yashsingh1/xdaforums huggingface dataset:
[Miscellaneous Android Development] diplomatic:
Probably another case of undetected stack protection code that makes it use the wrong address for selinux.

Can you send me the kernel symbol file made by

./mtk-su -s > kallsyms.txt

? That command won't reboot it.

And do you have a link to the firmware or boot image currently on that phone? (Or custom recovery that has the same exact kernel.)
[Miscellaneous Android Development] Rortiz2:
Ok, when I get the phone (because its a friend phone) I will do it.

It has Android 5.1 and locked bootloader.

Here's the TWRP:

https://xdaforums.com/huawei-y5/how-to/root-huawei-y5-ii-cun-l21-l03-t3536329

And here the stock boot.img:

https://mega.nz/#!TwlUyaKD!PjOtZKkN5yo1NYWnaIdpy6f6JoovDywqMfcTlHBD5RQ

PS: I will test mtk-su too in a ZTE BLADE V6 (mt6753)
[Miscellaneous Android Development] diplomatic:
[MENTION=8978978]Rortiz2[/MENTION], try this build. I made a tweak for what I think is the problem. If that doesn't work, get me the symbol table.
[Miscellaneous Android Development] M47Z:
Any chance on the Mediatek M7322?

I was really happy when I saw this, thought it might work on my Mi TV 4S 55" (MSSP3, "machuca"). I know this is not in the scope of your work, but I hoped maybe this could work on this device as well. It got a MStar T22 (M7322) processor and it's hard to even find any info on this. Afaik MStar is owned by Mediatek since a while now, that's why I thought there might be a chance for this to work.

Not even sure if it is 64 bit, but I guess(ed) it is: "uname -m" shows "armv81".

But when trying to run the 64 bit version of your exploit, it always just says "not found", that leads me to believe it's 32 bit... (or maybe aarch64? is there a difference? idk) When I try to run the 32 bit version it just says:

Failed critical init step 1

incompatible platform

That makes me think at least it can execute the 32 bit version, but it just doesn't work.

Maybe it's aarch64, your 64 bit version is arm64 (as said: I don't even know for sure there is a difference, but I think there is), and that is why it doesn't work?

[MENTION=8132642]diplomatic[/MENTION] long story short: Do you think this is worth trying? Or does my MStar SoC not have enough in common with Mediatek ARMv8 devices? Would it be realistic to mod your tool to support this? (I'd guess you don't want to release the source of this? :angel: understandable.) Any hints welcome! Quite a few Smart TVs use this SoC, even though not very well documented, being able to root those would be great for many many users of totally locked down devices! :good:
[Miscellaneous Android Development] diplomatic:
Nope, no chance this will work on that TV/chip. "Incompatible platform" pretty much tells you the HW is not even in the ballpark. You'd get the same result on Qualcomm, Samsung, etc... arm chips.
[Miscellaneous Android Development] M47Z:
Damn, would have been too good to be true. Thanks for the quick reply never the less! Thanks for all your work.
[Miscellaneous Android Development] Solobolo56:
I'M IN

Once again mtk-su notches another win for team [MENTION=8132642]diplomatic[/MENTION]. I'm not only glad to be one of the success stories but also see a lot of the other threads taking much deserved notice of whats going on in here. :cowboy:

MUCH APPRECIATION:good::D

Alps tablet series

Android 5.1

3.10.73 layout

All done in TERMINAL

u0_a162@along8163_e_86vm:/ $ cd
u0_a162@along8163_e_86vm:/data/data/jackpal.androidterm/app_HOME $ ls -l
-rwxr-xr-x u0_a162 u0_a162 65216 2020-05-13 01:22 mtk-su
u0_a162@along8163_e_86vm:/data/data/jackpal.androidterm/app_HOME $ ./mtk-su -v
param1: 0x3000, param2: 0x18040, type: 8
Building symbol table
kallsyms_addresses pa 0x40941c00
kallsyms_num_syms 43282, addr_count 43282
kallsyms_names pa 0x40996600, size 530905
kallsyms_markers pa 0x40a18000
kallsyms_token_table pa 0x40a18600
kallsyms_token_index pa 0x40a18a00
Patching credentials
gps failed
Parsing current_is_single_threaded
ffffffc0002cf4e0+50: ADRP x0, 0xffffffc000ba7000
ffffffc0002cf4e0+54: ADD xd, x0, 3744
init_task VA: 0xffffffc000ba7ea0
Possible list_head tasks at offset 0x290
comm swapper/0 at offset 0x510
Found own task_struct at node 1
cred VA: 0xffffffc035e93200
Parsing avc_denied
ffffffc00028257c+24: ADRP x2, 0xffffffc000cb6000
ffffffc00028257c+28: LDR [x2, 940]
selinux_enforcing VA: 0xffffffc000cb63ac
Setting selinux_enforcing
Switched selinux to permissive
starting /system/bin/sh
UID: 0 cap: 3fffffffff selinux: permissive
u0_a162@along8163_e_86vm:/data/data/jackpal.androidterm/app_HOME #
[Miscellaneous Android Development] machskn:
Do any of you know a link with good explanation, how can I downgrade my opo reno z (cph1979)?

Thanks in advance !

---------- Post added at 01:43 PM ---------- Previous post was at 01:43 PM ----------

Do any of you know a link with good explanation, how can I downgrade my opo reno z (cph1979)?

Thanks in advance !
[Miscellaneous Android Development] DB126:
You should ask in your device forum; this thread is not the place for such questions.
[Miscellaneous Android Development] realali:
I found some oppo not success. (step 4 error)

android 7.1.1, linux 4.4.22-G202003030407

android 9, linux 4.4.146

android 9, linux 4.9.117

The Security Patch is not after 2020-3.

Is there linux core up to date?
[Miscellaneous Android Development] mecusmecus:
How do I alter the boot partition. I want to be able to edit system apps
[Miscellaneous Android Development] jacobas92:
I'm terribly sorry if this is the wrong place to ask, I couldn't find anything on this after searching. I've got a 2019 Fire HD 10 and using this last release for a bootless root setup with magisk. Is there a way to pass safety net cts profile check without modifying system? Sorry if this is a stupid question and thanks.
[Miscellaneous Android Development] DB126:
Nope. Might be able to get around some simplistic checks but anything that really looks for root (or other compromises) is going to bomb out.
[Miscellaneous Android Development] Duhjoker:
Ok um check this out. So magisk can sign a boot.img. So you take your stock boot and have magisk patch and it will resign at the end of the patching process.

Do not try to dd it in place with out unlocked bootloader. But.....

What im saying is read the source code that revolves around the send_event commands in the kernel source. It mentions sending firmware images to their corresponding partitions. This will work like the linux lg flashing commands. You will need to figure out the bit index for the communication.
[Miscellaneous Android Development] diplomatic:
Does it not pass the check? The Android 9 device I tested this on passed both MM and Root Checker apps' tests. Or does it have to be a Google certified device or something?
[Miscellaneous Android Development] KookyPower:
MagiskPolicy Not found

Log:

Executing scripts from /storage/emulated/0/init.d (21 Mei 2020 11.59.04 AM)

magisk-boot.sh

Temporary root by diplomatic@XDA

Home URL:

https://xdaforums.com/android/development/amazing-temp-root-mediatek-armv8-t3922213

--------------------------------------------------

UID: 0 cap: 3fffffffff selinux: permissive

/system/bin/sh: [42]: ./magiskpolicy: not found
[Miscellaneous Android Development] jacobas92:
Oh it passes basic integrity just not cts check. The Fire HD 10(2019) isn't a google certified device so I was guessing that was why it fails cts. I was hoping to spoof a different device fingerprint but didn't know of any way to do that without directly editing prop values.
[Miscellaneous Android Development] DB126:
Correct on certification assumption. Fiddling with fingerprints on these devices is generally a fools errand although some simplistic tests may pass. Not bashing Amazon; devices have their place. The latest Onn challengers may fill the niche once occupied by the upper end of the Fire lineup. Time will tell.
[Miscellaneous Android Development] Lefteris Fragiadakis (Frago):
[MENTION=8132642]diplomatic[/MENTION]

I have a Sony android tv mt5893

ARM Cortex A73

i already managed to extract system.img and boot.img,

In fastboot getvar all say bootloader unlock yes

but it doesnt allow me to write flash,like a modded boot.img i have with root support,

i will try to see if this method works,is any aother way for this kind of soc?

