yashsingh1/xdaforums huggingface dataset:
[Miscellaneous Android Development] ghylander:
im a bit confused

i followed all the steps and after running ./mtk-su, it just stayed blank for some time and then the phone rebooted normally

it's a huawei tag-L21, with a mt6753, and i followed the adb method

as an update, every first time i connect to the phone and run ./mtk-su i get the folowing error:

read failed: Bad address

Can't find kallsyms addresses

Unable to get kernel symbol table

New UID/GID: 2000/2000

if i close the shell and repeat the whole procedure again, i get what i described at the beggining of the message:

phone gets frozen and after 20 seconds reboots to system with no problem
[Miscellaneous Android Development] diplomatic:
I see. There is probably something new about the format of the addresses in the symbol table, that it can't detect it. Is this kernel 4.9? Do you happen to have a boot image (or recovery) for that phone, or at least a link to the firmware?

OK, so it's clearly not compatible with that phone yet. The cause will have to be investigated. If you don't mind running it again, can you tell me the output of './mtk-su -v' ? Specifically, the line with param1: 0xYYY param2: 0xYYY type: N'? But other than that you shouldn't run it anymore.

EDIT: I think I have a fix for this. But in the meantime, if you were trying to run the arm64 binary, you should be able to run the arm version successfully.
[Miscellaneous Android Development] mrmazak:
Yes it is kernel 4.9.77

kernel source is available. I have it onto github **this is the source as released from BLU, but it is not bootable, they failed to include correct DTB file

https://github.com/mrmazakblu/BLU-VIVO-XL4-kernel

Full firmware is available from

https://android.googleapis.com/pack.../9d5a92195de2e7819e951c70ae9b400ba043a6f1.zip

Few TWRP and Pulled firmware files are here

https://androidfilehost.com/?w=files&flid=287088
[Miscellaneous Android Development] bigrammy:
[MENTION=6522015]ghylander[/MENTION]

Is your device still on 5.1 as listed HERE ?

[MENTION=8132642]diplomatic[/MENTION]

I am not sure if your mtk-su is affected by this or not :confused: but just in case older mediatek boot.img's have a header of 512bytes on the kernel and 512bytes on the ramdisk so your binary may not find what it expects to find if it reads from 0x0 down sort of thing. :eek:

More info on that here should you need it. https://xdaforums.com/showthread.php?t=2753788
[Miscellaneous Android Development] ghylander:
yes it unfortunately is

is there any way to make the exploit compatible?
[Miscellaneous Android Development] diplomatic:
[MENTION=5312578]mrmazak[/MENTION], PM sent.

[MENTION=3924647]bigrammy[/MENTION], neither of those things are relevant to mtk-su

[MENTION=6522015]ghylander[/MENTION], have you tried the 'arm' version like I said in last post?
[Miscellaneous Android Development] chauhanjayc:
i guess this is all high facny stuff, but still i am trying to figur it out. I have XA1 Plus

Once i follow all the steps will i get permenent root?

can i use supersu after that?

can it brick my device if something went wront?

Thanks in Advance
[Miscellaneous Android Development] ghylander:
sorry i missed your update

yes i was using arm64 and the arm version woks fine and returns "New UID/GID: 0/0", with selinux set as permissive

however im a bit unsure of how to move on, apps still report that there is no root access

running ./mtk-su -v reports the following:

shell@HWTAG-L6753:/data/local/tmp # ./mtk-su -v

aarch64 machine

param1: 0x3000, param2: 0x18040, type: 6

Building symbol table

kallsyms_addresses pa 0x40a92f00

kallsyms_num_syms 49056, addr_count 49056

kallsyms_names pa 0x40af2d00, size 589730

kallsyms_markers pa 0x40b82d00

kallsyms_token_table pa 0x40b83300

kallsyms_token_index pa 0x40b83700

Patching credentials

__ksymtab_init_task not found

Parsing show_state_filter

ffffffc0000cf1ac+10: ADRP x21, 0xffffffc000d88000

ffffffc0000cf1ac+1c: ADD xd, x21, 480

init_task VA: 0xffffffc000d881e0

Possible list_head tasks at offset 0x290

0xffffffc07f25f290 0xffffffc005591290 0x000000000000008c

comm offset 0x4d8 comm: swapper/0

Found own task_struct at node 0

real_cred VA: 0xffffffc01d19a500

Parsing sel_read_enforce

ffffffc0002a5bd0+04: ADRP x0, 0xffffffc000f0e000

ffffffc0002a5bd0+14: LDR [x0, 1404]

selinux_enforce VA: 0xffffffc000f0e57c

Setting selinux_enforce

Selinux is already permissive

New UID/GID: 0/0

starting /system/bin/sh

notice the "__ksymtab_init_task not found", which i dont know if has any effect
[Miscellaneous Android Development] ahhl:
manage to cp but still permission denied
[Miscellaneous Android Development] mrmazak:
So close. You skipped a step though.

After you cp the mtk-su file to the termux home folder, you must give it permission

"chmod 755 mtk-su"
[Miscellaneous Android Development] omgsmite:
Tested this on my android tv with mtk 5891 on android 8.0. Got to the last step and get failed critical init step 1. I tried at least 20 times.
[Miscellaneous Android Development] ahhl:
[emoji1787] thanks for pointing out. i thought that command only needed when i executing using adb.. [emoji16]

anyway.. after executing mtk-su - v, the phone just reboot. not enough time for me to capture screen shot.

i managed to capture slow-mo video and screen shot the video before the phone reboot.
[Miscellaneous Android Development] diplomatic:
OK, thanks for feedback. It's not compatible with kernel 4.9 yet. If it reboots, don't run it anymore. It's not safe.

It looks like you do need to chmod the file after all. I just assumed that copying takes care of that. (It's set automatically in some cases.) I'll add it to the instructions... But you said it failed at step 2. The mtk-su command is actually step 3.
[Miscellaneous Android Development] ahhl:
Ha..ha.. my mistake...[emoji16][emoji28]

any way just to let you know that I am testing using armv7/mtk-su instead of arm/mtk-su.

Will it make any different if I use arm version?
[Miscellaneous Android Development] FlexibilityGuy:
I've tried your temp-root method in termux and although it runs well, when i try to run magisk script then it said: ./mtk-su: not found. How to resolve this? I use oppo a5s
[Miscellaneous Android Development] diplomatic:
[MENTION=10076402]FlexibilityGuy[/MENTION], have you set up the binaries in the right directory tree (/sdcard/init.d/bin)? Thanks for the report on that phone, btw.
[Miscellaneous Android Development] kobul:
Does this work on oppo f7?
[Miscellaneous Android Development] Rortiz2:
https://xdaforums.com/showpost.php?p=79354355&postcount=3
[Miscellaneous Android Development] TooMuchSloeGin:
First of all a great thank you [MENTION=8132642]diplomatic[/MENTION] for the temp root stuff. I have been using this to good effect on a Sony Xperia L1 which I did not want to root for various reasons.

Now I've found this post of yours about bootless rooting via mtk-su and magisk. This may or may not be something I might want to try... depending on whether my understanding of the process is sound. Basically what seems to happen is that (late) upon boot a third-party app (init.d scripts support) executes whatever scripts are found in /storage/emulated/0/init.d. Your suboot.sh (plus mtk-su plus various magisk binaries) in this directory will do all the magic and as a result the phone is then rooted. If rebooted, root is first lost but will be recreated by the same sequence.

