yashsingh1/xdaforums huggingface dataset:
[Touch Diamond, MDA Compact IV ROM Development] obsidianjaguar:
Hello,

Apologies for long post , but I am very keen on this project and I am in need of help from all the lovely cookers out there .. Well I have an idea , but unfortunately lack the skills to turn it to reality , so I was hoping someone with the time , energy and skills would be kind ... I like the concept behind "remote tracker", because it will basicly sleep silently and hidden , waiting for you to send the text , then wakes up and will txt you back with various info .. like GPS / cell tower location info , new owner , new sim card .. txt message s ect .. It also can detect a SIM card change . So this would be good to have if the phone was stolen ... NOW .. as I understand it .. the settings are inside a encrypted reg file of some sort .. Now If this SW got added to the ROM the reg file would also need to be in there , and I am assuming such things as the emergency number and email stuff like that needs to be in there as well .. I dont know anything about cooking up ROMS , but I think there is a part of the rom .. pre ROM ?? .. where you can Specfiy application to be installed as part of the rom , like for instance the updated .net version , AppToDate, and any opther " supporting software's" stuff like that ..

I also like TRACK ME , while this offers somewhat similar functionality , it is idaly used for stuff like , for example tracking a run or walk .. I can add tis manually , but if you already baking , it might not be too hard to add it in

Track me needs some SQL stuff too , so it might be more trouble

So My question is .. can someone please teach me how to bake up a Rom based on RUU_Diamond_HTC_HK_WWE_1.93.831.1

With remote tracker, and Track Me , all working and configured for my infos and SIM card .. and I dont know if there is a way , even after a hard reset that some part of the rom would auto load the proggie and settings and everything .. maybe if it just loaded remote tracker for now , and had a way that even if they hard reset , it would still work ... like send my girlfreinds mobile a text saying " phone is at GPS/ Cell phone tower location xxxx .... and has new sim xxxxx in it"

ALSO A SIDE note , the method of flashing from the Internal memory comes to mind , as that might even make it a bit harder for a thief , or the causal person who found my phone ...

Any idea at all , also if you guys have used other softwatres for tracking the phone after it is stolen or lost . do tell ..

Any help.. suggestions .. Idealy maybee somone can cook me a rom and I can test it on my phone
[Touch Diamond, MDA Compact IV ROM Development] mjaxa:
You realize that this solution will not work if teh thief will flash his own/other rom?

As usual - you will never get teh smart ones, only the stupid/uneducated ones will get caught...:(
[Touch Diamond, MDA Compact IV ROM Development] kareeem:
Not sure why you see it as a bad thing, but i'd personally rather have somebody completely dumb with WM rather than one who knows the tricks and work-arounds.
[Touch Diamond, MDA Compact IV ROM Development] Thilo T.:
There are already apps on the market, that enable you to track your phone, receive an SMS with the new number...

Take a look at kaspersky e.g.

And of course, if someone flashes the phone, its all useless. So I don´t think its worth the effort.

bye,

Thilo
[Touch Diamond, MDA Compact IV ROM Development] djcurr:
seriously?

you guys seriously think that someone who is gonna steal a phone or find a phone is gonna be able to flash the rom? first thing they are gonna do is try and sell the phone. you guys are giving the rest of the world population to much credit. majority of ppl have no clue what a rom is or what flashing something even meens. but yes a tracking software would be essential now that gps are getting so accurate u might even find the guy.
[General Questions and Answers] lupastro82:
Hi, someone can help me to best understood what is External storage and/or Download Management?

I've this in some app > Storage and cache.

Ty 😅☺️
[General Questions and Answers] lupastro82:
I never plug any extra device in my pixel 7 pro.

Also, in Dropbox app (like from screen) there is External storage + download management or similar. I don't know why and I don't know if is safe to clear this extra data.

Ty.
[General Questions and Answers] lupastro82:
Obviously, isn't related to Dropbox app.

Is just a question about android.
[General Questions and Answers] WoKoschekk:
As already mentioned Android's internal storage is the entire eMMC or eUFS storage chip. Any other called external storage.

If you talk about app specific data then the terms 'internal' and 'external' storage could have other meanings.

The internal storage is the system's app directory in /data/data/PACKAGE where all apps store their sensitive app data.

The external storage is then /internal/Android/data/PACKAGE where also user related stuff is stored, e.g. pictures, movies and documents.

