pm list packages -f
package:/system/priv-app/AmazonPlatform-release/AmazonPlatform-release.apk=com.amazon.platform
package:/data/app/com.box.android-2/base.apk=com.box.android
package:/system/priv-app/FireflyIdentifiesSDK-release/FireflyIdentifiesSDK-release.apk=com.amazon.mw.sdk
package:/system/priv-app/com.amazon.knight.calendar/com.amazon.knight.calendar.apk=com.amazon.knight.calendar
package:/data/app/com.google.android.youtube-1/base.apk=com.google.android.youtube
package:/data/app/com.amazon.photos-2/base.apk=com.amazon.photos
package:/system/priv-app/com.amazon.dp.contacts/com.amazon.dp.contacts.apk=com.amazon.dp.contacts
package:/system/priv-app/com.amazon.unifiedsharegoodreads/com.amazon.unifiedsharegoodreads.apk=com.amazon.unifiedsharegoodreads
package:/system/priv-app/com.amazon.kindle.otter.oobe.forced.ota/com.amazon.kindle.otter.oobe.forced.ota.apk=com.amazon.kindle.otter.oobe.forced.ota
package:/system/priv-app/FireRecessProxy/FireRecessProxy.apk=com.amazon.recess
package:/system/app/fdrw/fdrw.apk=com.amazon.platform.fdrw
package:/data/app/com.google.android.googlequicksearchbox-1/base.apk=com.google.android.googlequicksearchbox
package:/system/priv-app/com.android.providers.calendar/com.android.providers.calendar.apk=com.android.providers.calendar
package:/system/priv-app/WhisperlinkSdk/WhisperlinkSdk.apk=com.amazon.whisperplay.contracts
package:/system/priv-app/MediaProvider/MediaProvider.apk=com.android.providers.media
package:/data/app/com.amazon.venezia-2/base.apk=com.amazon.venezia
package:/system/priv-app/SpeechUi/SpeechUi.apk=com.amazon.speechui
package:/data/app/com.amazon.webapp-1/base.apk=com.amazon.webapp
package:/system/priv-app/DeviceSoftwareOTAContracts/DeviceSoftwareOTAContracts.apk=com.amazon.dcp.contracts.library
package:/system/priv-app/WallpaperCropper/WallpaperCropper.apk=com.android.wallpapercropper
package:/data/app/com.teslacoilsw.launcher-2/base.apk=com.teslacoilsw.launcher
package:/system/priv-app/com.amazon.zordon/com.amazon.zordon.apk=com.amazon.zordon
package:/data/app/com.udacity.android-1/base.apk=com.udacity.android
package:/system/app/Protips/Protips.apk=com.android.protips
package:/data/app/com.speedsoftware.rootexplorer-1/base.apk=com.speedsoftware.rootexplorer
package:/system/priv-app/IvonaTtsOrchestrator/IvonaTtsOrchestrator.apk=com.ivona.orchestrator
package:/system/priv-app/com.amazon.device.sync/com.amazon.device.sync.apk=com.amazon.device.sync
package:/system/framework/fireos-res/fireos-res.apk=amazon.fireos
package:/data/app/com.google.android.apps.paidtasks-1/base.apk=com.google.android.apps.paidtasks
package:/system/priv-app/LogManager-logd/LogManager-logd.apk=com.amazon.device.logmanager
package:/system/app/DocumentsUI/DocumentsUI.apk=com.android.documentsui
package:/system/priv-app/ExternalStorageProvider/ExternalStorageProvider.apk=com.android.externalstorage
package:/system/app/HTMLViewer/HTMLViewer.apk=com.android.htmlviewer
package:/data/app/com.gbeatty.arxiv-1/base.apk=com.gbeatty.arxiv
package:/data/app/com.amazon.firelauncher-1/base.apk=com.amazon.firelauncher
package:/system/priv-app/com.amazon.media.session.monitor/com.amazon.media.session.monitor.apk=com.amazon.media.session.monitor
package:/system/priv-app/com.amazon.h2clientservice/com.amazon.h2clientservice.apk=com.amazon.alta.h2clientservice
package:/system/priv-app/AdvertisingIdSettings/AdvertisingIdSettings.apk=com.amazon.advertisingidsettings
