yashsingh1/xdaforums huggingface dataset:
[Miscellaneous Android Development] bigrammy:
by-name made simple

Not all MTK's are equal when it comes to the by-name path so I created a few noob friendly cmd's to try ensure people get the proper by-name path since it can be different depending on Android version and SoC.

EG: The mt6795 and some tablet SoC's mt8xxx use Upper Case /.../.../.../11230000.MSDC0/by-name while most use Lower Case.

Older Android Version and some OEM's still use the shorter /dev/block/platform/mtk-msdc.0/by-name

So these cmd will give you the full by-name paths for ease of use and hopefully ensure the correct paths are been followed.

This one simply finds the by-name then shows all the /by-name/file with full path.

find /dev -name by-name -exec find {} \;

Out Put Of Above Example:

/dev/block/platform/mtk-msdc.0/11230000.MSDC0/by-name
/dev/block/platform/mtk-msdc.0/11230000.MSDC0/by-name/flashinfo
/dev/block/platform/mtk-msdc.0/11230000.MSDC0/by-name/userdata
/dev/block/platform/mtk-msdc.0/11230000.MSDC0/by-name/cache
/dev/block/platform/mtk-msdc.0/11230000.MSDC0/by-name/system
/dev/block/platform/mtk-msdc.0/11230000.MSDC0/by-name/tee2
/dev/block/platform/mtk-msdc.0/11230000.MSDC0/by-name/tee1

This one does the same as above but saves it to your sdcard as a text file named "by-name-path.txt"

find /dev -name by-name -exec find {} -print > /sdcard/by-name-path.txt \;

You can read this using cat like so.

cat /sdcard/by-name-path.txt

As this by-name-path.txt was crated while in temp root it may not be visible via mtp so to get a copy to your PC use adb pull.

adb pull /sdcard/by-name-path.txt ~/Desktop

Substitute ~/Desktop with the path where you wish to save the file on your PC.

I hope this can help some who wish to make a backup while they have temp root Thank's to the brilliant mtk-su. :o

EDIT: To explain You can now use these full paths for backing up what you want.

EG: This is just a example!

Make a folder named "mybackup" on your sdcard then using the output of "your" find cmd use dd like this.

dd if=/dev/block/platform/mtk-msdc.0/11230000.MSDC0/by-name/boot of=/sdcard/mybackup/boot.img

The below will create the folder called mybackup on your internal sdcard using cmd

mkdir /sdcard/mybackup
[Miscellaneous Android Development] ahhl:
i have tried on S4, extract the boot. img, using kitchen, edut tge init. rc and repack back into boot. img and flash using twrp. it works.

just by copying only won't work.

---------- Post added at 11:01 PM ---------- Previous post was at 10:59 PM ----------

i can tell you, this commands are too high tech for me[emoji1787]

but i ll try

thanks
[Miscellaneous Android Development] ahhl:
nope. not working
[Miscellaneous Android Development] HemanthJabalpuri:
There should be space between exec find and braces

This will also works

find /dev | grep "by-name" >/sdcard/dir.txt

Or

mount | grep " /system "
[Miscellaneous Android Development] mrmazak:
you are missing a space between the second 'find' and the curley bracket {}
[Miscellaneous Android Development] bigrammy:
The cmd's work fine for me in Termux and adb shell via PC so maybe it's your typing if it's anything like mine always double check these first before stating "It did not work" I always check cmd's work for me first before posting else I can look kinda stupid. :laugh:

You need a space between find and the wiggley braces which have no space between them btw {}

yours is

find{}

should be

find {}

;)

Proof it works in termux

[MENTION=5312578]mrmazak[/MENTION]

You beat me to it :D
[Miscellaneous Android Development] diplomatic:
OK, that's solid advice on how to find your storage device node, but what does any of this have to do with [MENTION=548005]ahhl[/MENTION]'s problem??? I already told him the correct path: /dev/block/platform/bootdevice/by-name . This path is used by kernel 4.4 and higher. He already flashed his recovery and it failed to boot. If it was the wrong path, it would not have flashed at all.

