yashsingh1/xdaforums huggingface dataset:
[Kindle Fire HDX 7" & 8.9" General] awinston:
ioctl pointer question

So I have been doing more research and cobbling together a variety of the exploits and I wanted to know if I am headed in the right direction, or not, considering I am struggling to understand what I am doing exactly :)

Here is my most recent log cat attempt

02-13 16:18:13.319 4324-4324/? D/TAG﹕ ROOTUID 1000

02-13 16:18:13.319 4324-4324/? D/TAG﹕ Tzwidevine: 0, app_id: -1098148004

02-13 16:18:13.319 4324-4324/? D/TAG﹕ Keymaster: -1, app_id: 2

02-13 16:18:13.319 4324-4324/? D/TAG﹕ QSEECOM_IOCTL_SEND_CMD_REQ return 0x1 0x1

02-13 16:18:13.319 4324-4324/? D/TAG﹕ ioctl return 0x0

02-13 16:18:13.319 4324-4324/? D/TAG﹕ mmap return 0x400ef000

02-13 16:18:13.319 4324-4324/? D/TAG﹕ 0xe59f0004

02-13 16:18:13.319 4324-4324/? D/TAG﹕ 0xe92d0001

02-13 16:18:13.319 4324-4324/? D/TAG﹕ 0xe8bd8000

02-13 16:18:13.319 4324-4324/? D/TAG﹕ 0x40023d2d

02-13 16:18:13.319 4324-4324/? D/TAG﹕ 0xb5006803

02-13 16:18:13.319 4324-4324/? D/TAG﹕ 0xd503005a

02-13 16:18:13.319 4324-4324/? D/TAG﹕ 0x6122280

02-13 16:18:13.319 4324-4324/? D/TAG﹕ 0xe0014313

02-13 16:18:13.319 4324-4324/? D/TAG﹕ 0x85b005b

02-13 16:18:13.319 4324-4324/? D/TAG﹕ 0xbd0018c0

02-13 16:18:13.319 4324-4324/? D/TAG﹕ QSEECOM_IOCTL_SEND_CMD_REQ

02-13 16:18:13.329 4324-4324/? D/TAG﹕ return 0x1 0x1

02-13 16:18:13.329 4324-4324/? D/TAG﹕ ioctl return 0xffffffff

02-13 16:18:13.329 4324-4324/? D/TAG﹕ ROOTUID 1000

You will notice ioctl returns 0x0 initially which in turn allows me to mmap but it is still not escalating to root. Does this look like what you might expect if I am going in the right direction? That being said if this is promising the next question I have is about the PTMS_FOPS static. I have found versions for 4.4.2, 4.4.4 and 5.0.0 and some unknown version. I have tried all with the same result. Is it possible that we need one for 4.4.3 since that is what 4.5.2 is running?

Anyway if I am barking up the wrong tree just let me know, wanted to throw it out there to see what anyone thought.

Alternatively this means that maybe 4.5.2 isn't vulnerable to this exploit.
[Kindle Fire HDX 7" & 8.9" General] p1gl3t:
I am pretty sure that 4.5.2 is vulnerable. I say this because the qseecom.c provided by Amazon here for 4.5.2 seems to be very close (only some cosmetic changes) to commits 568757f02d9a243bad7f70cebfa414c4a65f361f and ed45a48430e7f67e1648d45514989af0e04f0e97 from Code Aurora.

I did a diff with all the revisions and these two came up with only 3 lines different to the qseecom.c that Amazon released.

I also extracted the kernel image from bootimg.bin and grep-ed after the new format strings included by the patches. The fact that nothing showed up strongly suggests that the kernel build doesn't include the patches.

