[Fire HD 8 and HD 10 Original Android Development] michi1051:
OK, after reboot it looks better, but su is still not found:

1|shell@suez:/data/local/tmp $ su

/system/bin/sh: su: not found

shell@suez:/data/local/tmp $ ./Matrix /data/local/tmp 2

<WSRoot><Command>0</Command></WSRoot>

<WSRoot><InitResource>0</InitResource></WSRoot>

Decrypt Success: /data/local/tmp/fileWork

Output File Name: /data/local/tmp/fileWork.

<WSRoot><Decrypt>0</Decrypt></WSRoot>

extracting: /data/local/tmp/Bridge_wsroot.sh

extracting: /data/local/tmp/krdirtyCow32

extracting: /data/local/tmp/krdirtyCow64

extracting: /data/local/tmp/libsupol.so

extracting: /data/local/tmp/my.sh

extracting: /data/local/tmp/mysupolicy

extracting: /data/local/tmp/patch_script.sh

extracting: /data/local/tmp/root3

<WSRoot><Decompression>0</Decompression></WSRoot>

execute string: /data/local/tmp/root3 /data/local/tmp/ 2

WARNING: linker: /data/local/tmp/root3: unused DT entry: type 0x6ffffffe arg 0x600

WARNING: linker: /data/local/tmp/root3: unused DT entry: type 0x6fffffff arg 0x1

ro.build.version.sdk :22

ro.product.cpu.abi :arm64-v8a

is x64

execute string: /data/local/tmp/krdirtyCow64 /data/local/tmp/ 2

WARNING: linker: /data/local/tmp/krdirtyCow64: unused DT entry: type 0x6ffffffe arg 0xd30

WARNING: linker: /data/local/tmp/krdirtyCow64: unused DT entry: type 0x6fffffff arg 0x1

path : /data/local/tmp/

path : /data/local/tmp

[*] path_script:/data/local/tmp/patch_script.sh /data/local/tmp

rm: /data/local/tmp/load: No such file or directory

supolicy v2.76 (ndk:armeabi) - Copyright (C) 2014-2016 - Chainfire

Patching policy [/data/local/tmp/sepolicy] --> [/data/local/tmp/load] ...

-permissive:zygote=ok

-permissive:kernel=ok

-permissive:init=ok

-permissive:su=ok

-permissive:init_shell=ok

-permissive:shell=ok

-permissive:servicemanager=ok

- Success

find_opcode offset:2d0 opcode:aaffbbee

find ok star:7fa9c72008 end:7fa9c722d8 size:2d0

sh : /data/local/tmp/my.sh /data/local/tmp 2 fwrite is count 212553 /data/local/tmp/load1

fwrite is count 54720 /data/local/tmp/load2

find_opcode offset:2b4 opcode:eaeaeaea

find_opcode offset:2b8 opcode:ebebebeb

find_opcode offset:22d opcode:abababab

load = 41409 load1 = 33e49 load2 = d5c0

find_opcode offset:2b0 opcode:efefefef

find_opcode offset:24d opcode:cdcdcdcd

find_opcode offset:2bc opcode:acacacac

init_shellcode

loadsize:267273

loadpath:/data/local/tmp/load

shpath:/data/local/tmp/my.sh /data/local/tmp 2

shpath:2bc

open /proc

PID:206

find logd pid : ce

_inject_start_s:0x7fa9c72008

Copying /sepolicy to /data/local/tmp/cp_sepolicy

cow_exploit_mv_file_init: Overriding /sepolicy from /data/local/tmp/load1

size: 212553

[*] mmap 0x7fa9a66000;

[*] exploit (patch)

[*] currently 0x7fa9a66000=8f97cff8c

checking the patch ... exploit

sched_setaffinity: Function not implemented[*] madvise = 0x7fa9a66000 212553

sleep 1s

sleep 1s

check done

sched_setaffinity: Function not implementedmadviseThread() done

procselfmemThread() done

[*] exploited 0x7fa9a66000=f97cff8c

[main]p_vdso_addr:0x7fa9c70000 p_vdso_buffer:0x400000

[*]set_ret_jmp

[*]set_ret_jmp 400410

[*]set_ret_jmp 400420

[main] write 1

Parent is over..status == 0

socket: No such file or directory

socket = 7

ret = 0

connect

: No such file or directory

ret = 32

find coe f

[main] write 2

Parent is over..status == 0

cow_exploit_mv_file_init: Overriding /sepolicy from /data/local/tmp/load2

warning: new file size (54720) and file old size (212553) differ

size: 54720

[*] mmap 0x7fa9c4a000;

[*] exploit (patch)

[*] currently 0x7fa9c4a000=8f97cff8c

sched_setaffinity: Function not implemented[*] madvise = 0x7fa9c4a000 54720

checking the patch ... exploit

sleep 1s

sleep 1s

check done

sched_setaffinity: Function not implementedmadviseThread() done

procselfmemThread() done

[*] exploited 0x7fa9c4a000=1ff0208

find coe 36

Parent is over..status == 0

cow_exploit_mv_file_init: Overriding /sepolicy from /data/local/tmp/cp_sepolicy

size: 212553

[*] mmap 0x7fa9a32000;

[*] exploit (patch)

[*] currently 0x7fa9a32000=1001901ff0208

sched_setaffinity: Function not implemented[*] madvise = 0x7fa9a32000 212553

checking the patch ... exploit

sleep 1s

sleep 1s

sleep 1s

check done

sched_setaffinity: Function not implementedmadviseThread() done

procselfmemThread() done

[*] exploited 0x7fa9a32000=f97cff8c

end!!!!!!!

<WSRoot><Exploit>0</Exploit></WSRoot>

<WSRoot><Done>0</Done></WSRoot>

---------- Post added at 01:06 AM ---------- Previous post was at 12:32 AM ----------

ok, success at the third time