yashsingh1/xdaforums huggingface dataset:
[Miscellaneous Android Development] DragonFire1024:
unfortunately it didn't last long enough for me to be able to do a test on it. I was in the midst of typing out ADB remount when 'root' was lost. I wish I had gotten a couple of screenshots. And without knowing the process behind the supposed rooting, I can't say what caused it or didn't. I can say that there is a CVE-2019-2215, details below from https://securityboulevard.com/2019/...ackers-root-access-found-running-in-the-wild/

It affects various kernels from 3.18 to 4.9 (this LG K51 has kernel 4.9). Theoretically it should have been patched. But since my initial Post in this thread, I've tried to find an explanation as to how this happened, and this is pretty much the only logical explanation I can come up with at least within my span of knowledge. It may not be this specific CVE, it may very well be a new one but without being able to replicate the rooting, ?. I do remember running ADB shell ID and did see a thing or two about an untrusted application.

Anyways that's all I can remember at the moment. Perhaps I will try posting in other LG forums that used this specific CVE on other LG devices and see what they think.
[Miscellaneous Android Development] diplomatic:
There is something wrong with trying to launch your bin/zsh shell program. Try running the stock Android shell ./mtk-su -c /system/bin/sh .

Check your SDK version with 'getprop ro.build.version.sdk'. That number can't lie. For Android 5, the sdk ver. would be about 21.

The other script can't have the same issue. Did you copy it in correctly (rename .txt to .sh and delete the first script)?
[Miscellaneous Android Development] duncan.wick:
I ran the commands you said

[IMG="adb output"]https://i.imgur.com/jlEOPbX.png[/IMG]

and afterwards got this from running the script

[IMG="script output after adb"]https://i.imgur.com/xX27Xbq.png[/IMG]

Still getting the same weird issue where the screen dims but nothing happens when trying to do anything that would require root
[Miscellaneous Android Development] DragonFire1024:
Here's a question, for mediatek devices, are partitions like /dev/block/platform/by-name/... Supposed to have any RW capabilities?
[Miscellaneous Android Development] DragonFire1024:
Oh and actually no it is Android nine
[Miscellaneous Android Development] DragonFire1024:
Hey [MENTION=8132642]diplomatic[/MENTION] and others that were around to crack open the Amazo fire tablets, what is it we used to do that had something to do with using one of Amazon's apps like some kind of social network sharing application to be debuggable, and set it and developer options? It's been such a long time I forget what we did that for. But I digress because I have managed to get 'run-as' to work in /data/local/tmp I. This LG and have managed to track down a couple of applications that have debuggable status already. I guess since it's been so long if you can refresh my memory as to what kind of commands would be useful when using run-as. And mind you it really sucks that I can't execute a damn thing on this phone unless it's through ADB shell. I guess what I'm trying to hint partially at is being able to create an APK and Android studio that is debugable that also has some kind of exploit built into it that can be executed when the application is installed and you execute it or press a few buttons or something.
[Miscellaneous Android Development] diplomatic:
Ah yes, that is Android 5.1 indeed. That vendor made quite a stretch with the reported OS version. :) (The 'mtk-su -c' command was for the other guy.)

Have you restarted your phone since changing the script? Anytime you want to rerun magisk-boot, you have to reboot the device. Does Magisk Manager report that Magisk is installed after running the script? Also, if you're not getting the Magisk prompts, try making it Grant by default.
[Miscellaneous Android Development] diplomatic:
No, none of them are readable or writable by unprivileged users.

OK, I guess the Boost variant is Android 9, but the unlocked one is 10.

IDK, man. Those are very specific questions that tend not to get answered on these forums. The reason you got some kind of short-lived "root" prompts could be anything, a bug, an expectation of root by the app, or a million other things. These types of things should be taken with a lot of skepticism. As I said, you need actual evidence that you got any elevated permissions before drawing any optimistic conclusions.

And this is also not a general Mediatek or LG hacking thread....
[Miscellaneous Android Development] DragonFire1024:
Skepticism indeed. I've been around here long enough to know things take time if they happen at all. I did manage to install a couple of debugging applications that have allowed me to at least be able play around with some of the /system/bin. Also can do a 'run-as' on any of those debugged applications. I know there is some kind of mild privilege escalation going on because I can successfully form some of the bin actions that normally you wouldn't be able to without some level of privilege like...cat /proc/partitions so now I actually have a list of everything that's back there and so far nothing has stood out.

