yashsingh1/xdaforums huggingface dataset:
[Miscellaneous Android Development] diplomatic:
Oh boy, you are asking a lot without so much as a thanks click. I don't believe you meet all the requirements listed on the OP. :rolleyes: (Mainly the first one.)

It's obviously not all devices. Just some Oppo ones. There may be a special version of mtk-su built for Oppo somewhere in this thread. Find it and see if that one works for you, assuming you meet the requirements...

OK, once I get some details such as the output of './mtk-su -v'. (I have nothing to do with that app, and I couldn't care less about it.)
[Miscellaneous Android Development] realali:
Thank you very much. I find it.

mtk-su_oppo_20190822a.zip

It's success. but it is too old.

Can you update it?
[Miscellaneous Android Development] umairmaher44:
failed critical init step 4

this paltform can not be supported
[Miscellaneous Android Development] modellim:
It's ok for ACER A1-734

Hi,

it worked very well for my Acer A1-734. I used the 64 bit version.

It was a long time I was trying to root the tablet to clean the internal memory from bloatware and move apps on the sd cards.

I had unlocked the bootloader, but no way to find a recovery rom for this device (and Mediatek devices also).

Now I have locked again the bootloader and following the guide in post #1001 I have installed Magisk.

There is only a small problem, the init.d script support app dosn't run the script at boot time, Magisk Manager don't find Magisk and there is not the last script result in the app. I have to run the script manually after a reboot.

I have also installed Link2SD, to remove system app and move apps to the SD.

Thanks a lot

Massimo
[Miscellaneous Android Development] bugmeont12:
Doesn't work on LG K220 (X Power). Changes the SELinux from Enforcing to Permissive but doesn't give root shell after 20 consecutive tries. Android version 6.0.1.

shell@mk6pn:/data/local/tmp $ ./mtk-su -v

armv7l machine

param1: 0x3000, param2: 0x18040, type: 7

Building symbol table

kallsyms_addresses pa 0x40bc86f0

kallsyms_num_syms 79457, addr_count 79457

kallsyms_names pa 0x40c16090, size 977789

kallsyms_markers pa 0x40d04c10

kallsyms_token_table pa 0x40d050f0

kallsyms_token_index pa 0x40d05480

Patching credentials

Parsing current_is_single_threaded

c0280cd4: MOVW R0, #0x19e0

c0280cd8: MOVT R0, #0xc0fc

init_task VA: 0xc0fc19e0

Could not pinpoint tasks list in init_task struct

Parsing avc_denied

c0a2bb54: MOVW R12, #0x4728

c0a2bb58: MOVT R12, #0xc12b

selinux_enforcing VA: 0xc12b4728

Setting selinux_enforcing

Switched selinux to permissive

starting /system/bin/sh

UID: 2000 cap: 0000000000 selinux: permissive

Kernel source is available on LG's site. I can't post a link due to the 10 post limit.
[Miscellaneous Android Development] diplomatic:
Thanks... But I would like to know the answer as well and you're the one with the phone...

-----------------------------------------------------------------------------------------------------------------------------------------------

So you're out of luck with that firmware. Only chance is to downgrade...

-----------------------------------------------------------------------------------------------------------------------------------------------

Glad to hear mtk-su worked on your device. BTW, if you can unlock the BL, you can install Magisk the intended way by patching the boot image with Magisk Manager. You can use temp root to pull the boot image from the flash first. But there's nothing wrong with preferring the bootless method too. To have init.d run at boot time, make sure to disable any background management or battery optimization setting for it...
[Miscellaneous Android Development] Wesley423:
Anyone here could use GLTools with this root method? I have tried but it seems Everytime I click to on the install option inside the gltools after it's reboot the phone the module isn't installed bringing me back to the same instalatio screen again.

Also is it safe to use any module? Or there are specific ones? Does it have any risk to bootloop the phone?

