yashsingh1/xdaforums huggingface dataset:
[Miscellaneous Android Development] diplomatic:
You should first check if mtk-su works on your phone by running './mtk-su -v' in adb or terminal app shell. There is reason to believe that 4.9 kernels on Wiko are not supported yet by the current mtk-su. If you get mtk-su up and running, you can back up your current boot and recovery partitions as [MENTION=4519203]NFSP G35[/MENTION] suggested. And with unlocked fastboot you will probably be able to flash them if something goes wrong. Actually, if your BL is unlocked, you can install Magisk the regular way by flashing a patched boot image made with Magisk Manager.

Hmm....not sure about that. Can you try mtk-su inside a terminal emulator app? It might reboot on that command also. But it would tell me if it's due to mtk-su or a magisk binary. There is also evidence that Oppo puts anti-exploit defenses into their OS and it's possible that that may be complicating things.
[Miscellaneous Android Development] Bananikus:
I've commented out everything from the script that is connected to selinux and nothing has changed, i think the error is coming from magiskinit.

Edit: it seems that policy file is untouchable, trying to open it is giving out of memory error, renaming, copying etc is giving permission denied/out of memory.

ls - l is giving :

policy
dr-xr-xr-x 2 root root 0 Jan 1 1970
[Miscellaneous Android Development] diplomatic:
Yeah, it's coming from magiskpolicy, an alias of magiskinit. BTW, there's no reason to comment out everything related to selinux. Doing one thing at a time makes troubleshooting easier. Remember to reboot between each change.

If that didn't work, then you can try experimenting with magiskpolicy. It can load the policy from the file system instead of the kernel's policy file. Try changing the parameters: instead of '--live' put in '--compile-split':

./magiskpolicy --compile-split --magisk "allow magisk * * *"

It's best to test this out in terminal emulator or adb shell (under root) before directly editing suboot.sh. See this page for the Magisk tools documentation. You will have to come up with a custom recipe for your phone to work around that problem....
[Miscellaneous Android Development] Bananikus:
So, its still giving the same kind of errors, but i thought... selinux is permissive by default or maybe its broken. So i just commented out magiskpolicy from the script and woah, its working. it is fine to do that, do i miss something?
[Miscellaneous Android Development] diplomatic:
OK, great. But you probably didn't need to do that since magiskpolicy was failing and not changing anything. That result was just due to taking away the setenforce command, a change you assumed would fail due to the error shown.

So this leaves it your selinux in permissive state. That's not ideal. It gives apps/programs a lot more freedom. Depends on how important security is to you. I would still try to tinker with the magiskpolicy command. I'm pretty sure you can cook something up with it and end up with selinux enforcing.
[Miscellaneous Android Development] diplomatic:
Problem with Release 17?

Is there some new problem with R17 that doesn't affect past versions? Because I see R16 still being downloaded a lot. Speak up so I can fix it.
[Miscellaneous Android Development] e.v.o:
Great info! Just two questions about this:

Am i correct that it's only possible to disable dm-verity when the device is bootloader unlocked and one has root to change one of the .prop files where dm-verity gets set?

The systemless module you are talking about which mounts the overlay gets reapplied everytime you reboot the system. So you really don't change the underlying file system but instead the calls to /system get sort of redirected?
[Miscellaneous Android Development] Abdo Ayman:
Hey man could you please guide me how you managed to root your oppo f7 any help will be appreciated thanks

I tried tremux and it reboot too I will try to capture screen shot for you so you can know what is the problem and how to fix it
[Miscellaneous Android Development] diplomatic:
Well, you need to modify the boot image in some way to disable dm-verity. But yeah, you can only boot a custom image with an unlocked BL. There might be some exceptions though.

The overlay part is pretty much on point. There's an image on the data partition that gets mounted by magisk as a loopback device on top of files or directories of /system. So you're actually accessing those files/directories on the small image instead of the system partition. You can see what's being mounted & where with the mount command.

