yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 General] Rortiz2:
Try disabling something else then. It's really just to check if Amazon blocked pm for shell or for everything that isn't root.​
[Fire HD 8 and HD 10 General] Azaze666:
The only problem is that this debuggable app has a lower id than adb, but it is part of many system groups, I'll give a try
[Fire HD 8 and HD 10 General] Azaze666:
tried "run-as com.amazon.venezia.intentproxy && pm disable-user --user 0 com.amazon.settings.systemupdates" and as well with com.amazon.device.software.ota.override, didn't work
[Fire HD 8 and HD 10 General] Azaze666:
I rooted ahahahahahhaah:https://xdaforums.com/t/fire-hd-8-2018-only-unbrick-downgrade-unlock-root.3894256/post-89546533
[Fire HD 8 and HD 10 General] 789mod:
i have mustang 7.3.2.2

how can unlock bootloader for it

or just root shell it
[Fire HD 8 and HD 10 General] A Cool User:
Fire 7 (2019, mustang) unbrick, downgrade, unlock & root

Make sure to read this guide completely before starting. You will lose all data on the tablet, make a backup of important data before you start. What you need: - a Linux installation. Don't use a VM! Use a live USB, if you don't have Linux...

xdaforums.com
[Fire HD 8 and HD 10 General] 789mod:
i know that but it after 2020

cant enter to bootrom
[Fire HD 8 and HD 10 General] Woolium:
I Have a onyx on 7.3.2.9 Nov 2023. can i do this?
[Fire HD 8 and HD 10 General] Woolium:
How to install?
[Fire HD 8 and HD 10 General] Azaze666:
Check if you have brom, doesn't matter if you have errors while entering it
[Fire HD 8 and HD 10 General] Woolium:
How do i check it?
[Fire HD 8 and HD 10 General] Azaze666:
Try to get in brom? Run the root method bootrom-step.sh and if handshakes or just finds bootrom port you have bootrom
[Fire HD 8 and HD 10 General] Woolium:
Where do i download that?
[Fire HD 8 and HD 10 General] 789mod:
any update for this ?
[Fire HD 8 and HD 10 General] fayazz13:
@Pro-me3us

Hi..

I tried the exploit for CVE-2023-6241 (https://github.com/github/securitylab/tree/main/SecurityExploits/Android/Mali/CVE_2023_6241).

It works perfectly fine on Pixel 8.

But, when I tried extending that to other vulnerable non-Pixel devices, it showed an error - CANNOT FIND REUSED PAGE:: ILLEGAL SEEK.

Is that something related to the defined TEST_VALUE=0x42424242 ? Or anything else?

I tested with Poco X6 Pro, Nothing Phone 2a, and Redmi Note 13 Pro+ by adding the offsets. All phones had the same error.

AND

Some devices with lower GPU revision levels with r32p1 give this error - BAD FILE DESCRIPTOR

Please help me with this.
[Fire HD 8 and HD 10 General] Pro-me3us:
IRC CVE-2023-6241 only works on devices with newer Mali Valhall GPUs (G78 or newer) with MTE support. I didn't look into that CVE since it only works on more recent higher-end devices.
[Fire HD 8 and HD 10 General] Woolium:
hey just wondering if you still have the files (bootrom-step.sh)
[Fire HD 8 and HD 10 General] Azaze666:
what model?
[Fire HD 8 and HD 10 General] Woolium:
onyx
[Fire HD 8 and HD 10 General] Woolium:
7.3.2.9 Nov 2023
[Fire HD 8 and HD 10 General] Azaze666:
i don't think there is a root with bootrom-step.sh for that? but i may be wrong
[Fire HD 8 and HD 10 General] Woolium:
dang. how would i go about rooting it with the mali exploit in the first place?
[Fire HD 8 and HD 10 General] Michajin:
Any of the bootrom steps from any of the amazon unlock threads will stop boot and put you into bootrom, ubuntu sees a MediaTek Inc. MT6227 from a lsusb in linux, if it was available, but it is not, the bootrom was disabled on all devices after 2019 and i have a onyx and looked for it. there was a user that said he was able to root i tablet with the same SOC as onyx ealier in this thread. post #268 says the tablet info and post #308 shows his success and a link for instructions. I will warn the risk of a brick if you can get anywhere with it
[Fire HD 8 and HD 10 General] Woolium:
Huh, okay. i'll look into it.
[Fire HD 8 and HD 10 General] Woolium:
I have my first error.

