yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 General] diplomatic:
Testers needed

OK guys, so I added some code that meticulously autodetects more platforms, which in turn should support a lot more devices. This includes phones that came out with kernel 3.10 and 3.18.19. However, it's possible it may have broken the compatibility of already compliant devices. Can someone please post the results of

both arm64 and arm

versions of the attached file on the following devices? These are both confirmed and new. If it succeeds, you can just copy the first line of output, that says "param1... param2... type..." which is what's important to me.

Any Fire HD 8 ([MENTION=4519203]NFSP G35[/MENTION] ?)

Fire TV 2 ([MENTION=4556232]el7145[/MENTION] ?)

An MT67xx phone with kernel 3.10.x ([MENTION=9737660]AccountForXDA[/MENTION]? I believe your MT6735 phone qualifies)

An MT67xx phone with kernel 3.18.19 ([MENTION=5437200]PizzaG[/MENTION]? I believe that's your friend's phone type)

I'll cross out these devices as I get your results. Really appreciate your help!

EDIT: Moved to OP as Release 7
[Fire HD 8 and HD 10 General] Rortiz2:
I try it on my bq?

Enviado desde mi Mi A2 mediante Tapatalk
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=8978978]Rortiz2[/MENTION]: that'd be great! If your kernel is less than 3.18.35, I think it's actually the same as the the HD 8 in terms of mtk-su functionality.
[Fire HD 8 and HD 10 General] AccountForXDA:
No luck with the 20190316 mtk-su version. Output from arm:

shell@HWLYO-L6735:/data/local/tmp $ ./mtk-su -v
param1: 0x1000, param2: 0x8040, type: 6
Building symbol table
Error in find_kallsyms_addresses()
Unable to get kernel symbol table
New UID/GID: 2000/2000
starting /system/bin/sh

arm64

/system/bin/sh: ./mtk-su: not executable: 64-bit ELF file

And my kernel version

shell@HWLYO-L6735:/data/local/tmp $ cat /proc/version
Linux version 3.10.65+ (jslave@WUH1000100514) (gcc version 4.8 (GCC) ) #1 SMP PREEMPT Tue Aug 21 23:40:44 CST 2018
[Fire HD 8 and HD 10 General] erono:
Fire HD 8 (2016)

Root succesfully.

But the sh script can't run as root.

Failed on 'mount -o remount,rw /system'.

When I wait more than 30 minutes, It succeeded again.

I have not changed anything.

adb push files\mtk-su /data/local/tmp/
adb push files\install-su.sh /data/local/tmp/
adb shell "chmod 755 /data/local/tmp/mtk-su"
adb shell "chmod 755 /data/local/tmp/install-su.sh"
adb shell "/data/local/tmp/mtk-su -v -c /data/local/tmp/install-su.sh"

param1: 0x3000, param2: 0x10000
Building symbol table
kallsyms_addresses pa 0x40afc100
kallsyms_num_syms 67998, addr_count 67998
kallsyms_names pa 0x40b80f00, size 817197
kallsyms_markers pa 0x40c48800
kallsyms_token_table pa 0x40c49100
kallsyms_token_index pa 0x40c49500
Patching credentials
init_task va: 0xffffffc000f0aa20
Possible list_head tasks at offset 0x338
0xffffffc0030c8338 0xffffffc0218bc838 0x000000000000008c
comm offset 0x5a8 comm: swapper/0
Found own task_struct at node 0
real_cred: 0xffffffc0031af680, cred: 0xffffffc0031af680
Parsing sel_read_enforce
Found adrp instr at offset 4
ADRP x0, 0xffffffc001062000
Found ldr instr at offset 28
LDR [x0,4092]
selinux_enforce VA is 0xffffffc001062ffc
Setting selinux_enforce
Switched selinux to permissive
New UID/GID: 0/0
starting /data/local/tmp/install-su.sh
mount: Permission denied
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=9737660]AccountForXDA[/MENTION], is your kernel 32-bit? Because it needs a 64-bit kernel to work. I think you can check with "uname -a" for "aarch64" tag, but it might just print the cpu architecture.

[MENTION=4833261]erono[/MENTION], sometimes it does not disable selinux successfully. You can check with the 'getenforce' command. If still Enforcing, 'exit' then try again.
[Fire HD 8 and HD 10 General] :
It looks like the 3-13 test file, even though run multiple times with errors, disabled selinux on his phone. Thats a decent step forward. Hes about to run the 3-16 file now. Any other way to get easy root with selinux disabled?

