yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 General] deckinghalls:
Sadly I deleted them, as I figured I would redo them and submit to GitHub when/if I can get the values for 2326. mali.h was unmodified from the Raven version. Originally I started with Gazelle since I didn't have some of the kallsyms listed in the original or Raven versions (like SEL_READ_ENFORCE) and I figured that mattered so I used what I thought was the closest. Of course, that was silly in hindsight. Was asked to use Raven as the base, and at least got further in the code before it failed. I did try the original PoC as well, but seems to have the same issues Gazelle had. Of course, it's kinda moot anyway at the moment without the right values
[Fire HD 8 and HD 10 General] 789mod:
my os 7.3.1.8

and this error wneho i use

fingerprint: Amazon/onyx/onyx:7.0/PS7318/1971N:user/amz-p,release-keys

./raven_shrinker: unable to match build id

: Success

plz
[Fire HD 8 and HD 10 General] p0werpl:
As someone wrote earlier in this thread, you have to create a new entry for your build in mmap.c. Use the fingerprints already in there as a template and add one for your tablet's build.
[Fire HD 8 and HD 10 General] 789mod:
cd

can i pm you ?
[Fire HD 8 and HD 10 General] deckinghalls:
So unfortunately I don't think compiling the kernel is the way to go. Kallsym values are completely different based on the versions of LLVM, Clang, and the Android toolchain used to compile. Additionally, it spits out a "dts" directory and the files "Image" (no extension), "Image.gz", and "Image.gz-dtb", none of which are recognised as a "boot.img" file by unpackbootimg. Kallsyms-finder is able to get the kallsym values, but all that I've generated so far are wildly off from the values I got with 2324 and 2828, so I'm guessing I don't have the correct combo of anything, really.
[Fire HD 8 and HD 10 General] p0werpl:
Depending on your level of desperation, you can download the 7.3.2.2 update (here: https://drivers.softpedia.com/get/T...11th-Generation-Tablet-Firmware-7-3-2-2.shtml), move it to internal storage, and check for system updates. It should prompt you to install the update.

Yes, you may lose some tweaking ability, but this root exploit should work on 7.3.2.2.
[Fire HD 8 and HD 10 General] deckinghalls:
I considered this. I might. I dunno. If I did go this route, I should be able to gain that tweaking ability back, right?
[Fire HD 8 and HD 10 General] p0werpl:
Yes if you're successful with this exploit. If not, 7.3.2.2 may be more locked down than 7.3.2.1 ( disabling launcher, system update, etc.). I haven't looked at it carefully. You should read up and decide whether you can live without those tweaks in the event you cannot get this expolit to work.
[Fire HD 8 and HD 10 General] deckinghalls:
Hmm. I think for the time being I'm going to put down my HD 10+ and try with my 7 instead. Perhaps if I'm lucky, my fingerprint will match the publicly released firmware this time. If I felt more confident in my abilities, I wouldn't think twice about going forward with that on the 10+, but I fear it's above my head right now, ever so slightly out of reach.
[Fire HD 8 and HD 10 General] SergeantFury:
It seems there's been a release of some sort of FireOS "7.3.2.7" for at least the 10th gen tablet - I apparently failed to properly defend against OTAs and the result was an update to

Amazon/onyx/onyx:9/PS7327.3329N/0026743734528:user/amz-p,release-keys. Anybody got any info on this update?
[Fire HD 8 and HD 10 General] bibikalka:
Hmm, a bit too early to do firmware updates before a working exploit is available! Once/if the exploit works - it'll cover a bunch of firmware versions, no need to chase a specific one now.

So are we stuck finding the right offsets now? I was away, so did not follow too closely.
[Fire HD 8 and HD 10 General] deckinghalls:
Yeah I'm trying to find the offsets for the Fire HD 10+ (2021) running FireOS 7.3.2.1 version 2326. The 7.3.2.1 firmware update available publicly is 2324, which doesn't seem to have the right offsets.
[Fire HD 8 and HD 10 General] bibikalka:
I just checked my HD10 2021 - it's 7.3.1.9. I think for you 7.3.2.1 & 7.3.2.2 are not that different - Fire Toolbox lost some features past 7.3.1.9, so if you update to 7.3.2.2 it's probably immaterial, and you'll have the same ROM as a file vs just on the device itself.