fingerprint: Amazon/onyx/onyx:9/PS7329.3851N/0029294004992:user/amz-p,release-keys

/data/local/tmp/shrinker: unable to match build id

: Success
[Fire HD 8 and HD 10 General] Michajin:
I'm not sure, you probably have to adjust the script for your build? FYI getting this to work will only get you into a temp shell root and you can't change the system files, but it gives access to block updates. I have a cube 3 that is the exploit.
[Fire HD 8 and HD 10 General] Woolium:
the guide said it unlocks the bootloader so i was going to flash Magisk after i finished it
[Fire HD 8 and HD 10 General] Michajin:
Ok. I would just see if you have root. I would be really surprised if you could unlock this. But if you don't care if you brick. Maybe message the op of the unlock if the unlock script and see if they can help you out. The Amazon os is such a mess now and without a custom ROM you might not have any options.
[Fire HD 8 and HD 10 General] fayazz13:
@Pro-me3us

Could you help in any way regarding the type/reason for this error ?

from https://github.com/github/securityl...its/Android/Mali/CVE_2023_6241/mali_jit_csf.c
[Fire HD 8 and HD 10 General] Pro-me3us:
I don't know, I've never encountered those errors. This exploit is completely unrelated to the shrinker exploit, relies on a different GPU driver line with newer features. These GPU drivers and exploits are pretty complex, and there's little chance that they will work between devices by only swapping out a couple kallsyms values. Check the Valhall driver source.
[Fire HD 8 and HD 10 General] oversleeper:
Any idea if any of these methods could be applied to fireOS 8.x devices?
[Fire HD 8 and HD 10 General] bibikalka:
Is there a small executable to run this and see its output? Could be a useful little tool if this line of root is to be pursued.
[Fire HD 8 and HD 10 General] relalis:
All the POC have setup_mali(int fd) that implements it.

struct kbase_ioctl_version_check param = {0};
if (ioctl(fd, KBASE_IOCTL_VERSION_CHECK, &param) < 0) {
err(1, "version check failed");
}
printf("mali ver %d.%d\n", param.major, param.minor);
[Fire HD 8 and HD 10 General] bibikalka:
Thanks! Btw, it looks like @diplomatic has not logged in for more than 20 months now:

Joined Mar 12, 2017

Last seen Sep 24, 2021

His mtk exploit code has been fantastic!

Edit @Pro-me3us: I tried raven versions here, but unfortunately it does not print the value of KBASE_IOCTL_VERSION_CHECK

trona:/data/local/tmp $ chmod +x ./raven_shrinker
trona:/data/local/tmp $ ./raven_shrinker
fingerprint: Amazon/trona/trona:7.0/PS7319/1726N:user/amz-p,release-keys
./raven_shrinker: unable to match build id
: Success
1|trona:/data/local/tmp $ chmod +x ./raven_buf
trona:/data/local/tmp $ ./raven_buf
fingerprint: Amazon/trona/trona:7.0/PS7319/1726N:user/amz-p,release-keys
./raven_buf: unable to match build id
: Success

Any of these folks are still around to help with hacking ??? This list is taken from "[UNLOCK][ROOT][TWRP][UNBRICK][...] FireTV 2nd gen Cube (raven) > PS7242" thread.

Contributors

@Functioner

@Zenofex

@npjohnson

@zeewox

@Pro-me3us

Additional thanks to

@tchebb - a bottomless encyclopedia of Amlogic knowledge, answering countless questions & troubleshooting

@roligov - providing photos, additional FireOS updates, and testing

@osm0sis, @canyie, @vvb2060 & @yujincheng08 - the Magisk team for being awesome, troubleshooting and making a number of code changes to get all features working on the Cube

@k4y0z - helping troubleshoot some TWRP and Magisk issues
[Fire HD 8 and HD 10 General] relalis:
You're trying to use the Raven PoC for a non-raven device out of the box, which isn't going to work. You first need to add the device fingerprint to select_offset() in mali_shrinker_mmap32.c, then you'll need the kallsyms for the kernel in question. After that, you'll probably need to modify the write_*() and fixup_root_shell() functions, and if you're unlucky you may have to modify the JIT calls to work on your specific mali gpu. Thankfully the differences between API versions aren't too much in the exploitable drivers, although the GPU memory management would likely require tweaking.
[Fire HD 8 and HD 10 General] webhook:
Will try on my FIre HD 10 2019 (mavericks) running FireOS 7.3.1.2 made after 2020
[Fire HD 8 and HD 10 General] Pro-me3us:
I briefly looked for the source for the MTK-SU exploit when I was trying to get bootless Magisk running. I didn't come across it, so I don't know if it was ever released, or how disabling selinux was done.