He needs to modify his init.*.rc scripts, from what I gather. In order to do that, he needs to edit his vendor partition. And to be able do that, he needs to change his boot image to disable dm-verity. But he can't because the bootloader has no support for red state. The only possibility I see is, and this is very remote, is if he signs his modified boot image with a self-made AVB 2.0 signature. And I'm not even sure how to do that. Probably not worth the hassle...
[Miscellaneous Android Development] bigrammy:
I posted it for general use as it will get very messy and confusing for noob's with all the different by-name paths flying around :eek:

I have to admit even I have not seen the /dev/block/platform/bootdevice/by-name before on mediatek but then again I do not have a 4.4 + kernel device :o

So to prevent this type of confutation I posted those cmd's.

I did not quote or mention ahhl in my last cmd's post but just replied to his typo post, I am not trying to interfere with your advice in anyway. :o
[Miscellaneous Android Development] diplomatic:
[MENTION=3924647]bigrammy[/MENTION], yeah, I know, that method is very useful....I have no doubt. But before, you kind of suggested that ahhl's error was due to using the wrong path. And that couldn't be the case, because dd would have thrown an error and his stock recovery would have remained. So him looking for the right by-name directory is a waste of time...

I've seen the ...bootdevice... path on at least 3 different firmwares. What they had in common was kernel 4.4 or 4.9. Just saying...
[Miscellaneous Android Development] bigrammy:
I was just tying to help & I am not questioning you or your advice bro.

Yes I did think the ...bootdevice... path may of been wrong until I saw the screenshot he posted then I realised it was indeed correct. :eek:

This why I tried to work out a "nicer" way to get the full by-name/file paths otherwise noob's will just copy n paste the first path cmd's they come across and say "dosn't work" without even checking if the path exists or not.

It'll save you a lot of spoon feeding later on hopefully. :laugh:
[Miscellaneous Android Development] ahhl:
Amazing Temp Root for MediaTek ARMv8

yup, spoon feed better[emoji1787] because we don't even understand what the command are for [emoji28]
[Miscellaneous Android Development] ahhl:
cut/paste work[emoji23][emoji13] thank you

i have extracted recovery image and boot image using

dd if=/dev/block/platform/bootdevice/by-name/recovery of=/sdcard/recovery.img

dd if=/dev/block/platform/bootdevice/by-name/boot of=/sdcard/boot.img

both file size exactly the same 67.11MB.
[Miscellaneous Android Development] mrmazak:
There is a partition on many mtk devices. I can tell from your screenshot, yours has this partition.

'seccfg'

This holds the status of bootloader unlock.

And the 'warranty' flag as well.

Like when you unlock bootloader status will show

Unlock = yes

Warranty= no

, then relock it, Status will show

Unlock= no

Still

Warranty= no

If you copy this partition now. Then you could restore full lock status and warranty to yes

It is also rumored that you can replace this partition with one from unlocked device and have unlocked status without wipeing /data.
[Miscellaneous Android Development] ahhl:
can i extract that folder?
[Miscellaneous Android Development] mrmazak:
The only way I know is to use a hex editor

And you can use the compare function of hex Editor to compare the before and after file
[Miscellaneous Android Development] ahhl:
sorry, actually what i mean, how to extract or copy that folder to sdcard? same way i dd boot. img?
[Miscellaneous Android Development] bigrammy:
Yes using dd like you did for the boot.img will be fine.