So... if I do not need root on a regular basis but just every now and then for say starting a backup apk (or any other stuff I can't do directly in the terminal via mtk-su) I should be able to go into a terminal, execute an adapted version of suboot.sh (adapted in the sense that all the required stuff is found in another directory), get root, do my stuff and then reboot to a clean, unrooted phone?
[Miscellaneous Android Development] diplomatic:
The Oppo F7 has an exploit protection built into the kernel that reboots the phone whenever an illegal UID change is detected. (It's not a very good one). I believe mtk-su has been reported to work under adb shell on that phone. But if you're talking about the Magisk root, that would probably trigger a reboot. It needs a special version with a workaround for Oppo....

Yeah, you're right on point. I couldn't have said it better myself. You can change the script to make it run from terminal like you said. Or you can leave it alone, and just use the init.d app's manual run function. (BTW, the manual start just became an ad-supported/premium only feature...) This kind of occasional root is a primary use case for this method. I actually prefer that kind of access myself instead of having root activated 24/7.
[Miscellaneous Android Development] kobul:
Oh... I see.

Please make this work for oppo f7, for long time... I want root my phone but still no hope. BTW, nice work sir. And thanks for ur explanation.
[Miscellaneous Android Development] diplomatic:
[MENTION=9425473]kobul[/MENTION], I already have (made it work). Can you try the latest version in the OP first? If that makes it reboot, I'll post the Oppo version.
[Miscellaneous Android Development] kobul:
What version color os do you have on oppo f7? I wanna try, but i'am affraid if make bootloop or brick my phone cz this is my daily use phone and doesn't have any backup.
[Miscellaneous Android Development] Supermatt01:
I so wish that it worked for F11. I just can't get it.
[Miscellaneous Android Development] TooMuchSloeGin:
Thanks for that. I'd rather start the script under my own steam than using a 3rd party app... every installed app is a(n admittedly tiny) security risk. A similar observation goes for root 24/7... I really don't need root all day long.

Keep up the good work!;)
[Miscellaneous Android Development] kobul:
C:\Program Files (x86)\Minimal ADB and Fastboot>adb shell

CPH1819:/ $ cd /data/local/tmp/

CPH1819:/data/local/tmp $ chmod 755 mtk-su

CPH1819:/data/local/tmp $ ./mtk-su -v

param1: 0x1000, param2: 0x8040, type: 16

Building symbol table

kallsyms_addresses pa 0x40eb1000

kallsyms_num_syms 54521, addr_count 54521

kallsyms_names pa 0x40f1b900, size 706525

kallsyms_markers pa 0x40fc8100

kallsyms_token_table pa 0x40fc8800

kallsyms_token_index pa 0x40fc8c00

Patching credentials

Parsing current_is_single_threaded

ffffff800837c898+58: ADRP x2, 0xffffff80097c9000

ffffff800837c898+5c: ADD xd, x2, 1728

init_task VA: 0xffffff80097c96c0

Potential list_head tasks at offset 0x3c8

comm swapper/0 at offset 0x690

Found own task_struct at node 1

cred VA: 0xffffffc07c26e380

Parsing avc_denied

ffffff8008316a08+10: ADRP x4, 0xffffff8009af3000

ffffff8008316a08+20: LDR [x4, 1460]

selinux_enforcing VA: 0xffffff8009af35b4

Setting selinux_enforcing

Switched selinux to permissive

starting /system/bin/sh

UID: 0 cap: 3fffffffff selinux: permissive

CPH1819:/data/local/tmp #

that the result sir? is that mean "it work"? Then what next? cz last time when i was check my phone with cpu Z, say that my phone still doesn't have root? sorry for noob question... and my bad english, i hope ur know what i mean. thanks before....
[Miscellaneous Android Development] CXZa:
Manual start works in init d scripts support v1.1.32.

https://apkpure.com/init-d-scripts-support/com.ryosoftware.initd

For just running the script manually, $cripter is good enough - and open source.

