yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 General] Pro-me3us:
When the shrinker exploit is patched, you'll get a flags_change failed message. But seeing that message doesn't necessarily mean it's patched. This exploit was listed in Android's monthly security updates in January 2023, and Amazon was pushing the patch out on FireOS for raven days before I got the mod out in March.

PS7329 appears to be from around November 2023, so I would expect that it was patched on the tablets by then. Once an Amazon device hits the market, the mali gpu drivers are never updated again, unless for security reasons. Amazon also prefers to backport security patches rather that update the drivers to the newest versions. So I would download the source for the the firmware you are currently on and compare it with the source that is from 2022 or older, and see if there are any differences. Look at the folder with the mali gpu drivers that correspond to your device.

There are also other considerations for this exploit such as whether the device uses midgard or bifrost drivers, and the kernel version. IIRC onynx uses kernel 4.9 and bifrost r16p0, which coincidentally is the same as raven, meaning less potential issues.
[Fire HD 8 and HD 10 General] nsfxpython:
I've hit road blocks for both the Fire HD 10 (2021, Fire OS 7.3.2.1) and the Fire HD 8 (2018, Fire OS 7.3.2.3). I think I'm simply not compiling correctly. Would you be able to compile for the Fire HD 10 2021 with Fire OS 7.3.2.1? I'd be very appreciative!
[Fire HD 8 and HD 10 General] A Cool User:
What road blocks?
[Fire HD 8 and HD 10 General] nsfxpython:
I've found that the compiling only works about 50% of the time. When it has worked and I get the appropriate values, I go to run the exploit and it ends up saying "Operation not permitted".
[Fire HD 8 and HD 10 General] Baiker000:
Did you place it in /data/local/tmp and give it execution rights by chmod +x /data/local/tmp/mali_shrinker_mmap32? This exploit is not working on Fire HD 10 right now, but for Fire HD 8 at least it should start even if offsets are wrong.

On 7.3.2.9 kernel gpu driver is newer than in 7.3.2.2, some files has 2022 year in it. But also, as @p0werpl mentioned, Fire HD 10 has arm64 firmware so try to build exploit with 64 bit compiler. And those file descriptors are suspicious to me. When I ran the exploit i got different descriptors for mali_fd and mali_fd2. Try to look what mali nodes you have in /dev
[Fire HD 8 and HD 10 General] A Cool User:
I don't think compiling for aarch64 is the way to go... It fails at mem_commit when compiling for that. Also the only mali node is /dev/mali0. If it helps anyone the GPU driver on 7.3.2.9 Trona is version v1.r14p0-01rel0.01e5c7ea2a98fd18e15a3ddbd079d568

EDIT1:

If the GPU driver is r14p0, and it was patched in r40p0, then it is exploitable, right?

EDIT2:

I think this

/* Only native allocations can be marked not needed */
if (reg->cpu_alloc->type != KBASE_MEM_TYPE_NATIVE) {
ret = -EINVAL;
goto out_unlock;
}

may be causing the issue...
[Fire HD 8 and HD 10 General] nsfxpython:
I'm going to try it again on the Fire HD 8 today. It's possible I was trying to execute incorrectly.
[Fire HD 8 and HD 10 General] Baiker000:
It fails to compile? You can check original exploit for Pixel which is compiled for aarch64 https://github.com/github/securitylab/tree/main/SecurityExploits/Android/Mali/CVE_2022_38181
[Fire HD 8 and HD 10 General] A Cool User:
No, compiling works fine (with a few warnings), but it fails there when running.
[Fire HD 8 and HD 10 General] Baiker000:
That probably means mem_flags_change is working when compiled for aarch64, because mem_commit is called after it. Maybe try to debug mem_commit, with what parameters it called when failed
[Fire HD 8 and HD 10 General] nsfxpython:
This is what I keep getting when trying to run the exploit. Stumped.