---------- Post added at 04:22 PM ---------- Previous post was at 04:22 PM ----------

[/COLOR [MENTION=8132642]diplomatic[/MENTION]

I have a Sony android tv mt5893

ARM Cortex A73

i already managed to extract system.img and boot.img,

In fastboot getvar all say bootloader unlock yes

but it doesnt allow me to write flash,like a modded boot.img i have with root support,

i will try to see if this method works,is any aother way for this kind of soc?
[Miscellaneous Android Development] Vortell:
Did you try magiskhide props config module for magisk? It's in the standard repo.
[Miscellaneous Android Development] diplomatic:
Have you copied a magiskinit file to init.d/bin?

I really doubt mtk-su will work on it. Android on official TVs or media boxes tends to be very locked down. You're not supposed to root any device that streams premium content.
[Miscellaneous Android Development] jacobas92:
I didn't figure it was worth trying honestly, still no way of writing to /system on the HD 10 2019. That module still needs write access, doesn't it?
[Miscellaneous Android Development] Lefteris Fragiadakis (Frago):
So after some hard work yesterday,i patched a boot.img from latest sony firmware update using magisk,flashed to tv and bricked,only sony logo and then power off,no recovery no fastboot mode,i have to open extract boot.img to see what when wrong but first i have to repair my tv,maybe if i patched the system.img and root this and not the boot img
[Miscellaneous Android Development] diplomatic:
I think all modules can be installed in systemless mode. They don't need to write directly to /system, but the files are mounted as a temporary overlay on top of it. That doesn't mean it'll work though. It might still need to be loaded early in the boot process. No harm in trying it out...

Ouch... not sure what to tell you. If the OS is Android 9, then it was also necessary to disable verification in vbmeta. Not to add insult, but you should have prepared for this by making sure you could get to fastboot independently of Android. Or have some other way to flash to the storage. When you flash a modded boot image there is always a significant risk it will not boot. Maybe it works like a phone/tablet in the sense you can hold a button while you power it on, and that will get you to fastboot or recovery. Just a guess. You can also try SP Flash Tool since this is MTK, but I doubt it's compatible with that chip. I didn't see a reference to any mt58xx platforms in SPFT binaries.
[Miscellaneous Android Development] Lefteris Fragiadakis (Frago):
No problem, i said to Sony that it bricked from an update ?, they will fix it on monday amd then i will try again, i Just need someone to examine the img files and help me try again, if i upload the full system dump, can you have a look? No one have ever root Sony android tv but i know, the security is not too much
[Miscellaneous Android Development] jacobas92:
I'll definitely give it a try, thanks

Update: It seems that I cannot install many modules, not sure why. Just says please install Magisk 20.0+ in terminal readout under failed message Tried 20.2 and 20.4. I also tried after a warm reboot but no dice. I did manage to install the systemless hosts module though with no issue, and it works fine so that's pretty cool.
[Miscellaneous Android Development] diplomatic:
Uh, I can check for some obvious problems, but that wouldn't guarantee that the boot img will work. If you can't get into fastboot or recovery from power-on, there is not much point in trying to install root. You are gambling with your TV every time you flash some image. Are you going to ask Sony to bail you out every time it bricks? At least try to find out from the repair guy what the recovery procedure is first.