Thanks for the awesome work!
[Miscellaneous Android Development] Pureindica:
Bootless root works on Lenovo tab 8 tb 8304f1
[Miscellaneous Android Development] yuansmart:
can you pls help me?

device is oppo a5s

android 8
[Miscellaneous Android Development] yuansmart:
update.

i rename magiskinit64 to magiskinit

and this still no root

pls help
[Miscellaneous Android Development] diplomatic:
Hi [MENTION=5178219]yuansmart[/MENTION],

Can you reboot your phone and try again? If it doesn't work, let me know the result of running it the first time on a clean boot.
[Miscellaneous Android Development] diplomatic:
[MENTION=10681673]Shemarjustin[/MENTION], any progress on this?
[Miscellaneous Android Development] KitKat25115:
my phone is koobee y3 ,android 7.1 sdk25

cmd display "mtk-su failed critical init step 4"
[Miscellaneous Android Development] DB126:
Mediatek chipset? Some sites show Qualcomm. Regardless, message indicates the device is not vulnerable to mtk-su exploit.
[Miscellaneous Android Development] Wesley423:
Anyone pls? :/
[Miscellaneous Android Development] diplomatic:
Of more importance, what is the line printed after "failed critical init...", if any?

One thread I found mentioning gltools is here. It sounds like they tried but did not have much luck with it. This module very likely needs to be initialized early in the boot process to work, as do most others. If you can somehow figure out how to smoothly restart core Android services like system_server or the System UI after launching Magisk, then there may be a chance.
[Miscellaneous Android Development] KitKat25115:
mt6763
[Miscellaneous Android Development] Filarh:
Working on ACER B1-860A MT8163 7.0 3.18
[Miscellaneous Android Development] FR4NC027:
Works in LG K50 Mediatek Helio P22 MT6762V

Armv8-a 64 bits.. Only temporary root but not officialy root because in this model i cant in any form flash any kdz or install twrp and impossible unlock the bootloader.. But works basically fine
[Miscellaneous Android Development] TiTiB:
There have been several updates/changes since I first used this temp root, and I would like to benefit from the most current improvements. Without having to reflash stock and start over, what's the best method to 're-do' my temp root?
[Miscellaneous Android Development] alangr:
Hello diplomatic

I have an asus zenfone max plus x018d zb570tl

The 18.1 method with suboot works perfectly with android 9 pie

but the new method with the latest magisk is not working, the script fails when trying to create /root folder with "permission denied" error. The newest method however works if I downgrade my phone to android 7

Is anything I can do to have latest magisk in android 9?

Thank you!
[Miscellaneous Android Development] diplomatic:
Are you talking about the bootless Magisk root? If so, just update the files manually. There's no reason to reflash the FW at all.

That's weird. It's not supposed to be creating the /root folder in Android 9 (system-as-root) at all. What is your output of the 'mount' command? For now, you can temporarily change the line 'have_rootfs=$?' in magisk-boot.sh to this:

# Set up /root links to /sbin files
mount | grep -qF rootfs
have_rootfs=1

But let me know why there is "rootfs" in your phone's mount and I will fix the script...
[Miscellaneous Android Development] alangr:
It's not working, I attached screenshots both of 1 and $?
[Miscellaneous Android Development] diplomatic:
[MENTION=2111340]alangr[/MENTION], what is the output from the command 'mount' in temp root shell? That's what will answer the question...

EDIT: In the 2nd one, it does show errors, but it looks like Magisk has loaded and should be working at that point...
[Miscellaneous Android Development] alangr:
Ok sorry :)

Magisk manager shows that I don't have root access even with the 2nd one

Here is the mount command in a temp root shell:
[Miscellaneous Android Development] diplomatic:
The weird thing with that mount setup is that there 2 things mounted on / , rootfs and the system partition. This is confusing the script. The best solution might be to try to unmount rootfs. I don't think rootfs is actually doing anything useful. See if this works in root shell:

umount -a -t rootfs

Check the mount output again and if the rootfs line is not present, try loading Magisk again. (If it does work, then that line should be added to the script.)

