yashsingh1/xdaforums huggingface dataset:
[Miscellaneous Android Development] Duhjoker:
Ok adb shell and adb su are two different ways that adb can interact with your device. With adb shell your computer becomes the command line for the device and can perform basic shell commands the same as terminal emulator or termux. Think of it like an extension of your device with more permissions.

Adb su assumes root shell of your device meaning you get full permissions in the shell commandline. With it you can do alot more and with can screw up alot more. Su permissions should be used with much thought and responsibility. For instance most people like to debloat thier devices by removing applications that arent needed and take up room and space.

Thats all good but say you didnt know carrierconfig was needed by your carrier app to give it permissions and protocols to make phone calls. By removing it you could keep your phone from being able to make or fecieve calls. At least temporarily.

Or what if you used dd trying to copy your system.img and wiped it instead. That would certainly ruin your day. I myself know exactly how to use dd but i double check and think very carefully brfore using it.

With out being able to get to fastboot mode copying all those partitions is pointless as you cant flash them using a fladhtool, twrp recovery or fastboot. With out fastboot you cant flash magisk either. So no full root.

Now if your device can be flashed by spflashtools then a recovery once made for your device can be flashed and you can also flash magisk from there.

But if you have followed the directions of the OP you have magisk installed already on your device as magisk manager and then magisk su when you exteacted the magisk init file.

There actually is a way to fully enable root this way and can be done with mtk-su but no ones really caught on to it yet. I think you should get a terminal app and a root file explorer and do some exploring and learning.
[Miscellaneous Android Development] Divogame:
Magisk

I understand what you're saying. and I have to be very careful when using it. But the problem I want you to help me, is to install Magisk after Temp root without having to reboot the phone or install via TWRP because my oppo device simply doesn't have custom Fasboot and TWRP.
[Miscellaneous Android Development] Duhjoker:
Well thats because your not paying attention and know very little about how the abdroid boot, recovery and partition system work. You cannot flash magisk and get permanent root with out being able to flash using fastboot. The boot loader needs to be unlocked to do so. If you were to try and dd something into place even with a locked bootloader you could boot loop or brick your device

There is no custom fastboot. Its built into every device but manufacturers and carriers decide wether the customer gets to access them so they disable the means to enter it
[Miscellaneous Android Development] DB126:
^^ This +1. Resist spoon feeding; only creates further dependencies and hapless orphans when the mother ship moves on.
[Miscellaneous Android Development] CXZa:
What DuhJoker is actually saying is that "Do what I say, not what I have done myself."

- Like zero dd-ing his own bootloader for example... ;)

https://xdaforums.com/showthread.php?t=4031671

Also - nobody knows everything...

Depends on your system what you can do - and what you cannot...
[Miscellaneous Android Development] Duhjoker:
Yes sir you are totally correct. I had an idea thought it might work didnt ask enough questions first and got cocky. As far as my implementation goes of perm mtk-su. I will ask questions before acting this time.

Speaking of asking....

I think there is an alternate way to enter fastboot besides the one i mentioned in my new thread. I have been looking at the lk.bin in a hex editor and think i may have found some hidden key combos that be used from laf on lg devices. Could be the same for others but i do know that adb reboot bootloader has been disabled completely.

What would be your estimate of a hidden backdoor command? And do you think they would stop us from entering fastboot all together.
[Miscellaneous Android Development] diplomatic:
Yeah, so you still need a stock boot image to be able to install root. It might be possible to extract it with SP Flash Tool. Or maybe wait for a stock ROM to be posted. I'll have to see about extracting the FW when I get my tablet...

OK, noted...
[Miscellaneous Android Development] diplomatic:
Have you seen post 3, which has projects based on the temp root? They seem to fit your bill pretty well. The Partition Backup Helper backs up your partitions from Termux. The bootless root will load Magisk, which will grant you root access for apps and shell.....
[Miscellaneous Android Development] Corneille95':
"WARNING If you have a device with Android 6 or higher, it likely has dm-verity enabled. On such a device one does not simply remount the system partition as read/write. The remount command will probably fail. But if you succeed in forcing it somehow it will trigger dm-verity, which will result in a very bad day. Your device will become inoperable until you restore the stock system partition."

