yashsingh1/xdaforums huggingface dataset:
[Fire HD 8 and HD 10 General] diplomatic:
Yeah, absolutely. If you can get a root shell in a terminal app, that lets you do anything you can in adb root shell. When you copy it into Termux, you don't use the root dir. Copy it into ./ (dot-slash, aka the current directory) or into $HOME.

OK, great! Although I think PizzaG already confirmed that model (or something very similar). I was mainly looking for test results from the arm version, which people didn't seem to notice I asked for. The "ksymtab..." message is normal. It's just using an alternative method that needs to be used most non-Amazon devices.

Well, I can't help you with unlocking the bootloader yet. My best advice is to explore whether you can flash self-signed or unsigned boot images and have them boot up. Although this is pretty risky as you don't have 'fastboot flash' or an outside means to recover the original boot image in case something goes wrong...
[Fire HD 8 and HD 10 General] diplomatic:
Release 9

Just 2 days after R8, I'm posting Release 9 with confirmed Android Oreo support. At least one device was shown to get root. Of course more Oreo testing is needed. Let me know if anything goes wrong for already confirmed devices. I had to remove R8 because of a nasty spamming bug affecting some devices.
[Fire HD 8 and HD 10 General] k4y0z:
I thought this was using a mediatek-specific bug?

And now you're saying it also supports qualcomm devices?
[Fire HD 8 and HD 10 General] bigrammy:
Almost want to keep this a secret now :crying:

Lets hope you can get some more tester to confirm it works on 8.0 > 8.1 maybe. :fingers-crossed:
[Fire HD 8 and HD 10 General] diplomatic:
Yes, that is what I am saying. I found a similar bug in Qualcomm's code. I guess it's all based on the same design made to conform to Android...
[Fire HD 8 and HD 10 General] k4y0z:
That's awesome :)

Had to test on my HTC M9 running LOS 16.

Doesn't work but I guess that is expected on Android P

himaul:/ $ /data/local/tmp/mtk-su -v
No access
Failed critical init step 1
[Fire HD 8 and HD 10 General] :
That's so Awesome, can hardly believe it but it makes perfect sense, just following googles guidelines. What Soc's from qualcomm are you thinking this will work on?

I havent forgotten about the info you need, its the wifes phone so i only get certain days to work on it. She doesnt work today so ill get that for you.
[Fire HD 8 and HD 10 General] bigrammy:
I used the termux app with these cmd's

drop mtk-su to the root of your internal sdcard

Then from the termux app issue the following

cp /sdcard/mtk-su $HOME

cd $HOME

ls

(to check it's there then)

chmod 755 mtk-su

./mtk-su -v

It may need to be run a few times.
[Fire HD 8 and HD 10 General] diplomatic:
No, pretty sure it'll work on that phone. bigrammy has the right idea. You have to try it a couple more times. If that doesn't give you root, you have only one option: try it a few more times. I'm sure it cannot fail in the end.
[Fire HD 8 and HD 10 General] NFSP G35:
Interesting... I have a few phones laying around we could experiment on:

HTC 10 (Verizon) - Snapdragon 820

HTC M9 (Verizon) - Snapdragon 810

(2x) HTC M8 (1 Verizon, 1 GSM) - Snapdragon 801

HTC Desire 626 (Verizon HTCD200LVW) - Not sure, either Qualcomm Snapdragon 410 or MediaTek MT6592

Samsung Galaxy S3 (lulz... also Verizon) - Snapdragon S4
[Fire HD 8 and HD 10 General] k4y0z:
Running it in termux doesn't do any difference.

I did also run it quite a lot of times, the output is always the same.

I can only test arm64 in termux, since dynamic linking fails for 32-bit in termux.

