yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 General] demoneg:
Did you extract the kernel offsets or can point me on how to do so :) ?

---------- Post added at 12:45 AM ---------- Previous post was at 12:39 AM ----------

Didn't work, I am on the older kernel, so code might need to be edited

MAIN: detected kernel version other than 3

MAIN: starting exploit for devices with waitqueue at 0x98

PARENT: soon will be calling WRITEV

CHILD: Doing EPOLL_CTL_DEL.

CHILD: Finished EPOLL_CTL_DEL.

CHILD: initial portion length 0x12000

CHILD: task_struct_ptr = 0x0

PARENT: writev() returns 0x13008

PARENT: Reading leaked data

CHILD: task_struct_ptr = 0x0

CHILD: Finished write to FIFO.

CHILD: **fail** problematic address pointer, e.g., 0

MAIN: **fail** retrying

PARENT: soon will be calling WRITEV

CHILD: Doing EPOLL_CTL_DEL.

CHILD: Finished EPOLL_CTL_DEL.

CHILD: initial portion length 0x12000

CHILD: task_struct_ptr = 0x0

PARENT: writev() returns 0x13008

PARENT: Reading leaked data

CHILD: task_struct_ptr = 0x0

CHILD: Finished write to FIFO.

CHILD: **fail** problematic address pointer, e.g., 0

MAIN: **fail** retrying

PARENT: soon will be calling WRITEV

CHILD: Doing EPOLL_CTL_DEL.

CHILD: Finished EPOLL_CTL_DEL.

CHILD: initial portion length 0x12000

CHILD: task_struct_ptr = 0x0

PARENT: writev() returns 0x13008

PARENT: Reading leaked data

CHILD: task_struct_ptr = 0x0

CHILD: Finished write to FIFO.

CHILD: **fail** problematic address pointer, e.g., 0

MAIN: **fail** retrying

Failed to leak data: error

1|maverick:/data/local/tmp $ uname -a

Linux localhost 4.4.146+ #1 SMP PREEMPT Wed Aug 14 00:34:21 UTC 2019 armv8l
[Fire HD 8 and HD 10 General] SweetBearCub:
After toggling that setting on, I got no joy. Of course, I didn't expect it to be that easy.

sudo fastboot oem unlock
FAILED (remote: the command you input is restricted on locked hw)
[Fire HD 8 and HD 10 General] Supersonic27543:
So it looks like the older version is not vulnerable to CVE-2019-2215 either... thank you for testing!

Can someone please try running the attached binary? (It is a different exploit, the device should crash and reboot if it's vulnerable, if it's not it should either output an error message or output nothing) Although I don't see any way it can damage the device at all because it only deals with kernel memory, run at your own risk. Good luck!
[Fire HD 8 and HD 10 General] BXM500:
Is there a way to format the microSD card so it supports files over 4GB but also gets recognized by the tablet?
[Fire HD 8 and HD 10 General] davidsummers:
Probably ext4 should work.

Edit: Just tried ext4 - didn't work, tablet set not recognised. bit odd as kernel supports ext4

---------- Post added at 11:34 PM ---------- Previous post was at 10:54 PM ----------

OK, just put 64bit mtk-su on an sd card, and moved to the device. This was the only way to have +x set. But can't execute - it says Permission denied:
[Fire HD 8 and HD 10 General] davidsummers:
Oh did you manage to toggle OEM unlocking? For me it always jumped pack to unset.

Yes I get the same response to oem unlock (note though I don't need to be sudo to run it ...(
[Fire HD 8 and HD 10 General] DB126:
OEM unlock toggle is useless on stock FireOS ROM and should never have been exposed.
[Fire HD 8 and HD 10 General] diplomatic:
// begin late reply

Hmm... technically that's true. But I think MTK is in a different class than others. Security does not seem to be a primary concern for them. MTK vulnerabilities seem to be more "down to earth" than other mainstream vendors. (Although I say that without knowing a lot about other platforms.) A lot of the weaknesses I've seen do take work for hackers to discover and leverage. But as for the engineers working on those hw/sw designs, my reaction is, "they can't be serious about this...stuff". A lot of these vulnerabilities should have been obvious to them. They spent so much time specifying, writing code, testing, etc, and it never once occurred to any involved MTK employee that, for example, a feature could be used for a different purpose that defeats security?