The original POC has a lot of checks to help debugging, you can comment out the fingerprint check and the POC will run until it hits the next check

err(1, "unable to match build id\n");

The POC only checks the version, it doesn't print it. You can follow @relalis's instructions and add the print command below the version check.

Amazon doesn't update GPU drivers unless it's required. No Fire device has probably gotten a gpu driver update since it's release, and may have only been updated for the first time in the past 2-3 months because of CVE_2022_38181. The patch for all the devices I have seen is to update to r38p0. Based on that, this is probably what you have:

FireHD 8 (12th gen) Bifrost r25p0, Kernel 5.4 Raspite

FireHD 7 (12th gen) Bifrost r25p0, Kernel 4.14 Quartz

FireHD 10 (11th gen) Bifrost r14p0, Kernel 4.4 Trona

FireHD 8 (10th gen) Bifrost r16p0, Kernel 4.14 Onyx

FireHD 10 (9th gen) Bifrost r14p0, Kernel 4.4 Maverick

FireHD 7 (9th gen) Midgard r26p0, Kernel 4.9 Mustang

FireHD 8 (8th gen) Midgard r26p0, Kernel 4.9 Karnak

Getting this to work is going to require having the device and the source in all likely-hood, to work through the shellcode portion. Please don't ping random people on this thread, the original Raven unlock exploit has zero relationship to this Mali GPU POC, and most will have no idea why you are mentioning them.

This POC has already been applied to the Onxy FireTablet. The Cube POCs were posted as a general guide with the 32bit conversation taken care of for other fire devices. It may benefit all the people working on this if everyone shared their source with each other as well.
[Fire HD 8 and HD 10 General] mind _spacer:
Kernel addresses used were,

Since AVC_DENY is not present in M30s I used SELINUX_ENFORCING,

SEL_READ_ENFORCE,

INIT_CRED,

COMMIT_CREDS these addresses are taken with relative to head.

and ADD_INIT, ADD_COMMIT calculated using @Rortiz2 told.

Are there any changes needed there? Is the MTK based dev is hard to exploit?

Also is it ok to use SELINUX_ENFORCING_BOOT instead of SELINUX_ENFORCING ?

New update:

I implemented the one of the new exploit mali_jit on the M30s and it executes completely,

shows: Result 49

Every step on the POC working as it is but unable to get root shell.

Do you know anything about why it is showing like that?
[Fire HD 8 and HD 10 General] Rortiz2:
Knox is probably preventing SELinux to be disabled. Take a look at chompie's sepolicy inject method.​
[Fire HD 8 and HD 10 General] Rortiz2:
As far as I'm concerned, different strategies are utilized by diplomatic's mtk-su in order to disable SELinux (please correct me if I'm wrong). For my specific scenario with the Amazon Fire HD8 2020, the avc_denied method never worked properly—it consistently caused device crashes. As a result, I resorted to directly writing to selinux_enforcing. However, this method isn't universally applicable. It demands a thorough analysis of each FireOS update's kernel binary to accommodate varying software updates. That being said, there must be a way to dynamically find selinux_enforcing. I just haven't had time (nor motivation, I guess) to do so.​
[Fire HD 8 and HD 10 General] mind _spacer:
Yeah probably, did you know any info about how Knox can be disabled (Other than chompie's method) on android 10 & above?

But out of curiosity I have looked on another device which has Mali GPU driver.

It's a Xiaomi's Redmi note 9 (Android 12, 4.14 Kernel ver). But it is also showing the same which the code run completely and ends with Result 49.

And when it runs with 32bit poc of cube its runs & prints Result 48.

It doesn't have SELINUX_ENFORCING so I run it using AVC_DENIED. I assume that it's doesn't have security mechanism like Knox.

