yashsingh1/xdaforums huggingface dataset:
[Miscellaneous Android Development] tecknight:
I did not know you were also into custom router firmware. That's great, I have always found it fascinating.

You are absolutely right about the point being to "get a shell" when hacking a router and I realized it about 2 minutes after I posted. Also, once I have a shell, I also have root, so what's the point of using mtk-su. You are also right about the firmware--currently the stock firmware outperforms the openwrt in 5Ghz performance, but it's getting close. I'm still running stock and I don't know if I will ever change.

I still really like the router's performance and price, especially in the 5Ghz range. The mediatek chip is really fast and it has a lot of NAND and RAM to work with.

How have you been, by the way ?

I'm still doing all right here in Vegas.
[Miscellaneous Android Development] ikik:
x27 plus phone

oke i tryed but now i'm stuck

shell@X27_Plus:/data/local/tmp $ ./mtk-su

UID: 0 cap: 3fffffffff

shell@X27_Plus:/data/local/tmp # chmod 755 mtk-su

shell@X27_Plus:/data/local/tmp # ./mtk-su -v

armv7l machine

param1: 0x3000, param2: 0x18040, type: 6

Building symbol table

kallsyms_addresses pa 0x8097f050

kallsyms_num_syms 47964, addr_count 47964

kallsyms_names pa 0x809addd0, size 571870

kallsyms_markers pa 0x80a397b0

kallsyms_token_table pa 0x80a39aa0

kallsyms_token_index pa 0x80a39e20

Patching credentials

Parsing current_is_single_threaded

c027a558: MOVW R0, #0x98b8

c027a55c: MOVT R0, #0xc0c2

init_task VA: 0xc0c298b8

Potential list_head tasks at offset 0x210

comm swapper/0 at offset 0x358

Found own task_struct at node 1

cred VA: 0xd7604c80

Parsing avc_denied

c08b6d58: MOVW R3, #0xa450

c08b6d5c: MOVT R3, #0xc0d3

selinux_enforcing VA: 0xc0d3a450

Setting selinux_enforcing

Selinux is already permissive

starting /system/bin/sh

UID: 0 cap: 3fffffffff

i think it is good 3 last line says Selinux is already permissive

not what you sad: UID: 0 cap: 3fffffffff selinux: permissive

what now my device is not Rooted
[Miscellaneous Android Development] bastienbaranoff:
Hello ! Thanks to diplomatic for your tool I want to root my Huawei Y5 2019 but I can't got this

Hello root fail on Huawei Y5 2019

Got this

param1: 0x1000, param2: 0x8040, type: 14

Building symbol table

armv8l machine

Can't find kallsyms addresses or offsets

Unable to get kernel symbol table

setns failed: No such file or directory

Bad system call

exit value 159 assets-r20

And with the tracer this

LD_PRELOAD=./syscall_hook.so ./mtk-su

alloc failed

alloc count=400 startPA=0x87585000

uncatched ioctl 40e07803

FORTIFY: fwrite: null FILE*

Any clue ??
[Miscellaneous Android Development] Valittaja:
Get permanent root with Cydia Impactor, that's what i did for my friend's Lenovo S6000L-F (Mediatek Arm v7 MT8125), since this method can not be used for it.

It's really a one-click root, it install's SuperSU (aka roots) your machine.

You can do a search on this forum for discussion about cydia impactor..
[Miscellaneous Android Development] serjiozh:
Works great!

Thank you, it worked!
[Miscellaneous Android Development] diplomatic:
It looks like it does open a root shell. Other than the missing "selinux: permissive", is there anything that makes you think it's not working? I think there's some weird behavior coming from the selinux status function in your OS...that's why it's not printing it.
[Miscellaneous Android Development] diplomatic:
OK, 3 issues:

Why are you asking me about the output from an someone else's app that I have nothing to do with? (mtk-su does not print the line "exit value 159 assets-r20".) No apps have been given permission to bundle mtk-su, BTW. That has been stated in the FAQ for a long time. Why don't you ask the guy who wrote the app and never asked for permission to include it?

.

Why are you posting the output from some code that someone wrote in an attempt to reverse engineer mtk-su? What does that have to do with anything? Apparently, that guy already knows everything about how mtk-su works. So why don't you ask him about it? Or if you are interested in running "the tracer" and reversing, why don't you develop the solution yourself since the "vulnerability" is already public?

