yashsingh1/xdaforums huggingface dataset:
[Android Q&A, Help & Troubleshooting] arifincaesar:
[MENTION=4418980]j4nn[/MENTION] heres the output

bindershell - temp root shell for xperia XZ1c/XZ1/XZp using CVE-2019-2215

https://github.com/j4nn/renoshell/tree/CVE-2019-2215

MAIN: starting exploit for devices with waitqueue at 0x98

PARENT: Reading leaked data

PARENT: leaking successful

MAIN: thread_info should be in stack

MAIN: parsing kernel stack to find thread_info

PARENT: Reading leaked data

PARENT: Reading extra leaked data

PARENT: leaking successful

MAIN: task_struct_ptr = ffffffcfe0d68000

MAIN: thread_info_ptr = ffffffd04aa3c000

MAIN: Clobbering addr_limit

MAIN: should have stable kernel R/W now

kernel slide invalid (0x4ffabc7b50)

kaslr slide 0x0

selinux set to permissive

current task credentials patched

got root, start shell...

Cell:/data/local/tmp # id

uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc) context=u:r:shell:s0

Cell:/data/local/tmp # cd

Cell:/ # ls

ls: ./cache: Permission denied

ls: ./init: Permission denied

ls: ./init.environ.rc: Permission denied

ls: ./init.rc: Permission denied

ls: ./init.recovery.qcom.rc: Permission denied

ls: ./init.usb.configfs.rc: Permission denied

ls: ./init.usb.rc: Permission denied

ls: ./init.zygote32.rc: Permission denied

ls: ./init.zygote64_32.rc: Permission denied

ls: ./postinstall: Permission denied

ls: ./ueventd.rc: Permission denied

ls: ./verity_key: Permission denied

acct bt_firmware bugreports charger config d data default.prop dev dsp etc firmware lost+found mnt oem persist proc res root sbin sdcard storage sys system vendor

1|Cell:/ #
[Android Q&A, Help & Troubleshooting] j4nn:
[MENTION=7940776]arifincaesar[/MENTION], well, as expected, detecting KASLR slide failed, therefore selinux could not be disabled and security context has not been patched either.

Without a kernel binary, it is difficult to implement a full temp root exploit.

I guess it could be doable, unfortunately I do not have the time for it.
[Android Q&A, Help & Troubleshooting] arifincaesar:
hehe thanks for information sir.. :)
[Android Q&A, Help & Troubleshooting] j4nn:
[MENTION=7940776]arifincaesar[/MENTION], see PM please...
[Android Q&A, Help & Troubleshooting] arifincaesar:
ok sir, thank you very much for helping me.. T_T

pm sent
[Android Q&A, Help & Troubleshooting] j4nn:
cve-2019-2215 based temp root exploit for ratel cell r1020

Here is a temp root exploit tailored specifically for RATEL CELL r1020 phone as described in the OP (Android 8.0 with security patch level of January 5, 2018). The exploit uses CVE-2019-2215, which can get you a temporal root shell very quickly and reliably (it's nearly instant).

Unfortunately RATEL CELL r1020 firmware is not publicly available, so it had not been possible to get a kernel image for analysis.

Luckily the first stage of the exploit designed for sony xperia xz1/xz1/xz1c worked, providing kernel space R/W primitives.

Eventually kernel memory dump has been retrieved (after KASLR bypass done in a generic way), so implementation of the final stage to bypass selinux and patch credentials to get root could be done.

Please find the result of my work attached here, it obviously is not tested as I do not have that phone, but I assume it would work as using similarly calculated stuff worked with my xz1c phone.

Please see the xperia phones exploit here for usage howto, including possibility to setup magisk from the exploit (modified script without sony specific stuff is already included). Just download the Magisk-v19.3-Manager-v7.1.2.zip from the linked post and use together with stuff from ratel-cell-temp-root.zip attached here.

EDIT: Updated ratel cell temp root with v2, supposed to work also with ratel cell having May 1, 2018 security patch level.

Please post the log (in [ CODE ] tags) and/or screenshots from your testing, possibly including even magisk setup, if bindershell exploit worked.

