yashsingh1/xdaforums huggingface dataset:
[Miscellaneous Android Development] Chainedge:
Xperia XA1 Plus rooted

Just managed to get a root shell on a Xperia XA1 Plus, G3421, under three seconds after execution. Wow, just wow. I should thank you since I can now back the TA partiton up, but this thing is almost frightening.

Note, this model's last SPL was on August 2019. Not sure if mtk-su will ever get patched on it. At least, AV's are doing a good job intercepting it. Had to set about 10 exclusions to solely execute
[Miscellaneous Android Development] diplomatic:
Glad you're impressed by mtk-su, [MENTION=11063291]Chainedge[/MENTION]. :D Yeah, I put a lot of work into making it efficient, including clever search algorithms to reduce the memory read/write. I think the first version took around 10 seconds to run. :eek: The AV detection, not sure what to say about that. One man's discretionary-use root tool is another man's malware...
[Miscellaneous Android Development] diplomatic:
Huh? Your reply has nothing to do with that quoted message of mine. What 6765 files do you mean? Do you have the output of 'mtk-su -v' from your phone? If you want to get permanent root, you can probably just follow the same procedure as almost every other unlocked phone: get your stock boot image, patch it with Magisk Manager, copy it to your PC, then fastboot flash it to boot....
[Miscellaneous Android Development] Pachacouti:
Yes it does...

When a phone is bootlooping, all you need do is reflash either the boot or recovery, which ever was flashed causing the bootloop, rather than flashing whole phone, saving so much time going through setting up the phone again. . And I've tried every method so far NONE has worked on my version of The Armour x5 MTK6765, see, what files? Root that works files. Oh that's right, the fake root that became rootless, then seemless, lol, now we cant write to the system, yes it can be bypassed, I'm 2 thirds of the way with my phone, by simply resizing system partition, but being dynamic...

I've got my magik'd bootloader, does nothing. I tried the recovery, does nothing. See, dynamic partitioning is your latest problem, and each app is also being loaded dynamically, so enjoy finding out why johnwu stated on twitter, RIP root.

I was only pointing out a bootlooping fone does not need a complete reflash, and wondering where the latest hacks are, you know, the ones that work?

Edit: I'll tell you where I'm at... System is /, not /system, so bin is in /bin. I did think of asking you to rewrite your app to reflect the coming changes, maybe even suggest to you to mount/bind to the new system partion, namely the external sdcard, but being dynamic, you wont know what mounted block system is gona be on, yet termux has a method that gives me sudo, so yeah, root is possible.. on my very up to date fone.... which is NOT the same as the OLD armour x5, which ran on arm 71, and used android 9... it's an octocore x64 arm v8a, which your mtk says has not been implemented, in otherwords your app needs a major update, no offence ;)

---------- Post added at 07:59 PM ---------- Previous post was at 07:22 PM ----------

Old apps get re-written by others:

./mtk-su -v

Failed critical init step 4

Firmware support not implemented

Update time..
[Miscellaneous Android Development] DaniloV5:
about removing apps

it is possible or not to remove permanently apps using this root method and pm?
[Miscellaneous Android Development] diplomatic:
You do realize there can be many different reasons for a bootloop, right? Restoring the stock image(s) did the trick in your specific case. However, I was talking about a totally different problem, which wasn't even a boot-loop. Anyways...

Not sure that's relevant, but there's one more thing I forgot to mention that applies to Android 9+. Have you disabled verification in your vbmeta? If not, that may be what you're missing for the BL to accept your modded images. This is independent of unlocking the BL. Get your stock vbmeta image to your PC. Then reflash it with fastboot like this:

fastboot flash vbmeta --disable-verification vbmeta.img

... which will patch vbmeta to disable verification. Now try to flash and boot your rooted image.

I don't think you need much else than the latest Magisk + M. Manager, fastboot, adb, the stock FW, etc. Anything else depends on what the specific problem is...

Thanks for the advice, but your phone's OS already blocks the mechanism used by mtk-su. Superficial implementation for your FW can technically be added, but that would only result in, "This firmware cannot be supported". It's useless to adapt it for Android 10+. I actually addressed this in the FAQ just recently:
[Miscellaneous Android Development] Pachacouti:
@ Diplomatic

, it's all relevant, keeping in mind I'm on android 10-q, yes I tried vmbeta, tried quite a few things most wont, nothing working so far apart from the fact I can write to... images lol, shame about the damn root, just gotta wait on a decent up to date exploit I guess, unless I find it first lol.. but thanks for the advice... ;)
[Miscellaneous Android Development] mindlery:
Acer B3-A40 tablet

