yashsingh1/xdaforums huggingface dataset:
[Miscellaneous Android Development] diplomatic:
[MENTION=3650953]victorhidalgo[/MENTION], I'm happy to hear that phone can play mtk-su! I had my doubts about it after someone reported a problem getting it to work.

This tool gives you a shell that you can use to run commands or scripts in a root context. This is all command line based. You can use it to back up partitions, do package administration commands, access restricted files, etc. If you would like to launch Magisk to give root permissions to apps, take a look at this guide. There are some limitations. You may also be able to unlock the bootloader and install Magisk the usual way, ignoring this method completely.
[Miscellaneous Android Development] chandraxdev:
Is this working for F11 Pro also? Tried the steps but getting 'This platform is not supported'
[Miscellaneous Android Development] diplomatic:
Not with that firmware. If you can find a way to downgrade to the previous one, then it might work, but only with the special Oppo version posted earlier in the thread.
[Miscellaneous Android Development] Rortiz2:
I think you should develop for Amazon lol. Exploit FireOS via software method is almost imposible, and look you've done it (now patched tho..).

BTW: mtk-su still working on my BQ M8 ;)

130|shell@aquaris_m8:/data/local/tmp $ ./mtk-su -v
param1: 0x3000, param2: 0x18040, type: 1
Building symbol table
kallsyms_addresses pa 0x40a5a200
kallsyms_num_syms 49331, addr_count 49331
kallsyms_names pa 0x40aba900, size 604687
kallsyms_markers pa 0x40b4e400
kallsyms_token_table pa 0x40b4eb00
kallsyms_token_index pa 0x40b4ef00
Patching credentials
Parsing current_is_single_threaded
ffffffc000322acc+50: ADRP x0, 0xffffffc000cfe000
ffffffc000322acc+54: ADD xd, x0, 2576
init_task VA: 0xffffffc000cfea10
Potential list_head tasks at offset 0x340
comm swapper/0 at offset 0x5c8
Found own task_struct at node 1
cred VA: 0xffffffc01e8fdf80
Parsing avc_denied
ffffffc0002c8650+20: ADRP x0, 0xffffffc000deb000
ffffffc0002c8650+24: LDR [x0, 316]
selinux_enforcing VA: 0xffffffc000deb13c
Setting selinux_enforcing
Selinux is already permissive
starting /system/bin/sh
UID: 0 cap: 3fffffffff selinux: permissive
root@aquaris_m8:/data/local/tmp #

As bibikalka said, never will be patched since BQ doesn't provide updates anymore.

PS: I'm running CM13.0 + 3.18.140 kernel and still works :P

Cheers!
[Miscellaneous Android Development] Rortiz2:
1- No because your device uses dmverity

2- No

3- Only if you flash some partition that you should not with dd

Maybe [MENTION=3924647]bigrammy[/MENTION] that has a Sony Xperia can tell you better.
[Miscellaneous Android Development] bigrammy:
Questions

1, No this does not give you permanent root.

2, No because 1 does not work due to Sony's verity which needs to be disabled in the kernel.

3, No it wont unless you make a mistake while executing cmd's for the terminal. :o

For the XA1 or any Sony MediaTek this tool (mtk-su) allows you to get temporary root to make backup's of your important /ta partition and others before you officially unlock the bootloader. As you will know Sony wipe the Sony DRM keys and possibly some camera calibration data which is stored in the /ta partition.

I have unsuccessfully tried to get full root while the bootloader was locked but it seems Sony have all the bases covered.

Please refer to the XA1 thread to ask any Sony specific questions HERE

mtk-su has done it's job well and got you a temp root.

The rest is up to you.

Each device and OEM is different and sadly there is no one tool fixes all except Magisk or SuperSU maybe.

For ease of use a TWRP recovery would be your next step so ask around to see if one exists if not ask HERE to get your device supported. :good:
[Miscellaneous Android Development] mrmazak:
Are you trying this on your Redmi 6a?

That has mt6761 correct? Helio a22?

I have mt6762 helio p22, with 64 bit os and rom.

A beta test version of this work has given the expected root shell on kernel 4.9.77 (64 bit )

As I recall Redmi 6a has 32 bit kernel.

The device crashing g into reboot is above my head but perhaps the "new" arm version will work.

