yashsingh1/xdaforums huggingface dataset:
[Miscellaneous Android Development] mr-stab:
thanks for the reply! it's actually 8.1.0 i'm using.

i'm happy to provide any data i can, if it helps. seems i can execute stuff in the tmp directory, but not elsewhere, from adb shell.

isn't selinux enforce locked on all phones? why's it mentioned in suboot.sh? i'm clueless with Linux stuff but i can follow instructions.
[Miscellaneous Android Development] ItsMeShouko:
F9 runs android 8.1.0 and it returns this

param1: 0x1000, param2: 0x8040, type: 14
Building symbol table
read failed: Bad address
A fatal error has occured, quitting
Unable to get kernel symbol table
New UID/GID: 2000/2000
starting /system/bin/sh
[Miscellaneous Android Development] mr-stab:
C:\Program Files (x86)\Minimal ADB and Fastboot>adb shell

HWDUA-M:/ $ cd data/local/tmp

HWDUA-M:/data/local/tmp $ ./mtk-su

find_selinux_enforce_var() returned -1

New UID/GID: 0/0

HWDUA-M:/data/local/tmp # ls

ls: .: Permission denied

1|HWDUA-M:/data/local/tmp # cd ..

HWDUA-M:/data/local # cd ..

HWDUA-M:/data # cd ..

HWDUA-M:/ # ls

ls: ./log: Permission denied

ls: ./verity_key: Permission denied

ls: ./ueventd.rc: Permission denied

ls: ./resetFactory.cfg: Permission denied

ls: ./microtrust.rc: Permission denied

ls: ./init.zygote64_32.rc: Permission denied

ls: ./init.zygote32.rc: Permission denied

ls: ./init.usb.rc: Permission denied

ls: ./init.usb.configfs.rc: Permission denied

ls: ./init.recovery.huawei.rc: Permission denied

ls: ./init.rc: Permission denied

ls: ./init.huawei.rc: Permission denied

ls: ./init.huawei.os.rc: Permission denied

ls: ./init.environ.rc: Permission denied

ls: ./init: Permission denied

ls: ./fstab.enableswap: Permission denied

acct charger cust_comm d dev hw_odm mnt product sdcard system

bugreports config cust_spec data dload hw_oem oem root storage vendor

cache cust custom default.prop etc lib proc sbin sys

1|HWDUA-M:/ #
[Miscellaneous Android Development] diplomatic:
Ohh, ok, so it's failing to curb selinux. That's the problem, not the OS version. What is the output of 'mtk-su -v'?

[MENTION=3211017]Supermatt01[/MENTION], can you post your -v output too?

Gotcha.... I kind of thought this would happen. It's due to a conflict between different mt6771 implementations. It will be tricky to solve. But I'll try my best.
[Miscellaneous Android Development] mr-stab:
also, this happens:

cheers!
[Miscellaneous Android Development] Supermatt01:
I'm going to update to version 16 on the laptop. I will post the log asap.
[Miscellaneous Android Development] Supermatt01:
My device driver has been corrupted or something. I can't get it to stay connected to my computer and I can't find it in the device man so I can't force uninstall it to make it install again. Anyone got a link to a trusted download source for this? I'm googling but I just had an allergy attack and can't seem to find anything I want at the moment.
[Miscellaneous Android Development] diplomatic:
[MENTION=3211017]Supermatt01[/MENTION], are you sure it's the driver and not the physical cable connection? Adb links tend to stay connected whether the driver is working on the other end or not....
[Miscellaneous Android Development] mrmazak:
Thank you for following up here, so [MENTION=8132642]diplomatic[/MENTION] can give his input. But you was told on telegram already, (could be wrong, but I do not think so).