If you like my work, you can donate to me via paypal (including card payment) or bitcoin - for details just follow the "Donate to Me" button please. Thank you.
[Android Q&A, Help & Troubleshooting] TNSMANI:
MOD ACTION:

Thread reopened per OP's request
[Android Q&A, Help & Troubleshooting] arifincaesar:
yes, it work sir thank you so much here is the log

but i think there other problem i will posting it later here

Cell:/data/local/tmp $ ./bindershellnew

bindershell - temp root shell using CVE-2019-2215, tailored for RATEL CELL R1020
https://github.com/j4nn/renoshell/tree/CVE-2019-2215

MAIN: starting exploit for devices with waitqueue at 0x98
PARENT: Reading leaked data
PARENT: leaking successful
MAIN: thread_info should be in stack
MAIN: parsing kernel stack to find thread_info
PARENT: Reading leaked data
PARENT: Reading extra leaked data
PARENT: leaking successful
MAIN: task_struct_ptr = ffffffd4316e9b00
MAIN: thread_info_ptr = ffffffd471268000
MAIN: Clobbering addr_limit
MAIN: should have stable kernel R/W now
attempting kaslr bypass: leaked ptr 0xffffff8a82608658
kernel base=0xffffff8a81480000 slide=0xa79400000
selinux set to permissive
current task credentials patched

got root, start shell...

Cell:/data/local/tmp # getenforce
Permissive
Cell:/data/local/tmp # id
uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc) context=u:r:toolbox:s0
Cell:/data/local/tmp # uname -a
Linux localhost 4.4.78-perf+ #1 SMP PREEMPT Tue Mar 6 11:00:11 CST 2018 aarch64
Cell:/data/local/tmp #
[Android Q&A, Help & Troubleshooting] yusuv:
Hi there sir [MENTION=4418980]j4nn[/MENTION] .

I'm yusuv, ratel cell user. I've been following this thread.

And lately seems the exploit works as intended.

The things is, ratel cell not only have the January patch on all the devices. I've tried the exploit and its stuck on the build number prop and it won't go any further.

Afaik, ratel have 2 ROM builds, one patch is January which is you build the exploit for, the other one is May 1, 2018 patch. With also different build number.

On behalf Ratel Cell user with the may patch. I'm here to ask you, is there any way for us with the May patch being able to root our device?

Thanks in advance.
[Android Q&A, Help & Troubleshooting] Ndangd:
Dear sir [MENTION=4418980]j4nn[/MENTION].

can you help us on how to install custom recovery in Ratel Cell, if you are willing to help, we will be very grateful.
[Android Q&A, Help & Troubleshooting] j4nn:
[MENTION=8675439]Ndangd[/MENTION], it is not possible to install custom recovery with just a temp root. You need to unlock bootloader first.

[MENTION=4567803]yusuv[/MENTION], I am sorry, I do not have the time to do that.

The already implemented root for ratel cell posted above cost me many long evenings.

In any case, if you like my work, you can donate to me via paypal (including card payment) or bitcoin - for details just follow the "Donate to Me" button please. Thank you.
[Android Q&A, Help & Troubleshooting] yusuv:
Uh, thankyou for the answer sir.

We'll see what we can do, maybe organize a fundraiser.

Hehe. Anyway, thanks again for working for our device.
[Android Q&A, Help & Troubleshooting] j4nn:
You got it wrong, I have not been asking for funds in advance.

I just reminded anybody using my already posted temp root for ratel cell, that it would be welcome to donate as a form of thanks.

You need to know that implementing a temp root solution is a difficult task, counted in full days at minimal for the easiest exploits.

Those difficult, implemented from scratch, like my renoroot, are counted in many months - see the development progress here...

You know for sure, that a personal free time is a limited resource, so I can hardly help all the people asking me...
[Android Q&A, Help & Troubleshooting] yusuv:
I know sir that you're not askind for funds in advance. I'm only implying that if we have enough funds, maybe that'll worth your time to spend more and investigate more on our beloved ratel cell. And as a token of favor.
[Android Q&A, Help & Troubleshooting] j4nn:
[MENTION=4567803]yusuv[/MENTION], there are things that are interesting for me to do just out of pure challenge or for personal use.

But there are also tasks that are nearly impossible to do, so any amount of money would not make any difference.

So again, if you like to donate, do it for the work done already.

I do not like the bounty threads here on xda, there are lot of promises not kept unfortunately.
[Android Q&A, Help & Troubleshooting] herudi:
[MENTION=4418980]j4nn[/MENTION]

Hello sir

can you help you root the ratel cell patch in May, maybe after we succeed we will give a little donation to you, not at least we appreciate your work
[Android Q&A, Help & Troubleshooting] arifincaesar:
hello sir.. i'm sorry i can't donate you to much..

but, one day if i have some money.. i will donate you more..

thanks for your help..

i hope we can be friend and not angry to me :)
[Android Q&A, Help & Troubleshooting] j4nn:
[MENTION=7940776]arifincaesar[/MENTION], thank you for your donation.