And I do realize it's not a general LG thread however there doesn't seem to be a forum for this device much less a single thread. So far as I know boost Mobile is the only one to come out with this phone and may possibly be the only ones to do so. this being a media tech device and seeing a few familiar faces is pretty much the only reason why I asked here and amongst the general help threads for any device.
[Miscellaneous Android Development] duncan.wick:
Yeah, I tried rebooting and also tried running the script manually. I installed Magisk manually through he Magisk Manager, should I not have? Also tried setting auto-response to Grant.

Edit: Just uninstalled Magisk, reinstalled the Manager, rebooted (had the script run) and Magisk manager then said 20400 is installed, but my issue persists.
[Miscellaneous Android Development] diplomatic:
You... installed Magisk manually through MM? Like, it actually succeeded in doing a Direct Install to your boot partition without any previous root setup? (The bootless root should have prevented that.) Then why are you bothering with this whole method? This script probably causes all kinds of conflicts. Your phone OS must be wide open with zero security whatsoever. That is often the case with these generic China knockoff devices....
[Miscellaneous Android Development] ConnCarl:
Issue with mtk-su, and Rortiz's Automated Root on a gen 7 HD8 running 5.6.4.0

Trying to gain root on a gen 7 HD8 running 5.6.4.0 (636558420).

All mtk-su steps go smoothly and result in a root prompt. But when I run Automated Root, it reports, "Could not find mtk-su binaries. Be sure to download them from the xda thread and put then in the corresponding folder!"

Apparently Rortiz's script is looking for the mtk-su binaries in /data/local/tmp2, whereas the instructions in this thread say to push them to /data/local/tmp. When I try to push to tmp2, I get: "remote permission denied".

I've rooted a couple of HD8s on 5.6.4.0, but I used a PC running Linux. Just trying to avoid digging that PC out if I can use Automated Root instead.

Thanks!
[Miscellaneous Android Development] thehondablaze:
Unexpected ) error when I try running mtk-su on 7.3.1.6

Whenever I try to execute the mtk-su on my 9th gen Fire 10 HD, I get the error below (even though I am in the right directory and I successfully chmod 755'd the file):

maverick:/data/local/tmp $ ./mtk-su

./mtk-su[1]: PK: not found

./mtk-su[2]: !Narm/UT: not found

./mtk-su[5]: syntax error: unexpected ')'

As a side note, I get the syntax error unexpected ) error line when trying to execute any other ZIP file such as magisk. What am I doing wrong or is this what happens for being 7.3.1.6? I was 7.3.1.2 I think it was last night but then I woke up to the dreaded update to 7.3.1.6 successfull message. I just received my new tab yesterday and I am looking into doing what I can toward achieving some sort of root for starters.

UPDATE: I put the mtk-su file from the ARM folder in the zip file and chmod 755 to it (and ls -l shows that it has the execute permissions) and I get the following error:

maverick:/data/local/tmp $ ./mtk-su -v

armv8l machine

Failed critical init step 4

Firmware support not implemented
[Miscellaneous Android Development] DB126:
Says it all - firmware has been patched; no longer vulnerable to mtk-su exploit
[Miscellaneous Android Development] thehondablaze:
Re: Fire 10 HD Maverick patched mtk-su exploit

Shucks - wish there was a way I could roll back to something earlier but I am guessing Fire has long enough ago started guarding against rollback attempts (even if I could just roll back to 7.3.1.0 if that is mtk-su vulnerable). If there were ever a way to flash a vanilla android version on this thing I'd do it.
[Miscellaneous Android Development] HemanthJabalpuri:
[MENTION=8132642]diplomatic[/MENTION]

Failed critical init step 1

Mediatek Helio G35 Android 10

No support for it right?
[Miscellaneous Android Development] diplomatic:
Hey [MENTION=8953766]HemanthJabalpuri[/MENTION],

Yeah, any Android 10 device is too new for this method. I'm not sure why it's failing at step 1, though, but that's been happening on some recent FWs.

(BTW, welcome back to this thread. I remember you from way back when this whole project got started... :))
[Miscellaneous Android Development] HemanthJabalpuri:
Thanks for your reply.