One just have to edit the HOMEDIR in suboot.sh: "com.ryosoftware.initd" -> "sites.mjwhitta.scripter"

https://play.google.com/store/apps/details?id=sites.mjwhitta.scripter
[Miscellaneous Android Development] alecxs:
the # is indicating you have a root shell. thats it! there is no whats next. you can access the whole file system now, for example you can grab a copy of boot.img ... but do everything within this root shell
[Miscellaneous Android Development] diplomatic:
Yes, it does work, in ADB shell, which I already said was known to work. This gives you a command line shell with root privileges. I thought you wanted Magisk bootless root. What's unclear is if it will achieve root in app mode (needed for launching Magisk). To test it, you have to set up bootless root (according to those instructions). Or just test mtk-su in a terminal app. BTW, there's not much danger of bricking your phone if mtk-su fails.
[Miscellaneous Android Development] kobul:
I try bootless root and when i run the script my phone reboot. Thanks god i don't check "run script on boot time". Or when i try push mtk-su with termux it fail, just make my phone restart.
[Miscellaneous Android Development] diplomatic:
Special mtk-su for Oppo

Yeah, [MENTION=9425473]kobul[/MENTION], good point about not checking run scripts at boot. :good:

So your phone does need the Oppo workaround. Here is the build that I have. Let me know how it works.
[Miscellaneous Android Development] kobul:
Finaly.... It work sir.... My phone now is rooted. Thank you very much sir. Realy... Realy nice work sir.

This screenshoot on cpu z.

https://ibb.co/pRDsvxh
[Miscellaneous Android Development] diplomatic:
Great! Enjoy your root... And do be careful about any mods to the firmware, if there's no firmware package for the recovery mode.
[Miscellaneous Android Development] Supermatt01:
So MM ROM. That's why. In pie it's still not working...
[Miscellaneous Android Development] TooMuchSloeGin:
As expected the manual method does work. The L1 is rooted and the apps I've tested do work.:D

However, there are two questions remaining. First, in your original description you wrote that MM, after suboot.sh has been run, will ask for "Requires Additional Setup". It didn't. (This is MM 7.1.1 as advised.)

Second, there's a bit of an oddity with the reboot command. This does not work (ie does not reboot the device) in an mtk-su-rooted (ie your method) terminal, but it does work in a su-rooted (ie Magisk method) terminal.:confused:

Lovely stuff.:good:
[Miscellaneous Android Development] diplomatic:
Cool! Glad you got it set up.

About the additional setup, does MM show that Magisk is activated? If so, it may have already gone through that setup before. Otherwise, you might need to delete some files under /data/adb to trigger it again.

Which app are you running 'reboot' from? It should work just fine. Unless maybe the app ships with its own reboot command or hooks into shared libraries (e.g. Termux, which I really don't recommend). If you need to use Termux, entering the the full path, /system/bin/reboot, might work...
[Miscellaneous Android Development] Supermatt01:
Yahoo! I finally got the terminal emulator to get root. However, Magisk still is no use. How can I use this to get apps running as root?
[Miscellaneous Android Development] diplomatic:
[MENTION=3211017]Supermatt01[/MENTION], ok, nice job, but something doesn't seem right. You're supposed to get a '#' prompt after mtk-su if you really did achieve a root user id. What is the output of 'id' after running mtk-su? I'm wondering if the new prompt you got is from a new subshell or still part of the original shell. In the new prompt, if you press the up arrow, do you see your last entered mtk-su command, or does it stay blank?
[Miscellaneous Android Development] Supermatt01:
I get the last command... Is that wrong? What terminal emulator will do a better job of it?

Edit: I got this in terminal emulator:
[Miscellaneous Android Development] diplomatic:
[MENTION=3211017]Supermatt01[/MENTION], yeah, that's bad. It means the internal exec call is failing and not even spawning a shell. That's consistent with the suboot script behavior. If you try to run some program from the data partition as root, it fails with operation not permitted. But you can probably get a root shell if you use /system/bin/sh instead of bash:

mtk-su -c /system/bin/sh

Or you can try it in Terminal Emulator, but you have to change to $HOME before entering those commands:

cd $HOME
cp /sdcard/arm64/mtk-su ./
<etc>

If you do get a root shell, post the output of

/system/bin/mount | grep /data

edit: probably should move this to PM to not clutter the thread....
[Miscellaneous Android Development] TooMuchSloeGin:
Yes, MM shows Magisk as active and all the options and settings are there. And root apps do ask for root and will get it if I grant it. So this all works as it should. I followed the steps as outlined in your rooting post: installed MM, started it, set the update channel, switched off updates, left MM, started the modified suboot script, restarted MM and Magisk was shown as active but there was no further prompt.

