yashsingh1/xdaforums huggingface dataset:
[Android General] billa:
Different versions/payloads??

After a bit of digging through the same versions released, one on their website (https://kingroot.net/), and the other here on xda (https://xdaforums.com/devdb/project/?id=9793#downloads), it appears that the payloads have been customized through some variances contained in the following files:

channel.ini, config.properties, KINGROOT.RSA, MANIFEST.MF, KINGROOT.SF, km, classes.dex

Specifically in the release channel# (channel.ini), the encrypted properties file (propertiesconfig.properties), and the (km) file.

So it's possible to have slightly different version of the payloads depending on where you've downloaded it from.

Any constructive input is welcome.
[Android General] gatesjunior:
Interesting.. I wonder even though the release is the same, is the build a different number ?
[Android General] liksalot35:
Do you think it might have to do with trying different methods to root the device?
[Android General] liksalot35:
It is a different build number bro.if u look at the build number compared to first realease of 5.05 compared to latest release 5.05 theres a few extra numbers and/or letters in the new 5.05. But like one of the xda devs said if it's to the only way to get root do it because u can uninstall purify and replace kinguser with supersu
[Android General] aikhhk8:
Using SuperSU is best.
[Android General] JIJOK:
noob question here, flashing a ROM will remove whole kingroot stuff ? or there is some deep thing that can't be removed ?
[Android General] yossijoe:
yes it will
[Android General] insomniacno1:
Noob question, is there any bloatware remover, to remove kingroot leftovers - that doesn't involve connecting to PC or work with Linux?
[Android General] ytg1123:
do you know PRCCreater?

you can make pre-rooted firmware,because.

temporarily do execute kingroot,and And immediately install the " TWRP or CWM".

then reboot the " TWRP or CWM",and install prerooted firmware.

this method execute your device's Flash partition reformat system and kernel and boot partition. kingrootgoes out!.

your device no more kingroot
[Android General] ne0tekk1:
Pretty sure kingroot gained traction when it started getting more tedious to root devices and the chances of bricking them with traditional ADB pushes. Personally, I bricked my LG G2 by pushing superSU via ADB and it took a long time to fix my mistake. Usually the stock LG software can repair these errors with their recovery but it failed. I had to keep trying to get into the stock recovery to reset the device and again, it failed. I eventually found the flash method in a xda thread that didn't have outdated links and was able to flash the device.

My story is probably one of many and it took me a full day just to figure out how to unbrick my phone cause all the tutorials on xda have broken links after 2 years. So being able to avoid bricking the device by downloading an app is REALLY convenient.

I actually ended up rooting my phone with kingoroot (not to be confused with kingroot). It's a Chinese app and they do install tencent, textnow, and a couple other folders into your phone. It also comes with their own version of superSU. I ended up getting another app that can delete and permanently suspend these processes and went as far as suspending the main app as well as parts of their supersu. Haven't had any more phishy activity since but I guess it's still possible that they could've installed something into my system apps that I haven't caught yet.

All in all, it took literally 2 minutes for the app to root my phone and a few more minutes for me to get the right software to start suspending it. Mind you, the kingOroot app, again not to be confused with kingroot, is actually much smaller in file size than kingroot and from my experience, took a lot less time to install.
[Android General] KatayHan:
THIS! This was the thing I was looking for.

I mean, it's obvious that their app is completely filled with adware/bloatware. Even before installation. When you look at how they adversite it, how they provide it, how they "serve" root to users, even at the main menu(I'm not even talking about that irrelevant permission request list).

To beat my curiosity I used it on another device. Result? I saw that there are more risks than I thought...

Xda shouldn't host them. It's a shame, in my opinion.

Do you really want to get rooted easily with one click?

Does it worth it?
[Android General] PalmCentro:
Just saying there's so many devices that where bricked via kingroot. Rooting in general is dangerous and not meant for everyone.
[Android General] gatesjunior:
Geez I'm glad i read this ! I was stoked about rooting my phone & wondered on the drawbacks of it. I'm a noob but not moronic though my thirst for knowledge plus the itch to modify All things Usually or Always have hooks. I'll still attempt to expand my phones​ capabilities but seek info like your post So chaching into Your karma bank bro.[/QUOTE]

No problem, more people need to be educated.
[Android General] heineken78:
King root

New "unbranded" china smartphones mostly dont have any root methode. Only KingRoot makes rooting of such devices.

