[Fire HD 8 and HD 10 General] Baiker000:
You need Linux or WSL for this.

You need to find ota update for your device Spoiler content hidden.

Open it as an archive and extract boot.img from it

You need unpackbootimg tool from https://github.com/osm0sis/mkbootimg and vmlinux-to-elf from https://github.com/marin-m/vmlinux-to-elf

Create folder unpacked and unpack boot.img using unpackbootimg -i boot.img -o unpacked

Get the base kernel address by adding base + kernel_offset, in my case its 0x40078000 + 0x00008000 = 0x40080000

In mali_shrinker_mmap32.c change #define KERNEL_BASE 0x40080000 to your base kernel address

Extract kernel ELF file by vmlinux-to-elf boot.img-kernel boot.elf

Extract kallsyms by kallsyms-finder boot.img-kernel > kallsyms.txt

Open kallsyms.txt and look at first entry. If its do_undefinstr then remove 0x1000 to get base address. For example ffffff8008081000 T do_undefinstr Means that base address is ffffff8008080000

In kallsyms.txt find:

sel_read_handle_unknown and then substract base from it. Then in mali_shrinker_mmap32.c replace #define SEL_READ_HANDLE_UNKNOWN_ONYX 0x32D220 with your value. For example:

ffffff80083ad220 t sel_read_handle_unknown means 0xffffff80083ad220 - 0xffffff8008080000 = 0x32D220

commit_creds. Do the same. Replace #define COMMIT_CREDS_ONYX 0x5B328 with your value

Open boot.elf in dissasembler, Ida Pro or Ghidra. Kernel is 64 bit so open in 64 bit version of disassembler.

Find sel_read_enforce function. You can you search in disassembler or find it in kallsyms.txt and jump to it (Press G in Ida pro). yellow is selinux_enforcing. You can decompile function to understand better . This is how it look in decompiler

And this is same function in kernel source code

After you get the address (FFFFFF800941AED4 in my example) do the same as you done with other kallsyms and replace #define SELINUX_ENFORCING_ONYX 0X139AED4 with your value

Now find prepare_kernel_cred the same as you done in previous step.

Yellow is init_cred.

Same function in kernel source

Do the same calculations and replace #define INIT_CRED_ONYX 0x12253F0

For ADD_INIT_ONYX open arm assembly to hex converter. I gonna use https://armconverter.com/

Set it to LLDB

In Assembly code put add x0, x0, #0x3f0 but instead of 0x3f0 write the last 3 digits of your INIT_CRED_ONYX. So in my example i have #define INIT_CRED_ONYX 0x12253F0 means my digits is 0x3f0. Convert it and take value from Arm64 Big Endian . Replace #define ADD_INIT_ONYX 0x910FC000 with this value

For ADD_COMMIT_ONYX do the same but use add x8, x8, #0x328 and take last 3 digits from COMMIT_CREDS_ONYX

Now build it. You need android ndk. I used android-ndk-r22b. build it using android-ndk-r22b/toolchains/llvm/prebuilt/linux-x86_64/bin/armv7a-linux-androideabi28-clang -DSHELL mali_shrinker_mmap32.c -o mali_shrinker_mmap32

Now place this mali_shrinker_mmap32 in tablet using adb:

adb push mali_shrinker_mmap32 /data/local/tmp

adb shell chmod +x /data/local/tmp/mali_shrinker_mmap32

Start it:

adb shell

/data/local/tmp/mali_shrinker_mmap32

Tablet may crash or code may stuck. Just retry until you get root. You can check if you root by command

whoami. It may take 20 or more retries and reboots until you get root

You can find selinux_enforcing in many functions, sel_read_enforce is just easy to find. but seems like init_cred used only in prepare_kernel_cred