Well, maybe it's just one of those things...

That's the Jackpal Term.apk app. I've been using this for many years. And yes, I've checked... it is indeed /system/bin/reboot that gets executed in both cases. Entering the full path doesn't make a difference ----> reboot just hangs within a mtk-su rooted shell but reboots in a Magisk-su rooted shell. It's NBD but rather strange all the same.
[Miscellaneous Android Development] ValdikSS:
Unfortunately v18 (both arm and arm64) doesn't work with Teclast M20 4G tablet.

m204g_m3k7_g:/data/local/tmp $ ./mtk-su -v
armv8l machine
param1: 0x1000, param2: 0x8040, type: 12
Building symbol table
kallsyms_addresses pa 0x40d9d000
kallsyms_num_syms 45140, addr_count 45140
kallsyms_names pa 0x40df5400, size 576819
kallsyms_markers pa 0x40e82200
kallsyms_token_table pa 0x40e82800
kallsyms_token_index pa 0x40e82c00
Patching credentials
Parsing current_is_single_threaded
Stack protection detected
ffffffc000353c28+88: ADRP x23, 0xffffffc0013eb000
init_task not found
Parsing avc_denied
ffffffc0002f1fa8+10: ADRP x4, 0xffffffc001e74000
ffffffc0002f1fa8+20: LDR [x4, 1444]
selinux_enforcing VA: 0xffffffc001e745a4
Setting selinux_enforcing
Selinux is already permissive
setns failed: Permission denied
starting /system/bin/sh
UID: 2000 cap: 0000000000 selinux: permissive

The tablet has Helio X23, runs Android 8.0.0, kernel 3.18.60, security patch 5 Feb 2018.

This tablet has unlockable bootloader but I tried this tool anyway. I wanted to get stock recovery image the easy way, without making a backup with SP Flash Tool.
[Miscellaneous Android Development] diplomatic:
OK, I just checked and got the same result. The reboot command is just setting the Android property sys.powerctl (as in 'setprop sys.powerctl reboot'). But for some reason if you set a property in an mtk-su environment, it doesn't stick. No idea why that is. It needs looking into...

I see. It looks like there is a false positive with the stack protection. I probably know why that is. Will be fixed in next version.
[Miscellaneous Android Development] kobul:
Sir... Yesterday i accidentally uninstall magisk manager. Then... When i tried root again, i fail. This is the last execution result on app init.d support

suboot.sh

New UID/GID: 0/0

/system/bin/sh: [50]: ./magiskpolicy: not found
[Miscellaneous Android Development] diplomatic:
[MENTION=9425473]kobul[/MENTION], did you set up the files in init.d/bin, namely magiskinit? If you did, then delete the data of init.d scripts support and set it up again. I'm not sure what that symptom has to do with reinstalling MM. Also, if it's me you're addressing, no need to use the s word. Any one of dude, man, bro, diplomatic is fine. ;)
[Miscellaneous Android Development] DIXES:
I get root shell successfully on Nokia 3.1 (TA-1049), but suboot no success.
[Miscellaneous Android Development] diplomatic:
OK, try this mtk-su version.