// end late reply
[Fire HD 8 and HD 10 General] TheFool131:
Not sure if anyone has mentioned or figured out that this is a 64 bit device but it can only run 32 bit applications? Does it even matter with regards to rooting it?
[Fire HD 8 and HD 10 General] AmznUser444 Dev:
Can you check the apps with GCM permissions in Google Play Store.
[Fire HD 8 and HD 10 General] DB126:
Siloed development, QA, recycled code and program (management) priorities are the likely culprits. In stream "engineers" (more likely contracted resources with lesser credentials) may very well have raised 'flags' only to be ignored or overridden by those watching timelines and budgets. It ain't what you think in the trenches and will remain that way until a wide-spread nafarous exploit (think Spectre or Stagefright) ruins the party. The minute community leveraging existing MTK vulnerabilities and the methodologies required to successfully execute exploits are insufficient incentives to drive retroactive remediation.
[Fire HD 8 and HD 10 General] BXM500:
Yes, this is strange. It means no storage for files over 4GB on sd card. :(
[Fire HD 8 and HD 10 General] davidsummers:
Haven't yet had time to look into it closer. Part of the difficulty is as an "adb shell" you only get the shell (id=2000) user rights, and they are *very* limited. This I think will make it hard doing things from the shell (e.g. mounting an ext4 sd card by hand, and seeing what the problems are).

Anyway as much of the file system is ext4 based, I guess you could "adb push" a big file.

What files do you have that are over 4GB anyway? Even my movies files are typically less than a GB, my guess is you'll need a blueray movie to get over 4GB!
[Fire HD 8 and HD 10 General] jcp2:
I had to format my 128gb card as internal with the tablet in order to transfer files >4gb. I know it sucks that now it's not removable, but the transfer speed from PC to tablet was surprisingly fast :)
[Fire HD 8 and HD 10 General] BXM500:
I guess I'll wait for LineageOS or some other solution. Not fan of adoptable storage for my tablet.
[Fire HD 8 and HD 10 General] jcp2:
Yeah, until the 9th gen gets root and custom ROM, the only way for >4gb files is adoptable internal :(
[Fire HD 8 and HD 10 General] diplomatic:
Temp Root Accomplished (FireOS 7.3.1.0)

Great news for root-bound enthusiasts: thanks to [MENTION=8247486]dr_docdoc[/MENTION] and probably some missed deadlines on Amazon's/MTK's part, we found out the shipping Fire OS 7.3.1.0 is accessible to mtk-su. I will be posting a compatible version soon. But for now I just wanted to warn people to block firmware updates when you receive your tablet if you want to get temp root or bootless Magisk root.....
[Fire HD 8 and HD 10 General] jcp2:
Damn. I updated to 7.3.1.1, 3 weeks ago :(
[Fire HD 8 and HD 10 General] dr_docdoc:
Fire HD 10 2019 - SUCCESSFULLY ROOTED!!!!

Hey guys . . . guess WHAT???????

Well, just see the attached picture . . . it's worth more than 1000 words!

So, can I honestly say I'm the first consumer in the world with a rooted Fire HD 10 2019? Sorry, my narcissism is getting the best of me. All credit goes to [MENTION=8132642]diplomatic[/MENTION] - thanks for giving me a SUCCESSFUL Sunday project.
[Fire HD 8 and HD 10 General] SweetBearCub:
I'm still on 7.3.1.0, and I anxiously await temp root!