Temporary root by diplomatic@XDA

Home URL:

https://xdaforums.com/android/development/amazing-temp-root-mediatek-armv8-t3922213

--------------------------------------------------

armv8l machine

param1: 0x3000, param2: 0x10000, type: 2

Building symbol table

kallsyms_addresses pa 0x40c0ff00

kallsyms_num_syms 43021, addr_count 43021

kallsyms_names pa 0x40c64100, size 555617

kallsyms_markers pa 0x40cebc00

kallsyms_token_table pa 0x40cec200

kallsyms_token_index pa 0x40cec600

Patching credentials

Parsing current_is_single_threaded

ffffff8008377320+4c: ADRP x0, 0xffffff8008f6e000

ffffff8008377320+50: ADD xd, x0, 2992

init_task VA: 0xffffff8008f6ebb0

Possible list_head tasks at offset 0x338

comm swapper/0 at offset 0x5f0

Found own task_struct at node 3

cred VA: 0xffffffc034181b40

Parsing avc_denied

ffffff8008312218+24: ADRP x0, 0xffffff80090a4000

ffffff8008312218+28: LDR [x0, 324]

selinux_enforcing VA: 0xffffff80090a4144

Setting selinux_enforcing

Switched selinux to permissive

starting /system/bin/sh

UID: 0 cap: 3fffffffff selinux: permissive

Load policy from: /sys/fs/selinux/policy

exit value 0 assets-r22

Works :)
[Miscellaneous Android Development] Newbehe1p:
I got 'bash: ./mtk-su: cannot execute binary file: Exec format error' what do I do? I have a mt8765
[Miscellaneous Android Development] diplomatic:
Uh, did you run mtk-su on your actual mt8765 device or on a different machine (like your PC)? If you ran it on your device, list the steps you took up to that point.
[Miscellaneous Android Development] Pachacouti:
@ Diplomatic,

Hope you find this usefull, helping you may help me lol:

http://www.voycn.com/article/androi...otquanxianadb-rootquanxianhe-apk-rootquanxian

It's in chinese, translate..
[Miscellaneous Android Development] Ryuuske01:
Confirming

Just to confirm,

Runs on the Lava IRIS 88s ( MT6739).

Thanks for the great work!
[Miscellaneous Android Development] diplomatic:
That looks like it's for building your own ROM with su included, if you have the complete source code....
[Miscellaneous Android Development] bigrammy:
Just info and to confirm that I just tried mtk-su on my new Xiaomi Redmi Note 8 Pro (Helio G90T) and as you have said already it doesn't work. :o
[Miscellaneous Android Development] Triassical:
I have a question, so basically, i used an app called "MTK Easy Root" that apparently does use this very method to gain root. The question is, can i accept the additional setup in Magisk Manager, i know this was answered in the FAQ, but mabye the answer is different for when using this Application.
[Miscellaneous Android Development] zeetotheuno:
Well, I have a special case here and maybe you guys could help me out.

I have a voice assistant called "MAIC", it's made by a greek company named MLS. It's based on Android (gotta be 7 or 8) and it uses an MT8167A chip.

The thing is, I can't get into the Android settings to enable USB Debugging or anything. I am able to get into recovery and fastboot though.

I tried to get this here to work and maybe do some more stuff with super user access, albeit temporary. But my computer won't even recognize the device. There is no reaction whatsoever and it is not shown in the device manager either. Hence, I don't get any response, when I try adb devices via platform tools.

Any suggestions on how I could make this work (if at all possible)? Or could somebody provide me with the drivers or even has this device himself (which, alas, I highly doubt) and tried this here? Anything will be appreciated.
[Miscellaneous Android Development] diplomatic:
Can you install any apps on it? If so, then you can try using a terminal app like Terminal Emulator for Android by following post 2. Also, you can just go ahead and load up Magisk bootless root from the link in post 3. Either of those options will probably give you permissions to turn on adb mode if you need it.
[Miscellaneous Android Development] Dildoman:
Thanks its work, but can't able to edit root directory

, can I update magisk from magisk manager by flashing magisk20.3 in mm ? Since my bootloader is already unlock. Pls let me know ..
[Miscellaneous Android Development] zeetotheuno:
Unfortunately, no. Neither can I install any apps (no Android Playstore on device), nor install/push them on the device.

I usually get the message "adb server version (32) doesn't match this client (41)"

So I'm not sure, whether this is a driver issue then, or whether there's a different command to try and load up Magisk.

edit:

I can access google search, though. But it won't install any of the apps/Apks I tap on. The browser keeps crashing, when I try to install anything.
[Miscellaneous Android Development] diplomatic:
Yeah, but I wouldn't recommend it. I would only try that if I had access to fastboot as backup in case something goes south. You'd also have to rename the boot partition device node from ".boot" to "boot" for the Magisk installer to find it. This file is in the directory /dev/block/bootdevice/by-name or something similar.

