yashsingh1/xdaforums huggingface dataset:
[Miscellaneous Android Development] EZIOCOMPAGNONI:
This is the report of my SONY XPERIA XA1 G3 121 ANDROID 8.0.0 KERNEL 4.4.83+ 48.1A.2.112 with unlocked bootloader.

Now what steps can I take to be root?

Thank you for a prompt reply.

Thanks, see you soon

G3121:/data/local/tmp $ chmod 755 mtk-su

G3121:/data/local/tmp $ ./mtk-su

UID: 0 cap: 3fffffffff selinux: permissive

G3121:/data/local/tmp # ./mtk-su -v

param1: 0x1000, param2: 0x8040, type: 12

Building symbol table

kallsyms_addresses pa 0x40de3900

kallsyms_num_syms 47827, addr_count 47827

kallsyms_names pa 0x40e41100, size 622694

kallsyms_markers pa 0x40ed9200

kallsyms_token_table pa 0x40ed9800

kallsyms_token_index pa 0x40ed9c00

Patching credentials

Parsing current_is_single_threaded

ffffff800835fef8+58: ADRP x2, 0xffffff80096f1000

ffffff800835fef8+5c: ADD xd, x2, 1728

init_task VA: 0xffffff80096f16c0

Potential list_head tasks at offset 0x390

comm swapper/0 at offset 0x658

Found own task_struct at node 1

cred VA: 0xffffffc09feea480

Parsing avc_denied

ffffff80082f8378+10: ADRP x4, 0xffffff800990e000

ffffff80082f8378+20: LDR [x4, 2612]

selinux_enforcing VA: 0xffffff800990ea34

Setting selinux_enforcing

Selinux is already permissive

starting /system/bin/sh

UID: 0 cap: 3fffffffff selinux: permissive

G3121:/data/local/tmp #
[Miscellaneous Android Development] bibikalka:
You are already root (#) in the terminal right after your first mtk-su! Head over here to convert it into bootless Magisk root : https://xdaforums.com/showpost.php?p=79354359&postcount=4
[Miscellaneous Android Development] JustUrAverageGuy307:
we

where can i download r16

without all the survey bs? TIA
[Miscellaneous Android Development] EZIOCOMPAGNONI:
I have followed step by step the "bootless Root with Magisk and MTK-SU" guide and I continue to have this result.

Why make two folders init.d and bin in /sdcard/ when init.d scripts app use only the folder in /storage/emulated/0/init.d ?

The init.d scripts and Magisk Manager apps must remain open or must closed first to reboot the phone ?

Thanks for your prompt reply.

Best regards
[Miscellaneous Android Development] diplomatic:
Huh? R16 has been removed. Why do you need it? The current version already does everything R16 did. The only reason you'd want it is if the newer releases broke something that worked in that one.

Read it more carefully. You probably didn't place all the files where they need to go.
[Miscellaneous Android Development] juanantofb:
Hi, sorry for my english, only speak spanish.

Init.d support App can select /storage/emulated/0/init.d, say only letter and number, when i try créate a forder the App again say can créate forlder.

I can do?

Thank.
[Miscellaneous Android Development] Supermatt01:
The folder should be created by a file manager.
[Miscellaneous Android Development] EZIOCOMPAGNONI:
I have followed step by step the "bootless Root with Magisk and MTK-SU" guide and I continue to have this result.

Some questions.

Why make two folders init.d and bin in /sdcard/ when init.d scripts app use only the folder in /storage/emulated/0/init.d ?

The init.d scripts and Magisk Manager apps must remain open or must closed first to reboot the phone ?

Thanks for your prompt reply.

Best regards
[Miscellaneous Android Development] juanantofb:
Hi, thanks.

The problem is that Init.d say only letters and number when try select /storage/emulated/0/init.d created with a file manager.

My device is Gionee M7L with MT6758 Soc, internal storage is encripted.

Regards.
[Miscellaneous Android Development] DB126:
Posting the same question within 24 hours (or any timeframe) only serves to annoy those who service this thread and is the fastest path to being ignored. If a member, presumably the OP, is capable, interested and willing to respond they will.
[Miscellaneous Android Development] diplomatic:
You misunderstood. The bin folder is created inside the the init.d folder. In there go magiskinit and mtk-su binaries.

I'm not sure what you mean by letters and numbers. Select the init.d directory from your internal storage.
[Miscellaneous Android Development] juanantofb:
Hi, thanks you.

But i try to select init.d folder, in init.d support App say only letters and number folders.

If i select anotther folder that not have "." no problem.

I has been trying last release in play store and a old release, in both some problem, i will try in another phone.