I see. A screenshot would be great. But I have to say, so far this sounds an awful lot like the F11 that has anti-exploit defenses built in to it. The kernel on that phone automatically reboots when it detects a UID change on a process. The one difference is that it happens in both adb and apps.
[Miscellaneous Android Development] e.v.o:
Do you have any good link or Google suggestion on “HowTo make a boot.img”? My instinct would tell me to rip the boot.img out of the firmware image I flashed, mount it and then alter it. But I can’t find any information on what to change. It’s one thing to flash a pre-made boot.img but I wanna do it myself and learn how this works...

Thanks in advance!
[Miscellaneous Android Development] diplomatic:
[MENTION=1520184]e.v.o[/MENTION], most people just have Magisk do it automatically. But if you're willing to go that route, why bother with this whole thing? Just unlock it and install Magisk the usual way. Check out [MENTION=3924647]bigrammy[/MENTION]'s threads on Sony. They're more appropriate for that topic.
[Miscellaneous Android Development] Qba_S:
Sorry I've somehow missed your question... In case you still need an answer:

PDA_sprout:/ $ getprop ro.boot.slot_suffix
[B]_b[/B]
PDA_sprout:/ $ getprop ro.boot.slot
[B]b[/B]

So this can probably be used to tweak the suboot script. Untill then we have to be careful to not accidentally update Magisk :)
[Miscellaneous Android Development] Bananikus:
It's not like that, until i didnt commented out the magiskpolicy, the script was not working. I did everything according to your instructions at first bit it didnt work. And magiskpolicy is constantly failing. Also it seems that selinux is in permissive state all the time (or its never?) , i don't do anything. This phone security is already mess i think. Also script is not starting on boot, i need to do it manually, I'm not sure if magisk modules are working or not, but just root managnent is ok. Also i tried to delete some bloat system apps but its not possible.
[Miscellaneous Android Development] WesHTCB:
[MENTION=8132642]diplomatic[/MENTION] , this is what i get on my wiko ride mt6765 kernel 4.9.117

C:\Program Files (x86)\Minimal ADB and Fastboot>adb push "C:\Program Files (x86)

\Minimal ADB and Fastboot\mtk-su_r17\arm64\mtk-su" /data/local/tmp/

C:\Program Files (x86)\Minimal ADB and...shed. 1.4 MB/s (38720 bytes in 0.027s)

C:\Program Files (x86)\Minimal ADB and Fastboot>adb shell

W-U300:/ $ cd /data/local/tmp

W-U300:/data/local/tmp $ chmod 755 mtk-su

W-U300:/data/local/tmp $ ./mtk-su

Can't find kallsyms addresses or offsets

Unable to get kernel symbol table

setns failed:: Permission denied

New UID/GID: 2000/2000

W-U300:/data/local/tmp $ ./mtk-su -v

param1: 0x1000, param2: 0x8040, type: 14

Building symbol table

Can't find kallsyms addresses or offsets

Unable to get kernel symbol table

setns failed:: Permission denied

New UID/GID: 2000/2000

starting /system/bin/sh

W-U300:/data/local/tmp $

does this mean mtk-su isnt compatable with wiko ride?
[Miscellaneous Android Development] diplomatic:
OK, thanks. So based on that, the script should already be working properly. Can you just check the partitions again please? In your /dev/block/platform/bootdevice/by-name directory, boot_a or boot_b (the current one) should be renamed to .boot_a or .boot_b .
[Miscellaneous Android Development] diplomatic:
Oh, I see. It may be that magiskpolicy is doing something, just not what we want. To answer your question, yes, it becomes permissive since running the script. mtk-su switches the policy to permissive. But since you removed 'setenforce 1', it never goes back to enforcing. Like I said, you have to somehow get magiskpolicy to work in order to take advantage of enforcing mode and have root.