But once is rooted with Kingroot, there is .sh script to remove KingRoot and replace by supersu.

Yes, KIngroot is **** its changes filesystem too.
[Android General] Darshan Thapaliya:
Jjjdjdjdjdjdddd
[Android General] adamsmith0805:
How to Remove KingRoot

I always find ELF:KingRoot-D pop-up ads and other unwanted advertisement on the every web page I visit. It also appears after closing. I do not how it enters and why it is happening. Few unknown add-ons and extensions also get attached with the browser and I am unable to remove it, since browser settings can not be modified. And lastly i clicked on proceed with the removal of ELF:KingRoot-D infection and other associated threats. Like me, you can also visit the website below. it is really helpful...

uninstall malware virus.com/remove-elfkingroot-d-updated-elfkingroot-d-removal
[Android General] Mr.MadScientist:
Another noob question: with root firewall & C. is not possible to block sending data from king root?
[Android General] username866:
Avoid ONE-CLICK ROOT also. Their business model is very similar to KingRoot's

It's crazy, I'm not usually a sucker for such cannibalistic companies., but when I couldn't find any guides on how to root my phone I settled for these lowlife scumbags.

Reality of the matter is; however, that over the past few years the smart phone companies have gone to great lengths to make sure consumers cannot root their phones.

---------- Post added at 02:42 AM ---------- Previous post was at 02:22 AM ----------

What in this world is provable to any sufficient extent? Nothing if you're honest and you really think about it. Even science is an "inexact science."

The problem is that I opted for KingRoot as a solution to root my phone partly because XDA FORUMs message boards allows KingRoot to post as if they're a legit operation. In the past I've seen XDA FORUM as a credible message board. However, by allowing this crap, XDA has lost a lot of credibility in my book.

It figures, though. Everyone's a sellout these days. It's gotten to the point where the only credible sources of information on the internet are Wikipedia and Reddit
[Android General] LS12crew:
Thanks

Wow, never knew they did all this to your phone it been a long time since i tried kingroot and it failed on my device which im now glad about and ill never be using it again in the future unless they change there way.
[Android General] alecxs:
The reason for not banning them from XDA is, it is difficult to collect all the different exploits in a single app, but its easy to remove this app once you have root access. it is simply more useful than danger
[Android General] kdm6389:
use KingRoot

when all door are closed

, copy every file /system (/system/etc, /system/bin, /system/xbin, /system/libs*64) somewhere safe before applying KingRoot
[Android General] antuketot76:
[MENTION=3178012]gatesjunior[/MENTION]

Here some report from Virus Total scanner showing 16 antivirus company detect this KIngRoot is a malicious application. This apk file was taken from xda forum thread about KingRoot.

ANTIVIRUS RESULTS DATED

Antiy-AVL --	Trojan/Android.TSGeneric	20170805

Symantec --	Trojan.Gen.2	20170805

K7GW --	Trojan ( 00510cb31 )	20170806

Avira (no cloud) -- SPR/ANDR.KingRoot.cucmr	20170805

WhiteArmor -- PUP.HighConfidence	20170731

Ikarus --	PUA.AndroidOS.DroidRooter	20170805

Rising --	Malware.Undefined!8.C (cloud:Z5lpeUGhw9U)	20170805

McAfee -- Artemis!DE83770FEAF5	20170804

TrendMicro -- ANDROIDOS_LOTOOR.OPST	20170806

TrendMicro-HouseCall -- ANDROIDOS_LOTOOR.OPST	20170806

Cyren --	AndroidOS/GenPua.521FF6A2!Olympus	20170806

Trustlook --	Android.PUA.Riskware	20170806

CAT-QuickHeal --	Android.DroidRooter.A907e (PUP)	20170805

AhnLab-V3 --	Android-AppCare/Kingroot.57f09	20170805

Sophos AV --	Android KingRoot (PUA)	20170806

ESET-NOD32 -- a variant of Android/DroidRooter.BB potentially unsafe-20170806

Here a link for Virus Total results for KingRoot apk -

https://www.virustotal.com/en/file/2d5514eb427e05058367a225ff126c67df5fd2aa492f8d1b817651b9cc20f830/analysis/1502005800/

FYI, after this apk been install into your android, Malwarebytes also detect this apps is dangerous and listed as a malicious apps. This apps also not passed the checking of Stagefright Detector and Shellsocks Vulnerability scanner.