Now the only step that remains is to get the addresses of the exported symbols (mainly ptmx_fops). The simple way would have been to boot the kernel and get what we need from /proc/kallsyms. Unfortunately the addresses aren't shown by default and the restriction must be dropped by "echo 0 > /proc/sys/kernel/kptr_restrict" as root. As I don't think there is anyone currently running a pre-rooted 4.5.2 rom, the only option remaining is to disassemble the kernel. I hope I'll manage to do this today.
[Kindle Fire HDX 7" & 8.9" General] Phate123:
I would not be sure about that. I don't think the provided source does match the actual implementation 100 percent.

This is good news. This could really mean that this might really work.

I will try that too, but I'm not sure about which symbols are needed and if I'm able to find them.
[Kindle Fire HDX 7" & 8.9" General] futzmaster:
Cpasjuste posted a 4.5.2 version for TWRP...

Maybe this helps you with testing...
[Kindle Fire HDX 7" & 8.9" General] Phate123:
4.5.2 Kernel addresses and symbols

[+]mmap
mem=b6553000 length=010cad08 offset=09ab5000
[+]kallsyms_addresses=c0aec330
count=00016d24
[+]kallsyms_num_syms=00016d24
[+]kallsyms_names=c0b477d0
[+]kallsyms_markers=c0c4d070
[+]kallsyms_token_table=c0c4d630
[+]kallsyms_token_index=c0c4d9f0
[+]kallsyms_lookup_name

c11bf690 ptmx_fops

Full list of symbols see attachement
[Kindle Fire HDX 7" & 8.9" General] Phate123:
[MENTION=6403649]awinston[/MENTION]

Would you mind trying your code changing the define of PTMX_FOPS in the top of the source to 0xc11bf690?

Also would you share the changes you did to it?
[Kindle Fire HDX 7" & 8.9" General] awinston:
Attached as msm3.c

Tried but doesn't seem to work. Feel free to give what I have a try, maybe I am missing something obvious. One oddity is that QSEECOM_IOCTL_APP_LOADED_QUERY_REQ only seems to work after a hard restart. Not sure what that means. Another thing to note is that this version of the exploit is considerably different than some of the other versions I have seen floating around so maybe making some more changes to this one will prove fruitful. The biggest change I made was adding the QSEECOM_IOCTL_APP_LOADED_QUERY_REQ along with some changes to the ion_alloc_data. These changes seem to match more closely the giefroot version that was reverse engineered.
[Kindle Fire HDX 7" & 8.9" General] awinston:
4.5.3 update

Just got 4.5.3 pushed, crap. WARNING to others, not sure what this means for this potential exploit.
[Kindle Fire HDX 7" & 8.9" General] p1gl3t:
For thor-ship_452-kitkat-build I got C11BF250 b ptmx_fops. Here you have all the symbols and here is the IDA script (credits go to Igor Skochinsky).

---------- Post added at 10:02 PM ---------- Previous post was at 10:00 PM ----------

Do a factory reset to delete the downloaded ota and try to use a proxy to block the requests.
[Kindle Fire HDX 7" & 8.9" General] shouthouse:
Well... That's what I have done. I'm not having the issue in Fire OS only in CM 11 and Nexus 4 with Safestrap 4. I have even installed both to stock ROM slot after backing up stock. Issue happens in Netflix and YouTube.
[Kindle Fire HDX 7" & 8.9" General] DB126:
Yikes - completely counters earlier suspicions. I run 'native' Nexus v4 (unlocked bootloader) so perhaps Safestrap v4 is introducing a layer that impacts video playback. That said, I have no problem cranking out 720p YouTube vids on a SafeStrap v4 equipped HDX running an older build of CM11. That device also has an unlocked bootloader (3.2.3.2) but shouldn't be a factor imo. Both are 7" models.

