yashsingh1/xdaforums huggingface dataset:
[LG V20 Questions & Answers] antintin:
Microsoft Windows [Version 10.0.17763.805]

(c) 2018 Microsoft Corporation. All rights reserved.

C:\Program Files (x86)\Minimal ADB and Fastboot>adb devices

List of devices attached

LMG820UM270ff472 device

C:\Program Files (x86)\Minimal ADB and Fastboot>adb shell

alphalm:/ $ cd /data/local/tmp

alphalm:/data/local/tmp $ ./su98

MAIN: detected kernel version other than 3

MAIN: starting exploit for devices with waitqueue at 0x98

PARENT: soon will be calling WRITEV

CHILD: Doing EPOLL_CTL_DEL.

CHILD: Finished EPOLL_CTL_DEL.

CHILD: initial portion length 0x12000

CHILD: task_struct_ptr = 0x0

PARENT: writev() returns 0x13008

PARENT: Reading leaked data

CHILD: task_struct_ptr = 0x0

CHILD: Finished write to FIFO.

CHILD: **fail** problematic address pointer, e.g., 0

MAIN: **fail** retrying

PARENT: soon will be calling WRITEV

CHILD: Doing EPOLL_CTL_DEL.

CHILD: Finished EPOLL_CTL_DEL.

CHILD: initial portion length 0x12000

CHILD: task_struct_ptr = 0x0

PARENT: writev() returns 0x13008

PARENT: Reading leaked data

CHILD: task_struct_ptr = 0x0

CHILD: Finished write to FIFO.

CHILD: **fail** problematic address pointer, e.g., 0

MAIN: **fail** retrying

PARENT: soon will be calling WRITEV

CHILD: Doing EPOLL_CTL_DEL.

CHILD: Finished EPOLL_CTL_DEL.

CHILD: initial portion length 0x12000

CHILD: task_struct_ptr = 0x0

PARENT: writev() returns 0x13008

PARENT: Reading leaked data

CHILD: task_struct_ptr = 0x0

CHILD: Finished write to FIFO.

CHILD: **fail** problematic address pointer, e.g., 0

MAIN: **fail** retrying

Failed to leak data: error

1|alphalm:/data/local/tmp $

that's whats happening to me on lg g8 kernel version 4.14.83 (just saw it wasn't 4.4)
[LG V20 Questions & Answers] arpruss:
If we have the kstack, we can probably make a good guess as to where the kernel code is.

Or we can find the user_ns address as in the original poc and crack kaslr immediately.
[LG V20 Questions & Answers] DrZener:
Not vulnerable, your device is too recent.
[LG V20 Questions & Answers] chompie1337:
yes i think you're right. i prefer guessing through kstack (maybe won't have to guess, maybe kernel base is predictable this way, not sure). as the user_ns way requires the offset from cred struct and also the offset to init_ns from the kernel base and most people seem to be having trouble finding their offsets

updates on bypassing SELinux (on devices that don't allow permissive) and Samsung RKP

seems that this technique:

https://www.blackhat.com/docs/us-17...ating-Samsung-KNOX-With-Zero-Privilege-wp.pdf

could work. i tested it and the string /sbin/poweroff is writable. exciting!

---------- Post added at 12:40 AM ---------- Previous post was at 12:32 AM ----------

you never posted your firmware, but if this link that you posted is your kernel source, the vuln has been patched.
[LG V20 Questions & Answers] arpruss:
I'm terminating my public development of this exploit due to legal worries related to: https://www.eff.org/deeplinks/2018/...s-whittle-our-own-personal-jailbreaking-tools

I hereby release all the code I wrote for this into the public domain, but I've deleted the github repo. Sorry.
[LG V20 Questions & Answers] Supersonic27543:
No worries, thank you very much for helping us! :) It's been awesome to work with you. Hope you wouldn't get into legal trouble, now that you have discontinued development. Good luck! :good:
[LG V20 Questions & Answers] pipop62:
hi, thanks for your work, any chance to have the new link for the code? at least for the development until today? thanks.
[LG V20 Questions & Answers] ilikenwf:
Could have put it up on an encrypted keybase git repo dude...

https://repo.or.cz/cve2019-2215-3.18.git

There's my mirror.

