[Fire HD 6 and 7 General] Rortiz2:
NOTICE: Full unlock method has been released. After installing TWRP using this thread's instructions, check this out to unlock your bootloader!​

Introduction:​

Given the abundance of outdated information on the forums, I have decided to create a thread for those who have acquired one of these tablets. Regardless of the FireOS version you have, this guide will help you downgrade, root, and install TWRP. Additionally, it includes optional instructions for installing custom ROMs or how to update to FireOS 5 while keeping root (& the ability to unbrick).

Make sure to read this guide completely before starting. It doesn't require you to open the tablet, however, you'll need a PC. This is only for Fire HD 6 / 7, 4th generation, also known as ariel or KFASWI.

You will lose all data on the tablet, make a backup of important data before you start. If you've enabled encryption, it's probably a good idea to disable it before you proceed with the guide.​

Requirements:​

A PC. Can use either Windows or Linux, but the latter is preferred

Micro USB cable to connect your tablet to the PC

Part I - Downgrading to FireOS 4.5.3:​

If you have recently purchased the tablet, whether from eBay or another source, it will likely come with the latest version of FireOS 5, which, as expected, is not rootable. If your device has 4.5.3, you can skip this section and go to part II.

To install TWRP and other customizations, we need root access. Fortunately, we can easily downgrade to FireOS 4.5.3 and then root the tablet without any issues. The procedure is simple, but requires ADB and a computer:​

1. Get the original FireOS 4.5.3 update.bin from Amazon (or use this mirror)

2. Install ADB & fastboot. Google is your friend, I'm not gonna get into details ;)

3. Reboot the tablet to Recovery mode. Use either ADB or Volume + and Power

4. Choose the 'apply update from ADB' option and connect the tablet to the PC

5. Open a terminal in the same folder where you downloaded the update and type:

adb sideload update-kindle-20.4.5.3_user_453011120.bin

6. This will downgrade to 4.5.3. Wait for it to finish and DON'T UNPLUG THE USB

7. Once the downgrade finishes, perform a factory reset through both 'wipe' options

8. Lastly, perform a reboot and wait for the device to boot. Once it does, skip the wizard

If you followed those steps correctly, you should have successfully downgraded to FireOS 4.5.3. It's crucial to skip the setup wizard and NOT CONNECT TO WIFI. Doing so could trigger an OTA download and potentially brick the device.​

Part II - Rooting:​

In the past, KingoRoot has commonly been used to root this device. However, this program is notorious for installing spyware and also poses the risk of updating the tablet during the rooting process. To address these complications, I have analyzed and extracted the KingoRoot rooting method to create a simpler, easier solution that does not require an internet connection :)

This process requires a computer and ADB. Additionally, you must enable USB debugging on the tablet. To do this, enable the developer options by tapping the tablet's serial number 7 times, then activate ADB:​

1. Download and extract CVE-2016-5195-ariel onto your PC.

2. Push the whole folder to the internal storage with ADB and copy the contents to the working directory (/data/local/tmp):

adb push CVE-2016-5195-ariel /sdcard/
adb shell "cp /sdcard/CVE-2016-5195-ariel/* /data/local/tmp/"

3. Give the corresponding permissions to all files with chmod:

adb shell "chmod 755 /data/local/tmp/*"

4.Time for the grand finale, run the exploit and hope for the best ;)

adb shell
cd /data/local/tmp/
./kingo ./mkdevsh

I haven't fully grasped what Kingo does yet, but from what I understand, it exploits the dirtycow vulnerability to replace and execute mkdevsh, a shell script that sets up and configures SuperSU. If successful, you will see something like the following upon completion:​

shell@ariel:/data/local/tmp $ ./kingo ./mkdevsh
star
shell@ariel:/data/local/tmp $ 4552
4555
4558
4561
4564
4567
...
6050
pkg: /data/local/tmp/SuperSU.apk
Success
kok

If it does not report ok as shown above (the numbers might differ, but the result must be a "Success" and "kok"), delete everything from /data/local/tmp/, perform a hard reboot of the tablet, and retry starting from step 2. This is a sample of the entire output that should be generated:​

Spoiler content hidden.

