yashsingh1/xdaforums huggingface dataset:
[Miscellaneous Android Development] Force of Fire:
a detailed explanation would be nice

thank you for your reply. while there are plenty of guides for (SmartPhone Flash Tool) the guides just explain what to do but they don't explain why it must be done. i am the kind of person who tries to look at android source code to learn to the inner-working of android (by the way https://cs.android.com is a great website to look at android source code) .and I know that and img file is properly an image of a partition that can be mounted. and i know why mtk-su needs to be moved to a specific place inside the data partition because the internal storage is mounted as SDCARDFS. and only ext4 support permissions and to execute the script. (on that note can you tell me how we can put Magisk inside the internal storage and it will work although internal storage does not support permissions) .by now i think you know what type of person I am. so can you please explain to me how to use (SmartPhone Flash Tool) and why each step is done(also i am a fast learner).if you willing to do that for me that will be very nice but if you don't want because it will take time to write the explanation that is also fine but it is unfortunate for me because i love to and acquire complex technical knowledge(and also https://hernan.de/blog/2019/10/15/tailoring-cve-2019-2215-to-achieve-root is a great article about Privilege escalation exploit that mentions kernel Symbol which is also mentioned by you exploit ) and i am very certain that you used (SmartPhone Flash Tool) because you are a developer a very knowledgeable one at that
[Miscellaneous Android Development] :
Do we know those hacks or have info? I want to do it for a couple of my devices
[Miscellaneous Android Development] Lonewolfv9:
Can I downgrade my oppo f9 android 9 to 8 by flashing a 8.1 firmware rom ?

Is it possible ?
[Miscellaneous Android Development] DB126:
Please take this elsewhere or start a new thread; OT here.
[Miscellaneous Android Development] diplomatic:
Yeah, the last 3 messages before DB126's are pretty off-topic. They would be better served by being asked in more relevant threads.
[Miscellaneous Android Development] Force of Fire:
it never hurt to try

well, it never hurt to try at least I tried to ask you. this is the last that you will hear of me
[Miscellaneous Android Development] rlrevell:
I pieced together a "fake VNC" technique where I can still use these phones remotely (via ADB or SSH) with a dead touchscreen or even one that spams bogus taps. Can be useful for data recovery etc or just finding out wtf happened with your touchscreen.

But I agree in this case, the phone was backed up, and i'm looking at higher end rootable LGs now. Any recommendations?
[Miscellaneous Android Development] bigrammy:
Nice work on the magisk-boot upgrade :highfive:

[MENTION=10584235]Force of Fire[/MENTION]

Not really much in the way of support for the Nokia 5.1/3.1 plus models (which are very closely related) any place. :rolleyes:

If I ever find the time to mess with my Nokia 3.1 plus I will be sure to let you know but for now be happy with root provided in this thread as its all you really need. (oops Nokia X5 is the same device) :o

EDIT: Post update.

[MENTION=10584235]Force of Fire[/MENTION]

I Just found this thread by [MENTION=7601808]hikari_calyx[/MENTION] who has done an amazing job on organising all things FiH aka Nokia (HDM Global) so read and post questions in the thread here https://xdaforums.com/nokia-x5/how-to/guide-how-to-convert-nokia-x5-to-global-t3858253 also check out Hikari Calyx's web site https://fih-firmware.hikaricalyx.com/hmd_en.html Big Thanks to him/her for all this stuff. :D
[Miscellaneous Android Development] TiTiB:
Oukitel K9 V21_20190524 Rooted

Successfully rooted my

Oukitel K9 V21_20190524

MT6765

Android 9

Thanks [MENTION=8132642]diplomatic[/MENTION]!

I followed instructions from this thread's #135 post https://xdaforums.com/showpost.php?p=79626434&postcount=135

So I used:

mtk-su for arm (not arm64) from mtk-su_21.zip

Magisk 18.1 zip

Magisk Manager 7.1.1

Will try updating Magisk after a few days—by:

What about Magisk Manager update? Not sure if I'm missing anything by using older 7.1.1, but...

RN, not sure of possibility of permanent root, but will do some research.
[Miscellaneous Android Development] Kramar111:
[MENTION=8132642]diplomatic[/MENTION]

Fire HD 10 9th gen (2019) Fire OS 7.3.1.0 (Android 9) - working fine! Thank you very much.