Someone fork it to a keybase, github or bitbucket and we can keep collaborating. IMO there's nothing to fear, screw the feds on this.
[LG V20 Questions & Answers] Rortiz2:
Cool. So here you are:

https://mega.nz/#!nxkE2QJb!Bh22U809US-fWYiVkEfJIy3yXISeBO4Ff5F7yuOCMEA

BTW: It's 4.23 so maybe they already patched the vuln :confused:
[LG V20 Questions & Answers] Supersonic27543:
Is it 4.4.23? I can't see Linux Kernel 4.23 mentioned anywhere in Google. If it is 4.4.23 then IMO there's a fair chance that the kernel is vulnerable. :)

BTW have you tried running the exploit with my device's offsets? Both are Huawei so maybe they will work for you too. (binder thread size 0x198, waitqueue offset 0xa8)

Good luck!
[LG V20 Questions & Answers] Rortiz2:
lol yeah, 4.4.23 xD:

Linux localhost 4.4.23+ #1 SMP PREEMPT Wed Jun 27 10:36:05 CST 2018 aarch64

Also I didn't tried.. I don't have time to recompile it xD.

You have the compiled binary?

Cheers!
[LG V20 Questions & Answers] Supersonic27543:
I decided to switch to Debian and I didn't backup the binary. Fortunately my phone had it backed up. Also I renamed this to su98.txt to upload here, you should rename it to su98 before executing ;) Good luck!
[LG V20 Questions & Answers] Supersonic27543:
Still wow, that's great! The offsets are correct so no need to go through the disassembly :D And the exploit can read/write kernel memory. The problem in your device seems to be about the same of mine. (not exporting selinux_enforcing symbol) When I get Debian running I'll compile the latest code, maybe it would work differently on your device.
[LG V20 Questions & Answers] DrZener:
The problem is not that's not exporting selinux_enforcing, but that it fails to find both format string and kallsyms table.

BTW, is anyone working on armv7 porting?
[LG V20 Questions & Answers] Supersonic27543:
My device doesn't export it according to the disassembly. :( It also fails to find the format strings and kallsyms table. Are there any way to find whether it exports or not without disassembling? Thanks.
[LG V20 Questions & Answers] Rortiz2:
Agreed. I'm root so if there's any way to print it with root I can try:)
[LG V20 Questions & Answers] DrZener:
Like mine, that's why I wrote the avc_denied parser.

That's the real problem. Try do dump some RAM and manually look for format strings or kallsyms table in order to understand why automatic detection fails.

P.S.: exploit uses a fixed kernel base. If you have KASLR you have to take it into account
[LG V20 Questions & Answers] Supersonic27543:
Okay, thanks for the information! :) I confused the terms, sorry, what I meant to say was that in my device selinux_enforcing address doesn't have an effect according to the disassembly, SELinux is always enforcing (See post #143) If it indeed doesn't have an effect do we still need to find the kallsyms table? (and the kernel base) Thanks! :)
[LG V20 Questions & Answers] DrZener:
Ok, that's a different matter. I haven't a device w/o permissive domain (nor with KASLR) to do tests, but I think you still need the symbols table to get offest for code patches.

Unless you have a Samsung with KNOX, that's another story
[LG V20 Questions & Answers] Supersonic27543:
It's Huawei, I am not aware of any "special" protections (except the kstack randomization) I did see in one release PDF about something called HKIP (Huawei Kernel Integrity Protection) and it stated that the newer devices have hardware based hypervisors, but that being only there makes me think that it is not implemented or something. Thanks!
[Fire HD 8 and HD 10 General] Kctucka:
There's a new Fire 10 coming out, with an Octacore processor, USB-C charging, and FireOS based on Pie:

https://arstechnica.com/gadgets/201...hd-10-tablet-costs-149-and-charges-via-usb-c/

I most certainly don't need any more fire tablets in my life, but this does look pretty cool. I wonder how hackable it is :p

Update 12/27/2019:

See post below for temporary root method from [MENTION=8132642]diplomatic[/MENTION]:

https://xdaforums.com/hd8-hd10/orig-development/experimental-software-root-hd-8-hd-10-t3904595

Note that this is only compatible with the firmware fresh out of the box. Do not let it update if you want temporary root.