Btw, all public versions can be found here:

Amazon kindle, fire, hdx, hd, touch, 3g, paperwhite, keyboard, dx, alexa, echo, fire phone, fire os, fireos, fire tv, firetv, amazonkindle, basics, audible, eero, luna, prime

TousLesDrivers.com permet de télécharger gratuitement toutes les mises à jour nécessaires au bon fonctionnement d'un PC. Les drivers, pilotes, BIOS, firmwares, utilitaires, logiciels et applications sont téléchargeables rapidement et facilement grâce au classement des fichiers par catégories de...

www.touslesdrivers.com
[Fire HD 8 and HD 10 General] deckinghalls:
7.3.2.2 is the first "bad" version, where you can't block OTA updates and such. Thank you for the link though! I was hoping 2326 had been released somewhere, but I guess that was never made public and no one has captured it unofficially.
[Fire HD 8 and HD 10 General] SergeantFury:
The .bin available for the HD 8 2020 on Amazon's webpage also now has an id of 3329. Suspecting that the GPU driver has been patched or some other security flaw has been found and fixed - can't think of many other reasons that there'd be an incremental update with no change in version number. I've not got the tools and skills needed to modify a copy of the exploit for myself though - paging @Rortiz2
[Fire HD 8 and HD 10 General] bibikalka:
If you are in the US, woot has Fire HD 8 Tablet, 8" HD Display (2020 release, 10th Gen) for $30 now. Since it's a refurb, it may end up with an older ROM.
[Fire HD 8 and HD 10 General] SergeantFury:
Would have been a good deal - mine was 45usd 😅
[Fire HD 8 and HD 10 General] deckinghalls:
With all due respect, I don't really see how that solves the issue.
[Fire HD 8 and HD 10 General] bibikalka:
:D

Well, right now you have a good ROM (7.3.2.1) you don't want to lose - and it's a good idea to stick to it until root is obtained. This $30 device would be slightly more disposable to play with - and you could probably return in after a few weeks.
[Fire HD 8 and HD 10 General] 789mod:
can i downgrade from 7.3.2.8 to .7.3.2.1 ?
[Fire HD 8 and HD 10 General] webhook:
What can we do with 7.3.1.2?? It's a 2020 Model Fire HD 10 2019..
[Fire HD 8 and HD 10 General] 789mod:
My device 10(11th) trona
[Fire HD 8 and HD 10 General] AvijitBis:
Any update on this?
[Fire HD 8 and HD 10 General] bibikalka:
@Rortiz2 was looking into using this for Fire tablets, but there is no solution yet.
[Fire HD 8 and HD 10 General] 789mod:
any update -_-
[Fire HD 8 and HD 10 General] AvijitBis:
yeah, i don't think we're getting root anytime soon. Probably in 1-2 years.
[Fire HD 8 and HD 10 General] Azaze666:
Do you have kallsyms? I'm looking for kallsyms for amazon tab hd8 2018

Nevermind i extracted them with vmlinuz to elf tool from github. Recovery comes from 6.3.0.0 firmware, boot from latest version of firmware, I downloaded it from amazon servers, extracted boot, then decompiled with aik, then used vmlinux2elf to extract kallsyms
[Fire HD 8 and HD 10 General] Azaze666:
Maybe we should do a bug bounty, just saying. I would donate for example
[Fire HD 8 and HD 10 General] A Cool User:
Any Progress?? :cowboy:
[Fire HD 8 and HD 10 General] travis82:
keira:/ $ /data/local/tmp/gazelle_buf

fingerprint: Amazon/keira/keira:6.0/NS6278/2804N:user/amz-p,release-keys

/data/local/tmp/gazelle_buf: unable to match build id

: Success
[Fire HD 8 and HD 10 General] Michajin:
did it work? i would be really surprised anyone is working on a fire television exploit. Too much risk in bricking considering it is just root access...
[Fire HD 8 and HD 10 General] travis82:
No it did not root. I'd like to root firetv's better than sticks to me.
[Fire HD 8 and HD 10 General] Azaze666:
Ahahah I frozen updates, using shizuku onetime and icebox app. You setup shizuku once, allow permission for icebox on shizuku settings, run shizuku once, then search for updates, there will be two apps, froze the two, then reboot. Updates will be frozen, you can connect to the Internet, I tested and I didn't receive system updates anymore (still on 7.3.2.7 while latest version is 7.3.2.9), and since I did not activate shizuku anymore and didn't defrost update apps I'm fine, no updates anymore.