In this case "external" is meant as "outside" the system's app directory.
[Fire HD 8 and HD 10 General] Pro-me3us:
This is a general service announcement. There is vulnerability in the Mali GPU drivers that allows for root access discovered by security researcher Man Yue Mo (CVE-2022-38181). The vulnerability goes way back and affects almost any device with a Mali GPU. That covers most of the FireHD tablets from the last 5 years, most of the FireTV televisions, and the 1st, 2nd and 3rd gen Cubes (and FireTV pendant).

Man Yue Mo posted a POC for the Pixel 6, that was adapted to work on the 2nd and 3rd gen FireTV Cubes. It takes a non-trivial number of changes to get it to work on other devices, and I don't have any FireHD tablets to work through it on. It appears that the cat's out of the bag on this exploit now, because the 2nd gen Cube just got an update that patches the POC. So I'm assuming a patch is coming (possibly even present) to other Fire devices as well, otherwise I would have kept it quiet for longer to try to work through some other devices.
[Fire HD 8 and HD 10 General] Pro-me3us:
I will try to post the source for the two Cube versions within the next day.

The Pixel 6 POC has to be modified for 32bit userspace, and there may need to be modifications to some of the struct's depending on which version of the Mali driver your device is using.

Kallsyms offsets need to be changed for any firmware you want to cover

Pool_size should be verified on your device

I'd also double check the path for define Mali, I've seen a couple devices that don't use the default path.

Lastly disabling selinux may need to be modified depending on the kernel version.

I'd start out with a device that you already have root on so that you can get any values needed, and use it as a potential template.

Edit: added 2nd and 3rd gen source code
[Fire HD 8 and HD 10 General] Rortiz2:
Thank you for your the brief explanation regarding the changes that need to be made. We are currently attempting to exploit the Fire HD8 2020 (onyx), but have encountered an issue. We were able to extract the kallsyms table using this script, which seemed to work correctly. However, we have discovered that some of the kallsyms appear to be missing, specifically:​

sel_read_handle_unknown: ffffff80083b08b0​

selinux_enforcing: Doesn't seem to exist.​

init_creds: Doesn't seem to exist.​

commit_creds: ffffff80080dc530​

add_init: Doesn't seem to exist.​

add_commit: Doesn't seem to exist.​

We have also observed that the tablet crashes after increasing FLUSH_SIZE (which seems to be normal as per the comments in the source code of the PoC), probably indicating that this device is indeed vulnerable to the CVE. Do you have any suggestions on how we can proceed with regards to the missing kallsyms?​
[Fire HD 8 and HD 10 General] Pro-me3us:
I don't know if it's a good idea to go through methods publicly since it will help instruct Amazon on how to make future probing and intrusions harder for other exploits. I'll pm you
[Fire HD 8 and HD 10 General] Michajin:
FYI, if you want to test anything on other devices i have almost everything 10 gen and below, including the hd8 (10). Totally dont care if i brick them, they arent used regularly... Including a unlocked and locked fire 7 (2019)

Graphics adapter

ARM Mali-T720 MP
[Fire HD 8 and HD 10 General] deckinghalls:
I'll gladly run any testing on my devices as well. Fire 7 (2019) and HD 10+ (2021) both running firmware version 7.3.2.1.
[Fire HD 8 and HD 10 General] SergeantFury:
I have an already-rooted Karnak (8th gen HD 8) that I can reflash to any OS needed - do let me know if it can be of any service to the cause.
[Fire HD 8 and HD 10 General] mind _spacer:
I am also facing trouble to find kallsyms - add_init add_commit values. can you help me to find that
[Fire HD 8 and HD 10 General] Rortiz2:
The values you're referring to are not kernel symbols, but rather shellcode(s). You'll need to adjust the ADD_* values to align them with your specific kallsyms. The following example shows the correct values for the Amazon Fire HD8 2020 (onyx):

#define AVC_DENY_7314_1443 0x3252F4 // avc_denied.isra.6
#define SEL_READ_HANDLE_UNKNOWN_7314_1443 0x3308B0
#define PREPARE_KERNEL_CRED_7314_1443 0x5C8E8
#define COMMIT_CREDS_7314_1443 0x5C530
#define ADD_PREPARE_KERNEL_CRED_7314_1443 0x9123a108 // add x8, x8, #0x8E8 <-- prepare_kernel_cred
#define ADD_COMMIT_7314_1443 0x9114c108 // add x8, x8, #0x530 <-- commit_creds

As you can see, these values are ARM assembly opcodes encoded as 32-bit constants. In this case, they represent the add operation on the x8 register. To create these constants, you can use online converters or the ARM instruction set encoding.