You can also make use of bootless root for a more permanent root solution (though, you cannot modify the system partition):

https://xdaforums.com/showpost.php?p=79626434&postcount=135
[Fire HD 8 and HD 10 General] thejoker954:
Damn, I'd have liked to see more ram. I could take or leave the processor upgrade. USB-C is good though.
[Fire HD 8 and HD 10 General] zed011:
3GB ram would have been nice for sure. I'm guessing this 2GHz octa-core processor is the MT8392
[Fire HD 8 and HD 10 General] xenokc:
Hopefully XDA devs will be motivated to root this one. Sounds worth the effort.
[Fire HD 8 and HD 10 General] Rortiz2:
[MENTION=7104332]k4y0z[/MENTION] [MENTION=9667509]xyz`[/MENTION] what do you think guys about exploit this :p

Looks very nice but IDK if amonet will work. Maybe kamakiri? Just for know xD.

Regards and sorry for the ping.

EDIT: From what I can see it runs MT8163 so it's like the ONN tablet but with FireOS.
[Fire HD 8 and HD 10 General] Kctucka:
Isn't that the same SoC as the HD8?
[Fire HD 8 and HD 10 General] NerdFire:
If I had the money I'd buy one just to be in the vanguard -- and to open it up to see if it has the CLK test point that's been so successful in unlocking the 8th gen Fire HD 8.

I'm also curious: since the current version is such an improvement over its predecessor, will this one be a similar leap forward? It's hard to imagine, but it might be worth checking out a few months down the road when they either go on sale or Amazon Warehouse gets a few refurbs. (I'll also probably wait to see if this model is a drop-in replacement for the one I have one that's in an Echo Show Mode case.)

EDIT: Well of course it can't just drop in. USB C vs. MicroUSB for the connector. Derp.
[Fire HD 8 and HD 10 General] Rortiz2:
Yep.

But HD8 uses QuadCore and the new HD10 OctaCore.
[Fire HD 8 and HD 10 General] Kctucka:
I didn't realize they messed with cores and frequencies and still called it the same SoC?

Just curious, what's your source for MT8163?
[Fire HD 8 and HD 10 General] Rortiz2:
Soorry.

It's MT8183. I minunderstood the CPU :p
[Fire HD 8 and HD 10 General] AmznUser444 Dev:
It's possible to use a microUSB type B to type C adapter for charging?
[Fire HD 8 and HD 10 General] DB126:
Yes provided the adapter is properly designed which most are. Same goes for basic data transfer and adb; may not work for fastboot.
[Fire HD 8 and HD 10 General] MarkMcCoskey:
The new Fire HD 10 is the 2.0 GHz octa-core MediaTek MT8183 processor with a Mali-G72 graphics processing unit (GPU).

https://tabletmonkeys.com/new-fire-hd-10-mt8183-processor/
[Fire HD 8 and HD 10 General] AmznUser444 Dev:
ADB and Fastboot script will work when using USB C
[Fire HD 8 and HD 10 General] DB126:
Of course they will when used with the stock USB C cable. Poster's question pertained to the use of a "microUSB type B to type C adapter". Are you saying through experience a particular adapter works for ADB and fastboot?