Up to [MENTION=8132642]diplomatic[/MENTION] to determine if he thinks it may be safe to try.
[Miscellaneous Android Development] diplomatic:
[MENTION=5312578]mrmazak[/MENTION], I'm working on that. Already sent him a test version. The problem was stack protection in that kernel. It was not being detected correctly in 32-bit kernels. This is the last issue to fix for R12. :fingers-crossed:
[Miscellaneous Android Development] ahhl:
Done testing. not crashing. However I will sent the text file.

it just come back to the $ prompt

---------- Post added at 03:18 PM ---------- Previous post was at 03:06 PM ----------

Ya 6a but 32bit
[Miscellaneous Android Development] ahhl:
Diplomatic, I uploaded the txt file. even though no crashing, the ,-v still got error
[Miscellaneous Android Development] ahhl:
So..what to do next...

I run Xplore, it still say my device not rooted .

but termux ls command can list all directory, as compare to previously just show as no permission
[Miscellaneous Android Development] mrmazak:
So then you did get the 'temp' root shell. That is all you where supposed to get.

Of course the explorer app still shows not rooted. This is only a temp root for that one shell session.

The next steps are different for each device

Your device has AVB (verified boot) , which means modified boot partitions will not load

It has dm-verity, so modified system partitions. Will not boot. Also with this setting, recovery get replaced if modified.

Official bootloader unlock takes care of AVB, and using something like universal-dm-verity-forceencrypt-remover will take care of dm-verity , also allow custom recovery to remain.

These are the steps as done by the guides for your phone.

There is no guide (not yet anyway) to go from temp root shell to full system root though. And this is the part where you could end up bricking a device.

I want to assume if you try to use "dd" to write a twrp recovery to to the /dev/block/..... by-name/recovery. It will boot.

But I do not know. And with verified boot, this might brick.

Your choice, try something new. Possibly achieve root , or possibly brick the device.

Vs, waiting the remainder of your 15 days to get official unlock.

Temp root is good for when you don't have an official unlock option, or for cases when the official unlock wipes some wanted partitions info. , Like mentioned few posts back. For example, on Sony device when they wipe drm keys.
[Miscellaneous Android Development] ahhl:
Can I backup my boot.img?

Sorry, very novice on this
[Miscellaneous Android Development] HemanthJabalpuri:
[MENTION=5312578]mrmazak[/MENTION]

I have a small doubt...

If bootloader is unlocked then flashing Magisk will not remove these dm-verity, force encrypt and get permanent root?
[Miscellaneous Android Development] diplomatic:
OK, thanks for the feedback. As [MENTION=5312578]mrmazak[/MENTION] said, mtk-su did what it was supposed to do. It doesn't give root permissions to your apps, at least not without the help of a temporary Magisk session. You can still do a lot of stuff from the shell, though.

About installing TWRP, you can try the dd method:

dd if=twrp.img of=/dev/block/platform/bootdevice/by-name/recovery

Although this is not without risk, it shouldn't be too dangerous as long as you're sure you can get back to Android. The twrp image will probably require at least a self-signed verified boot signature to pass locked bootloader test. The stock recovery will be restored automatically on your next reboot to Android. (So you want reboot to recovery as soon as possible.) You can also back it up with:

dd if=/dev/block/platform/bootdevice/by-name/recovery of=recovery.img
[Miscellaneous Android Development] diplomatic:
Release 12

The next release is out. This is the biggest update in years. :) Some of the highlights:

Unify the arm and armv7-kernel binaries into one

Support devices with kernel 4.9.x

Improve speed and possibly reliability

Fix arm64 support for phones on kernel 3.10.65

Fix stack protection workaround for armv7 kernels

Update readme file

This is the fastest and smoothest version yet. Everyone should update to it. As with any update, previously compatible devices could have become not-compatible. Let me know if that's the case.
[Miscellaneous Android Development] ahhl:
someone, on redmi6a thread, have patch up boot.image of redmi6a using magisk manager. if i use that patchedboot.img, will it work to unlock bootloader or what possibly might happen.
[Miscellaneous Android Development] diplomatic:
[MENTION=548005]ahhl[/MENTION]: no, that won't unlock the bootloader. In fact, modifying the boot partition is exactly what bootloader security is designed to prevent, in principle. You can try this out, but I think it's much safer to try and flash the recovery. That's because if your boot image fails, you will not get a bootable Android OS. You will have to somehow recover the stock firmware. But if booting the custom recovery fails, simply restarting the phone will restore the stock recovery.
[Miscellaneous Android Development] ahhl:
you need to add Redmi 6a Global Rom. successful
[Miscellaneous Android Development] ahhl:
pls bear with me with my lack of knowledge.

to flash the twrp, it fail
[Miscellaneous Android Development] ahhl:
ok forgot to mtk-su

however. after flash and i quickly reboot recovery but it says system destroyed.

and i reboot back to stock
[Miscellaneous Android Development] bigrammy:
Is the path you are using /dev/block/platform/bootdevice/by-name/ correct as I have not seen this sort of path used before on my Mediatek devices unless Mi created a link to make things a bit more universal. :confused:

You could use the find cmd to confirm the path and then ls to check the contents of any returned paths

EG:

find /dev -name by-name

This should return any "by-name" folders in /dev along with the full path.

