yashsingh1/xdaforums huggingface dataset:
[SuperSU] jwds1978:
The Class D (multicast) range is from 224.x.x.x to 239.x.x.x, and it's used for a very specific form of IP traffic. This entire class is not a public range and won't route on the Internet. In the AV world, this is the address space used for multicast streaming of video, audio, or both.

With that said, I've set it to deny and not prompt again for the time being. I'm not sure, at the moment, what's triggering it without further investigation.
[SuperSU] srt10coupe:
any other suggestions ;)

HTC One X
[SuperSU] Chainfire:
As stated in the changelog, apps running as system (1000) or shell (2000) no longer get root access without asking. You don't get system (user 1000, your mksh) without having prior root access though (unless exploits) or being a true system app - and true system apps don't call su and thus wouldn't generate the popup.

As such, it's quite likely a 3rd-party root app (it certainly isn't SuperSU). That you haven't seen this specific popup before means... absolutely nothing. The app causing this could've been doing this ever since it was installed.
[SuperSU] siseam:
Prior to v0.87 the prompt option was saved for each app but after that version even if you set the per-app access option to "prompt" you still have to mark "Ask me again next time" each time otherwise access will be set to "deny" or "grant".

This the only but still pretty important that the original Superuser app has SuperSu doesn't support. The older Superuser app saves whether you marked "Remember" at the last prompt so one can use this feature to get prompted for every access attempt. However, this way you could grant or deny access with a wrongly selected "Remember" option.

So it would be best if there were an global preference whether "Ask me again next time" should be marked by default or not.
[SuperSU] jwds1978:
I wasn't implying that you're doing something illicit. I was only explaining that I've not seen the prompt before the recent update. As such, I'm not certain at the moment what's specifically generating it. In my case, I did state that my first thought would be Samba and the Multicast Lock of it. However, I won't know that until doing some testing. As for other users, I couldn't begin to say for them.
[SuperSU] Chainfire:
Well, if you're really fast and can make the popup come at will, let the timeout expire and in the meantime follow the pid / parentpid combination up the process tree by calling "adb shell ps".

If you can paste the output of the entire thing during the popup, I can do it for you, if you don't know how.
[SuperSU] Chainfire:
I put this on my to-do list.
[SuperSU] KevinAlbrecht:
Any chance of getting this integrated(Per app hide of SU)? I see the option to grant/deny/prompt, but I would like to hide. I have an email application for work that forbids root.

Otherwise, can this applicaiton be called with opening arguments? That way I could script a tasker step.
[SuperSU] ScottHW:
I also got the same prompt today. I have never seen it before.

In fact, I didn't even look and clicked Grant immediately. I know, I know, that is bad security practice on my part. Hopefully this isn't too malicious, and I will have learned my lesson about granting root access through Superuser so fast.

So, does anybody know what this route request was from?
[SuperSU] SecUpwN:
Given the worse quality of your screenshot, no. But why not open SuperSU itself and have a look which apps got granted root permission?
[SuperSU] maniakx:
Here I was getting the same message so I tried to capture the processes for you. It's when you turn WiFi on. I don't know if this helps answer the question. This is between the two requests for root letting the first timeout. I'm personally not to worried about it since you said the user shell was approved by default before.
[SuperSU] Chainfire:
Yeah that doesn't really help, as it only shows the end of the "ps" command, I need the entire thing :)
[SuperSU] Ray!:
su binary update installation failed problem

what to do?

where can i update binary ?
[SuperSU] Pons:
Flash the zip from the OP.
[SuperSU] srt10coupe:
Superuser.apk don't ask for this process!!!
[SuperSU] zooster:
Me too
[SuperSU] Chainfire:
Which means it's probably auto-granting it :)
[SuperSU] rul3z:
I'll send you a pm with the ps output while waiting popup to timeout right now, its only happening when turning on the WiFi, i haven't granted access yet, because it seemed suspicious
[SuperSU] Chainfire:
Unfortunately, that told me the command originates from system_server, which tells us absolutely nothing, unfortunately. The command itself doesn't really seem to be anything malicious, though.
[SuperSU] rul3z:
So what else can we do to pinpoint the 'culprit', malicious or not?
[SuperSU] ArmedandDangerous:
Not sure if it's relevant, but could this be related to roms that modify WiFi settings so it never goes to sleep, for example HTC's SmartSynv feature or similar? It only pops when you turn WiFi on :)

Sent from the pits with ViperX 1.0.1
[SuperSU] Ready2Mosh:
I have an Asus transformer infinity and it doesn't have this request where as my HTC One S does, the one s is rooted and unlocked but running stock 4.04, the Infinity is just rooted running Jellybean 4.1. One the One S for me it gets triggered when I turn on wifi, I tried this on the infinity and it doesn't make the request, granted both devices don't have the same apps.