The kernel on your hauwei device was built without possibility to switch to permissive.
[Miscellaneous Android Development] Supermatt01:
I'm not sure. I'll try another cable... Could I get an invite to the telegram group?
[Miscellaneous Android Development] mrmazak:
The group I mentioned was hauwei unlock group. Focused on Kirin chipset, not relevant to mtk.
[Miscellaneous Android Development] Supermatt01:
Oh. A telegram group for this project could be helpful though...
[Miscellaneous Android Development] diplomatic:
Oh, well that changes everything. I just confirmed by inspecting the FW that the kernel was indeed compiled with selinux permanently set to enforcing. They set "edit: the well-documented selinux permissive capability" :) to "no", which removes the selinux_enforcing variable. So it's not possible to curb it with the strategy used in mtk-su. I think to turn off selinux some of the kernel code would have to be patched directly, an entirely different approach.
[Miscellaneous Android Development] bigrammy:
Don't tell them that they will all be patching the above to "no" :crying: :laugh:
[Miscellaneous Android Development] Supermatt01:
OP4883:/data/local/tmp $ ./mtk-su -v

param1: 0x1000, param2: 0x8040, type: 14

Building symbol table

kallsyms_addresses pa 0x41021a00

kallsyms_num_syms 51927, addr_count 51927

kallsyms_names pa 0x41087200, size 664577

kallsyms_markers pa 0x41129700

kallsyms_token_table pa 0x41129e00

kallsyms_token_index pa 0x4112a200

Patching credentials

Parsing current_is_single_threaded

ffffff80083c2edc+44: ADRP x8, 0xffffff80099bd000

ffffff80083c2edc+48: ADD xd, x8, 1728

init_task VA: 0xffffff80099bd6c0

Potential list_head tasks at offset 0x480

0xffffffc05fff4480 0xffffffc006e13480 0x000000000000008c

comm swapper/0 at offset 0x758

Found own task_struct at node 0

real_cred VA: 0xffffffc04c94eb40

Parsing avc_denied

ffffff80083501f8+10: ADRP x11, 0xffffff8009c70000

ffffff80083501f8+14: LDR [x11, 24]

selinux_enforcing VA: 0xffffff8009c70018

Setting selinux_enforcing

Selinux is already permissive

New UID/GID: 2000/2000

starting /system/bin/sh
[Miscellaneous Android Development] diplomatic:
LOL... fixed.
[Miscellaneous Android Development] diplomatic:
Well, that looks ok. So the locked selinux (which would have shown up as a consistent "Root user only" msg) is not the problem in your phone. It's still the Android 9 security that has to be lifted by mtk-su....
[Miscellaneous Android Development] Supermatt01:
quick thought. should I have rebooted the device and turned off the boot script version before trying this, or should that not matter?
[Miscellaneous Android Development] mr-stab:
yes, i was told, which is why i asked the creator of this script why he had mentioned enforcing. plus Telegram thread is about 50 different phones and moves too fast for anyone with half a life.

thanks a lot for the advice, guys. i guess Huawei have made this piece of crap impenetrable.
[Miscellaneous Android Development] raj2k8:
ad blocking

can i do ad blocking with it
[Miscellaneous Android Development] DB126:
Root access permits some tools to work more effectively. However, you do not need root permissions to perform effective ad blocking using a VPN based approach (eg: AdGuard).
[Miscellaneous Android Development] Hamza417:
it is working in Oppo Realme 1
[Miscellaneous Android Development] raj2k8:
i want to use adaway which needs root access . will it work?

---------- Post added at 02:08 PM ---------- Previous post was at 02:04 PM ----------

also want to edit my build prop is it possible
[Miscellaneous Android Development] DB126:
You'll do better with a permenant root solution; check your device forum for specifics. Temp root is a stepping stone in that direction.

Edit build.prop? Folks still do that??
[Miscellaneous Android Development] diplomatic:
For which phone? If it's a recent Android version, I'm not sure. It's possible if it is all done in systemless mode. Magisk seems to be able to handle a systemless hosts file. The one reason it wouldn't work is if the modified hosts file needs to exist early in the boot process before Magisk can start.