For instance, add x8, x8, #0x8E8 is encoded into the 32-bit value 0x9123a108 using the following breakdown:​

91000000 - Base value for ADD (immediate) instruction with 64-bit registers (this will be different for non-ARM64 archs).​

00001000 - Destination and first operand register (x8 in binary).​

00111010 - Immediate value to be added, rotated right by 12 bits (0x8E8 rotated - prepare_kernel_cred).​

00000001 - Shift amount for immediate value (1*12, since immediate value is specified in multiples of 12).​

I actually implemented a function to dynamically craft the values, but I never tried it so far. In case anyone is interested, this is how it looked like:

#define ADD_OPCODE_ARM64 0x91000000 // ARM64
#define ADD_OPCODE_ARM32 0xE0000000 // ARM32

uint32_t add_off_to_reg(uint32_t offset, uint8_t reg) {
uint32_t add_value = ADD_OPCODE_ARM64;
add_value |= reg; // Rd
add_value |= reg << 5; // Rn
add_value |= (offset & 0xFFF) << 10; // imm12
LOG("add x%d, x%d, %#x: 0x%08X\n", reg, reg, offset, add_value);
return add_value;
}

I hope this helps you!​
[Fire HD 8 and HD 10 General] mind _spacer:
Thank you for the brief reply, definitely it helped a lot.
[Fire HD 8 and HD 10 General] mind _spacer:
Is this POC works on android devices (such as samsung) having mali driver , if its works can you tell me the modifications need to done on struct's and disable selinux depending on kernel version(which u mentioned) and what are the changes do we need to do?
[Fire HD 8 and HD 10 General] Pro-me3us:
Knowing nothing about your device, it's hard to know what changes are required to get the POC to run. What is the device kernel version and Mali driver type and version? Is it using a 32bit or 64bit version of Android? Do you have a copy of the firmware that your device is currently using (most importantly boot.img)? Do you have the source code for the kernel? Is the source code for the same version of the firmware that your device is currently running?

There are a few ways to do things depending on what resources you have available to you.
[Fire HD 8 and HD 10 General] nsfxpython:
Following....with my 2021 Fire HD 10 running 7.3.2.1
[Fire HD 8 and HD 10 General] mind _spacer:
This is the spec of my device:

Samsung M30s (M307FXXU4CVD1)

Android 11, 64-bit version

Kernel - 4.14.113

Security patch level - 1 Mar 2022

Mali - G72 MP3, version - r26 p0

I have the source code and firmware image of this device. And I have found the device specific offsets (from elf of kernel) and @Rortiz2 helped me to find some of it, kernel base address (by reading header of boot.img) and path defined for mali is correct.

I tried to run the original POC but device reboots at the after it prints "Cleanup flush region" part.

then, I tried ur poc which ends by "Release_mem_pool" and reboot.

Hope you could help me.
[Fire HD 8 and HD 10 General] Pro-me3us:
I'm assuming that Mali driver type is Valhall? or Bifrost? Midgard?

Valhall r26p0 might be recent enough that you don't need to make any struct changes to for older driver compatibility.

Since your device is using 64bit Android, I'd stick to the original Pixel6 POC. A lot of the changes in my two POCs was 64bit to 32bit conversations. The 32bit POC may work on your device, but I don't know if there are any incompatibilities. Better to avoid any potential 32bit complications.

What are the 6 kernel addresses that you plugged in to the Pixel6 POC for your device?
[Fire HD 8 and HD 10 General] relalis:
I'm trying to work with your gazelle POC as a base for amazon mustang (midgard r26p0), but I have some questions; what is alloc.in.flags (1 << 22) in spray()? It doesn't seem to match any base_mem_alloc_flags I could find for either the cube or the mustang.

I'm also getting -EPERM on the alias_sprayed_regions() mmap(), presumably because of MAP_SHARED. When ORed with MAP_ANON the mmap64 call succeeds, however find_pgd() then fails because the pages are all zeroed. Can you advise?
[Fire HD 8 and HD 10 General] bibikalka:
@Pro-me3us

A temp root would be great - at least, to make backups easier. is this new exploit realistic to get working on hd tablets? Do you have a tablet like that to try ?
[Fire HD 8 and HD 10 General] Pro-me3us:
I have never taken a look at Midgard.

Midgard r26p0 - July, 2018 (mustang)

Bifrost r25p0 - June, 2020 (gazelle)

Bifrost r16p0 - December, 2018 (raven)

Based on the timing, I would use the raven POC as your base, because the driver is likely more similar. This is related to the issue you were asking about. Bifrost r16p0 doesn't support the memory pool group which is that flag. Support for that was added somewhere between Bifrost r16p0 and r25p0, and Midgard r26p0 may not support it either. Check out the changes made in Raven, I basically just removed it.