For those who decide to root your phone using this apps for your device, think twice before proceed.

Cya...
[Android General] tiennhu89:
So how can u get these file before u root ur phone?
[Android General] kdm6389:
You can use manually copy/paste ES File, you are not going to get all file but try as many you can. in folder "bin", "xbin", "etc", lib*
[Android General] tiennhu89:
Really? :). How can u go to "bin", "xbin"...folders if ur phone wasnt root. I mean if i rooted my phone, i would go anywhere i want. If not, u cant go anywhere unless sdcard and internal storage (not /system). Right? If im wrong, clearly for me, please?
[Android General] kdm6389:
leave it, it was my mistake
[Android General] mixpro:
Be warned! Be Careful!

I told people about Kingroot A long time ago.

Our corporate firewall wont even let us access kingroot website because it's connected to or indirectly part of the Chinese Military Group Axiom. Cyber Espionage. Think I am kidding?

Do your homework XDA!

ALL android users, within our company has been warned months ago, if anyone is caught using any software related to Kingroot, their contract will be ended. We are all Military Subcontractors.

Also Arxan is one of our partners and their take on Kingroot is very bleak. They simply tell us to avoid it all cost.

Stay Away!
[Android General] conorsulli:
Anyone using kingroot probably deserves adware...
[Android General] :
You were correct, you can access system without root
[Android General] phantomhell:
Just want to say, KingRoot help me root my locked bootloader SO-04F. SuperSU bootloop while update to new binary, Magisk give me bootloop
[Android General] BBRecon:
I removed kingroot but some files still remain, no idea where they are. Though I have SuperSU and it works properly, it wasn't a clean install. So annoying.

Most annoying thing is one of their daemons won't disappear and is always running, no matter how hard you try to get rid of it. It even keeps replacing references to itself in the boot files (install recovery), and the binary itself even! So malicious!
[Android General] allasca:
i know how to remove kingroot, flash your stock firmware/custom rom. lol

fukc kingkongroot
[Android General] basem_ym:
Kingroot,SuperFlash,IRoot,

Mobogenie(dont know if this one is chinese)

They're all malaware/adware apps.

Thank you for this post but you are very late!!

2 years ago I rooted my xperia m2 using king****.

I used to not switch off data connection before sleeping(I always disable auto updates)

Guess what?

My 2GB data plan was consumed plus around 400MB

How??

Kinguser or another crapppppy thing downloaded and installed punch of crappy apps around 700MB

Another 1000MB were gone, but how? I dont know!!

Whenever I click on the screen a bloody ad pops up!!

I was thinking about posting about that crap.

But when I saw the confusing great acceptance of this rooting app I logged off XDA and flashed my device.

I really love every thing about China.

Great country, lovely people, but really fu*king root apps.

---------- Post added at 06:30 PM ---------- Previous post was at 06:22 PM ----------

For the 9 people who voted No.

Ask yourself this question:

Why does anybody do all this hard work and publish it in one click for free??

Use ur brains people!!
[Android General] Outfield303:
yeah
[Android General] anonymoustl:
There are a few scripts and cleaners out that kill KR totally.. Attached is a list of components that KR installs during the takeover.. As far as I have tested, 360Root, PermRoot,Kingo Root all use a binary that easily transfers to SuperSU without any major hacks... The bins mentioned could serve a purpose of obfuscation of root, or they could be all the connections that are required for a remote ADB hack session. China knowing what apps I use, what device I use, and where it is does not bother me nearly as much as all of that access granted to parties within the CONTUS. That is why I don't use full versions of social network apps, and use 3c Toolbox Pro to edit out individual permissions and receivers.

The list should give you something to plug in to a batch file for ease of use.
[Android General] ashyx:
Maybe the same reason the rest of us do it, whom without XDA wouldn't exist?
[Android General] basem_ym:
It was my mistake to encompass every one, sorry.
[Android General] Niii4:
More often than not, if a sophisticated app is for *free* your privacy is the price.

If the gullible user falls for adware it's their own fault.

But above all, legitimate devs have merit a reward for their work. Paid apps is the way to go nowadays IMO.