package:/system/priv-app/DownloadProvider/DownloadProvider.apk=com.android.providers.downloads
package:/system/priv-app/com.amazon.socialplatform/com.amazon.socialplatform.apk=com.amazon.socialplatform
package:/system/priv-app/com.amazon.dp.fbcontacts/com.amazon.dp.fbcontacts.apk=com.amazon.dp.fbcontacts
package:/system/priv-app/com.amazon.comms.knightcontacts/com.amazon.comms.knightcontacts.apk=com.amazon.comms.knightcontacts
package:/system/priv-app/com.amazon.h2settingsfortablet/com.amazon.h2settingsfortablet.apk=com.amazon.h2settingsfortablet
package:/data/app/com.hulu.plus-1/base.apk=com.hulu.plus
package:/system/priv-app/com.amazon.calculator/com.amazon.calculator.apk=com.amazon.calculator
package:/system/priv-app/com.amazon.cloud9.systembrowserprovider/com.amazon.cloud9.systembrowserprovider.apk=com.amazon.cloud9.systembrowserprovider
package:/system/priv-app/com.amazon.kindle.otter.settings/com.amazon.kindle.otter.settings.apk=com.amazon.kindle.otter.settings
package:/system/priv-app/AlexaModeSwitch/AlexaModeSwitch.apk=com.amazon.alexa.modeswitch
package:/system/priv-app/com.amazon.dp.logger/com.amazon.dp.logger.apk=com.amazon.dp.logger
package:/system/priv-app/com.amazon.ods.kindleconnect/com.amazon.ods.kindleconnect.apk=com.amazon.ods.kindleconnect
package:/system/priv-app/DefaultContainerService/DefaultContainerService.apk=com.android.defcontainer
package:/system/priv-app/com.amazon.accessorynotifier/com.amazon.accessorynotifier.apk=com.amazon.accessorynotifier
package:/data/app/com.amazon.cloud9.contentservice-1/base.apk=com.amazon.cloud9.contentservice
package:/system/priv-app/DownloadProviderUi/DownloadProviderUi.apk=com.android.providers.downloads.ui
package:/data/app/com.android.vending-1/base.apk=com.android.vending
package:/system/app/PacProcessor/PacProcessor.apk=com.android.pacprocessor
package:/system/priv-app/com.amazon.sharingservice.android.client.proxy.release/com.amazon.sharingservice.android.client.proxy.release.apk=com.amazon.sharingservice.android.client.proxy
package:/system/priv-app/com.amazon.weather/com.amazon.weather.apk=com.amazon.weather
package:/system/priv-app/AmazonKKWebViewLib/AmazonKKWebViewLib.apk=com.amazon.webview
package:/system/priv-app/marketplace_service_receiver/marketplace_service_receiver.apk=com.amazon.android.marketplace
package:/data/app/com.tencent.ig-2/base.apk=com.tencent.ig
package:/system/priv-app/FireStorageManager/FireStorageManager.apk=com.amazon.storagemanager
package:/system/priv-app/com.amazon.vans.alexatabletshopping.app/com.amazon.vans.alexatabletshopping.app.apk=com.amazon.vans.alexatabletshopping.app
package:/system/app/CertInstaller/CertInstaller.apk=com.android.certinstaller
package:/system/priv-app/wakewordserver/wakewordserver.apk=amazon.speech.wakewordservice
package:/data/app/com.reddit.frontpage-1/base.apk=com.reddit.frontpage
package:/system/priv-app/TabletDockSettings/TabletDockSettings.apk=com.amazon.tablet.dock.settings
package:/system/priv-app/DeviceBackupAndRestoreInternalSDK-release/DeviceBackupAndRestoreInternalSDK-release.apk=com.amazon.device.backup.sdk.internal.library
package:/system/framework/framework-res.apk=android
package:/data/app/com.llamalab.automate.ext.network-1/base.apk=com.llamalab.automate.ext.network
package:/system/priv-app/com.android.contacts/com.android.contacts.apk=com.android.contacts
package:/data/app/org.mozilla.fennec_aurora-2/base.apk=org.mozilla.fennec_aurora
package:/data/app/com.aor.droidedit.pro-1/base.apk=com.aor.droidedit.pro