Try deleting /data/adb/magisk/busybox and restart MM to do a refresh.
[Miscellaneous Android Development] Lefteris Fragiadakis (Frago):
[MENTION=8132642]diplomatic[/MENTION]

I think i found the way for flash,

I went to Sony service for asking for my tv, and i saw this

https://www.amazon.com/Letotech-Serial-Converter-TTL-232R-3v3-AJ-Adapter/dp/B07C6MBS26

But i have to wait for the tv to come to check,

So my friend, do you want from me to upload tbe full partitions dump and give you the link for checking?
[Miscellaneous Android Development] diplomatic:
[MENTION=4561223]Lefteris Fragiadakis (Frago)[/MENTION], ok, but I think we should move to PMs, because that's pretty off topic now.
[Miscellaneous Android Development] paco.io:
it says incompitable platform!

I pushed both the scripts "arm/mtk-su" && "arm64/mtk-su" tried to chkmod both but got no luck......my device is CHP1803 oppo...A3S...

lilnks to the error are somewhere here... [IMG="image"]https://imgur.com/bEE272t[/IMG] please help me root this device i really want to experiment new things.

Thank You in advance
[Miscellaneous Android Development] diplomatic:
Mediatek-based devices only, [MENTION=10836491]paco.io[/MENTION]
[Miscellaneous Android Development] paco.io:
should is used other scripts for this??

should i use another scripts to root my device, i followed this thread because when i root my device with mtk easy root it showed me the link of this thread saying platform not compitable.
[Miscellaneous Android Development] JunioJsv:
Your device is not compatible, simple as that
[Miscellaneous Android Development] white&black:
Hello.

android 7.0

MT6750

when entering a command in the terminal:

cp /sdcard/mtk-su_r21/arm/mtk-su ./

writes:

cp: .//mtk-su: Read-only file system

what's wrong?

kernel sources: https://drive.google.com/file/d/1itZnerT1FwU2XXVZMu0mFBaUj4a4LN9U/view
[Miscellaneous Android Development] DragonFire1024:
mtk-su will not work in internal storage. That's why you need ADB to push it to /data/local. Without root you can't move a file from sdcard to /data without mounting it rw. Use ADB to copy it and the required files.
[Miscellaneous Android Development] white&black:
used adb

C:\adb>adb push mtk-su /data/local/tmp/
mtk-su: 1 file pushed, 0 skipped. 18.8 MB/s (60840 bytes in 0.003s)

C:\adb>adb shell
ZTE_BLADE_V0820:/ $ cd /data/local/tmp
ZTE_BLADE_V0820:/data/local/tmp $ chmod 755 mtk-su
ZTE_BLADE_V0820:/data/local/tmp $ ./mtk-su
UID: 0 cap: 3fffffffff selinux: permissive
ZTE_BLADE_V0820:/data/local/tmp #

Does this mean what happened?

ZTE_BLADE_V0820:/data/local/tmp # ./mtk-su -v
armv7l machine
param1: 0x1000, param2: 0x8040, type: 4
Building symbol table
kallsyms_addresses pa 0x40bccb10
kallsyms_num_syms 62454, addr_count 62454
kallsyms_names pa 0x40c09b00, size 760492
kallsyms_markers pa 0x40cc35b0
kallsyms_token_table pa 0x40cc3980
kallsyms_token_index pa 0x40cc3d10
Patching credentials
Parsing current_is_single_threaded
c0345588: LDR Rt, [PC, #132] ; 0xc0345614
init_task VA: 0xc1028e10
Possible list_head tasks at offset 0x2b0
comm swapper/0 at offset 0x428
Found own task_struct at node 1
cred VA: 0xc4ec3b00
Parsing avc_denied
c0aca988: LDR Rt, [PC, #84] ; 0xc0aca9e4
selinux_enforcing VA: 0xc1334354
Setting selinux_enforcing
Selinux is already permissive
starting /system/bin/sh
UID: 0 cap: 3fffffffff selinux: permissive
ZTE_BLADE_V0820:/data/local/tmp #
[Miscellaneous Android Development] YeshuaisTheMessiah:
It works

Thanks a lot

U can add tablet ODYS PACE 10

WITH A MT8163 PROCESSOR ARM CORTEX A53

RUNING ANDROID 7

I ALSO GOT MAGISK TO RUN SO DOUBLE CHECK AND GAIN ROOT PERMISSION!!