Regards.

Regards.
[Miscellaneous Android Development] EZIOCOMPAGNONI:
In fact I entered the files correctly in the folders as you can see in the photos attached but correct me if I am wrong I must create the folders both in internal memory of the phone and in the sd card as pictures below and correctly insert the files in the respective folders as guide explained is correct this ?

Thanks for your prompt reply

Ezio
[Miscellaneous Android Development] juanantofb:
Hi, aparently all has benn solved.

Later i user root explorer App to créate init.d folder, now i use es file explorer and now i have magisk working :)

Only a Little problema i have to run init.d script support afeter reboot.

Thanks.
[Miscellaneous Android Development] diplomatic:
No, just the internal memory. Are you making them on the external SD card? Because the /sdcard/ path, aka /storage/emulated/0, in Android file system refers to the internal storage.
[Miscellaneous Android Development] Rortiz2:
¿Que quieres decir? ¿Tienes que ejecutar el script por cada reinicio? Se supone que la función de init.d es hacer que un script se inicie al boot. A mí me tarda un poquillo, como 1 min o algo así.

PS: Si, hablo español tmb jajajaja.

English ver:

What do you mean? Do you have to run the script for each restart? It is assumed that the function of init.d is to make a script start at boot. It takes me a little, like 1 min or something.

PS: [MENTION=8132642]diplomatic[/MENTION], with your permission going to update my AutomatedRoot with latest mtk-su binaries and I'll switch subprocess to POPEN to make it more cleaner and not generate junk .txt files.

Cheers!
[Miscellaneous Android Development] juanantofb:
Hi, sorry to all.

Hola, puff de estas no nos escapamos, nos banean seguro :)

El problema ya esta solucionado, esta rom tiene una función de black list, y White list, hasta que no pongas lo que quieres que se ejecute al inicio o que se mantenga en segundo plano, no se ejecuta o lo mata el sistema.

Tradúcelo para que no me tiren de las orejas jejejeje

Es una maravilla, ya tengo funcionando el Viper FX, lo que si me he dado cuenta es que para que las apps detecten que esta routeado hay que dejar la pantalla del MM abierta, por cierto tengo la 7.1.2, sabes si pasa algo?

Gracias a todos y al DEV.
[Miscellaneous Android Development] Rortiz2:
Ok perfecto.

Yes, sorry to all for not speaking in english xD.

EDIT: There's no problem with have the 7.1.2 I think.

Cheers!
[Miscellaneous Android Development] EZIOCOMPAGNONI:
Guys I must thank diplomatic and all of you because since yesterday finally I have my XPERIA XA1 with boot loader unlocked rooted with magisk manager and init.d scripts support apps.

I preferred to use this root process because I didn't want to flash TRWP and a custom ROM because I found myself very well with stock Sony's ANDROID 8.0.0 firmware.

A question.

At this point are there other recommended steps to have more security using this root for example to avoid problems with "dm-verity" and avoid bootloop problems?

Thanks for your prompt tips.

Best regards.

Ezio
[Miscellaneous Android Development] material-defender:
Hi, I can confirm this works on the [MT8163] Alba 7 Inch tablet sold by Argos. It is running Oreo 8.1 Go Edition.

I used diplomatic's Amazing Temp Root for MediaTek ARMv8 method.

I'll post a pic of the system info once my post count is high enough.

I've tested root using adaway and CF.lumen and both seem to work fine.
[Miscellaneous Android Development] diplomatic:
Yeah, good idea. You don't need any temporary files to run commands. Of course update the mtk-su binaries if you're already bundling them. (I see you updated the project but not mtk-su yet?)

Cool.... you don't have to post the system info, but you can post the 'mtk-su -v' output instead. I will add it as "Alba MT8163 tablet series" because I take it it's a series....
[Miscellaneous Android Development] Rortiz2:
Yes. I'm doing more changes. I will definelety update it today :)

Cheers!

Enviado desde mi WAS-LX1A mediante Tapatalk
[Miscellaneous Android Development] Rortiz2:
Ok [MENTION=8132642]diplomatic[/MENTION] this is the good update ;)

https://github.com/R0rt1z2/AutomatedRoot/releases/tag/4.3

As says in the changelog, I improved the main script and unified it to work in windows/linux without need of two scripts.

Fixed the unroot script by backing up, restoring and chcon'ing app_processes with correct SELinux contexts (u:object_r:zygote_exec:s0) tha wasn't allowing the device to boot after the unroot.

And as promised, updated mtk-su binaries to latest release.

