[Root] Kindle Fire HDX 8.9 14.3.1

Search This thread

EniGmA1987

Senior Member
Sep 21, 2010
2,064
807
Good News Everyone! I made the required changes in source, and recompiled it for the Kindle Fire HDX 7". It worked for me at least! Here it goes:

http://goo.gl/4gBmq5

Be sure to rename the file to 'exploit', follow the instructions on the first post, and don't forget to thank jcase and fi01.

I get this when trying to root my 7" model:


attachment.php

Does the same thing using the official and latest Android SDK adb.exe.
 

Attachments

  • RootError.jpg
    RootError.jpg
    97.6 KB · Views: 6,715
Last edited:

Android Cowboy

Senior Member
Jan 17, 2012
307
111
androidcowboy.com
Please do not donate to me for this, it is not my original work. If you want to donate, I suggest finding a way to donate to fi01 (not aware of a way or if he accepts them) or donating to a charity. It is the holiday times, maybe a toys for tots or something similar. I know a lot of ppl dislike the salvation army, and I can't stand up with some of the things they do, but their toy donation program is good and they do get the toys to kids who really have no other option, maybe drop off some new toys? May be food to a food bank?

Source: https://github.com/hiikezoe/android_run_root_shell

Vuln:
https://www.codeaurora.org/projects...hecks-putusergetuser-kernel-api-cve-2013-6282

Exploit Source:
https://github.com/fi01/libput_user_exploit

Beaups compiled it at my request for you guys.

adb push su /data/local/tmp/
adb push rootme.sh /data/local/tmp/
adb push exploit /data/local/tmp/
adb shell chmod 755 /data/local/tmp/rootme.sh
adb shell chmod 755 /data/local/tmp/exploit
adb shell /data/local/tmp/exploit -c "/data/local/tmp/rootme.sh"

Thank you sire. I'm willing to offer up my KF HDX 7" for testing if we can get root done on that. Anything that could help let me know.
 

jzen

Senior Member
Oct 9, 2010
720
254
That's not entirely true. 1 Mobile Market only has free apps and a more limited selection. There's no way to get your paid apps from 1 Mobile Market. I had to side load my paid apps.

The playstation store is a free app and on 1 mobile market. Was referring to a comment someone made further back saying they wish they had 1 click root to try out the playstation app.... or maybe I was just high, sorry :x

Great work all on rooting the kindle hdx!
 
Last edited:

Android Cowboy

Senior Member
Jan 17, 2012
307
111
androidcowboy.com
Shure all framework, play services, account synch all of that as system apps. But after first start the Playstore allways FC

Gesendet von meinem Nexus 4 mit Tapatalk

This was stated earlier in the post: "I also have the Play Store working, which was just a matter of changing the ro.build.host to point to Google" I'm not sure where you find the ro.build.host file though and how to change it.
 

scaryshark

Senior Member
Jan 11, 2012
397
205
Can you explain what line to add to point to Google ?

Based on the Nexus 7 (2013) build.prop change the line to this:

Code:
ro.build.host=vpbs6.mtv.corp.google.com

Also,to block the update servers might be best to add the IP addresses that kholdstare mentioned to the hosts file in /system/etc/hosts with root.

Code:
72.21.194.208
176.32.100.136
72.21.195.233
 

cdub50

Senior Member
Jul 21, 2007
467
204
https://dl.dropboxusercontent.com/u/8699733/kindletest

test please, same directions as are in the OP, jsut change the exploit filename to kindletest

Yeah rooted and removed ads from lockscreen trying to figure out what amazon apps I need to freeze so that I wont get over the air updates. I renamed and moved /system/etc/security/otacerts.zip.

Anyone know what apps I need to freeze? Started with Remote Device Management and Silk Browser.

Thanks again!!! jcase for making the HDX that much better with root access.
 