package:/system/priv-app/ReadyNowCore-release/ReadyNowCore-release.apk=com.amazon.readynowcore
package:/system/priv-app/MetricsApi/MetricsApi.apk=com.amazon.client.metrics.api
package:/data/app/com.amazon.aca-1/base.apk=com.amazon.aca
package:/system/priv-app/FireOsMiddlewareDebugApp/FireOsMiddlewareDebugApp.apk=com.amazon.dcp
package:/system/priv-app/com.amazon.imp/com.amazon.imp.apk=com.amazon.imp
package:/data/app/com.amazon.mp3-2/base.apk=com.amazon.mp3
package:/system/priv-app/com.amazon.unifiedsharesinaweibo/com.amazon.unifiedsharesinaweibo.apk=com.amazon.unifiedsharesinaweibo
package:/system/priv-app/amazon.alexa.tablet/amazon.alexa.tablet.apk=amazon.alexa.tablet
package:/system/priv-app/sync-service-fireos-tablet-release/sync-service-fireos-tablet-release.apk=com.amazon.sync.service
package:/system/priv-app/com.amazon.comms.knightmessaging/com.amazon.comms.knightmessaging.apk=com.amazon.comms.knightmessaging
package:/system/priv-app/com.amazon.frameworksettings/com.amazon.frameworksettings.apk=com.amazon.frameworksettings
package:/system/priv-app/com.amazon.fireinputdevices/com.amazon.fireinputdevices.apk=com.amazon.fireinputdevices
package:/data/app/com.NewDsemu.FreeDraStic-1/base.apk=com.NewDsemu.FreeDraStic
package:/system/app/Stk/Stk.apk=com.android.stk
package:/system/priv-app/BackupRestoreConfirmation/BackupRestoreConfirmation.apk=com.android.backupconfirm
package:/data/app/com.amazon.dee.app-2/base.apk=com.amazon.dee.app
package:/system/priv-app/com.amazon.csapp/com.amazon.csapp.apk=com.amazon.csapp
package:/system/priv-app/logan/logan.apk=com.amazon.logan
package:/data/app/com.amazon.tahoe-1/base.apk=com.amazon.tahoe
package:/system/priv-app/com.amazon.tcomm/com.amazon.tcomm.apk=com.amazon.tcomm
package:/data/app/com.microsoft.office.onenote-1/base.apk=com.microsoft.office.onenote
package:/data/app/org.coursera.android-2/base.apk=org.coursera.android
package:/system/priv-app/com.amazon.redstone/com.amazon.redstone.apk=com.amazon.redstone
package:/system/priv-app/com.android.calendar/com.android.calendar.apk=com.android.calendar
package:/data/app/com.llamalab.automate.ext.settings-1/base.apk=com.llamalab.automate.ext.settings
package:/system/priv-app/com.amazon.kindle.personal_video/com.amazon.kindle.personal_video.apk=com.amazon.kindle.personal_video
package:/system/priv-app/com.amazon.displayclockface/com.amazon.displayclockface.apk=com.amazon.displayclockface
package:/system/priv-app/SpeechInteractionManager/SpeechInteractionManager.apk=amazon.speech.sim
package:/system/priv-app/com.amazon.identity.auth.device.authorization/com.amazon.identity.auth.device.authorization.apk=com.amazon.identity.auth.device.authorization
package:/system/priv-app/com.amazon.kcp.tutorial/com.amazon.kcp.tutorial.apk=com.amazon.kcp.tutorial
package:/system/priv-app/com.amazon.kindle.cms-service/com.amazon.kindle.cms-service.apk=com.amazon.kindle.cms
package:/data/app/com.amazon.kindle.kso-1/base.apk=com.amazon.kindle.kso
package:/system/priv-app/SettingsProvider/SettingsProvider.apk=com.android.providers.settings
package:/system/priv-app/com.amazon.kindleautomatictimezone/com.amazon.kindleautomatictimezone.apk=com.amazon.kindleautomatictimezone
package:/system/priv-app/SharedStorageBackup/SharedStorageBackup.apk=com.android.sharedstoragebackup
package:/data/app/com.llamalab.automate.ext.storage-1/base.apk=com.llamalab.automate.ext.storage