fingerprint: Amazon/karnak/karnak:9/PS7323.2829N/0023455272192:user/amz-p,release-keys
region freed 63
alias gpu va 100641000
/data/local/tmp/mali_shrinker_mmap32: mmap alias failed 0
: Operation not permitted
[Fire HD 8 and HD 10 General] A Cool User:
Strange... Well you are farther then me 🤷‍♂️ . At least some of the exploit is working!
[Fire HD 8 and HD 10 General] nsfxpython:
Yeah, I feel like it is some permission error or something. I get the same result when trying to run the exploit on the Fire HD 10 (2021).
[Fire HD 8 and HD 10 General] Androiduser2390:
Got a flag_change error. Is it patched?
[Fire HD 8 and HD 10 General] JJ2017:
@Baiker000

Thanks for your guide, posted: https://xdaforums.com/t/potential-a...d-8th-12th-gen-affected.4574635/post-89350071

I've followed it through for the Onyx (HD8) firmware 7326 - but now I am stuck.

Output for my nearest success shown below - this achieved following a million reboots ;-)

I've also had a couple of 'buzzing' responses followed by crashing - good to know I've annoyed the device... but still no root!

Like some others here - I've had difficulty finding the appropriate addresses in Ghidra - the de-compiling just doesn't look quite same as what was originally posted (I'm using Ubuntu 20.04)

Any ideas?

Output:

"onyx:/ $ /data/local/tmp/mali_shrinker_mmap32

fingerprint: Amazon/onyx/onyx:9/PS7326.3178N/0025602845184:user/amz-p,release-keys

region freed 41

alias gpu va 100641000

read 0

cleanup flush region

release_mem_pool

reserve pages here

jit_freed

jit_free commit: 3 0

Found freed_idx 3

find_pgd, freed_idx is 3 start_pg is 0

find_pgd, freed_idx is 3 start_pg is 0

Found pgd 23, 1006a3000

write_data overwrite addr : 104100ee4 ee4

write_data overwrite addr : 104300ee4 ee4

write_func called with code_size = 8

write_func overwrite addr : 104100918 918

write_func overwrite addr : 104300918 918

time to run_enforce

run_enforce: before sleep

run_enforce: after sleep

run_enforce: open

result 49

run_enforce_un: before sleep

run_enforce_un: after sleep

run_enforce_un: open

run_enforce_un: after read

run_enforce_un: after close

result 49"
[Fire HD 8 and HD 10 General] A Cool User:
If you are talking about not being able to open the function in Ghrida, @Baiker000 got it working a while back. See this post. It did not look the same for me either when I decompiled. I had to guess/reference the kernel source to find the addresses.
[Fire HD 8 and HD 10 General] Androiduser2390:
Can we get permissive SELinux? I heard that there was an exploit that could inject Magisk if the SELinux is permissive
[Fire HD 8 and HD 10 General] Baiker000:
Seems like exploit is working. This is offsets for 7.3.2.6

// Amazon fire hd 8 2020 7.3.2.6
#define SELINUX_ENFORCING_ONYX 0x139aed4
#define SEL_READ_HANDLE_UNKNOWN_ONYX 0x32c470
#define INIT_CRED_ONYX 0x12253f0
#define COMMIT_CREDS_ONYX 0x5b328
#define ADD_INIT_ONYX 0x910FC000 //add x0, x0, #0x3f0
#define ADD_COMMIT_ONYX 0x910CA108 //add x8, x8, #0x328

Try a few time even if you not get the root, it sometimes not make selinux to permissive, you can see it by first result 49, if all fine it should be result 48
[Fire HD 8 and HD 10 General] nsfxpython:
I'm going to look into this and report back anything I may find. Driver and kernel differences may be the reason I can't get this exploit to work on karnak.
[Fire HD 8 and HD 10 General] Pro-me3us:
I briefly looked at kernel and gpu versions of the tablets last year. This was what I had written down last spring but it would be good to double check. I was off on onyx, I guess it's kernel is 4.14 so a little newer than raven's 4.9.