To have init.d scripts support start on boot, check if your phone has any autostart managers and allow it to start that app on boot if there is a switch to do so. Magisk modules should install fine, but some of them won't work because they need to be loaded early to function. You can't modify system due to dm-verity, as noted in the limitations list. You can disable your apps instead.
[Miscellaneous Android Development] Qba_S:
It is renamed correctly, but in a different location:

>ls -a [B]/dev/block/by-name[/B] | grep boot
.boot_a
boot_b
boot_para

>ls -a [B]/dev/block/platform/bootdevice/by-name[/B] | grep boot
boot_a
boot_b
boot_para

I'm not sure which path is used by Magisk.
[Miscellaneous Android Development] WesHTCB:
[MENTION=8132642]diplomatic[/MENTION] This is what i got in return from the new file...

wiko run

C:\Program Files (x86)\Minimal ADB and Fastboot>adb shell

W-U300:/ $ cd /data/local/tmp

W-U300:/data/local/tmp $ chmod 755 mtk-su

W-U300:/data/local/tmp $ ./mtk-su

New UID/GID: 0/0

W-U300:/data/local/tmp #

W-U300:/data/local/tmp # ./mtk-su -v

param1: 0x1000, param2: 0x8040, type: 14

Building symbol table

kallsyms_addresses pa 0x40f19400

kallsyms_num_syms 49232, addr_count 49232

kallsyms_names pa 0x40f79800, size 637240

kallsyms_markers pa 0x41015200

kallsyms_token_table pa 0x41015900

kallsyms_token_index pa 0x41015d00

kimage_vaddr: 0xffffff8587c00000

memstart_addr: 0xffffffde40000000

Patching credentials

Parsing current_is_single_threaded

ffffff8587fcd328+44: ADRP x8, 0xffffff85893f5000

ffffff8587fcd328+48: ADD xd, x8, 3392

init_task VA: 0xffffff85893f5d40

Potential list_head tasks at offset 0x500

0xffffffe230e8f500 0xffffffe209f85500 0x000000000000008c

comm swapper/0 at offset 0x7e0

Found own task_struct at node 1

cred VA: 0xffffffe2069f1e40

Parsing avc_denied

ffffff8587f5e2fc+10: ADRP x11, 0xffffff858964d000

ffffff8587f5e2fc+14: LDR [x11, 3672]

selinux_enforcing VA: 0xffffff858964de58

Setting selinux_enforcing

Selinux is already permissive

New UID/GID: 0/0

starting /system/bin/sh

W-U300:/data/local/tmp #
[Miscellaneous Android Development] diplomatic:
[MENTION=6745396]WesHTCB[/MENTION], looks like it works ...and ready for bootless root!
[Miscellaneous Android Development] diplomatic:
Release 18

The next version of mtk-su has been posted. This one clears another hurdle to temp root on a class of MTK devices. And that hurdle is KASLR--kernel address space randomization, which is enabled on some newest firmwares with arm64 kernel 4.9. If you were getting "Unable to get kernel symbol table" before, this one's probably for you. Also updated is the bootless root script, which now has better protection against (unintentionally) installing Magisk on a/b firmwares (thanks to [MENTION=5662866]Qba_S[/MENTION]'s feedback.)

Let me know if anything is broken in the latest release. A lot of code got added and changed around between R18 and R17 and I can't test every possible scenario.
[Miscellaneous Android Development] diplomatic:
Not sure if you're aware, but this root doesn't make it possible to do any deep modding or install twrp and stuff. You might pull it off if you really know what you're doing, which you have to to avoid bricking. (Not to mention a compatible TWRP has to be built first.) You can definitely make a back up of the firmware. But I'm not sure how you intend to transfer it to another phone that I assume doesn't boot(?).

EDIT: This is assuming you can't unlock the bootloader. If you can, then all you need mtk-su for is to extract the images. Then you're good to go.
[Miscellaneous Android Development] leonardo.teseyra:
Working in a Sony Xa1 g3123, but I can't write on System. I can't change the permissions to rw on System.