package:/system/priv-app/PrintSpooler/PrintSpooler.apk=com.android.printspooler
package:/system/priv-app/DeviceBackupAndRestore-release/DeviceBackupAndRestore-release.apk=com.amazon.device.backup
package:/system/priv-app/MapsAPIClientServices-release-signed/MapsAPIClientServices-release-signed.apk=com.amazon.geo.mapsv2.services
package:/system/app/MopriaPlugin/MopriaPlugin.apk=org.mopria.printplugin
package:/system/priv-app/com.amazon.securitysyncclient/com.amazon.securitysyncclient.apk=com.amazon.securitysyncclient
package:/system/priv-app/UnifiedShareActivityChooser/UnifiedShareActivityChooser.apk=com.amazon.unifiedshare.actionchooser
package:/system/priv-app/WhisperplayActivityView/WhisperplayActivityView.apk=com.amazon.whisperlink.activityview.android
package:/data/app/com.dropbox.android-2/base.apk=com.dropbox.android
package:/system/priv-app/DeviceMessagingAndroid/DeviceMessagingAndroid.apk=com.amazon.device.messaging
package:/system/priv-app/com.amazon.digital.asset.ownership.app/com.amazon.digital.asset.ownership.app.apk=com.amazon.digital.asset.ownership.app
package:/system/app/AmazonDeviceMetrics/AmazonDeviceMetrics.apk=com.amazon.device.metrics
package:/system/priv-app/DeviceMessagingAndroidInternalSDK/DeviceMessagingAndroidInternalSDK.apk=com.amazon.device.messaging.sdk.internal.library
package:/system/app/WhiteListedUrlProvider/WhiteListedUrlProvider.apk=com.amazon.providers
package:/data/app/com.amazon.kindle.otter.oobe-1/base.apk=com.amazon.kindle.otter.oobe
package:/data/app/com.foxit.mobile.pdf.lite-2/base.apk=com.foxit.mobile.pdf.lite
package:/system/priv-app/com.amazon.tv.ottssocompanionapp/com.amazon.tv.ottssocompanionapp.apk=com.amazon.tv.ottssocompanionapp
package:/system/priv-app/com.amazon.photos.importer/com.amazon.photos.importer.apk=com.amazon.photos.importer
package:/system/priv-app/SystemUpdatesUI/SystemUpdatesUI.apk=com.amazon.settings.systemupdates
package:/data/app/com.teslacoilsw.launcher.prime-1/base.apk=com.teslacoilsw.launcher.prime
package:/system/priv-app/OneTimeInitializer/OneTimeInitializer.apk=com.android.onetimeinitializer
package:/system/priv-app/davsclientservice/davsclientservice.apk=amazon.speech.davs.davsclientservice
package:/system/priv-app/MapsAPISupportLibrary-release-signed/MapsAPISupportLibrary-release-signed.apk=com.amazon.geo.mapsv2
package:/system/app/KeyChain/KeyChain.apk=com.android.keychain
package:/system/priv-app/com.amazon.unifiedsharetwitter/com.amazon.unifiedsharetwitter.apk=com.amazon.unifiedsharetwitter
package:/data/app/com.android.chrome-1/base.apk=com.android.chrome
package:/system/priv-app/FireTvSaleService/FireTvSaleService.apk=com.amazon.device.sale.service
package:/system/priv-app/com.amazon.cardinal/com.amazon.cardinal.apk=com.amazon.cardinal
package:/system/priv-app/com.amazon.comms.multimodaltachyonarm/com.amazon.comms.multimodaltachyonarm.apk=com.amazon.comms.multimodaltachyonarm
package:/data/app/com.medium.reader-1/base.apk=com.medium.reader
package:/data/app/com.google.android.gms-2/base.apk=com.google.android.gms
package:/data/app/com.google.android.gsf-1/base.apk=com.google.android.gsf
package:/data/app/tv.twitch.android.app-2/base.apk=tv.twitch.android.app
package:/system/priv-app/PackageInstaller/PackageInstaller.apk=com.android.packageinstaller
package:/data/app/com.glassdoor.app-2/base.apk=com.glassdoor.app
package:/system/app/PicoTts/PicoTts.apk=com.svox.pico
package:/system/priv-app/com.amazon.communication/com.amazon.communication.apk=com.amazon.tcomm.client
