yashsingh1/xdaforums huggingface dataset:
[Miscellaneous Android Development] bibikalka:
It's kind of coming back to me now. The original DirtyCow focused on replacing files, but in principle the way it was advertised is that it can overwrite any arbitrary memory that you can currently read, given your level of selinux permissions. So if you have enough privileges from the adb shell to read the memory where your favorite kernel variables reside (as you do with mtk-su), you should be able to overwrite that with DirtyCow. It appears mtk-su automatically finds the address it needs for a given MTK device, and then does its thing. So conceptually, you seem to start in the same place as DirtyCow would, and have enough information to proceed with DirtyCow.

In many posts with DirtyCow, people focused on overwriting system files with the correct selinux privileges to then did stuff like write into recovery, or other partitions. The goal was to fully unlock the device, or at least to root it permanently. Getting a good root shell was rarely the end goal. But DirtyCow does not limit you to replacing just files, it should enable you to overwrite any memory that you can read.

With mtk-su, you put lots of effort to get a tool to get a good root shell, and, it seems the method is pretty robust. Could not DirtyCow overwrite the same kernel variables as you do now, and get a good shell for devices that are not the vulnerable MTK family?

---------- Post added at 03:05 AM ---------- Previous post was at 02:29 AM ----------

@diplomatic

Ok, I re-read your original Amazon thread. You mentioned that you could read/write any location in memory. So if you cannot read that memory from adb shell on non-mtk, then you escalate a bit - overwrite some system file with enough access, and then try to read the same memory again using this overwritten higher privilege command.

Or do you think that on non-mtk there is simply no way to read the kernel variable memory, which would then preclude dirtycow from overwriting it?
[Miscellaneous Android Development] diplomatic:
Cool! Can you tell me the "type:" number that it says on the first line of -v output, though?

The selinux state has always behaved that way. It stays permissive until you manually change it to enforcing.

Yes, you can run the script from Termux. But you have to change the paths in it to point to the right package name and bin directory.

No userspace process on Android can legitimately read arbitrary memory addresses. Only the kernel can do that. The only way I see that might possibly accomplish this is to insert a custom kernel module. That would rest on whether the permissions gained by that exploit are enough for that....
[Miscellaneous Android Development] mrmazak:
terminal output

Microsoft Windows [Version 10.0.17134.765]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Users\Mr>adb shell ls /data/local/tmp

C:\Users\Mr>adb push C:\Users\Mr\Downloads\mtk-su_r15\arm64\mtk-su /data/local/tmp/
C:\Users\Mr\Downloads\mtk-su_r15\arm64\mtk-su: 1 file pushed. 1.9 MB/s (30464 bytes in 0.015s)

C:\Users\Mr>adb shell
F1:/ $ cd /data/local/tmp
F1:/data/local/tmp $ ls
mtk-su
F1:/data/local/tmp $ chmod +x ./*
F1:/data/local/tmp $ ./mtk-su -v
param1: 0x1000, param2: 0x8040, type: 14
Building symbol table
kallsyms_addresses pa 0x40e74200
kallsyms_num_syms 49877, addr_count 49877
kallsyms_names pa 0x40ed5a00, size 635449
kallsyms_markers pa 0x40f70d00
kallsyms_token_table pa 0x40f71400
kallsyms_token_index pa 0x40f71800
Patching credentials
__ksymtab_init_task not found
Parsing current_is_single_threaded
ffffff80083a8ad4+44: ADRP x8, 0xffffff80097a5000
ffffff80083a8ad4+48: ADD xd, x8, 1216
init_task VA: 0xffffff80097a54c0
Potential list_head tasks at offset 0x480
0xffffffc05ff31480 0xffffffc0282bb480 0x000000000000008c
comm swapper/0 at offset 0x758
Found own task_struct at node 0
real_cred VA: 0xffffffc058226e40
Parsing avc_denied
ffffff8008337330+10: ADRP x11, 0xffffff8009a2c000
ffffff8008337330+14: LDR [x11, 1672]
selinux_enforcing VA: 0xffffff8009a2c688
Setting selinux_enforcing
Switched selinux to permissive
New UID/GID: 0/0
starting /system/bin/sh
F1:/data/local/tmp #
[Miscellaneous Android Development] Ahateon:
Xperia XA1 Bootless Magisk Root works!!!

Anyway, what about magisk modules?
[Miscellaneous Android Development] diplomatic:
I have not tested Magisk modules with this script. I see they don't work for some reason. Looking into it. Maybe someone figured it out already?

