HD 10 (2017): Xposed, FlashFire, etc.

Search This thread

retyre

Senior Member
Jan 14, 2011
311
318
Central FL
The Xposed threads for older HDs haven't been updated in months, so I thought I would start a new one for the 2017 HD 10.

Before I begin, the standard disclaimer: This is a risky undertaking. If you encounter issues or, worse, end up with a brick, I (or the others here) will try to help you, but the risk is all yours. Before you start with Xposed, do a dd backup of your SuperSU-rooted /system (with SuperSU in /system) to use as a fallback. Details are below.

Xposed:
Follow this guide to install Xposed. As of this writing, v89 works well.

Modules: See the screenshots for the modules I have installed and confirmed working and for the look of the status bar and the navigation bar using GB, FSBI, and Xstana.

Some other apps of choice:
Launcher: Apex (free)
Keyboard: Gboard
Browser: Lightning
File explorer: Root Explorer (only because I got it for free from an old Amz promotion)
Office: OfficeSuite (ditto reason above)
YouTube: OGYouTube
Media: VLC for Fire
Adblocker: AdAway
Backup: Titanium Backup and Backup+
Boot manager: ROM Toolbox Lite and All-In-One Toolbox
VPN: OpenVPN Connect

Update: I have finally been able to get FlashFire working, albeit an older version. I have tested backup/restore extensively (backup and restore of /system and /data) and flashed a few zips with success.

Requirements:
-- Root with SuperSU
-- FlashFire v0.24 or modified v0.51
-- Xposed with Per App Hacking module (to use Time Machine to load time-bombed FF)
-- Low risk aversion
-- Patience

Downloads:
-- Download the Xposed Installer from here. You should be downloading this framework: xposed-v89-sdk22-arm64 (the installer will likely pick it up from here).
-- Search for and download all the Xposed modules (the screenshot below contains the version numbers of the modules I have installed) from the Xposed Installer's Download tab. For modules that aren't in the Xposed repo, do a Google or XDA search. The Per App Hacking module is here.
-- Download FlashFire v0.24 or modified v0.51 from the attachments in this post.

I have now created a custom image (using dd) with SuperSU, Xposed, and FlashFire in /system. After a factory reset or adb sideload, I root with Kingo, dd this custom system.img, and reboot to have a SuperSU-rooted /system with working Xposed. You may have to run each of these apps once and reboot for things to work properly. Finally, install the Per App Hacking module to allow FlashFire to function. I would have loved to put the PAH module in /system as well, but FF doesn't like that.

FlashFire:
How to get FF working and use it to backup and restore /system and /data:
-- Install FlashFire but do not open it. You can make it (and anything else) a system app at this point. I used Link2SD (long-press on the app and convert it to a system app), but manually moving it to /system/app or /system/priv-app works just as well. For SuperSU, just choose the option in Settings to make it a system app (this moves SuperSU to /system/app; you can confirm this using a root explorer). Reboot after you convert user apps into system apps.
-- Assuming you have Xposed working, install and activate the Per App Hacking module.
-- Go to the aforementioned module and scroll down to FF. Under Time Machine, choose a date around the time the version was active. For v0.24, I went with late Sept. 2015. The format is (date time): 2015-09-25 12:55.
-- Now start FF. It should open w/o complaints. Under Settings, use the best compression and all the cores.
-- This is not needed if you use FF to backup /system as a raw image, but here's how you use dd (to use as a failsafe in the event of a careless wipe, make sure you copy the backup off the tablet after it's done):
Code:
adb shell
su
dd if=/dev/block/mmcblk0p13 of=/sdcard/system.img
-- If you are happy with your system partition, you can now backup using FF. Choose "raw" backup.
-- Here's where you wait ... and wait ... and wait. I have timed this wait: First, the Fire will reboot to a near-black screen. It will spend about 4 minutes on that screen before a huge Loading sign in the center and a bunch of /system modules being loaded. Next, you will be on a black, but slightly brighter, screen for another 4 minutes, after which you will see the red FF at the top and the backup progress at the bottom. The actual backup should take a minute or so and the Fire will reboot. Your backup should be in /sdcard/FlashFire/Backups/. Open system.gz in 7-Zip and extract system. Save it as system.img (file extension optional).
-- To backup /data, choose Normal backup in FF, check the data partition, and repeat the rest of the steps in FF (above).
-- You can chain actions in FF. For example, you can backup /system as Raw and /data as Normal in one shot, saving you an eight-minute wait.
-- After a factory reset (or if root is lost), use (offline) Kingo to root as usual (do not reboot), but don't jump through hoops to install SuperSU. Use dd to write back the saved system img (assuming it's in /sdcard):
Code:
adb shell
su
mount -w -o remount /system
dd if=/sdcard/system.img of=/dev/block/mmcblk0p13; sync
Note: Doing a live dump onto a mounted partition is risky. The above process is meant to save a few minutes. If you have time to burn, use FlashFire to restore /system. Using the steps in "FlashFire w/o Xposed," this will be even quicker.
Wait a few minutes and reboot. (If your Fire reboots before this is done, you will be stuck at the Fire logo, but adb shell and su will still be available. Repeat the dd and it should work this time. I have noticed that the likelihood of reboot during dd is (much) greater when moving from one version of FireOS to another.)
-- After confirming SuperSU is working as expected (change the default access to Grant), uninstall the Kingo junk.
-- Finally, restore the data partition using FF, but before you do so, install Per App Hacking and tweak it to get FF working.