In my experienced poorly designed (cheap knockoff) adapters may not work for fastboot communication. Same for bargain cables. Get what you pay for.
[Fire HD 8 and HD 10 General] AmznUser444 Dev:
Look Android 9 Pie features from official Android website

-> Adaptive Battery for optimizations

-> Adaptive brightness for the battery optimization

-> App timer

-> Digital Wellbeing

-> New Accessibilities: Sound Amplifier for make an audio is louder

-> Slices

-> Display cutout

-> HEIF photo format support
[Fire HD 8 and HD 10 General] Akopps:
Only 2GB of RAM probably means poor multitasking.
[Fire HD 8 and HD 10 General] DB126:
Not necessarily, unless you're looking for rapid switching among a dozen or more apps which would be a challenge given low end components (cpu, nand, etc). Android 9 does a commendable job managing larger ZRAM blocks given inherent limitations. Won't be a speedster but probably more tolerable than raw specs would suggest.
[Fire HD 8 and HD 10 General] bibikalka:
The big question is whether this chipset has the proper bootrom bug to enable the unlock - or at least, writing into Emmc memory.

[MENTION=9667509]xyz`[/MENTION] , [MENTION=7104332]k4y0z[/MENTION]
[Fire HD 8 and HD 10 General] xyz`:
We can't tell whether it's vulnerable until it ships. Also, for a proper untethered unlock the bootrom vulnerability isn't enough, we need one in LK too.
[Fire HD 8 and HD 10 General] SurroundSound:
This tab needs some better memory management, reloads everything from multitask menu as far as I can tell. Surely 2gb ram can keep at least 3 or 4 apps open ?? Barely keeps one open without reloading :(. I debloated mine with the fire tool, hasn't really made a big difference really other then making it look and feel like a regular android tablet. I hope root comes along soon. I'd like to see lineage on this, but it may not be worth it with the ram. Why didn't they put at least 3gb ram in this thing.
[Fire HD 8 and HD 10 General] ILoveLamp2234:
It turns out my device updated to the dreaded update everyone has been avoiding. When it did it is beyond me but it happened. I decided to run SnoopSnitch anyways and it says the patch is from 2018. I hope it helps somewhat regardless.
[Fire HD 8 and HD 10 General] Supersonic27543:
Every SnoopSnitch checked vulnerability from 2019 is patched?! It doesn't look good right now, I think that the only hope is a bootrom vulnerability or mtk-su (and speaking of that [MENTION=8132642]diplomatic[/MENTION] is there still a possibility that this firmware might be vulnerable? :)) or a nice future vulnerability. Thank you for checking!
[Fire HD 8 and HD 10 General] dr_docdoc:
I still have several of these unopened. I can look later when I get home today after work. However, off the top of your head or if you can check now, what version does the system say it is on? The one that I did have open that I was able to Wipe before the update that downloaded installed still says from August 2019, which is before the month I actually even purchased it. So I’m guessing, but I don’t have an updated device on that one yet, perhaps?
[Fire HD 8 and HD 10 General] MontysEvilTwin:
In addition, there is no option to do an adb sideload in the recovery menu.
[Fire HD 8 and HD 10 General] dr_docdoc:
So not sure what version you see that was “updated” where all vulnerabilities have been patched, but I opened and booted all my device, and they all have the same version and date (see attached pic):

7.3.1.0 build date August 14, 2019, 12:24 AM

If there is anything I can do to help along the way towards rooting, let me know and I’ll try my best to get you the information you want.
[Fire HD 8 and HD 10 General] AmznUser444 Dev:
Can you take apart (remove back cover) your newest Fire HD 10 and post the motherboard pictures with test point like CLK, DAT0, CMD and removed metal shield.
[Fire HD 8 and HD 10 General] dr_docdoc:
AmznUser444,

I’m actually going to respectfully ask you to stop responding to my posts and stop asking me for anything. I will no longer reply to your posts other than to make this request.
[Fire HD 8 and HD 10 General] dr_docdoc:
I am running the Fire HD 10 2019 on the "virgin" OS that came out of the box: Fire OS 7.3.1.0 Build Date: August 13, 2019, 7:24 PM

I side-loaded SnoopSnitch, followed post #147 (to block OTA and KINDLE ads).

