yashsingh1/xdaforums huggingface dataset:
[Miscellaneous Android Development] Sensonic:
I have a TWRP backup of my phone. Can that be flashed to formatted phone (with the computer) somehow?

I also have two original firmware versions, Android 7 and 8. But each and every time I've tried to flash them to my phone, it gives me an error message with SP Flash Tool 5. With SP Flash Tool 3 it tells that the scatters of original firmware (both versions 7 & 8) are corrupted. MiracleBox crashes when trying to flash.

What to try next???
[Miscellaneous Android Development] bigrammy:
Hi, OK with SPFlashTool it could be any number of things causing issues but none of them have anything to do with MTK-SU so are way off topic for this thread. :(

Google reveals hundreds/thousands of results and adding your exact error and device to the search would likely narrow things down.

I recommend this how too here for SPFlashTool related stuff https://forum.hovatek.com/thread-159.html They have youtube videos also. If by some chance none of that works then I suggest starting a thread in your device section.

If your device doesn't have one then open a general help thread giving as much detail as possible and include things like screenshots scatter files firmware package file lists etc etc.

You can "mention" me and maybe others in that thread so I will get a notification and then maybe I could help out a bit more in that thread.

I have a number of my own threads and know how quickly SPFlashTool related posts can swallow a forum thread up and that's why I now generally ban posts related to it :cry:
[Miscellaneous Android Development] OMAKE:
Hello.

Smartphone is LG Q7 and i can see it in the list.

I can gain root shell in ADB and Material Terminal (mtk-su in app's home, command ~/mtk-su)

but magisk solution doesnt works for me.

I am pretty sure all settled correctly.

Output:

Can't acquire root privileges (Feb 1, 2021 17:07:12)

Executing scripts from /storage/emulated/0/init.d (Feb 1, 2021 17:07:12)

magisk-boot.sh

Temporary root by diplomatic@XDA
Home URL:
https://xdaforums.com/android/development/amazing-temp-root-mediatek-armv8-t3922213
--------------------------------------------------

UID: 0 cap: 3fffffffff selinux: permissive
'/dev/root' is read-only
chmod: chmod '/root' to 40750: Read-only file system
ln: cannot create hard link from '/sbin/bnrd' to '/root/bnrd': Read-only file system
ln: cannot create hard link from '/sbin/charger' to '/root/charger': Read-only file system
ln: cannot create hard link from '/sbin/fuelgauged_static' to '/root/fuelgauged_static': Read-only file system
ln: cannot create hard link from '/sbin/rctd' to '/root/rctd': Read-only file system
ln: cannot create hard link from '/sbin/ueventd' to '/root/ueventd': Read-only file system
ln: cannot create hard link from '/sbin/watchdogd' to '/root/watchdogd': Read-only file system
Error making /sbin hardlinks

As far as i understand / is /dev_root and /root is read only on the device.

Can i do something?

Thank you and have a nice day.
[Miscellaneous Android Development] Sensonic:
Thanks mate 👍

The problem is that SP Flash Tool V5.2 gives me an error "STATUS_DA_HASH_MISMATCH (0xC0070004)".

SP Flash Tool v3. crashes. MiracleBox crashes as well 😢
[Miscellaneous Android Development] bigrammy:
With the phone off try Pressing Volume Up or maybe Down when you insert the usb cable into the PC and keep it held until the flashing process starts.

EDIT: Google is a wonderful thing sometimes. :)

Fix DA MISMATCH
[Miscellaneous Android Development] Sensonic:
Have tried it but saw @ Hovatek how to create a checksum with the application. Will try it next.

It seems to be quite hard to flash hard bricked (in this case accidentally formatted) device even though it's still responsive to USB cable.
[Miscellaneous Android Development] Tech0308:
Sorry for clogging this thread.