Now ls the content of the by-name folder or folder's

ls path to your by-name folder produced by find eg: /dev/block/platforn/......../by-name
[Miscellaneous Android Development] mrmazak:
That is common message on xiome.

Believe it is from AVB (verified boot) warning.
[Miscellaneous Android Development] Rortiz2:
This happened to mi Mi A2 when I reocked the BL with magisk patched boot img installed. If it boots to system its OK but if it refuse to boot, you will need to flash it in EDL mode..

---------- Post added at 09:18 PM ---------- Previous post was at 09:14 PM ----------

[MENTION=8132642]diplomatic[/MENTION] release 12 worked like a charm on my Aquaris M8:

shell@Aquaris_M8:/ $ ./data/local/tmp/mtk-su -v
param1: 0x3000, param2: 0x18040, type: 1
Building symbol table
^[[Dkallsyms_addresses pa 0x40a43000
kallsyms_num_syms 49221, addr_count 49221
kallsyms_names pa 0x40aa3400, size 602609
kallsyms_markers pa 0x40b36600
kallsyms_token_table pa 0x40b36d00
kallsyms_token_index pa 0x40b37100
Patching credentials
__ksymtab_init_task not found
Parsing show_state_filter
ffffffc0000c6964+0c: ADRP x21, 0xffffffc000cea000
ffffffc0000c6964+14: ADD xd, x21, 2576
init_task VA: 0xffffffc000ceaa10
Potential list_head tasks at offset 0x340
0xffffffc0030d8340 0xffffffc030e23e00 0x0000000000008c
comm swapper/0 at offset 0x5c0
Found own task_struct at node 2
real_cred VA: 0xffffffc07919c000
Parsing sel_read_enforce
ffffffc0002cae50+04: ADRP x0, 0xffffffc000dd9000
ffffffc0002cae50+1c: LDR [x0, 316]
selinux_enforce VA: 0xffffffc000dd913c
Setting selinux_enforce
Switching selinux to permissive
New UID/GID: 0/0
starting /system/bin/sh
shell@Aquaris_M8:/ # getenforce
Permissive
shell@Aquaris_M8:/ #
[Miscellaneous Android Development] chandraxdev:
Thanks for the clarification. I have the latest firmware running on it which may not be allowing this hack. But, i don't see any option available for downgrading also considering that it doesn't support Fastboot and the recovery doesn't allow flashing an old version.
[Miscellaneous Android Development] Rortiz2:
So then not a good idea to downgrade. Maybe Oppo has an anti-rollback system like Amazon and if you downgrade will cause a brick (hard since in this case there's no amonet for that phone).

Cheers.
[Miscellaneous Android Development] DrZener:
Hi [MENTION=8132642]diplomatic[/MENTION],

any future plan about releasing exploit source code?
[Miscellaneous Android Development] leviathany2k:
Ok, so what is that we doing with this kind 4 error?

Thanks

Can't acquire root privileges (Oct 25, 2019 1:53:26 AM)

Executing scripts from /storage/emulated/0/init.d (Oct 25, 2019 1:53:26 AM)

suboot.sh

Failed critical init step 4: Bad address
setns failed:: No such file or directory
New UID/GID: 10163/10163
Root user only
[Miscellaneous Android Development] Rortiz2:
Not a good idea if you want to keep this non-patched.;)
[Miscellaneous Android Development] DrZener:
Ok, but it isn't a 0day anymore since it's released (even as a binary). MTK could easily reverse the file and find the vuln, if they want.

[MENTION=8132642]diplomatic[/MENTION] could you tell me what the hex values listed here are?

Offsets from kernel base?

kallsyms_addresses pa 0x40bdd500
kallsyms_num_syms 70337, addr_count 70337
kallsyms_names pa 0x40c66d00, size 862960
kallsyms_markers pa 0x40d39800
kallsyms_token_table pa 0x40d3a100
kallsyms_token_index pa 0x40d3a500
[Miscellaneous Android Development] diplomatic:
IDK...

