yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] minieod:
echoing the issue with new img's on android N's new build - using pixel c.

currently running stock setup. looking forward to an updated twrp in the future, and an updated boot.img to unleash root again

thanks phh!
[Android Software/Hacking General [Developers Only]] ohad129:
Waiting for root +twrp again
[Android Software/Hacking General [Developers Only]] phhusson:
There is a new r203 release to fix N preview 2.

I tested only on ryu, and on it, only "noverity" variant works. But it's likely the behaviour will be different on other devices.
[Android Software/Hacking General [Developers Only]] Lost Dog:
The r203 "eng" and "noverity" both are not working on Shamu. Got a bootloop then it booted in to safe mode.
[Android Software/Hacking General [Developers Only]] Lost Dog:
Well, I'm now stuck in safe mode. I can't get out of it... Even tried reflashing everything but user data. Looks like I may be set for a wipe and re-install :crying:
[Android Software/Hacking General [Developers Only]] adrman:
The new superuser-r197.zip is working perfectly with Franco kernel "fk-r15-anykernel2" on Angler/MHC19Q. It's nice to have color control and high brightness mode back.
[Android Software/Hacking General [Developers Only]] Subhojit:
Flashed 'nocrypt' on NPC91K build for Angler and got into bootloop. Is it working for anyone?
[Android Software/Hacking General [Developers Only]] w1nst0n sm1th:
Hi.

Is it possible to add support for intel tablet teclast x98 ?

There is no custom recovery for it. Is it possible to flash it trough fastboot ?
[Android Software/Hacking General [Developers Only]] wolfballz:
I followed the instructions and in terminal emulator I get an error after running the command that /data/data/hosts is not found. I checked and sure enough there is no hosts in /data/data. I did notice that I have an /etc with a hosts file in it and also /system/etc/ with a hosts file in it. I know both these locations are exactly the same since if I put a file in /etc it also shows up in /system/etc. However, if I just normally install Adaway or Adfree and run them they do install the new hosts file which shows in /system/etc and in /etc and the ad blocking seems to work, however, if I reboot my tablet the hosts file reverts back to a standard hosts file. If I tell Adaway to install the hosts file to /data/data it will stick and not be overwritten but the system isn't looking at /data/data/hosts and seems to only be looking at /system/etc/hosts or /etc/hosts. I know the instructions say not to create a symlink but it almost seems I need to. Not sure what to do other than every time I reboot I have to reapply adaway.
[Android Software/Hacking General [Developers Only]] Schrotty35:
Working with the new LG G5?
[Android Software/Hacking General [Developers Only]] androcraze:
I create the symlink, and it survives a reset.
[Android Software/Hacking General [Developers Only]] wolfballz:
I went ahead and let it create the symlink and it seems to be good for me also now after a reboot.
[Android Software/Hacking General [Developers Only]] Haul:
Your build bot currently stores the original boot image at https://superuser.phh.me/, alongside your modified images. Would it be possible to store the original recovery image there as well? While your superuser never touches the recovery partition, it's [usually] not possible to flash it without modifying the recovery partition. Archiving the original recovery partition could make it easier for those trying to revert to stock (to install OTA updates for example).

Edit: Well, I suppose one can fastboot boot into a custom recovery without ever flashing the recovery partition. So this request is more of a convenience thing.
[Android Software/Hacking General [Developers Only]] cyberbandit1998:
Thanks N kernel working great. Got full root back and system RW.
[Android Software/Hacking General [Developers Only]] cyberbandit1998:
N3 is out can't wait for your kernel.
[Android Software/Hacking General [Developers Only]] teshxx:
Ha...I been waiting patiently as well lol
[Android Software/Hacking General [Developers Only]] superdragonpt:
Hi

This is awesome.

I always like alternatives, open source is even better.

Latest build is working on following MediaTek devices :

- Jiayu S3 ( MT 6752) tested on CM12.1

+edit* working also on cm13 ( MOB30J) need to build and update my local branch's ...

(will give you feebback if its working on latest cm13 MM.rev.)

- Wiko Darkmoon ( MT 6582) Tested on AOSP 5.0.2

Need to try on other SoCs, and on MM builds

Terminal gets su privileges, rw /system as well.

Kernel control apps as well.