FlashFire w/o Xposed:
If you only care about FlashFire and don't want Xposed, here's a quick-and-dirty non-Xposed way to get FlashFire working (say, after an adb sideload and SuperSU): Change the date using busybox:
Code:
busybox date -s "201509221745"
Changing the system date has implications beyond FF, so this is just a quick fix to get FF working to do a restore, after which you should look to PAH as the permanent solution.

Given the risk of data corruption when dding back a system.img into a mounted /system, here's my recommended approach:
-- adb sideload update.bin
-- Root with (offline) Kingo
-- Install SuperSU v2.79
-- Get FF working with backdating using busybox
-- Use FF to restore /system and /data from backup
 

Attachments

  • sshot2.jpg
    sshot2.jpg
    81.3 KB · Views: 7,518
  • sshot1.jpg
    sshot1.jpg
    161.3 KB · Views: 7,154
Last edited:

mistermojorizin

Senior Member
Dec 21, 2011
854
188
Google Pixel 5
I like to use swype for keyboard. I use a version 1.8 from oppo which has a bult in voice key that activates google voice input, instead of dragon. it just seems to read my mind much better than gboard, or swiftkey.

For launcher, i use nova.

for browser i use chrome, just because it has all my passwords and history from my desktops and laptops.

for youtube, i use iYTPB Vanced version. I used to mess around with OG Youtube but it wasn't nearly as functional for me; maybe it's gotten much better over the years. I install regular youtube, login, then rename the modded youtube to iYTPB and replace the base.apk for youtube. It stays logged in. The main thing it does is get rid of ads and unlimited resolution on mobile

edit: what does a boot manager do?
 
Last edited:

mistermojorizin

Senior Member
Dec 21, 2011
854
188
Google Pixel 5
Prevents apps from running automatically at boot. You can also prevent apps from autorunning even after boot. This is a safer alternative (relative to wholesale uninstall).

To answer my question in the OP, I have finally been able to get FlashFire working, albeit an older version. Can't do much more than backup/restore at this point, but that's all I need (backup and restore of /system and /data). It has trouble restoring /system (presumably because FF starts by loading a minimal /system), but I just use good old dd to live-restore system.img.

Requirements:
-- Root with SuperSU
-- FlashFire v0.24
-- Xposed with Per App Hacking module (to use Time Machine to load time-bombed FF)
-- Low risk aversion
-- Patience

I have now created a custom image (using dd) with SuperSU, Xposed, FlashFire, and AdAway in /system. After a factory reset or adb sideload, I root with Kingo, dd this custom system.img, and reboot to have a SuperSU-rooted /system with working Xposed. Each of these apps has to be run once and rebooted for everything to work properly. Finally, install the Per App Hacking module to allow FF v0.24 to function. I would have loved to put the PAH module in /system as well, but FF doesn't like that.

this is very interesting! Nice work! Let me know if i got this right:


  • get flashfire working with Per App Hacking, make a backup of /data
  • make SuperSu, Xposed App, AdAway, and FlashFire system apps
  • created a custom image (using dd) with SuperSU, Xposed, FlashFire, and AdAway in /system
  • root with Kingo
  • dd this custom system.img and reboot
  • run SuperSu and reboot
  • run Xposed (app) and reboot
  • run FlashFire and reboot
  • run AdAway and reboot
  • install Per App Hacking module to make FF function
  • restore /data with flashfire


Now come the stupid questions. I've tried researching this but couldn't figure these parts out.