EDIT: File removed
[Miscellaneous Android Development] DIXES:
It works. Thanks for your help.
[Miscellaneous Android Development] DartTimeTime:
Sorry for the late reply, but I recently discovered this tutorial. Im fairly new to the rooting scene, so I found it really useful. This also might be an obvious question, but are there steps I can take to make the rooting process more permanent? As stated on the bottom of the post the root status essentially "reset" on boot.
[Miscellaneous Android Development] KtownJeff:
Confirmed LG-K8+2018 locked bootloader

lg k8+2018 X210ULMA11F...I had no fastboot because I was a tribute dynasty sp200... Flashed another varient frimware with LGUP...gonna try to force fastboot by nuk force the LAF/LAFBK partitions.....

update------Now have systemless root and magisk....still working on bootloader...Got plenty to do now...lol..trimmin bloat
[Miscellaneous Android Development] diplomatic:
On which device? Generally, to install permanent root, you need to unlock the bootloader and flash a Magisk-patched boot image. But if your device is compatible with mtk-su, then the bootless root would be a pretty permanent alternative to unlocking.
[Miscellaneous Android Development] DoctorSelar:
Hi,

First off, thanks for this project and the detailed instructions; I've been trying to root my device for a long time now and this is the first glimmer of hope for me.

I'm trying to get the bootless root working on my CAT S41 (MT 6757 chipset). The actual exploit works: using mtk-su I can get a root terminal. I'm unable to get Magisk working, either through the original instructions quoted in the first page (the "Advanced users" method) or through the init.d method.

Using the first method, I used Magisk 19.x. I was able to complete all of the steps up to 16: as soon as I exited the mtk-su shell, I could no longer connect to the Magisk daemon; I get:

read (4 != 1) failed with 104: Connection reset by peer

However, if I use mtk-su again I can use the Magisk su binary and successfully get a su shell; I think this might be related to some additional SELinux stuff on this phone blocking regular users from communicating with the Magisk daemon. The one issue with this is that I can't kill the Magisk daemon using plain "killall", I have to send the KILL signal which makes me think that it might be hanging on this device.

Using the init.d method, I followed all of the instructions posted: Magisk 18.1, manager 7.1.1 (just in case). The "last execution result" is as you posted, but whenever I run "su" it just hangs. Unlike the other method, "su" (rather "magisk su") hangs whether run as a normal user (both ADB and through Termux) or when running in the mtk-su root shell. Running "ps", the only magisk-related things running as root are "magisklogd" and "/sbin/.magisk/mirror/system/bin/logcat". If I run "magisk --daemon" out of the "/sbin/.magisk/mirror/system/bin" folder, I get the same behavior as the other method: I can use "magisk su" as root but get the "read error" as a regular user.

I'm new to rooting and SELinux in general, so if you need any more information please let me know.
[Miscellaneous Android Development] diplomatic:
At first I was confused which method you're talking about because there's no step 16 on the OP or the bootless root page. The one you noticed on the first page was just my experimental/theoretical procedure from a long time ago. That was before I realized how to launch magisk properly. I managed to start magisk, but I don't even remember how much luck I had with it overall. Anyway it's absolutely useless now in light of the current init.d approach. So don't worry about it and use the bootless root guide.

I think you messed up Magisk's internal files by mixing different versions. It's best to just clean out the /data/adb directory and start over. Before launching magisk, just do this in mtk-su shell:

rm -r /data/adb/*

Then just follow the guide and don't deviate from it.

Don't worry, Selinux is like quantum mechanics: nobody understands it. If you think you understand Selinux, you don't understand Selinux. You need a PhD in selinuxology just to be able to manage it. :D

Thanks for the report on your CAT phone, BTW.
[Miscellaneous Android Development] Kurei1437:
First off, thank you so much Diplomatic for the detailed instructions.

So, I have 3 Amazon Fire 7 *9th Gen* devices that I was rooting. I rooted 2 out of the 3. The 3rd one wouldn't root for some reason. I keep getting this error suboot.sh "failed critical init step 4: Bad address" from last execution results. The only difference that I noticed is that this device where the root failed has a build # of 0002517056644, build date August 9, 2019.

The build date and # of the 2 devices that worked are May 27, 2019. 0002517050244

Any solutions would be great.