yashsingh1/xdaforums huggingface dataset:
[Miscellaneous Android Development] rc1421x:
RE: RE: Get full root with Magisk on a locked bootloader! (10/5/19)

10/5/19

Dear Diplomatic:

Thank you again for your assistance & patience!

News Flash! Heeeeeere is the complete init.d scripts support last exec results:

Can't acquire root privileges (Oct 5, 2019 10:13:04 AM)

Executing scripts from /storage/emulated/0/init.d (Oct 5, 2019 10:13:04 AM)

suboot.sh

/data/data/com.ryosoftware.initd/files/bin

UID: 0 cap: 3fffffffff selinux: permissive

source type magisk does not exist

Error in: allow magisk (null) (null) (null)

client: launching new main daemon process

(i learnt auto-copy from Phone to PC - ain't i smart...)

So here's the other details:

1. The init.d scripts supp exec log is now consistent (how many times have you helped no-minds like me who initially have a 1/2 bigillion ideas of what they're looking at & over time come back down to earth - that's me alright)

2. NOW the su util is produced - i do believe consistently. When run via PC-putty client login it instantly tells me "Permission denied". But at least I have one now - did you know that TCL's Android 8.1 doesn't even bother to supply one? Is putty from PC the wrong way to test? What would you recommend instead? I'm not taking anything for granted heeere.

OK now to Magisk Mangler! When invoked the main screen sez that both Magisk & MM are up to date. The Log(s) are both as blank as my expression.

How about MM settings?

Need I clear the Repo Cache (for old time's sake)?

Magisk Core Only (ala) Mode is OFF.

Magisk Hide is ON.

Sooperuser access is APPS/ADB - by the way the adb shell SU response id like Putty (in my hands).

Multiuser Mode is DEVICE OWNER ONLY.

Mount Namespace mode - Inherited (the wind).

Auto Response - Prompt

Req Timeout - 10s (too small mayhaps?)

and, of course...

SU Notify - TOAST

As near as I kin tell those are the relevant settings.

Is there a XDA-DEV forum post covering this?

I apologise if I'm guilding Lilly here.

Please be patient with me on this. 2 me this is one of the most incredibly marvelous projects I've seen in a long time. I want to learn!

In closing may I impart 2 u the "provenance", so to speak of droid 8.1 filesystem /sdcard:

1|U50A_PLUS_TF:/ $ su

Permission denied

1|U50A_PLUS_TF:/ $ ls -ld /sdcard

lrwxrwxrwx 1 root root 21 1969-12-31 18:00 /sdcard -> /storage/self/primary

U50A_PLUS_TF:/ $ ls -ld /storage/self/primary

lrwxrwxrwx 1 root root 19 2019-10-05 11:07 /storage/self/primary -> /mnt/user/0/primary

U50A_PLUS_TF:/ $ ls -ld /mnt/user/0/primary

lrwxrwxrwx 1 root root 19 2019-10-05 11:07 /mnt/user/0/primary -> /storage/emulated/0

Around the Filesys in 80 clicks...

yer pal

rich
[Miscellaneous Android Development] mrmazak:
That's not such good news. I just ordered another phone. Released this month I believe.

A new sub brand of BLU, the Bold N1. Helio p70 soc.

Was planning to just use mtk-su on it. I will have to try when it arrives. it is supposedly shipped with July security patch, so maybe it will work.
[Miscellaneous Android Development] diplomatic:
Happy to help...hope you can translate that into bumping my thanks meter. ;)

The problem you have is with the MM prompting. I'll repeat what I said before. Your OS is interfering with MM running in the background or its prompts. You have to take Magisk Manager off any battery optimization or background manager, etc, lists. That would probably be in Android settings, possibly in app permissions etc. MM's options don't have much effect on that. Actually, one thing you can try to change in MM, as a last resort, is to set auto response to Grant. Take a look at this post because it dealt with a similar issue:
[Miscellaneous Android Development] diplomatic:
Ouch.... I hope it's still vulnerable with the original FW. If there's a ROM or custom recovery to download, I can take a look...
[Miscellaneous Android Development] Supermatt01:
[MENTION=8132642]diplomatic[/MENTION], have you seen the zero day exploitation? Do you think it may be used for gaining full root access without malignancies?
[Miscellaneous Android Development] diplomatic:
I've read a little bit about it. The full exploit isn't published yet, I don't think. But what do you mean by malignancies? It does sound like it can get full root.