Note that in this version, you need to have adb/python local path defined in windows.
[Miscellaneous Android Development] diplomatic:
You mean simply running this in a terminal emulator returns "bad system call"? That has to be related to seccomp. But there's no blocked system calls in it AFAIK. And the arm version has been confirmed to work on Android 9. In the init.d app, do you also see "Bad /sbin mount?" in last execution results?
[Miscellaneous Android Development] Rortiz2:
[MENTION=8132642]diplomatic[/MENTION] sorry for bother again.

Using my AutomatedRoot I can root my tablet perfectly but as I said in the past, it stucks in bootanimation due SELinux problems with /system/bin/daemonsu.

It just simply stucks at bq logo with adb connection. I can boot up it by running mtk-su since it sets SELinux in permissive and ignores all warnings. The problem is that it's a bit tricky to run mtk-su on each boot xD.

Tested this on other mt6735 device (ZTE BLADE V6) (Android 6.0 no dm-verity) and happens exactly the same. My guess is that contexts of daemonsu need to be defined in file_contexts, something like this:

# SU
/system/xbin/daemonsu u:object_r:system_file:s0

Obviously we can't do this since you need to edit the boot.img and with locked bootloader is like is not going to boot. Any ideas about how to allow this context? I think will be useful for mtk devices with 6.0.1 and no custom recovery.

Cheers!
[Miscellaneous Android Development] skystander:
Comprehensive Commands

For anyone following these instructions and want the actual commands you can follow mine below:

The following worked on Android 7.1.1

1) adb push magiskinit64 /data/local/tmp

2) adb shell chmod 755 /data/local/tmp/magiskinit64

3) adb shell ./data/local/tmp/magiskinit64 -x magisk /data/local/tmp/magisk

4) cp magiskinit64 magiskpolicy

5) cp magisk su

6) make_ext4fs -J -l 2MB magisk.img

7) losetup /dev/block/loop7 ./magisk.img (if you need to detach it run losetup -d /dev/block/loop7)

8) mkdir mountfolder

9) chmod 755 mountfolder

10) mount -v -t ext4 /dev/block/loop7 /data/local/tmp/mountfolder/

11) cat /proc/mounts | tail -n 1 (Test to see if the mount worked)

12) cp su mountfolder/su

13) cp magisk mountfolder/magisk

14) umount -f mountfolder

15) ./mtk-su

16) ./magiskpolicy --live --magisk 'allow magisk * * *'

17) ./magisk --daemon

18) pidof magiskd (check if daemon is running)

19) ./su

20) I'm not sure how to make sure the root shell has the context u:r:magisk:s0

<optional create a backup to your device's external sd card>

21) dd if=/dev/block/mmcblk0 of=/storage/sdcard1/mmcblk0.img

<if your backup is larger than 4gb then you will have to make sure its mounted as an internal sd card, as that would format it as ext4>

21) dd if=/dev/block/mmcblk0 of=/mnt/expand/<your cards number>/mmcblk0.img

22) losetup /dev/block/loop0 magisk.img (if resource busy error then locate the next available loop device using: losetup-f)

23) mount -o ro /dev/block/loop0 /system/xbin

24) killall magiskd

25) magisk --daemon (no ./ at the start)

26) exit

27) exit

28) su
[Miscellaneous Android Development] diplomatic:
Why can't you use chcon on the file? You already said you used it in your previous post. That file does not need to be in file_contexts.

Uhhhh.... ok, but why? Have you seen THIS? A proper way to launch magisk from a root shell.

I think it's because they set a different behavior for seccomp. Normally, when mtk-su does a seccomp test, it's supposed to receive a signal after a blocked system call, which it interprets as seccomp enabled. But I think the way it's configured on your OS is to immediately kill the process instead. And yes, of course it's part of Android 9. This is not standard behavior as far as I can tell, so it's not going to be a priority to fix. As for that additional access, that's because you got selinux disabled.
[Miscellaneous Android Development] Rortiz2:
I already chcon it lol. I mean that after do that the tablet stucks at boot. My guess is that, Selinux contexts need to be defined. Maybe this sounds very stupid and it's not true. Just a guess.

Cheers.

Enviado desde mi WAS-LX1A mediante Tapatalk
[Miscellaneous Android Development] diplomatic:
[MENTION=8978978]Rortiz2[/MENTION], then I guess it could be anything. It's supposed to have a patched selinux policy in userdata, which should take care of all the selinux stuff. It might be a problem with the modified policy or with the loading of it. But I don't really know. You should check if anything is being logged as denied in dmesg if you can access that.
[Miscellaneous Android Development] Rortiz2:
Thanks. I will look at it.