The obviously troubleshooting guidance applies: full wipe, clean install, no background apps, different hotspots (excessive jitter can have weird effects on video), etc. Also try browser playback. Suspect you've already jumped through some hoops. Don't have an immediate answer. Perhaps others will chime in.
[Kindle Fire HDX 7" & 8.9" General] shouthouse:
Yea that's what I tried. Its strange right? Glad im not stumped due to ignorance. I've done a good ten different wipes and installs. I wonder if I can make a video of it happening.
[Kindle Fire HDX 7" & 8.9" General] DB126:
Possible you have a hardware issue (memory, permanent storage). Might want to run a few benchmarks to get a high level overview and then dive into any suspicious areas. As I recall AnTuTu bench should be in the low 30Ks on a 3rd gen HDX. Not much you can do if a problem is detected as there are no user replaceable components. An extreme outlier is tweaking kernel parameters to optimize performance - akin to changing the orbit of Pluto to cure cancer. Even if something was amiss it should get reset on reflashes. I'll drop a post in the Nexus thread pointing to references and tools if you want to pursue this path. Probably a waste of time.
[Kindle Fire HDX 7" & 8.9" General] shouthouse:
I was just thinking this myself and I think I figured it out. It seems to be a multi touch issue. I was using Amazon and it kept kicking back to the main screen and sometimes the keyboard jumps up randomly. The device is still under warranty so I think I can get it replaced.
[Kindle Fire HDX 7" & 8.9" General] Samson Lau:
Hi Friend,

What news for <4.5.2?
[Kindle Fire HDX 7" & 8.9" General] whitefang0925:
ANY HELP?

can i ask how can i put this file on my fire 4.5.2 without using the wifi coz when i turn it on its just update my firmware to the latest version, sorry for the noob question :D

how can i install this apk ? should i put it in the internal storage ?

im lost help :confused:

---------- Post added at 03:46 AM ---------- Previous post was at 03:35 AM ----------

nevermind i got it thanks :D
[Kindle Fire HDX 7" & 8.9" General] shouthouse:
Yes, move the Apk to internal storage.
[Kindle Fire HDX 7" & 8.9" General] awinston:
EDIT: A right ROP chain on my device (Version 4.5.2) seems to be:

static int rop_chain_THOR[] = {0x0004eab0,0x000247a4+4+1,0x0003cf90+8,0x0002553d};

If you don't mind me asking how do you obtain the rop_chain? I tried to make sense of the comments in the exploit but am way in over my head. The current rop_chain doesn't work for 4.5.3 so either this exploit was fixed or I can try and get the new one and try again before trying to factory reset to 4.5.2, assuming that works.
[Kindle Fire HDX 7" & 8.9" General] johim:
I think that factory reset will work only if you haven't upgraded already.

You can ask Amazon to rollback to 4.5.2,if you wish. Someone mentioned that now they downgrade with no questions asked.
[Kindle Fire HDX 7" & 8.9" General] Phate123:
I'm still on 4.5.2 so it seems my attempts to block updates did work. :)

Use a tool like ROPgadget to find the addresses of the gadgets used in the ROP chain. The output of ROPgadget is used in the comments so they are easy to find.

The address of system() can be found with the NDK tool nm.

EDIT:

Did you use another kernel image? I got mine from https://kindle-fire-updates.s3.amazonaws.com/update-kindle-14.4.5.2_user_452004220.bin
[Kindle Fire HDX 7" & 8.9" General] zxz0O0:
I could offer my help if you're interested.
[Kindle Fire HDX 7" & 8.9" General] p1gl3t:
14.4.5.2 is for Apollo, I have used the Thor kernel.
[Kindle Fire HDX 7" & 8.9" General] awinston:
Great that got me going in the right direction. I also stumbled on some rop chain exploit exercises, wow they look tough. Anyway doesn't seem to have changed for 4.5.3. I was only able to verify 1-3 though, I couldn't figure out how to get 4.

Only thing that might be helpful would be for someone to get the 4.5.3 update so we can take a look to see what changed. As it stands 4.5.3 doesn't seem to be vulnerable to CVE-2014-7911 but maybe I am missing something.
[Kindle Fire HDX 7" & 8.9" General] Phate123:
****, what a stupid mistake. Thanks for doing it right....
[Kindle Fire HDX 7" & 8.9" General] p1gl3t:
Got the second stage exploit running (from root, didn't bother with the first stage) on my 3.1.0 Apollo. I should also run on 4.5.2, but I don't have the right setup to test it.