[MENTION=4567803]yusuv[/MENTION] and others, I am not promising anything - it's really about the time.

But as I've already implemented a kernel dumping method for arifincaesar, you can try it (attached here).

Post the log in [ CODE ] tags here and share the kernel.bin and current_task.bin files that the exploit hopefully creates.

Please note, the log and the files must be from the same single run.
[Android Q&A, Help & Troubleshooting] yusuv:
Got it sir. I wish you good luck then on your current project and the next project after. I'll wait for the time to come for us on the may patch to enjoy root on our device.

I'll donate thru my friend arifincaesar here since i don't have btc/pp.

Thank you so much for your effort on this device.

Have a good day.
[Android Q&A, Help & Troubleshooting] yusuv:
MAIN: starting exploit for devices with waitqueue at 0x98
PARENT: Reading leaked data
PARENT: leaking successful
MAIN: thread_info should be in stack
MAIN: parsing kernel stack to find thread_info
PARENT: Reading leaked data
PARENT: Reading extra leaked data
PARENT: leaking successful
MAIN: task_struct_ptr = ffffffc05b68d000
MAIN: thread_info_ptr = ffffffc027954000
MAIN: Clobbering addr_limit
MAIN: should have stable kernel R/W now
attempting kaslr bypass: leaked ptr 0xffffff82a8408658
kernel base=0xffffff82a7280000 slide=0x29f200000
dumping stuff for 'CELL_1.07.01.02'

thats the result and below rar is the bins.
[Android Q&A, Help & Troubleshooting] j4nn:
[MENTION=4567803]yusuv[/MENTION], [MENTION=10597331]herudi[/MENTION], [MENTION=7940776]arifincaesar[/MENTION], I just added ratel-cell-temp-root-v2.zip into post#15 that is supposed to work also with May 2018 security patch level. Enjoy the temp root for your ratel cell r1020 phone:)
[Android Q&A, Help & Troubleshooting] yusuv:
Update sir, it's working for the May patch.

Updating magisk and magisk manager resulting in a perm root. It requires data wipe as it somekind of decrypt and encrypt again the data partition. Idk im not sure.

And uh, one thing, there is warning just like a unlocked bootloader phone in the boot process. With some kind of ID code in it.

Maybe this is a way to unlock the bootloader?

Anyway, it's enough for me to just have a permanent root.

Thank you sir, thank you so much.
[Android Q&A, Help & Troubleshooting] j4nn:
That is quite interesting - it seems magisk manager patched kernel boot image to permanently integrate new magisk version.

You should consider yourselves very lucky, because that could result with a bricked phone - bootloader should normally refuse to boot a kernel that does not match oem signature check.

That there is just displayed a warning screen on boot and bootloader still loads rooted kernel is quite surprising, particularly with snapdragon 835.

It would be interesting to backup unmodified kernel boot image from a still not-modified phone and restore it on perm-rooted phone to see if the warning screen disappears (i.e. to restore the phone to a still locked state).

Anybody wants to test that?
[MENTION=4567803]yusuv[/MENTION], [MENTION=10597331]herudi[/MENTION], [MENTION=7940776]arifincaesar[/MENTION]
[Android Q&A, Help & Troubleshooting] herudi:
[MENTION=4418980]j4nn[/MENTION]

if after installing Magisk successfully, is it possible to unlock the bootloader ??
[Android Q&A, Help & Troubleshooting] j4nn:
[MENTION=10597331]herudi[/MENTION], in my opinion, bootloader state either did not change or has been unlocked automatically when detected modified kernel boot image. That is what would be interesting to test.

If you (or somebody else) still do not have that warning screen on power/boot up, you could use the temp root to backup stock kernel boot image via copying it from it's partition.

Then try to install magisk for permanent root, reboot, see the warning screen, switch to root, restore the kernel boot image from the backup and reboot, checking if the warning screen disappeared.

I would assume that kernel boot image could be retrieved by following commands (in a root shell):

dd if=/dev/block/bootdevice/by-name/boot of=/data/local/tmp/boot.img

Be sure to retrieve the /data/local/tmp/boot.img via 'adb pull /data/local/tmp/boot.img' to avoid losing it if there was a factory reset.

To restore the kernel boot image from backup, probably following command would be used (you may need to 'adb push' it there first):

dd if=/data/local/tmp/boot.img of=/dev/block/bootdevice/by-name/boot
[Android Q&A, Help & Troubleshooting] herudi:
[MENTION=4418980]j4nn[/MENTION]

My cellphone is permanently rooted, but it feels incomplete if it doesn't unlock the bootloader and also install twrp if there is spare time can you help me to install twrp and unlock bootloader friend ??
[Android Q&A, Help & Troubleshooting] j4nn:
[MENTION=10597331]herudi[/MENTION], find two persons, that did not permanently rooted yet, one with January security patch and one with May.