P.S. Epic name, man :good:

Well bummer...

You'd have to find some way to run a user app or get it to expose the USB debugging interface. The server version error sounds like an issue with adb binaries on your PC. Other than that, I would investigate whether there is unguarded SP Flash Tool access from that device. It's a long shot, but if you can get SPFT working, it might let you flash a patched image and boot it without much fuss...
[Miscellaneous Android Development] Dildoman:
Thanks giving

Hi Iam here to thanks you , I have successfully install magisk from direct download method via magisk manager , without any PC or recovery , without you its was not possible so thanks for the wonderful guide ...:good::good:
[Miscellaneous Android Development] zeetotheuno:
Thank you, but no such luck so far. I tried to get SP Flash Tool working, but no dice. Tried to get a memory read, but nothing happened. I also tried to get a readback (using Wwk to create a scatter), but no luck either. This device seems not to be recognized at all. I installed the MTK VCOM Drivers (for 65xx chipsets, though, but as far as I understand, these can be used for my chipset) but I get no indication whatsoever that a device is connected.

This is a real bummer, I would've loved to try your temporary SU. That would've helped me a lot to tweak a thing or two.
[Miscellaneous Android Development] Jadevinicole:
So I tried the method mentioned in this thread :

https://xdaforums.com/showpost.php?p=79626434&postcount=135

I tried it on an RCA tablet, RCT6303W87M7 (MTK8127) but the mtk-su could not be executed.
[Miscellaneous Android Development] Jadevinicole:
So I did it using this new method and still can't get root. I tried with the two versions of the mtk-su (32 & 64). For the 32 I get an error saying failed critical init step 1 incompatible platform, and for the 64 it says that the file is not executable. Screenshots attached and any help is appreciated.

Specs:

RCA RCT6303W87M7

MT8127

Android 6
[Miscellaneous Android Development] diplomatic:
It sounds like you've already tried all the possibilities. Yeah, the device has to be detected by the PC before you can get a foot in the door. Just to make sure, you did power it off completely before trying the SPFT stuff, right? Also, try holding a volume button as you connect the cable to see if that does anything different. In theory there should be some back door for the manufacturer to repair/refurbish these units in case they don't boot up.

That chip is not compatible with this method. Get a device with one of the chips listed on the first page and an older firmware...
[Miscellaneous Android Development] diversant:
Does exist working mtk-su for MT6763?

I have got BQ 6424L Magic O with Helio P23 (MediaTek MT6763V/V) and firmware version Android Pie released 2019-12-05 (BQru-6424L_V06_S191205). No new firmware or updates on this phone more than one year from BQ.

Many bugs in fw like missing system/framework/mediatek-cta.jar and junk in /vendor/operator/app/ sad me. And i'm looking for working method exploitation CVE-2020-0069 for root shell on this device. But all of available here mtk-su not working on BQ 6424L. I tried from _r18 till _r23 all with "This firmware cannot be supported"

Look like this:

BQru-6424L:/data/local/tmp $ uname -a

Linux localhost 4.4.146 #2 SMP PREEMPT Thu Dec 5 16:25:09 CST 2019 aarch64

BQru-6424L:/data/local/tmp $ ./mtk-su

Failed critical init step 4

This firmware cannot be supported

1|BQru-6424L:/data/local/tmp $ file mtk-su

mtk-su: ELF shared object, 64-bit LSB arm64, dynamic (/system/bin/linker64), for Android 21, built by NDK r20b (5948944), BuildID=6468d950faea31c7

825693344481d04173af5f73, stripped

BQru-6424L:/data/local/tmp $

Processor of BQ 6424L Magic O:

BQru-6424L:/data/local/tmp $ cat /proc/cpuinfo

Processor : AArch64 Processor rev 4 (aarch64)