If you can't unmount rootfs, here is a magisk-boot script that has a workaround for that situation. (Rename .txt to .sh.) Also, you should reboot your phone between each attempt at running magisk-boot.
[Miscellaneous Android Development] alangr:
Wow thank you!

The umount command is not working (rootfs line still present in mount output)

But the script you send is working! :)
[Miscellaneous Android Development] masood24:
Hello, thank you for going through the work and getting this done. I have been at it for a while, and I am running into a problem. I currently have Fire tablet HD 10 2019. It is running Fire OS 7.3.1.0. I followed your updated tutorial on page 101. I went through the instructions a few times and looked through the older tutorials as well. However I keep getting this;

It is not installing the magisk I believe, your feedback would be appreciated.

Thanks
[Miscellaneous Android Development] Filarh:
I'm very interested in this post and I was wondering if somehow it's possible to dump seccfg.img and somehow decompile it and unlocking our device
[Miscellaneous Android Development] diplomatic:
Well, that looks OK if you're running it a second time since reboot. What is the result of running it the first time after a reboot?
[Miscellaneous Android Development] masood24:
I honestly don't remember. The problem is that I am not seeing Magisk in the Magisk Manager. It says that it is not installed. Am I installing that manually or is it supposed to appear in the manager when I run the commands? Also, as you can see in the picture at the top in red, it says that root access was denied. Is there something else that I need to do in order to gain root access?

Thanks
[Miscellaneous Android Development] diplomatic:
[MENTION=7010448]masood24[/MENTION], well why not reboot and find out? It should work automatically if you followed the directions. Have you tried to restart MM? If you used magiskinit64, you may need to switch to magiskinit.
[Miscellaneous Android Development] masood24:
Alright, so I tried using Magiskinit, instead of Magiskinit24 from the arm folder. I ran the script and then restarted and it worked. Thank you for your help.
[Miscellaneous Android Development] Mahz4130:
Hi [MENTION=8132642]diplomatic[/MENTION],

I have anry s20 tablet with mtk 6797 processor running Android 9. I tried your method but unfortunately it did not work. I tried magiskinit from magisk 19.4, 20.2, 20.3, 20.4.

UID:10099
[Miscellaneous Android Development] nach0x:
Hi!

It doesn't work with an moto e6 plus with a MTK6762 (Helio P22), the adb shell returns "This platform cannot be supported". I have the latest firmware from February 2020.
[Miscellaneous Android Development] diplomatic:
Hi,

You need to show me the log from './mtk-su -v' by following the OP instructions and point me to the firmware if possible.
[Miscellaneous Android Development] Mahz4130:
X30:/data/local/tmp $ ./mtk-su -v

param1: 0x1000, param2: 0x8040, type: 12

Building symbol table

kallsyms_addresses pa 0x40db7000

kallsyms_num_syms 45340, addr_count 45340

kallsyms_names pa 0x40e0fa00, size 579393

kallsyms_markers pa 0x40e9d200

kallsyms_token_table pa 0x40e9d800

kallsyms_token_index pa 0x40e9dc00

Patching credentials

Parsing current_is_single_threaded

ffffffc000355d28+88: ADRP x23, 0xffffffc00140f000

init_task not found

Parsing avc_denied

ffffffc0002f30d8+10: ADRP x4, 0xffffffc001e97000

ffffffc0002f30d8+20: LDR [x4, 1444]

