yashsingh1/xdaforums huggingface dataset:
[Miscellaneous Android Development] Rortiz2:
Hi,

If you read the OP you will see that the "Failed critical init step 4" means the vulnerability has been patched in your device.

BTW: IIRC Vsmart wasn't bq?

Regards.
[Miscellaneous Android Development] bigrammy:
Perfect reason why OEM's should be forced to release Full kernel source code and bootloader unlock code.

NO BAD OEM's like Amazon and others should be able to simply abandon it's older but perfectly capable devices leaving them vulnerable to attacks. So when Amazon for instance stops support for a typical device they should have to provide Fully working kernel source code and provide a bootloader unlock code by LAW. This will at least give people the chance to patch there own devices and re-secure them.

I have never bought a Amazon device again ever since my Fire Phone experience & I never will again regardless of their cost.

Amazons reply to my Concerns about the security holes in KK with no patches was buy another Phone. I said I only just bought it from YOU and you have stopped support for it!! No reply to that. :mad:

Sony, Google and Nokia and others are very good examples of How OEM's should behave giving both the above in most cases. :good:

Thanks to you this tool may cause a big shake up & re-think in OEM land so well done bro you have my 100% support :highfive: :highfive:
[Miscellaneous Android Development] mrmazak:
You have received "critical" status.

Mtk-su is officially flagged an Android exploit.

CVE-2020-0069

Wow
[Miscellaneous Android Development] b1283822:
Wonderful. It still works on a fully patched Nokia 5.1 Plus (2020.02 security patch, Pie). Though I failed to set HAL3 property using either setprop or modifying build.prop, so temp root isn't of use to me. But nice work indeed.
[Miscellaneous Android Development] thinhx2:
Thank for information

No, only Active 1 (X2 pro) and Joy 1 (C) made by Bq. Another model made by china brands or ODM
[Miscellaneous Android Development] diplomatic:
You said it! The law should be that users are allowed to install alternative OSs on their devices, just like we're allowed to use 3rd party ink cartridges in printers....
[Miscellaneous Android Development] diplomatic:
:eek:

Ironically, this has become a bigger security threat...
[Miscellaneous Android Development] tecknight:
Now Forbes releases this news story

While [MENTION=8132642]diplomatic[/MENTION] created this thread 11 months ago, Forbes releases this security alert TODAY:

https://www.forbes.com/sites/daveyw...-rooted---update-now-if-you-can/#1b20ae1240a1
[Miscellaneous Android Development] diplomatic:
OK, guys, here it is. Let me know how this one works in a terminal app or with bootless root.
[Miscellaneous Android Development] roguedbear:
Can not test on Moto E3 Power

I was going to test this exploit on my Moto E3 Power which has the MediaTek chipset.

While doing the adb push command, I get the remote permission denied error

Searching this up on Google tells me that I need to run adb as adb root

Doing this it says that I can't run adb root on production build

Fixing this would eventually lead me to root my phone in order to test the temporary root exploit.

Am I doing anything wrong with the adb thing?

I have used adb in the past (but on Kitkat device) but never had any of this issue
[Miscellaneous Android Development] mrmazak:
Impossible to say if you are doing it wrong.

You don't show what you do.

You only said which step. But remote permission on adb push, suggests to me you did something wrong.
[Miscellaneous Android Development] kidddd66:
Global Xiaomi Redmi note 8 pro mt6785T - MIUI V11.0.6.0.PGGMIXM Dec 2019 security patch

not working
[Miscellaneous Android Development] levone1:
Just reporting working on Alcatel/TCL A501DL (A1); Oreo, locked bl, MT6739WM, Linux 4.4.95, December 2019 sec patch...

Now if I could get in to fastboot...
[Miscellaneous Android Development] CXZa:
Well, I don't understand nothing about this but after reading this

https://www.xda-developers.com/mediatek-su-rootkit-exploit/ .

I just chmod the mtk_cmdq and put the enforcing on..

That at least on my MT6750 did the trick... ..or did it?

Attached is a script to be run when the system starts - the same way as your suboot.sh.

No guarantees of any kind. Use at your own risk... etc.