I want to use this method to get root, but I don't correctly understand the aforementioned. I'm using a MT6739 device running on Android 8.1.0. Does this WARNING mean; by even trying this method—I am shooting myself in the foot? Because I am running "Android 6 or higher" ????
[Miscellaneous Android Development] Ashok.Vardhan:
SP Flash Tool + WwR_MTK method to backup ROM

I did try using these two tutorials to take a ROM backup, however, without much success.

https://android.stackexchange.com/q...nd-full-rom-without-root-for-mediatek-devices

https://forum.hovatek.com/thread-21970.html

The first issue I noticed with Wwr_MTK (I downloaded the latest version I could find: WwR_2.51_Eng) is that it did not have a drop-down option for the Mediatek MT6762.

It had options for MT6761 & 6763, but not for 6762. So it did not have a pre-configured scatter file format to choose from. So I used the option-2 and modified the Template.ini file to include it into the drop down menu options.

The second issue I came across was that Smart Phone Flash Tool (I downloaded the latest version I could find: SP_Flash_Tool_v5.1944) did not support MT6762 either. It has support for MT6761, though.

Furthermore, after some discussion with Duhjoker, I checked the tablet specs using Droidinfo and noticed that the chipset it detected was: MT8768WT.

Perhaps I was using the wrong information so far?

I arrived at the conclusion that LenovoTB-8705F had MT6762 chipset after cross-checking Mediatek wiki page for the CPU: MediaTek Helio P22T Tab Octa-core 2.3G (the corresponding chipset marked there was MT6762).

So I am not able to use SP Flash Tool to make a backup for the stock firmware.

Any suggestions on how to get past this roadblock?

Much appreciated.
[Miscellaneous Android Development] Rortiz2:
nvm
[Miscellaneous Android Development] diplomatic:
No, it just means you are not going to be able to change any files on /system. But if you try very hard to modify the system partition in some way (such as at the block layer) and succeed, your device will probably become unbootable.

The mt6162 chipset is part of a family of chips under the umbrella of some platform name. It may be either *61, *63, or possibly *65. Whenever you're not sure about these things, it doesn't hurt to try one after another. But the thing is, that tablet might not even give you access to SPFT without a special DA from Lenovo. You can try to do a short readback with SPFT with a generic scatter file and watch for any errors. For readback, the file doesn't have to be accurate. Also, if that doesn't work, you might want to try getting into boot-ROM mode for SPFT by holding volume up or down as you plug in the cable....
[Miscellaneous Android Development] Corneille95':
After I select 2) Run Boot-Recovery Backup, nothing happens

I just get 'press enter to exit'

Whether I select option 1 or 2. dd-backup folder is empty. Any help for this?
[Miscellaneous Android Development] diplomatic:
I think the file dd-backup-maker.sh needs tuning for some phones where the block directory is /dev/block/platform/bootdevice/by-name. Can you take a look at it, [MENTION=5312578]mrmazak[/MENTION]?

[MENTION=6976537]Corneille95'[/MENTION], have you tried getting a root shell yet? (Does mtk-su work?) What phone do you have?
[Miscellaneous Android Development] mrmazak:
Try to start over. Clear all of the downloaded files and start again.

Based in the error in your screen shot it is from this section of the script.

.. .
folder="/sdcard/dd-backup"
script="dd-backup.sh"
script2="dd-backup-boot-recovery.sh"
touch "$script"
touch "$script2"
echo "making dd-backup folder"
mkdir "$folder"
......

the variable "$folder" is hard coded in the script. So for the message to say missing operand means the downloaded script may be corrupt.
[Miscellaneous Android Development] Corneille95':
mtk-su works perfectly. I am rooted through it. My device is a Hisense F35 (Hisense Infinity H12 Lite).

---------- Post added at 01:45 PM ---------- Previous post was at 01:43 PM ----------

Okay, I will try and reply back.