UPDATE:. Bravo, you are a genius. Hit paydirt with you newest file. First try he got 0/0. You are a monster dude, mad kudos. This phone was locked down tight

---------- Post added at 05:27 PM ---------- Previous post was at 05:13 PM ----------

Apparently having an issue getting system mounted rw
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=5437200]PizzaG[/MENTION]: LOL.... thrilled to hear that, man!

If his phone has dm-verity, he won't be able to remount /system that easily.

Question: did he try both arm and arm64? And on the first line, what # is the type?
[Fire HD 8 and HD 10 General] :
I,m not sure. Im not at home and copy paste isnt working on my phone. Ill post his output when i get home and get you that info

Edit: This is his output.

shell@ELSA6:/ $ cd /data/local/tmp

shell@ELSA6:/data/local/tmp $ ./mtk-su -v

param1: 0x1000, param2: 0x8040, type: 7

Building symbol table

kallsyms_addresses pa 0x40ba4d00

kallsyms_num_syms 55416, addr_count 55416

kallsyms_names pa 0x40c11200, size 654426

kallsyms_markers pa 0x40cb0f00

kallsyms_token_table pa 0x40cb1600

kallsyms_token_index pa 0x40cb1a00

Patching credentials

__ksymtab_init_task not found

Parsing copy_process

Found dmb ish instr at offset 2236

Found adrp instr at offset 2252

ADRP x3, 0xffffffc000f36000

Found add instr at offset 2260

ADD xd, x3, 2384

init_task va: 0xffffffc000f36950

Possible list_head tasks at offset 0x340

0xffffffc003061340 0xffffffc08a280340 0x000000000000008c

comm offset 0x5d0 comm: swapper/0

Found own task_struct at node 0

real_cred: 0xffffffc078203300, cred: 0xffffffc078203300

Parsing sel_read_enforce

Found adrp instr at offset 4

ADRP x0, 0xffffffc001124000

Found ldr instr at offset 28

LDR [x0,36]

selinux_enforce VA is 0xffffffc001124024

Setting selinux_enforce

Switched selinux to permissive

New UID/GID: 0/0

starting /system/bin/sh

shell@ELSA6:/data/local/tmp # id

uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats) context=u:r?s0
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=5437200]PizzaG[/MENTION], ok awesome. So do both arm and arm64 versions give the same results? I ask because their internal behavior has to be different on that chip type and I'd like to know if I did it right...
[Fire HD 8 and HD 10 General] :
Apologies, I forgot you had asked that. I sent him the arm64 version.

Did you want him to try the arm version as well? If so, I can get that info to you ASAP tomorrow. He had to go to bed for the night, lol. Didn't even get it perm root yet. Tomorrow it'll be pwnd though thanks to your top notch devotion.

You don't understand what you've done. You've blown the MTK rooting scene wide open IMHO. This MT6753 has Android 6, kernel 3.18.19, and an August 18th security patch stamp. August wasn't too long ago.........
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=5437200]PizzaG[/MENTION], yeah, try the arm build too if you guys don't mind. If it works, I don't need the whole output. Just the first line, with "param1...", etc.

Oh, I'm dead serious about this thing supporting the vast majority of 64-bit MTK chips. I wasn't kidding about that headline in the OP. It does/will support that range of chipsets. And to add to that, this hole may not be that easy to seal. I used to think it would only need a straightforward patch. But now that I've learned more about it, I believe they would have to overhaul a bunch of stuff to fix it.

And do be careful about installing permanent root. Getting temp root doesn't automatically give you the ability to install a root manager. I don't know if your friend knows about dm-verity, but it makes it pretty easy to brick a phone with this tool if there is no recovery method...
[Fire HD 8 and HD 10 General] :
Don't worry my friend, I don't ever mess with a phone unless I have solid access to a stock rom and a way to flash it. Luckily I have Alcatel software with access to a vast majority of the Alcatel mtk devices, with the ability to swap out the stock recovery for twrp during the factory flash, lol. That only works for factory unlocked bootloader models though far as i know. its also able to downgrade little kernel files(where fastboot lives) for models that lost fastboot access due to an update, but the older fastboot enabled little kernel is available to download. As was the case for my Alcatel Tetra 5041C MT6739 device. Bought it from the store with no fastboot, luckily the older update rom was available with fastboot enabled little kernel.