Android Cowboy

Senior Member
Jan 17, 2012
307
111
androidcowboy.com
I am going to tak as many questions as possible, but will probably do something in the Q&A section to keep this clean. Right now, this is a manual adb exploit, though if you have a rooted device & USB OTG, you can use root transmission. Currently, it is fairly easy & straight forward, but you will need adb to utilize this root method. jcase said we could package it into a one click, but that is going to take some time.

At this point, there are no custome roms & there are no custom recoveries, just root access. I also have the Play Store working, which was just a matter of changing the ro.build.host to point to Google. Again, no easy way to do it yet. Since you are asking about "flashing" this, I would suggest you wait. Either that, or go back & read about some of the old root methods & how to use ADB. There is no flashing this file. You use ADB to push the files, & shell to change owner/permissions. You then run a script (again via adb) that moves the SU binary into xbin. Currently, there is still a bit of a trick to get SU going, but it is pretty easy if you understand the basics of ADB.

Really, what this means is that now the gates have been cracked & it is possible to start building recoveries, roms & all that good stuff.

In the WIP thread for Google apps it was mentioned that an Apps 1.0 apk may be responsible for passing data to Amazon Appstore which may need to to stopped.
 
Last edited:

LinearEquation

Senior Member
Aug 26, 2013
1,765
436
Midwest
IMy HDX 8.9 was on my doorstep today and as soon as I turned it on and it proceeded to install an update, or at least tried to. Since it doesn't tell you WHAT the update is it's sort of clinches your undies in a wad. I don't see a way to turn auto update off in the GUI. So, what's the verdict? Update or no? Because I'm guessing it's possible that, even if I root now, I could lose it by updating.

Props guys for getting us root so fast.

There is a topic on here that has the IP addresses that Amazon uses to update from. Add them to Droidwall or AdAway so your tablet never hears them. I believe it is in the 2013 KFHD 7" topic just made for rooting it.

Sent from my Amazon Kindle Fire HD running CM 11 KitKat 4.4 using xda app-developers
 

bruckner

New member
Jan 14, 2009
2
0
Word of caution: do NOT attempt to factory reset you rooted kindle fire. Did it on mine yesterday, it won't boot and I can't get adb.

Does that apply if nothing else than rooting happened on the device? Could it also happen if it catches an OTA update from Amazon?

Just in case, is/will there be a way to unroot?
 

fierce_brake

Senior Member
Jun 2, 2010
414
120
san salvador
Word of caution: do NOT attempt to factory reset you rooted kindle fire. Did it on mine yesterday, it won't boot and I can't get adb.

That sucks man! sorry about your device, and thank you for sharing !
hopefully you can get a replace from amazon ?

---------- Post added at 03:14 PM ---------- Previous post was at 03:11 PM ----------

Yeah, same happened to me. Factory reset is the worst thing to do. Totally kills adb and bricks it. I called Amazon and getting a replacement for now.

Sent from my Nexus 7 using Tapatalk

Did they ask for stuff before issuing the replacement ? or was it easy to get them to send it to you ?
 

Top Liked Posts

  • There are no posts matching your filters.
  • 44
    Please do not donate to me for this, it is not my original work. If you want to donate, I suggest finding a way to donate to fi01 (not aware of a way or if he accepts them) or donating to a charity. It is the holiday times, maybe a toys for tots or something similar. I know a lot of ppl dislike the salvation army, and I can't stand up with some of the things they do, but their toy donation program is good and they do get the toys to kids who really have no other option, maybe drop off some new toys? May be food to a food bank?

    Source: https://github.com/hiikezoe/android_run_root_shell

    Vuln:
    https://www.codeaurora.org/projects...hecks-putusergetuser-kernel-api-cve-2013-6282

    Exploit Source:
    https://github.com/fi01/libput_user_exploit

    Beaups compiled it at my request for you guys.

    adb push su /data/local/tmp/
    adb push rootme.sh /data/local/tmp/
    adb push exploit /data/local/tmp/
    adb shell chmod 755 /data/local/tmp/rootme.sh
    adb shell chmod 755 /data/local/tmp/exploit
    adb shell /data/local/tmp/exploit -c "/data/local/tmp/rootme.sh"
    9
    Bomb! You are the man!