Thanks
[Miscellaneous Android Development] mrmazak:
I could possibly use line like this

cat /etc/recovery.fstab | cut -d '#' -f 1 | grep /system | grep -o '/dev/[^ ]*' | head -1

Right now it is using this to find the path

ls /dev/block/platform/*/*/by-name/boot* | head -1

The fstab grep option might be tricky if fstab is in vendor/extra though. You think?
[Miscellaneous Android Development] diplomatic:
I was thinking just change it to this:

ls /dev/block/platform/*/*/by-name/boot* /dev/block/platform/*/by-name/boot* | head -n1

The fstab file would be more problematic because it's at different paths on different devices.

Another issue I just thought of as I was typing is that if the script is run when bootless root is active, then the "boot" file would not be detected. So maybe change it to system* ?
[Miscellaneous Android Development] TheK0tYaRa:
Amazing

I have ARMv7.1 and it errored about not getting root but root is GOT!

Lenovo k10a40 C2 Power

K10a40_S120_161203_ROW
[Miscellaneous Android Development] diplomatic:
Hi,

Can you be more specific? What was the error?
[Miscellaneous Android Development] bigrammy:
My "Find" cmd would be the most reliable and universal way and that's why I used it in my script

find /dev -name by-name

not sure why [MENTION=5312578]mrmazak[/MENTION] dropped it in favour of ls to honest. :o

I explored all options some time ago with Superr while adding support for mediatek devices in his kitchen since at that time some recovery's were using old legacy mtk partitioning scheme and therefore would not flash roms produced by the kitchen. :eek: We agreed that this cmd I found was the best cmd to use for all devices and I think it's still used today in the install script.

Find is very useful and works with any device mtk or others. It also works with the shorter legacy mtk partitioning scheme. ;)

eg:

find /dev -name by-name -exec ls -R {} \;

Result of the above will produce a output like this example below which gives the full path along with all the "by-names"

/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name:
Qnovo boot diag flashinfo frp lk logo md1arm7 md1img metadata nvram oemkeystore persist proinfo protect2 secro ta tee2
apps_log cache expdb fotakernel keystore lk2 ltalabel md1dsp md3img nvdata oem para ppl protect1 seccfg system tee1 userdata

Or

find /dev -name by-name -exec ls -l {} \;

output =

lrwxrwxrwx 1 root root 21 2020-02-27 11:14 boot -> /dev/block/mmcblk0p23
lrwxrwxrwx 1 root root 21 2020-02-27 11:14 cache -> /dev/block/mmcblk0p32
lrwxrwxrwx 1 root root 21 2020-02-27 11:14 diag -> /dev/block/mmcblk0p30
lrwxrwxrwx 1 root root 20 2020-02-27 11:14 expdb -> /dev/block/mmcblk0p7
lrwxrwxrwx 1 root root 21 2020-02-27 11:14 flashinfo -> /dev/block/mmcblk0p36
lrwxrwxrwx 1 root root 20 2020-02-27 11:14 fotakernel -> /dev/block/mmcblk0p5
lrwxrwxrwx 1 root root 20 2020-02-27 11:14 frp -> /dev/block/mmcblk0p8
lrwxrwxrwx 1 root root 21 2020-02-27 11:14 keystore -> /dev/block/mmcblk0p28
lrwxrwxrwx 1 root root 21 2020-02-27 11:14 lk -> /dev/block/mmcblk0p21
lrwxrwxrwx 1 root root 21 2020-02-27 11:14 lk2 -> /dev/block/mmcblk0p22
lrwxrwxrwx 1 root root 21 2020-02-27 11:14 logo -> /dev/block/mmcblk0p24

and so on

Here is my implementation https://github.com/bigrammy/dd-backup-helper-script/blob/master/dd-backup.sh#L25

Sorry if OT :o
[Miscellaneous Android Development] TheK0tYaRa:
It is so every time:

Can't acquire root privileges (27 febr. 2020 y. 11:03:40 PM)

suboot.sh

Temporary root by diplomatic@XDA
Home URL:
https://xdaforums.com/android/development/amazing-temp-root-mediatek-armv8-t3922213
--------------------------------------------------
/data/data/com.ryosoftware.initd/files/bin

UID: 0 cap: 3fffffffff selinux: permissive
source type magisk does not exist
Error in: allow magisk (null) (null) (null)
client: launching new main daemon process
[Miscellaneous Android Development] diplomatic:
Yeah, you can use find, but I think this was done mainly in favor of keeping it simple and minimalistic. You don't have to break out the find command if the shell's own wildcard expansion can do that job. There's also a snag with searching for "by-name". That pattern will include your SD card partitions as well if it's GPT. You have to look for the "by-name" directory that also has standard Android partitions (boot or system).

Oh, that's all normal. Everyone gets that. :good: I just didn't bother to include it in the example.
[Miscellaneous Android Development] bigrammy:
Point taken about the by-name :good:

Maybe this then

find /dev/block | grep -i -e /lk -e /boot -e /system

Output is this on my sony xa.

Note: I added the lk to see if it would get multiple instances of lk like lk2 and it does so it should work for boot1 boot2 etc etc on the new new partition schemes :fingers-crossed:

find /dev/block | grep -i -e /lk -e /boot -e /system
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/system
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/boot
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/lk2
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/lk

No need for grep.

find /dev \( -name 'm*boot*' -or -iname 'system' -or -iname 'fotakernel' -or -name 'lk*' -or -name 'boot*' \)

Output below

/dev/block/mmcblk0boot1
/dev/block/mmcblk0boot0
/dev/block/platform/mtk-msdc.0/11230000.msdc0/mmcblk0boot1
/dev/block/platform/mtk-msdc.0/11230000.msdc0/mmcblk0boot0
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/system
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/boot
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/lk2
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/lk
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/fotakernel
[Miscellaneous Android Development] CXZa:
Finding a big enough sd card for these... without buying one...

That is the main problem.... (I know have a pile of them somewhere...)

There is more that one way to skin a @@@ politician...

Whatever works.... I would just use cat... it's the fastest most of the time.

But I would really like to just pull them with adb...

Unsecure adbd doesn't work. Any other tricks? Magisk?

BTW, the scripts do not dump the partition table and the preloader partitions...
[Miscellaneous Android Development] bigrammy:
I have edited my post above and as you will see we can capture the preloader partition using the new find cmd.

Warning: the preloader needs to be trimmed before been re-flashed or it could brick the device I believe.

See this post on how to process the preloader here https://xdaforums.com/showthread.php?t=2540400 and see the clean.sh, trim.sh, trimFF.sh

Thanks to [MENTION=4796707]syserr[/MENTION] for this. :good:
[Miscellaneous Android Development] CXZa:
I see. The partition table is typically at the begin (pgpt) and the end (sgpt)

of mmcblk0, 512 kb... should be the same...

Also the decrypted data, dm-# or whatever, could be nice to dump...

YMMW. That preloader trim etc. guide is quite old. I remember that it was very easy

on my old Lollipop using a hex editor. With my newer LG , I don't if it is needed or not.

But it's a LG, so... (the SPFT doesn't work anyway -- yet...)
[Miscellaneous Android Development] bigrammy:
Preloader is trimmed in the official Sony Firmwares unlike the boot and recovery that are full block size.

also when flashing it seems to be treated differently than other partitions. :confused:

Taken from Nokia3 update.zip

assert(package_extract_file("preloader.bin", "/tmp/preloader.bin"),
write_raw_image("/tmp/preloader.bin", "/dev/block/mmcblk0boot0"),
delete("/tmp/preloader.bin"));

all the others partitions use normal convention below.

package_extract_file("logo.img", "/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/logo");

I will stick with trimming and flashing with these conventions just in case I end up with a brick again :laugh:

Running OT now so PM me if you need to :good:
[Miscellaneous Android Development] pradiphrx:
error :