:cowboy:

Edit: the chmod also if added to suboot.sh makes other mtk-su to fail.

Doesn't seem to affect the Magisk su...

Tried mtk-su after suboot with chmod.

mlv5n:/data/local/tmp $ ./mtk-su -v

armv7l machine

Failed critical init step 1

1|mlv5n:/data/local/tmp $ su

mlv5n:/data/local/tmp #

Edit2: Notice! Might cause some side effects...

https://xdaforums.com/android/devel...atek-armv8-t3922213/post81943009#post81943009
[Miscellaneous Android Development] FusionDragon:
Q710AL LG Stylo 4 Confirmed Rooted
[Miscellaneous Android Development] roguedbear:
I ran the script using init.d method for Magisk.

The script ran successfully and the adb shell su also gave me a root shell.

[MENTION=8132642]diplomatic[/MENTION] This exploit works on Moto E3 Power

Kernel Version: 3.18.19+

---------- Post added at 11:12 AM ---------- Previous post was at 11:07 AM ----------

I followed the procedure to install Magisk with root as described in this post

I have Magisk Manager version: v7.1.1 (203)

and Magisk version: v18.1 (18100)

Installing any module through the downloads section results in an installation error each saying " Magisk v19 Required ".

Do I need to manually download older releases which are compatible with v18 for the modules?
[Miscellaneous Android Development] sscsps:
$ ./mtk-su

CANNOT LINK EXECUTABLE: cannot locate symbol "setns" referenced by "./mtk-su"...

I guess this means my device is not supported?

I'd be happy to provide more details, but this is a tv from China having android 4.4, and very weird set of packages, it doesn't have curl, but apparently have adb! Lol
[Miscellaneous Android Development] diplomatic:
Thanks... again?

OK, that will stop mtk-su, but that device node is intended to be accessible from user space. Watch out for any side effects...
[Miscellaneous Android Development] diplomatic:
That device is totally out of the scope of this tool. TVs are not prone to this. And neither is Android 4.x.
[Miscellaneous Android Development] realali:
How can I get the src from internet?

I want adapt to other phone with android 6.0.

It's not find the kallsyms address.
[Miscellaneous Android Development] CXZa:
So, what processes, apps use that node? Any examples what could cause

side effects. I'll try if I can cause some. So far haven't been able to...

Though something like battery drainage might take some time to spot it...

:fingers-crossed:

Edit: okay camera got stuck, if it has been used before the chmod it works though...

This needs more tests and maybe a different way to do it...
[Miscellaneous Android Development] sscsps:
Although the android version it's running is plain android, not android tv,

but if Android 4 itself is not supported, then its a totally different thing!
[Miscellaneous Android Development] diplomatic:
Yeah, all the modules have come to depend on Magisk 19. See if the info in this post is of any help. You basically have to run this shell command to change the internal magisk version and then modules can be installed again:

sed -i '/MAGISK_VER_CODE/ s/18100/18200/' /data/adb/magisk/util_functions.sh

I have not seen the source code on the internet. ? If that is a 32-bit kernel, try out the version in post 925. It has updates to better detect the symbol table on arm. If it works out, plz identify your device.

Well, you tell me what uses that node. It could be anything related to multimedia or the GUI. Camera functionality sounds about right. Blocking it could also possibly affect video playback, image compression, graphics scaling among other things. I think any app can potentially open it, as well as system services like surfaceflinger.
[Miscellaneous Android Development] levone1:
Sorry - been bouncing around a lot of threads lately... Just didn't want to neglect
[Miscellaneous Android Development] FusionDragon:
The latest lg security update for february first 2020 has broken the mtk exploit on stylo 4 devices on sprint/boost. if anyone with this phone wants root do not update to the february first update
[Miscellaneous Android Development] Ashok.Vardhan:
Wondering if you received your Lenovo TB-8705F tablet?

Would love to root this device. So far have been unsuccessful.
[Miscellaneous Android Development] cdo-h:
BQ Aquaris M4.5 confirmed root

I'm happy to confirm that mtk-su is working on a BQ Aquaris M4.5 (chip MT6735M, Android 6.0, Kernel 3.18.19, 32 bit, tested with mtk-su release 20 over an SSH connection).