I then connected to internet and immediately ran the SnoopSnitch test.

The results are attached in the pic. Any good news here?
[Fire HD 8 and HD 10 General] diplomatic:
No, it's not vulnerable to mtk-su, sorry.

Look, it's pretty much expected that Amazon would have released this tablet with everything already patched. They are not playing around. We got pretty lucky with the Fire 7 of 2019, but that's it. The state of this tablet is pretty much like the state of the past HD8/HD10s was in 2017-2018. All "security" research has to start from the bottom, again. None of the previous hacks will apply. The only exception I can think of is some kind of a tethered root using a bootROM exploit.

I think people have unrealistic expectations about rooting this tablet. The string of Mediatek/Amazon hacks of 2019 has given some the impression that unlocking any Fire tablet is easy, and that every new device will be cracked in short order. The reality, I think, is that it may take months or years for a rooting method to be found. I, for one, am not eager to start digging into this device, and I understand why other hackers would not be either...
[Fire HD 8 and HD 10 General] Supersonic27543:
Thank you for testing that! It is strange how so much tests are inconclusive, I will test the exploits I can find on 7.3.1.0 when the tablet arrives. :)

Yes, currently this is looking like an another case like HD 8 2017. :( I was thinking that this wouldn't be too hard to crack for a temporary root (so we can install Magisk to an unverified partition for a limited root) because of the mediocre security patch, but the date must be a mistake. And the HD 8 took more than a year to crack until finally mtk-su nailed it down and it didn't even have AVB. (I think having no way to reflash is bound to slow down development too) Probably there are some vulnerabilities in the earlier 7.3.1.0 but I'm not hopeful about it (still its build date being August suggests that it might be vulnerable to CVE-2019-2215) Thank you!
[Fire HD 8 and HD 10 General] dr_docdoc:
Yer welcome! And, I’m still ROOTin’ for ya!

;););)
[Fire HD 8 and HD 10 General] DKXC:
I got a Fire HD 10 recently on Black Friday week for only 99€. It's actually a great tablet and the performance is pretty good compared to my Fire HD 8, 8th gen.
[Fire HD 8 and HD 10 General] dr_docdoc:
Setting up shop!

At this point, I’m all in. “Budget” YouTube Gaming Studio—Family Friendly (of course).

The kiddos think they’re SMOKIN’ compared to graphics and performance of their Rooted Fire HD 8 6th gen (2016).

Hey! These can play Mario Kart Tour as smooth as silk!

Now, just to test how well AdGuard might satisfy in app ads during gameplay.

Also, rooting will hopefully happen (sometime) so I can also “debloat” the memory usage, too!

They always “gaming,” so If you can’t beat ‘em—join ‘en (and see if I can at least recover the investment, LOL)!

:D:D
[Fire HD 8 and HD 10 General] ILoveLamp2234:
Ended up returning my HD 10; it did what I wanted it to as far as performance wise but I’m just going to revert my chrultrabook back to chromeOS and I’ll just work with Android that way ?. Looking forward to seeing the progress of this thread. Maybe I’ll end up buying it again down the line. Good luck to everyone though!
[Fire HD 8 and HD 10 General] DB126:
Wait ... doesn't that Amazon Dev 444 dude have all the answers?

mtk-su was an unexpected gift and a rare find in today's security concious world. Same for the ridiculous hardware exploits that unlocked swath of devices. Folks need to reset expectations regarding finding and leveraging vulnerabilites on newer devices. Could happen...but probably won't anytime soon.
[Fire HD 8 and HD 10 General] dr_docdoc:
Well, for my part, I came here looking for a root solution to debloat and increase performance on said subject device.

What I learned is that I’m able to achieve an experience on an unrooted device that gives me very close the same as my original desires.

Between learning about the OTA block on this thread (still hasn’t updated and we’ll see if it persists) and the Amazon Fire ToolBox (now v 6.3), I have a device that pretty much looks and feels like virgin Android. I also saw memory usage drop from 1.6 GB to 1.3 GB after the debloat.