Edit: it worked for two reboots, after that updates unfrosted, sad... I will keep trying
[Fire HD 8 and HD 10 General] Azaze666:
i think i found a working way to block updates, guys do it as fast as you can:https://xdaforums.com/t/block-updates-dns-way-no-root-needed.4397079/
[Fire HD 8 and HD 10 General] A Cool User:
@Pro-me3us

Trying to exploit this on Trona and I am running into the same issue. It would be great if you could give me some suggestions as well. Thanks in advance!
[Fire HD 8 and HD 10 General] benjaluth9:
Any updates on this?
[Fire HD 8 and HD 10 General] mind_game:
I attempted to apply CVE-2022-20186 on a Samsung S8+, but encountered an error stating “set flags failed.” The Samsung S8+ is equipped with Mali G71 (r16p0-01), running on kernel version 4.4.111 and Android 9. What could be causing this error, and how can I address this issue?

exploit code used :https://github.com/github/securityl...oits/Android/Mali/CVE_2022_20186/mali_alias.c
[Fire HD 8 and HD 10 General] mind_game:
I attempted to apply the CVE-2022-20186 exploit on a Samsung M30s device that operates on Android 11 and features a Mali-G72 MP3 GPU with Bifrost architecture revision r26p0. However, during the execution of the exploit code, an error occurred, specifically stating "mali_alias: mem_alias failed: Invalid argument." How can I resolve this issue?

exploit code used :https://github.com/github/securityl...oits/Android/Mali/CVE_2022_20186/mali_alias.c
[Fire HD 8 and HD 10 General] Baiker000:
I manage to get root on Fire HD 8 Plus 2020 on firmware 7.3.2.2 using this exploit. It's unstable, may crash system and often take 20 attempts to run before success but it works.

You can't modify system files because of dm-verity but it possible to disable protected apps with "pm disable". Before calling pm disable you need to change context using

# runcon u:r:system_app:s0 /system/bin/sh

command

If you plan to port it to other firmware version, amazon kernel does not include all symbols in kallsym table so you need to find

selinux_enforcing and init_cred manually in dissasembler.
[Fire HD 8 and HD 10 General] Michajin:
Awesome. First step in trying to finding a unlock bootloader option. I might pull my Onyx out and see if i can as well soon... Mine has been offline for awhile and likely i disabled updates before that was blocked.
[Fire HD 8 and HD 10 General] nsfxpython:
This sounds promising. I have an 11th gen (2021) Fire HD 10 running 7.3.2.1. Thanks to Toolbox, I have auto updates disabled. What would I need to do differently for this firmware version?
[Fire HD 8 and HD 10 General] Androiduser2390:
How do you run this exploit? Could we get a hacked fastboot that works or flash TWRP if more research is done on this. Also: Amazon is trying to make a duplicate build of 7.3.2.9 that might patch this. My wifi is off on the tablet so it can't update. I know that the onyx supports GSI if we got a recovery or a working fastboot with arm32 with a binder of 64. I think the vndk is 28
[Fire HD 8 and HD 10 General] A Cool User:
Any advice on what file to look at in the disassembler? Got the boot image...