Also, no need to quote the entire OP. It clutters up the thread. Either keep a small part of the post or wrap it in "hide" tags.
[Miscellaneous Android Development] raj2k8:
oops i ll keep it in mind

i hv infinix hot 7 pro with android 9 i tried to unlock its bootloader but

fastboot oem unlock

fastboot oem unlock go

fastboot fishing unlock

nothing worked

FAILED (remote: oem unlock is not allowed)

finished. total time: 0.016s

even i hv enabled oem unlocking in developer option

finally spflash tool worked n flashed magisk patched boot.img but it gives error on boot

Your Device has fail to pass verification and may not work properly

any solution for that
[Miscellaneous Android Development] Supermatt01:
You may need to go back to stock boot to pass dm-verity, or search for a way to turn it off in your device threads or a general kill code for it over adb.
[Miscellaneous Android Development] raj2k8:
how to disable dm veriety in locked bootloader
[Miscellaneous Android Development] DB126:
OT for this thread. Question should be asked in your device forum.
[Miscellaneous Android Development] Rortiz2:
[MENTION=8132642]diplomatic[/MENTION] worked on Xperia L3:
[Miscellaneous Android Development] diplomatic:
[MENTION=8978978]Rortiz2[/MENTION]: very good! That picture is pretty hard to see, but I'll take your word for it. ;) Thanks for reporting!
[Miscellaneous Android Development] bigrammy:
Thanks That's really good to know because I want a Xperia L3 too :good:

I want to add it to my Sony Xperia (MediaTek) collection. :laugh:
[Miscellaneous Android Development] Rortiz2:
Sorry for the offtopic but how I can restore TA partition?

I backed up with dd: dd if=/dev/block/mmcblk0p1 of=/sdcard/TA.img

Now I'm going to unlock BL and then I should restore doing:

dd if=/sdcard/TA.img of=/dev/block/mmcblk0p1

Regards!
[Miscellaneous Android Development] bigrammy:
It's a bit OT and very specific to Sony devices so please re ask this question in a Sony (MediaTek) common thread I started HERE some time ago but no one really picked up on. :(

I would consider this question to be common to all Sony (MediaTek) devices along with 98.9% of other things. :good:

Please be careful with the /ta it's very fragile and can hard brick the phone easily.
[Miscellaneous Android Development] BIOYAM:
[MENTION=8132642]diplomatic[/MENTION],

Not sure if this thread is also for reporting, Version 16 no longer works on Fire TV Box Generation 2 with newer firmware v5.2.7.0 .... it did work with prior versions.

Just an F.Y.I.
[Miscellaneous Android Development] diplomatic:
[MENTION=719170]BIOYAM[/MENTION], yes, I know. It's bad news. (A thread you just posted to.) It's not the version of mtk-su. That FW has been, let's say, made incompatible with mtk-su. So that's it for Fire TV 2, I'm afraid. Already noted on the OP devices list.
[Miscellaneous Android Development] BIOYAM:
Ah..... thanks for your reply. I was trying to help out a buddy..... Thank goodness I got my FTV2 box on v5.2.6.6!!

Again, thanks for your time.
[Miscellaneous Android Development] nonnymoose:
Look, I understand that you want to make it possible for as many people as possible to root their devices, but this is bad. It's worse than Dirty Cow even, at least from Android's perspective. With this exploit, an app could steal any data from other apps. It could steal your keystrokes, passwords, and banking info. It could lock your device and hold it ransom. If you didn't pay, it could wipe your userdata, bootloader, and modem firmware, including the IMEI. It could permanently brick your device. It could disable thermald and cause physical damage to the device. In extreme cases, like maybe on fast-charging devices, it might be possible to set your device on fire.