My question is this only happening with HTC devices?
[SuperSU] Chainfire:
I think everybody who has reported this has indeed been running HTC.

Still no idea what's causing this (I don't have HTC devices anymore, so this doesn't happen for me). It is still likely to be an installed app or script by the user causing this somehow. It's not technically impossible that HTC would include this command in their code, but it would make absolutely zero sense, as it wouldn't run on non-rooted devices.

One thing you could do is pull all files from the device (both /system and /data) and do a full binary search on all files to see which ones contain "ip route add" :)
[SuperSU] Skyrocket2:
How do I update to this new version from v0.96?

Thanks for new updated version!
[SuperSU] Pons:
Like most other apps, via the Play Store. If you can't for some reason, then flash the zip in the OP.
[SuperSU] srt10coupe:
Never ;)

So you mean to your 0.97 update, suddenly came a mksh root request. Where should this request come at once? Super User accepts the request automatically? That sounds both very funny.

HTC One X
[SuperSU] osm0sis:
Fantastic! There are definitely some apps like BootUnlocker that I'd like to get prompted every time, so this is an awesome addition. :)
[SuperSU] chrisch1974:
It comes from libChange.so (checked on a HTC Sense 4.1 rom)

su -c ip route add 224.0.0.0/4 dev %s
[SuperSU] srt10coupe:
and why it asks only for the Supersu.app? Not when Superuser.app, any idea?

So it's a system query?

HTC One X
[SuperSU] TheAquanox:
I'm getting the same message when I turn Wifi On.

No new apps installed for a while. I don't know what could be causing this. The only relevant thing going on these days is the JellyBean update, though I haven't received it yet.

HTC one X.
[SuperSU] Ethere:
Definitely the same here. Running an AT&T HTC One X with Cleanrom 5. As others have stated, it only happens when wifi is turned on.
[SuperSU] rchtk:
sys cpufreq and supersu

Hi

I'm getting something weird.

If booting with supersu enabled, I get a permission denied on /sys/devices/system/cpu/cpu0/cpufreq/stats:

Disabling it (from the superuser menu) and rebooting fixes the problem.

:confused:

I'm on stock JB on a Galaxy S3.
[SuperSU] osm0sis:
You needed to type su
[SuperSU] rchtk:
No:

I am thinking of a kind of lock as I have andromizer pro that might be monitoring the same directory.

Removing all perms for all apps also fixes the problem.

I will not use andromizer pro until I understand what's going on.
[SuperSU] skodazek:
Superuser is likely installed as a system app. To remove it download Link2SD from Google Play.

Use Google play to uninstall superuser. Optionally you can then use Link2SD to make SuperSU a system app.
[SuperSU] DroidManIc:
I searched for MKSH because Im also getting the i.p permission requestrequest and it seems to be MirOS korn shell (i assume). I'm not very advanced in this subject. Can some1 elaborate? I have an Evo 3d. http://en.m.wikipedia.org/wiki/MirOS_BSD
[SuperSU] CheriePie:
nevermind, posted in wrong place.
[SuperSU] chrone:
i thought there's something wrong when adbing from windows 8, but i was wrong for not noticing the "Added "ADB shell" display" changelog. grant root access to the adb shell from supersu popup notification and voila, work like a charm! :D

thanks for the update dude!
[SuperSU] adell_:
I'm using HD2 and haven't seen that popup yet when turning on WiFi.
[SuperSU] vlt96:
Because you are on CM10;)

Sent from my LG-P500
[SuperSU] shaggyskunk:
SuperSU is working fine for me - Only thing that I do see - Is even after flashing the .97 zip, the play store tells me that I have an update for superSU?

Not sure why?

R4INS for AOKP
[SuperSU] Pons:
Just to double check, when you go into SuperSU, go to settings, and does it say v0.97 in the top?
[SuperSU] shaggyskunk:
I'll be darned - No it's the .96 version - I'll flash it again and report back - Curious.

The only thing that I ever had to do after flashing a new rom, was just get the pro version from the store - but the base zip always replaced chainsdd's superuser?