When I tried, this happened:

G3123:/ # mount -o rw,remount /system

'/dev/block/dm-0' is read-only

Or

1|G3123:/ # mount -o remount,rw /system

mount: '/dev/block/dm-0'->'/system': Device or resource busy

Android 8.0

Magisk app 7.1.1.

magisk zip 18.1

I used the procedure in the next link:

https://xdaforums.com/showpost.php?p=79626434&postcount=135
[Miscellaneous Android Development] WesHTCB:
[MENTION=8132642]diplomatic[/MENTION]

I am actually trying to pull the firmware off this wiko ride to repare a second wiko ride. im hoping i can just get the partition information and do a push/ pull of boot,system, and recovery from the good one to the bricked one. i still have fastboot and can unlock bootloader but i had verity issues while trying to flash a twrp made for the same chipset but for anither model phone.
[Miscellaneous Android Development] diplomatic:
I'm surprised you can unlock the BL on that carrier phone. The block device path should be at /dev/block/platform/bootdevice/by-name/ You might want to use [MENTION=5312578]mrmazak[/MENTION]'s partition backup script to help you. This is an example of a command to pull a partition manually:

dd if=/dev/block/platform/bootdevice/by-name/system of=/sdcard/system.img bs=1048576

One complication might be that if your system partition is corrupt, fastboot might not accept a raw system image. It may need to be converted to some kind of a sparse format first...
[Miscellaneous Android Development] deepu458:
Hi With this SUboot.zip can we try this on Fire HD10 Tablet that is boot locked?
[Miscellaneous Android Development] diplomatic:
[MENTION=6409421]deepu458[/MENTION], of course. Getting this to work on locked devices is the whole point.
[Miscellaneous Android Development] Senral:
Oukitel K12

mtk-su_r17 and lower not work

mtk-su_r18 work

MM 7.0.0 work

MM 7.1.1 work

MM 7.1.2 and higher not work
[Miscellaneous Android Development] diplomatic:
OK [MENTION=4985904]Senral[/MENTION], good info. The MM version details are already noted in the guide....
[Miscellaneous Android Development] Rortiz2:
[MENTION=8132642]diplomatic[/MENTION] worked in 2 secs in Umidigi Power Android 9.0:

Power:/ $ /data/local/tmp/mtk-su -v
param1: 0x1000, param2: 0x8040, type: 14
Building symbol table
kallsyms_addresses pa 0x40f9fb00
kallsyms_num_syms 50820, addr_count 50820
kallsyms_names pa 0x41003100, size 658141
kallsyms_markers pa 0x410a3c00
kallsyms_token_table pa 0x410a4300
kallsyms_token_index pa 0x410a4700
kimage_vaddr: 0xffffff9267c00000
memstart_addr: 0xffffffc6c0000000
Patching credentials
Parsing current_is_single_threaded
ffffff9267fd09bc+44: ADRP x8, 0xffffff92694c5000
ffffff9267fd09bc+48: ADD xd, x8, 3520
init_task VA: 0xffffff92694c5dc0
Potential list_head tasks at offset 0x500
comm swapper/0 at offset 0x7e0
Found own task_struct at node 1
cred VA: 0xfffffffa5c61e6c0
securebits were 0x2f
Parsing avc_denied
ffffff9267f614c4+10: ADRP x11, 0xffffff926971d000
ffffff9267f614c4+14: LDR [x11, 3672]
selinux_enforcing VA: 0xffffff926971de58
Setting selinux_enforcing
Switched selinux to permissive
starting /system/bin/sh
UID: 0 cap: 3fffffffff selinux: permissive
Power:/ #
[Miscellaneous Android Development] k4y0z:
But why not just unlock :confused:
[Miscellaneous Android Development] diplomatic:
Great! Another notch in my belt. I love how brand new phones are still coming out complete with root access.... lol

IDK, maybe because you don't have to be a rocket scientist to try this method. :p

Maybe he wants Magisk instead of the tired old SuperSU.
[Miscellaneous Android Development] k4y0z:
Well unlock gives you Magisk right at boot (Magisk-patched boot-image).