Please consider reporting this bug to anyone who could fix it. I don't want to feel insecure entering personal info into my own phone.
[Miscellaneous Android Development] ItsMeShouko:
If you don't like it, don't use it.
[Miscellaneous Android Development] nonnymoose:
I think you misunderstand. I'm not afraid of using it by itself (not that I would, purely since my device allows bootloader unlocking) and I more or less trust OP. The problem is that it would be trivial for a malicious app developer to insert this binary into their app. They could then completely take over your device as soon as you opened the app. I (hope that I) probably wouldn't fall for this, but there are a lot of Android users out there with Mediatek devices, and some of them might.
[Miscellaneous Android Development] ItsMeShouko:
Same goes for all proprietary apps that you use. Take any platform, be it Windows, Linux, MacOS, android etc. When you use a proprietary app or binary you are always taking a risk.
[Miscellaneous Android Development] nonnymoose:
You are correct and I agree. However, on Android, people expect that apps can't affect their device as a whole or other apps because of the sandboxing on Android. This program allows app developers to violate that expectation. That's what makes it dangerous.
[Miscellaneous Android Development] NFSP G35:
You can't protect people from their own stupidity.

mtk-su is a tool. It can be used for good or nefarious purposes. Fire is a tool, it can be used for good or nefarious purposes.

Shall we now ban fire so no one burns down houses?

Additionally, this is a tool that exploits an existing vulnerability... Not the vulnerability itself.

OP exploiting this for a good purpose (allowing power users more access to their own devices / their own property) in no way precludes an independent 3rd party from finding and exploiting the same vulnerability and using it to their own purposes, good or otherwise.
[Miscellaneous Android Development] bigrammy:
No mate what your describing is what Apple does with its iPhone users :laugh:

Stay secure by keeping the bootloader Locked do not root your phone and only install apps from the playstore then you will be fine ;)

I never use banking stuff on any phone and I recommend my friends not to either. So if some hacker does hack or find my phone the most they will get is some blurry photos, a few music tracks and a phone that cost $150 when new to try sell on.

MediaTek based phone rock they are CHEAP probably don't have any government spyware pre-installed and allow me to be in control of my own destiny so thanks to them and the OP :highfive:

Peace :cool:
[Miscellaneous Android Development] DB126:
Really. And why is that? Question assumes strong credentials and careful screening of apps permitted on your device.
[Miscellaneous Android Development] diplomatic:
[MENTION=7923407]nonnymoose[/MENTION] and [MENTION=4519203]NFSP G35[/MENTION], you both make good points. Your concerns about security are perfectly valid, [MENTION=7923407]nonnymoose[/MENTION]. I agree with them completely and with the potential malicious uses of mtk-su. You should expect top-notch protection inside your phone, even more so than from your PC. App isolation is a primary design goal of Android. But IMO, if privacy and security are of the highest priority for you, your first step should be to stay as far away from Mediatek as possible. After working on this project, I can safely say this: security being one of Mediatek's top design priorities is not a true statement. One case in point is the 2019 bootloader hacks of Amazon Fire devices. That exploit takes advantage of a bootloader bug that's been known about for at least 5 years! I bet it exists on many or most other MTK devices as well. Did MTK care to research and patch it? No. A related example: the MTK bootrom hack. That one is possible due to design flaws that are on a whole another level of carelessness. Include raw memory read & write commands in the bootrom? Sure, no problem. Just wrap them with weak encryption and no one will ever exploit them. Download mode security? Defeated and cannot be patched. Your emmc is now subject to side-channel reads and writes even if the vendor doesn't want it to be.

So going back to mtk-su. If any company mentioned in the first 3 posts is concerned about it, they already know how it works, trust me. It would not be too hard for an experienced researcher to learn what's going on there. I would say that what makes this project possible is due to things that are more "features" than bugs. Just another symptom of the little regard for security in Mediatek-land. Judging from what I've seen, I feel like MTK's platform is a playground of vulnerabilities waiting to be exploited. The ones I mentioned here are probably just the tip of the iceberg.
[Miscellaneous Android Development] dutchthomas:
Would it be possible to use the exploit to gain root, but then use root to patch the vulnerability?
[Miscellaneous Android Development] NFSP G35:
... Sorry, I couldn't help myself
[Miscellaneous Android Development] diplomatic:
No, you'd need to modify the firmware
[Miscellaneous Android Development] Seriel:
In case it hasnt been mentioned here before, this vuln works perfectly with the Nokia 1, which features a MT6732 SoC but armv7I kernel and OS.