EDIT: OK, so I figured out the problem with Magisk modules. It was due to a conflict between the Magisk version we use and the environment that MM sets up when you answer Requires Additional Setup, which comes from the latest version. This is mainly about the files placed in /data/adb/magisk . I just detailed a workaround for this in step 4 of the instructions. If you use a custom URL for update checking it will set up the environment from v18.1. The URL that points to the old package is: https://raw.githubusercontent.com/topjohnwu/magisk_files/841e978604f989d04549013cd4dcc7e34aea5288/stable.json . If you already did the Additional Setup, just delete the file /data/adb/magisk/util_functions.sh and restart MM. It will ask you again about the Setup, but this time use the right version.
[Miscellaneous Android Development] bigrammy:
[MENTION=3701480]chauhanjayc[/MENTION]
[MENTION=5411508]Ahateon[/MENTION]

Can you please report your success back to the XA1 users :good:

This will help other Sony XA1 or any Sony (mtk) based devices owners.

Thread here incase you forgot it https://xdaforums.com/xa1/how-to/april-2019-ta-backup-unlocking-t3922565 :o
[Miscellaneous Android Development] Ahateon:
Bootless magisk modules

Ok, modules seems working (curl), but font doesn't apply (Product Sans). Init.d support should run script with no delay, after boot, but it's delayed :/

Edit: Ok, at this time modules are useless. Most of them (eg. apk, fonts) won't work as expected. I've tried Youtube advanced, some fonts, binaries... they are available AFTER script execution, so too late for proper work
[Miscellaneous Android Development] diplomatic:
[MENTION=5411508]Ahateon[/MENTION], all the Magisk enhancements only get mounted when the app runs the init script. The app can only run it after it's started by the OS. Not much that can be done about that. You're just gonna have to deal with it or unlock the BL.
[Miscellaneous Android Development] Ahateon:
This script will backup on mtk devices (should, on XA1 works) TA, FOTAKERNEL, OEM, OEMKEYSTORE partitions. Root required. Use tsu/tsudo command on termux. Have a nice day!!!

https://www.dropbox.com/s/6kjs150nxkuoofz/backup.sh?dl=0
[Miscellaneous Android Development] chauhanjayc:
so root work after first boot time

i able to apply swipe gesture root and it was able to hide my stock navigation as getting root support, but no success in font or deleting apk from system/app.
[Miscellaneous Android Development] mukhlesur.millon:
Does not work on vivo Y81i (Mediatek MT6761 Helio A22 (12 nm))

Does not work on vivo Y81i (Mediatek MT6761 Helio A22 (12 nm))

$ ./mtk-su -v

param1: 0x1000, param2: 0x8040, type: 13

Building symbol table

Can't find kallsyms addresses

Unable to get kernel symbol table

New UID/GID: 2000/2000

$ cat /proc/kallsyms | head -n 10

0000000000000000 T do_undefinstr

0000000000000000 T _stext

0000000000000000 T __exception_text_start

0000000000000000 T do_sysinstr

0000000000000000 T do_mem_abort

0000000000000000 T do_sp_pc_abort

0000000000000000 T do_debug_exception

0000000000000000 t gic_handle_irq

0000000000000000 t gic_handle_irq

0000000000000000 T __exception_text_end
[Miscellaneous Android Development] Rortiz2:
[MENTION=8132642]diplomatic[/MENTION] bootless root working on BQ M8!

Thanks!
[Miscellaneous Android Development] JunioJsv:
diplomatic wave I'm making an app based on your script. Theoretically my app is root with just one click on mediatek cell phones. But it is not completely complete, so I wanted your help, github repository link https://github.com/JunioJsv/mediatek-easy-root
[Miscellaneous Android Development] chauhanjayc:
Trying your app now.
[Miscellaneous Android Development] CEEXOTA:
I can't install xposed?
[Miscellaneous Android Development] guizzzmo:
i just try your app on new amazon fire 7 2019 9th generation and "root failed" :(

for mtk-su command on amazon fire 7 2019 we have that:

mustang:/data/local/tmp $ ./mtk-su -v

armv7l machine

param1: 0x1000, param2: 0x8040, type: 1

Building symbol table

Can't find kallsyms addresses

Unable to get kernel symbol table

New UID/GID: 2000/2000

starting /system/bin/sh

mustang:/data/local/tmp $
[Miscellaneous Android Development] ilya980:
This does not work :( My phone keeps updating despite automatic updates disabled. I tried disabling notifications for "Software Update" process, but it did not help either. The phone would bring the update screen, lock all functions until I either click update or remind me later, and after 4 or 5 reminders it would install updated regardless and reboot without allowing me to do anything. Now I am on Jan 1 2020 and root is gone. :(

