[Fire General] bibikalka:
He-he, you wish! With SELinux on, everything is tightly controlled. On 6.0.1, I could use DirtyCow to replace any system files, and still that did not get me anywhere since I could not get around the SELinux permissions.

Here is the unpacking tool:

https://androidmtk.com/download-mtk-extractor

I am thinking DeviceSoftwareOTA would get us into recovery, now, if there was a way to manipulate recovery into something more useful than the typical commands, that'd be a good start. Basically, we could dump something into /cache/recovery/command, and have recovery run it. Of course, most of these features one can already access in recovery.

Below are permissions obtained for the OTA package from this command : dumpsys package com.amazon.device.software.ota. Even with these permissions, I am not seeing that we could do much. I've also uploaded the 'recovery' program which will be parsing anything in /cache/recovery/command, there are some strings in there, perhaps there is some useful command in there to put some images into Fire partitions without signature verification ...

Shared users:
SharedUser [com.amazon.device.software.ota] (a581137):
userId=32114 gids=[3003, 1028, 1015, 2001]
grantedPermissions:
android.permission.ACCESS_CACHE_FILESYSTEM
android.permission.DOWNLOAD_WITHOUT_NOTIFICATION
android.permission.WRITE_SETTINGS
android.permission.RECOVERY
com.amazon.dcp.ota.permission.QUERY_PENDING_UPDATES
android.permission.MODIFY_AUDIO_SETTINGS
com.amazon.dcp.messaging.permission.HANDLE_DEVICE_MESSAGE
com.lab126.downloads.DOWNLOAD_SVC_CLIENT_CONNECT
android.permission.INSTALL_PACKAGES
com.amazon.readynowcore.permission.READYNOW
com.amazon.dcp.ota.permission.CONTROLLER
android.permission.RECEIVE_BOOT_COMPLETED
com.amazon.kor.demo.provider.permission.READ_PROVIDER
android.permission.INTERNET
android.permission.READ_EXTERNAL_STORAGE
android.permission.GET_PACKAGE_SIZE
com.amazon.dcp.sso.permission.MANAGE_DEVICE_AND_USER_DATA
android.permission.INTERACT_ACROSS_USERS_FULL
com.amazon.dcp.settings.permission.READ_SETTINGS
android.permission.WRITE_SECURE_SETTINGS
android.permission.READ_PHONE_STATE
amazon.permission.COLLECT_METRICS
com.amazon.identity.permission.MULTIPLE_PROFILE_AWARE
android.permission.ACCESS_DOWNLOAD_MANAGER
android.permission.DELETE_CACHE_FILES
android.permission.ACCESS_NETWORK_STATE
android.permission.INTERACT_ACROSS_USERS
android.permission.REBOOT
com.amazon.identity.permission.GENERIC_IPC
android.permission.CLEAR_APP_CACHE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.CRYPT_KEEPER
com.amazon.dcp.sso.permission.USE_DEVICE_CREDENTIALS
android.permission.WAKE_LOCK
android.permission.ACCESS_DOWNLOAD_MANAGER_ADVANCED
android.permission.DELETE_PACKAGES

Activity Resolver Table:
Non-Data Actions:
android.intent.action.MAIN:
ab2393f com.amazon.device.software.ota/.dx.OtaDashboardActivity

Receiver Resolver Table:
Non-Data Actions:
com.amazon.intent.SYNC:
210dc20c com.amazon.device.software.ota/.OTASyncReceiver
com.amazon.dcp.ota.action.DEFERRED_OS_INSTALL:
25437755 com.amazon.device.software.ota/.OTADeferredOSInstallReceiver
android.intent.action.BOOT_COMPLETED:
cd3e56a com.amazon.device.software.ota/.OTABootReceiver
com.amazon.identity.auth.account.added.on.device:
201b2a5b com.amazon.device.software.ota/.AccountAddedReceiver
com.amazon.dcp.messaging.topic.OTA.CheckForUpdates:
fdaf2f8 com.amazon.device.software.ota/.S2DMReceiver
android.intent.action.MY_PACKAGE_REPLACED:
1a1133d1 com.amazon.device.software.ota/.OTAReplacedReceiver

Service Resolver Table:
Non-Data Actions:
com.amazon.dcp.ota.action.CONTROLLER:
3bc2ee36 com.amazon.device.software.ota/.OtaService

Key Set Manager:
[com.amazon.device.software.ota]
Signing KeySets: 2

Packages:
Package [com.amazon.device.software.ota] (1255ae5a):
userId=32114 gids=[]
sharedUser=SharedUserSetting{a581137 com.amazon.device.software.ota/32114}
pkg=Package{44846a4 com.amazon.device.software.ota}
codePath=/system/priv-app/DeviceSoftwareOTA
resourcePath=/system/priv-app/DeviceSoftwareOTA
legacyNativeLibraryDir=/system/priv-app/DeviceSoftwareOTA/lib
primaryCpuAbi=null
secondaryCpuAbi=null
versionCode=6092610 targetSdk=21
versionName=6.0.387.0_6092610
splits=[base]
applicationInfo=ApplicationInfo{1f243c0d com.amazon.device.software.ota}
flags=[ SYSTEM HAS_CODE ALLOW_CLEAR_USER_DATA PRIVILEGED ]
dataDir=/data/data/com.amazon.device.software.ota
supportsScreens=[small, medium, large, xlarge, resizeable, anyDensity]
usesLibraries:
com.amazon.identity.auth.device
usesOptionalLibraries:
com.amazon.dcp.contracts
com.amazon.device.settings.sdk.internal.library
retaildemoapi
com.amazon.readynow.api
usesLibraryFiles:
/system/framework/com.amazon.identity.auth.device.jar
/system/framework/retaildemoapi.jar
/system/framework/com.amazon.readynow.api.jar
timeStamp=2018-01-16 19:41:16
firstInstallTime=2018-01-16 19:41:16
lastUpdateTime=2018-01-16 19:41:16
signatures=PackageSignatures{bc7b7c2 [1289d3]}
permissionsFixed=false haveGids=true installStatus=1
pkgFlags=[ SYSTEM HAS_CODE ALLOW_CLEAR_USER_DATA PRIVILEGED ]
User 0: installed=true hidden=false stopped=false notLaunched=false enabled=0