There isn't much need for this on the Nokia 1 since it's easy to unlock the bootloader, but I still think it's nice to have regardless.

FRT:/data/local/tmp $ ./mtk-su
New UID/GID: 0/0
FRT:/data/local/tmp # whoami
root
FRT:/data/local/tmp # getenforce
Permissive
FRT:/data/local/tmp #
[Miscellaneous Android Development] Rortiz2:
[MENTION=8132642]diplomatic[/MENTION] This monday I will try mtk-su in a Umidigi One Pro (MediaTek Helio P23).

Hope it works : )
[Miscellaneous Android Development] Pix12:
Is the Onn Tablets compatible with the Magisk method?
[Miscellaneous Android Development] NFSP G35:
I wasn't able to get it to work yet... But you don't really need to. Just unlock the bootloader from fastboot, patch the boot image, and flash it.

https://xdaforums.com/general/help/how-to-unlock-root-xposed-onn-8-walmart-t3945284
[Miscellaneous Android Development] diplomatic:
Cool! Look forward to padding my list. You sure have access to a lot of phones, man :)

Not yet. I have a test version that should be good to go. Just waiting to get some results with Magisk on Android 9.
[Miscellaneous Android Development] Roly519:
Have a bbq i must attend today but as soon as i get home ill try this on a stylo 4 q710pl.
[Miscellaneous Android Development] mrmazak:
New test of magisk suboot on pie still failed.

UPDATE:

Full Root was achieved from the temp root on device running PIE.

Follow directions from the [MENTION=8132642]diplomatic[/MENTION] 's post

will need new version mtk-su, (still not released ) V18 or ?

Magiskhide is not an option

Device fails safety net.
[Miscellaneous Android Development] Pix12:
Oh the tablet actually allows unlock? Does it also work on the 10"?
[Miscellaneous Android Development] NFSP G35:
Yep!
[Miscellaneous Android Development] Roly519:
No go on the lg q710al. Cant get past the 2000 2000 thing. Ill doing a factory reset in the morning and try again. Will post pics of outcome.
[Miscellaneous Android Development] diplomatic:
[MENTION=9485151]Roly519[/MENTION], please post the text output of 'mtk-su -v' and direct me to any firmware downloads if you have em. Doing a factory reset will not change the result.
[Miscellaneous Android Development] Rortiz2:
[MENTION=8132642]diplomatic[/MENTION] Wiko View 3 not working...
[Miscellaneous Android Development] Rortiz2:
[MENTION=8132642]diplomatic[/MENTION] Can't test on Umidigi One Pro. Just recieved the phone and it's broken...

---------- Post added at 07:15 PM ---------- Previous post was at 07:15 PM ----------

[/COLOR [MENTION=8132642]diplomatic[/MENTION] Can't test on Umidigi One Pro. Just recieved the phone and it's broken...
[Miscellaneous Android Development] abdoh01:
is it work on lg k10 (lgk430dsy) ????

it is encrypted model
[Miscellaneous Android Development] diplomatic:
[MENTION=8978978]Rortiz2[/MENTION], I see. Well, $hit happens...

Currently working on the Wiko phone problem.

[MENTION=8183734]abdoh01[/MENTION], great question! I would like to know the answer to that as well. (BTW, no need to quote that entire giant post.)
[Miscellaneous Android Development] Sniff26:
Tried this on Nokia 3.1 Plus, Android 9

In the thread it says its supported but when i run ./mtk-su i get this

armv8l machine
param1: 0x1000, param2: 0x8040, type: 14
Building symbol table
Can't find kallsyms addresses
Unable to get kernel symbol table
New UID/GID: 2000/2000
starting /system/bin/sh

Any help maybe?
[Miscellaneous Android Development] martyfender:
With the assumption that adb and fastboot are set up correctly, will this work with a Linux PC connected, instead of a Windows PC?
[Miscellaneous Android Development] NFSP G35:
[MENTION=8126387]martyfender[/MENTION]

For this process, I generally boot my laptop to Ubuntu instead of Windows 10 because ADB and fastboot are more reliable there LOL.