package:/system/priv-app/com.amazon.knight.blink/com.amazon.knight.blink.apk=com.amazon.knight.blink
package:/system/priv-app/MetricsService/MetricsService.apk=com.amazon.client.metrics
package:/system/priv-app/RemoteSettingsInternalSDK/RemoteSettingsInternalSDK.apk=com.amazon.device.settings.sdk.internal.library
package:/system/priv-app/ProxyHandler/ProxyHandler.apk=com.android.proxyhandler
package:/system/app/UnifiedSettingsProvider/UnifiedSettingsProvider.apk=com.amazon.acos.providers.UnifiedSettingsProvider
package:/data/app/com.upwork.android-1/base.apk=com.upwork.android
package:/data/app/com.netflix.mediaclient-1/base.apk=com.netflix.mediaclient
package:/system/priv-app/com.amazon.firepowersettings/com.amazon.firepowersettings.apk=com.amazon.firepowersettings
package:/system/priv-app/com.amazon.glorialist/com.amazon.glorialist.apk=com.amazon.glorialist
package:/data/app/app.greyshirts.sslcapture-1/base.apk=app.greyshirts.sslcapture
package:/data/app/com.llamalab.automate-1/base.apk=com.llamalab.automate
package:/system/priv-app/amazon.jackson-19/amazon.jackson-19.apk=amazon.jackson19
package:/data/app/com.google.android.calendar-1/base.apk=com.google.android.calendar
package:/system/priv-app/com.audible.application.kindle/com.audible.application.kindle.apk=com.audible.application.kindle
package:/system/priv-app/ManagedProvisioning/ManagedProvisioning.apk=com.android.managedprovisioning
package:/data/app/com.spotify.music-1/base.apk=com.spotify.music
package:/data/app/org.khanacademy.android-1/base.apk=org.khanacademy.android
package:/system/vendor/app/AtciService/AtciService.apk=com.mediatek.atci.service
package:/system/priv-app/DeviceSoftwareOTA/DeviceSoftwareOTA.apk=com.amazon.device.software.ota
package:/system/priv-app/FireflyAppFireOS-release-stub/FireflyAppFireOS-release-stub.apk=com.amazon.mw
package:/system/priv-app/com.amazon.pm/com.amazon.pm.apk=com.amazon.pm
package:/system/priv-app/com.amazon.gloria.smarthome/com.amazon.gloria.smarthome.apk=com.amazon.gloria.smarthome
package:/system/priv-app/CredentialLockerAndroid-tablet-release/CredentialLockerAndroid-tablet-release.apk=com.amazon.wifilocker
package:/data/app/com.linkedin.android.jobs.jobseeker-2/base.apk=com.linkedin.android.jobs.jobseeker
package:/system/priv-app/com.amazon.tabletsubscriptions/com.amazon.tabletsubscriptions.apk=com.amazon.tabletsubscriptions
package:/system/priv-app/DeviceClientPlatformContractsFramework/DeviceClientPlatformContractsFramework.apk=com.amazon.dcp.contracts.framework.library
package:/system/priv-app/com.amazon.device.bluetoothdfu/com.amazon.device.bluetoothdfu.apk=com.amazon.device.bluetoothdfu
package:/data/app/com.google.android.gsf.login-1/base.apk=com.google.android.gsf.login
package:/system/priv-app/WhisperplayCore/WhisperplayCore.apk=com.amazon.whisperlink.core.android
package:/system/priv-app/com.amazon.kor.demo/com.amazon.kor.demo.apk=com.amazon.kor.demo
package:/system/priv-app/DeviceMessagingAndroidSDK/DeviceMessagingAndroidSDK.apk=com.amazon.device.messaging.sdk.library
package:/data/app/com.ultimateguitar.tabs-1/base.apk=com.ultimateguitar.tabs
package:/data/app/com.faultexception.reader-1/base.apk=com.faultexception.reader
package:/system/priv-app/com.amazon.geo.client.maps/com.amazon.geo.client.maps.apk=com.amazon.geo.client.maps
package:/data/app/com.scee.psxandroid-1/base.apk=com.scee.psxandroid