In step 1, how do you use PAH to get FF working? How do you backup /data from inside FF? (I see the guide for installing xposed, so that's a given, but then what?) Do you also backup system.img with FF? Do you backup /data as an .img? Also, which version xposed do you use? in the guide it says use v87 but v89 is the current version.
In step 2, how do you check if SuperSu is properly installed as a system app? (I had run "make supersu a system app" when I rooted, but I don't know if it actually worked. I was just happy to get permanent root.) If SuperSu is not a system app, what's the best way to do it? Use the option from within SuperSu or move the apk to /syste/app and set proper permissions?
In step 3, I don't know how to do that. I researched "dd" and I know it's an adb command. But how do you use it specifically make a live-restore system.img?
In step 4, do you mean run the kingo from the PC and get the "temp root" without rebooting (the state right after we root with kingo but if we reboot without doing anything else, the root is lost)?
In step 5, same question as step 3 - how do you specifically do it?
In step 11, how do you restore /data with flashfire

sorry for all these questions, just want to make sure I am doing it exactly how you did it.
 
Last edited:

retyre

Senior Member
Jan 14, 2011
311
318
Central FL
Let me know if i got this right:
Snipped a lot of your post, but here are the answers:
-- Do 2. and 3. first. If you make a backup of /data with the four apps and then make them system apps, you will have duplicates (one in the data backup and one in your system img).

ETA: Most of the FlashFire-related information that used to be here is now in the updated OP.
 
Last edited:

mistermojorizin

Senior Member
Dec 21, 2011
854
188
Google Pixel 5
Snipped a lot of your post, but here are the answers:
-- Do 2. and 3. first. If you make a backup of /data with the four apps and then make them system apps, you will have duplicates (one in the data backup and one in your system img). But before you do that, you need to get FF working:

I tried installing xposed using the steps from your post here: https://forum.xda-developers.com/showpost.php?p=74913548&postcount=160

now I am in a bootloop. it goes fire, optimizing apps, then loads walpaper and sometimes lockscreen, then reboots back to the fire logo. I use adb shell, su, mount system writeable, rm app_process64_xposed, says file not found (which makes sense because i made sure to delete it from system/bin before rebooting). What should I try?
 

retyre

Senior Member
Jan 14, 2011
311
318
Central FL
I tried installing xposed using the steps from your post here: https://forum.xda-developers.com/showpost.php?p=74913548&postcount=160

now I am in a bootloop. it goes fire, optimizing apps, then loads walpaper and sometimes lockscreen, then reboots back to the fire logo. I use adb shell, su, mount system writeable, rm app_process64_xposed, says file not found (which makes sense because i made sure to delete it from system/bin before rebooting). What should I try?

Try this first. If that doesn't work, then this (not in TWRP obviously, but in a root shell from adb).

If SuperSU was working before you installed Xposed, you should be able to get to a root shell from adb, delete the xposed installer from /data/app and /data/data, and reboot.

Did you follow the steps to the letter?
 
Last edited:

mistermojorizin

Senior Member
Dec 21, 2011
854
188
Google Pixel 5
Try this first. If that doesn't work, then this (not in TWRP obviously, but in a root shell from adb).

If SuperSU was working before you installed Xposed, you should be able to get to a root shell from adb, delete the xposed installer from /data/app and /data/data, and reboot.