I would rather discuss it on Skype or Hangouts as the code is still very messy.
[Kindle Fire HDX 7" & 8.9" General] AmazonLeaker:
Personal observation :

Device officially rolled back to old firmware will update normally via .bin file side load update but again it downgrades to old version after connected to wifi (seems that servers check the update and auto push rollback firmware, however this needs to be cross verified again by some one here)
[Kindle Fire HDX 7" & 8.9" General] veaceslav:
Nobody tried on Fire Os 4.5.2 ? Does it work?
[Kindle Fire HDX 7" & 8.9" General] awinston:
Never saw a followup so I wanted to clarify, did you actually get the exploit working running as system uid on 4.5.2?

Amazon rolled me back to 3.2.8 and I am trying to decide if I should go upgrade to 4.1.1 first and work some on the exploit unless someone else has already tried without any luck. I might also go all the way up to 4.5.2 if you need help testing.
[Kindle Fire HDX 7" & 8.9" General] veaceslav:
I'm running 4.5.2 and I might be able to test if you need help.
[Kindle Fire HDX 7" & 8.9" General] p1gl3t:
Sorry for the lack of updates, I was pretty busy this week.

I am currently working on booting 4.5.2 with the 3.2.3.2 bootloader. Apparently there are some problems with the display not initializing properly on Apollo and I must familiarize myself with device tree related stuff.

As I don't want to delay the development even more (until I manage to boot 4.5.2), I have uploaded to github the changes that I have made. Sorry for no additional comments in the code. Hope [MENTION=3556718]Phate123[/MENTION] will get it running on 4.5.2 asap.
[Kindle Fire HDX 7" & 8.9" General] p1gl3t:
Good news, 4.5.2 is vulnerable to CVE-2014-4322. I have managed to execute code in kernel mode. Now I have to test CVE-2014-4322 and make a nice apk. Unfortunately I don't think I'll manage to do it tomorrow.

From a (very) quick look through the src of 4.5.3, it doesn't seem that they have fixed CVE-2014-4322, but we'll see that later.

For the moment, please do anything you can to not upgrade. You should do a factory reset if an ota was downloaded, but not yet applied.
[Kindle Fire HDX 7" & 8.9" General] awinston:
Wow that is great news! That being said although 4.5.3 is still vulnerable to 4322 as you mentioned, they fixed cve-2014-7911 which essentially renders 4322 useless unless there is another exploit that can escalate to system in order to execute 4322. If you need help testing let me know.

I did have a question though for anyone that might know, I am considering manually updating from 3.2.8 to 4.1.1 and then possibly 4.5.2 and was curious if anyone knows if this reenables OTA. My guess is that it does but without really digging in I am can't be sure. Just wanted to save some time.
[Kindle Fire HDX 7" & 8.9" General] EncryptedCurse:
I don't think so, the OTA block is done server side.
[Kindle Fire HDX 7" & 8.9" General] veaceslav:
Too late .... I hate when they automatically update... I hope that this exploit can be ran on 4.5.3....
[Kindle Fire HDX 7" & 8.9" General] dpeddi:
I suspect that 4.5.2 is still vulnerable to unlock bootloader hack:

http://xdaforums.com/kindle-fire-hd...bootloader-unlock-procedure-software-t3030281

Some brave to try to unlock bootloader?

Note that new syntax is

fastboot oem unlock <file.img>

Regards
[Kindle Fire HDX 7" & 8.9" General] ONYXis:
but how it could be possible? if we must use cuber for signing *.img that works only on <=x.3.2.3.2 ?

I could try when root becomes available.
[Kindle Fire HDX 7" & 8.9" General] dpeddi:
I may wrong read binary blob.. but it seems to me that they have patched "image_verify" code but not unlock_verify.