:)

Cheers
[Android Software/Hacking General [Developers Only]] Lost Dog:
Just tried flashing the Eng version for npd35k on a Nexus 6. Everything seemed find until I tried granding su to TitaniumBackup. It went in to a instant reboot then in to Safe Mode. I had to re-flash full npd35k to get out of safe (even re-flashing the system, boot, etc didn't help).
[Android Software/Hacking General [Developers Only]] cyberbandit1998:
I just flashed it on Shamu also. I also got the safe mode reboot, I rebooted the phone and phone booted fine no safe mode. I used the noverity . That again N3 running great.
[Android Software/Hacking General [Developers Only]] samuro625:
[MENTION=1915408]phhusson[/MENTION], I have a Lenovo K5 plus (A6020L36 upgraded to A6020A46) with locked bootloader. I'm trying to root this phone using ported recovery (TWRP, CWM, Phil'z), unsuccesfully. Your tool don't work to me because I can't modify the recovery. How I can modify the boot.img like your tool?. I have the file from the upgrade.
[Android Software/Hacking General [Developers Only]] AlxMAX:
[MENTION=1915408]phhusson[/MENTION] I don't know if anyone has warned you, but there seems to be a memory leak in the nested function inside prepare_binds (in daemon.c). Not all of its return paths free the tmpfile char string allocated with asprintf. I've discovered it while attempting to build with CLANG and transforming the nested functions in normal functions.
[Android Software/Hacking General [Developers Only]] potatohead:
Request for Teclast x16 Plus Tablet root support

Hi, I would like to request support for Teclast x16 Plus tablet. It is using Intel Cherry Trail SoC and presently running Android 5.1. I believe its boot image is verified (dm-verity), thus the inability for it to be rooted without patching the boot image. I'd really love to have root on it and would appreciate if you can point me in the correct direction.

I have attached the boot.img file, there is currently no TWRP or 3rd party recovery for it, thus flashing update.zip is out of question.

Thanks much in advance!
[Android Software/Hacking General [Developers Only]] lklun:
I have spent quite some time reading about the security in Marshmallow and also about this project. I really appreciate the work being put into this project!

I have some questions, which I hope someone could answer:

1. Which repo is used for the project? https://github.com/phhusson/Superuser or https://github.com/seSuperuser/Superuser

2. Should the keystore.img (at https://superuser.phh.me/keystore.img) be flashed manually? If so, how?

3. E.g. for the "user" mode, should I both flash the boot.img for user and edit config.txt to user?
[Android Software/Hacking General [Developers Only]] Lrs121:
https://github.com/seSuperuser/Superuser is the official repo.

The keystore is meant for verification. I don't know if it's meant to be flashed.

If you flash a user boot img then you don't need to configure a txt file that's only for flashing the zip
[Android Software/Hacking General [Developers Only]] IndiNix:
Is the build-bot permanently down? Any chance of an update for 30M images?

Also, anyone using the previous build on shamu MOB30M?

;)
[Android Software/Hacking General [Developers Only]] androcraze:
superuser-r170.zip worked like a champ on my Nexus 5. Flash via TWRP. No need to use a prior ROM's boot.img. It converts the boot.img directly to the "eng" version, I believe.
[Android Software/Hacking General [Developers Only]] IndiNix:
Yup yup! Wasn't sure about the different versions, given the MOB30I images were generated using r210, and only r170 and r192 were posted.

r170 (eng verity nocrypt) working on Nexus 5/7

r170 (eng noverity crypt) working on Nexus 6

(Had to change the config to noverity to get adaway working on the n6)

Thanks!
[Android Software/Hacking General [Developers Only]] sonic64:
Strange issue with this.

I attempted to replace supersu on my Asus tf700 running katkiss 5.1.1 with the superuser r197 zip and everything seemed to go perfect. I rebooted and things got weird. All of my installed apps mysteriously disappeared, except for f-droid, and I couldn't install any apps. I'm gapps free, so I use f-droid to install apps and I'll get a message from f-droid saying there was an unknown error during the installation. If I attempt to sideload an APK, it'll say that i'm low on internal storage, even though I have ~30gb free. I then tried to wipe the tablet and install phh superuser right away instead of flashing supersu then rebooting. Still no luck. It does this with all apps until I completely wipe it and install supersu. Even if I install supersu after phh superuser, it'll still fail to install. Stranger yet, my download speed will be cut in half until I get rid of phh superuser. Thank you in advanced.
[Android Software/Hacking General [Developers Only]] danieljenkin:
I tried flashing supersu 2.62 beta plus used sunshine (& $25) to go s-off as it was suggested that would fix my issue, but neither did. Eventually, I found out that the SD format requires dm-verity to encrypt which is changed in the root method I used - but not the one on this thread.
[Android Software/Hacking General [Developers Only]] cloud1250000:
Is it possible to edit the boot.img without having an unlocked bootloader? Can I use this and expect it to patch my boot.img on the fly?
[Android Software/Hacking General [Developers Only]] wirelesskebab:
has anyone got this working with Samsung Galaxy Tab S2 SM-T710 yet? Thanks :eek:
[Android Software/Hacking General [Developers Only]] ddimple4:
Can this method be done as "systemless", where Android Pay would work?
[Android Software/Hacking General [Developers Only]] Lrs121:
This is a systemless root. It only touches the boot image. Android pay may or may not work. I haven't used this method since chainfire released flashfire in beta
[Android Software/Hacking General [Developers Only]] adrman:
As stated it is systemless, but it does not pass the SafetyNet check (su exists in /sbin), so Android Pay does not work.
[Android Software/Hacking General [Developers Only]] phhusson:
It should be really easy to pass Android Pay, but this would be a stupid race between SafetyNet and SU that I don't want to do.