processor : 0

BogoMIPS : 26.00

Features : fp asimd evtstrm aes pmull sha1 sha2 crc32

CPU implementer : 0x41

CPU architecture: 8

CPU variant : 0x0

CPU part : 0xd03

CPU revision : 4

processor : 1

BogoMIPS : 26.00

Features : fp asimd evtstrm aes pmull sha1 sha2 crc32

CPU implementer : 0x41

CPU architecture: 8

CPU variant : 0x0

CPU part : 0xd03

CPU revision : 4

processor : 2

BogoMIPS : 26.00

Features : fp asimd evtstrm aes pmull sha1 sha2 crc32

CPU implementer : 0x41

CPU architecture: 8

CPU variant : 0x0

CPU part : 0xd03

CPU revision : 4

processor : 3

BogoMIPS : 26.00

Features : fp asimd evtstrm aes pmull sha1 sha2 crc32

CPU implementer : 0x41

CPU architecture: 8

CPU variant : 0x0

CPU part : 0xd03

CPU revision : 4

processor : 4

BogoMIPS : 26.00

Features : fp asimd evtstrm aes pmull sha1 sha2 crc32

CPU implementer : 0x41

CPU architecture: 8

CPU variant : 0x0

CPU part : 0xd03

CPU revision : 4

processor : 5

BogoMIPS : 26.00

Features : fp asimd evtstrm aes pmull sha1 sha2 crc32

CPU implementer : 0x41

CPU architecture: 8

CPU variant : 0x0

CPU part : 0xd03

CPU revision : 4

processor : 6

BogoMIPS : 26.00

Features : fp asimd evtstrm aes pmull sha1 sha2 crc32

CPU implementer : 0x41

CPU architecture: 8

CPU variant : 0x0

CPU part : 0xd03

CPU revision : 4

processor : 7

BogoMIPS : 26.00

Features : fp asimd evtstrm aes pmull sha1 sha2 crc32

CPU implementer : 0x41

CPU architecture: 8

CPU variant : 0x0

CPU part : 0xd03

CPU revision : 4

Hardware : MT6763V/V

BQru-6424L:/data/local/tmp $

Does it possible successfully launch mtk-su on MT6763V/V and that Android version?
[Miscellaneous Android Development] diplomatic:
Unfortunately, your device is too new for this and mtk-su is correct in reporting that the FW cannot be supported. Mediatek has long since had the board firmware patched before distributing it to the vendor....
[Miscellaneous Android Development] SkylerMews:
Awesome work! Got this to work on my Kindle Fire HD 8 (6th generation) and have magisk and root.

I do have one question though, since we can mount the system partition ... is there a way to have the script execute on boot, so root is established every reboot without the user having to?

I've looked into crontabs and init.d, but none have worked so far.
[Miscellaneous Android Development] m4ctep:
Hello,

check @ Diplomatics Post on site 100 : https://xdaforums.com/android/devel...-t3922213/post82081703?nocache=1#post82081703
[Miscellaneous Android Development] Valiante:
To clarify, if I've gotten to this point, is root now "permanent" (with the exception of the early-stage boot)?

And has anyone been able to run Riru / Edxposed once Magisk is achieved?​
[Miscellaneous Android Development] diplomatic:
Most people with that tablet install SuperSU to the system partition. But as for the init.d app, does it not run at boot? That's what it's supposed to be doing if you've checked "run scripts at boot time"....
[Miscellaneous Android Development] SkylerMews:
Is installing SuperSU a permanent solution? Also, I much prefer Magisk to SuperSU, but can deal
[Miscellaneous Android Development] gumis1986:
Hello some time ago I rotated my htc desire 12 on the mt6739 chip. Unfortunately, I noticed that I can't give him full privileges to the system folders. He gets a read-only folder each time. Is there any way to do it if it made a mistake while rooting? Using programs that need root I have no problem getting it and I can't edit files in the system folder. Hope this is fixable.
[Miscellaneous Android Development] SkylerMews:
Have you tried mounting the system partition as read/write?

su
mount -o rw,remount -t ext4 /system
[Miscellaneous Android Development] gumis1986:
Dosent work :(. I try on pc and used termux on phone. aI get msh read only in dm-0 like on SS
[Miscellaneous Android Development] 532:
please put the model G532MT
[Miscellaneous Android Development] DragonFire1024:
I have a mediatek device but mtksu will not work on it. Armv7l cpu. But this is the only place I could think of posting this where maybe I could get some help. There is no form for my device which is an LG K51 (LM-K500um). There is no root solution for it, which is what I've been trying to do. So I've been experimenting with apps such as VMOS which create another Android OS in a virtual machine. While having this installed and an operation with root access on that virtual machine OS, I also had kingroot installed on the actual device, trying to get root. A day or two ago I opened the kingroot application and clicked on the optimize button and realized that I had for a moment root privileges. I was able to go into the settings menu and grant "allow" for ADB root access period but as quick as the oddity appeared it also disappeared and I have not been able to repeat the process. I have been reading about CVEs and came across some that spoke of using the sandbox, breaking Free of it and escalating privileges in order to gain root access. that's about the only explanation I can come up with on how this happened except for I can't get a repeat. I don't know if anyone has had this what happened before or even tried but I figured if anyone could give me some information it would be someone like [MENTION=8132642]diplomatic[/MENTION].
[Miscellaneous Android Development] diplomatic:
Hi DragonFire,

I don't think I can give you much advice on this. That's an Android 10 phone that is fully patched and has no public root vulnerabilities. So it's basically in the same boat as the latest Amazon devices. I have no idea what happened with Kingroot. Unless you verified that you had actual root privileges, like the ability to access /data files, I wouldn't put much stock in that....
[Miscellaneous Android Development] lateral_G:
Hi,

I also have the same device that's currently on Fire OS 5.6.7.0. Since you said you got this tool to work on yours recently, and since that OS update came out in August, I wanted to inquire if you did it on the same OS version.