Also, I have other Android tools setup on linux; and using the same commands from the terminal and adb shell is a lot easier than having to jump back-and-forth between PS/CMD and adb shell.
[Miscellaneous Android Development] martyfender:
Yes, I also find it more reliable on my Linux Mint, as well. I am considering getting one of the previously mentioned Onn 8" tablets.

However, I would prefer waiting until someone builds a working TWRP for it. Do you have any news on that? I posted on the Onn thread for it, but have not gotten a response, yet.

Thanks
[Miscellaneous Android Development] NFSP G35:
OT for here, I'll respond in the other thread or pm you :)
[Miscellaneous Android Development] mrmazak:
When launching magic from the mtk-su is it normal to not be able to use magiskhide? and for cts profile to fail (safety net)?
[Miscellaneous Android Development] KevMetal:
[MENTION=8132642]diplomatic[/MENTION] [MENTION=8183734]abdoh01[/MENTION] .. i have a K8 which is like k10 with lower specs ...there is another root method and also a tool to build a twrp for your LG ..this method could work with some adjustments ..supersu or su can't run or be installed due to a different compression type used by LG on the K devices ..you need a special zip that can be found in K8 forums to decompress then flash su then recompress for the phone to boot

i wanted to play with this on my K8 but my screen + digitozer broke so i need to order a replacement.

read here about lz4 compression

https://xdaforums.com/lg-k10/how-to/twrp-root-lg-k8-k350n-t3475807
[Miscellaneous Android Development] mrmazak:
Yes works on nokia 3.1 plus. BUT, you have pie(Android 9).

This is still in trials right now.

There was some changes needed to make it work on pie. A test build did work, but I don't know if it is ready for release yet.
[Miscellaneous Android Development] Senral:
OUKITEL K12 -> http://www.oukitel.com/products/k/oukitel-k12-114.html

tk-su_r16 -> not work

firmware and/or the kernel -> not available

K12:/data/local/tmp $ ./mtk-su
Can't find kallsyms addresses or offsets
Unable to get kernel symbol table
New UID/GID: 2000/2000
[Miscellaneous Android Development] mrmazak:
That is Android 9. Soon an update will be published that will work on 9. Try new version when it's available
[Miscellaneous Android Development] abdoh01:
actically you dont need to flash rce_univ.zip twice this cause you will use magsik not regular superuser

so you dont have to decompress then flash su then recompress cause magisk support lz4

and still dont know if it will work on lg k devices or not
[Miscellaneous Android Development] Sniff26:
Well, i'll wait, also, thanks to the developer who puts hard work for that!
[Miscellaneous Android Development] diplomatic:
[MENTION=7403760]Sniff26[/MENTION], [MENTION=4985904]Senral[/MENTION], [MENTION=5312578]mrmazak[/MENTION], the kernel symbol table error is due to a certain kernel configuration on new kernels, not Android 9 per se. It won't be covered by release 17. I still need to work on it. The next one may take care of it. Check back in a couple to several weeks. Thank you for your interest.
[Miscellaneous Android Development] mrmazak:
The new suboot.sh, might need two reboots for the first time to work. Or that 2 boots needed might have been just from the multiple tests I was doing.
[Miscellaneous Android Development] diplomatic:
Release 17

The next mtk-su release is out. The focus has been improvements for Android Pie. Adb shell now has full root privileges and seccomp gets disabled in app mode. There has been a major internal overhaul. So let me know if something got broken for previously supported devices.

Also uploaded is an improved suboot script for bootless Magisk.