I have another identical phone that has not yet updated. Is there ANY way to prevent it from updating while root is still there? Any way to disable those software update checks? Any way to dump partitions and restore back after update? Thanks.
[Miscellaneous Android Development] azaopung257:
I
[Miscellaneous Android Development] azaopung257:
t3922213
[Miscellaneous Android Development] azaopung257:
[0] Linux version 3.18.35 (NRD90M@AndroidServer) (gcc version 4.8 (GCC) ) #1 SMP PREEMPT Mon Nov 20 13:15:55 WIB 2017
[Miscellaneous Android Development] luridphantom:
whats your carrier? i know carriers like cricket will force updates no matter what you do

next time you have temp root use titanium backup to freeze any software update related apps on the device
[Miscellaneous Android Development] ilya980:
AT&T. They forced update on me no matter what I did. What do you mean next time? Is there a temp root for Jan 1 2020 firmware? mtk-su says "firmware cannot be supported".

I actually tried titanium, but for some reason it did not work. It could not stop some processes, like as if there are other built-in apps that prevent this. I haven't seen this on Android, but on a PC sometimes you cannot kill a process using a task manager even with administrative rights. The system will not allow it.
[Miscellaneous Android Development] F308:
Once upon a time, to get rid of operating system updates, I found application which was responsible for it then moved it away.

I don't remember name, though, and of course it was possible only on rooted phone.
[Miscellaneous Android Development] ilya980:
Today I found that my phone does not see any of the 5 GHz WiFi networks. There a a lot of places around me that only have 5 GHz WiFi. The phone specs say 802.11 a/b/g/n/ac (2.4Ghz, 5Ghz) + MIMO, but I can't see how to turn 802.11a (5GHz) on. Same with my wife's phone. How do I use 5 GHz Wifi with this phone? The phone is LG K40 AT&T (LM-X420AS). I set up both 2.4 GHz and 5 GHz AP's with my router. The phone only sees 2.4 GHz AP.
[Miscellaneous Android Development] luridphantom:
might be your phone, my unrooted lg rebel 4 doesnt see 5ghz networks either unfortunately
[Miscellaneous Android Development] ilya980:
My phone? My wife also has LG K40 AT&T and she does not get 5GHz either. Is sounds unlikely that both phones would be "defective" the same way.

The LG rebel 4 is not supposed to see 5 GHz.

https://www.lg.com/us/cell-phones/lg-L211BL WiFi Connectivity b/g/n. That is 2.4 GHz only.

My phone should have 802.11 ac, which is 5 GHz. Here is the official spec sheet. https://www.lg.com/us/support/products/documents/Spec Sheet_LG_K40_Unlocked.pdf

Does anyone have unlocked LG K40 or at least not AT&T provider and could confirm whether 5 GHz WiFi is working? Has AT&T disabled the 5 GHz WiFi with their firmware???
[Miscellaneous Android Development] 4096abcd:
HTC Desire 19+ (mt6765)

Working on 1.10.709.3 and below

Not working on 1.11.709.3 (final version)
[Miscellaneous Android Development] Valtazar:
ZTE Blade A530 (MT6739)

Android 8.1.0

I'm not sure how, but it seems it worked. Tnx
[Miscellaneous Android Development] ilya980:
I am on March 1, 2020 (i.e. without mtk-su) and I am able to dump partitions with mtk client (https://xdaforums.com/t/unlocking-bootloader-for-all-mtk-devices.4349243/) from my AT&T LG K40.

Will this method unlock the bootloader on AT&T locked LG K40? Does it mean that custom ROM is now possible? I am worried that if I try "python mtk xflash seccfg unlock" I will get a brick. Has anyone tried it?