There are two parts to the POC, the GPU driver exploit, and disabling selinux to open a root shell. The GPU exploit portion should be mostly compatible between devices. If your device is using 64bit userspace, use the original Pixel6 POC which shouldn't have any driver incompatibilities back to about Bifrost r25p0 (2020). The Pixel6 uses Valhall, i'm not sure what driver version was available in 2020. If you have a device with 32bit userspace like most Amazon devices, then either the raven or gazelle POC should work for the GPU exploit portion. Midgard may have other unknown differences that need to be addressed

Disabling selinux / rootshell fixup portion is the part that needs to be modified to get the POC working with any individual tablet, because this portion has kernel specific instructions. This part of the POC probably isn't going to be as simple as swapping a couple kallsyms addresses. I think @Rortiz2 was working on getting the selinux / rootshell fixup working a few of the tablets. Using that as a base for the other MediaTek tablets might be more useful than my POCs, assuming they are more similar.

The new POC uses a race condition and the GPU portion is a bit more complicated, and may need more device specific tuning. The selinux / rootshell portion is mostly the same as the older exploit. The new user_buf exploit exploit mostlyonly has the advantage of working on Bifrost r38p0 which is the driver Amazon updated the Cubes to, to patch the shrinker exploit.

@mind _spacer sorry, I didn't notice your device kernel version before. The pixel6 POC handles the rootshell portion by disabling AVC_deny, for kernels older than 5.0 it may be easier to substitute selinux_enforcing, at least that's what was done for raven. I struggled a bit to get the rootshell portion working on both raven and gazelle. @rortiz was able to adapt it to one of the FireTablets in just a couple days, so he probably has a much better understanding and might be able to offer insights.
[Fire HD 8 and HD 10 General] bibikalka:
A bulk of Fire HDs was 32 bit user space indeed, armv8l was the kernel on many (HD10 2019 that i have). HD10 2021 became aarch64.

I thought @diplomatic had a fairly generic code to disable selinux fairly for all devices within his MTK exploit? Or was that a lot more different than here? Too bad a lot of old crew seems to have scattered, so much less capability around here these days (looking at @k4y0z here :) ).

What's the best way to find out the version of MALI driver that the device is using?
[Fire HD 8 and HD 10 General] relalis:
KBASE_IOCTL_VERSION_CHECK will return param.major and param.minor API versions, as to the driver type (midgard/bifrost/valhal) you'll have to look at Amazon's source code release for the individual devices, or perhaps find the relevant page on postmarketos wiki
[Fire HD 8 and HD 10 General] p0werpl:
ffffff0010689fe4 t avc_denied

ffffff00101bc73c T prepare_kernel_cred

ffffff001069e538 t sel_read_handle_unknown

ffffff00101bbffc T commit_creds

Note that these are not the values for your build.
[Fire HD 8 and HD 10 General] nsfxpython:
I'm going to be stepping away from this exploit for a little while. I just can't seem to get this to work for both my 11th gen Fire HD 10 and 8th gen Fire HD 8. I'll check back in at a later date to see if others have had more luck. Good luck to all!
[Fire HD 8 and HD 10 General] Azaze666:
Dear @Pro-me3us i really appreciate all you have and are doing for these tabs, but jeez.... the exploit here:https://github.com/Pro-me3us/CVE_2022_38181_Raven which is the one i tried to use for my tab is hardcoded for arm64, but unfortunately my tab is armv8l, i even compiled it and runned it but of course it was giving error, after looking at the code i realized it was hardcoded for arm64..... I don't say this for criticize but... it is useless for me (and other amazon tab hd8 2018 users). So with all humility possible (as i'm not mad, i'm just a bit disappointed), would you mind realizing a version for arm? In case you want to do it for my tab specifically i'll tell my version of fireos: 7.3.2.7, (Amazon Fire 8 2018), let's see if i can get the kernel elf, since seems that firmware version matters and the one i posted previously wasn't for my fw version.
[Fire HD 8 and HD 10 General] Azaze666:
The fun stuff continues to happen, i just discovered that vmlinux2elf tool detects always the arch of the kernel as aarch64. WTF my kernel is armv8l (32 bit) lol, if someone wants to help me get the right offsets for me, i would really appreciate, in the same way, what about a 32 bit version of the exploit? It's a problem if there isn't. Idk if it's bcz of the wrong arch the tool extracted not a lot of offsets, i may try to give to him the full boot image, still it detects the wrong arch so it is probably useless. btw here is full fw for my tab in case someone needs it:https://drivers.softpedia.com/get/T...ration-Tablet-Firmware-7-3-2-7.shtml#download