---------- Post added at 03:24 AM ---------- Previous post was at 03:22 AM ----------

Sounds like your system is compromised.
[Android General] kurix:
I make a script from anonymoustl file. You can run it in terminal by command

sh "file_destination/kingroot.sh"

or by simply running by x-plore file manager build-in shell executor. I can't post links so delete backspace

ufile .io/g1hec
[Android General] Nik Satyr:
Well, kingroot team wants to earn more money by showing more ads. That's not how you treat with the users. Thanks god I found this thread while choosing a proper way to root my device
[Android General] kdm6389:
I have found, If you root using "kingroot 4.5.0-120" to "android 4.1.2". It places /system/bin/start-ssh . Now this is in commutation with some Chinese server. You can log this using adaway.

So final conclusion: Yes, KR is Malware / Adware root
[Android General] kurix:
It looks like SSH backdoor. Can you post screenshots and download link to this file?
[Android General] kdm6389:
Yes, it is SSH backdoor. I dont understand "screenshots and download" of what, if you want "/system/bin/start-ssh". I removed it from there and wiped all traces of kingroot from /system/bin /system/app /system/etc /system/xbin and install supersu which is more trusted. Sorry I did not backed up that virus, i did not thought of it.

Any way my lg phone get boot security error after a month, So I will be repeating this process again. then i will upload the binary for investigation.

---------- Post added at 06:28 PM ---------- Previous post was at 06:28 PM ----------

Yes, it is SSH backdoor. I dont understand "screenshots and download" of what, if you want "/system/bin/start-ssh". I removed it from there and wiped all traces of kingroot from /system/bin /system/app /system/etc /system/xbin and install supersu which is more trusted. Sorry I did not backed up that virus, i did not thought of it.

Any way my lg phone get boot security error after a month, So I will be repeating this process again. then i will upload the binary for investigation.
[Android General] drmjlovell:
Scripts to Kill KR

Thank you for publishing this list and will you kindly let us know of a script or cleaner that will totally kill KingRoot.

This is a very insidious program and even Titanium fails to freeze it.

Help please!!!
[Android General] Sirius_Balzier:
Wow, this thread's awesome. I was doubting how trusting is it. I've rooted a friend's phone, she told me the annoying adware her phone has now. The phone is an ZTE Blade L110 (chinese kills chinese, lol.) I'll try to kill KR with scripts attached previously.

Another thing is, i was planning to downgrade my Xperia M5 (E5606) from 6.0 to 5.1, to root with KR. But, thinking seriously, IT IS A SHAME. I don't know if there is a way to root for 6.0 and not 5.1 (i don't want to downgrade, don't want to catch a bootloop [if i do it bad] ). I've read some threads about this with my M5 but i'm confused, i still want a rooted 6.0.

Regards everyone and sorry if my english is bad :p
[Android General] kurix:
It is probably possible to extract kingroot exploit by using PC version and capturing packets using tool called USBPcap. Now I dont have any smartphone that is rootable by kingroot, so I ask for help. Someone need to check that, because it can be used to root offline without kingroot.
[Android General] antuketot76:
[MENTION=3178012]gatesjunior[/MENTION] Removed it from there and wiped all traces of kingroot from /system/bin /system/app /system/etc /system/xbin and install supersu which is more trusted

​
[Android General] gatesjunior:
No, it is not that simple. They encrypt their payload and decrypt at time of reading it in and executing it. So you would literally have to capture the whole memory space and decipher what it is they are doing.
[Android General] L7.d3pt:
Kingroot 1st then superSU-me pro worked for my XP6

hello all, I did the kingroot root method via USB on a VMWare Win10 machine. The root executed flawlessly, but then I went and read this thread....Using the CPU logger I could see King...Crap running all the time. Found SuperSU-me 3,99 on ye olde play store. Worth every penny. Successfully kept root, installed SuperSU binaries instead, deleted (almost)everything related to KingRoot. According to CPU logger all that runs now when idle is kworker, touchslinger? (or whatever that's called), and some clocking and cell activities, no more kingcrap of any sort. I wish kingroot would just charge the 4 dollars what's his face did for supersu-me. With that being said. Exploiting Kingroot to gain root privilege on the device and then paying a developer to exploit that exploit is poetic justice in a way. Be it intellectually elegant or not, it does work, and much safer and faster than I would have been able to achieve, I'm pretty certain. I downloaded x-plore, Titanium Backup, Textra and BusyBox. Using Ti backup was able to scrub the rest of the file system for a remaining Kinguser folder, also scrubbed all that google bloatware. (I like Google and all, but, I'm not intereted in Google play anything. I tend to download things to local storage). Anyway, As far as kingroot goes, it is Adware, because, maybe they are stealing info, tapping phones, general identity theft, specific character assassination, corporate espionage, extortion, blackmail and murder (overt and covert). It would take really, really big balls to charge money and commit all those heinous acts. After closer scrutiny, which I prolly shoulda exercised BEFORE use, I'm gonna hafta agree with the dude who said that kingRoot is Chinese Military Intelligence. (MAybe?!?!)
[Android General] md kaal:
Kingroot apk
[Android General] trustytrev:
KingRoot status.