My dump of seccfg is 8 MB, but only the first 60 bytes have something in them, the rest are zeros.
[Miscellaneous Android Development] CXZa:
Nope. If you mean mtk-su. If the other program then this is the wrong thread.
[Miscellaneous Android Development] thieftime1980:
Can be unlocked. device running on MT8766 ?
[Miscellaneous Android Development] Tech0308:
Try it! It depends on if it's patched so you won't know until you try and unless you do something really silly there's no danger...
[Miscellaneous Android Development] thieftime1980:
and how to try what program ?
[Miscellaneous Android Development] kww__:
i'd suggest to look at 3rd post in this topic

link: https://xdaforums.com/t/amazing-temp-root-for-mediatek-armv8-2020-08-24.3922213/post-79354355
[Miscellaneous Android Development] Luckas Magalhães:
Motorola Moto G8 Power Lite (blackjack) the following error appears in step 7:

Someone to help me?
[Miscellaneous Android Development] silentashes:
Anybody have a cpu- compatible version of mtk su still they can share or DM?

8.1.0 GO

Security Patch level April 2019

ARMv7 Processor rev 5 (v7l)

Board: VLE5

DROID INFO REPORT

DEVICE

Model: VLE5 (Poblano)

Manufacturer: Hot Pepper Inc

Baseband Version: MPSS.JO.3.0-00429-8909_GEN_PACK-1

RIL Version: Qualcomm RIL 1.0

Build Number: HPP-VLE5190413

Build Fingerprint: HotPepper/Poblano/VLE5:8.1.0/OPM1.171019.011/30:user/release-keys

Bootloader: unknown

Java VM: ART 2.1.0

OS Version: O MR1 (8.1.0)

SDK: 27

DISPLAY

Resolution: FWVGA, 480x854 pixels

Software Density: 204 dpi

Refresh Rate: 60 Hz

PROCESSOR

CPU Architecture: ARMv7 Processor rev 5 (v7l)

Board: VLE5

Chipset: Qualcomm Technologies, Inc MSM8909

Cores: 4

Clock Speed: 1094 MHz - 1094 MHz

Instruction Sets: armeabi-v7a, armeabi

CPU Features: half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm

CPU Governor: interactive

Kernel Version: 3.18.71-perf

Kernel Architecture: armv7l

GRAPHICS

Renderer: Adreno (TM) 304

Vendor: Qualcomm

OpenGL Version: OpenGL ES 3.0

RAM

Total: 894 MB

Java Heap: 96 MB

STORAGE

Internal: 5.2 GB

EXTERNAL: Not Detected

FEATURES

Bluetooth: Yes

Bluetooth LE: Yes

GPS: Yes

NFC: No

USB Accessory: Yes

WiFi: Yes

WiFi Direct: Yes

BATTERY

Technology:

Health: Good

SENSORS

stk8baxx-accel

txc_alsprx-proximity

txc_alsprx-light

Created by Droid Info
[Miscellaneous Android Development] AdamProgrammer:
Hi,

I have this error code when I execute this on OPPO A5S CPH1909 ;

CPH1909:/data/local/tmp $ ./mtk-su -v

armv8l machine

Failed critical init step 1

Does someone knows what is the problem please?
[Miscellaneous Android Development] vayaviya:
I have the same error "Failed critical init step 1" with Vivo Y21. Any help pls.
[Miscellaneous Android Development] susetoyix:
[deleted]
[Miscellaneous Android Development] גלגל:
Works great on soyes xs 12

you're huge
[Miscellaneous Android Development] ToxaMacTep:
Huawei GR3 (TAG-L21) - works!
[Miscellaneous Android Development] Skorpion96:
i really hope someone does a similar method for unisoc devices.
[Miscellaneous Android Development] Bom jonas:
:love:🤣
[Miscellaneous Android Development] sketchscarz:
/data/user/0/juniojsv.mtk.easy.su/files/magisk-boot.sh[124]: ./mtk-su: Permission denied

exit: 1

This is the result I get on my revvl v tmrvl4g
[Miscellaneous Android Development] Biggie_still:
I'm guessing this won't work on vivo devices running Android 5.1
[Miscellaneous Android Development] Biggie_still:
Mtk-easy-su 2.1.0

extracted magisk-boot.sh

extracted 32/magiskinit

extracted 64/magiskinit

extracted 32/mtk-su

extracted 64/mtk-su

[0]

[0] 5.1

[0] Thu May 5 18:07:23 WAT 2022

[1] ls: Unknown option '-1'. Aborting.