It's in a different post, 448.
[Miscellaneous Android Development] k4y0z:
Are you talking about this?

"the zero day exploitation" isn't really a good description.

I was gonna check it out as well, there is a poc available with a write-what-where primitive.

You could probably easily make an mtk-su fork that replaces the mtk-primitive with this one ;)
[Miscellaneous Android Development] rc1421x:
Re: Root via mtk-su/magisk

My smart-brick (tcl a502dl & 8.1) does not allow "enable background" app option for either MM or init.d support (some other apps still do). So I disabled Battery Optimization for MM & Init.d support & enabled app Notify for both. As for MM I added Autoresponse Grant.

Now after boot the whole shebang is no-go but a init-supp "run scripts now" starts it OK - every time after so many restarts that my smart-brick belongs on my fireplace.

Also I "think" that booting with the USB cable connect to PC is naughty -- I knew you guys hated Windows but sheesh...

Thank you very much.

Rich

:D:D:D:D:D:D:D
[Miscellaneous Android Development] diplomatic:
Yeah, I looked at the code and the memory r/w routines could be fairly interchangeable because this is in the same league as mtk-su. (Are you gunning for temp root on the Fire TV 4K stick? :) ) But seriously, can you check if Amazon's/MTK kernel has been patched for this? It may only apply to Oreo+ devices though, from what I read.

I don't get what you're saying here. So it did work with automatic Grant, or not? (And what is booting with USB cable connected?)

There's no such thing as full root without the possibility of malicious actions. I guess that's what you mean by malignancies. A vulnerability that lets you get root access is of the highest severity. That means it's at the highest priority of getting patched. Doesn't matter what's it's already being used for...
[Miscellaneous Android Development] k4y0z:
Temp root for the 4K would have been nice, yes ;)

Couldn't get it to work though on the 4K, seems like the poc would need adjustments for 32-bit anyway.

But couldn't even get the crash to work.
[Miscellaneous Android Development] hassan.seoul:
Sir root shell is working fine on termux but suboot is not working.

Device = Oppo F11 (CPH1911)

[MENTION=3211017]Supermatt01[/MENTION] was saying that suboot works fine on his device. He has not yet updated to latest security patch.
[Miscellaneous Android Development] diplomatic:
Try this script. I think it will work better.
[Miscellaneous Android Development] hassan.seoul:
Thanks A lot Sir, It worked perfectly. You should move the oppo workaround to the OP.
[Miscellaneous Android Development] diplomatic:
[MENTION=7023767]hassan.seoul[/MENTION]: Cool.... Let me know if you get any warnings from the OS about root access, and which system app is showing them.
[Miscellaneous Android Development] hassan.seoul:
No, I didn't get any kinda warning or caution. All is working fine till now. I'll let you know if anything wrong happens!

Thanks again!
[Miscellaneous Android Development] menglim:
Anyone has tried on OPPO F9 (CHP1823) yet?

Please let me know, I really want to root my device event temporary.
[Miscellaneous Android Development] Supermatt01:
https://mobile.twitter.com/Digital_Cold/status/1182098907096125441 check it out...
[Miscellaneous Android Development] rc1421x:
root via mtk-su & Magisk

Thanks again for your work & creativity. Since my TCL LX runs this method Ok but usually only after init.d support 'run scripts now' I am attempting to contact the developer in sunny Catalonia to request purchase of I. S. Pro. Since his latest version is now up to the ''1.1.40's' is there any harm in using that in place of the original '1.1.35'?
[Miscellaneous Android Development] Supermatt01:
The newest version works. I've updated the script manager every time he releases a new one. It won't get in the way.
[Miscellaneous Android Development] mrmazak:
Well, first attempt to use mtk-su on the new phone(bold N1), it failed. ( Failed critical unit step 4 )

I think I saw you work through similar issue. When was related to kernel symbol table not read.