Please update the list of working devices if you would. Get a nice documented area, maybe kernel versions and such......

All up to you of course, just an idea.

So you know, the MT6738, Kernel version 3.18.35+, android 7.0, security patch 11-1-2017, phone model: Alcatel 5049Z(I'd bet the whole 5049 Model line works) can be confirmed working in one try, every try.

So you know, the MT6753, Kernel version 3.18.19, android 6.0, security patch 8-18-2018, phone model: Alcatel 5085Z(I'd bet the whole 5085 Model line works) can be confirmed working in one try, every try.

I will confirm or deny it working on the Alcatel 5041C, MT6739 tomorrow and report back.

I'll let you know about the arm version as well on the MT6753.

Great work, I'm spreading the word
[Fire HD 8 and HD 10 General] :
Still the same error for the MT6739
[Fire HD 8 and HD 10 General] 0mr1:
[MENTION=8132642]diplomatic[/MENTION], I tested mtk-su_20190316.zip on :

Device: Nokia 3 (TA-1032)

Chipset: MT6737

Kernel Version: 3.18.79+

Kernel Architecture: aarch64

Instruction Sets: arm64-v8a

Result:

C:\Users\SF>adb shell /data/local/tmp/mtk-su_20190316/arm64/mtk-su -v
Failed critical init step 1

P.S.: I also tested mtk-su_r2/3/4/5/6 with the same result.
[Fire HD 8 and HD 10 General] Colossus96:
Can any one pls elaborate on this?

After using this method can i install adaway & remove unnecessary system apps? If device is bricked is there any way to restore stock rom?
[Fire HD 8 and HD 10 General] Rortiz2:
Did you chmod the file?

chmod 0755 mtk-su
[Fire HD 8 and HD 10 General] 0mr1:
Yes
[Fire HD 8 and HD 10 General] diplomatic:
Hold on, I don't want to clutter this OP with non-Amazon devices. There is going to be a separate thread soon for Mediatek devices in general. This is where I will list the working devices from all vendors. I just need to work out some basic things first and make sure new functionality doesn't conflict with Amazon.

Cool! Good to know. Wait, so you have these other phones to test on? What were you waiting for? :) Can you please post the first line of output with "param1..." for arm & arm64 for both phones?

Yeah, I know. I don't know if the phones that came out with Oreo will work yet. I'm leaning toward yes. They need a different solution which I'm working on.

I see. If that phone was released with Oreo, it's probably in the same camp as Linux 4.4. We'll have to see if it works with a future update.
[Fire HD 8 and HD 10 General] 0mr1:
It was released with Nougat and is now on Oreo (8.1).
[Fire HD 8 and HD 10 General] diplomatic:
OK, gotcha... Then either way it could be the same issue...
[Fire HD 8 and HD 10 General] andyrauc:
5.3.2.1 Fire HD8 6th Gen

Hi

so my HD 8 has so many popups it as unusable. Amazon was unable to resolve the issue so they offered me a new device at a reduced price. the old unit can of course now not be registered as it has probably been blocked as it was supposed to be binned.

found your tread and was most excited. Successfully got ADB working and unfortunately seem to be stuck two steps from the end. Any ideas? From what I have read this exploit has been successful with my version.

shell@giza:/data/local/tmp # ./mtk-su -v

param1: 0x3000, param2: 0x18040

Building symbol table

kallsyms_addresses pa 0x40ad8f00

kallsyms_num_syms 67082, addr_count 67082

kallsyms_names pa 0x40b5c100, size 805834

kallsyms_markers pa 0x40c20d00

kallsyms_token_table pa 0x40c21600

kallsyms_token_index pa 0x40c21a00

Patching credentials

init_task va: 0xffffffc000edaa20

Possible list_head tasks at offset 0x338

0xffffffc0030c8338 0xffffffc02fff9a38 0x000000000000008c

comm offset 0x5a8 comm: swapper/0

Found own task_struct at node 1

real_cred: 0xffffffc00972a600, cred: 0xffffffc00972a600

Parsing sel_read_enforce

Found adrp instr at offset 4

ADRP x0, 0xffffffc001030000

Found ldr instr at offset 28

LDR [x0,444]

selinux_enforce VA is 0xffffffc0010301bc

Setting selinux_enforce

Selinux is already permissive

New UID/GID: 0/0

starting /system/bin/sh

shell@giza:/data/local/tmp #
[Fire HD 8 and HD 10 General] :
No go on a MT6771 device.