package:/system/app/jp.co.omronsoft.iwnnime.mlaz/jp.co.omronsoft.iwnnime.mlaz.apk=jp.co.omronsoft.iwnnime.mlaz
package:/system/vendor/app/Ds/Ds.apk=com.dolby
package:/data/app/jackpal.androidterm-1/base.apk=jackpal.androidterm
package:/system/priv-app/com.amazon.ags.app/com.amazon.ags.app.apk=com.amazon.ags.app
package:/system/app/jp.co.omronsoft.iwnnime.languagepack.zhcn_az/jp.co.omronsoft.iwnnime.languagepack.zhcn_az.apk=jp.co.omronsoft.iwnnime.languagepack.zhcn_az
package:/data/app/org.edx.mobile-1/base.apk=org.edx.mobile
package:/data/app/com.amazon.kindle.unifiedSearch-1/base.apk=com.amazon.kindle.unifiedSearch
package:/data/app/com.linkedin.android-1/base.apk=com.linkedin.android
package:/system/priv-app/sync-provider_ipc-tablet-release/sync-provider_ipc-tablet-release.apk=com.amazon.sync.provider.ipc
package:/system/priv-app/FireTabletSettings/FireTabletSettings.apk=com.android.settings
package:/system/framework/android.amazon.perm/android.amazon.perm.apk=android.amazon.perm
package:/system/priv-app/com.amazon.paladin/com.amazon.paladin.apk=com.amazon.paladin
package:/system/priv-app/com.goodreads.kindle/com.goodreads.kindle.apk=com.goodreads.kindle
package:/system/priv-app/AwvDeploymentService/AwvDeploymentService.apk=com.amazon.webview.awvdeploymentservice
package:/data/app/com.pushbullet.android-1/base.apk=com.pushbullet.android
package:/data/app/com.elevenworks.touchdraw-1/base.apk=com.elevenworks.touchdraw
package:/system/priv-app/ContentSupportProvider/ContentSupportProvider.apk=com.amazon.providers.contentsupport
package:/system/priv-app/com.amazon.platformsettings/com.amazon.platformsettings.apk=com.amazon.platformsettings
package:/system/priv-app/VpnDialogs/VpnDialogs.apk=com.android.vpndialogs
package:/system/priv-app/moffice_7.1_default_en00105_multidex_217792/moffice_7.1_default_en00105_multidex_217792.apk=com.kingsoft.office.amz
package:/system/priv-app/com.amazon.ava.shopping.android/com.amazon.ava.shopping.android.apk=com.amazon.ava.shopping.android
package:/system/priv-app/com.amazon.virtual.dash.knight.app/com.amazon.virtual.dash.knight.app.apk=com.amazon.virtual.dash.knight.app
package:/system/priv-app/CrashManager/CrashManager.apk=com.amazon.device.crashmanager
package:/system/priv-app/FireApplicationCompatibilityEnforcer/FireApplicationCompatibilityEnforcer.apk=com.amazon.application.compatibility.enforcer
package:/system/priv-app/com.android.email/com.android.email.apk=com.android.email
package:/system/priv-app/IvonaTTS/IvonaTTS.apk=com.ivona.tts.oem
package:/system/app/Music/Music.apk=com.android.music
package:/system/priv-app/Shell/Shell.apk=com.android.shell
package:/data/app/com.baronkiko.launcherhijack-1/base.apk=com.baronkiko.launcherhijack
package:/system/app/UserDictionaryProvider/UserDictionaryProvider.apk=com.android.providers.userdictionary
package:/data/app/com.llamalab.automate.ext.superuser-1/base.apk=com.llamalab.automate.ext.superuser
package:/data/app/com.ideashower.readitlater.pro-2/base.apk=com.ideashower.readitlater.pro
package:/system/priv-app/com.amazon.kindle.rdmdeviceadmin/com.amazon.kindle.rdmdeviceadmin.apk=com.amazon.kindle.rdmdeviceadmin
package:/data/app/com.camelgames.superking-2/base.apk=com.camelgames.superking
package:/system/priv-app/com.amazon.parentalcontrols/com.amazon.parentalcontrols.apk=com.amazon.parentalcontrols
package:/system/priv-app/DeviceSoftwareOTAIdleOverride/DeviceSoftwareOTAIdleOverride.apk=com.amazon.device.software.ota.override