Kallsyms has all 000000000000 listed instead of addresses

The kernel source was released, but it does not build with correct drivers. There are drivers called for in defconfig, that are not included. It will complete a build with default board named defconfig (will not boot) but not with device defconfig. Blu said they will release a fixed source soon. But maybe you can look at current source ( as long as only issue with it is just drivers)to see it mtk-su might have a chance to work. I started git hub repo for this kernel
[Miscellaneous Android Development] diplomatic:
Hey [MENTION=5312578]mrmazak[/MENTION],

I looked at your posted source code and unfortunately, it is one of the "fixed" kernels as that error suggested. The symbol table is unrelated to this because mtk-su can't even get a foothold into the kernel. A problem with the symbol table would have shown up as symbol table not found or similar. Is it impossible to make it work with the patch? I don't know. I haven't looked into that very thoroughly to make that conclusion yet.
[Miscellaneous Android Development] akshaykarve:
Mt6771 helio p60

Will this work for mt6771 oppo f7?

Will i be able to use supersu and apps like gameguardian?
[Miscellaneous Android Development] diplomatic:
[MENTION=9155241]akshaykarve[/MENTION],

There is no point in asking if it will work on a particular phone. Instead of waiting a month and a half since you came here last time, why not just take a few minutes to try it out, and report your results? BTW, on the Oppo F7, you may have to use the Oppo build from post 448. There is no SuperSU (why would you want that?). But bootless root with Magisk should work just fine.
[Miscellaneous Android Development] martyfender:
I just got a replacement tablet but have not attempted the mtk su root yet.

one question, is this the exact command to enter to backup the boot.img:

or do I need to substitute values in there? Also I assume I need to first have the mtk su pushed to the device first to do this?

In addition, can I push mtk su to the device from my Linux Mint desktop? I have Windows 7 but rarely ever boot to it now, as I like Linux Mint Mate much better on my old, 2009 Dell desktop.

I believe that if I backup the boot.img and patch it with the latest stable version it should work, assuming there was a revision of the rom on the previous failed tablet.

Concerning a previous post about Titanium Backup, I had pushed it to the back of my mind, as I had unsuccessfully tried it on a much older, Android 5.0 device and never attempted to use it again. However, I believe it was that device and buggy Lollipop that could have caused the issues in the past.

Thanks

I posted this in the wrong thread, but it may still be relevant as I am getting ready to attempt this root on my new Onn 8" tablet.
[Miscellaneous Android Development] Ikikass:
Using the root shell you get from this you can

#dd if=/dev/block/mmcblk0p42

of=/sdcard/system.img

(Use ls -al /dev/block/bootdevice/by-name or ~/platform/bootdevice/by-name to find your exact path to system)

#losetup /dev/block/loop0 /sdcard/system.img

(Your loop devices might be at /dev/loop)

#mkdir /mnt/system

#mount -t ext4 -o rw /dev/block/0 /mnt/system

#chmod -R 0777 /mnt/system

(Now you can modify your system files under /mnt/system using a terminal or any file explorer that shows the / path.)

#umount -D -f -l /dev/block/loop0

#mount -t ext4 -r /dev/block/loop0 /system

(This will mount over your current system files.)