I would grab them all if I was you they should amount to around 6GB ish so make sure you have enough space. :good:

There is No need to backup the userdata which will be very large indeed using dd using a tar cmd would be better for that but I can't seem to remember it off the top of my head. :eek:
[Miscellaneous Android Development] ineedroot69:
MT6797 is listed on supported chipset give it a try ...
[Miscellaneous Android Development] Pureindica:
Works for Lenovo Tab 8 TB-8304F1

I got a temp root shell on Lenovo Tab 8 TB-8304F1
[Miscellaneous Android Development] mirrorable:
Will this work on the ARM Cortex-A55

Will this work on the ARM Cortex-A55, anyone know a root method for the ARM Cortex-A55
[Miscellaneous Android Development] Yellow-Snow:
Just got my 10 HD 2019.

Booted it but it connected to wifi and i think it started to update.

I didn't put in wifi password.

I pulled the power of my modem rebooted and still on 7.3.1.0

Getting stuck at ./mtk-su

Even tried +x

Tried /system/bin: sh /data/local/tmp/mkt-su

Thoughts?
[Miscellaneous Android Development] diplomatic:
[MENTION=5277039]Yellow-Snow[/MENTION], that tablet needs the arm version. Also, make sure that you have met the first requirement. ;)
[Miscellaneous Android Development] mirrorable:
Can Confirm Not Working For ARM Cortex-A55

Does not work for the ARM Cortex-A55 maybe an update later will fix this issue?
[Miscellaneous Android Development] diplomatic:
:confused: What device? What chipset? That doesn't sound like Mediatek. ARM Cortex is too vague. It's just the CPU architecture variant. This needs a Mediatek SoC. No exceptions.
[Miscellaneous Android Development] mirrorable:
blu studio mega 2019 is the device, yeah its not a mediatek device. Wish it was though make rooting a lot easier for me.

Edit:

Hardware :

Unisoc

Model : G5 Plus

Build number : BLU_G0190_V9.0.04.05_GENERIC_31-12-2019_1605

Build date UTC : 20191231-080602

Android v : 9

Baseband v: FM_BASE_18B_W19.10.2_P20.02|sc9863A_modem|09-05-2019 20:38:13

Kernel v : 4.4.147 (fqian@fqian) (gcc version 4.9.x 20150123 (prerelease) (GCC) ) #1 SMP Tue Dec 31 16:22:28 CST 2019
[Miscellaneous Android Development] diplomatic:
[MENTION=10474135]mirrorable[/MENTION], ok, so it's a Unisoc chip. (So can't be supported by this tool.) FWIW, that phone would probably have been blocked from this method even if it was MTK. It's too recent. Have you already tried the usual unlocking methods, fastboot, etc?
[Miscellaneous Android Development] mirrorable:
Yeah i have tried fastboot & adb. Darn thing is pretty tricky to unlock when i try fastboot unlocking it just says this.

FAILED (remote: Not implemet.)
[Miscellaneous Android Development] mirrorable:
What tool should i use i looked into the spreadtrum tool but that one does not seem to work for me.
[Miscellaneous Android Development] diplomatic:
No idea. Look, if you can't get it unlocked via 'fastboot flashing unlock', then getting any kind of root ever on that phone will be a long shot at best. There is not a lot of public information about this chip vendor. So finding specific working hacks for it will be hard to come by. And you still have to have a copy of the stock ROM package to install a root manager. My advice is, if rooting/modding is important to you, it's better to just return/sell that handset and get a new one that is not locked down tight.
[Miscellaneous Android Development] tiberian41:
I have a Blackview BV6100 (MT6761), this rooting method didn't work for me. However, I did manage to unlock the bootloader.

'fastboot oem unlock' didn't work form me.

I used:

'fastboot flashing unlock' (from ADB).
[Miscellaneous Android Development] pieromtk:
Just tried, but it doesn't work: it tells me to confirm with volume up, but it ignores all key presses.
[Miscellaneous Android Development] tiberian41:
I can't remember the key combination, but it may be a case of trying any combination of pressing up/down/power, depending on key mapping. Failing that, SP Flash the rom, and try again.