P.S. Magisk Manager 7.5.1, Magisk 20.4, mtk-su 21
[Miscellaneous Android Development] Rortiz2:
Be sure to disable OTAs;)

An user disabled them and even the tablet updated to 7.3.1.2

Regards
[Miscellaneous Android Development] Supermatt01:
Tried to update

I got this when trying to update on my OPPO F11. Now I can't roll back to the OPPO version you gave me. It just forces reboot. Trying on the latest SU.boot script and newest Magisk manager. I think I've followed the steps right.
[Miscellaneous Android Development] diplomatic:
Wait, you used the old Magisk 18.x guide.... but you quoted the new magisk-boot post from here? (I just made that a few days ago.) The updated script lets you use the latest MM + Magisk 20.x. Just delete the old suboot.sh.

Yeah, the magisk-boot script will not work on the Oppo. I will have to update the Oppo script too, later. The reboot sounds like it's happening because of the general release mtk-su program. Put your custom mtk-su back in there. I will probably update that later. If you still get errors from the script, then clear the data of the init.d app and set it up again. I'll be in touch...
[Miscellaneous Android Development] TiTiB:
Yeah, I've been following this thread, but not close enough and just kinda jumped in and started rooting without fully reading; bad on me. Thanks for the info.
[Miscellaneous Android Development] Supermatt01:
Yeah, the magisk-boot script will not work on the Oppo. I will have to update the Oppo script too, later. The reboot sounds like it's happening because of the general release mtk-su program. Put your custom mtk-su back in there. I will probably update that later. If you still get errors from the script, then clear the data of the init.d app and set it up again. I'll be in touch...[/QUOTE]

Thanks brother. I tried reverting to the old one. It reboots over and over.
[Miscellaneous Android Development] BloodStormm:
I remove old suboot script and started use new.

Phone: Lenovo L18021

Magisk Manager 7.5.1, Magisk 20.4, mtk-su 21.

[IMG="Screenshots"]https://a.radikal.ru/a43/2003/79/f4c3bf3d0c6c.png[/IMG]

Also, when switching to the old script, an error is triggered.

Bad system call.

Bad /sbin mount?
[Miscellaneous Android Development] Supermatt01:
I deleted the data from the boot script app and now I got the mtk-su to work in termux but it won't work with the Magisk Manager for root. That's with the old script for OPPO. Got it to work. Newest MM, magiskscript v18. Had to force it thorough terminal emulator.
[Miscellaneous Android Development] MT_777:
vivo

can some vivo phones use the mtk-su, like Y93s, Y81, Z3i....
[Miscellaneous Android Development] Supermatt01:
It may work. You'd have to try it.
[Miscellaneous Android Development] diplomatic:
What about MM 7.1?
[Miscellaneous Android Development] Supermatt01:
No need of it. The newest MM app works. I had rolled back to it but the update worked. But still on version 18.1 and the old boot script.
[Miscellaneous Android Development] Mistercraft38:
I tried the new script and it behaves quite strangely on my phone (maybe I didn't uninstalled the old one correctly) :

- It only works when I run it from ADB (I tried with termbot/automate plus the init.d app you suggested, and it doesn't work there)

- On apps, the first attempt doesn't behave as the second : on the first try it says "Bad system call (seems to come from mount) Bad /sbin mount ?", and on the second one "Error making /sbin hardlinks" along with an error from ln : "cannot create hard link from '/sbin/*' to '/root//*': No such file or directory"

- Linking binaries from root behaves stangely : here is the output from a successful try (from adb) where I forced the script to keep running even if the linking failed :

UID: 0 cap: 3fffffffff selinux: permissive
Load policy from: /sys/fs/selinux/policy
ln: cannot create hard link from '/sbin/*' to '/root//*': No such file or directory
Error making /sbin hardlinks
20.4:MAGISK (20400)
client: launching new main daemon process

If it could help I did 'ls -la' on /root and /sbin before running it from the app, after doing so, and after running it from adb:

Root was void at the begining. After the app, there was : charger, ueventd -> ../init and watchdogd -> ../init spawned, and they stood there after ADB

Sbin was already filled with : charger, ueventd -> ../init and watchdogd -> ../init, but they disapeared after the app letting only .magisk (folder). ADB putted every magisk-related bin/links and putted back charger -> /root/charger, ueventd -> ../init and watchdogd -> ../init

I also saw an error from ln saying that /root and /sbin weren't on the same device but I can't get to reproduce this error so I assume it was just a bug...
[Miscellaneous Android Development] diplomatic:
Wow, thanks for the awesome details, [MENTION=7873712]Mistercraft38[/MENTION]! That narrows down the problem to seccomp, which blocks certain system calls. mtk-su will have to be updated to disable seccomp for Android 8. Right now, it only does so on Android 9. I'm just trying to figure out what syscall is tripping magisk. It's not mount(). Android 8 seccomp does not filter a lot of calls--only 2 that I'm aware of.
[Miscellaneous Android Development] Supermatt01:
Getting this again

Now this again.
[Miscellaneous Android Development] diplomatic:
You need to redo the environment setup in MM. In root shell, delete any file in /data/adb/magisk, e.g.

rm /data/adb/magisk/busybox

Restart MM, let it set up the environment and reboot.