We need to backup the original stock kernel boot image from the internal storage boot partition, in order to test, whether the bootloader has been unlocked by magisk installation or not.

Concerning twrp, that is a very difficult task and you would need kernel sources for that.
[Android Q&A, Help & Troubleshooting] arifincaesar:
ratel cell use A/B partition system sir..

so i think is that the same boot.img beetween a_boot and b_boot?

if they are same i can send you the b_boot.img because a_boot.img has been pacthed with magisk
[Android Q&A, Help & Troubleshooting] arifincaesar:
[MENTION=4418980]j4nn[/MENTION] this video of the rom ratel cell sir..

the system a or b has a same size 4.5gb

but boot a different size from boot b maybe because the boot a has benn patched?
[Android Q&A, Help & Troubleshooting] arifincaesar:
[MENTION=4418980]j4nn[/MENTION] there is the boot a and b

https://mega.nz/#!Fg41SaDa!CP_JoyNsOkfiByNUfBa7YyiI3Aw8nOUM-tt2Mk39pJM
[Android Q&A, Help & Troubleshooting] arifincaesar:
for your information my device had permanent rooted..

i don't know if boot_b still locked state or unlock state..

because for backup the rom it need rooted state sir..

i hope the boot_b is the same version like boot_a but not patched..
[Android Q&A, Help & Troubleshooting] j4nn:
[MENTION=7940776]arifincaesar[/MENTION], you are right, it's A/B device, boot_a has been patched with magisk for permanent root, while boot_b seems to be the original kernel boot image.

Please try to restore boot_b.img into boot_a partition:

cd /data/local/tmp
tar zxvf boot_b_backup_2020-03-07_07-20-17.tar.gz
dd if=boot_b.img of=/dev/block/bootdevice/by-name/boot_a
sync

and reboot to see if the warning screen on boot disappears.

I have compared extracted boot_a vs boot_b and they are really the same except the magisk integration.

So it should boot just fine when you restore boot_b.img into boot_a partition.

Can you recall if you made some changes in system or vendor using magisk root?

System-less-magisk modules should be ok, but for example removing apps from system or vendor would not be ok with regard to having unmodified stock fw and therefore boot displaying some warnings during boot up.

Please make a backup of all partitions.

It would be useful if somebody could make a backup of all parittions before reboot with magisk installed permanently and then after reboot with magisk installed permanently so we could then compare if the unlocked state had been recorded somewhere.

Could you please share following partitions?

abl_a
apdp
cdt
cmnlib64_a
cmnlib_a
ddr
devcfg_a
devcfg_b
devinfo
dip
dpo
frp
fsc
hyp_a
keymaster_a
keystore
limits
logdump
logfs
mdtp_a
mdtp_b
mdtpsecapp_a
mdtpsecapp_b
misc
msadp
nvs
persist
pmic_a
rpm_a
sec
splash
ssd
sti
storsec
toolsfv
tz_a
xbl_a
[Android Q&A, Help & Troubleshooting] arifincaesar:
i want try but it will lost my rooted state right?

if i want to root my device again i must be run bindershell again and that is not permanent sir..

if i wanna permanent i must patched the boot again and that must wipe my phone again :crying:

but if mean important i will do it..

i don't understand sir

yes.. i had full backup all the rom but i don't know how to flash it into the device because bootloader still locked state and fastboot command doesn't work at all in this state sir

and if my phone not in rooted stated, how can i backup the rom sir?

it must be rooted right so i can backup the rom

i think the system file not changed at all because this exploit just the boot because patched in magisk

yes i will do it later and share the files here sir
[Android Q&A, Help & Troubleshooting] j4nn:
[MENTION=7940776]arifincaesar[/MENTION], it is important - we need to know if the bootloader is already unlocked or not.

If restoring stock boot would remove the warning screen, it would suggest bootloader is still locked but allows to boot modified/unsigned images.

But it would be strange, that it would cause userdata erase in such case. This rather suggests that bootloader unlocked itself already and most likely it would not revert to locked state anymore.