Hello,

I have used KingRoot in the past and thought it did a good job of rooting Allwinner A83T tablets using Lollipop. However after upgrading to a ROM with Marshmallow I found issues with the internal sdcard no longer being available and the use of the external sdcard rather convoluted and disappointing. I re flashed the tablets back to Lollipop as the sdcard operation use is much better for internal and external cards.

However the Link2sd app needs the tablet to be rooted. This was when I found the issue about KingRoot being raised on this forum.

My faith in applications made available via this site has been severely undermined. Is there any thing I can do to root these tablets that does not involve KingRoot and that will not compromise the security of my devices? Or is this downturn in the efficacy of KingRoot being driven by ulterior motives. Anti virus product creators have all been coming in for a lot of criticism recently due to Microsoft virtually destroying their market for Windows PC's with Microsofts own security. Any clear guidance on this would be most welcome.

It has become increasingly more difficult to customise android products due to Google without the addition of apps from xdadevelopers being of questionable efficacy. I hope there is a positive response to my thread and a way past the present uncertainty.

Regards.

trustytrev.:(
[Android General] Yakia:
100% TRUE
[Android General] WyrdWyrd:
Reverse Engineering FTW?

My idea-- that I currently lack the skill to actually do-- would be to try to reverse engineer how KingRoot does whatever it does.

Or, if not that, then at least thoroughly document each and every changed file it leaves in its wake-- that way after it's done rooting, you could use your new Root powers to undo all the damage it left in its wake.

Obviously though-- none of this is particularly quick and easy to do, else it would already be done.

Also, the second idea-- document all changes to aid in manual clean-up-- would likely require frequent updating as it's entirely possible KingRoot will make different changes to a phone depending on the KingRoot version and/or the type of phone.

--

Furry cows moo and decompress.
[Android General] illiam1:
You have that backwards sir/mam without the devs xda wouldnt exist. The indoctrination is strong within you :silly:
[Android General] ashyx:
Which is exactly what I'd posted? :rolleyes:
[Android General] Piso Mojado:
I was so desperate with so many guides on this forum which didn't work that I went to Kingroot, and it did root my phone. However, then I factory reset it and found a guide which actually worked.

I have a D415 running 5.0.2 version D41520c. Neither the towelroot method nor gdjinda's "Root All L90 Varients with Latest updates" nor Purpledrake's original script worked for me.

The root method which worked for me was avicohh's LG One Click Root 1.2 script here:

https://xdaforums.com/lg-...lipop-t3056951
[Android General] levone1:
What do we think Kingroot team is exactly up to? Windows, for example, does the same things and worse, and everyone knows about it, but they're not considered 'shady'. If you ask them, it all has to do with collecting info to make better products, and legal security, etc., but some people would say that actually they're secretly trying to take over the world. Probably nobody really believes that they want to rob you or something, (because they actually do, with their prices, etc., so it's hidden in plain sight)... What do we think about Kingroot? Are they Chinese spies, trying to take over the world, or thieves looking for people's bank account information, or just wanting to collect data to be successful software developers, or...???
[Android General] a-raccoon:
Microsoft is an American Corporation with legal oversight and culpability. If Microsoft steals from you, then lawyers and men with guns force Microsoft to dole out millions of dollars to you in apology.

Anonymous Chinese hackers have zero culpability, and zero money, and all-too-often they also have zero honor. Like Nigerians. There are no lawyers or men with guns capable of setting things right for you.

Recently, Microsoft has been doling out hundreds of $10,000 settlements to businesses whose Windows 7 computers automatically updated to Windows 10, because their cash registers suddenly stopped working and permission to upgrade didn't require administrator access. Apple is being sued for 10's of millions because they slowed down people's iPhone 6's with an iOS update. Chinese hackers have been sued for $0 since computers were invented.