Failed critical init step 1

---------- Post added at 01:40 PM ---------- Previous post was at 01:30 PM ----------

Can you got back to Android 7 and try again?
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=5437200]PizzaG[/MENTION], if it fails at step 1 and it's Oreo, you don't have to report it. What I could use is the first line of the output on the devices it does work on.

BTW, I'm still waiting for results of the test version in post 290. Can someone do a quick test on an HD 8 tablet and Fire TV 2 and post the first line of output? [MENTION=6680544]bibikalka[/MENTION]? [MENTION=4556232]el7145[/MENTION]? Then I can release it and move on to other things...
[MENTION=8978978]Rortiz2[/MENTION], have you tried it on your BQ tablet yet?
[Fire HD 8 and HD 10 General] :
[MENTION=8132642]diplomatic[/MENTION]

Output of the MT6753

param1: 0x1000, param2: 0x8040, type: 7

Output of the MT6738

param1: 0x3000, param2: 0x18040, type: 4
[Fire HD 8 and HD 10 General] el7145:
Sorry diplomatic, the fire tv2 went into my daughter's room and is now hard to get at...ill try to get access to it at some point in the next 24hrs, if u don't hear from me after that, send the police, lol
[Fire HD 8 and HD 10 General] :
looks like it worked to me
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=4556232]el7145[/MENTION], do you really need physical access to it? If it has adb enabled, just try it over the network from your PC.
[Fire HD 8 and HD 10 General] Rortiz2:
I could not because I have bricked the tablet and I have not yet managed to revive it. When I can I will try it.
[Fire HD 8 and HD 10 General] el7145:
[MENTION=8132642]diplomatic[/MENTION]

I stealthily went in over wifi connect, got a quick "segmentation fault"

C:\adb>adb push mtk-su /data/local/tmp/

409 KB/s (26232 bytes in 0.062s)

C:\adb>adb shell

shell@sloane:/ $ cd /data/local/tmp

shell@sloane:/data/local/tmp $ chmod 755 mtk-su

shell@sloane:/data/local/tmp $ ./mtk-su -v

Segmentation fault

139|shell@sloane:/data/local/tmp $

EDIT: just saw ur reply, LOL
[Fire HD 8 and HD 10 General] andyrauc:
5.3.2.1 Fire HD8 6th Gen

Was assuming that the last two lines of the output shown in the first post was also required. As I am a novice here I do not know how to proceed from here as I was expecting some change to my device. could you direct me to a post that will guide me to install a standard Android system?
[Fire HD 8 and HD 10 General] :
This just grants you temp root and disables selinux temporarily so that you can push permanent root to the device or whatever it is that you are planning to do with temp root. I'm pretty sure it's page 1 that has the SuperSU procedure to push that to your device. There is also a root script somewhere in this thread as well you could try. Always a good idea that you make sure you have acces and way to flash stock in case something goes wrong. This isn't a full root fool proof way. It's fool proof as far as temp root, what you do after that is on you. The uid0/0 says that you have root rights in the shell, which means it worked. Now you either need to push full root or find a way to debloat from root shell. Hope this helps clear it up for you.
[Fire HD 8 and HD 10 General] diplomatic:
Oh, my bad. That was the result of a last minute change I made after doing my last test. (But the arm version should have worked.) Can you please try again with this zip. And test both arm and arm64 binaries if you can. Thanks a lot!
[Fire HD 8 and HD 10 General] el7145:
[MENTION=8132642]diplomatic[/MENTION]

arm64

param1: 0x3000, param2: 0x18040, type: 1

arm

param1: 0x3000, param2: 0x18040, type: 1

looks like they both work on a FireTV2 sloane
[Fire HD 8 and HD 10 General] diplomatic:
OK, excellent! Appreciate the quick reply, [MENTION=4556232]el7145[/MENTION]. Now to just have someone successfully test it on a Fire HD 8, and I'll call it releasable.
[Fire HD 8 and HD 10 General] morgonhed:
This is not working for me on a Fire 10 running 5.3.6.4.

I can get root by running mtk-su and can copy su, libsupol.so and supolicy to their destinations, change their permissions and change the security context, but when I try to run "su" from a user-account it simply hangs (it works from root).