Thank you for your awesome work, [MENTION=8132642]diplomatic[/MENTION] !
[Miscellaneous Android Development] diplomatic:
Thanks for the report! Can I ask you something? Does mtk-su take a long time to run on that phone, like 20 seconds or over? It should be under 2 sec. I'm trying to troubleshoot slowdowns on some Android 6 devices....
[Miscellaneous Android Development] diplomatic:
Bummer... Do you happen to remember the last version that mtk-su ran on?
[Miscellaneous Android Development] cdo-h:
Sure :) It's between 3 and 4 seconds (with display active, no difference if unlocked or locked, consistent over multiple runs).

With display off it varies between 4 and more than 40 seconds, but eventually succeeds. But your instructions anyway say to keep the display on during execution.

The only noticeable delays are after the "Building symbol table" and the "kallsyms_num_syms 52549, addr_count 52549" lines (both approximately of the same duration, maybe the second one is slightly longer).

With display off the delays are at the same steps, still both approximately of the same duration but both much longer.

armv7l machine
param1: 0x1000, param2: 0x8040, type: 7
Building symbol table
(some delay noticable here)
kallsyms_addresses pa 0x40a5cf90
kallsyms_num_syms 52549, addr_count 52549
(some delay noticable here)
kallsyms_names pa 0x40a904c0, size 630397
kallsyms_markers pa 0x40b2a340
kallsyms_token_table pa 0x40b2a680
kallsyms_token_index pa 0x40b2a9f0
Patching credentials
Parsing current_is_single_threaded
c028df58: MOVW R0, #0x2d50
c028df5c: MOVT R0, #0xc0d8
init_task VA: 0xc0d82d50
Potential list_head tasks at offset 0x290
comm swapper/0 at offset 0x400
Found own task_struct at node 1
cred VA: 0xd8a4fc80
Parsing avc_denied
c09957c0: MOVW R12, #0x5384
c09957c4: MOVT R12, #0xc0e8
selinux_enforcing VA: 0xc0e85384
Setting selinux_enforcing
Selinux is already permissive
starting /system/bin/sh
UID: 0 cap: 3fffffffff selinux: permissive
[Miscellaneous Android Development] diplomatic:
[MENTION=10606845]cdo-h[/MENTION], OK, that all sounds normal. Those slowdowns are due to power management. But there's at least one device that acts like it's asleep while running mtk-su, even though the screen is on...
[Miscellaneous Android Development] cdo-h:
[MENTION=8132642]diplomatic[/MENTION] thanks for the power management explanation, that makes sense.

Happy to help and always trying to learn more :)
[Miscellaneous Android Development] realali:
these phone is not work.

model	android linux	CPU

oppo	R9km	5.1	3.10.72	MTK

oppo	R9tm	5.1	3.10.72	MTK

oppo	A59s	5.1	3.10.72	MTK

gionee	S9	6	3.18.22	MTK
[Miscellaneous Android Development] realali:
Can't find kallsyms addresses or offsets

Unable to get kernel symbol table

UID: 2000 cap: 0000000000 selinux: enforcing

oppo A59s can't work, but oppo A59m can work.

How can I do for you to adapt this one?
[Miscellaneous Android Development] alecxs:
[MENTION=3924647]bigrammy[/MENTION] aren't they forced already by law, or isn't it covered by GPL?

anyway.. a patch is useless, lot mtk devices doesn't even get OTA updates
[Miscellaneous Android Development] diplomatic:
You're gonna have to provide more details. All these phones have 4GB of RAM, right? I think I know what the problem is. But I need to know the first line of 'mtk-su -v' output, where it says 'type: ##'. What is the reported 'type' for each of those?
[Miscellaneous Android Development] sumitpsr1:
Thank u for ur guide helping me to root Realme 3(mtk p70) but the problem is that the safety net failed. Should I install patch to passed or any alternative method.
[Miscellaneous Android Development] Duhjoker:
Well it involves grabbing a bit of lge source code and using grep to find the fastboot commads in the source code. Basically yout going to be needing a usb uart and using a command called send_event to send some ascii characters to the board which will flash firmware.
[Miscellaneous Android Development] sumitpsr1:
Hey, After the first try root permission was granted by SuperSU but after the reboot the SuperSU stop working and it's not prompt any su request. I tried termux command "su" it's day permission denied. Also I checked FAQ for solutions, I thought selinux is the problem but it set to permissive.