I would like to further my quest in discovering if there are any other Amazon native services that could be disabled to possibly free up more memory and make this tablet scream (for the low-midrange that is is, anyway).

Anything else out there I could use?

Thanks again to you all!
[Fire HD 8 and HD 10 General] DB126:
Spot on. Considerable usability benefits can be obtained without rooting or resorting to a custom ROM (often with liabilities) on more recent versions of FireOS which are just as bloated but less restrictive than earlier builds. The excellent Toolbox makes many if these 'tweaks' easy to apply. I'm cautiously optimistic the soft OTA block will hold but history suggests otherwise.

If you are looking to further optimize take a peek at running services under developer options. Items with the biggest memory footprint are obvious canidates for further consideration. That said, once swapping is under control killing additional background services has diminishing returns. Good luck!
[Fire HD 8 and HD 10 General] diplomatic:
The security patch date is pretty meaningless. It's not one big patch that comes with the date baked in. It's dozens of little patches that must be applied manually. The date is also entered separately. So the date is more like a claim of the patch level rather than the proof.

But nonetheless, I will make an mtk-su build that is tuned for that firmware and send it to you or someone who has the old version. Worth a short at least...

Oh yeah, all we have to do is find the test points and an exploit will practically write itself. :)

As I said before, I think there are still plenty of security holes to be discovered in Mediatek-land. And there isn't a shortage of people in the world to find and exploit them. It's just that there isn't much incentive for hackers to put in the time and effort only to release it for free. Most of them time, these things are done by people who just wanted to hack their own devices.
[Fire HD 8 and HD 10 General] davidsummers:
So thats what you use ...
[Fire HD 8 and HD 10 General] DB126:
Well, isn't that the case with virtually all devices? Motivation and reward (which can take many forms) are always factors. Just look at the level of organic 'development' on 5th-8th gen devices after root and solid bootloader unlock were secured. Root simply doesn't hold the same appeal it once did for reasons we could debate for hours but the end result is the same across virtually all devices - not just Amazon gizmos.
[Fire HD 8 and HD 10 General] hotstocks:
Help please

Can you explain EXACTLY how and when to press each button after the triangle? And when to let go of each button. I just can't get it to go into recovery or get past that first triangle.
[Fire HD 8 and HD 10 General] dr_docdoc:
At white triangle with exclamation point:

Hold down power (again)

And tap (quickly press and release) volume up.

There you go!
[Fire HD 8 and HD 10 General] davidsummers:
OK, on fastboot the only command I've got to work is "fastboot reboot" other commands give

.

When go in via "adb shell" and log in as trhe user "shell" that has little rights. E.g. even "dmesg" gives "dmesg: klogctl: Permission denied"
[Fire HD 8 and HD 10 General] hotstocks:
Thanks, that worked! But after wiping dalvik cache twice and rebooting it didn't do the usual android thing and reload all the apps, went instantly to fire launcher, so not sure if wiping cache even works, oh well... Maybe root one day.
[Fire HD 8 and HD 10 General] novatillo:
PoC for CVE-2019-2215 https://github.com/grant-h/qu1ckr00t

Maybe someone with the device, and the appropiate knowledge and skills can try it.
[Fire HD 8 and HD 10 General] Supersonic27543:
I already checked that but the latest firmware is unfortunately not vulnerable. :( Maybe the older one is, going to try it out when my device comes. (The older ones kernel source was not released) Thank you!
[Fire HD 8 and HD 10 General] novatillo:
Yeahh, patched in AOSP in Feb 2018. If patched in last kernel version, probability will be also in previous version.

What about some more recent vulnerabilities?
[Fire HD 8 and HD 10 General] davidsummers:
Developer options

Thats interesting. Under developer option is "OEM unlocking" if you try and enable it it says "WARNING: Device protection features will not work while this setting is on" then hitting either CANCEL or ENABLE and it switches it off!