.

If you actually get the same result from mtk-su by running it manually, then the explanation is already in post 4....
[Miscellaneous Android Development] ikasemota:
Please diplomatic, I ran this on my phone(Tecno pouvoir lc6a mt6761). It rebooted my phone several times. What could be wrong?
[Miscellaneous Android Development] muzzol:
Fire HD 7th not working

as many others stated I can't run it on my Fire HD 8 7th with 5.3.7.0:

./mtk-su -v
armv8l machine
Failed critical init step 4
This platform cannot be supported

probably they changed something in a minor update to patch it. can someone confirm it?
[Miscellaneous Android Development] diplomatic:
It's probably the same issue as this other MT6761 phone was reported to have. Unfortunately, we found that the method used by mtk-su has been patched on that phone and probably on your phone as well. The reason it's rebooting is that this is an early patch that has its own bugs in it. A bug in the patched kernel causes it to crash and reboot the phone. So this is basically the same result as "This platform cannot be supported."

Yes, it appears they probably did...
[Miscellaneous Android Development] muzzol:
I think one problem here is that version numbers are misleading.

mtk works with up to Fire OS 5.6.4.0 build 636558520 only and my device says version 5.3.7.0 but it's updated from just a month ago so it's impossible that is that old.

I think the real version of my device is build 650601220 labeled by amazon as update-kindle-50.6.5.0_user_650601220.bin but for some reason appears as 5.3.7.0 in the settings.

so now I'll try to downgrade to an older version.
[Miscellaneous Android Development] muzzol:
sorry for auto-reply, just leaving here in case someone was as confused as myself.

DON'T TRY TO DOWNGRADE!

bricked mode works nice with this version: 5.3.7.0 (650601220)

and just to make it clear: bricked mode doesn't mean to open your device physically!!!

I was confused about all mixed info in this subforum and I was really hesitant to execute that mode but is really simple. Just boot with linux (if you don't have linux installed use a live pen or a VM) and execute all instrucctions detailed here:

https://xdaforums.com/showpost.php?p=81862781&postcount=436

thanks a lot for your work [MENTION=8132642]diplomatic[/MENTION] and sorry for the noise.
[Miscellaneous Android Development] realali:
vivo Y75 android 7.1.1 8u 4G linux4.4.22+

mtk-su -v

param1: 0x1000, param2: 0x8040, type: 15

Building symbol table

kallsyms_addresses pa 0x40ed7300

kallsyms_num_syms 52434, addr_count 52434

kallsyms_names pa 0x40f3db00, size 685229

kallsyms_markers pa 0x40fe5000

kallsyms_token_table pa 0x40fe5700

kallsyms_token_index pa 0x40fe5b00

Patching credentials

Parsing current_is_single_threaded

ffffff80083585a4+4c: ADRP x0, 0xffffff800936e000

ffffff80083585a4+50: ADD xd, x0, 3376

init_task VA: 0xffffff800936ed30

Potential list_head tasks at offset 0x368

comm swapper/0 at offset 0x620

Found own task_struct at node 1

cred VA: 0000000000000000

0000000000000000 is not a valid address

Parsing avc_denied

ffffff80082f3f48+24: ADRP x0, 0xffffff8009679000

ffffff80082f3f48+28: LDR [x0, 1660]

selinux_enforcing VA: 0xffffff800967967c

Setting selinux_enforcing

Selinux is already permissive

starting /system/bin/sh

UID: 2000 cap: 0000000000 selinux: permissive
[Miscellaneous Android Development] mini536:
But I can't use that root my phone

When I use your tool to root my MT6375M yunos phone,It says out of memory and can't switch to super use,I don't think an OS can fix that in 2017.:confused:
[Miscellaneous Android Development] diplomatic:
Support for that phone is "problematic". See post 4.

Hmm, not sure. It's failing to execute a new shell for some reason. Sounds like an issue with your OS. I haven't seen that before. You can try './mtk-su -c sh' to start a rooted sh manually. What is the output of 'echo $SHELL' on your command line?