Should it also work on Android Pie?
[Fire HD 8 and HD 10 General] diplomatic:
OK, then, you know what, I think it's something to do with the date. It's possible that April 1st is a bad day to try this. The date is part of the vulnerability. The 2nd or 3rd might get you there. But April 1st, now that I think about it, might prevent it from completing.
[Fire HD 8 and HD 10 General] :
WTF?? I'm so lost on that. You baked in a timebomb or something? Also, I'm available to test it out on my wifes phone now. Should I use the test version or the newest version on here?
[Fire HD 8 and HD 10 General] diplomatic:
[MENTION=5437200]PizzaG[/MENTION], yeah, please try R9. Although if it's a 32-bit kernel, it won't complete, but it'll help confirm if it's possible.
[Fire HD 8 and HD 10 General] k4y0z:
I guess I'll have to try again tomorrow then, could've fooled me.
[Fire HD 8 and HD 10 General] diplomatic:
Great, look forward to seeing those results... :)
[Fire HD 8 and HD 10 General] :
Well I tried to copy it with the commands. Permission denied. I then used "pwd" and placed the mtk-su file in the home folder for termux. chmod resulted in denied. Permissions showed it being 700 already. Executing the file resulted in permission denied as well. I'm not really sure what the heck is going on here.
[Fire HD 8 and HD 10 General] 0xcafebabe:
I guess April 1st is going on here ...
[Fire HD 8 and HD 10 General] :
well at this stage in the game, i'm not in the mood for jokes, lol. I'm skipping a nap to work on this and have no clue why the simplest thing isn't working.

EDIT: manually setting selinux to permissive and running the file gets me

Failed Critical init step 4: not a typewriter

Can't get the file to run from termux any other way
[Fire HD 8 and HD 10 General] cybersaga:
The permissions aren't set right. 700 means that only the owner of the file can read/write and execute and no one else can do anything with it. If you're getting permission denied when using chmod, it means you're not running under the owner of the file.

Ideally you should chmod 755 (owner can read/write/execute, others can read/execute).

What account is the owner of the file? Running "ls -l mtk-su" will tell you. In my case, it's "shell":

-rwxr-xr-x 1 shell shell 34424 2019-03-30 14:56 mtk-su

Running "id" will tell you which account you're running under:

uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc) context=u:r:shell:s0
[Fire HD 8 and HD 10 General] Rortiz2:
LOL [MENTION=8132642]diplomatic[/MENTION] Snapdragon support!?

If you get it, it will be great. So I will not have to unlock the BL on my Xiaomi Mi A2.
[Fire HD 8 and HD 10 General] diplomatic:
OK, got it. That means it's not compatible yet. I'll have to look into it and do some fine tuning

I'm not sure why people are getting permission denied errors. If you cp it from within the terminal app, it should set the right ownership and security context and so on, automatically. [MENTION=3924647]bigrammy[/MENTION] was getting permission messages too, but was able to fix it somehow....
[Fire HD 8 and HD 10 General] cybersaga:
I suspect that might be the issue there. Maybe they used "adb push" to copy it over (or some other method), then tried to run it in Termux. If the permissions are 700, that would explain not being able to run it.
[Fire HD 8 and HD 10 General] diplomatic:
Already works on that phone ;)

I don't think any other method (than root) can copy the file to the app's private directory, though....
[Fire HD 8 and HD 10 General] :
i hooked it up to pc, moved the file to root of sd. wasnt able to copy it with termux. i then used xplore file manager on the phone to move it into the termux home directory. the instructions say to make it 700 which it already was. i made it rw execute for all just to cover my bases.
[Fire HD 8 and HD 10 General] Rortiz2:
Really?! Oh fu** i unlocked the OEM a week ago... Well I will try It. Thanks!

Enviado desde mi Mi A2 mediante Tapatalk

EDIT: Nah, doesn't work :)

C:\Users\rorle\Desktop\Rortiz2\ANDROID\ADB AND FASTBOOT>adb push mtk-su data/local/tmp
adb: error: failed to copy 'mtk-su' to 'data/local/tmp/mtk-su': remote fchown failed: Operation not permitted
mtk-su: 0 files pushed. 0.8 MB/s (30328 bytes in 0.038s)

If i copy and chmod manually:

jasmine_sprout:/data/local/tmp $ ./mtk-su -v
No access
Failed critical init step 1
[Fire HD 8 and HD 10 General] cybersaga:
Which instructions? The OP of this thread says 755
[Fire HD 8 and HD 10 General] :
Download the current mtk_su zip to your device and unzip it. Take note of where you extracted it. Use the arm64 binary for most devices. You'd only need the arm binary if your phone has a 32-bit only userspace with a 64-bit kernel. (32-bit kernels are not supported yet.)