PS: What's your Asus tablet model? If I have time I want to reward you with one thing :) If not will donate xD.

Cheers.

Enviado desde mi WAS-LX1A mediante Tapatalk
[Miscellaneous Android Development] Vortell:
[MENTION=8978978]Rortiz2[/MENTION]

Isn't there already a twrp image for 6735?

https://yadi.sk/d/xptg_hzL3X87jU

Then there is some scource code out there from Sony for 6755 from the xa I thing.

I though all of the boards were similar in design. As in the same thing with different speed or different system chip same GPU ECT. Is there alot of custom parts on mtk builds. I assumed as close to reference as possible to cheapen it as much as possible. Since they are normally in mid to lie range phones.

Honestly I stayed away from mtk because the best info I could find was on 4pda and freaktab. That and sptools seems to be only lasting tool for it and the reports of bricking with it is relatively high. They have a whole mtk tablet section. Some I of the stuff you have talked about appears to have been asked there as well, like binding for SD cards.

https://forum.freaktab.com/forum/mtk-based-devices/mtk-tablets
[Miscellaneous Android Development] diplomatic:
Oh? :cyclops: I have a ZenPad Z380M....
[Miscellaneous Android Development] Rokia:
Hi [MENTION=8132642]diplomatic[/MENTION],

Ahh that makes sense and priorty is totally cool, I'm getting there bit by bit. I think you're right, I've been looking at mtk-su -v and there are lines about forbidden syscalls and seccomp issues...

On a better note I have discovered whilst trying to run [MENTION=5312578]mrmazak[/MENTION] 's script (post - https://xdaforums.com/showpost.php?p=79534121&postcount=121) that on my particular system/device, that the sdcard is not at /sdcard but at #/storage/####-####/ (sdcard number) and figured out that by changing the create folder line to /storage/****-****/ that it worked... Also discovered that the /bin is also in root directory not in /system/bin... Slow progress.

Anyway thanks for getting back to me,

Yours,

R.
[Miscellaneous Android Development] CXZa:
Tested r19 on MT6580, Android v.5.1.1, unrooted for testing

init.d scripts support result

so, where is that test version then?
[Miscellaneous Android Development] Rortiz2:
What do you mean? I'm not following you:confused:
[Miscellaneous Android Development] diplomatic:
Post 600, man :) Let me know which phone it is for the list....
[Miscellaneous Android Development] diplomatic:
So let's see the -v log. Maybe it's something else, not exactly what I presume. If there's more than one line about forbidden system call, it may be a bug or something....
[Miscellaneous Android Development] CXZa:
After executing, all main apps started to crash. PlayStore, Launcher, etc..

The tablet isn't really normal in any way. It's of those faked ones. K960 etc...

Kernel version 3.10.72+ . Here is its firmware

https://xdaforums.com/android/softw...m-add-root-t3877701/post80758487#post80758487

Result this time.
[Miscellaneous Android Development] Rortiz2:
Sounds interesting..

I've compiled a few days a fully-working TWRP for this tablet. IDK if will work with yours if you want to give it a try:

https://www.androidfilehost.com/?fid=4349826312261622625

Sorry for the OT diplomatic

Cheers!
[Miscellaneous Android Development] diplomatic:
So in other words, you're telling me that it works? :)

But actually, why did it say "Selinux is already permissive"? Is it because you got a root shell before? And why do you have the verbose log in the execution result?
[Miscellaneous Android Development] Rortiz2:
Yes. That fake tablets come with su injected in system. At least my old (died) K107. Not sure if it's the same for him.

Cheers!

Enviado desde mi WAS-LX1A mediante Tapatalk
[Miscellaneous Android Development] CXZa:
edit: <--------

>So in other words, you're telling me that it works?

Not really as those apps keep on crashing.

The tablet cannot be used because of it.

Just this and that has stopped working

message boxes one after another...

Maybe I can try su through the adb if it works,

I'll try it later today... next week..

-------->

>"Selinux is already permissive"? I

> Is it because you got a root shell before?

Nope. And no ready made su either.

It has had two roots by now, but none at the moment.

>And why do you have the verbose log in the execution result?

I can take that -v I put away if that is what you really wish... ;)

I also had to install busybox as root before testing your stuff.

These fakes are what they are... but it still has one of the fastest boots that I have seen...

Just couple of seconds really. I don't think it ever really shuts down...
[Miscellaneous Android Development] diplomatic:
OK, so I think it's safe to say that selinux enforcement is the problem. That half-baked FW is permanently stuck on (and needs) permissive and when the script changes to enforcing, you get crashes. So the only thing you have to do remove the 'setenforce 1' lines from the script....