I have participated in this thread from 3rd page https://xdaforums.com/android/development/amazing-temp-root-mediatek-armv8-t3922213/post79392481 with a little script to flash supersu from within the booted device:).
[Miscellaneous Android Development] HemanthJabalpuri:
[MENTION=8132642]diplomatic[/MENTION]

I don't know if it is normal or not, but in my device(locked bootloader with stock recovery, Android 10) when I reboot to recovery and use adb root, I am getting root access in adb shell. But without unlocking bootloader and with Android 10 we can't tweak anything right?

Thanks
[Miscellaneous Android Development] amg314:
What are you going to tweak? What about SAR (System as Root) at your device ?

Try something like

adb shell pm list packages -d (list of frozen applications)

Then try to freeze not very important app like calculator

adb shell pm disable Calculator_package_name
[Miscellaneous Android Development] DragonFire1024:
adb shell pm uninstall --user 0 com.package.name

If it fails, add -k in front of --user and try again. This almost always works to disable system applications and is rarely patched. To bring them back to life simply use a file explorer and navigate to the application APK and click install. Application will be revived.

Used this method to disable built-in Chrome webview, in order to install Chrome beta, and use its available webview and the standard Android system webview installable from the Play store. Fair warning doing this may actually cause some of your other applications to not properly work. If things get out of hand and you think you broke something all will be fixed with a simple factory reset.
[Miscellaneous Android Development] diplomatic:
That's interesting...

The answer depends. You first have to mount the userdata partition to be able to tweak anything in Android. But pulling that off would be complicated since userdata is encrypted. (None of those previously mentioned "pm" commands will work outright.) The stock recovery never mounts userdata. TWRP can do it. You may be able to build a custom recovery and push its files to adb, then start it manually using some hacky process. But this is just a vague idea and it would presumably take a pretty complicated maneuver to pull off. A simpler experiment would be to try to flash a patched boot image and see if the BL will accept it. Alternatively try flashing a vbmeta image with verification disabled and check for the same thing... A lot of options you have there. The limiting factor is time.
[Miscellaneous Android Development] Pachacouti:
I've read this thread from start to finish, and yet to read the following: If mtk root is not working, it's actually because, from my understanding, you already HAVE a root shell, albeit system as root, in other words, system is / not /system. So theoretically, your root apps would work if the system directory was rewritten as / instead of /system, as in your root would be in /bin, not /system/bin, you already have SHELL dont you? The jokes on you and all still looking for a root SHELL you already have! ( for latest android users lol ), but since all partitions are now dynamic, and writing apps for a dynamic partition that may use partition 1 today, 32 tomorrow...

learn your NEW shell
[Miscellaneous Android Development] DragonFire1024:
I'm on Android Pie and I can say that's definitely not the case for me period not to mention that this phone is armeabi-v7a, the system or / isn't mounted as either. However the phone is "system as root." If what you say is true, then I must be doing something wrong because I can't get any of those applications to work no matter what I do (root apps).

One oddity is though according to mtkdroidtools su is present but "inaccessible" and that I should be able to spawn a root shell. Since I'm not at my desk I cannot give you the exact wording until I get home. But again if what you say is true and what Droid tools says is true, where is the root shell? I'll post the partition layout when I get home.
[Miscellaneous Android Development] jasonmerc:
Wanted to quickly say, tried this with the AT&T Radiant Core (Tinno U304AA) and it did not work. Tried both 32 and 64 bit versions.

It's running Android 9 Go, with Kernel 4.4.146
[Miscellaneous Android Development] diplomatic:
[MENTION=5006327]jasonmerc[/MENTION], did you get any kind of output besides "This firmware cannot be supported" or "Firmware support not implemented", or "Incompatible platform"?
[Miscellaneous Android Development] jasonmerc:
Just redownloaded and ran it again. Gives the following for arm:

Failed critical init step 4

This firmware cannot be supported

And this for arm64:

/system/bin/sh: ./mtk-su: not executable: 64-bit ELF file

So I assume I'm running 32 bit Android Pie Go then
[Miscellaneous Android Development] diplomatic:
[MENTION=5006327]jasonmerc[/MENTION], yeah so that phone is too new for this tool and can't be supported. And yes, the vendor only built the 32-bit version of Android, unfortunately.
[Miscellaneous Android Development] KUum:
[MENTION=8132642]diplomatic[/MENTION]

This is a log from mtk-su for Huawei Y5 lite 2018 (DRA-LX5). Earlier you wrote that this line of models has a kernel for which you need a special bypass. Have you checked it?
[Miscellaneous Android Development] mrmazak:
I think I am ready to share this tether-less method to use this wonderful temp root shell.