My device(Cubot X18 plus) appears to have exactly the same problem. I've tried everything for several hours, even dismantled it to it's bare minimum to try all of its testpoints to no avail. The only thing I can find out if that we likely need a custom da and Auth file which Cubot doesn't provide and people who've contacted customer service have drawn a blank.
[Miscellaneous Android Development] hhxxhg:
armv7l machine

param1: 0x3000, param2: 0x18040, type: 6

Building symbol table

kallsyms_addresses pa 0x4097aee0

kallsyms_num_syms 67968, addr_count 67968

kallsyms_names pa 0x409bd4f0, size 823075

kallsyms_markers pa 0x40a86420

kallsyms_token_table pa 0x40a86850

kallsyms_token_index pa 0x40a86be0

Patching credentials

Parsing current_is_single_threaded

c028db04: MOVW R0, #0xb0b8

c028db08: MOVT R0, #0xc0c8

Possible list_head tasks at offset 0x210

comm swapper/0 at offset 0x358

Found own task_struct at node 1

cred VA: 0xc218b880

init_task VA: 0xc0c8b0b8

Parsing avc_denied

c08c41ac: MOVW R3, #0xd2d0

c08c41b0: MOVT R3, #0xc0d5

selinux_enforcing VA: 0xc0d5d2d0

Setting selinux_enforcing

Selinux is already permissive

starting ls

UID: 0 cap: 3fffffffff selinux: permissive

exec: Out of memory

Has anyone met the same problem? I tried different types of "-c" command but all of them end up with "out of memory".

device:noain x9 plus, mt6750, with yunos, which never opened its source.

Edit: I know such the problem has been mentioned by others before(#1,166), but the problem doesn`t get solved actually.May I catch a glimpse of the source code and find a workaround by myself?
[Miscellaneous Android Development] Sensonic:
Thanks for the info mate!

Where do I get those?

Thanks in advance.
[Miscellaneous Android Development] diplomatic:
I'll take a look at it once it comes out. It's not clear to me which files will be included inside the zip package. It's possible that the best solution would be to drop in the whole Magisk zip file as-is...

- D
[Miscellaneous Android Development] diplomatic:
Does your phone have Android 9? Because it might be system-as-root that's incorrectly detected as rootfs (not SAR). Can you post the output of mount from a root shell?

- D
[Miscellaneous Android Development] OMAKE:
Android 8.1
[Miscellaneous Android Development] diplomatic:
I beg to differ cuz your mount command says system-as-root. ;)

Here, try the script in this post. I made it way back last April especially for this purpose (Android 8 upgraded to 9). But never got around to putting it on the main bootless root page because I wasn't sure it didn't break any other cases...
[Miscellaneous Android Development] OMAKE:
c:\ADB_Fastboot>adb devices
List of devices attached
LMQ6106PSK9LR8SCWC device

c:\ADB_Fastboot>adb shell getprop ro.build.version.release
8.1.0

c:\ADB_Fastboot>

Script works! Thank you!

init.d last executed command output "can't acquire root privilegies" but everything seems okay.

I am not very good at shell scripting.

Can you please help me - how to rewrite script to execute it manually

from terminal emulator as root?

I mean put files to /data/bin and execute script manually after gaining root shell using mtk-su.

I don't need automatic magisk setup and init.d app.

Thank you and have a nice day!
[Miscellaneous Android Development] zeetotheuno:
Hi guys,

I've been trying to get root/temp root on a device called MLS IQR70 (MT8167 running Android 7.0) for a while now. It's a Voice Assistant/ Smart Screen, which actually does not give you access to anything: its files or settings nor does it allow you to enable USB-Debugging. I already talked to @diplomatic about it.

Now I somehow got into its settings and managed to do the Magisk thing. Worked like a charm! (Apart form the fact, that the installed browser kept crashing, when downloading stuff, since external SD-Card or USB connection was not possible)

Gotta repeat @Valiante 's question tho, because I'm not sure if it was answered:

So, after doing the Magisk thing, the root is permanent?