RSA_public_decrypt == -1 -->unsecure (<=3.2.3 - image_verify - all unlock)

RSA_public_decrypt != hash_size -->secured (>3.2.3(or 4?) - image_verify )

---------- Post added at 01:57 PM ---------- Previous post was at 01:57 PM ----------

I may wrong read binary blob.. but it seems to me that they have patched "image_verify" code but not unlock_verify.

RSA_public_decrypt == -1 -->unsecure (<=3.2.3 - image_verify - all unlock)

RSA_public_decrypt != hash_size -->secured (>3.2.3(or 4?) - image_verify )
[Kindle Fire HDX 7" & 8.9" General] rubinho:
[MENTION=438903]dpeddi[/MENTION]

Then the bootloader versions v3.2.4-3.2.8 should also be unlocked ?!
[Kindle Fire HDX 7" & 8.9" General] dpeddi:
Yes, it should. But i haven't checked that minor

But i need confirmation. I won't upgrade bootloader to check by myself..

Inviato dal mio GT-I9505 utilizzando Tapatalk
[Kindle Fire HDX 7" & 8.9" General] rubinho:
Hehe, i can understand that :D
[Kindle Fire HDX 7" & 8.9" General] awinston:
So I finally got myself back to 4.5.2 after being downgraded to 3.2.8 and gave what you have in github a spin and unfortunately it still isn't working for me. It gets all the way to "Bye" without crashing but UID is still 1000. That being said I did notice that in the code you commented the PTMX_FOPS as 14.4.5.2. I am actually on 13.4.5.2. Are these kernels exactly the same, meaning they would have the same PTMX_FOPS? If not I might need a little help getting the PTMX_FOPS for 13.4.5.2, because I am curious and trying to learn more about how to do all this. I did get the boot.img from the update_kindle bin and found various tools that seemingly extract various information but from everything I was able to do I couldn't get exactly what I need. Do you guys end up having to compile the kernel from source that kindle provides to get the symbol names in the kernel image? Anyway, just wanting to help and learn. If taking it to PM is better let me know.
[Kindle Fire HDX 7" & 8.9" General] Phate123:
The address of PTMX_FOPS has been posted by p1gl3t before, please check the values. I'am not at home this week so I am not able to test it myself yet. We extracted the kernel image from the official Amazon update. It is possible to extract the symbol table from this image
[Kindle Fire HDX 7" & 8.9" General] awinston:
Great work everyone, it is done!!!!