By using the termux app on your phone you can get this root shell to work with out needing pc and adb.

I also added few lines that will allow you to use 'DD' to make image backups of your partitions. ( thanks to the motivation I received from [MENTION=3924647]bigrammy[/MENTION] )

My main motivation with this, is to allow coping of boot.img and recovery.img. To be used to make root / twrp porting easier. And also full backups for device repair.

My script is on github https://github.com/mrmazakblu/Root-Backup-Helper

and the readme directions are here ;

TO Run MTK-SU and then the backup helper

Script to be used in android termux app

This process uses "curl" and "git" to sync with files on internet, so an active internet connection is needed.

Install termux and run these four commands
to make sure you have needed termux resources

pkg update
pkg upgrade
pkg install curl
pkg install git

Then curl this script to termux with the following commands

curl https://del.dog/raw/mtk-su.sh > mtk-su.sh
chmod 755 mtk-su.sh
./mtk-su.sh

This will download latest version of mtk-su, then check which version (32-bit or 64-bit)
that is needed to run on your device.
Then it will run the backup-maker script, and give the option to backup boot and recovery or all partitions.

There is no gaurantee that this mtk-su will work on your particular device. If you fail to complete the first method , using mtk-su and backup-helper together then after getting root (some other way) you can still run back-up helper by itself

To run just the Backup-help curl from this address

curl https://raw.githubusercontent.com/mrmazakblu/Root-Backup-Helper/master/dd-backup-maker.sh > maker.sh
chmod 755 maker.sh

Next part will need root to work. The method above includes a root step.

./maker.sh

At the end of the maker.sh, you will get 3 options.
1. run full backup
2. run backup of just boot and recovery
3. exit --without doing any backup
[Miscellaneous Android Development] ahhl:
[emoji106]should put this to first page. this will disappear once the thread becomes looongg.... [emoji16]
[Miscellaneous Android Development] shiningwizard:
Hi I'm trying this out on the vivo v15 (mediatek version). I can't perform the chmod +x on the mtk-su, both through adb shell. The permissions just don't take hold. Any idea how i can do so?

As for termux, i am unable to access /sdcard/mtk-su. I get permission-denied error.

----------------------

never mind, this is solved. I used the script from mrmazak to install the mtk-su.

However, i'm getting the error "Failed critical init step 4: Not a typewriter". Any suggestions? Does it mean i can't root the vivo v15? Its chipset is H70 aka MTK6771V/CT.
[Miscellaneous Android Development] ipdev:
Great project.

You can add BLU R2_LTE (MT6735) to the working list.

BLU S1 also. I know it's grouped into the BLU R1 line.

I tried this on my newer Nook 7 (BNTV46)

It is a MT8163 chip running 32-Bit Android 8.1.0 Go.

Appears to be the MT8163-v/b version.

I know arm7 is not supported.

Will this work on an MT65xx or MT8127?

No, there is no support for 32-bit chips.

Still hopefully this will help in some way.

Not asking for arm support but, maybe this will help for further development.

Since MT8163 is a 64-Bit chip.

On my Nook 7.

adb shell and terminal emulator (jackpal) did not work for me.

mtk-su -s gave no output in adb or terminal emulator.

Gave Termux a shot.

Never used it before.

Attached files.

Termux mtk-su -v (mtksu-v.txt)

Termux mtk-su -s (mtksu-s.txt)

Added .zip to mtksu-v.txt to get past upload restriction. It is not zipped.

Output lines from adb terminal emulator and termux shell. (shells.txt)

Cheers. :)
[Miscellaneous Android Development] diplomatic:
(gone)
[Miscellaneous Android Development] diplomatic:
OK, good to know. So it's Android 9 with MT6771.... That message means I will have to look into the firmware and tune the program to make support for it. Do you happen to have a link to the firmware and/or kernel sources of any MT6771 phone? But FYI, this is only temporary root. This isn't like installing Magisk or something.

Nice! Thanks for the feedback about the BLUs.

