yashsingh1/xdaforums huggingface dataset:
[Miscellaneous Android Development] dgputopang:
I tested on Vivo Y93. No luck.

My mtk-su output is as follows:

$ ./mtk-su -v

param1: 0x1000, param2: 0x8040, type: 13

Building symbol table

kallsyms_addresses pa 0x4117d000

kallsyms_num_syms 55330, addr_count 55330

kallsyms_names pa 0x411e9300, size 732637

kallsyms_markers pa 0x4129c100

kallsyms_token_table pa 0x4129c800

kallsyms_token_index pa 0x4129cc00

Patching credentials

Parsing current_is_single_threaded

ffffff80083c6b98+58: ADRP x0, 0xffffff8009a85000

ffffff80083c6b98+5c: ADD xd, x0, 2368

init_task VA: 0xffffff8009a85940

Potential list_head tasks at offset 0x4f0

comm swapper/0 at offset 0x7c0

Found own task_struct at node 1

cred VA: 0000000000000000

0000000000000000 is not a valid address

Parsing avc_denied

ffffff800835d5b0+10: ADRP x4, 0xffffff8009f06000

ffffff800835d5b0+20: LDR [x4, 3644]

selinux_enforcing VA: 0xffffff8009f06e3c

Setting selinux_enforcing

Selinux is already permissive

setns failed: Permission denied

starting /data/data/com.termux/files/usr/bin/bash

UID: 10170 cap: 0000000000 selinux: permissive
[Miscellaneous Android Development] diplomatic:
All right, sweet! That points to something being messed up in the /data/adb directory. When you deleted the files there, you did it when Magisk wasn't running, right? If you feel like testing it, you can try to wipe it again after a reboot (no need for factory reset).
[Miscellaneous Android Development] Tmoney2019x:
Tecno KB7j (

Magisk not installed on tecno spark 3. I have done everything I could read and think off. Kindly assist.

Can't acquire root privileges (Sep 21, 2019 6:35:10 AM)

FYI:

Executing scripts from /storage/emulated/0/init.d (Sep 21, 2019 6:35:10 AM)

suboot.sh

UID: 0 cap: 3fffffffff selinux: permissive

source type magisk does not exist

Error in: allow magisk (null) (null) (null)

Bad system call

Bad /sbin mount?
[Miscellaneous Android Development] kenshinta:
for Meizu users

Had a chance to factory reset my Meizu M6 to study how the bootless root can work - and discovered what caused my issues before.

It was Meizu/ Flyme Security app function for Background processes - they implement a special "Smart Background" setting as default behaviour for installed apps. For Magisk I think that though the app is allowed to background run it suppresses the popup prompts. Changing that to "Allow Running in Background" let's Magisk superuser prompts and grants happen.

Also , by setting the initd app to "Allow Running in Background" finally lets autorun at boot happen.

HTH to other Flyme/ Meizu users and thanks [MENTION=8132642]diplomatic[/MENTION] for this root solution.
[Miscellaneous Android Development] diplomatic:
Try the mtk-su in post 413. If that doesn't work, post the output of 'mtk-su -v'.
[Miscellaneous Android Development] diplomatic:
Glad you figured it out and happy you are grateful for this method.... ;)
[Miscellaneous Android Development] Tmoney2019x:
Tecno KB7j (

[IMG="mtk-su -v"]https://drive.google.com/file/d/0B3dpplBhkQ9dWXMxMU1FLWhoa3VJOTJGcjlRVnRUTUNnczJF/view?usp=drivesdk[/IMG][/QUOTE]

I was able to get temporary root access through mtk-su but suboot.sh didnt work.

Can't acquire root privileges (Sep 22, 2019 5:59:57 AM)

Executing scripts from /storage/emulated/0/init.d (Sep 22, 2019 5:59:57 AM)

suboot.sh

UID: 0 cap: 3fffffffff selinux: permissive

source type magisk does not exist

Error in: allow magisk (null) (null) (null)

Bad system call

Bad /sbin mount?ajayitomilola@yahoo.com

---------- Post added at 05:46 AM ---------- Previous post was at 05:26 AM ----------

@diplomatic pls find attached as requested.
[Miscellaneous Android Development] diplomatic:
[MENTION=10134915]Tmoney2019x[/MENTION], I don't see any attachments. There's a broken link or something, at the top. Can you just paste the text output? There's never a reason to do a screenshot of text window if all you want is the text.