Also, try not to quote the whole first post in your replies.
[Miscellaneous Android Development] mini536:
I tried the method you said yesterday, it still prompts out of memory
[Miscellaneous Android Development] Vijay arts:
Reno 2 z root requirements

Reno2z requirements

:)
[Miscellaneous Android Development] JunioJsv:
I'm sorry for not asking for permission to use mtk-su to make the app work, I just wanted to help the community to use its tool more easily, I really have no idea how mtk-su really works. I put the credits to you inside the app, including the link to this forum.

---------- Post added at 11:17 PM ---------- Previous post was at 10:50 PM ----------

Diplomatic if you don't like something in the app, you can send a pull resquest to github project page which I accept without problems.
[Miscellaneous Android Development] diplomatic:
Oh hi, Junio. The thing that I don't want to happen is people bundling mtk-su with their apps. I'm fine with apps using it per se (probably unreasonable to deny that), if users come to this thread and download it manually. That would alert people to how an app achieves root and the possible dangers of the app having those privileges (abuse, etc). Instead of bundling, is it possible that your app can pull mtk-su files from internal storage, where the user has downloaded them manually? BTW, nice of you to give me credit...after I started printing the info banner in app mode. ;)
[Miscellaneous Android Development] diplomatic:
That's really strange. There's nothing out of the ordinary about the execute program call in mtk-su. It might be some root detection scheme in the kernel, but not likely. Can you simply start a new shell from your command line with 'sh' ? What about trying a different su command, like './mtk-su -c uname -a' ?
[Miscellaneous Android Development] mini536:
well,it still says out of memory,I think it's impossible,since it have 320mb ram left and 2.3G rom left when I try to su it:confused:[IMG="faild"]https://gadam.wodemo.com/entry/531996/d49a3a28bb7d08d9637565da4931d96e/0.png[/IMG]

[IMG="system info"]https://gadam.wodemo.com/entry/531996/20200509/42cf7c5e8120a1b81fbd1b0f570f8872/12.png[/IMG]

[IMG="cpu info"]https://gadam.wodemo.com/entry/531996/20200509/4d7c38966b19b20bcec6c1a2fca32d53/01.png[/IMG]
[Miscellaneous Android Development] diplomatic:
[MENTION=10784069]mini536[/MENTION], can you try the Oppo version from this post? Other than that, I think I'm out of ideas. I'd probably have to have that device on hand to figure this out. You're right, it's not really short on memory. It's one of those typical messages that doesn't mean what it says.
[Miscellaneous Android Development] mini536:
Well,i have tried oppo version,it still says out of memory,like r22:crying:,should I send the rom and flash tool to you:confused:
[Miscellaneous Android Development] Supermatt01:
What is the flash tool?
[Miscellaneous Android Development] diplomatic:
One other thing to try is a terminal app according to the post 2 guide. But it sounds like there would need to be a custom version of mtk-su to be able to start a root shell (if you can motivate me to work on it). I would classify that phone as "problematic". You said your phone has YunOS, right? The web says that this ROM is a derivative of Android but not completely compatible with it. So I suspect the exec problem stems from that...
[Miscellaneous Android Development] xdriv3r:
Cannot run su in adb

I'm getting root access on my device, but adb is not giving su access.
[Miscellaneous Android Development] Solobolo56:
Unsuccessful

[MENTION=8132642]diplomatic[/MENTION]

Man, dude, bro anything but SIR.

Unsuccessful on the alps tablet series.

Android 5.1

3.10.72 layout

Mt 8163 chipset

Output only says failed critical Init'd step 4.

For clarity can this entire process be executed solely within the terminal app, or without a PC? Unfortunately I no longer possess a computer to push mtk-su or anything to my tablet. EX-girl took it on the way out the door, good story but OT. Now only left with two cheap non-rooted Chinese tablets.

Read every page of thread and OP multiple times , and pretty sure followed to the letter , yet results didn't improve. Did notice through the 3.10.72 layout , on android 5.1, had created problems for [MENTION=10045479]realali[/MENTION] and a few others with this chipset but not sure if the problems been resolved or even if I'm having the same issue. Would appreciate any clarity from the man on these threads.

Won't let me attach the logs.
[Miscellaneous Android Development] xdriv3r:
Use init.d method
[Miscellaneous Android Development] DB126:
Wow - what a greeting. What more needs to be said :rolleyes:
[Miscellaneous Android Development] diplomatic:
You need to allow it in MM Superuser menu...