Besides your own personal interest, can you tell me the broad benefits and drawbacks of releasing it? (I honestly want to hear them.) Some people have previously said I shouldn't release it.

Yeah, MTK knows about it and has actually addressed the issue. If you browse the thread, you'll see some new phones (or firmwares) simply don't play nice with mtk-su.

Those values are the locations of the symbol table components in relation to the physical address. So an arm64 kernel is loaded at 0x4008000. And if you want the offset from the kernel base, you subtract the loading address from those "pa" values. What are you after exactly?
[Miscellaneous Android Development] diplomatic:
That is from an old version. What is the message from the latest mtk-su? But in any case, it looks like your firmware is not supported. What device and firmware is this?
[Miscellaneous Android Development] Rortiz2:
You're right. I already tried to reverse it haha. Just for fun.

It's diplomaitc. If he wants he will release it. If not nothing.

Cheers.
[Miscellaneous Android Development] DB126:
Gonna chime in -- big fan of open source when it makes sense. For the vast majority of original development efforts it doesn't, at least initially, unless community support is desired, code verification needed (eg: security/transactional apps) or the original developer is moving on and wishes the project to continue. Open source advocates, not necessarily the previous poster, get their drawers in a knot when business/practical realities spoil communal hand-holding visions. Cannot see the benefit of OS for this tool given the potential for abuse.
[Miscellaneous Android Development] EZIOCOMPAGNONI:
Great work.

I have a SONY XPERIA XA1 G3 121 ANDROID 8.0.0 VERSION KERNEL 4.4.83+ BUILD 48.1.A.2.112 with boot loader already unlocked.

Is it possible to use your Root for MediaTek ARMv8 or can I have problems with the "dm-verity enabled" ?

Thanks for a prompt reply

Ezio
[Miscellaneous Android Development] DrZener:
I'm moving my first steps into exploit development and I'm trying to learn as much as possible from papers and public exploits. I'm not really interested in the vuln itself but rather in the techniques and tricks used to achieve the goal. For example, just looking at its logs I see you're solving a problem in a way I've never (in my limited experience) seen before, and it was funny and educational trying to adapt it to another exploit.

Well, I just thought that my personal interests could also be the interests of many other people.

I'm not that much into into the scene to give you a bullet list of pros and cons, so what I think is that releasing the source means sharing knowledge but also losing complete control of it. I can imagine that you put a lot of effort and I know how much frustrating can be seeing your hard work being copied/stolen w/o giving credit, therefore your reticence is totally undestandable.

These were only my 2 cents, so nevermind...

Got it, thank you.

I was just trying to understand the various steps involvend
[Miscellaneous Android Development] diplomatic:
Very good points, DB! On the subject of abuse, one thing I don't want to happen is this method being used for remote attacks. My intent for mtk-su is to be only used locally on one's own device. I don't know if the finished executable is suitable for a remote attack when coupled with another exploit. But one thing that recent binder vulnerability was notable for is having been used with another browser(?) exploit for malicious remote execution. This MTK weakness is more serious, btw.

[MENTION=8094126]DrZener[/MENTION], you're right about the hard work that's been put into it. The amount of code may be fairly small, but the vast majority of work/time/stress was spent on research, not coding. I would think the main benefit of disclosing a security vulnerability would be for it to get patched as soon as possible. But on the other hand, that is also a drawback because it counters my goal of people applying it to their own (locked down) devices. I guess I won't be releasing the source for at least a good while.

So I take it you're trying to build a kernel parser on top of that Binder exploit. If you have other questions, I might be able to help you out...
[Miscellaneous Android Development] Rortiz2:
Hi [MENTION=8132642]diplomatic[/MENTION]

Just want to thank again your hard work finding this vulnerability;)

My friend's LG K10 has locked bootloader and LG locked down fastboot mode. Used mtk-su and got temp root in almost 2 secs, pretty fast isn't it? At least on my BQ takes like 10 secs:confused:

Well anyway after getting root shell I nuked /laf partition to see if I can get fastboot and worked very well but still no bootloader. So I decided to put into it bootless root and worked like a charm as expected:)

Best Regards!
[Miscellaneous Android Development] mrmazak:
some mtk (older) control the ability to unlock with frp partition. some data that holds the selection of --development_settings-allow-oem-unlock

but then again, probably has been built without the unlock commands in the bootloader , not just the blocked the allow flag from settings.
[Miscellaneous Android Development] Rortiz2:
Thanks,

Sadly most of low-range mtk based lg phones come with fastboot mode disabled. There's no need to play with frp because I can already enable that option in dev settings.