OK, I dug up your screenshot. But actually, the info that I need has to be obtained from a

terminal emulator

, not adb. I should have mentioned that, my bad. The adb output is different and has nothing about seccomp, which is the problem here.
[Miscellaneous Android Development] Tmoney2019x:
Tecno KB7j (

:/ $ echo hello world

hello world

:/ $ fsck_msdos

usage: fsck_msdosfs -p [-f] filesystem ...

fsck_msdosfs [-ny] filesystem ...

1|:/ $ fsck -AR -y

/system/bin/sh: fsck: not found

127|:/ $ fsck_msdos -AR -y

fsck_msdos: invalid option -- A

usage: fsck_msdosfs -p [-f] filesystem ...

fsck_msdosfs [-ny] filesystem ...

1|:/ $ cp /sdcard/mts-su_20190822a/arm/mtk-su ./

cp: bad '/sdcard/mts-su_20190822a/arm/mtk-su': No such file or directory

1|:/ $ home

/system/bin/sh: home: not found

127|:/ $ cp /sdcard/mtk-su_20190822a/arm/mtk-su ./

cp: .//mtk-su: Read-only file system

1|:/ $ chmod 700 mtk-su

chmod: mtk-su: No such file or directory

1|:/ $ cp /sdcard/mtk-su_20190822a/arm/mtk-su ./

cp: .//mtk-su: Read-only file system

1|:/ $ chmod 700 mtk-su

chmod: mtk-su: No such file or directory

1|:/ $ cp /sdcard/mtk-su_20190822a/arm/mtk-su $HOME/

:/ $ cd $HOME

hmod 700 mtk-su <

:/data/user/0/jackpal.androidterm/app_HOME $ ./mtk-su -v

armv7l machine

param1: 0x1000, param2: 0x8040, type: 14

Building symbol table

kallsyms_addresses pa 0x40f1a2d0

kallsyms_num_syms 52724, addr_count 52724

kallsyms_names pa 0x40f4dab0, size 682655

kallsyms_markers pa 0x40ff4550

kallsyms_token_table pa 0x40ff4890

kallsyms_token_index pa 0x40ff4c20

Patching credentials

Parsing current_is_single_threaded

c04b7ef4: MOVW R12, #0xc3c0

c04b7ef8: MOVT R12, #0xc130

init_task VA: 0xc130c3c0

Potential list_head tasks at offset 0x438

comm swapper/0 at offset 0x5e4

Found own task_struct at node 1

cred VA: 0xdaf68700

thread_info flags VA: 0xc8678000

seccomp mode VA: 0xce080438+218

Parsing avc_denied

c043e110: MOVW R12, #0x259c

c043e114: MOVT R12, #0xc151

selinux_enforcing VA: 0xc151259c

Setting selinux_enforcing

Selinux is already permissive

Trying seccomp-forbidden syscall

Caught SIGSYS

Disabling seccomp

This address does not seem to have your thread flags (0x00000080)

seccomp mode: filter

starting /system/bin/sh

UID: 0 cap: 3fffffffff selinux: permissive

:/data/data/jackpal.androidterm/app_HOME #
[Miscellaneous Android Development] diplomatic:
OK, so there was a bug in handling seccomp on 32-bit kernels. Try this one out and let me know how it works.
[Miscellaneous Android Development] Tmoney2019x:
Tecno KB7j (

[MENTION=8132642]diplomatic[/MENTION] Wow! You are too much. It works flawlessly. I'm so grateful men, thank you so much.

Can't acquire root privileges (Sep 24, 2019 9:15:31 PM)

Executing scripts from /storage/emulated/0/init.d (Sep 24, 2019 9:15:31 PM)

suboot.sh

/data/data/com.ryosoftware.initd/files/bin

/data/data/com.ryosoftware.initd/files/bin

UID: 0 cap: 3fffffffff selinux: permissive

source type magisk does not exist

Error in: allow magisk (null) (null) (null)

client: launching new main daemon process
[Miscellaneous Android Development] LL99-KF7:
Amazon Kindle Fire 7" 2019

Massive thanks to diplomatic for the mtk-su executable.

I've setup iptables rules on a Fire 7 2019 by writing a little bash script and getting run on startup with Termux boot (F-Droid).

The script executes mtk-su to get SU prompt, runs /system/bin/iptables with the rules required and is done.

It's not perfect, because I am not doing the whole TWRP and Magisk thing. I'm trying to go as far as I can without flashing in an image I haven't gone over - call me mildly paranoid ;)

Recent replies to other folks answer my own thinking - I can't just use dd to image out chunks, mount and edit them in full blown Desktop Linux, compress then flash back. There is more to it than that, and I am likely to bugger it up. In a perfect world I'd like to have things more like a proper Linux terminal, enter a password for sudo and be done with it. I understand why Android isn't setup like this - can you imagine how many people wouldn't change super user password from "admin" or "password"? Plus they have that pesky verity which stops mounting of system and thus modifying the core OS. Annoying for people who have a clue what they are doing, but it makes sense when these things are sold to your Grandmother or given to your 7-year-old to watch cartoons or play some simple game on it.