Open Termux and copy the mtk-su binary to its home directory, which is the shell's initial working directory.

General idea: cp path/to/mtk-su ./

For example,

Code:

cp /sdcard/mtk-su_r8/arm64/mtk-su ./

Add permissions, but probably not needed

Code:

chmod 700 mtk-su

Run the program

Code:

./mtk-su -v

Copy the output to clipboard and post it here.

Taken from the first page and posted by the OP so i thought it was good

EDIT: Even chmod 755 gets permission denied trying to change permission
[Fire HD 8 and HD 10 General] cybersaga:
You missed a slash in the target path. It should be "/data/local/tmp" not "data/local/tmp" :)
[Fire HD 8 and HD 10 General] Rortiz2:
Not working :)

C:\Users\rorle\Desktop\Rortiz2\ANDROID\ADB AND FASTBOOT>adb push mtk-su /data/local/tmp
mtk-su: 1 file pushed. 0.4 MB/s (30328 bytes in 0.072s)

C:\Users\rorle\Desktop\Rortiz2\ANDROID\ADB AND FASTBOOT>adb shell
jasmine_sprout:/ $ cd /data/local/tmp
jasmine_sprout:/data/local/tmp $ ls
mtk-su
jasmine_sprout:/data/local/tmp $ chmod 0755 mtk-su
jasmine_sprout:/data/local/tmp $ ./mtk-su -v
No access
Failed critical init step 1
1|jasmine_sprout:/data/local/tmp $
[Fire HD 8 and HD 10 General] diplomatic:
Ah, that explains it. You must use the app's cp command. One thing I forgot to mention is that, if you're copying from your sdcard directory, you have to set the terminal app's Storage permissions. That may be why you couldn't copy it. With that method, you don't have to worry about file permissions.

Well, don't give up so easily. The chance of success on Qualcomm is exactly 4.01%.
[Fire HD 8 and HD 10 General] NFSP G35:
Hmmm, that's oddly specific ;)
[Fire HD 8 and HD 10 General] :
I made sure storage was checked for permission in Termux and I even tried Terminal Emulator. I'm stumped at this point

EDIT: Ok finally got it to run normal like it's supposed to. I was trying to cp from external sdcard not internal. Once i moved the file to internal sdcard it ran like it's supposed to.

Failed Critical init step 4: not a typewriter
[Fire HD 8 and HD 10 General] Rortiz2:
I do not understand ... You said it worked on this phone:

Already works on that phone

And now you say that? Well, nothing happens, I can wait and appreciate the great work you are doing.

I have tried all the devices in my house (those that work) and it has not worked either ..

Output of my chaozu:

C:\Users\rorle\Desktop\Rortiz2\ANDROID\ADB AND FASTBOOT>adb push mtk-su /data/local/tmp
mtk-su: 1 file pushed. 1.3 MB/s (30328 bytes in 0.023s)

C:\Users\rorle\Desktop\Rortiz2\ANDROID\ADB AND FASTBOOT>adb shell
chaozu:/ $
chaozu:/ $ cd /data/local/tmp
chaozu:/data/local/tmp $ ls
mtk-su
chaozu:/data/local/tmp $ chmod 0755 mtk-su
chaozu:/data/local/tmp $ ./mtk-su -v
No access
Failed critical init step 1
1|chaozu:/data/local/tmp $

I will try it tomorrow on a Moto G6Play, LG G5, Xiaomi Mi A1.

Of course I imagine that this will not work with exynos processors (Samsung S3, Samsung A7, etc etc)
[Fire HD 8 and HD 10 General] k4y0z:
If the chance of success is exactly 4.01% you will have to run it at least 25 times for it to be succesfull once.

Also there is a chance that it won't work today, you may have to try again tomorrow.
[Fire HD 8 and HD 10 General] Rortiz2:
Ahhh, I've misunderstood it. Well, I'm going to try XD.

Every time I try it, I have to restart, right?

I say this because I have made a script that repeats it all the time and I do not know if it will work. It is to test if it works on my MI A2. At the moment it does not work, always failed critical init step 1.