Using this method opens up all sorts of possibilities. You can do anything you want with the system.img file and then see how well it works when you mount it. Copy the su binary from whicher Superuser manager you like into /mnt/system/bin /mnt/system/xbin and then run the apk after mounting to /system. All sorts of other stuff probably. You could of course just skip mounting to /mnt/system but I think it is safer to make any changes there and then mounting as read only to /system. If you run into any problems, simply reboot.
[Miscellaneous Android Development] akshaykarve:
[MENTION=8132642]diplomatic[/MENTION]

I know sir,

But i just dont want to brick my phone as i have no knowledge of programming but need the root

---------- Post added at 10:42 AM ---------- Previous post was at 10:42 AM ----------

[/COLOR [MENTION=8132642]diplomatic[/MENTION]

I know sir,

But i just dont want to brick my phone as i have no knowledge of programming but need the root
[Miscellaneous Android Development] akshaykarve:
Successfully did it but what next?

Update:
[MENTION=8132642]diplomatic[/MENTION]

Successfully did the temporary root. How to install supersu with root permissions using this?

Can i use apps like gameguardian and rootbrowser?
[Miscellaneous Android Development] akshaykarve:
Bootless by magisk

I did all the steps as per the post and now my phone is stuck on a boot cycle after 1 minute of loading

Any idea how to get rid of it?

Update..

Managed to get rid of the whole process by uninstalling init.d script app

Now again unrooted ?
[Miscellaneous Android Development] diplomatic:
Did you use the special oppo mtk-su I mentioned? The regular one triggers a reboot that the vendor has put in there. Before setting Run scripts at boot, you should tap Run scripts now to test it out first.
[Miscellaneous Android Development] akshaykarve:
[MENTION=8132642]diplomatic[/MENTION]

I didnot see any special oppo mtk-su in this post.

Please guide me accordingly. Sorry for the mistake if there is some special oppo mtk-su. I went thru the post again. Still unable to locate.

I used the july 2019 suboot mentioned in your post on page 14 and mtk-su for arm64 mentioned in first post.

Thanks in advance.

Also if there is special oppo mtk-su file, will replacing the initial file in init.d folder and then installing init.d script app suffice or should i do the whole process gorm scratch...

---------- Post added at 04:08 PM ---------- Previous post was at 04:08 PM ----------

[/COLOR [MENTION=8132642]diplomatic[/MENTION]

I didnot see any special oppo mtk-su in this post.

Please guide me accordingly. Sorry for the mistake if there is some special oppo mtk-su. I went thru the post again. Still unable to locate.

I used the july 2019 suboot mentioned in your post on page 14 and mtk-su for arm64 mentioned in first post.

Thanks in advance.

Also if there is special oppo mtk-su file, will replacing the initial file in init.d folder and then installing init.d script app suffice or should i do the whole process gorm scratch...

Update..

I got the oppo mtk-su

But my other question still remains..

Wont proceed until you give a green signal
[Miscellaneous Android Development] diplomatic:
Come on, man, I mentioned post 448 in my first response to you. Just use that binary when you set up init.d, instead of the original one and that's it.
[Miscellaneous Android Development] akshaykarve:
Yaaaaaay

[MENTION=8132642]diplomatic[/MENTION]

I did it... Supersu working.... But says binary occupied...

Is it common?
[Miscellaneous Android Development] hassan.seoul:
bro you have to use magisk as mentioned on page 14. SuperSu wouldn't work because of locked bootloader. Before asking any question you should search the thread.
[Miscellaneous Android Development] akshaykarve:
One more thing,

I just received an OTA system update with September 2019 google security patch.

Will installing it undo the procedure? Or brick the phone? Or will nothing happen and the root will still continue to work as it is bootless?

Thanks in advance

---------- Post added at 03:34 PM ---------- Previous post was at 03:34 PM ----------

One more thing,

I just received an OTA system update with September 2019 google security patch.

Will installing it undo the procedure? Or brick the phone? Or will nothing happen and the root will still continue to work as it is bootless?