As a consequence (or so I believe) I cannot use e.g. Titanium Backup as it also hangs at "Detecting SU and BusyBox".

Any idea?
[Fire HD 8 and HD 10 General] NFSP G35:
2017 HD8

ARM

127|shell@douglas:/data/local/tmp $ ./mtk-su -v
param1: 0x3000, param2: 0x10000, type: 1
Building symbol table
kallsyms_addresses pa 0x40b07300
kallsyms_num_syms 67971, addr_count 67971
kallsyms_names pa 0x40b8c100, size 817035
kallsyms_markers pa 0x40c53900
kallsyms_token_table pa 0x40c54200
kallsyms_token_index pa 0x40c54600
Patching credentials
init_task va: 0xffffffc000f16a20
Possible list_head tasks at offset 0x338
0xffffffc0030c8338 0xffffffc0191d25b8 0x000000000000008c
comm offset 0x5a8 comm: swapper/0
Found own task_struct at node 2
real_cred: 0xffffffc026310f80, cred: 0xffffffc026310f80
Parsing sel_read_enforce
Found adrp instr at offset 4
ADRP x0, 0xffffffc001086000
Found ldr instr at offset 28
LDR [x0,4092]
selinux_enforce VA is 0xffffffc001086ffc
Setting selinux_enforce
Switched selinux to permissive
New UID/GID: 0/0
starting /system/bin/sh
shell@douglas:/data/local/tmp #

ARM64:

shell@douglas:/data/local/tmp $ ./mtk-su -v
param1: 0x3000, param2: 0x10000, type: 1
Building symbol table
kallsyms_addresses pa 0x40b07300
kallsyms_num_syms 67971, addr_count 67971
kallsyms_names pa 0x40b8c100, size 817035
kallsyms_markers pa 0x40c53900
kallsyms_token_table pa 0x40c54200
kallsyms_token_index pa 0x40c54600
Patching credentials
init_task va: 0xffffffc000f16a20
Possible list_head tasks at offset 0x338
0xffffffc0030c8338 0xffffffc027335f38 0x000000000000008c
comm offset 0x5a8 comm: swapper/0
Found own task_struct at node 2
real_cred: 0xffffffc05289c580, cred: 0xffffffc05289c580
Parsing sel_read_enforce
Found adrp instr at offset 4
ADRP x0, 0xffffffc001086000
Found ldr instr at offset 28
LDR [x0,4092]
selinux_enforce VA is 0xffffffc001086ffc
Setting selinux_enforce
Switched selinux to permissive
New UID/GID: 0/0
starting /system/bin/sh
shell@douglas:/data/local/tmp #

First try both times. Also repeated the process on my wife's 2017 HD8 as well, same success :good:
[Fire HD 8 and HD 10 General] diplomatic:
Fantastic! Thanks for testing both versions. Now I can work on the next problem.
[Fire HD 8 and HD 10 General] NFSP G35:
No problem, happy to help. Sorry I couldn't get to it earlier.
[Fire HD 8 and HD 10 General] coolloser:
Been trying on an RCA Galileo Pro MT8127, kernel 3.18.22, running 6.0. it has no way to access from the computer so I'm trying through a terminal. Can't copy the script to the tmp folder, or chmod, or run it from anywhere. Permission denied.

Anyway, here's the values from Fire hd 8 2018:

param1: 0x3000, param2: 0x18040, type: 1

64bit:

/system/bin/sh: ./mtk-su: No such file or directory
[Fire HD 8 and HD 10 General] diplomatic:
MT8127 not supported, [MENTION=2047101]coolloser[/MENTION]... not 64-bit.
[Fire HD 8 and HD 10 General] coolloser:
Ah, I didn't even check that part, was too excited to try! :eek:
[Fire HD 8 and HD 10 General] lifegap:
Thanks to the great work of [MENTION=8132642]diplomatic[/MENTION], I successfully rooted my HD8 2016 with permanent way, add SuperSu to manage the root. Then I ruined it by installing Magisk Manager to try Magisk 18.1 work or not (in order to flash Ainur Sauron audio mods to improve Fire HD 8 2016 sound: speaker too quite and headphone out also not loud). It made the Fire HD bootloop in Amazon logo. Have to sideload the stock rom from Amazon to get the Fire run then try to root it again. This time I faced a lot of error in command "mount -o remount -rw /system". It's always "permission denied". Try a lot tof times, with the support from SEMIAUTOMATEDROOT.zip then success rooted again. Then try to flash Ainur Sauron zip with flashfire. It stuck in Fire logo (last boot loop in Amazon logo) but luckily turn off/on can solve. Any suggesstion to get Ainur Sauron works? I have Ainur Sauron in my Android phone (flashed with Magisk) and its sound great.

