yashsingh1/xdaforums huggingface dataset:
[Miscellaneous Android Development] DB126:
See: https://xdaforums.com/hd8-hd10/orig...oftware-root-hd-8-hd-10-t3904595/post80102590

You *might* be able to roll back to an earlier FireOS build. However, if the bootloaders are incompatible the device will brick.
[Miscellaneous Android Development] TooMuchSloeGin:
Here's another oddity:D

After a clean reboot, if I start the Term app and go into /data/local/tmp/ to start ./mtk-su it gives me a nice "permission denied" message. OK, that makes sense as this directory and its files are owned by shell. So I go into an adb shell, start /data/local/tmp/mtk-su (this works of course) and then give the mtk-su files chmod 777. This sticks, so I reboot and guess what, I still get "permission denied" messages from inside the Term app. In fact, there's no way (that I could find) to start mtk-su via the Term app after a fresh reboot. (Copying those files into /data/user/0/jackpal.androidterm/app_HOME/ (Term's home directory) doesn't work either.)

Only after mtk-su has been run at least once, it'll start working from within the Term apk... but not before. Any ideas?
[Miscellaneous Android Development] diplomatic:
Oh, really? :D

You're just running up against selinux. It's doing its job as intended. The terminal app can only run programs from its own directory that have the app's ownership and selinux label. When you copy files into the home directory, you have to do it using the app, excluding any file attributes (i.e. cp /data/local/tmp/mtk-su $HOME/). You didn't say how you copied the executable. But check the security label of the file (ls -Z) first. It should be "...app_data_file..." or something. If it's failing because of that, not much odd about it.

BTW, about the reboot & properties issue, I found out it was because of selinux. Even though it's permissive, setting system props is still being enforced somehow. In the next release, I'll have an option where you can set a security context for the shell, like

mtk-su -Z u:r:shell:s0
[Miscellaneous Android Development] TooMuchSloeGin:
Indeed. I found out late yesterday evening that it would work when I cleared Term's data and recopied everything from within the app. Before I had done the copy from within an adb shell.

Interesting information about selinux, will have to have a closer look, always keeping this in mind:

:D:D

And thanks for taking the trouble to look into this and the reboot matter. Appreciated!
[Miscellaneous Android Development] akshaykarve:
Is it a permenant root?

Will it work for helios p60 chip?
[Miscellaneous Android Development] diplomatic:
[MENTION=9155241]akshaykarve[/MENTION], only you can tell us if it will work on your phone....
[Miscellaneous Android Development] turtleletortue:
I can't describe how thankful I am for this. Good job. I was able to use it to get temporary root on a Nook Tablet 7" (8.1.0 Go Edition) which has no other known method. This has been so useful as I was finally able to backup the partitions on the device for examination. Amazing work!
[Miscellaneous Android Development] TooMuchSloeGin:
So... after having started magisk via a modified suboot.sh and having done whatever I had to do (say a Titanium backup) I currently reboot back into a magisk-free, unrooted phone. Works. Perfect. Happiness all round.

But alas, people are not built to be simply happy ;) Perhaps this whole marvellous thing could be even more perfect (aka whiter than white...) if I could somehow undo the various steps done in the suboot.sh script, say with a su-unboot.sh script. I could probably kill the magisk daemon but I have no idea whether this would bring down fire and brimstone. I have even less of an idea what else might be needed to undo whatever suboot.sh does.

So. Is that a feasible idea or just a pipe dream?

In somewhat related news, I have found a nice command line app that will copy and compress whole partitions. See http://www.garloff.de/kurt/linux/ddrescue/ for details (this is NOT the GNU ddrescue). Downloads for Android binaries are further down the page. I've tested this and it does what it says on the tin.
[Miscellaneous Android Development] diplomatic:
[MENTION=5445966]TooMuchSloeGin[/MENTION], nice to hear your results from the bootless root. There is no straightforward way to undo everything done by the script. But you can simply stop the magisk daemon, like with 'killall magiskd' and that would shut down root access for all apps. You probably have to do that with selinux permissive. Shutting down everything started by magisk would involve unmounting a bunch of file systems and if anything's being used on them, you would have to kill the processes occupying them, etc. That would get very elaborate if you have any modules that make systemless mounts to /system.
[Miscellaneous Android Development] diplomatic:
Cool, I'm glad you found this really useful. (It's nice to get an appreciation note without a question about some problem attached, for a change.) There's also a full Magisk root method using this tool, if you haven't seen it...
[Miscellaneous Android Development] TooMuchSloeGin:
I was expecting that. But it was worth a try. At any rate, I do not need root often so it's NBD.