Did you follow the steps to the letter?

yes pretty sure i followed the directions closely. here's what I did: installed xposed installer, selected install arm64-v89, deleted process_64, reboot. it optimized files for a while then went into this bootloop

i created a blank file from adb shell root system rw /data/data/de.robv.android.xposed.installer/conf/disabled and then used the ls command to make sure it is indeed in there. I changed the xposed installer in data/app and data/data to .bak rather than deleting altogether. still not working
 

retyre

Senior Member
Jan 14, 2011
311
318
Central FL
yes pretty sure i followed the directions closely. here's what I did: installed xposed installer, selected install arm64-v89, deleted process_64, reboot. it optimized files for a while then went into this bootloop

i created a blank file from adb shell root system rw /data/data/de.robv.android.xposed.installer/conf/disabled and then used the ls command to make sure it is indeed in there. I changed the xposed installer in data/app and data/data to .bak rather than deleting altogether. still not working

See whether wiping the cache partition in recovery and rebooting helps. And /data/dalvik-cache/ from a root shell.
 
Last edited:

retyre

Senior Member
Jan 14, 2011
311
318
Central FL
i tried that and it didn't help, so i wiped dalvik cache from adb
rm -r /data/dalvik-cache
rm -r /cache/dalvik-cache

took 10 minutes to boot, but didn't work, same behavior

I think we have tried the usual Xposed-bootloop troubleshooting tips. Before you do adb sideload (w/o a factory reset), can you think of anything else you may have done to /system after your last working reboot? In particular, anything SuperSU-related?
 

mistermojorizin

Senior Member
Dec 21, 2011
854
188
Google Pixel 5
no i didn't touch supersu, and i don't think i did anything with system either. is there any way to boot into safemode? also will sideloading 5.6 without factory reset get rid of root?

edit: it's so frustrating, it'll sometimes load the lockscreen and systemui, and even started nova launcher and i saw my homescreen. but it soft-reboots so quickly it seems like.
 

retyre

Senior Member
Jan 14, 2011
311
318
Central FL
no i didn't touch supersu, and i don't think i did anything with system either. is there any way to boot into safemode? also will sideloading 5.6 without factory reset get rid of root?

edit: it's so frustrating, it'll sometimes load the lockscreen and systemui, and even started nova launcher and i saw my homescreen. but it soft-reboots so quickly it seems like.

Earlier Kindles had a safe mode (power + vol down), but I don't think ours does. Yes, sideloading update .bin will clean /system, thus removing root.

Putting the "disabled" file in /data/data/de.robv.android.xposed.installer/conf/ disables Xposed, so I doubt your current issue is Xposed-related (it may have been caused by the Xposed install, though).

Did you uninstall any system apps (or convert user apps like your launcher to system apps) after your last successful boot?
 

mistermojorizin

Senior Member
Dec 21, 2011
854
188
Google Pixel 5
Earlier Kindles had a safe mode (power + vol down), but I don't think ours does. Yes, sideloading update .bin will clean /system, thus removing root.

Putting the "disabled" file in /data/data/de.robv.android.xposed.installer/conf/ disables Xposed, so I doubt your current issue is Xposed-related (it may have been caused by the Xposed install, though).

Did you uninstall any system apps (or convert user apps like your launcher to system apps) after your last successful boot?

no not since the last successful boot. i tried disabling a few root apps through adb, and then gave up and am doing the sideload. i've done this a ton of times the other day when i was trying to root. but now...it's stuck at 64% and in the screen says "patching system unconditionally'. It's been stuck for 5 minutes. I don't think this is normal, though i've never watched the whole process before.

Edit:it got through it and the %age is increasing at a reasonable pace now.
 
Last edited:

mistermojorizin

Senior Member
Dec 21, 2011
854
188
Google Pixel 5
Snipped a lot of your post, but here are the answers:
-- Do 2. and 3. first. If you make a backup of /data with the four apps and then make them system apps, you will have duplicates (one in the data backup and one in your system img). But before you do that, you need to get FF working:
-- Install FF v0.24 but do not open it. You can make it a system app at this point. I used Link2SD (right-click on the app and convert it to a system app), but moving it to /system/app or /system/priv-app works just as well. For SuperSU, just choose the option in Settings to make it a system app (this moves SuperSU to /system/app; you can check it using a root explorer). Reboot after you convert user apps into system apps.
-- Assuming you have Xposed working (v89 works fine), install and activate the Per App Hacking module.
-- Go to the aforementioned module and scroll down to FF. Under Time Machine, choose a date right after v0.24 was released (but before v0.26 just to be safe). I went with late Sept. 2015. The format is (date time): 2015-09-25 12:55.
-- Now start FF. It should open w/o complaints. Under Settings, use the best compression and all the cores.
-- This is not needed if you use FF to backup /system as a raw image, but here's how you use dd (make sure you copy the backup off the tablet after it's done):
Code:
adb shell
su
dd if=/dev/block/mmcblk0p13 of=/sdcard/system.img
-- If you are happy with your system partition, you can now backup using FF. Choose "raw" backup.
-- Here's where you wait ... and wait ... and wait. I have timed this (I know what you're thinking!): First, the Fire will reboot to a near-black screen. It will spend about 4 minutes on that screen before a huge Loading sign in the center and a bunch of /system modules being loaded. Next, you will be on a black, but slightly brighter, screen for another 4 minutes, after which you will see the red FF logo at the top and backup progress at the bottom. The actual backup should take a minute or so and the Fire will reboot. Your backup should be in /sdcard/FlashFire/Backups/. Open system.gz in 7-Zip and extract system. Save it as system.img (file extension optional).
-- To backup /data, choose Normal backup in FF, check the data partition, and repeat the rest of the steps in FF (above). FF does not give you the option to backup /data as a raw image (thankfully, so you're not left with a 20G backup because /sdcard is in /data).
-- After a factory reset (or if root is lost), use the Kingo PC app and root as usual (do not reboot), but don't jump through hoops to install SuperSU. Use dd to write back the saved system img (assuming it's in /sdcard):
Code:
adb shell
su
mount -w -o remount /system
dd if=/sdcard/system.img of=/dev/block/mmcblk0p13; sync
Wait a few minutes and reboot. (If your Fire reboots before this is done, you will be stuck at the Fire logo, but adb shell and su will still be available. Repeat the dd and it should work this time.)
-- After confirming SuperSU is working as expected (change the default access to Grant), uninstall the Kingo junk.
-- Finally, restore the data partition using FF, but before you do so, install Per App Hacking and tweak it to get FF working.

So I'm back up and running. I made a dd backup :).

I got xposed going and I used time-machine for FF. Opened FF and hit the plus sign under actions, and selected only the data partition. It's been stuck on the fire splash screen for about 17 minutes now. Is that normal? I know you mentioned the raw system backup takes forever, but I thought data would go quicker, and I didn't expect it to spend all its time on the splashscreen.

edit: i force reboot after like 35mins of the boot screen. was glad to see that it reboot normally just fine. so i decided to try the raw system backup (by the way, in there it had system and boot prechecked, I unchecked boot - is that OK?). So I was expecting it to reboot to a blank screen as you mentioned, but nope, its just sitting at the "fire" boot screen again. I can get into ADB shell.

edit 2: i installed the wrong version of flashfire. gonna try again.

edit 3: 0.24 did the same thing

edit 4: changed FF to a user app, and now it seems to be working on backing up data partition (at least it's giving me a black screen instead of that boot logo). But to do system, i will need to move it to system. I've been using link2sd and it puts it in priv-app. maybe it should just be in system/app? It's working for you to backup system as a system app? Is it in priv-app?
 
Last edited:

retyre

Senior Member
Jan 14, 2011
311
318
Central FL
So I'm back up and running. I made a dd backup :).

I got xposed going and I used time-machine for FF. Opened FF and hit the plus sign under actions, and selected only the data partition. It's been stuck on the fire splash screen for about 17 minutes now. Is that normal? I know you mentioned the raw system backup takes forever, but I thought data would go quicker, and I didn't expect it to spend all its time on the splashscreen.

edit: i force reboot after like 35mins of the boot screen. was glad to see that it reboot normally just fine. so i decided to try the raw system backup (by the way, in there it had system and boot prechecked, I unchecked boot - is that OK?). So I was expecting it to reboot to a blank screen as you mentioned, but nope, its just sitting at the "fire" boot screen again. I can get into ADB shell.

edit 2: i installed the wrong version of flashfire. gonna try again.

edit 3: 0.24 did the same thing

edit 4: changed FF to a user app, and now it seems to be working on backing up data partition (at least it's giving me a black screen instead of that boot logo). But to do system, i will need to move it to system. I've been using link2sd and it puts it in priv-app. maybe it should just be in system/app? It's working for you to backup system as a system app? Is it in priv-app?