BTW, I also have Xiaomi Box Enhanced with Mediatek MT8693 (64 bit system, Android 5.1). Will this software root works with MT8693?
[Fire HD 8 and HD 10 General] DoughMucker:
Same here. For a less secure workaround, change the Default Access setting in SuperSU from Prompt to Grant.
[Fire HD 8 and HD 10 General] Dan_firehd:
SuperSU access workaround for Fire devices

One can also try the following manual fix on SuperSU not prompting for root access :

SuperSU access workaround for Fire devices

https://xdaforums.com/hd8-hd10/general/supersu-access-workaround-fire-devices-t3738269
[Fire HD 8 and HD 10 General] andyrauc:
5.3.2.1 Firmware on Fire HD8 6th Gen

Everything executed perfectly from the Script and Supersu installed successfully on the kindle. However when it is run there is the message SuperSU Root Undetected. I read the rest of this forum bit it seems nobody has had this issue. Any ideas would be appreciated.
[Fire HD 8 and HD 10 General] lifegap:
I faced this several times when trying to root HD8 again after loosing root due to flashing Magisk. Try the script or the .Bat again and again, remove SuperSu again until opening su and it allow to update binary
[Fire HD 8 and HD 10 General] morgonhed:
This is (I believe) the way to do it.

Worked for me on a Fire 10.
[Fire HD 8 and HD 10 General] Rortiz2:
Output of my Aquaris M8:

shell@karin:/data/local/tmp $ cat /proc/version
Linux version 3.18.22+ (jenkins@bqbot6) (gcc version 4.9.x-google 20140827 (prerelease) (GCC) ) #1 SMP PREEMPT Tue Sep 18 16:29:44 CEST 2018
shell@karin:/data/local/tmp $ ./mtk-su -v
param1: 0x3000, param2: 0x18040, type: 1
Building symbol table
kallsyms_addresses pa 0x40a43000
kallsyms_num_syms 49221, addr_count 49221
kallsyms_names pa 0x40aa3400, size 602609
kallsyms_markers pa 0x40b36600
kallsyms_token_table pa 0x40b36d00
kallsyms_token_index pa 0x40b37100
Patching credentials
__ksymtab_init_task not found
Parsing copy_process
Found dmb ish instr at offset 2116
Found adrp instr at offset 2132
ADRP x3, 0xffffffc000cea000
Found add instr at offset 2140
ADD xd, x3, 2576
init_task va: 0xffffffc000ceaa10
Possible list_head tasks at offset 0x340
0xffffffc0030d8340 0xffffffc01fb0e140 0x000000000000008c
comm offset 0x5c0 comm: swapper/0
Found own task_struct at node 0
real_cred: 0xffffffc014cecb80, cred: 0xffffffc014cecb80
Parsing sel_read_enforce
Found adrp instr at offset 4
ADRP x0, 0xffffffc000dd9000
Found ldr instr at offset 28
LDR [x0,316]
selinux_enforce VA is 0xffffffc000dd913c
Setting selinux_enforce
Switched selinux to permissive
New UID/GID: 0/0
starting /system/bin/sh
root@karin:/data/local/tmp # getenforce
Permissive
root@karin:/data/local/tmp #
[Fire HD 8 and HD 10 General] xunair:
Successfully rooted my fire HD 8 7th gen

Thankyou Everyone

Anyway to install magisk n xposed?
[Fire HD 8 and HD 10 General] richaardvark:
Play Store Un-rooted my HD8/Uninstalled SuperSU... :-/

I just experienced something pretty frustrating - 24 hours after having followed your amazing root tutorial/successfully achieving root, the Play Store/Play Protect unrooted my device and removed SuperSU...! ???

I didn't want to rant on your wonderful post, so I started a new thread here - is this a fairly common situation/have others experienced this?

Thanks for any feedback on this!
[Fire HD 8 and HD 10 General] flaxstar:
Not sure about Magisk, but this is how I installed Xposed on mine: https://xdaforums.com/hd8-hd10/general/xposed-framework-fire-hd-8-6th-t3549043