[Android Q&A, Help & Troubleshooting] jacksmack:
At yout own risk

Before you do anything, you might want to PM this guy: celoxocis (search this thread, his avatar is black with red and white facial details). He seems to know his stuff and might be able to let you know if trying this on your device is insane or plausibly reasonable. What worries me about you doing it on your device is that it seems like a sector of the phone is actually being patched, see 2.替换applypatch和app_process64, and I don't know if the patching is temporary or if it's permanent and if your phone's values don't line up with those from our phone, then you might be screwed.

That being said, I went through Wu Lin's tutorial like 10 times before it worked for me. I think there was an issue with the ROM version I was using.

Eventually, on ROM R9s_11_OTA_005_all_201611050005_local.ozip, I finally got the correct results after running adb logcat -s recowvery, "beginning of system, beginning of crash, beginning of main". Up until that point I was getting: "beginning of main, beginning of crash", and other combos that weren't "beginning of system, beginning of crash, beginning of main". It was frustrating but it didn't brick my phone. Stock recovery and everything else still worked just fine. I tried 3 or 4 different stock roms with different settings before it finally worked with the aforementioned rom and USB DEBUGGING enabled.

So Lum_UK might be right, it might work all the way up the installation of TWRP and then you could probably install King Root or SuperSU once the phone reboots into the permissive state but I don't know that the permissive SELINUX status will stick after the second reboot.

After getting the DirtyCow exploit from here: https://mega.nz/#!oY4kzIzK!JQmwNj_tve9sayFRydEBtww77EB8uk5dU2gYNnJYS8k , you could try and run these commands, but again, I have no idea if this will work on your variant, so you're taking a risk (insert normal XDA disclaimer stuff here):

adb push dirtycow /data/local/tmp

adb push recowvery-applypatch /data/local/tmp

adb push recowvery-app_process64 /data/local/tmp

adb push recowvery-run-as /data/local/tmp

adb shell

cd /data/local/tmp

chmod 0777 *

./dirtycow /system/bin/applypatch recowvery-applypatch

./dirtycow /system/bin/app_process64 recowvery-app_process64

exit

adb logcat -s recowvery #if it worked, you should see what's visible in the attachment 3.如果不自动重启可以看到这个log

#physically hit "[CTRL+C]" like you would when copying something

adb shell reboot recovery

adb shell

getenforce #verify that you have a permissive setting

cd /data/local/tmp

./dirtycow /system/bin/run-as recowvery-run-as

run-as su

At this point, if your phone is still kickin', you should have root access and you could try to install SuperSU or KingRoot and see if SU sticks after the next reboot. Again, please be aware that this may or may not work and may inadvertently brick your device (I've lost a couple devices following guides that weren't explicitly for my variant of a given model).

Please refer to my mini "what I did" in this thread for additional links, etc.

If you're uncomfortable doing the above, you could always google "r9s plus root" and then go past the first couple of pages until everything is Chinese and Russian and click on anything that looks promising. ;) It probably sounds crazy but that's how I found Wu Lin's stuff for the r9s. KingRoot may also get around to providing an exploit soon. Before finding Wu Lin's stuff the one-click app said 80 more people had to request root access for the r9s before they looked in to it.

---------- Post added at 11:25 PM ---------- Previous post was at 11:22 PM ----------

Agh, I hadn't as yet tried speaker phone, thanks for the heads up, for your script and for the link to the GreaseMonkey script. Good stuff.