R4INS for AOKP
[SuperSU] Pons:
Judging by your signature, I'm assuming you're running AOKP. That being the case, AOKP uses a precompiled version of SuperSU in their ROM. So if you've flashed AOKP after you've done the zip in the OP, AOKP will replace SuperSU with theirs. A quick look at their github (https://github.com/AOKP/vendor_aokp/tree/jb/prebuilt/common/app) and it says "Update SuperSU to v0.96"

This is all assuming you're running AOKP JB.
[SuperSU] shaggyskunk:
Thanks - But I always flash Rom, Gapps & SuperSU in that order.

Just flashed the SuperSU zip again (twice) and after reboot, it's the .96 version still? :confused:

And, you are correct, I'm currently running R4INS AOKP JB :)

R4INS for AOKP
[SuperSU] TheByteSmasher:
As a SuperSu pro user I'd like to say that I love the app. I was wondering though if it's possible to use a widget to either temp unroot or hide root from certain apps like Google wallet which doesn't work using nfc payments if the device is rooted. Thanks
[SuperSU] Pons:
Without trying myself, not sure. Could be because you already have SuperSU.apk as a system app, and now you're flashing SuperSU (but named as Superuser.apk) onto your ROM. In the app drawer, SuperSU is mapped to SuperSU and not Superuser (what .97 is named in the flashable zip), so when you open up SuperSU, it opens the wrong one. Or maybe Chainfire didn't update his zip correctly? Doubtful, but mistakes occasionally do happen. This is all just speculation. You could try manually place Superuser.apk and su from the OP's zip to where it goes on /system. Also, any particular reason why you don't just update from the Play Store?

@Chainfire, if this is the problem, how about add rm /system/app/SuperSU.apk to your updater-zip?
[SuperSU] shaggyskunk:
Thanks ;)

No, there's no particular reason that I don't update from the store - it's just that the anomaly peaked my curiosity - And since my habit of always flashing Chainfire's zip after flashing a new rom, had always been effective.....

Since I'm still relatively new & inexperienced - I'm like the annoying kid that always asks "why" lol

But, Thank you for your help!!

:thumbup:

R4INS for AOKP
[SuperSU] Chainfire:
I'm not really sure what's up... the ZIP seems to flash fine for me... ?

If you figure out what the problem is, do let us know! :)
[SuperSU] shaggyskunk:
I just flashed it again - wiped cache & dalvick twrp reported that it flashed successfully... (but I'd already updated it in the store - this time) so, I'll wait for the next new rom - or if I have a chance, I'll just reflash the rom I'm on from scratch..

Yeah, me either - Never had this happen before with the .96 zip - running AOKP, CM10 or AOKP & I've been using TWRP recovery all along.... IDK? I guess that I'll wait & see if it still happens with the next SuperSU version?

I'm very happy with SuperSU - never had any funky messages or errors

R4INS for AOKP
[SuperSU] OldDogEyes:
Noob question

I have a Google/Asus Nexus 7.

I unlocked the bootloader when I got it.

But when I run a 'Root Checker' it says that I am not properly rooted.

And I never get any prompt from SuperSU to grant an app root access... For example, shouldn't the Root Checker app have caused a prompt?

Here is the root checker that I am using:

https://play.google.com/store/apps/details?id=com.joeykrim.rootcheck&feature=order_history

NOTE: I know that not all apps require or request root access...

Stickmount is one that I know does and it's not prompting me for root access on that one either.

Help!

Thanks...
[SuperSU] osm0sis:
Hi! Unlocking the bootloader is not the same as rooting your device. Since it sounds like you're pretty new to Android (and that's okay), I'm going to direct you to efrant's signature, it's for the GN but is a great introduction to Android and rooting, etc. as a lot of the same applies, especially with Nexus devices. Especially check out number 1,2 and 5. :)
[SuperSU] OldDogEyes:
Thanks... I'm actually not that new, but obviously still learning. My root experience on Nook Color was less than ideal... the darn thing kept resetting it self and going factory stock for unknown reasons. My root experience on my daily driver phone, HTC Evo 4G has been awesome... running MikG and loving it. But I wanted to keep the Nexus 7 stock for now with the option to customize later.

Will take a look at your link.
[SuperSU] adell_:
Thanks. So CM10 doesn't have this process?
[SuperSU] vlt96:
I think so, CM is based on AOSP, which doesn't have any sense stuff in it, and I am guessing sense is the reason only HTC users reported
[SuperSU] Hammerfest:
Ya know, im speaking totally off-tilt about this, but that would be a great (and yet devious) way for a OEM MFG's to mark/track devices that have been rooted/unlocked...