If you have trouble with modules in general, then in temp root shell (clean boot without Magisk started), clear the /data/adb directory

rm -r /data/adb/*
[Miscellaneous Android Development] xplod_one:
For LG k10 m250 2017

no root. tryed both mtk-su and got the same massages as [MENTION=7873712]Mistercraft38[/MENTION]
[Miscellaneous Android Development] Supermatt01:
The first step did the job. Thanks brother.
[Miscellaneous Android Development] tecknight:
[MENTION=10584235]Force of Fire[/MENTION],

Not only off topic, but also very presumptuous and perhaps even a bit rude to one of the most knowledgeable and helpful developers on this site.

Yes, Diplomatic is extremely knowledgeable and also very helpful to anyone that posts on topic questions on his threads.

However, your questions are clearly not about obtaining temp root on a Mediatek ARMv8 based device, you are basically asking [MENTION=8132642]diplomatic[/MENTION] to come up with a completely new exploit for your device, since it's kernel appears to be patched against mtk-su.

Therefore, your question(s) should be posted in it's own new thread.

I admire that you are trying to expand your knowledge, I just think that your posts should show more respect to the most knowledgeable MediaTek developer on this site. I know that I have a GREAT deal of respect for him, I think he knows more about the internal workings of Mediatek ARM chips than anyone working for Mediatek.

Thanks
[Miscellaneous Android Development] diplomatic:
Guys, take this version for a spin. I enabled seccomp handling for Android 8. If you're curious about the problem, it's that Magisk binaries use deprecated versions of some system calls, which are not allowed by seccomp. For example, mknod() was replaced by mknodat(), and the standard libc mknod() function became a wrapper around the latter one. But Magisk is statically linked to the old Android 4.x libraries. So calls like mknod() are hard-coded.

Please post the output of 'mtk-su -v' from a terminal app. Also, let me know which phones you have if they aren't listed at the front page already...
[Miscellaneous Android Development] diplomatic:
:D

:good:

Not wrong and I'll take it :o But other MTK devs that deserve recognition too. Take a look at the groundbreaking exploits for Amazon devices from last year and before...
[Miscellaneous Android Development] BloodStormm:
Thanks it worked for me.

I also attach -v logs (init.d and terminal).
[Miscellaneous Android Development] Mistercraft38:
It worked well !

I had a strange error after the launch of magisk tho :

param1: 0x1000, param2: 0x8040, type: 13
Building symbol table
kallsyms_addresses pa 0x40d23900
kallsyms_num_syms 51159, addr_count 51159
kallsyms_names pa 0x40d87900, size 665632
kallsyms_markers pa 0x40e2a200
kallsyms_token_table pa 0x40e2a900
kallsyms_token_index pa 0x40e2ad00
Patching credentials
Parsing current_is_single_threaded
ffffff8008363d78+58: ADRP x2, 0xffffff8009581000
ffffff8008363d78+5c: ADD xd, x2, 960
init_task VA: 0xffffff80095813c0
Potential list_head tasks at offset 0x390
comm swapper/0 at offset 0x658
Found own task_struct at node 1
cred VA: 0xffffffc04c601900
thread_info flags VA: 0xffffffc08bea9000
seccomp mode VA: 0xffffffc08bea9390+360
Parsing avc_denied
ffffff80082fe2f0+10: ADRP x4, 0xffffff80097c0000
ffffff80082fe2f0+20: LDR [x4, 2988]
selinux_enforcing VA: 0xffffff80097c0bac
Setting selinux_enforcing
Selinux is already permissive
Trying seccomp-filtered syscall
Caught SIGSYS
Disabling seccomp
thread flags: 0x00000800
Trying seccomp-filtered syscall
TIF_SECCOMP deactivated
seccomp mode: disabled
starting /system/bin/sh
UID: 0 cap: 3fffffffff selinux: permissive
/data/data/org.sufficientlysecure.termbot/files/bin
Load policy from: /sys/fs/selinux/policy
20.4:MAGISK (20400)
client: launching new main daemon process
/system/bin/sh: <stdin>[94]: /sbin/magisk: No such file or director
y
/system/bin/sh: <stdin>[94]: /vendor/bin/touch: No such file or dir
ectory
/system/bin/sh: <stdin>[96]: /vendor/bin/setenforce: No such file o
r directory