Here's another idea for those who want to run AFWall+ (or rather, its rules) but w/o full root. Even w/o root the app itself installs fine and actually works in the sense that one can enable/disable internet access rules for other apps in the GUI itself (I'm using an older 2.9.7 version so YMMV).

Obviously, enabling the firewall doesn't work w/o root. However, what a rooted AFWall+ does is actually just feeding a bunch of rules to the iptables binary; the firewalling work is then done in the kernel. So... once those rules have been fed into iptables, they can be read out and later re-applied... even without the AFWall+ app actually running. This can be done with mtk-su (for instance on start-up), magisk root is not needed.

The steps are basically as follows:

1. get temp root via magisk

2. define all your rules in AFWall+ and enable the firewall

3. go into an mtk-su-rooted terminal and save the rules via iptables-save >/sdcard/iprules

4. reboot

5. from an mtk-su-rooted terminal restore the rules via iptables-restore </sdcard/iprules

(I do have these executables on my phones, in /system/bin. Others may or may not have them. Also, this is for IP v4. v6 needs the v6 versions.)

In fact, once the rules are saved in /sdcard/iprules it is almost trivial to add further rules for new apps (or remove rules for existing apps) simply by editing this file and reloading it. This sort of thing is probably best left to command-line freaks though.

EDIT: To reboot from within an mtk-su-rooted shell, this does the trick:

svc power reboot :o
[Miscellaneous Android Development] kurdiak:
Thanks a lot

I made an account today just to thank you for this method (Magisk bootless root method) . you saved me. I used this method to root my new fire HD 2018 edition, it worked like a charm after a reboot.. I used this method on another mobile (Bluboo S8), that has some hardware defects like volume buttons not functioning (both) and can not be connected to any computer by USB, so I had no opportunity to connect through ADB and fastboot. it was loaded with ads, so I used this method for obtaining root by installing and transferring the files, and worked again like a charm. thanks a lot. you are really genius..

My device was (Bluboo S8) .:MT6750T
[Miscellaneous Android Development] diplomatic:
Very cool.... good research. For the firewall rules, I'm sure you can write some init.d script to have them applied automatically on each boot. Also, good find on the alternative reboot command....

Awesome! Thanks for sharing. Watch out for the FW updates on the HD 8, though. mtk-su doesn't work on the latest version...

Oh, and can you confirm your phone model is Bluboo S8, because the specs say that one has an MT6750...
[Miscellaneous Android Development] bigrammy:
Not sure if this would be of interest xda member [MENTION=3562083]wanam[/MENTION] made a nice on device app "Partitions Backup & Restore on playstore" that worked fine last time I used it thread here.

You will need to give it root permission for it to do it's thing.

Because it backs up while you are mounted things like system & data can take a good while and you may think the app is stuck but just give it time and you will eventually get the backup complete toast.

It's good for those without TWRP or for those not confident with cmdline stuff. :o
[Miscellaneous Android Development] kurdiak:
Awesome! Thanks for sharing. Watch out for the FW updates on the HD 8, though. mtk-su doesn't work on the latest version...

Oh, and can you confirm your phone model is Bluboo S8, because the specs say that one has an MT6750...[/QUOTE]

………………………….

Yes you were right, I corrected my mistake... it has MT6750T (Bluboo S8)
[Miscellaneous Android Development] crazyheart012:
I found this thread because we are on a development of a rom of ASUS Zenfone Max Plus (M1) X018DC/ZB570TL and we are looking for some help for this rom. We are trying to port the global firmware for the device that is a chinese version but it seems we need to root this firmware and we are no luck at all until now.. We have no luck of unlocking it's bootloader then.

Here is the main thread:

https://xdaforums.com/android/general/rom-asus-zenfone-max-plus-m1-google-apps-t3900039

That is an MT6750 firmware and we are waitinig for quite long looking for rooting of this device and trying to port an global firmware with updates.

I hope someone will help us to getting root of this device.