I have a question can i also install twrp , would be possible?

Bless God for Your Help!!
[Miscellaneous Android Development] martyfender:
Only if someone has ported it to your specific device.
[Miscellaneous Android Development] YeshuaisTheMessiah:
Thanks for the info, i tried out a tutorial to create twrp from another device with same architecture...... I will see how it goes!

Bless U
[Miscellaneous Android Development] thefevi:
How did you get magisk?

I am able to run commands as su, but how I can run an app that requires su privilegies? Also is it possible to get full root trhough command line?

Thanks!

Edit: I am asking to you [MENTION=10615025]YeshuaisTheMessiah[/MENTION] because i have a device with the same cpu MT8163 :D
[Miscellaneous Android Development] AstonSmith:
I don't think that will work. A normal Magisk installation starts early during boot, loading the App Systemizer module, systemizing the selected apps there and then.

The method used here doesn't start Magisk until boot is completely finished, either manually or using an auto-running app (like init.d). So App Systemizer can't systemize init.d because it won't be loaded before init.d.

On my tablet init.d doesn't start immediately, but it does eventually get there.
[Miscellaneous Android Development] DB126:
Bingo :)
[Miscellaneous Android Development] bpaxda:
Had no luck even getting a systemizer installed. App Systemizer says if you're on Oreo you should install Privileged Permission Whitelist which has been depreciated in favor of Terminal App Systemizer. Terminal App Systemizer errors out during install with "Please install the latest Magisk!" so no luck there. As of the date of this message, I'm using the latest of Magisk, Magisk Manager and the boot script.

Side note, slightly off topic, slightly on topic:

I'm not sure I understand the whole Magisk framework anyway. It appears to provide a systemless framework, but with a flashing aspect used in its "typical install", something we avoid in this thread (Mtk Systemless Temp Root) as this could brick the device with locked bootloader? Yet, isn't the idea of "systemless" supposed to avoid flashing of any kind and that everything is supposed to happens at boot time to an unmodified system? For Amazing Mtk Systemless Temp Root, we are pulling out magiskinit scripts from the Magisk ZIP and using Magisk Manager (presumably just for the su grant dialogs), but apparently Magisk is not really being installed in the typical way which is why I can't get any Magisk modules to work ... ? I looked at the install script for Terminal App Systemizer (not that it would have solved my boot issue but just to see if I can get it to systemize anything) and it checks for the presence of /data/adb/magisk/util_functions.sh and if that file isn't found, this triggers the error "Please install the latest Magisk!". Trying another Magisk module Xposed Framework, results in the same error as it would be nice to get Xposed with Xprivacy on this device as I had gotten it to work with an older rooted device. Am I correct in concluding that Mtk Systemless Root isn't compatible with Magisk modules but this method installs just enough (i.e. the Magisk core) so that the GUI works to grant SU permissions? This is totally cool with me BTW, just it would be nice to know so I don't waste any more time trying to get Magisk modules working and I can't seem to find clarification for this online. Where does the util_functions.sh script come from anyway. I have unprotected the bootloader in Developer Options by unchecking the appropriate spot, but I don't know what this really does. Does it mean I can use Magisk to do its native "flash" install without fear of being bricked? I don't really know what this means on these new Android 8.1 devices but something tells me its not compatible with this thread's Mtk-su Systemless root. I am super grateful for Mtk-su, just trying to ramp up an understanding the latest hardware changes on these new devices. My original goal was to root the device for the purpose of disabling forced automatic updates (and for fun) and I have achieved that goal.
[Miscellaneous Android Development] DB126:
Fully OT; repost in Magisk thread
[Miscellaneous Android Development] diplomatic:
The util_functions.sh file (and others in /data/adb/magisk) gets installed after MM prompts you for additional setup, aka step 10. Modules should install just fine in general. They do get installed in systemless mode, which mounts their files in a temporary overlay on top of /system without physically editing the partition. As for the init.d app not starting at boot, check the Apps settings for this app, the battery section, and disable any background activity restriction.
[Miscellaneous Android Development] already_taken:
Peloton Android 7.0 Firmware support? (August 2019 Android Security Patch)