I've been reading a lot about possible hard-bricking of the Kindles on XDA, so I wanted to confirm before I try it. Please let me know what your experience has been. Thanks!
[Miscellaneous Android Development] AspireInspire:
Can't acquire root privileges (Oct 4, 2020 9:33:06 AM)

Executing scripts from /storage/emulated/0/init.d (Oct 4, 2020 9:33:06 AM)

magisk-boot.sh

/storage/emulated/0/init.d/magisk-boot.sh[139]: ./mtk-su: No such file or directory

Do not know why the binary is missing. I checked my files are set up as instructed.
[Miscellaneous Android Development] duncan.wick:
I'm getting an error installing the Magisk root.

When I run the script it says:

cmp: invalid option -- s
cmp: invalid option - s
cmp: invalid option -- s
cmp: invalid option - s
UID: 0 cap: 3fffffffff selinux: permissive
/system/bin/sh: [33]: [: gid=0(root): unexpected operator/operand
Load policy from: /sys/fs/selinux/policy 20.4:MAGISK (20400)
client: launching new main daemon process

Screenshots:

[IMG="init.d log"]https://i.imgur.com/e3iFDR9.png[/IMG] [IMG="Magisk homescreen"]https://i.imgur.com/vvPEJ7x.png[/IMG] [IMG="Magisk log"]https://i.imgur.com/4xHEa8e.png[/IMG]

And afterwards root access cannot be granted. Any ideas?
[Miscellaneous Android Development] diplomatic:
Did you put mtk-su and magiskinit in the init.d/bin/ subdirectory? If that's taken care of, you might have to adjust the HOMEDIR variable in the script...

What device or OS version?
[Miscellaneous Android Development] duncan.wick:
It's a chinese noname phone. MTK6799, mt6580 (32-bit), Says Android 10, build no I700_lyx_k17_welcome_q_s20u_128a256_en_yl_v20
[Miscellaneous Android Development] shenery:
Has anyone tried on Nokia 2.3? Need a twrp too
[Miscellaneous Android Development] diplomatic:
I see. Well, if you check the Android version with some system info app, I bet you'll find that it's really Android 5.x. The magisk-boot script from the main guide doesn't play well with that version. You have to use the one from this post.
[Miscellaneous Android Development] sushen520:
UID: 0 cap: 3fffffffff selinux: permissive exec: Out of memory

mt6735

＄./mtk-su

UID: 0 cap: 3fffffffff selinux: permissive

exec: Out of memory

＄./mtk-su -v

armv7l machine

param1: 0x3000, param2: 0x18040, type: 6

Building symbol table

kallsyms_addresses pa 0x409bbaa0

kallsyms_num_syms 69697, addr_count 69697

kallsyms_names pa 0x409ffbc0, size 854072

kallsyms_markers pa 0x40ad0400

kallsyms_token_table pa 0x40ad0850

kallsyms_token_index pa 0x40ad0c00

Patching credentials

Parsing current_is_single_threaded

c0290fe4: MOVW R0, #0x10b8

c0290fe8: MOVT R0, #0xc0d0

Possible list_head tasks at offset 0x210

comm swapper/0 at offset 0x358

Found own task_struct at node 1

cred VA: 0xc22f4780

init_task VA: 0xc0d010b8

Parsing avc_denied

c0900428: MOVW R3, #0xe058

c090042c: MOVT R3, #0xc0de

selinux_enforcing VA: 0xc0dee058

Setting selinux_enforcing

Selinux is already permissive

starting /data/data/com.termux/files/usr/bin/zsh

UID: 0 cap: 3fffffffff selinux: permissive

exec: Out of memory：困惑：
[Miscellaneous Android Development] duncan.wick:
Thanks for your reply. Yeah, I suspected it's not Android 10, too, but 4 sys info apps all read it as android 10. But then again, 2 read 8GB RAM and one read 1GB, so I guess they mostly just believe what the phone tells them.

I tried the script you linked and ran into the same issue.