If anyone is interested in my iptables script, I'll happily post it on request.

You'll need Termux and the Termux boot apps downloaded from F-Droid or Google Play. Make sure they come form the same place, as the signature and thus AppID (UID) must be the same so they can talk to each other.

As much as I wanted Terminal Emulator to work, it was just a pain compared to Termux.
[Miscellaneous Android Development] diplomatic:
Great!

BTW, XDA should make a button for that.... :)
[Miscellaneous Android Development] CXZa:
Ha haa... :laugh:
[Miscellaneous Android Development] Tmoney2019x:
Tecno KB7j (

[MENTION=8132642]diplomatic[/MENTION] My observations concerning the mtk-su:

1. I noticed that after reboot I normally lose the root access until I run the script again. But the run scripts at boot time is checked.

2 The magisk hide do not work , I'm using magisk manager V7.1.1. I even tried v7.0.0 and its still the same thing.

3. Is there a working twrp for my phone model (ported ) , I wouldn't mind if I can get one.

Hope to hear from you soon.
[Miscellaneous Android Development] diplomatic:
Yeah, cuz people stop by, express appreciation, and leave like they never even heard of that button (even though that's listed in the requirements). It's like I've reached my thanks quota for the year or something. Not to mention the OP is getting hardly any clicks at all, despite hundreds of downloads per day. Just because it's a few months old, doesn't mean there's no need to click it.

Yeah, the init.d app needs to autostart so that it can launch root again on every boot. If it doesn't start automatically, it's usually because your OS has some background process manager or autostart manager or battery optimization that's affecting it. Make sure to remove it from any of those "optimization" lists.

The MagiskHide and SafetyNet don't work well on Android 9 for some reason. Not sure this is fixable with this method.

For TWRP, can you unlock the bootloader? I mean, if you can unlock, you don't need to bother with bootless root. You can simply flash a patched boot image instead.
[Miscellaneous Android Development] CXZa:
:yesnod: That's how it is, but at least you get thanks + appreciation, and the ratio per post isn't bad really.

Here is what one positive thinker here, [MENTION=2494638]celoxocis[/MENTION], once answered to me...

https://xdaforums.com/android/softw...er-package-t3595277/post73126165#post73126165

Keep up the good work - and thanks! :good:
[Miscellaneous Android Development] bigrammy:
Welcome to the unappreciated club it's getting pretty big nowadays on xda :laugh: :laugh:

xda should require the thanks button to be clicked before allowing users to view or use any download links since in today's society manners do not apply anymore so it would seem. :(
[Miscellaneous Android Development] DB126:
Well said (wait...probably should have clicked 'thanks'...;) )
[Miscellaneous Android Development] Tmoney2019x:
Tecno KB7j (

[MENTION=8132642]diplomatic[/MENTION] Thanks I really appreciate the clarification. I have patched boot IMG several times with magisk. It doesn't work on my phone. Until you rescued me with mtk-su.

Even the philz recovery I manage to port can't mount anything (cache, data, etc.). And I have not seen any twrp that works on Tecno KB7j.
[Miscellaneous Android Development] amanciomandanga:
Hello,

thanks for the amazing work! I tried with a Samsung SM-532F with Mediatek 6737 but it fails. It seems the problem is the missing symbol table. In case you could help the debug output is:

armv7l machine
param1: 0x3000, param2: 0x18040, type: 7
Building symbol table
Can't find kallsyms addresses or offsets
Unable to get kernel symbol table
setns failed: Permission denied
...

Thank you!

aman
[Miscellaneous Android Development] diplomatic:
Have you patched the actual boot image extracted from your phone, and using the latest Magisk 19.x, not 18.1? In general, if that method doesn't work, then installing through TWRP will probably not make much difference.

That phone just has a different symbol table starting address, which no other kernel seems to have. Here, give this version a spin.
[Miscellaneous Android Development] diplomatic:
That would reserve the downloads for members only. I would settle for just that. XDA should add it as an option for uploaded files.
[Miscellaneous Android Development] bigrammy:
How do you know this stuff!! :eek: :eek: :laugh::laugh:
[Miscellaneous Android Development] CXZa:
He sold his soul I'm sure... :angel: :eek: :laugh:
[Miscellaneous Android Development] diplomatic:
I just looked at the unpacked kernel from the firmware, which is easy to find for that phone. Finding the beginning of the symbol table is pretty central to the tool. Usually that error means mtk-su doesn't know about the table's fingerprint in that particular kernel. So I have to figure out all types of symbol tables used in MTK kernels....