Then, what to do with it?
[Fire HD 8 and HD 10 General] CaptR3dBeard:
Good news indeed. Mine will be delivered today. I'm hoping they are still shipping with the same build.
[Fire HD 8 and HD 10 General] dr_docdoc:
Keep me posted on what OS build you get on a newly ordered device.
[Fire HD 8 and HD 10 General] diplomatic:
mtk-su for OS 7.3.1.0

I just uploaded the latest mtk-su (a thing that gives you temp root) in the Temp root thread. It only supports the original OS. No solution yet for the updated version, but hoping a downgrade or unlock method will be found.
[Fire HD 8 and HD 10 General] SweetBearCub:
Thanks [MENTION=8132642]diplomatic[/MENTION] and [MENTION=8247486]dr_docdoc[/MENTION]!

A few questions.

What are the exact ADB commands to accomplish these? I don't want to push a file into the wrong folder or play with in-related permissions accidentally, for example.

1. Push mtk-su to /data/local/tmp
2. Give exec permissions to mtk-su
3. Run ./mtk-su

Next, how long does this temp root last? Until reboot?

Lastly, other than installing Magisk, what can we use this temp root to do?
[Fire HD 8 and HD 10 General] CaptR3dBeard:
as of today (12/15/19)... still shipping with 7.3.1.0

imgur. com/dDOqEND
[Fire HD 8 and HD 10 General] bibikalka:
Impressive work as always !!! Too bad black Friday is behind us :(
[Fire HD 8 and HD 10 General] Supersonic27543:
Great, yet another device nailed by mtk-su, thanks to [MENTION=8132642]diplomatic[/MENTION] (and Amazon/MTK)! Now that we have temp root, we should be able to dump the preloader/LK/TZ from the factory firmware, I hope that it will be vulnerable to some bootrom exploit! (It could even be vulnerable to amonet, and I think it is very likely that it is vulnerable to kamakiri) I don't know how the bootrom exploits works though, maybe someone who does can help us out here. (If what I know about those are right, having temp root should allow us to use the exploits without hardware-level modifications)

Also a word of caution to those who install Magisk, be extremely careful about what you do with the root privileges. It is not hard to accidentally write something to a verified partition (like system or boot, I think some apps do that without any warning when you give them root privileges) and there's NO WAY to recover your device if you do because we don't have a bootrom exploit to unbrick yet (Amazon removed the ADB reflash option) and you'll have to return the device.

Good luck! :)
[Fire HD 8 and HD 10 General] HeaDekBatHblu:
Waiting for TWRP, because device support Project Treble ARM64 A or ARM_binder64 A (don't know yet, without trying to flash ARM64 A GSI rom), and with Treble this tablet seems very hot deal :)
[Fire HD 8 and HD 10 General] AmznUser444 Dev:
The USB-C port on newest Fire HD 10 has an UART connection
[Fire HD 8 and HD 10 General] fanavity:
Damn my tablet updates automatically to 7.3.1.1 at the initial process. I hope it will be possible to downgrade the os :)
[Fire HD 8 and HD 10 General] davidsummers:
mtk-su_r19.zip

OK using mtk-su_r19.zip

the arm executable gives:

the arm64 executable gives

is r19 the right one to use?
[Fire HD 8 and HD 10 General] SweetBearCub:
Before ordering my tablet, I read in other places on the forum that you had to be very careful when ordering the tablet, and on the order page, uncheck the option to link the tablet to your account, which would stop it from logging into WiFi via passwords saved to your Amazon account.

Upon receiving it, cancel the setup by selecting a password protected WiFi, backing out of entering the password, and clicking on the "Skip setup" option that would then appear. Then, once you're in the OS (still not connected to WiFi), enable developer options and ADB debugging, and use the pm disable commends to set various updater packages to disabled. (Fire Toolbox can help)

Without doing these things, at a minimum, the tablet would try to update itself.
[Fire HD 8 and HD 10 General] CaptR3dBeard:
No, download the one from this thread

https://xdaforums.com/hd8-hd10/orig...hd-8-hd-10-t3904595/post81211881#post81211881
[Fire HD 8 and HD 10 General] dr_docdoc:
So I just read up on Project Treble. Seems like it allows stock Android on top of driver code for the device hardware. Is that what you're expecting here? To be able to install stock, virgin Android OS on this device with all the hardware having the drivers through this Project Treble architecture?