C:\adb\platform-tools>adb devices

List of devices attached

S4A6AMOBJZEAZ5MZ device

C:\adb\platform-tools>adb push mtk-su /data/local/tmp/

mtk-su: 1 file pushed. 4.0 MB/s (64780 bytes in 0.016s)

C:\adb\platform-tools>adb shell

1814:/ $ cd /data/local/tmp

1814:/data/local/tmp $ chmod 755 mtk-su

1814:/data/local/tmp $ ./mtk-su

0000000000000000 is not a valid address

UID: 2000 cap: 0000000000 selinux: permissive

1814:/data/local/tmp $ ./mtk-su -v

armv8l machine

param1: 0x1000, param2: 0x8040, type: 13

Building symbol table

kallsyms_addresses pa 0x4117ce00

kallsyms_num_syms 55319, addr_count 55319

kallsyms_names pa 0x411e9000, size 732476

kallsyms_markers pa 0x4129be00

kallsyms_token_table pa 0x4129c500

kallsyms_token_index pa 0x4129c900

Patching credentials

Parsing current_is_single_threaded

ffffff80083c6b98+58: ADRP x0, 0xffffff8009a75000

ffffff80083c6b98+5c: ADD xd, x0, 2368

init_task VA: 0xffffff8009a75940

Potential list_head tasks at offset 0x4f0

comm swapper/0 at offset 0x7c0

Found own task_struct at node 1

cred VA: 0000000000000000

0000000000000000 is not a valid address

Parsing avc_denied

ffffff800835d5b0+10: ADRP x4, 0xffffff8009ef6000

ffffff800835d5b0+20: LDR [x4, 3644]

selinux_enforcing VA: 0xffffff8009ef6e3c

Setting selinux_enforcing

Selinux is already permissive

starting /system/bin/sh

UID: 2000 cap: 0000000000 selinux: permissive

please help,

my device vivo y93
[Miscellaneous Android Development] Sakitana872es:
Does work for my device?

My model: Alcatel 5V (5060D)

RAM: 3GB

ROM: 32GB

CPU: Mediatek MT6762 Helio P22

Version: 8.1.0

Patch: 5th November 2019

Build: 01006

I tried to mtk-su that he said denied?

I don't know why? I have stock ROM Backup using SPFT.

Can you make to port TWRP? I have stock Boot and Recovery.

My Stock ROM: https://mega.nz/#!IklFQRoC!AJvTKs1E9RJG1N4x6-FV4DvKS5fLOIaJ0ESXd2ov2qU

Someone help me? ?
[Miscellaneous Android Development] diplomatic:
That's a modified kernel. The location of the cred pointer within task_struct has been moved. See the bottom of post 4. Yes, it's possible to get temp root on it, but I'm not going to add support for that in the release version. PM me if you have some way to motivate me to work on this...

Uh, what is the actual error? "Denied" doesn't sound like an error from mtk-su. Have you called it from the right location with the right file permissions?
[Miscellaneous Android Development] sachinchude:
Error mtk-su nokia 1 android pie

armv7l machine

param1: 0x1000, param2: 0x8040, type: 12

Building symbol table

kallsyms_addresses pa 0x40ab9460

kallsyms_num_syms 40556, addr_count 40556

kallsyms_names pa 0x40ae0e20, size 503776

kallsyms_markers pa 0x40b5be00

kallsyms_token_table pa 0x40b5c080

kallsyms_token_index pa 0x40b5c3d0

Patching credentials

Parsing current_is_single_threaded

Stack protection detected

c03ce590: LDR Rt, [PC, #156] ; 0xc03ce634

init_task VA: 0xc0e2aa78

Potential list_head tasks at offset 0x290

comm swapper/0 at offset 0x438

Found own task_struct at node 1

cred VA: 0xc2635400

thread_info flags VA: 0xc3ea8000

seccomp mode VA: 0xd7517910+2ac

Parsing avc_denied

c036f634: LDR Rt, [PC, #496] ; 0xc036f82c

selinux_enforcing VA: 0xc0ee56dc

Setting selinux_enforcing

Selinux is already permissive

Trying seccomp-forbidden syscall

Caught SIGSYS

Disabling seccomp

This address does not seem to have your thread flags (0x00000800)

seccomp mode: filter

Bad system call
[Miscellaneous Android Development] levone1:
Very interested in what you're trying to do. I've been on Xperia for most of the last 10 years, but happened to get a hold of an Alcatel mtk phone, (A501DL), locked, Oreo 8.1, no fastboot, dm-verity. I've tried every I can think of to get into fastboot, (even called Alcatel/TCL twice).