Changing FF to user vs. system app should have no bearing on being able to backup /system as a raw image. I use it as a system app (in /system/priv-app) and it works fine. Did the /data backup complete? What's the size of the .gz file in /sdcard/FlashFire/Backups/**/? Which backup option are you choosing and which partitions are you checking in there?

Read my section about FF starting up (and how many minutes each step should take). Look carefully at the screen and tell me whether you see the "two stages of black." The first black should be darker than the second, and there should be a bunch of scrolling text (this will only last a second or two, so you will have to stare at your screen like your life depends on it) between the two stages. If you don't see the red FlashFire at the top in 8-10 minutes, something's gone wrong. In general, it would be a good idea to keep an eye on the Fire's screen for the entire 10 minutes after you click Flash in FF and press OK.
 
Last edited:
  • Like
Reactions: mistermojorizin

mistermojorizin

Senior Member
Dec 21, 2011
854
188
Google Pixel 5
Changing FF to user vs. system app should have no bearing on being able to backup /system as a raw image. I use it as a system app (in /system/priv-app) and it works fine. Did the /data backup complete? What's the size of the .gz file in /sdcard/FlashFire/Backups/**/? Which backup option are you choosing and which partitions are you checking in there?

Read my section about FF starting up (and how many minutes each step should take). Look carefully at the screen and tell me whether you see the "two stages of black." The first black should be darker than the second, and there should be a bunch of scrolling text (this will only last a second or two, so you will have to stare at your screen like your life depends on it) between the two stages. If you don't see the red FlashFire at the top in 8-10 minutes, something's gone wrong. In general, it would be a good idea to keep an eye on the Fire's screen for the entire 10 minutes after you click Flash in FF and press OK.

I ended up getting it to work. Had to uninstall, reinstall, change to user app again and everything worked. Don't know why it didn't work before. I appreciate all of your help. when doing the raw system backup, i only checked "system" and unchecked "boot". That sound right?

One thing I've been wondering about is why the arm64 version of xposed works on this devices. It does have a arm64 cpu, but it's instruction set is armv7 only, and from what i can tell, all of the apps it runs are not arm64 versions.
 
Last edited:

retyre

Senior Member
Jan 14, 2011
311
318
Central FL
... when doing the raw system backup, i only checked "system" and unchecked "boot". That sound right?

One thing I've been wondering about is why the arm64 version of xposed works on this devices. It does have a arm64 cpu, but it's instruction set is armv7 only, and from what i can tell, all of the apps it runs are not arm64 versions.

Yes. You can check all the partitions just for completeness (esp. boot and recovery), but there's not much we can do with them at this time (other than for debricking; better to use dd with those images).

Yes, I noticed that as well. After trying the arm version, I realized the Xposed Installer cares more about the CPU architecture than the instruction set.

So, you never got FF to work as a system app? If it does, the only app to install after a dd restore will be PAH.

Were all the partitions backed up properly?
 
  • Like
Reactions: mistermojorizin

bibikalka

Senior Member
May 14, 2015
1,424
1,111
...
To answer my question in the OP, I have finally been able to get FlashFire working, albeit an older version. Can't do much more than backup/restore at this point, but that's all I need (backup and restore of /system and /data). It has trouble restoring /system (presumably because FF starts by loading a minimal /system), but I just use good old dd to live-restore system.img.

Requirements:
-- Root with SuperSU
-- FlashFire v0.24
-- Xposed with Per App Hacking module (to use Time Machine to load time-bombed FF)
-- Low risk aversion
-- Patience

May I inquire why you were using FF v0.24 ? What's wrong with the newer FF versions? Do they not work?

I have now created a custom image (using dd) with SuperSU, Xposed, FlashFire, and AdAway in /system. After a factory reset or adb sideload, I root with Kingo, dd this custom system.img, and reboot to have a SuperSU-rooted /system with working Xposed. Each of these apps has to be run once and rebooted for everything to work properly. Finally, install the Per App Hacking module to allow FF v0.24 to function. I would have loved to put the PAH module in /system as well, but FF doesn't like that.

What's the reason to save an img for /system, instead of just reloading everything upon getting root?