I also thought about dm-verity could be a problem are it be?

---------- Post added at 07:48 PM ---------- Previous post was at 07:15 PM ----------

Guide m to uninstall root. Magisk uninstaller not work.
[Miscellaneous Android Development] realali:
oppo	R9tm	5.1	3.10.72	8U	4G	64G

param1: 0x3000, param2: 0x18040, type: 7

Building symbol table

Can't find kallsyms addresses or offsets

Unable to get kernel symbol table

starting /system/bin/sh

UID: 2000 cap: 0000000000 selinux: enforcing

------------------------------------------------------------------------------

oppo	R9km	5.1	3.10.72	8U	4G	64G

param1: 0x3000, param2: 0x18040, type: 7

Building symbol table

Can't find kallsyms addresses or offsets

Unable to get kernel symbol table

starting /system/bin/sh

UID: 2000 cap: 0000000000 selinux: enforcing

------------------------------------------------------------------------------

oppo	A59s	5.1	3.10.72	8U	4G	32G

aarch64 machine

param1: 0x3000, param2: 0x18040, type: 7

Building symbol table

Can't find kallsyms addresses or offsets

Unable to get kernel symbol table

starting /system/bin/sh

UID: 2000 cap: 0000000000 selinux: enforcing

-------------------------------------------------------------------------

gionee	S9	6	3.18.22	8U	4G	64G

param1: 0x1000, param2: 0x8040, type: 7

Building symbol table

Can't find kallsyms addresses or offsets

Unable to get kernel symbol table

starting /system/bin/sh

UID: 2000 cap: 0000000000 selinux: enforcing
[Miscellaneous Android Development] Supermatt01:
I'd like to try this. What are the steps to make it useful?
[Miscellaneous Android Development] levone1:
So I got some source code from a different TCL phone and started grep'ing, and found, for example,

grep -r "fastboot" idh.code <
idh.code/kernel4.4/fs/f2fs/super.c: Opt_fastboot,
idh.code/kernel4.4/fs/f2fs/super.c: {Opt_fastboot, "fastboot"},
idh.code/kernel4.4/fs/f2fs/super.c: case Opt_fastboot:
idh.code/kernel4.4/fs/f2fs/super.c: seq_puts(seq, ",fastboot");
idh.code/kernel4.4/include/trace/events/f2fs.h: { CP_FASTBOOT_MODE, "fastboot mode" }, \
idh.code/kernel4.4/include/linux/mfd/si476x-platform.h: bool fastboot;
idh.code/kernel4.4/Documentation/filesystems/f2fs.txt:fastboot This option is used when a system wants to reduce mount
idh.code/kernel4.4/drivers/gpu/drm/i915/i915_drv.h: bool fastboot;
idh.code/kernel4.4/drivers/gpu/drm/i915/i915_params.c: .fastboot = 0,
idh.code/kernel4.4/drivers/gpu/drm/i915/i915_params.c:module_param_named(fastboot, i915.fastboot, bool, 0600);
idh.code/kernel4.4/drivers/gpu/drm/i915/i915_params.c:MODULE_PARM_DESC(fastboot,
idh.code/kernel4.4/drivers/gpu/drm/i915/intel_display.c: * as Haswell has gained clock readout/fastboot support.
idh.code/kernel4.4/drivers/gpu/drm/i915/intel_display.c: * fastboot case, we'll flip, but if we don't update the pipesrc and
idh.code/kernel4.4/drivers/gpu/drm/i915/intel_display.c: if (i915.fastboot &&
idh.code/kernel4.4/drivers/gpu/drm/i915/intel_drv.h: * tracked with quirk flags so that fastboot and state checker can act
idh.code/kernel4.4/drivers/input/touchscreen/elants_i2c.c: * sending fastboot or IAP command to the device.
idh.code/kernel4.4/drivers/input/touchscreen/elants_i2c.c:static int elants_i2c_fastboot(struct i2c_client *client)
idh.code/kernel4.4/drivers/input/touchscreen/elants_i2c.c:error = elants_i2c_fastboot(client);
idh.code/kernel4.4/drivers/clk/rockchip/clk-rk3288.c: * wakes up from fastboot.
idh.code/kernel4.4/drivers/mfd/si476x-cmd.c: ctsen << 7 | intsel << 6 | puargs->fastboot << 5 |