So it can happen that with restore of stock boot image the warning would still be there. Following install of magisk from bindershell including permanent patch done from magisk manager would not cause userdata erase, because bootloader status would not change, being already unlocked from before.
[Android Q&A, Help & Troubleshooting] arifincaesar:
ok then i will do it later sir because now i can't open my laptop..

and do i must upload the firmware sir? because the system file had large size and will take some time to upload..

update information my friend in group try to change or flash the system and now his phone bootloop.. can we found the solution for him to flash again the firmware into his phone? and it still warning screen when booting
[Android Q&A, Help & Troubleshooting] j4nn:
[MENTION=7940776]arifincaesar[/MENTION], please note, I did not include system, vendor or userdata (this one contains internal storage content and all installed apps and settings) partition in the list above - so no need to upload those big partititions.

The listed partitions should not be that big particularly when compressed into an archive.

Concerning bootloop - you should never make permanent changes unless you have bootloader unlocked with working fastboot to flash partitions or at least boot custom kernel from usb.

If the system does not come up and you have no other way to do something, I have no idea what to do.

Maybe try to switch to system B using some fastboot command.
[Android Q&A, Help & Troubleshooting] arifincaesar:
[MENTION=4418980]j4nn[/MENTION]

cd /data/local/tmp
tar zxvf boot_b_backup_2020-03-07_07-20-17.tar.gz
dd if=boot_b.img of=/dev/block/bootdevice/by-name/boot_a
sync

for this command in cmd should be superuser or can executed without su permission sir?
[Android Q&A, Help & Troubleshooting] j4nn:
surely root user needed
[Android Q&A, Help & Troubleshooting] arifincaesar:
ok sir i'll do that

it mean his phone cannot back to normal again?

how about if flashing with some tools like QFIL or maybe experiment the backup ROM and flashing with ODIN like samsung device?

i mean do u have information how to flash msm9889 sir?

i think it can't switch to system B because all of fastboot command related to system will failed
[Android Q&A, Help & Troubleshooting] arifincaesar:
[MENTION=4418980]j4nn[/MENTION]

heres file from my friend in group sir, boot image backed from temp root and may patch security..

https://mega.nz/#!1pY2nQAB!aKLPAftA-N2_sDstZOyIcXtsa-jeBMsB00CBB_U7PNw
[Android Q&A, Help & Troubleshooting] arifincaesar:
and this is the partition sir.. :)

https://mega.nz/#!4gpXXSjA!3x9zeyjv3UhZSHFFp8sZ1PnwGXymWTSbTW66JPTo4pM
[Android Q&A, Help & Troubleshooting] arifincaesar:
and for this, yes it work sir :)

the phone back to normal state (unrooted) and no warn screen when booting..

so i had too try checking from fastboot and it show still boot from slot=a..

and then my device has been reset again because decryption problem, but i'm fine, it's ok, i can download my app again later :)

i will show the video to you later sir..
[Android Q&A, Help & Troubleshooting] j4nn:
So my guess is that the phone is still locked but allows to boot unsigned kernel boot image, just showing a warning screen.

Quite surprising, but very lucky for you otherwise you had a brick already, instead you get permanent magisk root with still locked bootloader.

Do you have any special features, like integrated widevine L1 key for example?

You may check with drminfo if you have L1 with stock boot (the original kernel boot image) and if it was L1, check what happens when you boot magisk modified kernel boot image - if it changes to L3 for example.

Your phone is msm8998 (snapdragon 835) if I am not mistaken. It is not samsung, so you can forget about odin.

Can you use 'fastboot boot' command? It's probably disabled due to locked bootloader, but it may be worth to check that:

fastboot boot boot_a.img

Also probably would not work, but just to be sure, something like this to switch to system B if system A is bootlooping:

fastboot set_active b
fastboot --set-active=b
fastboot --set-active=b reboot

I do not have an experience with QFIL, but I guess that tool needs the phone booted to EDL mode (emergency download mode).

That might be entered automatically based on a critical boot error or you would need to trigger it by a test point (shorting an oem specific test point on motherboard of the phone to ground, most likely with battery disconnected and having it shorted, connect it via usb to pc).

Unfortunately EDL mode needs OEM-signed programmer image file (more details for example here), that would be loaded into the phone's RAM from PC via usb to enable emergency flashing. Without that programmer image file, EDL mode is useless.

You might be able to test EDL mode (possibly with QFIL) if the kernel allows reboot to it, like this:

adb reboot edl

If you can find a working programmer image, recovering this way might be possible, if the firehose programmer would allow flashing without any other authentication.

If you can make this work, the person with bootlooping phone would then need to disassemble the phone and find the test point and the way to trigger EDL mode with it. I cannot help you any further here...

But it would very interesting, if you could find a working firehose/edl programmer, particularly if it allowed 'peek' and 'poke' commands as outlined here.