P.S. Wanted to add on the subject of Xposed. My must have Xposed modules are App Settings v1.13 (to make Chrome tabs behave like on a cell phone, instead of taking an extra line - link), GravityBox (to make status bar display notifications in colors, and up/down network traffic), and the module with a yellow smiley face :) (kind of like Walmart's)
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 13
    The Xposed threads for older HDs haven't been updated in months, so I thought I would start a new one for the 2017 HD 10.

    Before I begin, the standard disclaimer: This is a risky undertaking. If you encounter issues or, worse, end up with a brick, I (or the others here) will try to help you, but the risk is all yours. Before you start with Xposed, do a dd backup of your SuperSU-rooted /system (with SuperSU in /system) to use as a fallback. Details are below.

    Xposed:
    Follow this guide to install Xposed. As of this writing, v89 works well.

    Modules: See the screenshots for the modules I have installed and confirmed working and for the look of the status bar and the navigation bar using GB, FSBI, and Xstana.

    Some other apps of choice:
    Launcher: Apex (free)
    Keyboard: Gboard
    Browser: Lightning
    File explorer: Root Explorer (only because I got it for free from an old Amz promotion)
    Office: OfficeSuite (ditto reason above)
    YouTube: OGYouTube
    Media: VLC for Fire
    Adblocker: AdAway
    Backup: Titanium Backup and Backup+
    Boot manager: ROM Toolbox Lite and All-In-One Toolbox
    VPN: OpenVPN Connect

    Update: I have finally been able to get FlashFire working, albeit an older version. I have tested backup/restore extensively (backup and restore of /system and /data) and flashed a few zips with success.

    Requirements:
    -- Root with SuperSU
    -- FlashFire v0.24 or modified v0.51
    -- Xposed with Per App Hacking module (to use Time Machine to load time-bombed FF)
    -- Low risk aversion
    -- Patience

    Downloads:
    -- Download the Xposed Installer from here. You should be downloading this framework: xposed-v89-sdk22-arm64 (the installer will likely pick it up from here).
    -- Search for and download all the Xposed modules (the screenshot below contains the version numbers of the modules I have installed) from the Xposed Installer's Download tab. For modules that aren't in the Xposed repo, do a Google or XDA search. The Per App Hacking module is here.
    -- Download FlashFire v0.24 or modified v0.51 from the attachments in this post.

    I have now created a custom image (using dd) with SuperSU, Xposed, and FlashFire in /system. After a factory reset or adb sideload, I root with Kingo, dd this custom system.img, and reboot to have a SuperSU-rooted /system with working Xposed. You may have to run each of these apps once and reboot for things to work properly. Finally, install the Per App Hacking module to allow FlashFire to function. I would have loved to put the PAH module in /system as well, but FF doesn't like that.