Yeah, it should support that tablet. The piece about 32-bit not being supported is only about 32-bit hardware. MT8163 is all good.

The problem looks like another case of stack protection gone undetected. This just happens to be something I fixed in R13 that I just uploaded. Can you test that version?

It's strange that Terminal Emulator did not work for you. What is the output of 'id' on that shell? It may have something to do with the selinux context. Either way, I have some work to do :)
[Miscellaneous Android Development] shiningwizard:
Yes it's Android 9 with MT6771. Temp root is good enough for now. The only thing i can find is here: http://asia-sysupwsdl.vivoglobal.co...1831F_EX_A_1.11.11-update-full_1556551958.zip

On the same subject, is there any perm root solutions for MTK SoCs? MTKDroidtool is no longer working.
[Miscellaneous Android Development] ipdev:
Quickly tried r13.

Sorry to say, still no root.

id

adb shell
uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:shell:s0

Terminal Emulator
uid=10080(u0_a80) gid=10080(u0_a80) groups=10080(u0_a80),3003(inet),9997(everybody),20080(u0_a80_cache),50080(all_a80) context=u:r:untrusted_app_25:s0:c512,c768

Termux
uid=10081(u0_a81) gid=10081(u0_a81) groups=3003(inet),9997(everybody),20081(u0_a81_cache),50081(all_a81)

I will have time to test tomorrow (now today) after work. :D
[Miscellaneous Android Development] mrmazak:
Here is hoping you get that nook working with MTK-SU. Because it has same soc as the about to be released tablet I was thinking of pre-ordering
[Miscellaneous Android Development] diplomatic:
[MENTION=5312578]mrmazak[/MENTION], there's already at least 7 MT8163 devices known to work with mtk-su. This problem with the Nook is specific to how the kernel on it is built. Currently working to take care of it. So that probably has nothing to do with that tablet you're talking about.
[Miscellaneous Android Development] diplomatic:
[MENTION=1311712]shiningwizard[/MENTION], check your PMs.
[Miscellaneous Android Development] diplomatic:
Release 14

A new version has been uploaded. Check it out, especially if you have an Android 8+ device. This release no longer requires using a terminal app for the first run on newer Androids. That change is less due to a new development, but more to a removal of a restriction that was never really necessary. As always, let me know if anything broke for already compliant devices. If that's the case, use a previous release until I fix it.
[Miscellaneous Android Development] AccountForXDA:
[MENTION=8132642]diplomatic[/MENTION] Sorry, didnt see your message from a month ago. Tested V14 on my Huawei MT6735 32bit kernel phone and it works. I've PM'd you the verbose output
[Miscellaneous Android Development] bigrammy:
[MENTION=8132642]diplomatic[/MENTION]

v14 Run on XA1 using adb shell and it executed first time without issue at all :good:

bigrammy@bigrammy ~ $ adb push ~/devtools/mtk-su/mtk-su_r14/arm64/mtk-su /data/local/tmp
501 KB/s (30464 bytes in 0.059s)
bigrammy@bigrammy ~ $ adb shell
G3121:/ $ chmod 755 /data/local/tmp/mtk-su
G3121:/ $ ./data/local/tmp/mtk-su
New UID/GID: 0/0
/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/ta of=/sdcard/ta.img
4096+0 records in
4096+0 records out

:D
[Miscellaneous Android Development] chauhanjayc:
Got It all well

Fricking heellllll I am now rooted:p

Device XA1 Plus G3416

Mediatek MT6757 Helio P20 (16 nm)
[Miscellaneous Android Development] NFSP G35:
Tried r15 with one of the new Walmart ONN 10.1" tablets (ONA19TB003)

It should have a supported MT8163 according to what I could find online.

arm64 just gave me: "Failed critical init step 1"

arm gave slightly more:

ONA19TB003:/data/local/tmp $ ./mtk-su -v
armv8l machine
Failed critical init step 1
[Miscellaneous Android Development] diplomatic:
[MENTION=4519203]NFSP G35[/MENTION], thanks for trying. I was actually curious about that new Walmart tablet. (It definitely has an mt8163, right?) That result doesn't sound promising at all. It may be that a certain loophole in the OS has been sealed off.

Update: The Walmart tablet is actually compatible with mtk-su. :) Work is in progress to add support for it. There are a couple of odd things about it that need to be accounted for...