so, if I get my uart hooked up, is there anything here that might help? Looks like /storage/emulated/0/Download/idh.code/kernel4.4/drivers/input/touchscreen/elants_i2c.c file might have the commands. I attached it here...

BTW - all I need is to enter fastboot, not necessarily flash anything. My main goal right now is unlock bl / gain system r/w...

Thanks
[Miscellaneous Android Development] superdragonpt:
However from March patch level, things have been hardened even more.

edit...
[Miscellaneous Android Development] Duhjoker:
Ok look for a command called send_event. I dont think this will neccesarily unlock the bootloader as we commonly know it but it will be away to flash firmwares including different .img. so it would still be a way to add twrp or cwm.

also your brand may not suport the source im talking about either
[Miscellaneous Android Development] levone1:
But forcing a boot img that's not properly signed with a locked bl will probably cause bootloop or brick, wouldn't it?

BTW - lots of send_event results, but none of them are in the same places as fastboot results... There are some send_id code there...
[Miscellaneous Android Development] diplomatic:
This is a known problem on Android 9. IDK of a way around it. But as a workaround, you can simply reboot your phone without loading root and use whatever apps that need to pass safety net. Then load root when you're done.

SuperSU? You mean Magisk, right? Do not use bootless root with permissive selinux. That kills the Magisk daemon. Make sure you're using the latest suboot script. Keep things simple and it should work.

There is nothing to uninstall. Just disable the init.d app from loading and reboot.

Just run the sed command once in root shell. After that try installing some modules.
[Miscellaneous Android Development] diplomatic:
OK, here is a test version for you. Good luck.
[Miscellaneous Android Development] flowswitch:
Time for source code?

diplomatic, you are the author, so it's up to you at the end, but with exploit details reached the news (no checks in mtk_cmdq IOCTLs) and the nature of exploit (not a crazy race condition with all planets aligned) it's a matter of (short) time for someone to release a source. What do you think?

Thanks for the hidden "dump" option! ;)
[Miscellaneous Android Development] DB126:
Well, that would be rather irresponsible IMO. While no big secret open source would make it easier to adapt and leverage the exploit for nefarious purposes.
[Miscellaneous Android Development] flowswitch:
An example of patch for kernels without selinux_enforcing var:

; avc_denied of Huawei Y5 kernel:
RAM:FFFFFF8008314B60 avc_denied ; CODE XREF: avc_has_extended_perms+144↓p
RAM:FFFFFF8008314B60 46 03 00 37 TBNZ W6, #0, exit_EACCES
RAM:FFFFFF8008314B64 4A 3C 00 12 AND W10, W2, #0xFFFF
RAM:FFFFFF8008314B68 82 1C 00 12 AND W2, W4, #0xFF
RAM:FFFFFF8008314B6C E4 10 40 B9 LDR W4, [X7,#0x10] ; avd->flags
RAM:FFFFFF8008314B70 88 01 80 12 MOV W8, #0xFFFFFFF3 ; -EACCES
RAM:FFFFFF8008314B74 C4 02 00 36 TBZ W4, #0, exit_w8 ; <--- write NOP (D503201F) here

Quick&dirty patching mtk-su binary to perform this operation (write to avc_denied + hardcoded offset 0x14) instead of write to selinux_enforcing worked fine :good:
[Miscellaneous Android Development] realali:
Thank you very much. It's success !

But there is a problem in phone.

#mount -o remount,rw /system

this command is also failed.

I can solve it in oppo.

change function get_boot_mode() result to 1.

can you add it to the mtk_su.
[Miscellaneous Android Development] Supermatt01:
Just run the sed command once in root shell. After that try installing some modules.[/QUOTE]

Worked.
[Miscellaneous Android Development] diplomatic:
I have no plans to release the source (and I would rather not comment about it further on this thread). There may be some PoCs made, but they won't replicate the universal functionality of this tool.

