[Fire HD 8 and HD 10 General] Mlinko6:
Hi All,

I have a fire HD 10 7th gen, OS 5.6.8.0 and the script runs good:

shell@suez:/data/local/tmp/fire $ ./Matrix /data/local/tmp 2

<WSRoot><Command>0</Command></WSRoot>

<WSRoot><InitResource>0</InitResource></WSRoot>

Decrypt Success: /data/local/tmp/fileWork

Output File Name: /data/local/tmp/fileWork.

<WSRoot><Decrypt>0</Decrypt></WSRoot>

extracting: /data/local/tmp/Bridge_wsroot.sh

extracting: /data/local/tmp/krdirtyCow32

extracting: /data/local/tmp/krdirtyCow64

extracting: /data/local/tmp/libsupol.so

extracting: /data/local/tmp/my.sh

extracting: /data/local/tmp/mysupolicy

extracting: /data/local/tmp/patch_script.sh

extracting: /data/local/tmp/root3

<WSRoot><Decompression>0</Decompression></WSRoot>

execute string: /data/local/tmp/root3 /data/local/tmp/ 2

WARNING: linker: /data/local/tmp/root3: unused DT entry: type 0x6ffffffe arg 0x600

WARNING: linker: /data/local/tmp/root3: unused DT entry: type 0x6fffffff arg 0x1

ro.build.version.sdk :22

ro.product.cpu.abi :arm64-v8a

is x64

execute string: /data/local/tmp/krdirtyCow64 /data/local/tmp/ 2

WARNING: linker: /data/local/tmp/krdirtyCow64: unused DT entry: type 0x6ffffffe arg 0xd30

WARNING: linker: /data/local/tmp/krdirtyCow64: unused DT entry: type 0x6fffffff arg 0x1

path : /data/local/tmp/

path : /data/local/tmp

[*] path_script:/data/local/tmp/patch_script.sh /data/local/tmp

supolicy v2.76 (ndk:armeabi) - Copyright (C) 2014-2016 - Chainfire

Patching policy [/data/local/tmp/sepolicy] --> [/data/local/tmp/load] ...

-permissive:zygote=ok

-permissive:kernel=ok

-permissive:init=ok

-permissive:su=ok

-permissive:init_shell=ok

-permissive:shell=ok

-permissive:servicemanager=ok

- Success

find_opcode offset:2d0 opcode:aaffbbee

find ok star:7f9524a008 end:7f9524a2d8 size:2d0

sh : /data/local/tmp/my.sh /data/local/tmp 2 fwrite is count 214219 /data/local/tmp/load1

fwrite is count 55008 /data/local/tmp/load2

find_opcode offset:2b4 opcode:eaeaeaea

find_opcode offset:2b8 opcode:ebebebeb

find_opcode offset:22d opcode:abababab

load = 41bab load1 = 344cb load2 = d6e0

find_opcode offset:2b0 opcode:efefefef

find_opcode offset:24d opcode:cdcdcdcd

find_opcode offset:2bc opcode:acacacac

init_shellcode

loadsize:269227

loadpath:/data/local/tmp/load

shpath:/data/local/tmp/my.sh /data/local/tmp 2

shpath:2bc

open /proc

PID:204

find logd pid : cc

_inject_start_s:0x7f9524a008

Copying /sepolicy to /data/local/tmp/cp_sepolicy

cow_exploit_mv_file_init: Overriding /sepolicy from /data/local/tmp/load1

size: 214219

[*] mmap 0x7f9503b000;

[*] exploit (patch)

[*] currently 0x7f9503b000=8f97cff8c

sched_setaffinity: Function not implemented[*] madvise = 0x7f9503b000 214219

checking the patch ... exploit

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

check done

sched_setaffinity: Function not implementedmadviseThread() done

procselfmemThread() done

[*] exploited 0x7f9503b000=f97cff8c

[main]p_vdso_addr:0x7f95248000 p_vdso_buffer:0x400000

[*]set_ret_jmp

[*]set_ret_jmp 400410

[*]set_ret_jmp 400420

[main] write 1

Parent is over..status == 0

socket: No such file or directory

socket = 7

ret = ffffffff

connect

: No such file or directory

ret = ffffffff

find coe f

[main] write 2

Parent is over..status == 0

cow_exploit_mv_file_init: Overriding /sepolicy from /data/local/tmp/load2

warning: new file size (55008) and file old size (214219) differ

size: 55008

[*] mmap 0x7f95222000;

[*] exploit (patch)

[*] currently 0x7f95222000=8f97cff8c

sched_setaffinity: Function not implemented[*] madvise = 0x7f95222000 55008

checking the patch ... exploit

sleep 1s

sleep 1s

check done

sched_setaffinity: Function not implementedprocselfmemThread() done

madviseThread() done

[*] exploited 0x7f95222000=3a01dc

find coe 36

Parent is over..status == 0

cow_exploit_mv_file_init: Overriding /sepolicy from /data/local/tmp/cp_sepolicy

size: 214219

[*] mmap 0x7f95006000;

[*] exploit (patch)

[*] currently 0x7f95006000=10007003a01dc

sched_setaffinity: Function not implemented[*] madvise = 0x7f95006000 214219

checking the patch ... exploit

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

sleep 1s

exit fork(), loop time more then 30s

<WSRoot><Exploit>0x00000332</Exploit></WSRoot>

check done

sched_setaffinity: Function not implemented<WSRoot><Exploit>0x00000382</Exploit></WSRoot>

FAIL : cp_sepolicy --> sepolicy

<WSRoot><Exploit>0x00000343</Exploit></WSRoot>

<WSRoot><Exploit>0x00000881</Exploit></WSRoot>

<WSRoot><Done>0x00000172</Done></WSRoot>

my folder output is:

2|shell@suez:/data/local/tmp/fire $ ls -la

-rwxr-xr-x shell shell 109400 2021-01-06 12:13 Matrix

-rwxr-xr-x shell shell 67 2021-01-06 12:14 ddexe

-rwxr-xr-x shell shell 1756 2021-01-06 12:14 debuggerd

-rwxr-xr-x shell shell 202824 2021-01-06 12:13 fileWork

-rwxr-xr-x shell shell 629 2021-01-06 12:14 install-recovery.sh

-rwxr-xr-x shell shell 757256 2021-01-06 12:14 krdem

-rwxr-xr-x shell shell 23 2021-01-06 12:14 mount

-rwxr-xr-x shell shell 32817 2021-01-06 12:14 patch_boot.sh

-rwxr-xr-x shell shell 13592 2021-01-06 12:14 pidof

-rwxr-xr-x shell shell 53881 2021-01-06 12:14 push_root.sh

-rwxr-xr-x shell shell 1912 2021-01-06 12:14 start_wssud.sh

-rwxr-xr-x shell shell 75348 2021-01-06 12:14 su

-rwxr-xr-x shell shell 108480 2021-01-06 12:14 su_arm64

-rwxr-xr-x shell shell 6352731 2021-01-06 12:15 supersu.apk

-rwxr-xr-x shell shell 5476175 2021-01-06 12:14 supersu.zip

-rwxr-xr-x shell shell 101852 2021-01-06 12:14 supolicy

-rwxr-xr-x shell shell 177316 2021-01-06 12:14 toolbox

-rw-rw-rw- shell shell 0 2021-01-07 16:08 w

-rwxr-xr-x shell shell 38830 2021-01-06 12:14 wsroot.sh

but I can't get SuperSU to work. I can start ./su:

shell@suez:/data/local/tmp/fire $ ./su

1|shell@suez:/data/local/tmp/fire $

Can someone please help me out?

thank you!

KR

Rok