(The reason I asked the -v log is that I don't know if it's there because you changed something or because of a bug I need to correct. You should tell me if you've changed something.)
[Miscellaneous Android Development] CXZa:
Okay, I did that and now it works. :good:
[Miscellaneous Android Development] CXZa:
I think I'll leave this temp root to device. Better solution than permanent for my little needs if any. Noticed that it also fooled one tv player app. Happened to start the temp root after it. That player seems to check the root only when it starts. Not that I really need such fooling, but maybe someone else has use for such...
[Miscellaneous Android Development] Vortell:
Tv player that needs root would shade me out.
[Miscellaneous Android Development] CXZa:
Other way around, pal... I meant that the app doesn't work if it founds out that the device is rooted.
[Miscellaneous Android Development] Vortell:
That makes much more sense. Only one I use that does that is Netflix. For that I just use old version of Netflix. It's res is only 480p but on 10" it doesn't matter.
[Miscellaneous Android Development] azzadh:
Works on lava iris 88s

I ran the script using JunioJsv app. I can confirm this method works on lava iris 88s.

Its a cancer of a phone invested with ad in the firmware. I had hoped to freeze the app causing the ads but I couldn't find the culprit in the non critical apps. Wonder where they coded it.

Side note I couldn't run the script using init.d, error code below:

suboot.sh

See mkdir --help

mkdir: Needs 1 argument

/storage/emulated/0/init.d/suboot.sh[95]: cd: no home directory (HOME not set)

Regardless, thank you diplomatic for the great effort you've made.
[Miscellaneous Android Development] wodgey:
Where can I find r14? I believe this variant has a version that supports armv7l?

I have been trying to gain temporary root on a Sony Bravia smart TV which is running Oreo on a mtk SOC.

I've pushed the 32 bit versions to/sdcard/ and chmod'ed to 0700 but I just get "permission denied".

Any ideas or assistance would be greatly received
[Miscellaneous Android Development] ShadeTreeBiker:
A Method To My Madness?!?! (I hope so...)

Have a few questions about combining this with several other methods to eventually gain a more permanent and full root solution on my bloatware INFESTED Qlink govt phone...and I want to be as safe as possible, need bloat gone, not phone...here are the specs:

ZTE Z3351S MTK MT6739

Android 9 security patch 2019-07-05

Build ID: Z3351SV1.0.0B4

64 BIT armV8-A in 32 bit mode

BL: Locked, (not sure IF there's an unlock.)

Not rooted, Stock Recovery...(DUH,)

Kernel 4.4.146+

(If you need anything else let me know)

Seeing as to the safety of this in general, (few bootloops/bricked devices,) I have read the whole thread and am ready to proceed with at least this bootless root...but i have a plan I've developed while searching all over the internet for rooting solutions to get rid of this cumbersome and annoying bloatwares.

Here is my plan:

Use the mtk-su terminal temp root to get the Magisk. (ultimately) THEN

Take full backup of the entire emmc and copy to computer...THEN

Magisk Manager to patch the boot.img, left on phone

Port Philz, TWRP, or CWM to this machine...

Use Rashr-Flash Tool to flash above custom recovery...(it can flash recovery on locked bootloader, I HOPE...I used it with my ZTE N817)

Reboot to recovery, where I use this method to fix the dm-verity...THEN

Reboot back to TWRP (or whatever,) Flash the patched boot.img

Once again, reboot recovery, wipe data/cache/system, etc., and recover Android 9

Boot Android 9, run initial setups....all SHOULD be good, AND ROOTED!

Unless I'm missing something...like a hidden root checker or some s&*t ZTE/Qlink decided to hide in there.

One serious question is can I take the original/first emmc backup and load it to Android Studio VM and test this theory? A yes here would be a great help.

I've always been a SuperSu fan, but the more I look at Magisk the more I LIKE it...

SoSorry for the long post, but I've been working up to this point over the last month and mostly from XDA...:cool:

All constructive input is welcome and very appreciated, but really,

What do you think [MENTION=8132642]diplomatic[/MENTION] ??

And if this one works a hugh feather-in-yo-cap!!!
[Miscellaneous Android Development] diplomatic:
OK, good to know it runs on that phone. (BTW, I never gave that app's creator permission to bundle my mtk-su binary.) About the suboot script, have you changed it somehow? Because 95 isn't even the right line for that command. Try the default one from the bootless root post.

This tool is cumulative in its versions like practically all other software. There's no need for R14. You can't give exec permissions for /sdcard/ files. It must be run from your tmp dir or inside a terminal app just like the directions say. That being said, it's unlikely it will work on your TV...