And you don't have to be a rocket scientist either thanks to using mtk-su during the process :p
[Miscellaneous Android Development] diplomatic:
Oh yeah, forgot it's Magisk on that tablet...
[Miscellaneous Android Development] Rortiz2:
Haha yeah. But it's very great. I made a full backup of stock ROM and I will try to compile TWRP!

Thanks for your mtk-su!
[Miscellaneous Android Development] k4y0z:
It's magisk on all the unlocked devices.

You could use SuperSU but have to set it to default grant, which for me doesn't really work.

BTW, regarding dumping stock ROM.

Is there anyone here who has the Walmart Onn 8 inch tablet and could dump the stock firmware and upload it somewhere?
[Miscellaneous Android Development] deepu458:
If i had seen this article before i setup the whole fire with apps and settings. For unlock it needs to factory reset and start over which i am not in favor for Fire OS. But when a custom roms start to appear for Fire 10 i will do that. Coming to Super-SU i think with this magisk manager approach all the changes i do are sticking in data partition not any way change the System partition like mounting System which helps in case of Updating when there is a software update.

I might be wrong in my above thinking.
[Miscellaneous Android Development] k4y0z:
Yeah that's true, on the HD10 it requires a factory reset.

That said when you already have root, nothing is keeping you from backing up your data-partition and restoring it after unlock ;)

Yes Magisk is preferable unlocked or not, allthough SuperSU also supports systemless AFAIK.
[Miscellaneous Android Development] deepu458:
Thanks for the reply. I am so sorry to ask you a favor that is can u link me an article where i can find details about backing up and restoring the data partition in this device?So i can read it thoroughly and that would help me.
[Miscellaneous Android Development] Supermatt01:
Newest version still forcing reboots on OPPO F11. Thank you for all your hard work and efforts in this fight for root.
[Miscellaneous Android Development] k4y0z:
Can't really link to you any article, I would probably just use tar. But I'm sure something like FlashFire would work.
[Miscellaneous Android Development] Senral:
Problem "init.d scripts support" and AFWall+

German Text:

Get full root with Magisk on a locked bootloader!

Kleine Änderung an der suboot.sh für AFWall+

Problem:

AFWall+ OnBootService und gleichzeitg root rechte benötigen!

AFWall+

Handy boot:

afwall+ benötigt su

init.d scripts support -> noch nicht ausgeführt oder läuft gerade

afwall+ kann regeln nicht erstellen

Lösung:

github afwall /AndroidManifest.xml#L175

AndroidManifest.xml

Änderung suboot.sh:

am ende einfügen

erste mal -> manuell starten in "init.d scripts support" -> su rechts gewehren.

mit etwas suche sollte es möglich seinen auch andere Apps so zustarten.
[Miscellaneous Android Development] WesHTCB:
Wiko Ride
[Miscellaneous Android Development] diplomatic:
I know, and I don't think I'll be supporting the Oppo workaround in the main release stream. FYI, the special Oppo build did succeed on the F7 (Android 8.x) in launching bootless root. The release version was making it reboot in app mode like your phone. You have to find if there is a way to run executables from the data partition with root shell. Maybe they will launch from the /data/local/tmp directory, for example. Then you might be able to get Magisk off the ground. The Oppo mtk-su build does appear to give you proper root in app mode, but the FW seems to have other barriers to doing things with root....

Can you try 'fastboot boot boot.img' to do a tethered boot?
[Miscellaneous Android Development] WesHTCB:
[MENTION=8132642]diplomatic[/MENTION] let me look into that, i need to install an emulator. let you know asap

---------- Post added at 08:14 PM ---------- Previous post was at 07:55 PM ----------

just hangs on waiting for device

adb to another phone gives no device emulator found

if im doing things proper... 90% sure i am

i installed termux and installtools.sh

run fastboot devices.

tried to update pkg but nothing found
[Miscellaneous Android Development] babu49598:
Arm v8 codec link give me
[Miscellaneous Android Development] diplomatic:
Is the phone actually detected by fastboot? I'm not sure why you're talking about termux. Are you using another phone as the fastboot host? Otherwise, if you did everything right, something may be wrong with the image....
[Miscellaneous Android Development] nonnymoose:
You're right. I still don't agree with publishing vulnerabilities, because that makes it easier to exploit them, but then again, refraining from doing so is just security by obscurity.