This is the script:

@echo off
:start
adb shell rm /data/local/tmp/mtk-su
adb push mtk-su /data/local/tmp/mtk-su
adb shell chmod 0755 /data/local/tmp/mtk-su
adb shell ./data/local/tmp/mtk-su -v
adb shell reboot
goto start
[Fire HD 8 and HD 10 General] bigrammy:
Use termux app only. :good:

I could not run mtk-su from /data/local/tmp on Android 8.0.

I test a lot of versions for [MENTION=8132642]diplomatic[/MENTION] then bang it worked on the last one he gave me.

[MENTION=8132642]diplomatic[/MENTION]

I have just reverted my Nokia 3 mt6737 to stock Android 8.1

I get the below so maybe a date issue.

./mtk-su -v
param1: 0x1000, param2: 0x8040, type: 12
Building symbol table
kallsyms_addresses pa 0x40a70900
kallsyms_num_syms 40733, addr_count 40733
kallsyms_names pa 0x40ac0300, size 509996
kallsyms_markers pa 0x40b3cc00
kallsyms_token_table pa 0x40b3d100
kallsyms_token_index pa 0x40b3d500
Patching credentials
__ksymtab_init_task not found
Parsing show_state_filter
Found adrp instr at offset 20
ADRP x20, 0xffffffc000f1f000
Found add instr at offset 28
ADD xd, x20, 408
init_task VA: 0xffffffc000f1f198
Could not pinpoint tasks list in init_task struct
Parsing sel_read_enforce
Found adrp instr at offset 12
ADRP x19, 0xffffffc000f1f000
Found ldr instr at offset 24
LDR [x19,0]
selinux_enforce VA: 0xffffffc000f1f000
Setting selinux_enforce
Selinux is already permissive
New UID/GID: 10183/10183
[Fire HD 8 and HD 10 General] diplomatic:
Yes, [MENTION=7104332]k4y0z[/MENTION] is right about trying it at least 25 times. And of course rebooting your phone between each time is totally necessary.

[MENTION=3924647]bigrammy[/MENTION]: LOL.. you have a Nokia 3 too? I know about the issue with it. The kernel uses some stack protection technology in each function that makes it harder to parse them. Call it a work in progress...
[Fire HD 8 and HD 10 General] Rortiz2:
Well I tried more of 30 times and always I get failed critical init step 1..

Enviado desde mi Mi A2 mediante Tapatalk
[Fire HD 8 and HD 10 General] diplomatic:
Then I think April 1st is to blame. Gonna have to try tomorrow....
[Fire HD 8 and HD 10 General] Rortiz2:
Ok:)
[Fire HD 8 and HD 10 General] bigrammy:
Yes got that too. :laugh:

If you need anything just pm me although will be unavailable most of the day tue's > friday inc
[Fire HD 8 and HD 10 General] :
could somebody please explain WTH the date has to do with any of this? Is there some joke going on that i'm unaware of or something? i mean i know it's april fools but i'm just not following.
[Fire HD 8 and HD 10 General] blueberry.sky:
You guys are bad...

:silly:
[Fire HD 8 and HD 10 General] k4y0z:
I think the date is only relevant for qualcomm devices.
[Fire HD 8 and HD 10 General] :
O geez, got me looking like a straight fool then. I'm tellin all these people it now supports Qualcomm devices. I got yard work to do, i'm retiring from this for the day. [MENTION=8132642]diplomatic[/MENTION] i'll try that other file later tonight. Funny but not funny i guess is all i'll say, lol. Momentarily butt hurt..... and....... OVER IT =)
[Fire HD 8 and HD 10 General] NFSP G35:
Whaaaaa??? Someone on teh interwebs actually being a good sport!?!? Where's the flame-war, miles of butthurt eventually culminating in hours of moderator cleanup???

PizzaG, you've proven there's a tiny glimmer of hope in humanity :victory:
[Fire HD 8 and HD 10 General] smileyint:
I tried on my daily driver LG G5 H860N oreo 8.0 unsuccessfully as i cannot chmod 700 or 777 to the mtk-su script. I had tried chmod at multiple location such as "sdcard/" or "sdcard/download" . Permission is still remains 660. Trying to run the script will yield permission denied at both locations. :crying:
[Fire HD 8 and HD 10 General] diplomatic:
LOL [MENTION=5437200]PizzaG[/MENTION]!! Sorry you had to go through that, bro. But you gotta admit that was a pretty successful prank. At least 3 people (now 4?) fell for it, even after I left so many clues it was for April Fools.