02-28 11:40:18.545 15465-15465/? D/TAG﹕ KINDLEUID 1000

02-28 11:40:18.545 15465-15465/? D/TAG﹕ brk 0x41622000

02-28 11:40:18.545 15465-15465/? D/TAG﹕ mypid 15465

02-28 11:40:18.545 15465-15465/? D/TAG﹕ target 0xaf000000

02-28 11:40:18.585 15465-15465/? D/TAG﹕ waiting

02-28 11:40:18.585 15465-15465/? D/TAG﹕ abuseBuff at	0x41623028

02-28 11:40:18.585 15465-15465/? D/TAG﹕ abuseBuff end	0x41624028

02-28 11:40:18.585 15465-15465/? D/TAG﹕ offset to PTMX_FOPS 0x7fb9c260

02-28 11:40:18.585 15465-15465/? D/TAG﹕ qseecom fd 11

02-28 11:40:18.585 15465-15465/? D/TAG﹕ ion fd 12

02-28 11:40:18.585 15465-15465/? D/TAG﹕ Got dma fd 13

02-28 11:40:18.585 15465-15465/? D/TAG﹕ QSEECOM_IOCTL_SET_MEM_PARAM_REQ start

02-28 11:40:18.585 15465-15465/? D/TAG﹕ ioctl return 0x0

02-28 11:40:18.585 15465-15465/? D/TAG﹕ Searching for apps

02-28 11:40:18.585 15465-15465/? D/TAG﹕ playread: -1, app_id: 2

02-28 11:40:18.585 15465-15465/? D/TAG﹕ QSEECOM_IOCTL_SEND_MODFD_CMD_REQ start

02-28 11:40:18.605 15465-15465/? D/TAG﹕ ioctl return 0xffffffff

02-28 11:40:18.605 15465-15465/? D/TAG﹕ Scanning target

02-28 11:40:18.625 15465-15465/? D/TAG﹕ 0xaf5aaffc: 0x6e00c000

02-28 11:40:18.675 15465-15465/? D/TAG﹕ mmap return 0x6e00c000

02-28 11:40:18.675 15465-15465/? D/TAG﹕ Prepping sc

02-28 11:40:18.675 15465-15465/? D/TAG﹕ e59f0004

02-28 11:40:18.675 15465-15465/? D/TAG﹕ e92d0001

02-28 11:40:18.675 15465-15465/? D/TAG﹕ e8bd8000

02-28 11:40:18.675 15465-15465/? D/TAG﹕ 400b6e61

02-28 11:40:18.675 15465-15465/? D/TAG﹕ b5006803

02-28 11:40:18.675 15465-15465/? D/TAG﹕ d503005a

02-28 11:40:18.675 15465-15465/? D/TAG﹕ 6122280

02-28 11:40:18.675 15465-15465/? D/TAG﹕ e0014313

02-28 11:40:18.675 15465-15465/? D/TAG﹕ 85b005b

02-28 11:40:18.675 15465-15465/? D/TAG﹕ bd0018c0

02-28 11:40:18.675 15465-15465/? D/TAG﹕ QSEECOM_IOCTL_SEND_MODFD_CMD_REQ start

02-28 11:40:18.685 15465-15465/? D/TAG﹕ ioctl return 0xffffffff

02-28 11:40:18.685 15465-15465/? D/TAG﹕ Opening PTMX_DEVICE

02-28 11:40:18.685 15465-15465/? D/TAG﹕ Triggering sc

02-28 11:40:18.705 15465-15465/? D/TAG﹕ MOUNT

02-28 11:40:18.715 15465-15465/? D/TAG﹕ ROOT

02-28 11:40:18.715 15465-15465/? D/TAG﹕ Bye

02-28 11:40:18.715 15465-15465/? D/TAG﹕ MYUID 0

I echoed a file to /system
[Kindle Fire HDX 7" & 8.9" General] ONYXis:
[MENTION=6403649]awinston[/MENTION], great news!

[MENTION=438903]dpeddi[/MENTION], i tried unlock on 13.4.5.3 - no luck - your unlock code is incorrect . Btw, i got this error when typed- flash unlock xxx.img , if i used oem unlock xxx.img - kindle just said OK. but still locked.

and I obtain manid and serial without root.
[Kindle Fire HDX 7" & 8.9" General] Cpasjuste:
Cool thanks :) Good to see some help here on this device !
[Kindle Fire HDX 7" & 8.9" General] DisgruntledUser:
Unlock

If I attempt to use the unlock posted above and it fails will the kindle just reject the change or will it screw with something else and give me a nice hunk of electronics. Additionally if the unlock does work can I use the existing TWRP or would I need to compile for the updated bootloader.

FYI: Running 13.3.2.7 downgraded from 13.4.5.2 so using the new bootloader.
[Kindle Fire HDX 7" & 8.9" General] veaceslav:
Somebody tried in on 4.5.3?
[Kindle Fire HDX 7" & 8.9" General] djclark25:
So let me get this straight in my noob hdx brain. This exploit if working for 4.5.x would enable root?
[Kindle Fire HDX 7" & 8.9" General] p1gl3t:
Yup. I'll upload an apk for 4.5.2 very soon (<1h, I hope)
[Kindle Fire HDX 7" & 8.9" General] Raptor270:
I'm currently on 4.5.1, will this work there too or do i need to update somehow
[Kindle Fire HDX 7" & 8.9" General] djclark25:
You beauty!!!! I'm on 4.5.3 so exploit still OK for this version?
[Kindle Fire HDX 7" & 8.9" General] Demonoid111:
If you follow the directions, nothing will happen. It will either pass or fail, and all you will need to do is reboot your kindle.