If not (and even if so) could you explain a little more about why you think Project Treble will be a "very hot deal," as you suggested? I'd like to learn more!

Thank you!
[Fire HD 8 and HD 10 General] diplomatic:
Great point! My intention for the bootless root method is to use it only if you have some way to recover the software outside of the OS. So for this tablet, this is all done at fairly significant risk. But that being said, there are some safeguards built in. For example, the boot partition device file is obfuscated so that you can't easily install a Magisk update to it. Also, the system/vendor partitions with verity enabled cannot be easily mounted with write access, which is standard behavior. I recommend only starting Magisk on demand and carefully monitoring what is being done with root access.
[Fire HD 8 and HD 10 General] newnewcomputer:
it works!!!

me 3/4/5 or whatever - gained temp root on Fire OS 7.3.1.0 w/ [MENTION=8132642]diplomatic[/MENTION] new mtk! :D

also installed Magisk following his guide but the limitations:

"

Cannot modify boot partition unless bootloader is unlocked

Cannot modify system/vendor partitions unless boot partition is altered

"

glad i read that cuz' the very 1st thing i wanna do w/ root was to rename com.amazon.device.software.ota but that file is in /system

its currently dis-abled by the pm disable-user command but my understanding is that Fire OS can override that. permanent sol'n is to rename that package. Because the temp root only works for 7.3.1.0, if an OTA update slips by, Magisk's root access will be gone!

now that i see how important it is to NOT allow the OTA, i might just keep my HD 10 2019 in airplane mode till its BL is unlocked!

thanx again to [MENTION=8132642]diplomatic[/MENTION]!!!

edit: just saw the post above - do u read minds too?! lol
[Fire HD 8 and HD 10 General] diplomatic:
7.3.1.0 Images

So here are some images extracted from the stock 7.3.1.0 FW, courtesy of [MENTION=8247486]dr_docdoc[/MENTION]. I trimmed the extra partition data. It would be great if [MENTION=7104332]k4y0z[/MENTION] or [MENTION=9667509]xyz`[/MENTION] could take a look at them.
[Fire HD 8 and HD 10 General] MontysEvilTwin:
How about the command "pm uninstall -k --user 0 <name of package>"? I know this will disable system apps because it was possible to use this command without root up until Fire OS 5.4.0.0, but does not delete the package from the system folder. It would be good to get opinions on this as I CANNOT GUARANTEE that this will not trigger DM-Verity.

---------- Post added at 01:59 AM ---------- Previous post was at 01:52 AM ----------

Is there likely to be any possibility of downgrading OS 7.3.1.1 to OS 7.3.1.0? Or is root going to be dependent on a bootloader unlock becoming available? I presume it is not possible to use a non-hacked fastboot to revert to the earlier version?
[Fire HD 8 and HD 10 General] diplomatic:
I can't tell you much about that yet. It would probably depend on whether there is a boot-ROM exploit to be found. Well, both downgrade and standard root would depend on that. And that's not really my department. :)
[Fire HD 8 and HD 10 General] newnewcomputer:
good point - pm uninstall likely will not trigger DM-Verity but not sure myself either. more importantly how effective it is depends on how Fire OS re-enables/re-installs those packages n we dont know that :(

i do remember the disable system apps capability in 5.3.0.0 as i have a HD 8 running just that! OTA updates n amazon ads never come back for 2+ yrs - i have to go home to check n see if that was done via pm uninstall, disable, or hide command.
[Fire HD 8 and HD 10 General] archos5005:
YES! I love the speed on it, but would rather have a a fully Google Tablet, not FireOS. How is the best way to be updated the moment a stable root/lineageOS is released for the new 2019 10" fire?
[Fire HD 8 and HD 10 General] DB126:
Will not trigger dm-verity exception as nothing is uninstalled (changed) in the system partition.