Thanks!
[Fire HD 8 and HD 10 General] A Cool User:
You need to download the zip provided & compile it to run. Something like this:

PATH_TO_YOUR_NDK/toolchains/llvm/prebuilt/linux-x86_64/bin/armv7a-linux-androideabi30-clang -DSHELL mali_shrinker_mmap32.c -o onyx_shrinker
# You need to enable ADB now
adb push onyx_shrinker /data/local/tmp/
adb shell chmod 777 /data/local/tmp/onyx_shrinker
adb shell data/local/tmp/onyx_shrinker
[Fire HD 8 and HD 10 General] Androiduser2390:
Thanks for the compile steps! The mali exploit did not work as the code has not been adapted to work on 7.3.2.9, I wonder if it is patched or it is still possible to gain root with the code changed
[Fire HD 8 and HD 10 General] Azaze666:
Still waiting (for root device [joke]), in reality I'm waiting for someone to port the exploit to hd8 2018 model, plz do this miracle, I left kallsyms some posts before this
[Fire HD 8 and HD 10 General] A Cool User:
Thanks so much for the detailed explanation!

I tried decompiling with Ghrida (because IDA Pro is not free), and it found the function symbol sel_read_enforce. The issue is that when trying to go to the address it results in Can not navigate to function symbol: sel_read_enforce (not in-memory). I am new to decompiling so this is probably just me not knowing how to do stuff. Any clue on what I am doing wrong?

Thanks!
[Fire HD 8 and HD 10 General] Baiker000:
Based on your kallsyms there is offsets for you

#define SELINUX_ENFORCING_ONYX 0X1085EE4
#define SEL_READ_HANDLE_UNKNOWN_ONYX 0x2D7DE0
#define INIT_CRED_ONYX 0XF12E20
#define COMMIT_CREDS_ONYX 0x48C78
#define ADD_INIT_ONYX 0x91388000 //add x0, x0, #0xe20
#define ADD_COMMIT_ONYX 0x9131E108 //add x8, x8, #0xc78

Kernel base calculate from your boot.img base + kernel_offset

Did it finished analyzing? Here is how it looks in my Ghidra

Find function in Symbol tree or press G and enter function name

Or enter function address from kallsyms
[Fire HD 8 and HD 10 General] Azaze666:
You should be blessed, thank you
[Fire HD 8 and HD 10 General] A Cool User:
It seemed like it did... I will try re-analyzing it.
[Fire HD 8 and HD 10 General] A Cool User:
Reanalyzed it, same result... Maybe trying using Windows instead of Linux will help?

EDIT1:

Interesting... ghrida is trying to jump to the same address found by kallsyms finder, so that is good. What is strange is that all addresses found by kallsyms finder are ffffff001*, but in ghrida all it sees f800*... Maybe changing the base address in ghrida would work?
[Fire HD 8 and HD 10 General] Baiker000:
f800* or ...f800*? Ghidra seems to truncates addresses. Try to right click on address and open Instruction Info. There should be full address

Can you attach your boot.elf, i can look at it
[Fire HD 8 and HD 10 General] A Cool User:
Ahhh I see! Thanks! Yes it is ...f800*. I have attached the boot elf for you to look at. This is 7.3.2.9
[Fire HD 8 and HD 10 General] A Cool User:
Did you download unpackbootimg from github? Like this:

git clone https://github.com/osm0sis/mkbootimg.git
cd mkbootimg
make
# Now, use ./unpackbootimg
./unpackbootimg

It seems the unpackbootimg you are using is coded in Python, not the one from github which is made in C
[Fire HD 8 and HD 10 General] nsfxpython:
EDIT: I was working in the wrong directory.... about an hour or so wasted there. Anyways, I have the correct boot.img-kernel file. Will continue to proceed and update!

I did clone it from github, but I must have done something wrong along the way. Anyways, I followed that code exactly as you wrote it and I should now be using the version of the program made in C. This is the current output, lost on what to do next:

./unpackbootimg
usage: unpackbootimg
-i|--input <filename>
[ -o|--output <directory> ]
[ -p|--pagesize <size-in-hexadecimal> ]
[Fire HD 8 and HD 10 General] Baiker000:
Yes, your elf don't work as expected in ghidra and ida pro. For what model this kernel for? I downloaded 7.3.2.9 for onyx and it seems opens fine in ghidra. Might be device specific problem or image unpacked with errors. Can you attach full boot.img
[Fire HD 8 and HD 10 General] Androiduser2390:
I would like to see a build for onyx that runs on 7.3.2.9
[Fire HD 8 and HD 10 General] A Cool User:
Fire HD 10 2021- update-kindle-Fire_HD10-PS7329_user_3842_0029294002820.bin
[Fire HD 8 and HD 10 General] benjaluth9:
Incredible work. I was wondering if I could do the same for 7.3.2.7, I have this same tablet (ony, hd 8 10th gen)!
[Fire HD 8 and HD 10 General] nsfxpython:
So I'm moving right along, at the step having to do with kallsyms.txt after extracting with the kallsyms finder...more specifically this part:

This is a screenshot of my kallsyms.txt. Do I need to do this step? And what would the base address look like?
[Fire HD 8 and HD 10 General] A Cool User:
I think you should do that. You can use https://www.calculator.net/hex-calculator.html to do the calculations. In your case, FFFFFF001011C000
[Fire HD 8 and HD 10 General] nsfxpython:
At this part now, same problem. Although, I tried it on Windows. 7.3.2.1
[Fire HD 8 and HD 10 General] AvijitBis:
where do i find the file "mali_shrinker_mmap32.c"?
[Fire HD 8 and HD 10 General] AvijitBis:
Can you make mali_shrinker_mmap32.c file for the fire HD 10 2021 7.3.2.9? Here's the boot file. Unfortunately I have a very shifty laptop which takes a long time to do decomipiling and analyzing in ghidra.
[Fire HD 8 and HD 10 General] A Cool User:
I was working on that already but got stuck here. Maybe @Baiker000 can help?
[Fire HD 8 and HD 10 General] Baiker000:
I'm not completely sure about it but it seems like kernel is extracted wrong with vmlinux-to-elf utility. For extracting you need to download this repo https://github.com/marin-m/vmlinux-to-elf, find function find_elf64_rela in kallsyms_finder.py and make it return False

Then run kernel extraction using this local version with --base-address 0xFFFFFF8008080000 parameter.

With this extracted kernel probably this is your offsets

#define SELINUX_ENFORCING_ONYX 0x18ec668
#define SEL_READ_HANDLE_UNKNOWN_ONYX 0x2c030c
#define INIT_CRED_ONYX 0x16c9918
#define COMMIT_CREDS_ONYX 0x4a70c
#define ADD_INIT_ONYX 0x91246000 //add x0, x0, #0x918
#define ADD_COMMIT_ONYX 0x911C3108 //add x8, x8, #0x70c
[Fire HD 8 and HD 10 General] A Cool User:
Is that for the Fire HD 10 2021?
[Fire HD 8 and HD 10 General] A Cool User:
That worked! Thanks!
[Fire HD 8 and HD 10 General] Androiduser2390:
Well I will wait for a zip of the exploit for onyx on 7.3.2.9
[Fire HD 8 and HD 10 General] benjaluth9:
I don't have a laptop right now, because I cannot see anthing on the screen and sadly there is no HDMI port on it. Can anyone compile a binary for the HD 8 10th gen (not the plus version)? Also, if you were wondering on how would I run it, I have an OTG cable so I can run commands from my phone to the tablet using Bugjaeger. Thanks in advance! :)

PD: Current FireOS ver I'm using is 7.3.2.7.
[Fire HD 8 and HD 10 General] A Cool User:
Well I successfully decompiled the binary / got the addresses for the Fire HD 10 Plus 2021... But when running it I get this:

: flags_change failed
: Invalid argument

Any idea what is causing this?

EDIT1:

If I comment out err(1, "flags_change failed\n");, I get failed, retry. a few times and then a reboot...
[Fire HD 8 and HD 10 General] Baiker000:
Probably you need to tweak exploit for your device. Try build exploit from this repo https://github.com/Pro-me3us/CVE_2022_38181_Gazelle And then see if it works. For testing you can remove

write_shellcode(mali_fd, mali_fd2, pgd, &(reserved[0]));
run_enforce();

and replace it with something like printf("DONE");