    FlashFire:
    How to get FF working and use it to backup and restore /system and /data:
    -- Install FlashFire but do not open it. You can make it (and anything else) a system app at this point. I used Link2SD (long-press on the app and convert it to a system app), but manually moving it to /system/app or /system/priv-app works just as well. For SuperSU, just choose the option in Settings to make it a system app (this moves SuperSU to /system/app; you can confirm this using a root explorer). Reboot after you convert user apps into system apps.
    -- Assuming you have Xposed working, install and activate the Per App Hacking module.
    -- Go to the aforementioned module and scroll down to FF. Under Time Machine, choose a date around the time the version was active. For v0.24, I went with late Sept. 2015. The format is (date time): 2015-09-25 12:55.
    -- Now start FF. It should open w/o complaints. Under Settings, use the best compression and all the cores.
    -- This is not needed if you use FF to backup /system as a raw image, but here's how you use dd (to use as a failsafe in the event of a careless wipe, make sure you copy the backup off the tablet after it's done):
    Code:
    adb shell
    su
    dd if=/dev/block/mmcblk0p13 of=/sdcard/system.img
    -- If you are happy with your system partition, you can now backup using FF. Choose "raw" backup.
    -- Here's where you wait ... and wait ... and wait. I have timed this wait: First, the Fire will reboot to a near-black screen. It will spend about 4 minutes on that screen before a huge Loading sign in the center and a bunch of /system modules being loaded. Next, you will be on a black, but slightly brighter, screen for another 4 minutes, after which you will see the red FF at the top and the backup progress at the bottom. The actual backup should take a minute or so and the Fire will reboot. Your backup should be in /sdcard/FlashFire/Backups/. Open system.gz in 7-Zip and extract system. Save it as system.img (file extension optional).
    -- To backup /data, choose Normal backup in FF, check the data partition, and repeat the rest of the steps in FF (above).
    -- You can chain actions in FF. For example, you can backup /system as Raw and /data as Normal in one shot, saving you an eight-minute wait.
    -- After a factory reset (or if root is lost), use (offline) Kingo to root as usual (do not reboot), but don't jump through hoops to install SuperSU. Use dd to write back the saved system img (assuming it's in /sdcard):
    Code:
    adb shell
    su
    mount -w -o remount /system
    dd if=/sdcard/system.img of=/dev/block/mmcblk0p13; sync
    Note: Doing a live dump onto a mounted partition is risky. The above process is meant to save a few minutes. If you have time to burn, use FlashFire to restore /system. Using the steps in "FlashFire w/o Xposed," this will be even quicker.
    Wait a few minutes and reboot. (If your Fire reboots before this is done, you will be stuck at the Fire logo, but adb shell and su will still be available. Repeat the dd and it should work this time. I have noticed that the likelihood of reboot during dd is (much) greater when moving from one version of FireOS to another.)
    -- After confirming SuperSU is working as expected (change the default access to Grant), uninstall the Kingo junk.
    -- Finally, restore the data partition using FF, but before you do so, install Per App Hacking and tweak it to get FF working.

    FlashFire w/o Xposed:
    If you only care about FlashFire and don't want Xposed, here's a quick-and-dirty non-Xposed way to get FlashFire working (say, after an adb sideload and SuperSU): Change the date using busybox:
    Code:
    busybox date -s "201509221745"
    Changing the system date has implications beyond FF, so this is just a quick fix to get FF working to do a restore, after which you should look to PAH as the permanent solution.

    Given the risk of data corruption when dding back a system.img into a mounted /system, here's my recommended approach:
    -- adb sideload update.bin
    -- Root with (offline) Kingo
    -- Install SuperSU v2.79
    -- Get FF working with backdating using busybox
    -- Use FF to restore /system and /data from backup
    4
    ROM update: some progress has been made. I've gathered everything needed to get a ROM up and running. Looks like I can port over most of the system from the Fire 7 ROM. The tests I've been doing show Many of the components are compatible to the HD 10. Im pretty sure I have all I need. It's just a matter of tweaking some things which I think I'll be done with later today. If so, I'll be able to perform the first flash to the HD 10 :D

    Sent from my Samsung Galaxy S4 using XDA Labs
    2
    what does a boot manager do?

    Prevents apps from running automatically at boot. You can also prevent apps from autorunning even after boot. This is a safer alternative (relative to wholesale uninstall).

    ETA: See the updated OP for FlashFire-related information.
    2
    Let me know if i got this right:
    Snipped a lot of your post, but here are the answers:
    -- Do 2. and 3. first. If you make a backup of /data with the four apps and then make them system apps, you will have duplicates (one in the data backup and one in your system img).

    ETA: Most of the FlashFire-related information that used to be here is now in the updated OP.
    2
    About the xposed framework, once the .zip is installed, isn't it already part of system? I mean, If it has already been installed and then the dd backup is done, isn't that enough to have it installed when restoring the system.img later? If it's not enough, what step needs to be done? (I did think you meant that the installer needed to be made a system app. I did not do that, and I think you're agreeing with that).

    On a different topic, for Dragon1024 issue about FlashFire, I've only used link2sd. I haven't copied the file directly. Could that be making a difference? I have not had any problem with FF v0.24 with PAH module.

    Yes, the framework files will be in /system. The goal is to have all the FF prereqs in system.img. That includes Xposed Installer. As you wrote, this is not required (using that argument, FF need not be a system app either; you could just install it like you would Xposed Installer), but it's one less thing to worry about.

    DragonFire1024: If you don't want to use Link2SD, just move /data/app/eu.chainfire.flash to /system/priv-app/eu.chainfire.flash and set the correct permissions (755 for directories and 644 for files).