Awesome work, anyway!
[Miscellaneous Android Development] diplomatic:
You just have to change the line at the beginning of the shell code

HOMEDIR=/data/data/com.ryosoftware.initd/files/bin

...and you don't have to get a root shell first.

HOMEDIR is the destination path for the magisk & mtk-su files and has to be inside the app data directory. For example,

HOMEDIR=/data/data/jackpal.androidterm/files/bin

would work for Terminal Emulator for Android.

What do you mean by the 'Magisk thing'? The bootless root method with the init.d script? If so, no, it's not permanent. It's only loaded when you run the init.d app.

- D
[Miscellaneous Android Development] zeetotheuno:
Yeah, I meant the bootless root.

Well, that's cool too, if it's only loaded when running the init.d app. Really great way to get a foot in the door!
[Miscellaneous Android Development] yhyzhj:
my device is not MTK CPU, i dont know if BL is locked. the device have ADB SU, can execute adb root, adb remount and adb shell setenforce 0, installed app can get root by magisk?
[Miscellaneous Android Development] OMAKE:
Doesn't works.

Can't even execute script from sdcard.
[Miscellaneous Android Development] TrippTech:
Lg Stylo 4

armv7l machine

Failed critical init step 1 Incompatible platform
[Miscellaneous Android Development] TrippTech:
Im lost lmao help
[Miscellaneous Android Development] TrippTech:
im sorry to blow you up. Last question Im on the LG Stylo 4 and it took me alot of time to get here and change little permissions but is this leading to the right path
[Miscellaneous Android Development] diplomatic:
Hard to say what's going on there. Why do you need the /data/bin directory to be in PATH? Perhaps that's messing things up if you have some binaries in there. Also, you should not need root to run 'sh /storage/..../magisk-boot2.sh'. Check if magisk-boot2.sh has the right permissions, ownership, and selinux context. It could have gotten stuck with some high level permissions if you copied it using a root shell...
[Miscellaneous Android Development] diplomatic:
Mediatek-based Stylo only, bro. And an older firmware to boot.
[Miscellaneous Android Development] Ryccardo:
"Finally" patched on Xperia L3 by the october 2020 update (which in $ony tradition was released in december)!

Thanks again Diplomatic, was fun while it lasted :)

(off topic)

Of course the bootloader unlock in developer settings continues to be fake...
[Miscellaneous Android Development] siamese007:
Hello sir,

I followed this tutorial but I got this result unsuccessfully rooted my Teclast M30 Pro Android 10 ARM64 A/B. MT6771 chipset.

Please help.
[Miscellaneous Android Development] TetsuK:
Hi, I owned an Huawei Y5 2019 (MT6761) and I'm interested to know how to make a "tailored" version of MTK-su to work on my phone. 'cause I can't unlock my bootloader.
[Miscellaneous Android Development] diplomatic:
You're welcome. Hope you can downgrade...

Do you happen to know the last version of the firmware that worked with mtk-su?

This will never work with Android 10 for multiple reasons, one being that apps are prevented from running their own native executables.
[Miscellaneous Android Development] VD171:
First and again, thank you very much for your incredible contributing.

Just pack native executables as shared library object.

You can exec it if it is inside the /data/app/package/lib.

Because the installer copies SO with +x mode to the lib folder.

Give a try to my app, you will see it happening: https://xdaforums.com/t/app-v1-08-vd-infos-package-com-vitaodoidao-vdinfos.4097379/
[Miscellaneous Android Development] ineedroot69:
it's been almost 2 years since this tool help me dump my phone boot.img and recovery.img and so i was avail to root my phone via Magisk and now im here once again just passing by since i accidentally bootloop my phone while installing EdXposed and Riru Module can't believe this thread is still going strong
[Miscellaneous Android Development] VD171:
It will be strong forever.

We need to work with "unrootable" devices.

And we need root to work.

So, we will need the temp root while we have any "unrootable" device.