I think this would only require to edit the su.sh script to change the name from "su" to something else.
[Android Software/Hacking General [Developers Only]] androcraze:
How about "shhhhh.sh"?
[Android Software/Hacking General [Developers Only]] JavaTiggy:
Just checking in to see when the build bot will include boot.img's for MOB30O. No rush just curious. Thanks for all your hard work!
[Android Software/Hacking General [Developers Only]] IndiNix:
Buildbot hasn't run since 06/21, so I wouldn't count on pre-made boot.img's anymore.

Just ran superuser-r170 against shamu-mob30o successfully generating the boot.img and everything su working just fine.
[Android Software/Hacking General [Developers Only]] JavaTiggy:
Good to know, would you mind pointing me to a link describing that process?
[Android Software/Hacking General [Developers Only]] IndiNix:
I'm sure somewhere in this thread there is a discussion about this but I can't be bothered to find it - something like this:

Download superuser-r170.zip

Download from https://superuser.phh.me/

unzip and modify config.txt

the options for the type of boot.img you want are set in config.txt

ie: eng verity nocrypt (my nexus 5 config)

eng noverity crypt (my nexus 6 config)

create new zip

Zip up the files (preserve directories!) and rename so you don't confuse the different files.

ie: create superuser-r170-eng-verity-nocrypt.zip

copy to device

mount your device and copy the superuser-r170-whatever.zip to it

reboot to bootloader and flash mob30o parts as per normal

ie: fastboot flash bootloader bootloader-whatever

fastboot reboot-bootloader

fastboot flash radio radio-whatever

fastboot flash system system.img

fastboot flash boot boot.img

fastboot erase cache

fastboot flash cache cache.img

boot from fastboot to recovery and install superuser-r170-something.zip

The install of the zip should have generated a boot.img with the options specified.

Note that you must have a recent version of TWRP installed, not the factory recovery.

reboot and profit?!!?

After rebooting you should be be able to rerun adaway or whatever at this point.
[Android Software/Hacking General [Developers Only]] JavaTiggy:
Awesome thank you!
[Android Software/Hacking General [Developers Only]] spacetaxi:
Will the superuser.zip receive further updates?
[Android Software/Hacking General [Developers Only]] Lrs121:
Possibly, we might see an uptick in development when Android N comes out
[Android Software/Hacking General [Developers Only]] JavaTiggy:
Deleted. I figured it out and just used the default config of the zip file and now I am rooted on the latest build. Thanks again!
[Android Software/Hacking General [Developers Only]] optimumpro:
@ phhusson

There is a problem with Superuser: when it is set to grant root to apps only, you can still get root via adb, which is a security hole. Steps to recreate:

Open Superuser; set root to apps only; enable adb, connect to computer; type adb shell, then su and you will get root to /data/data without any prompt. Granted, it is not root to the whole system partition, but nonetheless it is a security bug.
[Android Software/Hacking General [Developers Only]] phhusson:
Build bot done on latest M releases. N is still NOK.

Yup known bug (I think it should be somewhere in github's bugtracker)

Would this be a useful feature for you, or should I just delete the option from the menu?
[Android Software/Hacking General [Developers Only]] optimumpro:
I think there should always be a prompt when root is requested and root shouldn't be granted when settings say no.
[Android Software/Hacking General [Developers Only]] ]grimm[:
Did you get the recovery.log that I sent? The zip file still doesn't seem to apply properly on the Pixel C. Apologies for bumping this issue again.
[Android Software/Hacking General [Developers Only]] fmc000:
I tried to use https://superuser.phh.me/superuser-r197.zip with the default options with SlimSaber, an Omni-based 6.0.1 ROM, on my encrypted phone but I ended up in a bootloop. The flashing process and the boot image replacement were OK, judging from the messages printed on the screen, but the subsequent boot never even got me to the PIN request.