Put # requiring command in driver, if # not granted, all is well, continue as normal, if # granted, call home, change DNS or something of that nature that in some way lets HTC (the OEM MFG in this case) get the basic info associated with your device....

Again, I speak with 0% knowledge on the issue at hand with HTC devices and the # issue, Im just thinking out loud about an interesting thing to look out for in the future....

OT however: 0.97 working great, no issues on any of my devices (at least the ones I use daily however), loving it still
[SuperSU] shaggyskunk:
Well, I don't know if this confirms Pons's theory - but I just flashed cm10 10/31 - Gapps - SuperSU .97 in that order & the SU zip stuck on .97 version.

The curious thing is, on previous builds of AOKP, I don't recall having to update SU in the store? But for me anyways, with AOKP now, I have to update with the store.

Hope this helps?

R4INS for AOKP
[SuperSU] Pons:
Again, pretty sure this is because AOKP installs SuperSU with their ROM. They currently have 0.96. Check in your ROM, after you do that whole flashing thing, see if you have both Superuser and SuperSU in /system/app.
[SuperSU] leftspoke:
+1...Started getting this yesterday when I turn on wifi and connect
[SuperSU] osm0sis:
HTC issue that was mentioned a page or so back, Chainfire knows and is looking into it.
[SuperSU] Chainfire:
mksh: ip route add 224.0.0.0/4 dev wlan0

As lots of people seem to be around looking for the answer, the current situation on the mksh "ip route add" is as follows:

- mksh is just the name of the default command shell on Android devices, nothing special there

- the "ip route add" command comes from libChange.so in HTC Sense ROMs (thanks to chrisch1974 for finding it), which itself is already running as a system component

- the command itself is not malicious, but there's no clear reason why HTC Sense should run this command. Sense does not need to call "su" to perform this command. Suggestions have been some form of tracking done by HTC (knowing HTC, this would not surprise me at all), or maybe something that has simply been left over during development really does nothing. At this time, nobody but HTC knows for sure. I do not personally currently own any recent affected HTC devices, as such it is not something I will further deeply investigate

- the reason it shows up in SuperSU v0.97 and does not show up in older versions is because v0.97 no longer automatically grants root to the shell and system processes. This command is run as system. Normally, only code provided by the OEM, or from an app that has already previously been granted root access can run as system. However, I have been informed of exploits that can allow a malicious program to gain system (not root) user access, and as such the system user is no longer safe, and must be specifically granted permission

- my advise would be to set it to deny (without asking again next time) until we know more
[SuperSU] M3PH:
I have noticed, on my One X, that the route add command doesn't show when i'm running ARHD 12 (Jelly bean base rom from htc) but it did on the ICS based ARHD 9.X series rom I was using. Does anyone think this issue is present in just ICS based Sense roms?
[SuperSU] DevilMind007:
CWM-SuperSU-v0.97.zip file gets Error when flashing

i downloaded 7 times & tried to install many times on my cm7 & Stock Rom as well...Not working
[SuperSU] jwds1978:
That's what I've already done and haven't experienced any noticeable negative effects with anything.
[SuperSU] blaz1nr:
unzip the zip file place the su apk and binary on sd. remove and replace both the old su apk and binary reboot. Bam profit!

((((((Also on the ip route toast. i believe whats going on is something is causing the Ip tunnel to act as a gateway. It would be to change/correct the source Ip.Hopefully that will help someone out in stopping it or whatever)))))) edit......please refer to post below.......

(IP Toast) This should help in fixing it....... http://code.google.com/p/android-openvpn-settings/issues/detail?id=35
[SuperSU] :
I'm having some problems.. I click Allow but toast message appears "has been denied superuser permissions".? How can I fix?
[SuperSU] JoshuaFCB:
I thought this mksh was malicious app trying to gain access to personal I information. So I uninstalled my sense ROM and went to cyanogenmod. Know its gone.
[SuperSU] blaz1nr:
the IP toast notification is only on sense roms, running virus check on zips and phone shows nothing. this is actually not a new problem. Im pretty sure it has something to do with what i posted above.

mksh is a command interpreter intended for both interactive and shell script use. Its command language is a superset of the sh(C) shell language and largely compatible to the original Korn shell.

heres more info on mksh apperantly its an at&t thing..... mksh is the MirBSD Korn Shell, largely similar to the original AT&T ksh, pdksh’s actively developed successor, portable. It includes bug fixes and improvements in order to produce a modern, robust shell good for interactive and especially script use. It has UTF-8 support and extended compatibility to other modern shells.