These Chinese phones can be quite glitchy. The manufactures also make it very hard to root them and create custom recoveries. In the later case, I'm trying to figure out how to create a TWRP.FSTAB file that works in the randisk root, when the stock .FSTAB is symlinked to the \ramdisk\etc folder. Very frustrating. There's plenty of weird things about these phones. For instance, where you normally boot holding power+volume down to get into the bootloader and power+volume up for recovery, both use the power+volume up keys as bootloader is an option from within recovery. Incidentally. Power+volume down goes into some hardware test functions.

FYI. If you achieve boot unlock:

1) Your warranty with Blacview will be void,

2) The phone will do a factory reset. So you will have to set up again, and then re-apply Mtk-su, and any changes you made.
[Miscellaneous Android Development] pieromtk:
The only key combination that i haven't tried is all 3 keys together.

There's another fstab in /nvdata, that seems to correspond to the truth.

as for the warranty it doesn't matter, as the telephone is just a little better than a brick and it's equally hurtling...

I've tried to flash the rom, overwriting with dd as root the recovery partition, but the original one was restored.
[Miscellaneous Android Development] tiberian41:
I also tried image patching via Magisk. A long story short, it didn't work either. However, when I checked if the phone was A/B, or SAR according to Magisk GitHub/Wiki, with the following result:

In terminal:

'getprop ro.build.ab_update', no result.

getprop ro.build.system_root_image = True. Indicating SAR - System as Root.

[MENTION=8132642]diplomatic[/MENTION]

EDIT 1: although the phone uses an arm64 cpu, Blackview put a 32bit OS on it.

Also, it uses the A partition as SAR. I read in a post on 4PDA about magisk patching, that mounting / system in RW on system-as-root (SAR) devices has changed. Now you need to mount the root, and not / system directly.

Edit 2: Tried mtk-su_r20 after I updated the firmware with the same results through ADB, -v 'arm71 machine'. However, through terminal emulator and termux, I get 'no such file or folder', and can't chmod mtk-su as I have rw issues and a bad fstab.
[Miscellaneous Android Development] diplomatic:
Try entering the 'fastboot oem key...' command during the prompt. See this post for more details. That command simulates physical button presses. According to it, 'fastboot oem key 8' is vol. up, 'fastboot oem key 2' is vol. down, 'fastboot oem key 5' is enter. Or try other numbers if those don't work out.

If you have booted Android after flashing, it will restore the original recovery.
[Miscellaneous Android Development] pieromtk:
I've tried

- fastboot oem unlock and in a different session fastboot oem key 8 when prompted => no good

- fastboot oem unlock 8 => no good

- fastboot oem unlock key 8 => no good

- typed 8 ( + enter) when still connected with fastboot => no good

I don't understand how I'm supposed to pass "key 8" to simulate volume up if the previous command is still pending completion.

It doesn't look like fastboot is supposed to work like adb shell.

I've never heard of that clk. I'm scared by windows stuff.

I gave the command adb reboot recovery immediately after flashing the twrp.img, not booting directly to android.

---------- Post added at 11:31 PM ---------- Previous post was at 11:14 PM ----------

Moreover I've discovered that the correct keys seem to be

24 --> "KEYCODE_VOLUME_UP"

25 --> "KEYCODE_VOLUME_DOWN"

26 --> "KEYCODE_POWER"

adb shell

input keyevent 24 / 25 / 26

dos the right thing: increase, decrease the volume, power up/down
[Miscellaneous Android Development] diplomatic:
Well, that was just an idea, and a long shot anyway. If it was going to work, using a different fastboot session would be the way to go. I would try different numbers with oem key, like between 0 and 9. BTW, combining oem unlock and oem key makes no sense. Those are 2 separate commands.

What is "twrp.img"? Unless this is a custom recovery that's been tested to work on your phone, it's unlikely to boot. It's probably just failing to boot (because of verification or bugs) and rebooting back to Android.