Thank you very much.
[Miscellaneous Android Development] kurdiak:
[MENTION=8364524]crazyheart012[/MENTION] I had a phone with same soc (bluboo S8), I used Magisk bootless method by [MENTION=8132642]diplomatic[/MENTION] and it rooted successfully. Just do the steps as mentioned, it does not need unlocking bootloader. I did every thing as mentioned, but reboot did not give me root, the other way which is /Run script now/ worked for me...I hope that you try this and if you need any help I will try my best...

this is the link https://xdaforums.com/showpost.php?p=79626434&postcount=135
[Miscellaneous Android Development] kurdiak:
Protruly D7 rooted

Today I rooted Protruly D7 mobile phone (MT6797) using the Magisk bootless method as described by [MENTION=8132642]diplomatic[/MENTION] . I tried previously various root methods including many (one click) root methods and patching boot image, all of these had failed. this was the only one (as I know) to root this mobile. I had problems connecting the phone in fastboot (unlike most other chinese phones), in which the procedure of patching boot image was straight forward (using magisk). Thanks again [MENTION=8132642]diplomatic[/MENTION]
[Miscellaneous Android Development] diplomatic:
OK, added to the list. Keep em coming, [MENTION=10110800]kurdiak[/MENTION]. ;)
[Miscellaneous Android Development] ShieldPower:
Top Thing

My new device is perfect rooted now!
[Miscellaneous Android Development] kurdiak:
which device?
[Miscellaneous Android Development] diplomatic:
Are you trying to flash the stock WW firmware over a locked down CN firmware? If so, I just posted a guide on how to do this on the ZenPad Z500M. If you follow the same basic procedure, but use the right WW recovery image for your phone, it could work. Please report your results with mtk-su.
[Miscellaneous Android Development] Rortiz2:
NVM device already in the list..
[Miscellaneous Android Development] kobul:
Bro... My phone now is rooted, but why i can't push or edit system file? is it because it's still a lock bootloader?
[Miscellaneous Android Development] Supermatt01:
Yes, if your bootloader is locked, you can't change system files.
[Miscellaneous Android Development] qureyoon:
OPPO Reno Z

Model: CPH1979

Android Version: 9

ColorOS Version: V6.0

Chipset:	Mediatek MT6779 Helio P90 (12 nm)​

Device do a soft reboot after executing ./mtk-su

And it exit from adb shell

./mtk-su -v
param1: 0x1000, param2: 0x8040, type: 14
Building symbol table
kallsyms_addresses pa 0x41167300
kallsyms_num_syms 60150, addr_count 60150
kallsyms_names pa 0x411dcc00, size 785762
kallsyms_markers pa 0x4129ca00
kallsyms_token_table pa 0x4129d200
kallsyms_token_index pa 0x4129d600
kimage_vaddr: 0xffffff93cb400000
memstart_addr: 0xfffffff800000000
Patching credentials
Parsing current_is_single_threaded
ffffff93cb7f54b0+44: ADRP x8, 0xffffff93cd016000
ffffff93cb7f54b0+48: ADD xd, x8, 448
init_task VA: 0xffffff93cd0161c0
manual cf
Potential list_head tasks at offset 0x520
comm swapper/0 at offset 0x800
Found own task_struct at node 1
cred VA: 0xffffffc94554f0c0
securebits were 0x2f

This phone is listed as supported chipsets

Any suggestion to make this work?

Thanks
[Miscellaneous Android Development] wodgey:
I realize this thread is with regards to mtk SOC's but does anybody know if there's a similar temp-root binary for snapdragon processors?
[Miscellaneous Android Development] diplomatic:
Well yeah, but indirectly. It's really because you have dm-verity enabled, which needs a patched boot image to disable.

Yes, the chipset is supported. But your phone, being an Oppo, is on the problematic list. That reboot you're getting is Oppo's fine exploit protection at work. I have a workaround for that, which I'm attaching here. But I won't be supporting it in the main releases.
[Miscellaneous Android Development] qureyoon:
Thank you very much for this. This version worked for me :good:
[Miscellaneous Android Development] crazyheart012:
sorry sir but may i know what is lockdown firmware means hehe.. ok i will check it out..
[Miscellaneous Android Development] tanimu2455:
BV9500 PLUS MT6771T android 9

not worked.

BV9500Plus:/data/local/tmp $ ./mtk-su -v

Failed critical init step 4

setns failed: Permission denied

starting /system/bin/sh

UID: 2000 cap: 0000000000 selinux: enforcing

BV9500Plus:/data/local/tmp $

Please tell me what to do.

thanks.
[Miscellaneous Android Development] diplomatic:
By locked down I just mean not unlockable and not rootable, etc. I'm just asking if you're trying to flash FW of a different region (WW), which would be how you plan to get root.