Yeah, something like that...
[Miscellaneous Android Development] bigrammy:
You must have a mass of kernels and firmwares downloaded by now I know I have just for the few phones I own let alone all the ones you cater for. :laugh:

Keep up the awesome Wizardry you perform with mtk-su. :good:

[MENTION=5213414]CXZa[/MENTION]

:laugh: :laugh:
[Miscellaneous Android Development] Supermatt01:
Is there a script manager that could launch the script earlier in the boot process? I think things may work smoother if it would launch faster.
[Miscellaneous Android Development] amanciomandanga:
[MENTION=8132642]diplomatic[/MENTION] Thank you very much. It works!!! I get root, but I still have problem with selinux. I'll try to find a solution, but if you could give me a clue it would be grateful
[Miscellaneous Android Development] diplomatic:
Thanks... Yeah, you got that right, I've downloaded quite a few firmwares and kernel sources back in the day. I don't need to keep them all, though. I get what I need then free up the disk space. I also don't need the ROMs for every device it supports. That would be insane, with hundreds of models available. Just a few different types will do, roughly corresponding to the kernel/OS version/architecture...

I should be posting a new release soon, as soon as I get done with that Samsung phone. Was hoping to support one or two more devices, but people won't cooperate....

Well, not that much earlier. A script manager is just an app that is started by the OS just like any other. Some might start a little bit faster. You tell us.

What problem? Is it not switching to permissive? What's the output of 'mtk-su -v'? Probably nothing you can do about it at your end.
[Miscellaneous Android Development] lpxx50117:
Thanks for your work!This mtk-su worked perfectly in Coolpad Cool Play 8Lite(mt6739,android7.1 with 32bit mode).

But mtk-su cannot work in Honor Play 8(Honor 8S)(mt6761,android9.0 with 32bit mode,maybe the system-as-root),the output like this:

armv8l machine

param1: 0x1000, param2: 0x8040, type: 14

Building symbol table

Can't find kallsyms addresses or offsets

Unable to get kernel symbol table

starting /system/bin/sh

UID: 2000 cap: 0000000000 selinux: enforcing

Thank you!
[Miscellaneous Android Development] amanciomandanga:
Thanks a lot again. I would like to contribute wity you, [MENTION=8132642]diplomatic[/MENTION], with the development or whatever you need. I am really interested in this topic.

Yes, it is NOT switching to permissive, but I have no idea about what is going on. The output is:

shell@grandpplte:/data/local/tmp $ ./mtk-su -v
armv7l machine
param1: 0x3000, param2: 0x18040, type: 7
Building symbol table
kallsyms_addresses pa 0x40aeb010
kallsyms_num_syms 55315, addr_count 55315
kallsyms_names pa 0x40b21070, size 663355
kallsyms_markers pa 0x40bc2fb0
kallsyms_token_table pa 0x40bc3320
kallsyms_token_index pa 0x40bc3690
Patching credentials
Parsing current_is_single_threaded
c02c33fc: MOVW R0, #0xa090
c02c3400: MOVT R0, #0xc0e4
init_task VA: 0xc0e4a090
Potential list_head tasks at offset 0x290
comm swapper/0 at offset 0x400
Found own task_struct at node 1
cred VA: 0xceffa000
Parsing avc_denied
Stack protection detected
selinux_enforcing not found
setns failed: Operation not permitted
starting /system/bin/sh
UID: 0 cap: 3fffffffff selinux: enforcing
shell@grandpplte:/data/local/tmp #

I have been trying with supolicy/magiskpolicy to inject new SELinux rules, but it is not working. Next step will be some public exploits, if I find it
[Miscellaneous Android Development] Supermatt01:
I've tried to launch it with other managers. It seems not to work at all. What do I need to do to make a different launcher run the script?
[Miscellaneous Android Development] Mistercatapulte:
Hi guys,