[MENTION=390235]smileyint[/MENTION], that doesn't look like a Mediatek phone. Qualcomm devices are not supported any more starting today. ;)
[Fire HD 8 and HD 10 General] Rortiz2:
Well, I did not find it funny. You left me as a fool.

Enviado desde mi Mi A2 mediante Tapatalk
[Fire HD 8 and HD 10 General] k4y0z:
Oh come on, I got fooled as well, but there were so many clues.
[Fire HD 8 and HD 10 General] smileyint:
Thanks diplomatic for his hard work on FireHD 8. Please do not release the information for Amazon to patch its firmware. Let the loophole be forever open. :)

For once i really thought i can finally root my old daily driver but is just a April fool prank. Too bad the device is unpopular to begin, and pretty old by now.

Btw, LG G5 is a qualcomm snapdragon 820 soc.
[Fire HD 8 and HD 10 General] dutchthomas:
April 1 is a terrible day for the Internet. All day long I was nearly fooled by fake stories and questioning legitimate ones.

Let's take this as a lesson; Not all cultures celebrate April Fool's Day. Maybe [MENTION=8978978]Rortiz2[/MENTION] can get revenge on Dia de Los Santos Inocentes
[Fire HD 8 and HD 10 General] Rortiz2:
In Spain its also celebrated but not given much importance and do not spend so many jokes. It did not seemed funny for me because I was very excited to root my Mi A2 without losing anything and it turns out that everything was a joke and as the joke was made by [MENTION=8132642]diplomatic[/MENTION] and [MENTION=7104332]k4y0z[/MENTION] I fell on it because they are great developers and everything they say is true.

PS: I can not take revenge because my jokes are very bad and nobody would believe them.

Enviado desde mi Mi A2 mediante Tapatalk
[Fire HD 8 and HD 10 General] cybersaga:
I was caught off guard by Stack Overflow's April fools joke yesterday. This is what the site looked like: https://i.imgur.com/omJBos4.png
[Fire HD 8 and HD 10 General] Rortiz2:
It seemed strange to me already. XD

Enviado desde mi Mi A2 mediante Tapatalk
[Fire HD 8 and HD 10 General] diplomatic:
Sorry [MENTION=8978978]Rortiz2[/MENTION], once you said you made a script to test it repeatedly, including rebooting between each try, I just couldn't resist. FWIW, I did not target anyone in particular or privately plan this with k4y0z or anyone else.

LOL... I have no problem keeping it to myself. But I guess if there's some indication that this is being patched, then I might as well release it...
[Fire HD 8 and HD 10 General] Rortiz2:
The problem, is that in Spain we celebrate: "El dia de los Santos Inocentes" which is December 28. So, I had no idea that April fools day was celebrated in your countries yesterday.

Anyway, I've believed it because you and diplomatic were giving me answers that seemed real when I asked something.

In short a joke very well made.

And yes, you're right, there were many clues but I'm very stupid and find it hard to find them XD. Also keep in mind my level of English ... I have to admit that when you and diplomatic told me to wait until tomorrow, it seemed strange but since you are developers, I thought you would not play a joke like that but now I see that I can not trust anyone.

---------- Post added at 04:16 PM ---------- Previous post was at 04:11 PM ----------

LOL?- I do not know, I thought that if you have to restart every time you do the exploit, I created that script for test.

I have already said before:

It has been a very good joke and I have believed it.