package:/system/priv-app/EnvironmentContextService/EnvironmentContextService.apk=com.amazon.knight.ecs
package:/system/priv-app/HumanDetectionService/HumanDetectionService.apk=com.amazon.knight.hds
package:/system/priv-app/FusedLocation/FusedLocation.apk=com.android.location.fused
package:/system/priv-app/com.android.deskclock/com.android.deskclock.apk=com.android.deskclock
package:/system/priv-app/SystemUI/SystemUI.apk=com.android.systemui
package:/system/app/audiostreamproviderservice/audiostreamproviderservice.apk=amazon.speech.audiostreamproviderservice
package:/data/app/com.amazon.windowshop-1/base.apk=com.amazon.windowshop
package:/data/app/org.cnx.android-1/base.apk=org.cnx.android
package:/system/priv-app/com.nokia.odnp.service/com.nokia.odnp.service.apk=com.here.odnp.service
package:/data/app/com.amazon.avod-2/base.apk=com.amazon.avod
package:/system/priv-app/shipmode/shipmode.apk=com.amazon.shpm
package:/system/priv-app/com.amazon.zico/com.amazon.zico.apk=com.amazon.zico
package:/system/priv-app/com.amazon.communication.discovery/com.amazon.communication.discovery.apk=com.amazon.communication.discovery
package:/data/app/com.jagex.oldscape.android-1/base.apk=com.jagex.oldscape.android
package:/system/priv-app/BluetoothInternals/BluetoothInternals.apk=com.amazon.bluetoothinternals
package:/system/priv-app/com.amazon.legalsettings/com.amazon.legalsettings.apk=com.amazon.legalsettings
package:/system/priv-app/Camera/Camera.apk=com.amazon.camera
package:/system/priv-app/RemoteSettingsAndroid/RemoteSettingsAndroid.apk=com.amazon.device.settings
package:/data/app/com.amazon.cloud9-1/base.apk=com.amazon.cloud9
package:/data/app/com.amazon.cloud9.kids-1/base.apk=com.amazon.cloud9.kids
package:/data/app/com.google.android.play.games-2/base.apk=com.google.android.play.games
package:/system/priv-app/com.amazon.device.sync.sdk.internal/com.amazon.device.sync.sdk.internal.apk=com.amazon.device.sync.sdk.internal
package:/data/app/com.valvesoftware.steamlink-2/base.apk=com.valvesoftware.steamlink
package:/system/priv-app/com.amazon.unifiedsharefacebook/com.amazon.unifiedsharefacebook.apk=com.amazon.unifiedsharefacebook
package:/system/priv-app/ConnectivityDiag/ConnectivityDiag.apk=com.amazon.connectivitydiag
package:/system/priv-app/com.amazon.dynamicupdationservice/com.amazon.dynamicupdationservice.apk=com.amazon.dynamicupdationservice
package:/system/app/Bluetooth/Bluetooth.apk=com.android.bluetooth
package:/system/priv-app/com.android.providers.contacts/com.android.providers.contacts.apk=com.android.providers.contacts
package:/system/app/TabletCaptivePortalLogin/TabletCaptivePortalLogin.apk=com.android.captiveportallogin
package:/system/priv-app/com.amazon.gambit/com.amazon.gambit.apk=com.amazon.gambit
package:/system/app/AmazonWebView/AmazonWebView.apk=com.amazon.webview.chromium
package:/system/priv-app/AwvMetricsService/AwvMetricsService.apk=com.amazon.webview.metrics.service
package:/system/priv-app/com.amazon.kindle.devicecontrols/com.amazon.kindle.devicecontrols.apk=com.amazon.kindle.devicecontrols
package:/system/priv-app/com.amazon.alexa.youtube.app/com.amazon.alexa.youtube.app.apk=com.amazon.alexa.youtube.app
package:/data/app/com.google.android.inputmethod.latin-2/base.apk=com.google.android.inputmethod.latin
package:/data/app/com.amazon.kindle-1/base.apk=com.amazon.kindle
package:/system/priv-app/FireApplicationCompatibilityEnforcerSDK/FireApplicationCompatibilityEnforcerSDK.apk=com.amazon.application.compatibility.enforcer.sdk.library