Happy to find mtk root, but would really like r/w access. Happy to test or support if I can...
[Miscellaneous Android Development] Seriel:
Run it from adb shell, Nokia 1 on Pie can't run it from the context of an app.
[Miscellaneous Android Development] Oxydeme:
Hi their will by franck,

Franckly, after reading the op and the last page..,

Do you think your method could help considering building a TWRP port for Meizu M813H HelioP22 Mediatek SoC, 6757 if I remember correctly,

Would be really interested, it would open a hole new branch, M813H on XDA, have seen plenty of Meizu threads but not M8.

Would really be interested in a twrp port and Custom Rom but,

What interest in a custom Rom without recovery? X)

Could learn about those things
[Miscellaneous Android Development] sachinchude:
Error init.d apk

Can't acquire root privileges (3 Mar 2020 06:46:48)

Executing scripts from /storage/emulated/0/init.d (3 Mar 2020 06:46:48)

suboot.sh

Temporary root by diplomatic@XDA

Home URL:

https://xdaforums.com/android/development/amazing-temp-root-mediatek-armv8-t3922213

--------------------------------------------------

Bad system call
[Miscellaneous Android Development] martyfender:
https://www.xda-developers.com/mediatek-su-rootkit-exploit/?utm_content=buffer54f20&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer
[Miscellaneous Android Development] sachinchude:
Incompatable system nokia1 mtk-su

I got error incompatable system on nokia 1 ta 1066

Chipset mt6737m android 9 pie update 02/2020

kernel source link

http://nokiaphones-opensource.azureedge.net/download/phones/Nokia1_V2.20A.tar.bz2
[Miscellaneous Android Development] sasebot:
Motorola Moto E4 Plus

Confirmed works on Motorola Moto E4 Plus (Mediatek MT6737, Android 7.1.1, Kernel version 3.18.35+ hudsoncm@ilclbld99 #1 Fri Mar 15 2019)

Thanks for your work !
[Miscellaneous Android Development] alecxs:
[MENTION=8132642]diplomatic[/MENTION] lol you are famous know :D

Critical MediaTek rootkit affecting millions of Android devices has been out in the open for months
[Miscellaneous Android Development] CXZa:
Hmm. While this root is in many cases so much wanted could [MENTION=8132642]diplomatic[/MENTION]

provide some sort of patch for it? So it would not work...

Or some sort of solution/app that if run other "things" could not use it???
[Miscellaneous Android Development] diplomatic:
That's actually a bug in mtk-su. The TIF_SECCOMP flag is different on 3.18 kernels, which are not common for Android 9. Someone asked about this phone a few months ago, but I think I misinterpreted the problem. I'll post a test version for you guys later...
[Miscellaneous Android Development] Seriel:
I see, thanks for the explanation!! All I knew from what I tried and what I saw of the thread here (Probably the same post you referenced) is that it doesn't work from apps, only adb shell. Would appreciate a version that works from apps, so I can get proper bootless root working, will gladly test anything you throw at me :)
[Miscellaneous Android Development] diplomatic:
From my understanding, the patch is pretty intricate. And I'm not sure how far it extends (i.e. just the kernel or system files as well). So it would have to come from MTK and/or Google. You would have to compile your kernel at least.
[Miscellaneous Android Development] thinhx2:
Vsmart Active 3 ,Mt6771 arm64, android 9, 2020 Feb Patch

mtk-su and mtk-su -v output same result