Any suggestions?
[Android Software/Hacking General [Developers Only]] jcase:
[MENTION=1915408]phhusson[/MENTION]

Looking to use your su in a temproot exploit for a new phone, typcially i gain execution as root in a context that we want, then launch the su daemon.

So assuming I am running as root in kernel||init context, what route would I go to launch your su daemon? drop su into sbin and run su daemon?
[Android Software/Hacking General [Developers Only]] phhusson:
Problem will be SELinux. I guess your exploit doesn't disable SELinux or doens't enable you to change its policy.

Possibly your device can change SELinux policy on the fly (that's disabled on Nexus, but allowed for OEMs). Which device is it? Can you extract that device's sepolicy?

But SELinux aside, putting su in /sbin, running su --daemon, and chmod 0755 /sbin (by default it's 0750) should be ok.
[Android Software/Hacking General [Developers Only]] jcase:
We can and do disable selinux and can run in any context so no issue.

Getting complaint about dup2 duplucate fd
[Android Software/Hacking General [Developers Only]] jcase:
This is the result I get

01-01 15:09:01.746 8539 8539 D su : starting daemon client 2000 0

01-01 15:09:01.758 8541 8541 D su : connecting client 8538

01-01 15:09:01.768 8543 8543 D su : remote pid: 8538

01-01 15:09:01.795 8545 8545 D su : remote pts_slave: /dev/pts/2

01-01 15:09:01.807 8546 8546 D su : remote uid: 2000

01-01 15:09:01.819 8547 8547 D su : remote req pid: 8308

01-01 15:09:01.831 8548 8548 D su : remote args: 1

01-01 15:09:01.841 8550 8550 D su : waiting for child exit

01-01 15:09:01.841 8552 8552 D su : daemon: stdin using PTY

01-01 15:09:01.853 8553 8553 D su : daemon: stdout using PTY

01-01 15:09:01.862 8554 8554 D su : daemon: stderr using PTY

01-01 15:09:01.875 8555 8555 E su : dup2 child infd failed with 22: Invalid argument

01-01 15:09:01.885 8556 8556 D su : sending code

01-01 15:09:01.899 8558 8558 D su : client exited 255

01-01 15:09:01.899 8557 8557 D su : child exited
[Android Software/Hacking General [Developers Only]] barturblits:
Same here, using Nexus 6P with omnirom 6.0.1 with encryption, selinux enforcing.

Precompiled patched stock angler 'noverity' img works for me ('user' and 'eng' do not work).

When using superuser-r197.zip to patch the omnirom image I also get a bootloop (changed options in superuser.zip to 'eng noverity crypt'). Have not tried 'eng noverity' but that I guess that should be the same.

Also tried the to patch the omnirom img with super-bootimg on my debian desktop but also no luck.

For the rest, superuser works perfectly. Good job!

Edit:

Any insight how to debug this?

Zip gives no significant feedback and super-bootimg is pretty verbose but no errors.

Should debug it on the phone but I never reach the decrypting stage so not possible to save log files. Any ideas how to log this error?
[Android Software/Hacking General [Developers Only]] moriel5:
Can you please add support for the Doogee X5 Pro on SnowCat4PDA's AOSP 6.0 rom?

If you need me to send anything, then I'm here.
[Android Software/Hacking General [Developers Only]] harpin14789:
Hi, I just stumbled upon this thread after looking through systemless Xposed thread. I have a nexus 6 running Resurrection Remix 5.7.2 rooted with SuperSU 2.76. I am confused as to how to flash this. Is there a zip like on SuperSU to get root or do I have to do fastboot flash boot boot.img each time after rom update. Also won't the boot.img overwrite my custom kernel? My rom build number is MOB30R 6.0.1-r52. I look in the shamu folder but I don't see MOB30R there.

Please help, I am noob on this thread. :confused:
[Android Software/Hacking General [Developers Only]] barturblits:
Superuser-r197.zip with noverity does work on franco kernel and elementalx, just not on omnirom kernel (nexus6p).
[Android Software/Hacking General [Developers Only]] wvcadle:
I've got Magisk, phh.SuperUser, and systemless Xposed (linked from the Magisk thread) installed, but cannot get AdAway to show as enabled on my 6P.

I've followed the instructions exactly as laid out. However, when I ran the command in a terminal emulator, I got the following message:

"BIND: Distant file NOT unique. I refuse. I then booted to TWRP and ran the command and it said SU not found.

I would assume this means it cannot verify that I'm rooted. But my root apps work, and root checker verifies I'm rooted.