FireHD 8 (12th gen) Bifrost r25p0, Kernel 5.4 Raspite

FireHD 7 (12th gen) Bifrost r25p0, Kernel 4.14 Quartz

FireHD 10 (11th gen) Bifrost r14p0, Kernel 4.4 Trona

FireHD 8 (10th gen) Bifrost r16p0, Kernel 4.14 Onyx

FireHD 10 (9th gen) Bifrost r14p0, Kernel 4.4 Maverick

FireHD 7 (9th gen) Midgard r26p0, Kernel 4.9 Mustang

FireHD 8 (8th gen) Midgard r26p0, Kernel 4.9 Karnak
[Fire HD 8 and HD 10 General] JJ2017:
Yep - that works - you're an XDA legend ;)

FWIW: I'm getting best results from the exploit by letting the tablet sleep for 20+mins after a reboot before trying the hack (this could just be coincidence, of course!)

Anyone else doing this and successfully getting root, don't forget:

"# runcon u:r:system_app:s0 /system/bin/sh" (as posted earlier in thread by @Baiker000)

before disabling any packages
[Fire HD 8 and HD 10 General] benjaluth9:
Thanks! I'll try this.

PS: It seems to work. AFAIK, the system crashes are a good sign, right?

I'll run it again and again until it works.
[Fire HD 8 and HD 10 General] A Cool User:
Does anybody have any idea about getting it to work on Trona 7.3.2.9? I think this check if (gpu_addr & ~PAGE_MASK) on line 1563 of mali_kbase_mem_linux.c is failing.
[Fire HD 8 and HD 10 General] Androiduser2390:
Flag change error?
[Fire HD 8 and HD 10 General] p0werpl:
I have a Trona on 7.3.2.3. Can you post your mmap32.c here? I will try with my addresses.
[Fire HD 8 and HD 10 General] benjaluth9:
Was able to run it in Termux!

PS: After two system crashes (fortunately not 20) it worked for me in a Fire HD 8 10th gen. Also, thanks Baiker000 for compiling mali_shrinker. Appreciate it!
[Fire HD 8 and HD 10 General] A Cool User:
My mmap32.c is just raven's file with my fingerprint/addresses added. Have you gotten it working on Trona?
[Fire HD 8 and HD 10 General] nsfxpython:
If SELINUX_ENFORCING is not to be used for the Fire HD 10, wouldn't I have to look for a different value in the kallsyms.txt file? Since for Onyx, you look for the sel_read_handle_unknown and subtract the base from it before compiling. Or does that not matter?
[Fire HD 8 and HD 10 General] p0werpl:
Look at the original exploit, which was written for arm64 (pixel 6): https://github.com/github/securityl...roid/Mali/CVE_2022_38181/mali_shrinker_mmap.c
[Fire HD 8 and HD 10 General] nsfxpython:
Okay. I see there are multiple instances of avc_deny:

#define AVC_DENY_2108 0x92df1c
#define AVC_DENY_2201 0x930af4
#define AVC_DENY_2202 0x930b50
#define AVC_DENY_2207 0x927664
#define AVC_DENY_2211 0x8d6810
#define AVC_DENY_2212 0x8ba710

Not sure which instance should be included, or if they all should (and if I would get the corresponding values for my particular tablet (Fire HD 10 2021 running 7.3.2.1) by subtracting the base address).
[Fire HD 8 and HD 10 General] p0werpl:
Each build has a different address. You have to create a new entry for your specific build and then reference that in the root command.
[Fire HD 8 and HD 10 General] Androiduser2390:
I think it is patched anyway. The exploit would have to be adapted to trona. Maybe mtkclient could do it
[Fire HD 8 and HD 10 General] A Cool User:
I checked the source code for 7.3.2.9 Trona and it does not seem to be patched...
[Fire HD 8 and HD 10 General] Azaze666:
tried to replace offsets on the c file there and compiled:https://xdaforums.com/t/potential-a...d-8th-12th-gen-affected.4574635/post-89354432 attached is the output