I don't think that has anything to do with fastboot. This is interacting with Android, while fastboot is a compact interface to the bootloader.
[Miscellaneous Android Development] bigrammy:
The spec's for your device Here says the device was launched with MM (Android 6.0) :confused:

If it's still on MM (Android 6.0) then you Probably don't need to unlock the bootloader on your device. :)

Using AVB signed images is normally enough so give that a try. :fingers-crossed:
[Miscellaneous Android Development] pieromtk:
Yes, it's still on Android 6.

I'm waiting for the MicroSD. This brick doesn't even have the space to hold a secondary image (I have 3 GB available and all images that I've found so far are 4+GB).

---------- Post added at 03:48 PM ---------- Previous post was at 03:46 PM ----------

it's an unofficial TWRP for this telephone that was built and distributed on some dodgy site. Probably I shouldn't even touch it with a barge pole, but being this phone as good as it is ... it can hardly work any worse.
[Miscellaneous Android Development] bigrammy:
Your phone is very well supported over on 4PDA HERE you will find everything you could ever wish for on that thread.

You will need to sign up to be able to download the TWRP recovery.img stock & custom firmwares etc.

No need for BootLoader unlocking it would seem. :o
[Miscellaneous Android Development] pieromtk:
oh, wonderful. Thanks!
[Miscellaneous Android Development] pieromtk:
Question: if i get to install the patched image using magisk, will I be able to install twrp in place of the recovery image?
[Miscellaneous Android Development] sabotage154:
Cubot King Kong Mini Root

hello. i cant find any root solution for the Cubot King Kong mini. so im going to try this mtk-su. i did a search on the thread and couldnt find anything on the king kong mini. im going to try the "Full root with magisk on locked bootloader" here

I have a question. CPU-Z says the Cubot king kong mini is running kernel architecture armv7l. im kind of confused on which version of MTK-SU to use, the processor/hardware is ARMV8 i believe but the kernel is armv7l.

Here are the specs for the device.

BOOTLOADER UNLOCKED

Hardware : MT6761V/WE

Model : KINGKONG_MINI

Build number : CUBOT_KINGKONG_MINI_9101C_V06_20191121

Build date UTC : 20191121-130020

Android v : 9

Baseband v: MOLY.LR12A.R3.MP.V75.5.P2,MOLY.LR12A.R3.MP.V75.5.P2

Kernel v : 4.9.117+ (feserver@v121-T7910O) (gcc version 4.9.x 20150123 (prerelease) (GCC) ) #2 SMP Thu Nov 21 21:24:23 CST 2019

If the kernel architecture is ARMv7l i believe i have to use the mtk-su arm (32 bit) binary, is that correct? thanks in advance.
[Miscellaneous Android Development] martyfender:
I am confused. I have a Smartab st7150 which supposedly has a rockchip cpu and as far as I know is not rootable. Is it the same as this mtk chipset that can be used with mtk-su? Or this exploit also works with it?
[Miscellaneous Android Development] diplomatic:
Yep, exactly. Although chances are kind of low that mtk-su will handle that phone. It came out recently enough to have mtk-su's access method blocked by the FW. Let me know how it works. But even if that's the case, with an unlocked bootloader, you should have no problem getting root by flashing a Magisk-patched boot image. You just have to have a copy of the stock FW. You could probably extract it with SP Flash Tool, which I don't see that phone having roadblocks to.