Note: I am on 13.3.1.0 and nothing happens when my unlock code failed. When I resigned it, it passed.
[Kindle Fire HDX 7" & 8.9" General] p1gl3t:
I have embedded a hacked version of a SuperSU recovery zip. It seems to work, but as my rom was already rooted I'm not 100% sure that everything is allright.

This might break things, so please wait until someone with a custom recovery and stock rom tests it. I would clean up my root and test it myself, but I gtg right now.

For the exploit to work you have to enable mock locations from Developer Options.

You have to click the button 2 times as the first run doesn't trigger the exploit.

It was only tested with 14.4.5.2, but should also work with 13.4.5.2.

For other versions we need the kernel symbol addresses and the rop chains. If you are on < 4.5.2 no not upgrade as we will have a solution for you soon enough.

[MENTION=6403649]awinston[/MENTION] stated in a previous post that Amazon patched the system exploit on 4.5.3, so bad luck for those that have upgraded to the latest version.
[Kindle Fire HDX 7" & 8.9" General] veaceslav:
Do you have a version of apk which only attempt to get root access, without modifying anything, so I could test on 4.5.3?
[Kindle Fire HDX 7" & 8.9" General] djclark25:
Yes I would be happy with just root on 4.5.3. I suppose Amazon would be more willing to roll back from 4.5.3 to 4.5.2 if wanted more then to roll back to 13.x
[Kindle Fire HDX 7" & 8.9" General] Potato_of_Doom:
Thank you, your APK works perfectly but you have to manually reboot until SuperSU recognizes its powers^^

Btw. Xposed is also working...
[Kindle Fire HDX 7" & 8.9" General] p1gl3t:
You can test that one and see if system crashes. It won't modify anything because the rop chains will be wrong.
[Kindle Fire HDX 7" & 8.9" General] veaceslav:
Guys with 4.5.3 : No luck! :(((((

here is a log cat...

http://pastebin.com/wxyUMsS4

I feel like Amazon is watching every single thread at XDA and patches everything up, before we can get something...
[Kindle Fire HDX 7" & 8.9" General] awinston:
Worst case you can ask for a downgrade to 3.2.8 then manually upgrade back to 4.5.2. I could only get the manual upgrade to work by side loading the update bin after doing a factory reset. Maybe someone smarter than me can figure out how to do it without doing the factory reset. The other problem though is that once you update manually to 4.5.2 OTAs start working again so you have to make sure not to turn on wireless before rooting.
[Kindle Fire HDX 7" & 8.9" General] veaceslav:
How did you figure out that vulnerability was patched? Maybe I miss a different ROP chain for 4.5.3?
[Kindle Fire HDX 7" & 8.9" General] awinston:
I checked the rop chain for the 4.5.3 update when I got it and I also downloaded it earlier today and checked again and it was the same. You are welcome to check, maybe I missed something obvious, in particular rop chain 4. Certainly worth someone taking a hard look though to see if there still might be a way.
[Kindle Fire HDX 7" & 8.9" General] zxz0O0:
Good job :good:

I assume you have reverse engineered my work or did you figure out the kernel exploit by yourself?
[Kindle Fire HDX 7" & 8.9" General] veaceslav:
But how did you check that vulnerability is fixed? Any changelog?
[Kindle Fire HDX 7" & 8.9" General] rubinho:
Wer hats erfunden ? :D
[Kindle Fire HDX 7" & 8.9" General] awinston:
I checked the 4.5.3 core jar. It appears to have the patch to ObjectInputStream.

https://android.googlesource.com/platform/libcore/+/738c833d38d41f8f76eb7e77ab39add82b1ae1e2^!/#F0