So there weren't any lines printed after the "Failed critical init.." line? (Appreciate the laid back greeting, btw. :cool:) If so, it sounds like support for that firmware is not implemented yet. Also, can you try R21? Something might have gotten messed up for Android 5 in the last version.

Of course you can run it with a terminal app. You read the entire thread but you missed those instructions? Check post 2.

LOL... no, he's got the right idea. I hate the s-word, which I mentioned before...
[Miscellaneous Android Development] xdriv3r:
Yeah I hadn't got the notification so I went in mm and did it.
[Miscellaneous Android Development] Solobolo56:
[MENTION=8132642]diplomatic[/MENTION]

I had to have my account tweeked to add these attachments. As you can see before my first post I had already tried both Init'd (thanks [MENTION=5917781]xdriv3r[/MENTION]) and terminal. So yes I even read your second post. Just couldn't understand why my results were so different than all the ones I read about. So i had to make sure. Plus it bothers me when i can't figure something out.:confused:

I went in order trying r20, r21, then the latest 22 before reaching out for help. Each attempt I started from scratch , on a clean boot and all responses were identical. I couldn't locate a link to the FW yet but still looking.

Attachments not sticking working it now.

---------- Post added at 07:32 AM ---------- Previous post was at 07:27 AM ----------

How bout a way to get this thing rooted. I'll settle for someone saying that.:rolleyes:
[Miscellaneous Android Development] Solobolo56:
Finally working.

This is the output.....any suggestions?
[Miscellaneous Android Development] diplomatic:
[MENTION=10725987]Solobolo56[/MENTION], PM sent...
[Miscellaneous Android Development] Solobolo56:
[MENTION=8132642]diplomatic[/MENTION]

Thanks for the help so far. If your up to continuing on this pain (i mean root) staking journey now it's failing to get the symbol table. I saw back in post 956 [MENTION=10045479]realali[/MENTION] had the same problem with a similar layout. But I couldn't find the script from your 963 post you fixed that with.. Is it only the symbol table detection or or am I dealing with something else?
[Miscellaneous Android Development] machskn:
Do any of you know if anything is already known about mtk-su_r23?

I have an oppo reno z cph1979, but unfortunately I get critical init step 4 .This firmware cannot be supported.
[Miscellaneous Android Development] Rortiz2:
not working on Aquaris M8
[Miscellaneous Android Development] HemanthJabalpuri:
Can you please try this one

#!/system/bin/sh
mkdir /sdcard/mtk-su-backup
bypath="$(/system/bin/mount | grep " /system " | cut -d" " -f1 | grep "by-name")"
if [ -n "$bypath" ]; then
bypath="$(dirname "$bypath")"
else
echo "Unable to find by-name"
exit 1
fi

for i in $bypath/*; do
echo "dd if=$i of=/sdcard/mtk-su-backup/$(basename $i).img" >> /sdcard/mtk-su-backup/my-by-name.txt
done
[Miscellaneous Android Development] bigrammy:
Really :confused:

Any details would be helpful. Did you read the Important Notes regarding "paste" in Termux app This may also affect other terminal app's IDK.

---------- Post added at 04:49 PM ---------- Previous post was at 04:31 PM ----------

When run using the Termux app.

Make's the directory and nothing else.

It give me no output on the screen either.

I will run it from /data/local/tmp which should execute it in /system/bin and report back.
[Miscellaneous Android Development] Rortiz2:
shell@Aquaris_M8:/sdcard # chmod 755 backup.sh
shell@Aquaris_M8:/sdcard # ./backup.sh
/system/bin/sh: ./backup.sh: can't execute: Permission denied
126|shell@Aquaris_M8:/sdcard #

I use PC because termux doesn't wsorks correctly on my device..

---------- Post added at 04:22 PM ---------- Previous post was at 04:11 PM ----------

If it is a Xiaomi it will not work, at least on mi MI A2

---------- Post added at 04:24 PM ---------- Previous post was at 04:22 PM ----------

I don't use terminal apps. I just use cmd, its easier..

Anyway I solved it using the sh prefix:

making dd-backup folder
finding by-name with full path
saving 1.txt
In /sdcard/dd-backup folder
strip first line
done stripping first line
add extra newline
adding dd if= cmd's to new-by-name.txt
done adding dd if= cmd's
adding dd of= cmd's to *.txt
Quick grep and cut
add extra newline
add .img to names
bust out paste cmd
done paste
remove spaces
It's almost complete!!!

cleaning up before exit

dd-backup.txt with no user input required

Hit @diplomatic THANKS button for mtk-su!!