selinux_enforcing VA: 0xffffffc001e975a4

Setting selinux_enforcing

Selinux is already permissive

starting /system/bin/sh

UID: 2000 cap: 0000000000 selinux: permissive

I couldn't find any firmware for this device.
[Miscellaneous Android Development] Mahz4130:
Is the log above alright?
[Miscellaneous Android Development] mad_fitter:
Well, I can confirm that this works on the Acer Iconia one 10. (B3-A50FHD wth MTK MT-8167A on android 8.1) This, along with unlocking the bootloader, also allowed me to gain perm root with magisk. Thanks for the discovery! I'm going to do some tinkering with porting TWRP over to it and see where I can go from there. I'll post my results in a different thread later. Thanks again!
[Miscellaneous Android Development] diplomatic:
[MENTION=9980075]bugmeont12[/MENTION], [MENTION=5854553]Mahz4130[/MENTION], here is a test version for you. I adjusted some parameters that should solve those issues. Let me know how it works.
[Miscellaneous Android Development] Mahz4130:
Same. It doesn't work. Here are the logs for both 32 and 64.

X30:/data/local/tmp $ ./mtk-su -v

param1: 0x1000, param2: 0x8040, type: 12

Building symbol table

kallsyms_addresses pa 0x40db7000

kallsyms_num_syms 45340, addr_count 45340

kallsyms_names pa 0x40e0fa00, size 579393

kallsyms_markers pa 0x40e9d200

kallsyms_token_table pa 0x40e9d800

kallsyms_token_index pa 0x40e9dc00

Patching credentials

Parsing current_is_single_threaded

ffffffc000355d28+88: ADRP x23, 0xffffffc00140f000

ffffffc000355d28+90: ADD xd, x23, 1432

init_task VA: 0xffffffc00140f598

Could not pinpoint tasks list in init_task struct

Parsing avc_denied

ffffffc0002f30d8+10: ADRP x4, 0xffffffc001e97000

ffffffc0002f30d8+20: LDR [x4, 1444]

selinux_enforcing VA: 0xffffffc001e975a4

Setting selinux_enforcing

Selinux is already permissive

starting /system/bin/sh

UID: 2000 cap: 0000000000 selinux: permissive

X30:/data/local/tmp $ ./mtk-su -v

armv8l machine

param1: 0x1000, param2: 0x8040, type: 12

Building symbol table

kallsyms_addresses pa 0x40db7000

kallsyms_num_syms 45340, addr_count 45340

kallsyms_names pa 0x40e0fa00, size 579393

kallsyms_markers pa 0x40e9d200

kallsyms_token_table pa 0x40e9d800

kallsyms_token_index pa 0x40e9dc00

Patching credentials

Parsing current_is_single_threaded

ffffffc000355d28+88: ADRP x23, 0xffffffc00140f000

ffffffc000355d28+90: ADD xd, x23, 1432

init_task VA: 0xffffffc00140f598

Could not pinpoint tasks list in init_task struct

Parsing avc_denied

ffffffc0002f30d8+10: ADRP x4, 0xffffffc001e97000

ffffffc0002f30d8+20: LDR [x4, 1444]

selinux_enforcing VA: 0xffffffc001e975a4

Setting selinux_enforcing

Selinux is already permissive

starting /system/bin/sh

UID: 2000 cap: 0000000000 selinux: permissive
[Miscellaneous Android Development] Filarh:
How did you get unlocked your bootloader? I have an Iconia 8 MT8163
[Miscellaneous Android Development] Mahz4130:
Mtk has fixed the loophole then?
[Miscellaneous Android Development] diplomatic:
Heh... only if that company actually cares about updating its products. But no, there's something weird about that kernel that makes it harder to parse. I found the problem in a kernel for a similar device. It's going to take a significant change to fix it. Plus, I just started working on something else for the next release. Just sit tight. I'll have a new version for you soon...
[Miscellaneous Android Development] bigrammy:
Sony Xpreria M5 (MT6795)

For Info and to add to the list:

Sony Firmware version=30.2.A.0.100

ro.semc.product.name=Xperia M5

ro.product.model=E5603

ro.build.version.release=6.0

ro.build.version.security_patch=2016-06-01

ro.board.platform=mt6795

ro.product.name=hollyss

Brand New Factory Replacement unit Never used.

mtk-su worked like a charm :good:

All partitions backed up and what looks like a incremental OTA (update_package) pulled.