Thanks in advance
[Miscellaneous Android Development] Vortell:
That's hard to say magisk has ota survival mode now but never used it. The truth is they could always introduce extra checks or purposely brick it if it was rooted. Though since it's not a phone that's highly unlikely. You can probably find the ota location and check it out. I think most systems keep it in some ota folder (fota maybe), somewhere in the system. I know on essential ph-1 you had to relock bootloader to get ota. You could also capture the ota and flash it in either magisk or twrp.
[Miscellaneous Android Development] diplomatic:
No, installing it will not brick it or undo the root, since the bootless root is not installed in the firmware. It runs entirely from the data partition, on demand. The main concern is whether they have patched it so that mtk-su stops working. If you can somehow get the boot image, I might be able to tell if it was patched.
[Miscellaneous Android Development] akshaykarve:
[MENTION=8132642]diplomatic[/MENTION]

Can you please advise the procedure so that i can get the file for you.
[Miscellaneous Android Development] hassan.seoul:
To All Oppo F11 users, don't update your phone to latest sep 2019 security patches if you want root.
[Miscellaneous Android Development] nawazbugti:
Got this bro 😭

Failed critical init step 4

UID: 10164 cap: 0000000000 selinux: enforcing

Root user only

---------- Post added at 06:12 PM ---------- Previous post was at 06:01 PM ----------

I already updated ?
[Miscellaneous Android Development] diplomatic:
Yeah... the file is somewhere the updater app's private directory, but I think there's no need to get it. Pretty sure you have your answer from the posts below you. It sounds like it's been patched on all Oppos. What is the FW version you have now?

Ouch... thanks for that report. Can you downgrade it? What is the last FW version that worked, so I can put it up on the board?
[Miscellaneous Android Development] hassan.seoul:
It was working on FM version CPH1911EX_11_A.22.

Stopped working after CPH1911EX_11_A.37 Update.

I'll try to downgrade and report the results.
[Miscellaneous Android Development] hassan.seoul:
Can't downgrade.

Installation failed. Installed Version is lower than current.
[Miscellaneous Android Development] diplomatic:
[MENTION=7023767]hassan.seoul[/MENTION], isn't there an SP Flash Tool ROM for your phone? Because downgrading through recovery is a lost cause. SPFT is your only option. If you can at least flash the recovery from the old ROM, then you might be able to install the old OTA zip.
[Miscellaneous Android Development] akshaykarve:
I upgraded to sept. Security patch firmware version A.36 for my oppo f7, the root still holds and is valid. Didnt do anything, just upgraded.

Sorry i couldnot find the file, so went ahead and upgraded, all working good.

Thx
[Miscellaneous Android Development] diplomatic:
Oh, that's nice to hear, [MENTION=9155241]akshaykarve[/MENTION]. :) I guess they're not too eager to patch this on Android 8.
[Miscellaneous Android Development] diplomatic:
Release 19

R19 is out. There are many small fixes and tweaks, but nothing groundbreaking. Check the changelog for the list of improvements.

As always, let me know of any new problems with this.
[Miscellaneous Android Development] bibikalka:
Another feather in your cap! Dragon Touch K10, Android 8.10, MT8163,64 bit OS (got this tablet randomly, never would have bought it):

K10:/data/local/tmp $ chmod 0555 ./mtk-su
K10:/data/local/tmp $ ls -l
total 44
-r-xr-xr-x 1 shell shell 42832 2019-01-01 01:00 mtk-su
K10:/data/local/tmp $ ./mtk-su -v
param1: 0x1000, param2: 0x8040, type: 11
Building symbol table
kallsyms_addresses pa 0x40ac9600
kallsyms_num_syms 38753, addr_count 38753
kallsyms_names pa 0x40b15300, size 483762
kallsyms_markers pa 0x40b8b500
kallsyms_token_table pa 0x40b8ba00
kallsyms_token_index pa 0x40b8be00
Patching credentials
Parsing current_is_single_threaded
ffffffc000364570+80: ADRP x0, 0xffffffc000db8000
ffffffc000364570+84: ADD xd, x0, 3696
init_task VA: 0xffffffc000db8e70
Potential list_head tasks at offset 0x340
comm swapper/0 at offset 0x5f8
Found own task_struct at node 1
cred VA: 0xffffffc049d58300
Parsing avc_denied
ffffffc000302df8+10: ADRP x4, 0xffffffc000ebd000
ffffffc000302df8+20: LDR [x4, 2156]
selinux_enforcing VA: 0xffffffc000ebd86c
Setting selinux_enforcing
Switched selinux to permissive
starting /system/bin/sh
UID: 0 cap: 3fffffffff selinux: permissive
K10:/data/local/tmp # ls
mtk-su