But theses binaries are accessible

BTW my phone is a CUBOT POWER
[Miscellaneous Android Development] diplomatic:
OK, nice...thx for feedback. One thing to note is that the script should not be called more than once per boot cycle. The script checks for multiple runs, but if there's something broken about the marker file, then it can still run multiple times. Do you get the same errors after trying the script first thing on a clean boot?
[Miscellaneous Android Development] Mistercraft38:
Well… I thought it was a clean boot… this time I only had the error for setenforce

Also there is a weird thing : the magisk daemon turned off during the night. I was still having access to modules' binaries, but not to su. It happened yesterday too. I dumbly reran the script forcing it to skip ln verification, but there is surely a better option right ?
[Miscellaneous Android Development] bigrammy:
Edit: diplomatic answered a couple of posts below this :good:
[Miscellaneous Android Development] FusionDragon:
Stylo 4 MTK Kernel

A word of warning, this is a bit weird. While the Stylo 4 has a 64bit processor it is using a 32 bit kernel so you will need to use the 32 bit exploit. The performance of this phone is so bad, and also is limited to Widevine L3. Something tells me a modified lineageos on a 64 bit kernel would increase performance a lot and make Netflix actually show 1080p content.

To answer some other questions, sprint does not give kdz files. And I think LG thought of this because using firmware from other devices will not work on this one as well seeing that they are from 2 different chipsets. The hard truth is that I will need a custom kdz, from someone's backup or otherwise if I ever want to downgrade this phone. I don't know much about Android, or the way chipsets work so there is better information out there than I can give. I've tried accessing the preloader on the Stylo 4 as well, but it won't take commands, otherwise I'm sure people could make short work of the sprint Stylo 4 variant.
[Miscellaneous Android Development] diplomatic:
Yeah, the 2 problems, setenforce and magisk daemon exiting, are related. If you keep selinux on permissive, the daemon will get killed when the host app is closed. It's a known issue. So setenforce has to do its job. Also, you should not run the script twice. That will mess up the mounting and module initialization. To restart the daemon, just run 'magisk --daemon' in root shell (and make sure to leave it with selinux enforcing). Or reboot & rerun. Do you get the 'no such file...' errors from the init.d app too? If not, that's something related to the other app you're using and you're kind of on your own about solving that. Check for any race conditions and anything weird in the Magisk log...
[Miscellaneous Android Development] :
How about adding a permissive magisk script? On mine, I added some lines to the Vendor build.prop and now have native Permissive that suddenly showed up in the about phone section. may be something worth looking into as well? Just throwing out a couple ideas

MTK-SU supporting iphones this April 1st [MENTION=8132642]diplomatic[/MENTION]? LOL
[Miscellaneous Android Development] MT_777:
I have tried them， but failed.

Can u support them?

Please help me.
[Miscellaneous Android Development] diplomatic:
You can set it to permissive with root (app or su shell cmd) any time you want. But the limitation is that it has to be enforcing at the moment when the init.d app is closed. Otherwise, the daemon will get killed. So that's why it's problematic to make a script that leaves it at permissive...

Ah yes .... iPhone support is coming soon. It's in the final stages of testing. I was hoping you wouldn't reveal it, but now that you did, I might as well confirm... :)
[Miscellaneous Android Development] Rortiz2:
Tried on Iphone 8 and doesn't seems to be working:p
[Miscellaneous Android Development] DB126:
You're a day late; Cinderella on iDevices. Gotta wait another year. ;)
[Miscellaneous Android Development] xplod_one:
It worked. Nice work :):good:
[Miscellaneous Android Development] Supermatt01:
Sorry. I'm not the developer. Diplomatic is. Maybe he can get it working if you give him some information. You'll have to work with him.
[Miscellaneous Android Development] Shemarjustin:
My device has a mt6570 chipset(not supported). Can it still be rooted with mtk easy sure app
[Miscellaneous Android Development] diplomatic:
The mt6570 may be compatible, actually. Try to run the latest mtk-su manually in adb by following the first post. Post the results of './mtk-su -v' if it fails. Or, try the Magisk bootless root setup at this post. Please identify your phone too.

FYI, the only apps permitted to use this temp root are the ones that would ask you to download the tool manually from this thread. I don't think there are any such apps around yet.
[Miscellaneous Android Development] ogghi:
Hi, I tested latest v21 on my BV9800Pro, I get this:

Means that P70 is not affected?
[Miscellaneous Android Development] Mistercraft38:
Sorry for being so long to answer.