MTK-SU is the best tool ever :highfive:

PS: Does anyone know how to decrypt these update_package either or or off device??
[Miscellaneous Android Development] Filarh:
Is a Qcomm SoC delete this twice xd
[Miscellaneous Android Development] diesel10:
I have lenovo c2 power with mediatek mt6735 and I did all solution from 101 page. I think is ok, root checker shows that i have root, magisk is installed but in log init.d i have can't acquire root privilages but in uid: 0 cap all is ok, the same as in solution. This is normal?

I didn't know which file magiskinit64 or magiskinit I should use in solution for my phone? I have used magiskinit (for 32 bit) maybe i should use magiskinit64?
[Miscellaneous Android Development] luna_qi:
add a device ZTE BA611

hi~ i am a newbie in android development. And what gave me the interest to have a try is the ZTE Blade A611T phone's original OS is too garbage, and the hardware is ok. So I think it may have some value after flash a custom rom. Its chipset is MT6735P, and it can be rooted through your file. But now I have a problem: when I connected it to computer, and typed "adb reboot bootloader", it entered meta mode instead of fastboot. How can I flash a twrp and rom in this mode? Do you have any ideas? Thank you for disturbing.:o
[Miscellaneous Android Development] mad_fitter:
Just used the fastboot flashing unlock command.
[Miscellaneous Android Development] Filarh:
I see, that method don't work on my device
[Miscellaneous Android Development] diplomatic:
Yeah, all normal. magiskinit will work in all cases. You can use magiskinit64 if your OS supports the armv8 ABI. (I suspect that phone doesn't.) You can check with 'getprop ro.product.cpu.abi'. If it mentions arm64-v8a, then you should use magiskinit64. Or try to run magiskinit64 in a shell and see if it complains about 64 bits...
[Miscellaneous Android Development] lucky7999:
not working broo

Log: Failed critical init step 4

This platform cannot vc supported

Exit value 1
[Miscellaneous Android Development] DB126:
Broo? Device type? Hard to identify with all the info you provided. Read OP
[Miscellaneous Android Development] Filarh:
Is possible to install BusyBox without modifying system partition?

Can I kill my device if I try to install it using an app?

MT8163 Locked Bootloader
[Miscellaneous Android Development] diplomatic:
Yeah, you can install it with a Magisk module and it will be mounted dynamically. That's what systemless is all about. It will be hard for apps to physically change /system data if there is dm-verity.
[Miscellaneous Android Development] TiTiB:
Is anyone using the Riru Core module? Is it possible? My ignorance of this stuff is showing. ? My goal is to install Riru so I can then install EdXposed, then, hopefully a few modules.

I installed Riru Core via Magisk Manager, rebooted, and now when I run the script to root, my device freezes and requires a hard reboot (PWR&VOL+).

Also, how do I uninstall Riru to get back to just Magisk if I don't have root? I'll just reflash my stock and start from scratch if I have to.
[Miscellaneous Android Development] serjiozh:
mtk-su makes selinux permissive but does not get root

Dear mtk-su developer

My no-name Chinese device is based on Helio x20 Mt6797 running Android 9.

When running mtk-su on it, selinux becomes permissive but UID shows that there is no root.

Here is mtk-su -v output (square brackets replaced with round ones):

Standard output:

param1: 0x1000, param2: 0x8040, type: 12

Building symbol table

kallsyms_addresses pa 0x40db1600

kallsyms_num_syms 45334, addr_count 45334

kallsyms_names pa 0x40e0a000, size 579220

kallsyms_markers pa 0x40e97700

kallsyms_token_table pa 0x40e97d00

kallsyms_token_index pa 0x40e98100

Patching credentials

Parsing current_is_single_threaded

ffffffc000353da8+88: ADRP x23, 0xffffffc00140b000

Parsing avc_denied

ffffffc0002f2128+10: ADRP x4, 0xffffffc001e94000

ffffffc0002f2128+20: LDR (x4, 1444)

selinux_enforcing VA: 0xffffffc001e945a4

Setting selinux_enforcing

Selinux is already permissive

Standard error:

init_task not found

setns failed: No such file or directory

starting /data/data/com.termux/files/usr/bin/bash

UID: 10088 cap: 0000000000 selinux: permissive

I wonder if anything can be done in this case...
[Miscellaneous Android Development] diplomatic:
[MENTION=10746151]serjiozh[/MENTION], here is a build that should fix that.