Probably in some time, @diplomatic (or some other blessed soul) will discover a new bug to newer MTK hardwares :-)
[Miscellaneous Android Development] Dionicio3:
got this working on an A501DL, very useful since this thing can't access it's bootloader to bootloader unlock

EDIT: although, I haven't been able to get magisk working using the guide.
[Miscellaneous Android Development] diplomatic:
Cool, good to know, but that's kind of beside the point. Android 9 from MTK was the last version to have this vulnerability. Android 10 never had it.

Make sure you stick with Magisk 21.x. The new version isn't compatible with that script....
[Miscellaneous Android Development] Dionicio3:
Ah that did the trick, thank you!
[Miscellaneous Android Development] dplicato:
Excuse me, I accidentally sent a partial post, please read my next post.
[Miscellaneous Android Development] dplicato:
Hi all,

I've got a Vivo V11i phone, equipped with Mediatek MT6771 Helio P60 chipset.

I want to TEMPORARY root my phone just to be able to copy from the phone to my computer the content of some folders inside /data/data path, unaccessible without rooting.

So I found this wonderful thread and my first question is: can I copy files from /data/data protected path using mtk-su? (assuming that mtk-su works with my chipset/phone).

The second question is about the original post of this thread, when the author says:

"WARNING If you have a device with Android 6 or higher, it likely has dm-verity enabled. On such a device one does not simply remount the system partition as read/write. The remount command will probably fail. But if you succeed in forcing it somehow it will trigger dm-verity, which will result in a very bad day. Your device will become inoperable until you restore the stock system partition."

My phone has for sure an higher versione than Android 6: as I said I just need to read files and I don't need to remount the filesystem. Do I have to worry about the author warning?

Thank you very much first of all to the mtk-su author and to anyone that will reply.
[Miscellaneous Android Development] djndjn4040:
help me with this please device doogee x70 run on 8.1 arm7vi

Temporary root by diplomatic@XDA Home URL: https://xdaforums.com/android/development/amazing-temp-root-mediatek-armv8-t3922213 -------------------------------------------------- armv7l machine param1: 0x1000, param2: 0x8040, type: 12 Building symbol table kallsyms_addresses pa 0x80bd7470 kallsyms_num_syms 37789, addr_count 37789 kallsyms_names pa 0x80bfc300, size 467744 kallsyms_markers pa 0x80c6e620 kallsyms_token_table pa 0x80c6e870 kallsyms_token_index pa 0x80c6ebc0 Patching credentials Parsing current_is_single_threaded c03acc44: MOVW R4, #0xfe48 c03acc4c: MOVT R4, #0xc101 Possible list_head tasks at offset 0x290 comm swapper/0 at offset 0x438 Found own task_struct at node 1 cred VA: 0xc5247000 thread_info flags VA: 0xdb8e4000 seccomp mode VA: 0xc4819610+2ac init_task VA: 0xc1027a70 Parsing avc_denied c034da28: MOVW R0, #0x9ee4 c034da2c: MOVT R0, #0xc111 selinux_enforcing VA: 0xc1119ee4 Setting selinux_enforcing Switched selinux to permissive Disabling seccomp thread flags: 0x00000800 TIF_SECCOMP deactivated seccomp mode: disabled starting /system/bin/sh UID: 0 cap: 3fffffffff selinux: permissive Load policy from: /sys/fs/selinux/policy ln: cannot create hard link from '/sbin/charger' to '/root/charger': File exists ln: cannot create hard link from '/sbin/magisk' to '/root/magisk': Cross-device link ln: cannot create hard link from '/sbin/magisk32' to '/root/magisk32': Cross-device link ln: cannot create hard link from '/sbin/magisk64' to '/root/magisk64': Cross-device link ln: cannot create hard link from '/sbin/magiskhide' to '/root/magiskhide': Cross-device link ln: cannot create hard link from '/sbin/magiskinit' to '/root/magiskinit': Cross-device link ln: cannot create hard link from '/sbin/magiskpolicy' to '/root/magiskpolicy': Cross-device link ln: cannot create hard link from '/sbin/resetprop' to '/root/resetprop': Cross-device link ln: cannot create hard link from '/sbin/su' to '/root/su': Cross-device link ln: cannot create hard link from '/sbin/supolicy' to '/root/supolicy': Cross-device link ln: cannot create hard link from '/sbin/ueventd' to '/root/ueventd': File exists ln: cannot create hard link from '/sbin/watchdogd' to '/root/watchdogd': File exists Error making /sbin hardlinks exit value
[Miscellaneous Android Development] waayo69:
init.d scripts support app force closes on my phone (asus zenfone max 3 5.2) any ways to make this work?
[Miscellaneous Android Development] Cjplay93:
I see that v12 on another post has the binary in the arm (32-bit folder) Why does the v23 version have nothing in the arm folder? The 9thgen Fire 7 I have rejects the arm64 version for being a 64-bit version. Thank you very much for all your efforts on this!
[Miscellaneous Android Development] diplomatic:
Need more info. What version of Magisk? What is the output of running it the first time after clean boot, if that's not what that is?

