[Fire TV General] ron1n541:
Really tried to get this to work. I think I'm close. I saw SELinux complain about the file size so I did some padding. Here's where I'm at

187594885]

I/Kernel ( 163): [ 1503.059370] (0)[163:healthd]healthd: battery l=100 v=4200

t=2.2 h=2 st=5 chg=u

W/linker (10431): ./dirtycow: unused DT entry: type 0x6ffffffe arg 0x600

W/linker (10431): ./dirtycow: unused DT entry: type 0x6fffffff arg 0x1

I/exploit (10431): size 223296

I/exploit (10431):

I/exploit (10431): [*] mmap 0xf7546000

I/exploit (10431): [*] exploit (patch)

I/exploit (10431): [*] currently 0xf7546000=464c457f

I/exploit (10431): [*] madvise = 0xf7546000 223296

I/Kernel ( 0): [ 1509.432532]-(2)[0:swapper/2]CPU2: Booted secondary process

or

I/Kernel ( 0): [ 1509.437302]-(3)[0:swapper/3]CPU3: Booted secondary process

or

I/Kernel ( 87): [ 1509.437743] (0)[87:hps_main][HPS] (0004)(1)(0)action end(2

7)(35)(0)(2) (2)(2)(2)(2)(2)(2)(2)(2)(1)(0) (6)(230)(0) (0)(0)(0) (0)(6)(230)(0)

(6)

I/exploit (10431): [*] madvise = 0 1048576

I/Kernel ( 0): [ 1511.439231]-(1)[0:swapper/1]CPU1: Booted secondary process

or

I/Kernel ( 87): [ 1511.440339] (0)[87:hps_main]CPU3: shutdown

I/Kernel ( 87): [ 1511.440873] (0)[87:hps_main][HPS] (0800)(1)(2)action end(1

05)(102)(0)(1) (2)(2)(2)(2)(2)(2)(2)(2)(1)(0) (105)(10)(0) (1666)(10)(0) (0)(102

)(10)(0)(102)

I/exploit (10431): [*] /proc/self/mem -1048576 1048576

I/exploit (10431): [*] exploited 0xf7546000=464c457f

I/art ( 501): Background partial concurrent mark sweep GC freed 256902(12MB

) AllocSpace objects, 15(2MB) LOS objects, 33% free, 20MB/31MB, paused 690us tot

al 136.802ms

E/WifiStateMachine( 501): WifiStateMachine CMD_START_SCAN source -2 txSuccessRa

te=50.64 rxSuccessRate=38.79 targetRoamBSSID=58:6d:8f:09:b7:37 RSSI=-39

E/WifiStateMachine( 501): WifiStateMachine L2Connected CMD_START_SCAN source -2

93, 94 ignore because P2P is connected

I/Kernel ( 87): [ 1513.438566] (0)[87:hps_main]CPU2: shutdown

I/Kernel ( 87): [ 1513.439651] (0)[87:hps_main][HPS] (0400)(2)(1)action end(7

)(4)(0)(0) (2)(2)(2)(2)(2)(2)(2)(2)(1)(0) (7)(10)(0) (288)(10)(0) (0)(4)(10)(0)(

4)

I/Kernel ( 87): [ 1515.438476] (0)[87:hps_main]CPU1: shutdown

I/Kernel ( 87): [ 1515.439146] (0)[87:hps_main][HPS] (0200)(2)(0)action end(4

)(3)(0)(0) (2)(2)(2)(2)(2)(2)(2)(2)(1)(0) (4)(10)(0) (46)(10)(0) (0)(3)(10)(0)(3

)

I/Kernel ( 119): [ 1521.197537] (0)[119:wdtk-0]wdk: [WDK], local_bit:0x1, cpu:

0, check_bit:0x1, RT[1521197519702]

I/Kernel ( 119): [ 1521.197575] (0)[119:wdtk-0]wdk: [WDK]: kick Ex WDT,RT[1521

197568471]

E/WifiStateMachine( 501): WifiStateMachine CMD_START_SCAN source -2 txSuccessRa

te=3.98 rxSuccessRate=3.61 targetRoamBSSID=58:6d:8f:09:b7:37 RSSI=-39

E/WifiStateMachine( 501): WifiStateMachine L2Connected CMD_START_SCAN source -2

94, 95 ignore because P2P is connected

^C

C:\Program Files (x86)\Minimal ADB and Fastboot>

130|shell@sloane:/data/local/tmp $ getenforce

Enforcing

130|shell@sloane:/data/local/tmp $ getenforce

Enforcing

I have an AFTV2 running latest firmware. I also noticed chainfires su binary i had was 32bit so I grabbed a 64bit one. Still no dice

shell@sloane:/data/local/tmp $ ls -la

-rwxrwxrwx shell shell 13776 2016-10-31 17:43 dirtycow

-rwxrwxrwx shell shell 223296 2016-10-31 18:27 ip

-rwxrwxrwx shell shell 223296 2016-10-31 19:48 ip_script

-rwxrwxrwx shell shell 108480 2016-10-31 19:39 su

shell@sloane:/data/local/tmp $

Hopes this helps someone