Also, this shall be the latest test version for all users of Magisk bootless root on Android 8.

EDIT: File removed. Use the latest release.
[Miscellaneous Android Development] tiagojpavan:
I have a question. What about the latest Magisk binaries update, the 20.4. It's working with mtk-su?

Enviado de meu LM-X420 usando o Tapatalk
[Miscellaneous Android Development] diesel10:
I make this solution with the latest magisk 20.4 and mtk-su r20 or r21 and its working for me.

Solution on 101 page.
[Miscellaneous Android Development] Valittaja:
On my Lenovo 4G Business TAB with Android 6.0.1 it said creating a directory called "init.d" has invalid characters, so i created a directory called "initd" and edited your script according to it.

Works great, no problems at all.

Thank you a lot. :)

yes, it works.
[Miscellaneous Android Development] nach0x:
Downgraded to the oldest build I could found (December 2019) and the script still returns "This platform cannot be supported". May it be possible that this device has been patched from the factory? Or could it be that the script is not compatible with this device yet?
[Miscellaneous Android Development] diplomatic:
OK, good to know. Make sure that the period is the standard ascii period character and not some international character.

Is this the Lenovo Tab3 10?

Yes, it's been patched from inception, as were most MTK devices released since late last year.
[Miscellaneous Android Development] moore.bryan:
Sorry to bother, but I'm trying this on a Fire HD 8 (2017) running 5.3.7.0 and, as I understand post #4, it should work, but I'm still getting the "The platform cannot be supported" error.

I'd appreciate any ideas where to go next.

Thanks, all!
[Miscellaneous Android Development] lucky7999:
In try on LG K11+(LM-X410BCW) Arch 32bits MT6750, and fail to obtain root acess

??????

Log: Failed init step 4

This platform cannot be supported

log value 4
[Miscellaneous Android Development] diplomatic:
About the error "This platform cannot be supported", there is nothing more to add than what's already on the OP. That message is 100% correct in its meaning.
[Miscellaneous Android Development] tecknight:
[MENTION=8132642]diplomatic[/MENTION],

I recently got a new Dual Band Wifi router.

It's amazingly fast and cheap !!

I paid $30 for mine brand new.

It's made by Xiaomi and it's called the Mi Router 4A Gigabit Edition.

It has:

16MB of NAND

128MB of RAM

It runs a MediaTek MT7621 @ 880 MHz (Tri core)

and I haven't seen the processor hit 10% utilization ever with 12-15 5Ghz connected devices.

My question is:

Do you think this processor could be vulnerable to mtk-su or something similar ?

They are currently using a complicated exploit called OpenWRTInvasion to get full Openwrt onto the router, but it is complicated and a quicker, more reliable method would be better.

FYI: Openwrt info page on this router:

https://openwrt.org/inbox/toh/xiaomi/xiaomi_mi_router_4a_gigabit_edition​
[Miscellaneous Android Development] diplomatic:
Hi tecknight,

I admit that at first glance, I didn't think that question was serious. I know a bit about router inner-workings because custom router firmware is one of my other interests. Putting aside the fact that that chip/platform is MIPS and not remotely designed for Android, even if it was vulnerable, what exactly would you use mtk-su for? All shells on those types of routers are already at root level. The problem there is getting a shell in the first place. I guess that's where that exploit comes in. BTW, I gotta tell you that those 3rd party FWs tend to be kind of crap and I would be concerned about getting the same wireless signal/performance out of them as with the stock FW.