Hit My THANKS Button Cheers @bigrammy
[Miscellaneous Android Development] bigrammy:
Thanks I found the problem with mine will update my op in a few min's with V3. Thanks for the feedback. :good:

[MENTION=8978978]Rortiz2[/MENTION]

Hi how does the dd-backup.txt look?

Is if formed correctly eg spacing etc can you cat it and update your post with the output. :)
[Miscellaneous Android Development] Rortiz2:
Still the same :/ I only can run it with sh before. ./dd-backup.sh don't works:

1|shell@Aquaris_M8:/ # chmod 755 /sdcard/dd-backup.sh
shell@Aquaris_M8:/ # cd sdcard
shell@Aquaris_M8:/sdcard # dd-backup.sh
/system/bin/sh: dd-backup.sh: not found
127|shell@Aquaris_M8:/sdcard # ./dd-backup.sh
/system/bin/sh: ./dd-backup.sh: can't execute: Permission denied
126|shell@Aquaris_M8:/sdcard #

[MENTION=3924647]bigrammy[/MENTION] here we go:

shell@Aquaris_M8:/ # cat /sdcard/dd-backup.sh
##
# dd-backup helper script
# by bigrammy @ xda-developers

# Termux Needs "paste" WTF! for this to work it's included in "pkg install coreutils"
# This Gem will find your by-name paths and add them
# to a text file in /sdcard/dd-backup But wait there's more
# it also edits the text file with dd cmds automatically so
# you can copy 'n' paste them in your teminal
# EG: /dd if=/dev/block/platform/mtk-msdc.0/11230000.MSDC0/by-name/boot of=/sdcard/dd-backup/boot.img

echo "making dd-backup folder"

mkdir /sdcard/dd-backup

echo "finding by-name with full path"

find /dev -name by-name -exec find {} -print > /sdcard/dd-backup/1.txt \;

echo "saving 1.txt"

echo "In /sdcard/dd-backup folder"

#fix first line as it's not needed
echo "strip first line"

sed -i '1d' /sdcard/dd-backup/1.txt

echo "done stripping first line"
#end of first line fix

#fix last line of text not adding of= cmd
#Needs extra line or sed will miss it
echo "add extra newline"

echo >> /sdcard/dd-backup/1.txt

#fixed last line of text

echo "adding dd if= cmd's to *.txt"

sed 's_/dev_dd if=/dev_' </sdcard/dd-backup/1.txt >/sdcard/dd-backup/2.txt

echo "done adding dd if= cmd's"

echo "adding dd of= cmd's to *.txt"

sed ':a;N;$!ba;s/\n/ of=\/sdcard\/\dd-backup\n/g' </sdcard/dd-backup/2.txt >/sdcard/dd-backup/3.txt

# Fix last bit of puzzel
# Get the list of names and trim the "e"
echo "Quick grep and cut"
grep -oE 'me/[^ ]*' /sdcard/dd-backup/3.txt|cut -c 3-19 >/sdcard/dd-backup/4.txt

echo "add extra newline"
echo >> /sdcard/dd-backup/4.txt

echo "add .img to names"

sed ':a;N;$!ba;s/\n/.img\n/g' </sdcard/dd-backup/4.txt >/sdcard/dd-backup/5.txt

echo "bust out paste cmd"

paste /sdcard/dd-backup/3.txt /sdcard/dd-backup/5.txt >/sdcard/dd-backup/6.txt

echo "done paste"

echo "remove spaces"

sed 's/backup[ \t]/backup/g' </sdcard/dd-backup/6.txt >/sdcard/dd-backup/dd-backup.txt

echo "It's almost complete!!!"
echo ""
echo ""
echo ""
echo ""
echo "cleaning up before exit"

rm /sdcard/dd-backup/1.txt
rm /sdcard/dd-backup/2.txt
rm /sdcard/dd-backup/3.txt
rm /sdcard/dd-backup/4.txt
rm /sdcard/dd-backup/5.txt
rm /sdcard/dd-backup/6.txt
echo ""
echo "dd-backup.txt created with no user input required"
echo ""
echo ""
echo "Hit @diplomatic THANKS button for mtk-su!!"
echo ""
echo ""
echo "Hit My THANKS Button Cheers [MENTION=3924647]bigrammy[/MENTION]"

exit
shell@Aquaris_M8:/ #
[Miscellaneous Android Development] bigrammy:
Hmm It works for me without sh prefix I am not sure if it's because your running it from the /sdcard directly :confused:

I run it from /data/local/tmp on my device.