So, what do you guys think @Pro-me3us @Rortiz2 is there any other reason POC doesn't work?
[Fire HD 8 and HD 10 General] bibikalka:
The devices from the modern list that MTK exploit ever worked for are: HD 8 (8th gen), Fire 7 (9th gen), and HD 10 (9th gen). HD 8 (8th gen) was a particularly popular device given the early unlock by @xyz`. I recall Karnak at some point switched from Android 7, to something newer, which was incompatible with the earlier root/unlock. Of course, the original MTK exploit did get patched, but it seems that the way @diplomatic disabled SELinux could work for at least some of these devices, such as HD 10 9th gen.

Is HD8 2020 that different from HD10 2019 where MTK exploit worked fine? It seems that HD8 has a newer kernel, but did that change things materially?

It feels that if there was a way to get hold of @diplomatic 's work, it'd be possible to crack at least some of these devices really quickly.
[Fire HD 8 and HD 10 General] 789mod:
i'll try on my

FireHD 10 (11th gen) Bifrost r14p0, Kernel 4.4 Trona
[Fire HD 8 and HD 10 General] 789mod:
where im use this code ?

kallsyms_finder.py ?
[Fire HD 8 and HD 10 General] 789mod:
i want this file plz
[Fire HD 8 and HD 10 General] mind _spacer:
I just want little help here,

I was being used the KERNEL BASE value in the original POC till now.

Someone please tell how to find the KERNEL BASE specified in the POC.

Any help would be appreciated.
[Fire HD 8 and HD 10 General] relalis:
If you don't have root access, you can use unpackbootimg to extract it from an update's boot.img. The generated boot.img-kernel_offset contains the kernel base offset.
[Fire HD 8 and HD 10 General] deckinghalls:
I'm attempting to get this up and running for my Fire HD 10+ (2021) running Fire OS 7.3.2.1. A few questions:

1. I've found the firmware update for the HD 10+ (PS7321/2324N) but my fingerprint indicates PS7321/2326N. As I cannot find a source for 2326N's update, is it okay to use 2324N's update? If not, does anyone have 2326N's or could point me in the right direction to dump my own boot.img without root?

2. In order to get the kernel base as mentioned in the post above mine, I used the unpackbootimg script. Comparing what's in the exploit for Gazelle with the output from running unpackbootimg on Gazelle's boot.img, it appears that the required kernel base is actually "BOARD_KERNEL_BASE" + "BOARD_KERNEL_OFFSET". In the case of Gazelle, BOARD_KERNEL_BASE = 0x1078000 and BOARD_KERNEL_OFFSET = 0x8000. Adding the two together gets 0x1080000 which is what the exploit shows. Applying that to Trona's values of 0x40078000 and 0x8000, I'd get 0x4008000. Is that correct?

3. I think I got the rest of the kallsym values correct, including the add_* ones (assuming my kernel base is correct and that I can use 2324N's boot.img). Added the fingerprint to Gazelle's exploit since the kallsyms more closely aligned with Gazelle than Raven. Compiled, pushed to the tablet, chmodded it, and ran. Got a JIT error and "not a typewriter". I figured I would run into this given what's been posted, but does this indicate that the rest of everything else is correct and I can move onto the JIT part?
[Fire HD 8 and HD 10 General] relalis:
KBASE_IOCTL_MEM_JIT_INIT for that board may be failing due to API version mismatch with the base struct defined in mali.h. You might want to check your major and minor versions, although I'd wager that the Fire HD 10 uses midgard api 11.11. This diff should fix your ENOTTY error and print out the mali API version (if it doesn't work, restore { group_id << 3} in `kbase_ioctl_set_flags set_flags`).

diff --git a/mali.h b/mali.h
index 3b61e20..e7d6934 100644
--- a/mali.h
+++ b/mali.h
@@ -492,9 +492,7 @@ struct kbase_ioctl_mem_jit_init {
__u64 va_pages;
__u8 max_allocations;
__u8 trim_level;
- __u8 group_id;
- __u8 padding[5];
- __u64 phys_pages;
+ __u8 padding[6];
};