I use init.d app now and it works like a charm. The no such file error no longer appears and the daemon keeps running... So yeah the other app was apparently the reason

I'll probably won't get back to this thread for a long time as my issue is solved and I don't find any other bug/issue, thanks for the help and for the root, and good luck for the following ;)
[Miscellaneous Android Development] bigrammy:
For the new posters.

Before posting please ask yourself's What am I? Noob or Newb

Newb's please give details logs, device hardware specifics, Firmware version etc. :good:

This will make it far easier for the OP and maybe others to assist you. :good:

So Much truth is spoken in Jest. :laugh:

PS: this is NOT aimed at the poster above [MENTION=7873712]Mistercraft38[/MENTION]

This is just for those about to post.

.
[Miscellaneous Android Development] diplomatic:
[MENTION=3924647]bigrammy[/MENTION], it's all good man. Lack of details hasn't really been a problem in this thread lately...

---------------------------------------------------------------------------------------------------------------------------------------

Most of the recent BV phones are not prone to this since they're based off of a newer board OS from MTK (with the fix included). It's not the chip per se...
[Miscellaneous Android Development] ogghi:
Well that's good news at least for the BV9800Pro users!

Thanks
[Miscellaneous Android Development] bigrammy:
The post was an attempt at been light-hearted as I thought the linked Noob description to be very witty indeed while been 100% true. :laugh:

Guess I am going a little stir crazy with this Lock Down. :eek:

:highfive:

.
[Miscellaneous Android Development] TiTiB:
I never knew the difference. Thanks for the informative and funny link. ?
[Miscellaneous Android Development] tecknight:
[MENTION=3924647]bigrammy[/MENTION],

I see that you have 4 different MediaTek devices. May I ask which of those devices have you been able to root using mtk-su ?
[Miscellaneous Android Development] bigrammy:
MTK-SU got me root permission on All of my MediaTek devices without fail :D

MTK-SU was a God send for my MTK Sony devices because it allowed us to get a backup of the /ta partition which preserves the drm keys and some other sony stuff most of which you loose when you unlock the bootloader officially. ;)

I may add the Sony L3 to my list very soon and would of done sooner had someone far cleverer than me been able to fix the none working Ril on custom ROM builds. :crying:

I limit myself now to Sony and Nokia devices as they are relatively Cheap to buy especially OEM refurbished ones they also provide the full kernel source and allow the bootloader to be unlocked. :good:

If a universal fix for the Ril can be found these devices would be a enthusiasts dream. :D

Long Live MTK and dev's like [MENTION=8132642]diplomatic[/MENTION] :victory:
[Miscellaneous Android Development] tecknight:
Glad to hear !!
[MENTION=8132642]diplomatic[/MENTION] s MTK-SU got me root on my 3 Amazon devices: A Fire TV, A Fire TV 4K, and a Fire 7 Tablet.

Good luck with the RIL on your Sony devices.
[Miscellaneous Android Development] MT_777:
I have some vivo phones, and I use the mtk-su, but it failed.

The vivo Phones: Y93s, Y81, Z3i.

How can I do to support them?

Can you tell me or help me?
[Miscellaneous Android Development] realali:
oppo A7x android8.1.0 8U 4G 128G

When I run mtk-su in adb shell , It's success.

but when I run in my apk, It's reboot system.

Why? This is code.

Process p = Runtime.getRuntime().exec("/data/local/tmp/mtk-su"+" -v");

InputStream in = p.getInputStream();

BufferedReader reader = new BufferedReader(new InputStreamReader(in, "UTF-8"));

String line = reader.readLine(); // reboot here
[Miscellaneous Android Development] diplomatic:
The Vivo phones will not be supported by the release version. It's possible to add support, in principle, if the current mtk-su does NOT return "This platform cannot be supported". See the bottom of post 4 for details. You would have to have a way to persuade me to add support for it in a special build...

Because the kernel has exploit protection that reboots the device when it detects a UID change to 0, or possibly on an exec system call....
[Miscellaneous Android Development] realali:
Is all android 8+ have this exploit protection ?

I can't run mtk-su in apk in android 8+?

Is there other method to replace?

I use NDK popen to run mtk-su, It's also reboot.

Can you close this protection?
[Miscellaneous Android Development] umairmaher44:
oppo f3 failed

I have oppo f3 Android 6.0

Kindly help with it current and the app mediatek easy root both failed to root:( plz help me
[Miscellaneous Android Development] tecknight:
Any of you see this:

https://www.extremetech.com/mobile/...ovides-mobile-benchmark-cheating-as-a-service

Apparently Mediatek has embedded benchmark recognition and core acceleration into pretty much every kernel since 2016.

If the kernel recognizes that a benchmark is running, it disables all governors and lets the cores run full bore, in order to score better on the benchmark.