I plan to move away from Mediatek the next time I buy a phone because I'll be able to afford the extra cost associated with a Qualcomm device.
[Miscellaneous Android Development] vddrnnr:
Hi diplomatic,

Any news about installing magisk modules?

Best regards,

voidRunner
[Miscellaneous Android Development] diplomatic:
[MENTION=4791280]vddrnnr[/MENTION], if you mean modules that need to be loaded early in order to function, then no, I think this is the best we can do....

I mean, you can try to experiment with warm reboots after starting Magisk. This would involve running the command 'killall zygote', but maybe you can find a better way. I have not played around with that myself because it causes some nasty side effects on my tablet. But maybe you will have better luck with it.
[Miscellaneous Android Development] :
How exactly does this work. I've looked over the suboot shell script but I don't entirely understand it. Thanks in advance for any responses!
[Miscellaneous Android Development] diplomatic:
[MENTION=9954674]Julian Marius Fairfax[/MENTION], not sure how fine-grained an explanation you want, but here's an overview: the script has 2 parts, one that runs under the app context and one that executes under root. mtk-su is what transfers control to a root context. The non-root script copies the needed binaries to the app's private directory, and calls mtk-su to run the root portion. The SU script simply does the same steps that Android init does when it launches the magisk services. At the end it does some stuff to help prevent Magisk installation to internal storage, and sets selinux back to enforcing.

BTW, no need to clutter the thread by quoting that entire lengthy post. A small piece of it or simply referring to bootless root is fine.
[Miscellaneous Android Development] mrmazak:
i have been on the Redmi telegram support forum since December. Unlocking bootloader is needed for getting twrp onto device. AVD is active and DM-Verity is enforced.

Once bootloader is unlocked, verity still needs to be disabled or else stock recovery gets forced back onto phone.

Also that phone has similar soc as my main device Mediatek MT6761 Helio A22 on the 6A mine has Mediatek MT6762 Helio P22

mtk-su did not work for me on testing.

15 days to wait is not really that bad. Some people have claimed 60-90 plus days wait to get unlock code.
[Miscellaneous Android Development] ahhl:
:cool:

---------- Post added at 02:43 PM ---------- Previous post was at 02:13 PM ----------

at step 2 , i got permission denied.

Redmi 6A firmware : https://c.mi.com/thread-1916774-1-0.html

kernal : https://github.com/MiCode/Xiaomi_Kernel_OpenSource/tree/cactus-o-oss
[Miscellaneous Android Development] HemanthJabalpuri:
[MENTION=8132642]diplomatic[/MENTION]

If someone can tweak system with your exploit then

Below update-binary for flashing SuperSU-2.82-sr5 directly in android terminal...

https://github.com/HemanthJabalpuri/Replace_KingRoot_with_SuperSU/blob/master/update-binary

3rd arg to the above script would be supersu zip path
[Miscellaneous Android Development] diplomatic:
If you flash TWRP with dd, simply rebooting to Android will restore the stock recovery. That is, assuming you don't install root or mods while you're in there. But you should still back up the stock recovery.

Well, do tell. What was the problem? Odds are it can adapted for that phone/chip.

If the cp command got permission denied, it's either the app doesn't have Storage permissions, or something else that you're gonna have to figure out. The terminal shell should be able to copy files from a shared storage or a tmp directory.
[Miscellaneous Android Development] diplomatic:
OK, cool... this would be only useful for devices without dm-verity, though. The Amazon Fire HD series with Fire OS 5 might benefit...
[Miscellaneous Android Development] mrmazak:
Ok, I will get it loaded again , and make you some logs.

This is what it gives me.

Cannot get kernel table.