#define KBASE_IOCTL_MEM_JIT_INIT \
diff --git a/mali_shrinker_mmap32.c b/mali_shrinker_mmap32.c
index 2dc9b0c..0c7fc07 100644
--- a/mali_shrinker_mmap32.c
+++ b/mali_shrinker_mmap32.c
@@ -160,7 +160,8 @@ void setup_mali(int fd, int group_id) {
if (ioctl(fd, KBASE_IOCTL_VERSION_CHECK, &param) < 0) {
err(1, "version check failed\n");
}
- struct kbase_ioctl_set_flags set_flags = {group_id << 3};
+ printf("mali version: %d.%d\n", param.major, param.minor);
+ struct kbase_ioctl_set_flags set_flags = {0};
if (ioctl(fd, KBASE_IOCTL_SET_FLAGS, &set_flags) < 0) {
err(1, "set flags failed\n");
}
[Fire HD 8 and HD 10 General] deckinghalls:
Confirmed it uses 11.11. Manually applied the diff, also had to comment out the lines

init.group_id = group_id;
init.phys_pages = va_pages;

in the jit_init() function. It appears struct kbase_ioctl_set_flags set_flags = {0}; results in "mem_alloc failed: Out of memory" and restored back to what it was results in "set flags failed: Invalid argument"
[Fire HD 8 and HD 10 General] relalis:
Use Raven as a base, rather than Gazelle.
[Fire HD 8 and HD 10 General] deckinghalls:
Ah right, sorry! First time trying something like this. Output is now:

fingerprint: Amazon/trona/trona:7.0/PS7321/2326N:user/amz-p,release-keys
failed, retry.
failed, retry.
failed, retry.
failed, retry.
failed, retry.
/data/local/tmp/trona: Out of memory.: Success
1|trona:/ $

Getting further, it seems?
[Fire HD 8 and HD 10 General] relalis:
On the contrary; it occurs to me that you mentioned you're running 7.3.2.1, which I think may have been patched for this exploit. I would suggest trying again soon after the board boots, and seeing if you can get to write_shellcode(). I'm currently stuck at aliasing the sprayed regions, as it returns -ENOPERM if the mmap flags don't include MAP_ANON; if you encounter the same issue, I would appreciate if you could let me know, as it could mean the board isn't necessarily patched, but rather the GPU address mapping is incorrect for these specific boards. Otherwise, CVE_2022_46395 may be the only hope for the fire 7/10 on 7.3.2.*
[Fire HD 8 and HD 10 General] deckinghalls:
That would be a bit unfortunate if that's the case, though I'll keep playing with it. Not 100% sure I'm doing things correctly, but I figured I'd give it a shot and attempt to learn. Currently, it's failing the if check at the line in the trigger() function:

if (ioctl(mali_fd, KBASE_IOCTL_MEM_QUERY, &query) < 0) {

No change immediately after a reboot.

Regardless, I do really appreciate your help and the efforts of yourself and the community!
[Fire HD 8 and HD 10 General] relalis:
Try increasing FLUSH_REGION_SIZE
[Fire HD 8 and HD 10 General] deckinghalls:
Increasing it to 1000 got rid of the "out of memory" error, but still fails at that line.

Edit:

In case it's a blunder on my part with the defines, I've attached the output of kallsyms_finder and unpackbootimg.

The defines are as follows (Raven as a base):

#define KERNEL_BASE 0x40080000

// PS7321/2324

#define AVC_DENY_7321_2324 0x6096F8 //avc_denied

#define SEL_READ_HANDLE_UNKNOWN_7321_2324 0x61DCD8

#define PREPARE_KERNEL_CRED_7321_2324 0x13C6EC //proxy for init_cred

#define COMMIT_CREDS_7321_2324 0x13BFAC

#define ADD_PREPARE_KERNEL_CRED_7321_2324 0x911BB108

#define ADD_COMMIT_7321_2324 0x913EB108
[Fire HD 8 and HD 10 General] 789mod:
fingerprint: Amazon/trona/trona:9/PS7328.3435N/0027213523712:user/amz-p,release-keys

./raven_shrinker: unable to match build id

: Success

plz can anyone post raven_shrinke ?
[Fire HD 8 and HD 10 General] mind _spacer:
I am using the original POC for Xiaomi's device. When i run it prints some overwrite address and device reboots. Do u know any thing about that?