Maybe i did something wrong, i just added my offsets on the c file and tried to compile it

Edit: I forgot to edit the kernel_base, the question is what is my kernel base? I'm now trying to get it from my boot_kernel.elf let's hope for the best

New update: with the help of ChatGPT (yes since we have it why don't use it) and ghidra i got the kernel_base offset (probably):#define KERNEL_BASE 0x8008ea0a7c and still compilation fails, I probably miss something on my system to compile well I guess, really sad, and I don't even know if the compiled binary will popup a root shell... Ok i updated the zip with the edited c file with new offset
[Fire HD 8 and HD 10 General] nsfxpython:
And how would I get the value for that entry?
[Xiaomi 11T] nabulsi08:
Hey 👋

I'm currently on MIUI 14 Indonesian ROM and in every MIUI Version I'm experiencing high battery usage from Screen, Android System and Google Play Services. I've already set most Apps to restrict background activities and Autostart is turned off. In GSI ROMs, which I don't want to use because of the Cameras, the battery lasts noticible longer.

Is it possible that Root Access is draining my battery?

How do I solve that issue?

Thanks in Advance.
[Xiaomi 11T] NOSS8:
Wifi consumes more for streaming and downloads.

Magisk modules can increase consumption.

Use a 25/35w charger.

Post a screenshot with the battery charged at 100% to 20%.
[Xiaomi 11T] nabulsi08:
Thanks for your reply. I'll do that today. The Magisk Modules I use shouldn't be the problem I think. Before root it was only minimal better. I've attached a picture with the Magisk Modules I use. Zygisk enabled and in LSposed Core Patch and WooBox activated. I'm using the original 67w Charger so it charges as fast as possible.
[Xiaomi 11T] nabulsi08:
I've attached the battery usage from 100 to 20 percent. "Others" seem to use much battery too.
[Xiaomi 11T] NOSS8:
100% to 20% like that but 20%

Spoiler content hidden.
[Xiaomi 11T] RaulArcos:
Hi!

Currently on MIUI Global 14.0.2, battery life on this phone wasn't incredible in MIUI13 (5h SOT without intensive load) but since I got the update it is horrible, in the attached screenshot is a day of ussage only on social media, always on wifi and between 30% to 50% brighness. Normally I get 3h SOT on a normal day, I have 120Hz ON but still seems like something isnt working properly... or is it? Just let me know if there are already good solutions or explanations for this issue...thx a lot <3.

View attachment 5895819
[Xiaomi 11T] nabulsi08:
I hope 30 is good too... Mostly not using my phone when it's 80 because it's night. A bit before I charge my phone.
[Xiaomi 11T] nabulsi08:
I already shared my results some time ago... Do you think I should try downgrading to MIUI 12, 12.5 or 13? I think it may help. Clean Flash of MIUI 14 didn't work for me.
[Xiaomi 11T] nabulsi08:
Die you find a solution? Maybe downgrading would help. For me it's "others" that's taking much battery...
[Xiaomi 11T] NOSS8:
On my 12 pro A13 has increased battery life compared to A12.

Maybe test without root.
[Xiaomi 11T] nabulsi08:
Already tested without root. Didn't help. I don't think it would count to "others"... GSI with Root has better battery life.
[Xiaomi 11T] NOSS8:
As said on one of my first post try to use a 25/30W charger to test.
[Xiaomi 11T] nabulsi08:
Did that too... I'm pretty sure it has to do something with the Software.
[Xiaomi 11T] NOSS8:
Try another version:

Indonesian is V14.0.1.0.TKWIDXM

while

EEA V14.0.2.0.TKWEUXM

Global V14.0.4.0.TKWMIXM
[Xiaomi 11T] nabulsi08:
I was on Global before
[Xiaomi 11T] nabulsi08:
I'll try this: https://xiaomirom.com/en/download/xiaomi-11t-agate-stable-V12.5.1.0.RKWIDXM/#indonesia-fastboot Is it possible to choose Save all data so nothing gets deleted when downgrading with MI Flash Tool or do I need a Clean Flash?
[Xiaomi 11T] NOSS8:
Clean flash,use Micloud.
[Xiaomi 11T] nabulsi08:
Dirty Flash won't work?
[Xiaomi 11T] NOSS8:
Version change, clean flash.
[Xiaomi 11T] nabulsi08:
Upgrading worked for me without clean flash before. I was using MI Flash Tool.
[Xiaomi 11T] NOSS8:
Updating and changing versions are two different things.
[Xiaomi 11T] nabulsi08:
,

Yes but I think downgrading to MIUI 12.5 (Stock) could help if it's a Software Problem
[Android Q&A, Help & Troubleshooting] Jager2901:
Hi everyone,

I'm desperately looking for a free way to generate the code I need to unlock the bootloader. I've searched everywhere on the internet and haven't found any valid solutions.

I don't want to pay third party sites to have something that I think belongs to me rightfully so.

The Huawei site is crap and won't let me log in.

Let me know if you have any ideas,please.
[Android Q&A, Help & Troubleshooting] xXx yYy:
It's impossible. :)
[Android Q&A, Help & Troubleshooting] Jager2901:
Thank you for your quick reply. I found the source code of the EML L29 released on the Huawei official website. Can it be used to create a program to find the bootloader code?

P.S. I'd rather pay Huawei for this code than third-party programs for obvious security reasons
[Touch HD Accessories] 69reichertm:
Hello

Today i got avery small Kratzer 7 linke scribed into the touch hd display ?

is There a polish paste or something to get this away ?

What to do ? Can anybody help perhaps ?

1000 thanks in advance

Regrads

M:R
[Touch HD Accessories] myslee_ovi:
your Kratzer must be a scratch :D

you can put a displaycover on it. (you will see small scratches anymore)

please don't use anything of displaypolish... you will destroy your touchscreen foil.

use everytime a displaycover (one foil is in-box), if you don't use it, you will get angry everytime !

SAVE YOUR PHONE :D
[Touch HD Accessories] 69reichertm:
Hallo !

Thank you very much for your advise.

I will give it a try.

Best greetings

MR
[Touch HD Accessories] tyronne1126:
is there a way to remove scratches on a screen that isn't touch? not for the HD but for any other regular phone?
[Touch HD Accessories] lipa47:
http://www.displex.com
[Touch HD Accessories] gjpax:
i got a scratch on mine as well with the stylus right down the middle , but the screen cover that comes with the hd is rubbish , so i bought 1 off ebay but i can still see the scratch underneath it but id rather have that than get more scratches

i did see on 1 site which sold displex that it is compatible with the touch hd(which i didnt believe as every other site that sells doesnt say about touch hd compatible
[Touch HD Accessories] IC3 DEMON:
You might not get anymore, but you can still see the scratch that you had before.

I first just want to get rid of the scratch, before putting the displaycover on it.

There must be some polish. I heared there's even one for the Iphone.
[Touch HD Accessories] Cret:
Mine is the same - one scratch but now I have the cover on and can still of course see the scratch.

Would love to get rid of it but all the polish type scratch removers are abrasive and they're meant to be a bad idea on touchscreens.

