Before I begin, the standard disclaimer: This is a risky undertaking. If you encounter issues or, worse, end up with a brick, I (or the others here) will try to help you, but the risk is all yours. Before you start with Xposed, do a dd backup of your SuperSU-rooted /system (with SuperSU in /system) to use as a fallback. Details are below.
Xposed: Follow this guide to install Xposed. As of this writing, v89 works well.
Modules: See the screenshots for the modules I have installed and confirmed working and for the look of the status bar and the navigation bar using GB, FSBI, and Xstana.
Some other apps of choice:
Launcher: Apex (free)
File explorer: Root Explorer (only because I got it for free from an old Amz promotion)
Office: OfficeSuite (ditto reason above)
Media: VLC for Fire
Backup: Titanium Backup and Backup+
Boot manager: ROM Toolbox Lite and All-In-One Toolbox
VPN: OpenVPN Connect
Update: I have finally been able to get FlashFire working, albeit an older version. I have tested backup/restore extensively (backup and restore of /system and /data) and flashed a few zips with success.
-- Root with SuperSU
-- FlashFire v0.24 or modified v0.51
-- Xposed with Per App Hacking module (to use Time Machine to load time-bombed FF)
-- Low risk aversion
-- Download the Xposed Installer from here. You should be downloading this framework: xposed-v89-sdk22-arm64 (the installer will likely pick it up from here).
-- Search for and download all the Xposed modules (the screenshot below contains the version numbers of the modules I have installed) from the Xposed Installer's Download tab. For modules that aren't in the Xposed repo, do a Google or XDA search. The Per App Hacking module is here.
-- Download FlashFire v0.24 or modified v0.51 from the attachments in this post.
I have now created a custom image (using dd) with SuperSU, Xposed, and FlashFire in /system. After a factory reset or adb sideload, I root with Kingo, dd this custom system.img, and reboot to have a SuperSU-rooted /system with working Xposed. You may have to run each of these apps once and reboot for things to work properly. Finally, install the Per App Hacking module to allow FlashFire to function. I would have loved to put the PAH module in /system as well, but FF doesn't like that.
FlashFire: How to get FF working and use it to backup and restore /system and /data:
-- Install FlashFire but do not open it. You can make it (and anything else) a system app at this point. I used Link2SD (long-press on the app and convert it to a system app), but manually moving it to /system/app or /system/priv-app works just as well. For SuperSU, just choose the option in Settings to make it a system app (this moves SuperSU to /system/app; you can confirm this using a root explorer). Reboot after you convert user apps into system apps.
-- Assuming you have Xposed working, install and activate the Per App Hacking module.
-- Go to the aforementioned module and scroll down to FF. Under Time Machine, choose a date around the time the version was active. For v0.24, I went with late Sept. 2015. The format is (date time): 2015-09-25 12:55.
-- Now start FF. It should open w/o complaints. Under Settings, use the best compression and all the cores.
-- This is not needed if you use FF to backup /system as a raw image, but here's how you use dd (to use as a failsafe in the event of a careless wipe, make sure you copy the backup off the tablet after it's done):
adb shell su dd if=/dev/block/mmcblk0p13 of=/sdcard/system.img
-- Here's where you wait ... and wait ... and wait. I have timed this wait: First, the Fire will reboot to a near-black screen. It will spend about 4 minutes on that screen before a huge Loading sign in the center and a bunch of /system modules being loaded. Next, you will be on a black, but slightly brighter, screen for another 4 minutes, after which you will see the red FF at the top and the backup progress at the bottom. The actual backup should take a minute or so and the Fire will reboot. Your backup should be in /sdcard/FlashFire/Backups/. Open system.gz in 7-Zip and extract system. Save it as system.img (file extension optional).
-- To backup /data, choose Normal backup in FF, check the data partition, and repeat the rest of the steps in FF (above).
-- You can chain actions in FF. For example, you can backup /system as Raw and /data as Normal in one shot, saving you an eight-minute wait.
-- After a factory reset (or if root is lost), use (offline) Kingo to root as usual (do not reboot), but don't jump through hoops to install SuperSU. Use dd to write back the saved system img (assuming it's in /sdcard):
adb shell su mount -w -o remount /system dd if=/sdcard/system.img of=/dev/block/mmcblk0p13; sync
Wait a few minutes and reboot. (If your Fire reboots before this is done, you will be stuck at the Fire logo, but adb shell and su will still be available. Repeat the dd and it should work this time. I have noticed that the likelihood of reboot during dd is (much) greater when moving from one version of FireOS to another.)
-- After confirming SuperSU is working as expected (change the default access to Grant), uninstall the Kingo junk.
-- Finally, restore the data partition using FF, but before you do so, install Per App Hacking and tweak it to get FF working.
FlashFire w/o Xposed: If you only care about FlashFire and don't want Xposed, here's a quick-and-dirty non-Xposed way to get FlashFire working (say, after an adb sideload and SuperSU): Change the date using busybox:
busybox date -s "201509221745"
Given the risk of data corruption when dding back a system.img into a mounted /system, here's my recommended approach:
-- adb sideload update.bin
-- Root with (offline) Kingo
-- Install SuperSU v2.79
-- Get FF working with backdating using busybox
-- Use FF to restore /system and /data from backup