After dumping some apks and trying to start them with stuff like
am start -n com.mediatek.connectivity/com.mediatek.connectivity.CdsInfoActivity
I gave up on this. The Amazon junk on there is probably not worth the time/effort to RE. So I grabbed the Linux version with cat /proc/version
Linux version 3.18.19+ (build@i3-ri-14-use1a-b-7) (gcc version 4.9 20140514 (prerelease) (GCC) ) #1 SMP PREEMPT Fri Aug 10 03:07:50 UTC 2018
Let’s check for some Linux kernel vulnerabilities…
[CHECKING ON https://www.cvedetails.com]
Manually comparing a bunch of the vulnerabilities reported there to the actual source downloaded from https://www.amazon.com/gp/help/customer/display.html?nodeId=200203720 shows me that Amazon has patched pretty much everything up.
This looks interesting: https://www.cvedetails.com/cve/CVE-2016-10229/ and comparing it to the Amazon kernel, it seems they might not have patched it up correctly. Let’s examine what we need. Patch: https://github.com/torvalds/linux/commit/197c949e7798fbf28cfadc69d9ca0c2abbf93191#diff-07a34bde5a1c422186acb5d57d6adc2b
So copied < ulen has to be true OR UDP_SKB_CB(skb)->partial_cov has to be true (not sure what the latter is yet)
If this evaluates to true, then we call udp_lib_checksum_complete and store its return value in checksum_valid. If the checksum is invalid, we abort
This is where Amazon messes up, because right after this we call skb_csum_unnecessary. In the patch, they check again if the checksum is invalid OR skb_csum_unnecessary.
So let’s see. The patch says:
udp: properly support MSG_PEEK with truncated buffers
Backport of this upstream commit into stable kernels : 89c22d8 ("net: Fix skb csum races when peeking") exposed a bug in udp stack vs MSG_PEEK support, when user provides a buffer smaller than skb payload. In this case, skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr), msg->msg_iov); returns -EFAULT. This bug does not happen in upstream kernels since Al Viro did a great job to replace this into : skb_copy_and_csum_datagram_msg(skb, sizeof(struct udphdr), msg); This variant is safe vs short buffers. For the time being, instead reverting Herbert Xu patch and add back skb->ip_summed invalid changes, simply store the result of udp_lib_checksum_complete() so that we avoid computing the checksum a second time, and avoid the problematic skb_copy_and_csum_datagram_iovec() call. This patch can be applied on recent kernels as it avoids a double checksumming, then backported to stable kernels as a bug fix.
So __skb_checksum_complete gets called twice which calculates the checksum twice.
(Side idea: run a static analysis on the FireOS kernel source smackerelofopinion.blogspot.com/2017/09/static-analysis-on-linux-kernel.html)
So is the problem that…
udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic that triggers an unsafe second checksum calculation during execution of a recv system call with the MSG_PEEK flag.
LATEST DEVELOPMENT: Build a local Linux kernel for quick PoC work. If it’s vulnerable it’ll be a lot faster to try out a simple C program, then work out the Android attack vector.
Sources:
https://www.cvedetails.com/cve/CVE-2016-10229/
https://github.com/torvalds/linux/commit/197c949e7798fbf28cfadc69d9ca0c2abbf93191
https://github.com/torvalds/linux/commit/89c22d8c3b278212eef6a8cc66b570bc840a6f5a
https://github.com/mcxiaoke/android-ndk-notes/blob/master/cpp11-support/src/main/jni/native.cpp
Pages: 1 2