OK i think i got it fully figured if you feel like getting the info i dug up----------> http://xdaforums.com/showthread.php?p=33561583#post33561583
[SuperSU] samarain:
I have this "mksh: ip route add 224.0.0.0/4 dev wlan0" after last SU update, but since this in File Expert i cant access my dropbox, if i turn off wifi and turn on again and popup again this permission the dropbox in File Expert work again in any of my choice. i have this in my One V with SU but in my One X i don't use SU (use the Personalized Super user from Viper Rom) and nothing of this happens...all fine there. weird..
[SuperSU] phealy:
224.0.0.0/4 is the standard IP multicast range (http://en.wikipedia.org/wiki/Multicast_address) - this command just forces multicasting out the wifi interface (since AFAIK cell carriers don't allow multicasting on their data connections). This prevents multicast traffic from attempting to use the mobile network connection and failing.
[SuperSU] Wacco001:
Maybe it was related to FE itself. Afterall update 5.0.3 of FE shows login bug fix for Dropbox ...
[SuperSU] DevilMind007:
plz someone fix this CWM-SuperSU-v0.97.zip file, i think chainfire did not made CWM zip correctly

it gives error when flash via cwm recovery during installation
[SuperSU] samarain:
weird because i have 2 phones with same version and 1 without SU works like a charm and another with Su not..:confused:
[SuperSU] Mashkawizii:
It's not tracking people, its just multicasting, some people can sound so paranoid at times..

XMBell
[SuperSU] zooster:
Ok but, malicious or not, still the question is: why this su request came out only with last Su 0.97 update??
[SuperSU] adell_:
Read the changelog.
[SuperSU] The-Last-Hylian:
I just had this pop up on my phone, I can just Deny it now I guess.

To get it to not ask me again would that be 'Disabled' in Notifications?
[SuperSU] bkraptor:
Chainfire: is there any way to hide the su binary and SuperSU app from peeking apps like DME that refuse to launch if the phone is rooted?

<edit>

Actually, unchecking "Enable Superuser" from the settings does exactly that. Unfortunately, the app also checks for the existence of /system/app/Superuser.apk, which will exist if you use auto-rooting kernels or use CWM to root and install SuperSU. Having the su binary hidden via unchecking "Enable Superuser" and having SuperSU installed from the market in /data/app works with this particular app.
[SuperSU] kAcA.:
Very good app, using it since 3 months now. Liked the previous icon better though... Keep up the good work! Thanks
[SuperSU] snipervn:
As I guest:

HTC is going to launch JB for some devices and some other upgrade for other HTC devices and if you turn on wifi in conditions that your setting is "update by wifi only", the mksh appeared and it may be a script to do something to prepare for loading update. Hope so.
[SuperSU] king_lud:
I've just flashed CM10 and went and installed Supersu but the update binary failed :( Shame because I really like both CM10 and Supersu...
[SuperSU] CiscoX:
Hi.

Try to install superuser from Google Play (Market) first and update it and then install SuperSU
[SuperSU] king_lud:
I already have superuser installed - it came with the ROM and it is up to date, so I can't' do that.
[SuperSU] GlassEyedPete:
I currently use SuperSU, and I have paid for superuser elite in the past. One of the features of Superuser Elite is the ability to backup/restore which apps are allowed to have root. The reason I have not yet purchased SuperSU Pro is the lack of this feature. Any plans to include something like that in the future?
[SuperSU] Chainfire:
It's on my to-do list. No ETA. Never an ETA. :)
[SuperSU] bbrad:
Love supersu bought the full version. Just too support chainfire :)
[SuperSU] alexskin:
mate, could you fix the bug with htc devices, please i've been using the pro version on the 2 superuser apk. and i love them, but the latest version is messing my wifi conection
[SuperSU] Kekoh:
Chainfire,

The mksh notification was appeared after v0.97. The mksh request was annoying me so I installed SuperSU 0.96, and I still got the mksh request. After that, I uninstalled updates and rebooted so now I am running SuperSU v0.93, but I am still getting mksh requests. Is there anything I can do to just run the older SuperSU to avoid this?

Thanks
[SuperSU] jethro650:
Installed without problem on Desire Z running latest ILWT CM7, all root requiring apps working properly including root explorer, 4EXT recovery control and terminal emulator. Installed via .zip in op through 4EXT touch recovery.
[SuperSU] jskolm:
Anyone having problems with an App not prompting for SU access and just closing it, set the default action in SuperSU to Grant and this will allow them to work. Root Explorer works this way for me.