In most lg devices, the trick is zero out the /laf partition (LG Advanced Download Mode) as here:

https://xdaforums.com/showthread.php?t=2708466

Sadly, seems that here's not the correct way since zeroing it out just reboots in system.

Well, I don't want to talk more about this here, it's becoming a bit OT, but thanks very much!

Cheers!
[Miscellaneous Android Development] diplomatic:
Awesome! Not sure why your tablet takes so long. Is it the same time frame in a terminal emulator? What about Fire OS 5 tablets?

Hey, BTW, do you have access to any MT6580 phones? I have a test version that should handle that chip as well. The MT6595 should already be supported by the release version, but that chip is not very common.
[Miscellaneous Android Development] Rortiz2:
Hey that's very cool! How come 32 bit support? I can access one Wiko with MT6580 (I can ask my classmate to give it to me for test prupouses :p).

About my tablet, termux is the same. For make it work very quick you can power off the screen and power it up again, it will crash and mtk-su will work.

About Fire OS 5 quick as always, that's what you meant?

Cheers!

EDIT: Seems that mtk-su stucks at building the symbol table, that's why takes so long:

shell@Aquaris_M8:/data/local/tmp $ ./mtk-su -v
param1: 0x3000, param2: 0x18040, type: 1
Building symbol table
[Miscellaneous Android Development] diplomatic:
I see, [MENTION=8978978]Rortiz2[/MENTION]. When you said you can power it off+on to make it work quickly, what will crash? For Fire OS5, is it ~10 seconds like the BQ or closer to 2 seconds? I don't know what it's always been. :)

Here is the version with mt6580 support. Hope it works...

I guess the cutoff is not between 32-bit and 64-bit SoCs, but more like between old and new armv7 chipsets, like before late 2014 and after. It's only those 2 mt65xx chips, I believe.

EDIT: File removed. Get the latest release from OP.
[Miscellaneous Android Development] Rortiz2:
Nice :) In FireOS if I remember it wasn't like the BQ but cannot say if it's 2 secs rn.

About the new version will try it probably today ;) So based on what you said, only the chips released before late 2014 can be supported? So I assume my Energy Phone Colors (mt6572) will not be supported (05/06/2013 = 2370 days old).

About crash, I mean it takes a bit long to load up again the lockscreen. I can record a video or catch a logcat if you want.

Cheers!

EDIT: Wohoo look at attatchment, that after run mtk-su :confused:
[Miscellaneous Android Development] blakegriplingph:
Glad you asked. I do have an MT6580 phone which we could try that build you made.

inb4 MT8127 support lol :P
[Miscellaneous Android Development] diplomatic:
No, mt6572 is no-go. It has to be their last generation armv7 chips, probably those that launched with at least kernel 3.10 on Android 5. So I'm pretty sure it's just the 2 that I mentioned.

OK, I see what you mean about the corruption. I'll take a look at it. (Don't post logs in this thread, btw.)

Have at it, blake. :) I wouldn't hold my breath about the mt8127. Most of the armv7 chips are not compatible with this. Nothing has changed. The mt6580/95 have always supported this hack. It's just that no one has asked about em until recently. ;)
[Miscellaneous Android Development] blakegriplingph:
So the MT6580's the odd man out then? That's a bummer. At least we have TWRP-based SuperSU/Magisk root with the Epic and Nabi SE though.
[Miscellaneous Android Development] bibikalka:
Alright, with all this awesome unshared knowledge inside [MENTION=8132642]diplomatic[/MENTION]'s head :D, how about a new and shiny exploit that is out there -

CVE-2019-2215.

The thinking is that [MENTION=8132642]diplomatic[/MENTION] already created lots of good infrastructure with mtk-su, can any of it be re-purposed for the above exploit in a time efficient manner? It may be that the kernel needs to be analyzed offline (which would make it a tad more complicated), to get the right addresses.

Time for a broadening assignment? ;)

Edit: Actually, if this new exploit also works on mtk devices, it will be a breeze to learn how to apply it most efficiently, given the other existing MTK bug which could feed the information for quick learning. Using both bugs together will be a nice way to shorten the learning curve to the minimum!