[0] Processor : AArch64 Processor rev 2 (aarch64)

processor : 4

BogoMIPS : 26.00

Features : fp asimd aes pmull sha1 sha2 crc32

CPU implementer : 0x41

CPU architecture: AArch64

CPU variant : 0x0

CPU part : 0xd03

CPU revision : 2

processor : 5

BogoMIPS : 26.00

Features : fp asimd aes pmull sha1 sha2 crc32

CPU implementer : 0x41

CPU architecture: AArch64

CPU variant : 0x0

CPU part : 0xd03

CPU revision : 2

Hardware : MT6750

[0] MemTotal: 2827584 kB

MemFree: 43256 kB

Buffers: 7496 kB

Cached: 683148 kB

SwapCached: 2572 kB

Active: 1495052 kB

Inactive: 634876 kB

Active(anon): 1156652 kB

Inactive(anon): 297292 kB

Active(file): 338400 kB

Inactive(file): 337584 kB

Unevictable: 11100 kB

Mlocked: 48 kB

SwapTotal: 524284 kB

SwapFree: 52528 kB

Dirty: 960 kB

Writeback: 0 kB

AnonPages: 1448568 kB

Mapped: 495200 kB

Shmem: 3512 kB

Slab: 138412 kB

SReclaimable: 58288 kB

SUnreclaim: 80124 kB

KernelStack: 57168 kB

PageTables: 51540 kB

NFS_Unstable: 0 kB

Bounce: 0 kB

WritebackTmp: 0 kB

CommitLimit: 1938076 kB

Committed_AS: 60463900 kB

VmallocTotal: 251658176 kB

VmallocUsed: 784344 kB

VmallocChunk: 250780928 kB

Error running exec(). Command: [free] Working Directory: null Environment: null[0] Linux version 3.10.72+ (compiler@compiler025) (gcc version 4.9 20140514 (mtk-20150408) (GCC) ) #1 SMP PREEMPT Wed Apr 21 21:42:06 CST 2021

[1] /data/data/juniojsv.mtk.easy.su/files/magisk-boot.sh[13]: dirname: not found

/data/data/juniojsv.mtk.easy.su/files/magisk-boot.sh[113]: cd: /64: No such file or directory

deleted magisk-boot.sh

deleted 32/magiskinit

deleted 64/magiskinit

deleted 32/mtk-su

deleted 64/mtk-su
[Miscellaneous Android Development] Biggie_still:
Can't acquire root privileges (May 5 at 6:06:20 PM)

Executing scripts from /storage/emulated/0/init.d (May 5 at 6:06:20 PM)

magisk-boot.sh

Temporary root by diplomatic@XDA

Home URL:

https://xdaforums.com/android/development/amazing-temp-root-mediatek-armv8-t3922213

--------------------------------------------------

cmp: invalid option -- s

cmp: invalid option -s

cmp: invalid option -- s

cmp: invalid option -s

0000000000000000 is not a valid address

UID: 10012 cap: 0000000000 selinux: permissive

/system/bin/sh: [33]: [: gid=10012(u0_a12): unexpected operator/operand

Unable to chmod /sys/dev/block/179:20/uevent: Operation not permitted

Load policy from: /sys/fs/selinux/policy

open: /sys/fs/selinux/load failed with 13: Permission denied

mount: Operation not permitted

Unable to chmod /root: Read-only file system

ln: /sbin/*: Permission denied

Error making /sbin hardlinks

setenforce: Could not set enforcing status: Permission denied
[Miscellaneous Android Development] Biggie_still:
Any help
[Miscellaneous Android Development] phigan:
Umidigi X with MT6771V no worky. Failed critical init step 4. This is Android 9 and security patch level Aug 5, 2019. Kernel version is somehow 4.4.146+ from May 9 2020. Build number is UMIDIGI_X_V1.0_20190912.
[Miscellaneous Android Development] catapult1:
Thanks! It works on Cubot Rainbow 2 (MT6580A)

mtk-su version: r23 arm

Android version: 7.0

Security patch: 5 February 2017

Build: CUBOT_RAINBOW 2_7021C_V04_20170221
[Miscellaneous Android Development] catapult1:
Confirmed working on Oukitel K6000 Pro (MT6753)

mtk-su version: r23 arm64

Android version: 6.0

Security patch: 5 October 2016

Build: OUKITEL_K6000_Pro_FZ_V12_20161129
[Miscellaneous Android Development] likwidchz:
Hiya everyone,

I'm having a weird time trying this. I have two tablets,

Tablet 1 = firmware 5.3.7.0 Nov 17th 650601220

Tablet 2 = firmware5.6.6.0 May 14th 654620620

I'm trying to execute the mtk-su exploit. Ive tried the R22 and R23 releases and all of them spit out