5. Confirm everything worked by getting to a root shell:

su

A SuperSU pop-up should appear, indicating that ADB is requesting superuser permissions. Simply confirm this request and verify that the $ symbol has changed to #:​

shell@ariel:/data/local/tmp $ su
root@ariel:/data/local/tmp # id
uid=0(root) gid=0(root) context=u:r:init:s0
root@ariel:/data/local/tmp #

6. Finally, open the SuperSU app. You will be prompted to update the su binaries. Click 'Continue' and select 'Normal'. This will complete the installation of SuperSU, and you will need to reboot afterwards​

Part II - Disabling OTAs + TWRP:​

1. Installing TWRP is optional but recommended. Open an ADB shell, type 'su', and then run the following command (extracted from the TWRP thread) to flash it:​

dd if=/data/local/tmp/twrp-3.0.2-0-ariel.img of=/dev/block/mmcblk0p7

2. Disabling OTAs is ESSENTIAL to prevent the tablet from auto-updating and becoming bricked. In the same shell as before, run the following commands:​

mount -o rw,remount /system
rm -rf /system/priv-app/DeviceSoftwareOTA.apk
pm disable com.amazon.otaverifier
reboot

If done correctly, after rebooting, attempting to check for updates should display 'Last update failed'. As for TWRP, you can use ADB or the volume + & power button combo to access it.​

Appendix I - Installing custom ROMs:​

Although it is not a well-known device, ariel currently has two custom ROMs available. These are LineageOS 11, based on Android 4.4 (developed by @ggow), and LineageOS 12.1, based on Android 5.1 (developed by me). Each has its pros and cons, but the installation should be done with TWRP.​

LineageOS 11.0:

​

1. Download the latest version of the ROM from its corresponding XDA thread

2. (optional) Download the adequate version of OpenGapps (ARM - 4.4 - pico)

3. (optional) Download and copy the latest version of SuperSU

4. Reboot the device to TWRP recovery and copy all the files to the internal storage

5. Go to Wipe and perform an advanced wipe of system, data and cache

6. Go to Install, flash the ROM, GAPPs (if wanted) and SuperSU (if wanted)

7. Reboot and wait for the device to boot :)

This ROM uses the bootloaders from FireOS 4.5.3, which means that TWRP will be normally accessible. If you wish to return to stock, it is important to first flash 4.5.3 and then SuperSU (to maintain root access) or, alternatively, flash one of my pre-rooted ROMs based on FireOS 5.​

LineageOS 12.1:

​

1. Download the latest version of the ROM from its corresponding XDA thread

2. (optional) Download the adequate version of OpenGapps (ARM - 5.1 - pico)

3. (optional) Download and copy the latest version of SuperSU

4. Reboot the device to TWRP recovery and copy all the files to the internal storage

5. Go to Wipe and perform an advanced wipe of system, data and cache

6. Go to Install, flash the ROM, GAPPs (if wanted) and SuperSU (if wanted)

7. Reboot and wait for the device to boot :)

This ROM uses FireOS 5 bootloaders, which means that TWRP will no longer be accessible and will be replaced by a Cyanogen Recovery based on 2ndinit. Despite this, it's important to note that 4.5.3 preloader is retained, allowing you to unbrick the device with aftv2tools if something goes horribly wrong ;). If you wish to return to stock, it is important to first flash 4.5.3 and then SuperSU (to maintain root access) or, alternatively, flash one of my pre-rooted ROMs based on FireOS 5.
​

Appendix II - Safe upgrade to FireOS 5​

If neither of the two custom ROMs suits your needs due to bugs or other reasons, you can install FireOS 5 while maintaining a vulnerable preloader, root access, and even install GApps.

This is as simple as flashing one of the following prerooted ROMs through TWRP, Cyanogen Recovery and (possibly) FlashFire (I haven't personally tested this, so do it at your own risk):​

Feb 18, 2022 - 5.3.6.2_r1 (marked as 5.7.0.0) | md5sum: 3156740c47b5d48889a98b7c71ff6283