No, I guess there are several models of those Smartabs around, including MTK, Intel, and Rockchip(?) based. Unless it's MTK, mtk-su won't support it.
[Miscellaneous Android Development] diplomatic:
Well, from my understanding, you need to patch the recovery image instead of the boot image to get systemless root on some SAR devices. mtk-su still can't support that phone (that won't change). Not sure what else you want me to say....
[Miscellaneous Android Development] tiberian41:
I appreciate your response. I'm just finding my way and asking for advice where ever I can get it.
[Miscellaneous Android Development] sabotage154:
i went ahead and downloaded a copy of the firmware and have access to the boot.img. tried patching the boot.img with magisk and flashed it over using fastboot. flash was sucessfuly but when i boot and get back into the system there is no root showing in magisk manager. i went ahead and patched recovery.img with magisk and flashed to recovery and get stuck at bootloop. i fixed bootloop by flashing original recovery. I have not been able to gain root by patching boot and recovery via magisk. any other ideas? thank you!!!!
[Miscellaneous Android Development] Vortell:
Wish version of magisk did you use? I'm no expert but some of the newer versions have this issues with devices seemingly at random. 20.1 is the version I have stuck with on my onn tablet. Some have had to go back to 19.x. Might be worth trying.
[Miscellaneous Android Development] diplomatic:
What about mtk-su? Can you try that too?

As for patching the boot image, I looked into it a bit, and there's a common theme where Magisk is not loaded by the modded boot image. It seems that Magisk does not handle armv7 kernels. For SAR, it must patch out "skip_initramfs" in the uncompressed kernel image. This command line parameter prevents the loading of the ramdisk. But in the case of 32-bit kernels, it doesn't know how to unpack the wrapped internal vmlinuz image. That explains why your's and tiberian41's kernel as well as Onn 7" tablet doesn't load Magisk. So how to fix this? Post or send me your patched boot image. I'd like to try binary patching the kernel manually. You too, [MENTION=4134151]tiberian41[/MENTION].
[Miscellaneous Android Development] tiberian41:
Many thanks for sticking with us. Here is my patched boot image.

https://mega.nz/#!2axDDSyC!zSfFFCV2wwUEkkPwTok8UXijsw08mL36UKqFjxB57js
[Miscellaneous Android Development] diplomatic:
OK, check this out. It was more complicated than I thought. I can see why the Magisk patcher doesn't want to deal with 32-bit kernels yet. The arm image format is a lot more elaborate than arm64. But I made it as close as possible to the original...
[Miscellaneous Android Development] Vortell:
Dude your a beast can you direct me to where I can start to learn about this low level programing?
[Miscellaneous Android Development] tiberian41:
[MENTION=8132642]diplomatic[/MENTION] Absolutely outstanding. Thank you so much. I'm now rooted and am trying out some apps including SmartPack-Kernel Manager. So far, I have root for All-in-One Toolbox, L Speed , Root Explorer, Trimmer (fsftrim), and XBooster. I'm guessing something similar will need to be done should a ported TWRP become available. At the very least, I owe you a beer, or a coffee for your time and effort.
[Miscellaneous Android Development] diplomatic:
IDK, go to computer science school? ...LOL... I don't think there's a comprehensive guide on working with arm kernels within boot images. There's not much programming involved in this. I'm just winging it at every step. I kind of need to be familiar with this process to analyze kernels for mtk-su. I'll probably post a detailed guide later on. But the rundown of it is this. You basically have to extract the gzipped vmlinux binary that's buried in the kernel section of the boot image. I use a hex editor for most of this work. Then patch out the mentioned string. Then gzip it again so that the compressed size is exactly the same as the original. Paste the new vmlinuz into the original kernel+dtb, which you would have extracted using some script or Android image tool along with the ramdisk image. Now make a new boot image. I use mkbootimg for this, while picking the parameters that match the original image....

Awesome! :good: Glad I could help. I also wanted to see if I could do it and if my theory was right. The root will work just like if it was patched automatically. You can upgrade Magisk just fine using this image. But if you update the FW, this will need to be redone. Unless you keep the old kernel. (My email address does accept beer and coffee now. :) )
[Miscellaneous Android Development] Vortell:
I did haha! This is just lower level then I know. I know some c,c++,Java,html... A few more I know a bit. Only low level experience was with su basic mips processor with no additional co processors. It's been a long while since I tried to build a Linux though.