Hi Diplomatic, I'm trying this tool on a Peloton 21" Tablet which is an MT8173 chipset armv8l

Here's some more device info ProjectConfig.mk from and build.prop file https://gist.github.com/sagz/64dbe6611e23da7084fe7b0b6f2da1a7 (There's also fastboot getvar all output there in the comment of the gist)

Also, they seem to have posted their kernel here: https://github.com/pelotoncycle/opensource-ruby/

I see

1|RB1VQ:/data/local/tmp $ ./mtk-su -v
Failed critical init step 4
This firmware cannot be supported

Since the CVE is newer than the android security patch on the device, any idea what's happening here?

I'm trying to get root or any custom recovery working on this tablet. Bootloader is unlocked and I tried a bunch of things and learnt that it doesn't have a recovery partitition and uses a recovery-in-place logic.

Thanks for making mtk-su in the first place :)
[Miscellaneous Android Development] diplomatic:
Hi [MENTION=6567190]already_taken[/MENTION],

It's entirely possible that tablet was patched before the official Google bulletin. The date of that FW is long after mtk-su has been out. The OEM could have caught wind of this tool early on, like Amazon and Oppo did. The kernel source you linked is obviously not your current version. So I can't tell much from it. Actually, did they upgrade the Android version last year? That would explain why it's blocked.
[Miscellaneous Android Development] already_taken:
Yes, it has the August 5, 2019 Android Security Patch. Bummer that it's patched. Any tips on how I can try a 'generic' recovery image since bootloader is unlocked? maybe the getvar dump in the gist might help you assess?
[Miscellaneous Android Development] RubenGreg:
I am trying this on a Nokia 2.2

Contains

MTK 6761V/WBB
Model TA-1188
Linux localhost 4.9.190+ #1 SMP PREEMPT Tue Feb 25 15:05:27 CST 2020 aarch64

./mtk-su -v
Failed critical init step 4
Firmware support not implemented

Any other suggestions I can do to get root? Many thanks
[Miscellaneous Android Development] superdragonpt:
MediaTek bug bulletin had release an patch long before the official cve patch come out, the patch was "optional" so many OEMs didn't merge it...

Patch was release for kernels 3.18 and up

Patch of cmdq kernel drv, ioctls, for security vulnerabilities,

Released March /April 2019

Anyone with an supported platform, with an patch level prior to March 2019 should have no issues
[Miscellaneous Android Development] RubenGreg:
Thanks. for the reply.

Oh yes there was an update to Android 10 last week. The new phone updated as soon as I connected to internet. (sh*t I should I have avoided) .
[Miscellaneous Android Development] diplomatic:
Yeah, true. And now we know how many OEMs actually care about security. (The only companies that I'm aware of that bothered to apply "the patch" early are Amazon and Oppo on at least one phone.) But, the security patch level/date only reflects Google's security bulletin. So anything dated before March 2020 could be up for grabs. In practice, almost all early cases I've seen that blocked mtk-su were new devices that had the patch already out of the box. Those were beginning to be released around Sept. Very few had been updated via a FW update....

If it's Android 10, it's very likely a case of "firmware cannot be supported". The actual error message you got means that it doesn't have tweaks for that specific kernel. But if I did include it, I really suspect you would get the "firmware cannot be supported" error.
[Miscellaneous Android Development] white5pirit:
I'm running Amazon Fire HD 7 9th Gen, Fire OS 6.3.1.5.

Getting "Failed critical init step 4

This firmware cannot be supported".

Any chance to downgrade to 6.3.1.2, or root the current version?

Thanks.