---------- Post added at 12:46 PM ---------- Previous post was at 12:44 PM ----------

Follow this thread and related topics in XDA.
[Fire HD 8 and HD 10 General] davidsummers:
doah - no luck for me:

I guess mine must have been updated, as its been on wifi here. How do I check? Anyway hopefully now that root has been achieved once, ways to unlock others with be found ...
[Fire HD 8 and HD 10 General] peachpuff:
nm...
[Fire HD 8 and HD 10 General] CaptR3dBeard:
Settings>Device Options>System Updates
[Fire HD 8 and HD 10 General] davidsummers:
Odd - that goes back to the settings menu for me!
[Fire HD 8 and HD 10 General] SweetBearCub:
As far as I know, that means that you have at least 1 of the 3 possible OTA apks disabled. Not sure which one, though, off the top of my head.
[Fire HD 8 and HD 10 General] bobjackson.other:
got my fire hd 10 today. 7.3.1.0 installed by default. device downloaded the 7.3.1.1 right away. it is no currently installed, but device indicates it will install later automatically. how do i prevent this or delete the update file
[Fire HD 8 and HD 10 General] dr_docdoc:
This happened to me, too.

Go into reset menu option and do a full system reset (reinstall fresh system wiping everything).

If update didn’t happen, then it will reinstall 7.3.1.0.

From there, be sure to block the OTA services as outlined in earlier post (I think #147) BEFORE you log in to a WiFi router. That’s working for me so far.
[Fire HD 8 and HD 10 General] bobjackson.other:
i logged in as root, went to /data/ota_package and deleted what looked to be the bin file update as well... going to make really sure... any updates on lineage movement with the temp root? seems like the thread has quieted down a lot!

keep up the good work people!
[Fire HD 8 and HD 10 General] voidling42:
Skipping initial setup without OTA update

I also tried to avoid the update and was successful by accident... thought I let you know how:

Usually the setup wizard forces you to connect to a wifi before it lets you proceed to the launcher. I was very carefully trying to figure out what to do on my firewall so I would be able to avoid the OTA update. As I am not an expert in tcpdump, mitmproxy and so on, this took a few tries. After the third time connecting to a wifi without access to WAN (aka the internet) it let me skip the remainder of the setup process.

So thanks to my guest wifi without internet access and not registering the tablet to my amazon account at checkout, I now have 7.3.1.0 Fire HD10 tablet that never accessed the internet.

It may well be that failing to set up a wifi for a few times also allows you to skip the initial setup process.
[Fire HD 8 and HD 10 General] SweetBearCub:
For everyone who needs to know how to avoid any OS updates:

- When you buy the tablet on Amazon's site, make sure and uncheck "Link to my Amazon account to simplify setup". This prevents it from logging into to any WiFi networks that you have saved previously.

- If you didn't do this when you bought the tablet, then disable your WiFi before powering on the tablet, or get out of range of it.

- Setup will direct you to connect to a WiFi network. Pick one with a password, and get to the password entry screen. Do not connect! Back out. A "Skip setup" option will appear under the list of networks, click it.

- Enable developer options, (Settings, Device Options, About Fire Tablet, tap repeatedly on serial number, watch for toast notification, back out to Device Options, Developer Options will be second to last option) and ADB debugging.

- Connect the tablet to ADB on your PC. Type "adb devices", without quotation marks, and press Enter. Make sure and authorize the connection on the tablet's screen.

- Execute the following commands one at a time in the same folder where you downloaded ADB, and watch that there are no errors:

adb shell pm disable-user --user 0 com.amazon.kindle.otter.oobe.forced.ota
adb shell pm disable-user --user 0 com.amazon.device.software.ota
adb shell pm disable-user --user 0 com.amazon.device.software.ota.override

Without quotation marks, type "Exit" and press Enter. This will close the command line/terminal.