Let's see if I can take revenge on December 28?
[Fire HD 8 and HD 10 General] k4y0z:
Just to make it clear, it wasn't my joke, I got fooled myself and once I figured it was a joke I just went with it :p
[Fire HD 8 and HD 10 General] smileyint:
I think amazon will never find it. Lol
[Fire HD 8 and HD 10 General] De2290:
So I managed to get complete root on my 6th gen Kindle fire HD 8 2016. Is there anyway I can unlock the bootloader and/or install a custom recovery?
[Fire HD 8 and HD 10 General] bigrammy:
Worked out problem with dd via ADB SHELL

Nokia 3 (mt6737 Android 8.1) Stock ROM

[MENTION=8132642]diplomatic[/MENTION]

Maybe I got my wires crossed with your instructions :eek:

But I noticed when you run the mtk-su from the Termux app it starts the shell in Termux it's self. :o

[B][COLOR="red"]starting /data/data/com.termux/files/usr/bin/bash[/COLOR][/B]

So I copied mtksu to data/local/tmp and ran it again and mtksu worked again but this time.

[B][COLOR="Red"]starting /system/bin/sh[/COLOR][/B]

dd then works perfect via adb shell. :good:

See below:

130|NE1:/ $ cp /sdcard/mtk-su /data/local/tmp/
NE1:/ $ chmod 755 /data/local/tmp/mtk-su
NE1:/ $ cd /data/local/tmp
NE1:/data/local/tmp $ ./mtk-su -v
param1: 0x1000, param2: 0x8040, type: 12
Building symbol table
kallsyms_addresses pa 0x40a70900
kallsyms_num_syms 40733, addr_count 40733
kallsyms_names pa 0x40ac0300, size 509996
kallsyms_markers pa 0x40b3cc00
kallsyms_token_table pa 0x40b3d100
kallsyms_token_index pa 0x40b3d500
Patching credentials
__ksymtab_init_task not found
Parsing show_state_filter
Stack protection detected
Found adrp instr at offset 32
ADRP x21, 0xffffffc000dd5000
Found add instr at offset 36
ADD xd, x21, 3712
init_task VA: 0xffffffc000dd5e80
Possible list_head tasks at offset 0x340
0xffffffc078f37340 0xffffffc071814340 0x000000000000008c
comm offset 0x5f8 comm: swapper/0
Found own task_struct at node 1
real_cred: 0xffffffc04adab840
Parsing sel_read_enforce
Stack protection detected
Found adrp instr at offset 40
ADRP x0, 0xffffffc000fd0000
Found ldr instr at offset 56
LDR [x0,2788]
selinux_enforce VA: 0xffffffc000fd0ae4
Setting selinux_enforce
Selinux is already permissive
New UID/GID: 0/0
[B][COLOR="Red"]starting /system/bin/sh[/COLOR][/B]
NE1:/data/local/tmp #
NE1:/data/local/tmp # dd if=/dev/block/mmcblk0p1 of=/sdcard/test2.img
6144+0 records in
6144+0 records out
3145728 bytes (3.0 M) copied, 0.118845 s, 25 M/s
NE1:/data/local/tmp #

Just to be clear to everyone this is NO April fool for MediaTek based devices it 100% works :victory:
[Fire HD 8 and HD 10 General] diplomatic:
Well yeah, you must run mtk-su in adb shell to get root. The shell that is started is whatever is stored in the SHELL variable.

Oh yeah, absolutely. No doubt about that. ;)

And I didn't tell you to say that. MTK 100% legit.

BTW, if anyone wants to test it out, here is the version that works with Nokia 3. It would also be great to know how it does with existing Fire HDs and Fire TV2, because there are some code parsing changes that might affect other devices.
[Fire HD 8 and HD 10 General] mobaddict:
Been trying to test if rooting my 67xx phone works, I'm getting a __ksymtab_init_task not found. New UID/GID: 0/0. starting /system/bin/sh. Then it stays stuck there.

EDIT: Now it looks good but can't remount saying '/system': Device or resource busy
[Fire HD 8 and HD 10 General] bigrammy:
/System is already mounted. Just use any shell cmd to do what you want like dd cp mv rm chmod anything you like as your working as root user. Hope that makes sense.
[Fire HD 8 and HD 10 General] mobaddict:
I meant that I can't remount the system to rw to add SU binaries. How do I know if I have temporary root?
[Fire HD 8 and HD 10 General] k4y0z:
Just tested on HD10, still works very well and much faster (both arm and arm64).

What device do you have and what android-version?

If you have dm-verity you shouldn't remount system.
[Fire HD 8 and HD 10 General] cybersaga:
Run "id" from the shell. You should see "uid=0(root)" if you have temp root.