Here is the output:

fingerprint: Redmi/merlin_in/merlin:12/SP1A.210812.016/V13.0.5.0.SJOINXM:user/release-keys

failed, retry.

region freed 15

read 0

cleanup flush region

jit_freed

jit_free commit: 2 0

Found freed_idx 2

Found pgd 20, 7fe246000

overwrite addr : 7fff00dc4 dc4

overwrite addr : 7ffd00dc4 dc4

overwrite addr : 7fff00dc4 dc4

overwrite addr : 7ffd00dc4 dc4

overwrite addr : 7ffb00dc4 dc4

overwrite addr : 7ffd00dc4 dc4
[Fire HD 8 and HD 10 General] Rortiz2:
Sounds like you need to modify some offset / shellcode. Verify they're all correct.​
[Fire HD 8 and HD 10 General] mind _spacer:
I assume that all the offset values and kernel base addresses are modified said like in this thread and correct. Is there any modifications needed to shellcode?
[Fire HD 8 and HD 10 General] 789mod:
fingerprint: Amazon/trona/trona:9/PS7328.3435N/0027213523712:user/amz-p,release-keys

./raven_shrinker: unable to match build id

: Success

why this error ?
[Fire HD 8 and HD 10 General] mind _spacer:
Sounds like you need to change the fingerprint that matches to your device in the source code.

The fingerprint details can be found from the shell using getprop ro.build.fingerprint command.
[Fire HD 8 and HD 10 General] 789mod:
i get this

Amazon/trona/trona:9/PS7328.3435N/0027213523712:user/amz-p,release-keys

when i type you commend
[Fire HD 8 and HD 10 General] p0werpl:
Any progress? Most of these builds (including 7.3.2.6) are from 2022. They should not be patched for this exploit. 7.3.2.8 is the only build after this exploit was made public.
[Fire HD 8 and HD 10 General] deckinghalls:
Nothing so far. I cannot seem to get past that one "if" check. I've even put in random values in the defines to see what it would do and it's acting the same, which leads me to believe my defines are wrong. If anyone has the ability to doublecheck my work so far, I would greatly appreciate it. And again it could be that minor difference between 2324N vs 2326N. At the end of the day, I'm just a noob trying to learn by doing.

I did confirm /dev/mali0 is the correct path. Not sure where to find POOL_SIZE but I'm guessing it's probably the same? Got my KERNEL_BASE, as mentioned previously, by adding BOARD_KERNEL_BASE to BOARD_KERNEL_OFFSET from the unpackbootimg log. Subtracted KERNEL_BASE (0x40080000) from each address listed in my kallsyms_finder log to get most of the defines, then used Rortiz2's C code to generate the ADD_* values. I used the ARM64 opcode as the add value (should I have used ARM32 instead?)
[Fire HD 8 and HD 10 General] p0werpl:
The kallsyms are almost certainly going to be different in 2326. It looks like all the publicly available updates are 2324.
[Fire HD 8 and HD 10 General] deckinghalls:
Ah, that would explain things then. Do you know how I could go about getting my own boot.img file without root/TWRP? Or alternatively, how else to go about getting the kallsyms?
[Fire HD 8 and HD 10 General] p0werpl:
The kernel source is available here: https://fireos-tablet-src.s3.amazon...c8qiXizk1Z/Fire_HD10-7.3.2.1-20210726.tar.bz2

It is probably 2326. If you are up for it, you could build the kernel yourself.

The 2828 kallsyms are:

ffffff0010689870 t avc_denied

ffffff00101bc6d4 T prepare_kernel_cred

ffffff001069de50 t sel_read_handle_unknown

ffffff00101bbf94 T commit_creds

Can you do the conversion and report the values here? Thank you.
[Fire HD 8 and HD 10 General] deckinghalls:
Oof, not a good start. Two minutes into the process and "multiple definition of `yylloc'" errors. I'm guessing I'm either missing some random unknown dependency or, the more likely, this wasn't meant to be compiled on Arch. Perhaps time to spin up a Debian VM.

The values I'm getting are:

#define AVC_DENY_7321_2828 0x609870

#define SEL_READ_HANDLE_UNKNOWN_7321_2828 0x61DE50

#define PREPARE_KERNEL_CRED_7321_2828 0x13C6D4

#define COMMIT_CREDS_7321_2828 0x13BF94

#define ADD_PREPARE_KERNEL_CRED_7321_2828 0x911B5108

#define ADD_COMMIT_7321_2828 0x913E5108

or if the ADD_* values should use the 32 bit values:

#define ADD_PREPARE_KERNEL_CRED_7321_2828 0xE01B5108

#define ADD_COMMIT_7321_2828 0xE03E5108
[Fire HD 8 and HD 10 General] p0werpl:
Can you share your mali.h and mali_shrinker_mmap32.c here? Why are you not using the original POC? It was written for aarch64.