Any ideas?
[Android Software/Hacking General [Developers Only]] adrman:
I didn't use TE. I used adb from my PC. It's been awhile since I've done that, but if I remember correctly, initially I used terminal emulator and was unsuccessful as well.
[Android Software/Hacking General [Developers Only]] barturblits:
Had something similar with the 'eng' kernel and also 'user'. With 'noverity' everything works correct. Probably selinux issue.
[Android Software/Hacking General [Developers Only]] wvcadle:
Okay, I ran the command in adb shell, and also got the same message:

"BIND: Distant file NOT unique. I refuse.

Any help is appreciated.
[Android Software/Hacking General [Developers Only]] adrman:
Just a shot in the dark here, but try running "su --bind --ls" and see if it turns up any existing bind mounts. Other than that, perhaps someone more knowledgeable than me will jump in.
[Android Software/Hacking General [Developers Only]] Fentadroid:
I cannot do it...

su --bind /data/data/hosts:/system/etc/hosts
BIND: Distant file NOT unique. I refuse.

Can someone help me? tried everything.....

I have a rooted oneplus 3 with stock ROM

Thanks :)

EDIT: ahahah ok, i see i'm not the only one here....

If i try to

su --bind --ls
10223 /data/data/hosts => /system/etc/hosts

But when i change the target hosts file in AdAway i got the "Symlink missing". If i press "NO" even if i reboot the phone, i always get the same message and adaway doesn't update hosts file....
[Android Software/Hacking General [Developers Only]] androcraze:
Did you try clicking "Yes"?
[Android Software/Hacking General [Developers Only]] Fentadroid:
No.

http://xdaforums.com/showpost.php?p=65189125&postcount=259

Should I?
[Android Software/Hacking General [Developers Only]] androcraze:
When I click "Yes", it actually works. I've never investigated where it writes the symlink to, but I don't care, as I'm not really using any "systemless" feature (Android Pay, OTA, etc.)

Clicking "Yes" fixes the AdAway issue for me.
[Android Software/Hacking General [Developers Only]] barturblits:
Same here, adaway works out of the box with superuser.
[Android Software/Hacking General [Developers Only]] phhusson:
This seem to be the issue, but it's weird, this shouldn't happen.

Can you provide the result of the following command (preferably run as root if you have root adb)

ps -Z

ls -lZ /dev

ls -lZ /dev/su
[Android Software/Hacking General [Developers Only]] sorewinner:
[MENTION=1915408]phhusson[/MENTION] : Requested commands are found @ http://pastebin.com/citnPBPJ

Device in question is an HTC One S S4, system & data-formatted EXT4, running unofficial 20160808 CM13.0, OpenGapps 6.0 Micro, Magisk V3, [MENTION=4470081]topjohnwu[/MENTION]'s v2 of your root, [MENTION=4470081]topjohnwu[/MENTION]'s Magisk-compatible systemless Xposed, Busybox 1.25 YDS, & systemless AdAway, flashed via TWRP 3.0M4.
[Android Software/Hacking General [Developers Only]] wirelesskebab:
I'm having some difficulties with an application I mistakenly denied root to with the phh app... it isn't giving me an option to change it or re-prompt. I tried searching this thread but it seems it was too complex for search. :confused:

Sorry if this has been asked but I haven't had my coffee yet, thanks. :silly::eek::fingers-crossed::good:
[Android Software/Hacking General [Developers Only]] stickt73:
If you go into the superuser app, select the app in question. In the top right corner will be a trashcan symbol, tap it. Then launch that app and grant superuser privileges.
[Android Software/Hacking General [Developers Only]] phhusson:
Could you link me to matching boot.img?

Could you also test on a stock rom?
[Android Software/Hacking General [Developers Only]] sorewinner:
I've attached the "stock" boot.img from CYM13.0 08082016, and the boot.img as it is on the device (i.e. after patching and writing by Magisk, your modified SU, etc...).. As to your second request, a stock ROM would be Kit Kat, which I REALLY don't want to have to go back down to... :p Plus, I'm pretty sure that there would be no issue if the device was completely stock.
[Android Software/Hacking General [Developers Only]] LazyT:
Tried on Samsung Tab S 10.5 (T800, chagallwifi) with AOSP MM without success: doesn't boot anymore. :crying:

SuperSU runs fine.

I see no errors in recovery.log, any ideas?

Thanks...
[Android Software/Hacking General [Developers Only]] phhusson:
Just a quick message to say that I tested the root on N release on Pixel C, and everything seem to work properly, including with FBE. I'm currently generating matching boot.imgs
[Android Software/Hacking General [Developers Only]] barturblits:
Nice!

Any progress on debugging the omnirom kernel (angler) or some advice how to get logs for debugging? Omnirom devs are also looking into it.