    Bro, I am going to PM you shortly. I would like to thank you & fi01. I will donate to both of you, or if you both prefer, I will donate my original pledge of $150 for root in your names to whatever charity you think is appropriate. If this leads to an unlocked BL, I will double my donation, to the $300 I originally stated in the General/Kernel thread.

    If you notice my signature, I have an issue I have become intimately involved in, so if there is something near & dear to your two hearts, just let me know.

    PROOF OF ROOT:
    IMG_20131125_102749.jpg

    IMG_20131125_102829.jpg
    8
    Awesome! How did you flash it? Is there a stock recovery mode or did you have to use ADB? I'm not familiar with ADB at all, so I'm hoping for a simple way of flashing this.

    I am going to tak as many questions as possible, but will probably do something in the Q&A section to keep this clean. Right now, this is a manual adb exploit, though if you have a rooted device & USB OTG, you can use root transmission. Currently, it is fairly easy & straight forward, but you will need adb to utilize this root method. jcase said we could package it into a one click, but that is going to take some time.

    At this point, there are no custome roms & there are no custom recoveries, just root access. I also have the Play Store working, which was just a matter of changing the ro.build.host to point to Google. Again, no easy way to do it yet. Since you are asking about "flashing" this, I would suggest you wait. Either that, or go back & read about some of the old root methods & how to use ADB. There is no flashing this file. You use ADB to push the files, & shell to change owner/permissions. You then run a script (again via adb) that moves the SU binary into xbin. Currently, there is still a bit of a trick to get SU going, but it is pretty easy if you understand the basics of ADB.

    Really, what this means is that now the gates have been cracked & it is possible to start building recoveries, roms & all that good stuff.

    ---------- Post added at 11:21 AM ---------- Previous post was at 11:17 AM ----------

    Guess it does not work on 7" (fire os 3.1 updated, ver 13.3.1.0):

    Device detected: KFTHWI (JDQ39)

    Try to find address in memory...
    Attempt msm_cameraconfig exploit...
    Detected kernel physical address at 0x00008000 form iomem

    Attempt fb_mem exploit...
    Detected kernel physical address at 0x00008000 form iomem
    You need to manage to get remap_pfn_range addresses.
    Failed to get prepare_kernel_cred addresses.
    Failed to get commit_creds addresses.
    Failed to get ptmx_fops addresses.
    KFTHWI (JDQ39) is not supported.
    Failed to setup variables.

    Have hopes it will be possible soon enough though :)

    Most likely, it is going to take a little address rework of the exploit. I am about 100% certain the exploit is there though.
    8
    Good News Everyone! I made the required changes in source, and recompiled it for the Kindle Fire HDX 7". It worked for me at least! Here it goes:

    http://goo.gl/4gBmq5

    Be sure to rename the file to 'exploit', follow the instructions on the first post, and don't forget to thank jcase and fi01.
    6
    Guess it does not work on 7" (fire os 3.1 updated, ver 13.3.1.0):

    Device detected: KFTHWI (JDQ39)

    Try to find address in memory...
    Attempt msm_cameraconfig exploit...
    Detected kernel physical address at 0x00008000 form iomem

    Attempt fb_mem exploit...
    Detected kernel physical address at 0x00008000 form iomem
    You need to manage to get remap_pfn_range addresses.
    Failed to get prepare_kernel_cred addresses.
    Failed to get commit_creds addresses.
    Failed to get ptmx_fops addresses.
    KFTHWI (JDQ39) is not supported.
    Failed to setup variables.

    Have hopes it will be possible soon enough though :)


    No but download the update.bin for your firmware from amazon, send me boot.img and system/build.prop and will port it