You can point me to your phone's firmware and/or kernel sources....
[Miscellaneous Android Development] bigrammy:
No Kernel sources from this manufacturer usually :(

I found firmware for the BV9600 which uses the same CPU (P70) Not sure of all the differences between the two devices but Blackview likely used the same MTK Source code for both devices but with different hardware config's obviously :o

BV9500 Plus Specs

BV9600 Specs

Official Firmware for BV9600 (P70 CPU) Android 9.0

Hope it's of some use. :fingers-crossed:
[Miscellaneous Android Development] crazyheart012:
I've search on chinese forums and translate a tutorial and I found a quite,maybe helpful tutorial for moddifying system files WITHOUT ROOT/ROOTED as per said on forums :cyclops: I attached a txt file tutorial. maybe something can be use in future.:)
[Miscellaneous Android Development] diplomatic:
Thanks, man. That particular firmware checks out. It should be supported. It may be that the latest one has been patched. Your linked one, which is from May, would have been too early for that. [MENTION=10121733]tanimu2455[/MENTION], how old is the FW that you have?
[Miscellaneous Android Development] tanimu2455:
Thanks for your cooperation.

FW is BV9500Plus_EEA_S62_V1.0_20190813V8.

As an aside, there are two types of BV9600 PRO.

1 BV9600 PRO helio P60 android8.1 model

2 BV9600 PRO helio P70 android 9 model

I have a BV9600 PRO helio P60 android8.1 model, and I succeeded in ROOT conversion here.

Thank you.
[Miscellaneous Android Development] bigrammy:
Like diplomatic said it seems you have a newer and probably patched Firmware :eek:

Are there any scatter.txt files for this device? If so you could do a SPFlashtool read back of the boot and system partitions. :fingers-crossed:
[Miscellaneous Android Development] crazyheart012:
maybe ur right. because the phone itself is a X018DC which is a Chinese(CTCC/CN) version of the device but the pre installed firmware shows an X018D version which is a Global(WW) version but it has no update at all and the firmware looks it's been modified/ported by the seller to look like a real X018D Global(WW) firmware. Maybe i will try the method you said wit mine and try to port CN to WW thru flashing the original stock firmware of the device :) I hope temp root will work soon..
[Miscellaneous Android Development] HeeyMaan:
It says Nokia 3.1 is supported but I keep getting this. Any help?

./mtk-su

Did not find seccomp offset

UID: 0 cap: 3fffffffff selinux: permissive

# ./mtk-su -v

param1: 0x1000, param2: 0x8040, type: 12

Building symbol table

kallsyms_addresses pa 0x40c9b000

kallsyms_num_syms 47635, addr_count 47635

kallsyms_names pa 0x40cf8200, size 613732

kallsyms_markers pa 0x40d8e000

kallsyms_token_table pa 0x40d8e600

kallsyms_token_index pa 0x40d8ea00

Patching credentials

Parsing current_is_single_threaded

Stack protection detected

ffffffc000354ef4+6c: ADRP x0, 0xffffffc0010bd000

ffffffc000354ef4+70: ADD xd, x0, 3712

init_task VA: 0xffffffc0010bde80

Potential list_head tasks at offset 0x398

comm swapper/0 at offset 0x668

Did not find seccomp offset

Found own task_struct at node 1

cred VA: 0xffffffc008ea1840

Parsing avc_denied

ffffffc0002eac60+44: ADRP x0, 0xffffffc0012c7000

ffffffc0002eac60+48: LDR [x0, 2852]

selinux_enforcing VA: 0xffffffc0012c7b24

Setting selinux_enforcing

Selinux is already permissive
[Miscellaneous Android Development] diplomatic:
nm
[Miscellaneous Android Development] diplomatic:
[MENTION=3383704]HeeyMaan[/MENTION], check post 413. It has a version that will fix that...
[Miscellaneous Android Development] kobul:
Bro...I can upload my boot.img or recovery.img can you make patched boot.img for me? It's save to flash boot.img via stock recovery?
[Miscellaneous Android Development] kenshinta:
[MENTION=8978978]Rortiz2[/MENTION]

May I know if you're also able to use Full bootless root with Magisk by [MENTION=8132642]diplomatic[/MENTION] ?

I have a Meizu M711H M6 with a MT6750 - was able to install everything all right (all logs show success as indicated in instructions)- HOWEVER I'm getting no prompts for superuser.

Anyone else with the same phone successful? I'm guessing Meizu's different frramework maybe in play here.
[Miscellaneous Android Development] Rortiz2:
Hey! What did you installed, bootless ROOT or SuperSU root?