So you don't need to deal with offsets, just to check if exploit is working.
[Fire HD 8 and HD 10 General] Baiker000:
I don't have device to test it but here you go, hope it works on last firmware
[Fire HD 8 and HD 10 General] nsfxpython:
What if I keep getting "Operation not permitted" in the adb shell? Keep trying?
[Fire HD 8 and HD 10 General] AvijitBis:
Getting the same error

fingerprint: Amazon/trona/trona:9/PS7329.3842N/0029294002688:user/amz-p,release-keys
/data/local/tmp/mali_shrinker_onyx_7329: flags_change failed
: Invalid argument
[Fire HD 8 and HD 10 General] nsfxpython:
I'm pretty much at a halt with my Fire HD 10 (2021) running 7.3.2.1. But... I remembered I have an older Fire HD 8 (8th Generation) lying around that I bought for a previous exploit which was hardware based. I think I'm going to tinker with this tablet using this newly found method and I'll come back with any results/findings.

also, my current firmware on this fire hd 8 is 7.2.1.3
[Fire HD 8 and HD 10 General] p0werpl:
The Fire HD 10 (2021) is arm64-v8a, not v7a as the HD 8 2020. Some flags are also different (AVC_DENY instead of SELINUX_ENFORCING).
[Fire HD 8 and HD 10 General] A Cool User:
Tried using Gazelle as the base, but now I am getting

/data/local/tmp/gazelle_shrinker: jit init failed
: Not a typewriter

...

EDIT1:

If I use Raven as the base I get flags_change failed... I think using Gazelle as the base is the best option...
[Fire HD 8 and HD 10 General] Baiker000:
This version is for onyx

jit init failed means its getting error at start because of group_id and/or phys_pages. You need to commit it.

void jit_init(int fd, uint64_t va_pages, uint64_t trim_level, int group_id) {
struct kbase_ioctl_mem_jit_init init = {0};
init.va_pages = va_pages;
init.max_allocations = 255;
init.trim_level = trim_level;
//init.group_id = group_id;
//init.phys_pages = va_pages;

if (ioctl(fd, KBASE_IOCTL_MEM_JIT_INIT, &init) < 0) {
err(1, "jit init failed\n");
}
}

But then there probably be more errors. I got the same errors when trying Gazelle on Onyx.

Your kernel is 4.4, i think using Raven is better since it has older kernel than Gazelle.

You got Invalid argument before in mem_flags_change. Try to figure out why its invalid. Function gets gpu_addr and flags. Flags are hardcoded, so probably gpu_addr is the problem. Try to printf it at start of mem_flags_change

printf("gpu_addr %llx\n", gpu_addr);

Maybe its 0 and problem is in jit_allocate
[Fire HD 8 and HD 10 General] Baiker000:
I checked source of your kernel, seems like kbase_ioctl_mem_flags_change struct is the same. Here is the code that called when flags changed

Spoiler content hidden.

It returns Invalid argument by default or when something going wrong. It almost identical to same function in Onyx so high chance that problem somewhere in parameters
[Fire HD 8 and HD 10 General] A Cool User:
The GPU address is 100001000...

fingerprint: Amazon/trona/trona:9/PS7329.3836N/0029294001152:user/amz-p,release-keys
Got to trigger function
Mapping GPU
Calling mem_flags_change
gpu_addr 100001000
fd 3
flags 131072
/data/local/tmp/gazelle_shrinker: flags_change failed
: Invalid argument

I think it does indeed have something to do with jit_allocate
[Fire HD 8 and HD 10 General] Baiker000:
Maybe even before that. jit_allocate returns gpu_alloc_region unchanged so probably when it created with mmap64 something go wrong. Try to check what value of gpu_alloc_addr after map_gpu

Based on your boot file, here
[Fire HD 8 and HD 10 General] A Cool User:
gpu_alloc_addr is 4294967296... jit_addr and gpu_alloc_addr never change. gpu_alloc_region seems to be the only one changing. Here is the output now:

fingerprint: Amazon/trona/trona:9/PS7329.3836N/0029294001152:user/amz-p,release-keys
mali_fd 3
mali_fd2 3
Got to trigger function
Mapping GPU
gpu_alloc_addr 4294967296
gpu_alloc_region 0xf726c000
jit_addr 4294971392
Calling mem_flags_change
gpu_addr 4294971392
fd 3
flags 131072
/data/local/tmp/trona_shrinker: flags_change failed
: Invalid argument

Also, ignore the previous gpu_addr value. I was using a bad printf statement.