Nice. What's the deal with get_boot_mode()? Is it some exploit defense that blocks /system r/w on normal boot? If so, I won't include that in mtk-su release version. It can be done, but it would have to be a special order....
[Miscellaneous Android Development] realali:
find get_boot_mode() address, modify the result of the function.

Yes, it's the defense for the blocks /system r/w. it's effect after android 6.

It's different for different manufacturers. I can't find common method.

If I can't unlock the bootloader, How can I modify system?

Can you remove the defense from boot with mtk-su?
[Miscellaneous Android Development] diplomatic:
[MENTION=10045479]realali[/MENTION], are you talking about a phone with Android 5 or 6? Because in Android 6+, the protection method is just plain old dm-verity. This is active on almost all Android 6+ firmwares. Not much can be done about that with temp root. If you modify /system, your phone will probably refuse to boot.
[Miscellaneous Android Development] realali:
So if I want modify /system, I must modify boot first.

Can you modify ns_capable() function result to 1 ?

I can read and write kernel address for it.
[Miscellaneous Android Development] peter7910162:
OPPO A77 Android 6.0 MT6750T

can't acquire root privileges

failed critical init step 4

this platform cannot be supporte
[Miscellaneous Android Development] realali:
I have the same problem when I upgrade to the new version.

I don't know is the android 9 not support, or the leak fixed.
[Miscellaneous Android Development] BenchBox:
Problems with Acer B3-A40FHD

Hello,

I have problems to grant root permissions with my "Acer Iconia One - B3-A40FHD"

It is listed in the confirmed Device List but i get no root permissions.

Could someone help me to get mtk-su running on it please?

In this post Temp root for some MTK devices - Need help getting permanent root on Acer B3-A40 the user "cybersaga" got it running with a modified script, where can i found the script? Or what do i have to do?

Here ist what mtk-su -v says:

acer_asgardfhd:/data/local/tmp # ./mtk-su -v
param1: 0x3000, param2: 0x10000, type: 2
Building symbol table
kallsyms_addresses pa 0x40c0ec00
kallsyms_num_syms 43005, addr_count 43005
kallsyms_names pa 0x40c62d00, size 555424
kallsyms_markers pa 0x40cea700
kallsyms_token_table pa 0x40cead00
kallsyms_token_index pa 0x40ceb100
Patching credentials
Parsing current_is_single_threaded
ffffff8008377320+4c: ADRP x0, 0xffffff8008f6e000
ffffff8008377320+50: ADD xd, x0, 2992
init_task VA: 0xffffff8008f6ebb0
Potential list_head tasks at offset 0x338
comm swapper/0 at offset 0x5f0
Found own task_struct at node 1
cred VA: 0xffffffc02797be40
Parsing avc_denied
ffffff8008312218+24: ADRP x0, 0xffffff80090a0000
ffffff8008312218+28: LDR [x0, 324]
selinux_enforcing VA: 0xffffff80090a0144
Setting selinux_enforcing
Selinux is already permissive
starting /system/bin/sh
UID: 0 cap: 3fffffffff selinux: permissive
acer_asgardfhd:/data/local/tmp #

O.K. sorry, I have installed Bootless root with Magisk and MTK-SU after the steps above and i have root acces now, even after reboots, yeahhhh, thx ....it's amazing.

How to unlock my bootoader now?
[Miscellaneous Android Development] BenchBox:
Acer Iconia One 10 B3-A40FHD is working !!

Acer Iconia One 10 B3-A40FHD is working ,thank you very much.

Could someone help me with getting my bootloader unlocked pls?
[Miscellaneous Android Development] senia76:
Nokia 5.1 Works great

[YOUTUBE]https://youtu.be/YO1TP9BCv5c[/YOUTUBE]
[Miscellaneous Android Development] diplomatic:
Cool video, [MENTION=4570672]senia76[/MENTION], and in a language I can kind of understand. :) Now make sure you don't update the FW. It's likely mtk-su will be blocked on the Nokias by a FW update...