ok i maybe found why vmlinux2elf says arm64 everytime, seems it tends to mix arm and arm64 together, i looked inside the tool and those are architectures:

mipsle = 1

mipsbe = 2

mips64le = 3

mips64be = 4

x86 = 5

x86_64 = 6

powerpcbe = 7

powerpcle = 8

armle = 9

armbe = 10

aarch64 = 11

mips16e = 12

superhle = 13

superhbe = 14

sparc = 15

arcompact = 16

So arm and arm64 are aarch64 together so this isn't the issue, this is good actually
[Fire HD 8 and HD 10 General] Androiduser2390:
Fire HD 8 (9th Generation) Onyx Engineering Sample (with Root access, full fastboot)

I recently got my hands on a Fire HD 8 (9th gen, 2020?), specifically a pre-production model that is both really locked down and not super locked down. For instance, I can pull a bunch of files from system directories and look at them on my PC...

xdaforums.com

Could any one try this on a non pre launch 10th gen, as it seems the onyx is very close to the 9th gen. This might be the closest to having a real fastboot on one of these kindles.
[Fire HD 8 and HD 10 General] Pro-me3us:
raven_shrinker is modified to run in 32bit user space. The original Pixel 6 POC is written for 64bit user space.

I don't know what you are referring to as being 'hardcoded for arm64'. Maybe you were looking at your tablet's kernel.
[Fire HD 8 and HD 10 General] Azaze666:
so maybe the poc doesn't work for me because of wrong offsets, i see. i apologize for the previous "attack?", i'm not even sure it was, i'm just frustrated, i just want to f.... Amazon (you can guess the word, i want to be polite) and root that tab
[Fire HD 8 and HD 10 General] Azaze666:
Well guys, aside from this exploit, which idk if i will ever be able to properly execute, im trying other ways of privilege escalation and stuff looks promising, let me show you why

a part of top command on my tab (Amazon Tab HD8 2018, FireOS 7.3.2.7).

[7m PID USER PR NI VIRT RES SHR S[%CPU] %MEM TIME+ ARGS [0m

9744 shell 20 0 6.4M 3.5M 2.8M R 2.6 0.2 0:01.49 top

779 u0_a119 20 0 932M 95M 89M S 0.6 6.4 0:15.64 com.amazon.redstone

1065 u0_a103 20 0 896M 90M 82M S 0.3 6.1 0:08.90 com.amazon.imp

544 system 18 -2 1.3G 205M 174M S 0.3 14.0 2:05.07 system_server

365 root 20 0 5.1M 2.5M 2.3M S 0.3 0.1 0:00.43 sh /vendor/bin/wifi_log_levels.sh

184 root 20 0 0 0 0 S 0.3 0.0 0:00.45 [mtk charger_hv_]

9740 shell 20 0 4.5M 2.5M 2.0M S 0.0 0.1 0:00.01 sh -

look at...what? an sh script running as root? unsecurity as it's max level, amazon doesn't know seems that scripts and processes in general running as root can be modified/hijacked or if they drop files world readable it's easy af to get root (look at samsung admire root method for example with a log with world readable perms). Unfortunately at a first look seems these scripts don't drop any file but that doesn't mean that i (or we if someone with my same tab, or if other people find out to have my same file/or conditions) can't exploit this script memory. That said i'm doing a top and i'll letting it run for a longer time to see if i'll find other scripts being runned as root, who knows i'll find something else. Also seems that this script inside calls another script but i looked at this other script as well and it doesn't seem useful at all, i'll leave them as attachments. Seems also this script runs periodically, just saying. Also take the terminal window at full screen if you don't want the log to be cutted. Running the cmd i will provide you will find a log file named top.txt on the internal storage.

to check if you have some script running as root like me:adb shell top | grep root >> /sdcard/top.txt

Edit: added more logs, and I will continue if needed, there is one of 11,5MB, on Linux it was 12,1, yes i stayed like 5 or 6 hours if not more with the tab logging from adb, hilarious isn't it? Tomorrow if possible I'll try to dump the memory of those two sh scripts (i don't even know if it will be even possible since they are runned as root and I don't have any reading permission, still I have to try, there are some utilities to try)