If it's SuperSU put grant in superuser promt.
[Miscellaneous Android Development] Supermatt01:
I've had to force close apps and then clear the cache of the app then restart it to get it to request SU. Do not load SuperSU with Magisk for root. They aren't compatible.
[Miscellaneous Android Development] diplomatic:
It doesn't work that way. If it were that easy, everyone whose phone can run mtk-su would be able to install Magisk the intended way; and no need for bootless root. You can patch it yourself with Magisk Manager. But it would not have the vendor's cryptographic signature. This is what determines if the image is legitimate or not. A locked bootloader checks it every time before loading the kernel.

What does Magisk Manager say after running the suboot script?
[Miscellaneous Android Development] Supermatt01:
Fair warning to OPPO users. It seems the newest ROM updates block this root solution.
[Miscellaneous Android Development] kenshinta:
Before manually running the suboot script (note also the initd app doesn't autorun at boot here) Magisk doesn't have superuser, magiskhide options.

After running the script I get all the options - superuser etc - BUT no logs are recorded and no prompts at all (my main purpose is titanium backup and maybe afwall to work). Any root app prompt just time out with no logs for root nor magisk operations.

I switched between ver 7.0 and 7.1 of mm same behaviour.

btw reboot within magisk manager works - that needs root function right, or no?
[Miscellaneous Android Development] diplomatic:
Wow, for real? Have you or someone tested it? What was the error?

I see. So Magisk is loaded OK, but something on your OS is blocking MM from showing prompts. (Have you tried enabling special permissions like draw over other apps, etc, for MM? Not sure that's necessary, just a thought.) But anyway, you can set Magisk to grant by default. In MM Settings, change Automatic Response to grant. Then when all your root apps have gotten their permissions, you can set it back.

For the init.d app to run automatically, check if it's listed in battery optimizations or any autostart managers or something similar on your OS. Disable any of those things.
[Miscellaneous Android Development] kenshinta:
bootless root as posted, as I'd prefer to keep superuser systemless

regardless while testing out mtksu I did try mounting /system as RW which failed saying "resource is busy ..." so I guess supersu installation would fail too?

---------- Post added at 03:52 AM ---------- Previous post was at 03:47 AM ----------

Tried that already , but I guess since MM isnt detecting any superuser access prompts there is nothing to automatically grant anyway.
[Miscellaneous Android Development] diplomatic:
Well, you're gonna have to say what you've tried before to avoid retreading the same steps. I believe if you set it to grant, it takes MM out of the equation. The su daemon already knows to grant permission to any app. A couple more things you can try:

Leave selinux on permissive to rule out selinux enforcement. Edit the script to comment out the last 'setenforce 1' line.

Clear out the /data/adb directory, which is Magisk's private directory. That should be done in mtk-su shell before starting Magisk:

rm -r /data/adb/*

Also, the logs are saved on /cache. Most of the time a new log is started, which is blank when you open it in the app.
[Miscellaneous Android Development] Supermatt01:
I'm not sure what the final error was. The member who was having trouble with it stopped communicating with me. I wanted to know without updating my own system.
[Miscellaneous Android Development] kenshinta:
The last execution results always indicate its already permissive. Do i still need to modify the script ?

Done. After a few reboots (magisk was complaining about something with /sbin) all installed again properly but still no superuser prompts nor logs in MM for both superuser and magisk. Speaking of which ..

Checking that shows 1 log file and a .bak log both of which always are 0 size files with updated modification date concurrent with each run of the suboot script.

I've also check that the /sbin abd /data/adb magisk directories are present, and also tried a few modules (busybox works, sysconfig patcher band some custom modules don't) so I'm pretty confident magisk is installed correctly - its just the superuser prompts - be it automatic grants or user grants - just dont happen still.
[Miscellaneous Android Development] diplomatic:
Well yeah, it's permissive for the scope of the script that sets up Magisk. Then it's switched to enforcing by the 'setenforce 1' command. If you remove that line, it stays permissive after the script is done. But you might be able to get the same result too just by running mtk-su after starting Magisk. That would set it to permissive.

I think the /sbin directory is set up correctly with su and stuff. Otherwise it wouldn't work with MM. But just to make sure, post the output of 'ls -lZ /sbin'. Also, make sure that magiskd is running by checking 'ps' output. Other than that, I can't imagine what could be going on.
[Miscellaneous Android Development] kenshinta:
Well how about that? Mere moments after I posted the above I went to remove the non woking modules I mentioned from MM then rebooted - after running suboot on the next boot I'm now getting proper superuser prompts and grants.

I really did nothing more than removing the non working modules, so I can't say what made this happen now. Finally can do titanium backups.

Time willing I'll do the process from a clean reset of the phone since I can do backups now.

So consider my issue solved with no explanation hehe.