I don't think we'll ever see any OS updates for this, so your exploit is safe :D Later, I will try to run dynamic Magisk, to get root for misc apps. This device does not have TWRP yet ...
[Miscellaneous Android Development] diplomatic:
Thanks, [MENTION=6680544]bibikalka[/MENTION]. I don't see a reason bootless root won't work. It's true that, not only that tablet, but most devices that mtk-su supports will never get patched. It's only the latest ones that are still under development that may get locked down. Mainly just MT6771 or MT676x series (+Amazon ofc :) ). Is that good or bad? IDK, you decide.
[Miscellaneous Android Development] Supermatt01:
OPPO F11 force reboot on release v19 (Thanks OPPO) same as always.
[Miscellaneous Android Development] CharlyRifa:
Thanks for the amazing job. I have an Xperia xa ultra with Bootloader Unlock Allowed: No and i install magisk and i install viper4android module, Is dully functional. I just install the module and after reboot the phone, i execute the script for install magisk and i Made a quick reboot with an app, viper4android showed up and after i just put permissive Selinux with viper app and the driver work.
[Miscellaneous Android Development] diplomatic:
Good to know, [MENTION=6958673]CharlyRifa[/MENTION]! Someone else was asking about viper4android a while back. I'm glad to know it works. I should let you know, though, there's a glitch with running Magisk while permissive. The problem is that the OS may kill the magisk daemon when it's time to close the init.d support app. This only happens if selinux is permissive. What you can do is close the init.d app after starting root (while enforcing), and then switch to permissive.
[Miscellaneous Android Development] victorhidalgo:
Works on an Asus Zenfone Max Plus with Android 8.1.0

Regards

My congratulations and many thanks to diplomatic

I want to report that it works on an Asus Zenfone Max Plus with Android 8.1

It has a MediaTek ARMv8a MT6750.

ASUS_X018_4:/data/local/tmp $ ./mtk-su -v
./mtk-su -v
param1: 0x1000, param2: 0x8040, type: 12
Building symbol table
kallsyms_addresses pa 0x40c86e00
kallsyms_num_syms 47283, addr_count 47283
kallsyms_names pa 0x40ce3500, size 604886
kallsyms_markers pa 0x40d77000
kallsyms_token_table pa 0x40d77600
kallsyms_token_index pa 0x40d77a00
Patching credentials
Parsing current_is_single_threaded
ffffffc00033a430+80: ADRP x0, 0xffffffc001089000
ffffffc00033a430+84: ADD xd, x0, 3696
init_task VA: 0xffffffc001089e70
Potential list_head tasks at offset 0x368
comm swapper/0 at offset 0x638
Found own task_struct at node 1
cred VA: 0xffffffc011ed0200
Parsing avc_denied
ffffffc0002d9070+10: ADRP x4, 0xffffffc0014ac000
ffffffc0002d9070+20: LDR [x4, 460]
selinux_enforcing VA: 0xffffffc0014ac1cc
Setting selinux_enforcing
Selinux is already permissive
starting /system/bin/sh
UID: 0 cap: 3fffffffff selinux: permissive
ASUS_X018_4:/data/local/tmp # exit

But after this I don't know what to do to get root.

If anyone has any guidance I can follow, I appreciate it.

Thank you.