Try an older version of that app? Alternatively, you can modify the script a little and run it from a different app like a terminal emulator.

R23 has both versions. Perhaps that file fell victim to your antivirus? ;)

- D
[Miscellaneous Android Development] djndjn4040:
i just follow your tutorial i try difrent versions of magisk starting from 7.1.1 to 7.5

my phone is doogee x70 has mtk 6580 chip
[Miscellaneous Android Development] waayo69:
ive tried every versions of the app still force closing. does it have to do with google play service? i just flashed my phone to stock and somehow the firmware i downloaded doesnt have any google store stuff related apps.
[Miscellaneous Android Development] HemanthJabalpuri:
If someone want to try Magisk v22+ then follow below instructions

If you have Magisk less than v22 before then delete all the things in /data/adb and also uninstall Magisk Manager

Download and install Magisk app from here and put apk in sdcard as /sdcard/init.d/bin/magisk.apk

Put mtk-su as /sdcard/init.d/bin/mtk-su

Put below attached script in /sdcard/init.d and unzip file as /sdcard/init.d/bin/unzip. Execute the script

Enjoy!

Thanks
[Miscellaneous Android Development] diplomatic:
Well, you need Magisk between 19.4 and 21.4 for that script to work. 7.x, etc, are the Magisk Manager versions(?).

No, it doesn't have to do with Google services. This is the first time I've heard of such a problem. But that aside, if you can flash ROMs, can't you install Magisk the typical way (like patch the stock boot image and flash it)?
[Miscellaneous Android Development] thehotmemer:
I root my device using temporary root (mtk-su) Magisk. Can anyone tell me can i install magisk modules? Plz answer....
[Miscellaneous Android Development] ineedroot69:
i don't know but while you have temporary root access via (mtk-su) you can actually dump your phone boot.img partition then use that to install magisk
[Miscellaneous Android Development] thehotmemer:
But magisk show magisk installed and getting root access install magisk module getting hard bricked or not.
[Miscellaneous Android Development] ineedroot69:
you used init.d scripts?
[Miscellaneous Android Development] thehotmemer:
Yes
[Miscellaneous Android Development] ineedroot69:
ahh i see i really don't know if you can install module if you use that ...

i used old version of mtk-su back in 2019 you should ask diplomatic or someone
[Miscellaneous Android Development] waayo69:
No, it doesn't have to do with Google services. This is the first time I've heard of such a problem. But that aside, if you can flash ROMs, can't you install Magisk the typical way (like patch the stock boot image and flash it)?

[/QUOTE]

my device is asus zenfone 3 max zc520tl cant flash anything aside from the official rom cuz asus dont support unlocking the bootloader anymore. btw ive found a solution, i just updated to android 7 from A6 and now it works. thanks for the replies!
[Miscellaneous Android Development] 998fa2a70c:
@diplomatic

Hi,

is there any new URL for MM Custom Update Channel?
[Miscellaneous Android Development] diplomatic:
❓

Need more details. You should be able to run it, but you need an older firmware to get past firmware unsupported messages.