Like this.

NE1:/data/local/tmp # cp /sdcard/dd-backup.sh /data/local/tmp
NE1:/data/local/tmp # chmod 755 dd-backup.sh
NE1:/data/local/tmp # ./dd-backup.sh
making dd-backup folder
finding by-name with full path
saving 1.txt
In /sdcard/dd-backup folder
strip first line
done stripping first line
add extra newline
adding dd if= cmd's to new-by-name.txt
done adding dd if= cmd's
adding dd of= cmd's to *.txt
Quick grep and cut
add extra newline
add .img to names
bust out paste cmd
done paste
remove spaces
It's almost complete!!!

Sorry I ment for you to

cat /sdcard/dd-backup/dd-backup.[B]txt[/B]

so I can see if the txt file is correctly formed. :o

[MENTION=8953766]HemanthJabalpuri[/MENTION]

Sorry mate your script is still broken even if I run it from data/local/tmp it makes the folder but nothing else :(

I do not understand grep very well so I don't know exactly where it's breaking.
[Miscellaneous Android Development] mrmazak:
Extension really makes no matter in This situation.

The issue with needing sh and ./ Is most of the time related to the termux environment not symlinked to /bin . So it needs a more full path the recognize the function that is needed to run.

Also you may need to allow termux access to storage to allow it to run from /sdcard
[Miscellaneous Android Development] Rortiz2:
I'm using cmd :confused:
[Miscellaneous Android Development] bigrammy:
Cheers. He was using shell and I get permission denied when I try to run it form the sdcard so I think that could be the issue.

I have asked Rortiz2 to move to PM because I do not want to hijack or bog down the thread with my stuff.

Sorry [MENTION=8132642]diplomatic[/MENTION] It kind of runaway a little. :o
[Miscellaneous Android Development] edwin_ecoral:
Its working very well in Nokia 5.1 with Android 9 pie, thanks sir.
[Miscellaneous Android Development] diplomatic:
Excellent, [MENTION=5018800]edwin_ecoral[/MENTION]! Psyched to hear it's working on that phone and Android 9.
[Miscellaneous Android Development] tr0picana:
Got the following error running it on a Skyworth 55G2 TV:

armv7l machine
No access
Failed critical init step 1
[Miscellaneous Android Development] diplomatic:
[MENTION=4248770]tr0picana[/MENTION], it won't work if it's not one of the listed chipsets.
[Miscellaneous Android Development] tr0picana:
Damn I was pretty sure it had a MediaTek chipset
[Miscellaneous Android Development] Rortiz2:
[MENTION=8132642]diplomatic[/MENTION] not working on Huawei Y5 II mt6735 using arm mtk-su...

shell@HWCUN-L6735:/ $ cd /data/local/tmp
shell@HWCUN-L6735:/data/local/tmp $ chmod 755 mtk-su
shell@HWCUN-L6735:/data/local/tmp $ ./mtk-su -v
armv7l machine
param1: 0x1000, param2: 0x8040, type: 6
Building symbol table
kallsyms_addresses pa 0x409e9b20
kallsyms_num_syms 63519, addr_count 63519
kallsyms_names pa 0x40a27bb0, size 772321
kallsyms_markers pa 0x40ae44a0
kallsyms_token_table pa 0x40ae4890
kallsyms_token_index pa 0x40ae4c20
Patching credentials
init_task VA: 0xc0d1d0f8
Potential list_head tasks at offset 0x210
0xdf82e210 0xc9696750 0x00008c
comm swapper/0 at offset 0x358
Found own task_struct at node 0
real_cred VA: 0xcdc9f500
Parsing sel_read_enforce
c023a050: MOVW R4, #0x61c8
c023a054: MOVT R4, #0xc0d1
selinux_enforce VA: 0xc0d161c8
Setting selinux_enforce
Switching selinux to permissive
Trying this again...

Then reboots..