Both of the tablets do exactly the same thing, see the output below.

user@OldHPNoteBook:/usr/src/suez/amonet/r22/arm64$ adb push mtk-su /data/local/tmp

mtk-su: 1 file pushed. 3.7 MB/s (65216 bytes in 0.017s)

user@OldHPNoteBook:/usr/src/suez/amonet/r22/arm64$ adb shell

shell@suez:/ $ cd data/local/tmp

shell@suez:/data/local/tmp $ chmod 755 mtk-su

shell@suez:/data/local/tmp $ ./mtk-su

Failed critical init step 4

1|shell@suez:/data/local/tmp $

What's the scoop with the exploit? Let me know if I'm doing something weird.

Thank you,

Take care.
[Miscellaneous Android Development] carlosyoan99:
It work with my LG-US601. Now I have Magisk 21.4 and it work very well, the only problem is that take 3-4 minutes to start Magisk.

Good job!

Thanks.
[Miscellaneous Android Development] jmarrr:
Amazon Fire HD 8 2017 Fire OS 5.7 doesn't seem to work; just posting in the off chance that this gets updated.
[Miscellaneous Android Development] daitalos:
I'm not sure for this device & Rom but read & here : https://xdaforums.com/t/rapid-temporary-root-for-hd-8-hd-10.3904595/

(I think OS 5.6.4 there for hd8 '17) ...
[Miscellaneous Android Development] jmarrr:
Yeah, I tried that already, thanks though.

I think I'd have to downgrade to 5.6 and that felt like a lot of work (you have to take the device apart and short some pins? No thanks)
[Miscellaneous Android Development] daitalos:
I don't think downgrading is a good idea ..
[Miscellaneous Android Development] Rortiz2:
You don't really need to open the device if the LK is still vulnerable to the fastboot brick exploit. Check the unlock thread for further information. And as a FYI, downgrading (can you even do that nowadays?) will brick your device (you'll have to open it to unbrick it) because of RPMB.​
[Miscellaneous Android Development] nnnbbbsss:
Is there any worked method for RN8P MIUI12 A11 April patch?
[Miscellaneous Android Development] TAMER99:
MTK EASY SU IS WORKING MICROMAX Q349
[Miscellaneous Android Development] kurdiak:
another device rooted successfully, oukitek K3, by this method. Although I could root K3 by unlocking bootloader and then flashing patched magisk image, but it lead to imei loss. But with your method everything was perfect.
[Miscellaneous Android Development] andPS2:
so how can i pass safetynet on fire hd 10 (9th gen)

i tried magisk 21.4 and 20.4 but when trying

to install safetynet-fix and MagiskHidePropsConf

i tells me magisk 19 or 20.4.1 are needed (cant find that version)

root itself works with no problems but i dont even get basic

profile to greenlight

thanks for any tips!

p.s. so i got basic integration to pass but for cts profile match i

need magiskhidepropsconf but cant install it always says

install magisk 20.4+ ...

p.s.s. strange thing magisk 21.4 always says requires additional

setup after yes and reboot it still says that
[Miscellaneous Android Development] andPS2:
so i managed to install safetynet-fix-v2.3.1 and

MagiskHidePropsConf-6.1.2 by installing Magisk 21.4 and updating the

(manager) app to 22.1

i set the device props to samsung galaxy a7

but still it fails CTS profile match

any ideas?
[Miscellaneous Android Development] andPS2:
so the version with magisk higher than 22.0 just wont

load for me

it says sccripted executed but when looking in the app it shows

magisk not installed
[Miscellaneous Android Development] Flash1993:
I am using the guide with mtk-su_r23 on Ubuntu and am not sure if I should have this:

shell@suez:/ $ cd /data/local/tmp

shell@suez:/data/local/tmp $ ./mtk-su

UID: 0 cap: 3fffffffff selinux: permissive

Sorry in advanced if I am such a noob. Also this is for a Kindle Fire HD 10 7th Gen on Fire OS 5.6.4.0 (636558520)
[Miscellaneous Android Development] VashTS:
Ive got a fire hd10 9th gen that won't boot for me but is recognized on USB under Linux. Is there any hope with reflashing stock firmware from there?

I'm thinking that's all it needs but I'm new to the fire tablet. I got this for free because it just "stopped working" from a stranger on facebook lol. I have no idea why it's not booting but I tried all button combos and no go.