Need some product that fills the scratch instead.
[Touch HD Accessories] Rizlo:
Well, the iPhone has a glass capacitive screen, a completely different thing. I'm pretty sure you can use a polish on that, but our resistive screens are much more delicate and I wouldn't take the risk.
[Samsung Galaxy A73 5G] pwilks89:
Is there custom rom for a73
[Samsung Galaxy A73 5G] ethical_haquer:
Sadly, it appears that there are currently no custom ROMs available for it. :(
[Samsung Galaxy A73 5G] Frax3r:
Our device overlay is merged to phhusson's and trebledroid's repos on early March. You shouldn't have any problems using GSIs that are released in March or later. Only problem known is screen brightness increases when fingerprint sensor is working. Afaik it is not related to overlay so there's not much to fix. If you decide to use an older GSI I'm leaving the overlay apk here. You need to push it to /system/product/overlay folder via adb or twrp. If you didn't use a vndklite build then you might find magisk easier so I'll leave a module for it as well.
[Moto G30] U_ShowcaseDev:
How can i change the Assistant Button Function without rooting my Moto G30?

Can you change the Assistant Button Function with a simple app?
[Moto G30] KAN7A:
It's actually impossible.
[Moto G30] U_ShowcaseDev:
That's what I think... Thank you also
[Moto G30] KAN7A:
https://play.google.com/store/apps/details?id=host.stjin.assistantshortcuts&hl=en&gl=US

Try this, it doesnt remap it but it pretends to be an assistant, havent tested it.

But to actually remap it is impossible.
[General Questions and Answers] LucyferM:
Hello,

I was wondering if there is a way to change the brand of the phone that is seen by apps?

I use 4k Stogram to scrape some Instagram accounts but the problem is 4k Stogram uses a user-agent(?) that is branded as Samsung SM-G925F.

In general it wouldn't really matter but I don't have a Samsung phone, I have a Xiaomi Redmi that I use to follow new accounts or update the account used in 4k Stogram and every time I log into the Instagram app on that Xiaomi phone the account gets logged out on the 4k Stogram app and often I'll have to change the password bc it's marked as a bot account yada yada.

It's annoying to have to change those things constantly bc I have to remember a different password, so in my head the solution would be just to make Instagram think my Xiaomi phone is the same Samsung SM-G925F as used by 4k Stogram.

Is this possible or am I out of luck?
[General Questions and Answers] xXx yYy:
This can be done by changing the related entries in Android's system file named build.prop: requires Android is rooted.
[General Questions and Answers] DrewPoss:
You can achieve the desired result by editing the build.prop file or spoofing the specific app using xposed modules like android faker or device emulator
[Android Head-Units] 1960darrenh:
Hi members. Had my head unit for 6 months but have no idea where I can update it online as the information is confusing.

I've uploaded some pics with the information I can get from it.

Thanks.
[Touch HD General] Gasman:
Hi, really hoping for a bit of help here, this driving me nuts.

I love the idea of threaded messages, but I have a problem with the keyboard overlaying the last text message in the thread, so i cannot see what i'm typing.

I have to click the keyboard symbol in the middle of the bottom part of screen to hide the keyboard/pad. Then click it again to bring it back in view, and only then does the message history/text move up the page and allow me to see blank section that the typed text is going to appear in.

I've blanked out the sweary :D

Thanks

Mick
[Touch HD General] Gasman:
Nobody else have this issue?......Just me :(
[Touch HD General] mmdirk:
No, I have the same issue, keyboard on/off appears to be the only resolution as you indicated.

The other annoyance is you can't resize the lower input portion of the window into the upper response side of the window therefore leaving you with only two visible lines. Typically you could touch this line and move it up or down to suit.
[Touch HD General] Cheeze[iT]:
hope they have a fix for this. i hate not knowing what I type.
[Touch HD General] tyronne1126:
its either that or the keyboard keeps jumping around.. or the list of msgs goes down so i cant even see the recent ones but the old ones..
[Touch HD General] Gasman:
Yeah it is a pain that the 'old' messages get more screen 'real-estate' than the message your actually typing out! Two lines of text then you gotta p**s about with tiny up/down scroll bar :mad:

Is this a HTC thing or a WM6.1 thing?

And if its HTC, can we log a complaint? Having the texting sorted is pretty fundamental on a mobile phone!

Mick