Doesn't work for me on Huawei Y5 2018, chipset MT6739, Android 8.1

./mtk-su -v

armv8l machine

param1: 0x1000, param2: 0x8040, type: 13

Building symbol table

kallsyms_addresses pa 0x40c8f400

kallsyms_num_syms 53327, addr_count 53327

kallsyms_names pa 0x40cf7800, size 699270

kallsyms_markers pa 0x40da2400

kallsyms_token_table pa 0x40da2b00

kallsyms_token_index pa 0x40da2f00

Patching credentials

Parsing current_is_single_threaded

ffffff800837e01c+40: ADRP x1, 0xffffff80093c9000

ffffff800837e01c+44: ADD xd, x1, 1088

init_task VA: 0xffffff80093c9440

Potential list_head tasks at offset 0x390

comm swapper/0 at offset 0x658

Found own task_struct at node 1

cred VA: 0xffffffc026fd8180

Parsing avc_denied

selinux_enforcing not found

setns failed: Permission denied

starting /system/bin/sh

UID: 0 cap: 3fffffffff selinux: enforcing

HWDRA-M:/data/local/tmp #
[Miscellaneous Android Development] amanciomandanga:
It is a problem like mine: you get root, but SELinux does not switch to permissive :crying:
[Miscellaneous Android Development] k4y0z:
Looks like it doesn't find selinux_enforcing, probably needs an update by [MENTION=8132642]diplomatic[/MENTION]
[Miscellaneous Android Development] diplomatic:
Selinux in enforcing mode will not let you do much of anything, especially change its policy. No point in looking for exploits. This has to be taken care of by mtk-su. Try this version. This addresses my best guess as to why it failed. If that doesn't work, I'll PM you to explore further.

(BTW, this is not a group project. But there are ways you can contribute to me. ;) )
[Miscellaneous Android Development] diplomatic:
[MENTION=6304493]lpxx50117[/MENTION], [MENTION=8756948]Mistercatapulte[/MENTION]: where are the firmwares for your devices (as asked in OP)?

For the Honor 8S, I can probably fix the kernel symbol table problem. But if it's anything like the Honor 7S, the kernel will not let the selinux policy be switched to permissive. Huawei is known to do that.

For the Huawei Y5, that output actually sounds like the kernel is not configured for selinux permissive, same as above. I'll have to check the boot image to make sure....
[Miscellaneous Android Development] lpxx50117:
The firmware is here http://update.dbankcdn.com/TDS/data/files/p3/s15/G4062/g1650/v295104/f1/full/update_full_base.zip

（need to unpack update.app）

Thank you!
[Miscellaneous Android Development] amanciomandanga:
Thank you very much again!! Wonderful job, but I have same result, same output except:

...
cred VA: 0xc1a1a9000
...

Please, If I could help you to find a solution it would be great
[Miscellaneous Android Development] contactwajeeh:
[MENTION=8132642]diplomatic[/MENTION]

I tried running this on the Infinix Hot 8, which uses the mt6765.

I am getting the following error. Please advise.
[Miscellaneous Android Development] diplomatic:
Is there a firmware I can download? Be advised that if the FW is recent, that error likely means it's not compatible with mtk-su anymore.
[Miscellaneous Android Development] diplomatic:
You have to change at least the HOMEDIR variable from /data/data/com.ryosoftware.initd/files/bin to whatever the app package's private directory is. I haven't tried that before though, so I don't know for sure that will work...
[Miscellaneous Android Development] kenshinta:
[MENTION=8132642]diplomatic[/MENTION]

curious if this works / can work for the Helio G90T (used in the redmi note 8 pro)
[Miscellaneous Android Development] diplomatic:
Hi, ken,

I see this is a newly released phone but Xiaomi was nice enough to publish the kernel source already. So I can tell you now it will not work on that phone, unfortunately. In general, any phone released after September would lean towards not being supported by mtk-su.
[Miscellaneous Android Development] rc1421x:
Rich Evans

RE: Get full root with Magisk on a locked bootloader!

Thank you so much for your work with mtk! I have installed this software on a TCL A502DL (Android 8.1.0) and it works sometimes. The init.d scripts last execution results mirror your adviso EXACTLY but with the following preamble:

Can't acquire root privileges (Oct. 4, blah, blah...)

and when I run su from command line it hangs.

Would the "Can't acquire..." blurb refer to the initial mtk-su "let's get started" call? I see the permissions for /sdcard/init.d/mkt-su lacks execute permission as does all executables under /sdcard.

If that's the case can some piece be mod'd to fix? Or am I totally full of b.s. here?

by the by mtk-su solo werks GREAT!

thank you for your brilliance & resourcefulness

yer pal

rich

ps I like android v.8 cause when something like your worthy like your idea crashes on the shoals of selinux, et. al. i think of the ditty from "WIZARD OF OZ" where it states -

"Oreo, my old rum..." - such a flavorful & nutritious combo it is
[Miscellaneous Android Development] diplomatic:
Hi, Rich,

It sounds like everything went ok as far as the script. Everything you mentioned about it is the way it's supposed to be. The problem has to do with Magisk Manager. What does it say when you open it? Make sure you take that app off any battery optimization, auto-start manager or background process manager lists. When you don't get a root prompt, it's usually because MM is being "overly managed" by the OS.