Done. You may now safely connect to WiFi. Understand that these disable commands may not be permanent, and Amazon could override them at any time.
[Fire HD 8 and HD 10 General] HeaDekBatHblu:
Treble give us a chance install any custom treble rom to Maverick, without special compiling for Maverick. Need only recovery, and optimized to architecture treble rom.

So, that mean we may to install any type of custom rom like pixel experience, miui, emui, Samsung or Xperia-like roms and other. Need only working recovery, restore stock rom method (on case of something going wrong), and check our architecture, ARM64 A or ARM_binder64 A

More you may read in XDA threads of Project Treble
[Fire HD 8 and HD 10 General] DB126:
Of the three commands listed the only one needed is:

adb shell pm disable-user --user 0 com.amazon.device.software.ota

As noted by [MENTION=756172]SweetBearCub[/MENTION] disabling components in this manner is easily reversible - although there is no evidence Amazon is actively doing this with more recent devices and/or FireOS builds. Time will tell.
[Fire HD 8 and HD 10 General] AmznUser444 Dev:
Fire tablet has an adaptive battery features?
[Fire HD 8 and HD 10 General] DB126:
Adaptive battery? What the heck is that??
[Fire HD 8 and HD 10 General] AmznUser444 Dev:
Adaptive battery was added in Android 9 Pie.

Adaptive battery can be save the battery life and optimize your device's battery from app backgrounds.
[Fire HD 8 and HD 10 General] DB126:
Interesting! My other devices running Android 9 do not expose this toggle in the main settings. However, the tuning component (standby apps) is can be found under Developer Options demonstrating that is available and running.

Will be interesting to hear what HD10 owners find; likely exposed only under Developer Options.
[Fire HD 8 and HD 10 General] grantdb:
There is a setting i haven't seen before in Dev options called Background check...

Haven't found much info on this.

Edit: I have the HD 10 (9th gen) 2019
[Fire HD 8 and HD 10 General] ToroXp:
Greetings, everyone,

I've been following you for several days, ever since I bought the new Fire 10 at Black Friday.

I must say that I am totally incompetent in terms of rooting android, although I would love to learn how to do these things.

I'm following this thread trying to figure out what to do, and the first thing I wanted to do was to try to block the ota.

I installed the Fire Tool v6.4 on my pc and tried using the adb function to give the command block ota.

I was told that there was no adb installed.

So I installed this

https://xdaforums.com/android/general/tool-adb-fastboot-installer-tool-windows-t3999445

once installed with my tablet connected the tablet screen went into fastboot mode.

Seeing something always installed from the window of before I tried to give the command again without result.

The tablet was locked on fastboot, at this point I followed this procedure

Follow these steps exactly to ensure you are doing it in the most effective manner possible.

Hold down the power button on your Fire tablet for 20 seconds until the screen goes black.

Wait a couple of seconds.

Turn the Fire on again with the power button.

at this point the tablet is turned off and reopened.

I wouldn't want to bother anyone with my ignorance on the matter, but could some pious soul tell me how to perform step by step the procedure to block the ota?

at the moment my tablet mounts original firmware, and it has never been connected to wifi.

I thank everyone who will want to help me, I cheer for you that you can unlock this small tablet.
[Fire HD 8 and HD 10 General] Rxbird87:
FWIW check amazon warehouse. $30-$35 when they come in stock. Over the past two weeks I have gotten over 12 tablets. They all came looking fresh. It is in the brown certified refurb box.
[Fire HD 8 and HD 10 General] AmznUser444 Dev:
Can you launch the Android battery settings activity using Activity Launcher from Google Play store.

And find Adaptive Battery.
[Fire HD 8 and HD 10 General] AmznUser444 Dev:
I will patch this boot image from Magisk Manager app.
[Fire HD 8 and HD 10 General] DB126:
Well, probably not contemporary HD10s at this price point (certainly not the 2019 varient). More likely HD8s. Still a good deal; I get most of my Amazon gizmos from the Warehouse. No duds to date.