What for? Have you used the latest guide for Magisk 21.x?
[Miscellaneous Android Development] jimster2:
Hi @diplomatic , thank you for this tool.

Unfortunately when running mtksu on my Honor 7S, I can see that it cannot switch selinux to permissive.

I assume that is because the vendor disable selinux mode switching in the kernel.

Please correct me if I'm wrong, the mode switching is just flipping a byte somewhere in the kernel memory. Your tool already has access to the kernel memory when the exploits runs.

Is it technically possible for your tool to dump the kernel memory into a file.

Then the user could analyze the file to find where the selinux byte is located that must be flipped.

Then the user can run your tool again with an argument pointing to the kernel memory byte which must be flipped to disable selinux.

Is the scenario above correct?

Maybe if it is doable, those of us on unsupported phones could
[Miscellaneous Android Development] diplomatic:
Hi jimster2,

It's more complicated than that. Because the selinux mode switching is disabled, your kernel does not have the selinux_enforcing variable to flip. I have a note about Honor kernels on post 4. So if you have some way to encourage me, you should PM me...

- D
[Miscellaneous Android Development] Tataty:
YEAH! Thanks to @diplomatic , this worked with a number of slaps to the back of the case of my aging ZC520TL (X008D) which says it has MT6737M (some seems to say it is 6735???)...

THIS was the gateway to unlocking the BOOTLOADER which Ass-us will not allow/enable.

These steps allowed me to get to my ADB shell and get su while the bootloader was still LOCKED (no success with fastboot, Ass-us, and any other suggestions).

THEN I followed another thread here to unlock the bootloader...

NEXT I shall try TWRP and then hopefully flash RR and/or Lineage for testing.

Again a great thanks for this guide!

Asus Zenfone 3 Max ZC520TL (X008D) ... Stock ROM flashed SPFT 14.10 ( = 7.0)

UPDATE: reflashed Ass-us 14.14 (because 14.10 caused IMEI failure), NOW repeating with the FIRST method (adb only) - since I already know that the init.d method DOES work on this model... then unlocking bootloader again (this method IS the gateway to get the BL unlocked - YEAH!)
[Miscellaneous Android Development] jimster2:
@diplomatic, do you think it would be possible to modify the exploit to load a kernel module provided by the user?

Will a kernel module be less restricted by selinux compared to a root shell?
[Miscellaneous Android Development] dav0dav0:
Does anyone know if there's an equivalent binary for Snapdragon processors?

Does anyone know if this is even possible on that family of chips (should be, but maybe Qualcomm blocks the approach...)?
[Miscellaneous Android Development] diplomatic:
You can load modules with root+permissive (unless the kernel needs them to be signed). I'm not sure if you're talking about the module somehow changing the kernel to be permissive or some other purpose. But the way to make the kernel behave like it was permissive is to patch some executable code....
[Miscellaneous Android Development] mosinnagant147:
Hey new to the forum trying to root my fire 7. I cant execute ./mtk-su every time i try to execute it gives me this:

mustang:/data/local/tmp $ ./mtk-su

Failed critical init step 3: Not a typewriter

setns failed:: Permission denied

New UID/GID: 2000/2000

thanks for any help
[Miscellaneous Android Development] diplomatic:
@mosinnagant147, what firmware version on your Fire 7? Check the last supported version in post 4. It's quite old.
[Miscellaneous Android Development] howdeedodat:
this one is temporary root right so after i reboot the phone does the SU is gone like normally or do i need to UN-SU first before the reboot ?
[Miscellaneous Android Development] mosinnagant147:
ahh yeah forgot about the firmware update. thanks for pointing that out. guess thats what happens when you try to do this with an hour of sleep
[Miscellaneous Android Development] dreadeye:
I did all that only to get an error I can't solve "Failed critical init step 1"