yashsingh1/xdaforums huggingface dataset:
[Sony Cross-Device General] ezdi:
Were you ever successful getting Magisk working? I can run it from ADB fine, but it doesn't work from termux, the jackpal terminal, or shell in 3c with different results from each.

At first it seemed to be just path related, but ignoring launching from termux (which is 64-bit so there's some other issues) it still seems like only the terminal program that launched it can see the updated sbin with the su in it. I disabled magisk hide, but it didn't change things. Magisk manager doesn't even think magisk is installed, but if I run su from the same program, I get a prompt and then a root shell. I'm not familiar enough with the internals of magisk and possibly ric to make much more progress.
[Sony Cross-Device General] Tifs:
Well, it took some time to dig into this issue but now I have an answer.

You were right, the new bind-mounted /sbin is not visible in other processes when mount command is executed from within termux or any other terminal app (except ADB shell). This is due to different mount namespaces [1] created for different applications. ADB shell has the root mount namespace, that's why Magisk setup works fine when launched from ADB shell. There are two great answers on SO [2], [3] that elucidate the mount namespaces in android.

As a solution, I tried first to execute mount commands as mount --make-shared ... but that didn't work. Then I tried to use nsenter [4] to switch mount namespace, but this module is not built by default into magisk BusyBox for some reason. So I found another BusyBox distribution that have the nsenter module: meefik/busybox [5]. I didn't install the apk, instead I unpacked busybox-1.31.1-46.apk/assets/arm64/bin/busybox and pushed it with ADB to /data/local/tmp and made executable with chmod +x /data/local/tmp/busybox. After that I succeed setting Magisk from terminal app without help of ADB:

cd /data/local/tmp
./bindershell
./busybox nsenter -t 1 -m /system/bin/sh
cd /data/local/tmp
./magisk-setup.sh

I think it would be more handy to integrate setns() call into bindershell to automatically escape application's mount namespace after root was successfully obtained. What do you think, [MENTION=4418980]j4nn[/MENTION]?

Sorry, the links are posted separately because I don't yet have a right to inegrate them as links.

[1] https://man7.org/linux/man-pages/man7/mount_namespaces.7.html

[2] https://android.stackexchange.com/questions/217741/how-to-bind-mount-a-folder-inside-sdcard-with-correct-permissions/217936#217936

[3] https://android.stackexchange.com/questions/197959/why-partition-gets-unmounted-automatically-after-some-time/200449#200449

[4] https://man7.org/linux/man-pages/man1/nsenter.1.html

[5] https://github.com/meefik/busybox
[Sony Cross-Device General] ezdi:
I was thinking it's a long shot to ask for help from someone with one post and you came back with great info. Thanks!

Works for me. Here's a single line version that's easier for me to paste or automate:

/data/local/tmp/bindershell -c "/data/local/tmp/busybox nsenter -t 1 -m -w/data/local/tmp ./magisk-setup.sh"

Perhaps Magisk didn't include it because it can invalidate what the user chose for "mount namespace mode". Not that it makes sense to secure yourself against something with root privileges, but having to compile your own or write native code is a hurdle for some.

You need the @ to tag them and then it shows you a list of users to pick as you type. Fixed it for you, but I doubt it'll work from a quote box.

It might be more than just the 2 lines of code. It's not clear to me why nsenter is putting us back in the root directory. In both the sys-utils and busybox versions it looks like they're trying to maintain pwd by default, but it doesn't seem to be working. Perhaps changing the mount space invalidates the file handles? Looks like Magisk sets up the whole environment regardless, after either giving it's namespace in global mode, or reassigning the program's original.
[Sony Cross-Device General] Lost149ers:
Not for 701SO
[Sony Cross-Device General] Dematen:
After exploit, when I try Security test with *#*#7378423#*#* I get "None" and "Configuration" hang and crash.

Update:

Now configuration work but i see Routing status: unknow.

Camera not working with green screen.

I not have unlocked bootloader.

I have used newflasher_v36 to flash firmware after deleted persist.sin and *.ta.

Root work fine.

TA backuped but I now know if it is fine.

How recove camera?

If I update the exploit remain?
[Sony Cross-Device General] Dematen:
I did a system update and everything is back to normal.

This exploit doesn't seem like it was done for mine phone.

Anyway I took the opportunity to do a TA backup.
[Sony Cross-Device General] Dematen:
How I can to delete bindershell from /data/local/tmp ?

>G8441:/ $ cd /data/local/tmp

>G8441:/data/local/tmp $ chmod 755 ./bindershell
[Sony Cross-Device General] MonsterDroid101:
Hey j4ann,

It's been a long time since I've done anything like this, and I have spent days looking for an answer. Following outdated guides, broken links etc. I'm hoping you woudln't mind pointing me in the right direction, or putting an end to my torturous journey!

Can I achieve a permanent Sim Unlock with this method?

I've created a thread in Xperia XZ1 Questions & Answers, I think it would be best if I just posted the link.

https://xdaforums.com/t/network-unlock-with-root-bl-ul-allowed-no.4199435/
[Sony Cross-Device General] jayloofah:
Were you able to use this method on a locked SO-02K?
[Sony Cross-Device General] hupengwei:
You say that firmware SO-02K_47.1.F.1.105 is suitable for your work ,so do you know where I could download it ?
[Sony Cross-Device General] hupengwei:
Thanks to your great work!

The firmware SO-02K_47.1.F.1.105 is suitable for your work,would you kindly tell me the link to download it?

To get a permanent root ,I need to unlock my bootloader, which needs to turn on the OEM unlock option in the developer 's view of settings.apk, while it's grey now.

With your work ,I can get a temp root ,install magisk , reset values pre-set in defaults.prop, make it possible to turn on the option , maybe there's a chance to unlock the bootloader.
[Sony Cross-Device General] clfdhq:
hi, i have problem . Can you help me, thanks
[Sony Cross-Device General] j4nn:
SO-02K_47.1.F.1.105 (Docomo Japan) is listed as supported - just flash that fw and test it.

Did you check the links in the OP? The second one particularly.

You need to downgrade to a listed fw version.
[Sony Cross-Device General] thibouille:
Hi all,

Would this allow me to make Whatsapp put its media files on SD Card ?

I don't wanna change anything else as this is my girl's phone.

I really don't need anything else than Whatsapp files out of phone memory.

Thank you !
[Sony Cross-Device General] clfdhq:
You need to downgrade to a listed fw version.

[/QUOTE]

Thank for you help.

If downgrade and root by this tool, after upgrade to new version, => Is root keep ?, thanks
[Sony Cross-Device General] ilbefun:
dose this work on X Compact?
[Sony Cross-Device General] Charlestai1225:
Hi sir does android 9 can use this temproot or i need to modified it thx
[Sony Cross-Device General] saiallexander:
no support for Xperia XZ1 (701SO) - SoftBank JP?

the last oreo firmware for this device is 47.1.D.11.103-R22B
[Sony Cross-Device General] j4nn:
@saiallexander, please check the first post - I have added a new version with support for Xperia XZ1 701SO (Softbank Japan) - 701SO_47.1.D.11.32.
[Sony Cross-Device General] lebigmac:
Hi @j4nn nice work!

Is there any chance to get this temp root to work on an Xperia XA2 (H3113) running Android 8.0.0 ? Thank you.
[Sony Cross-Device General] jayloofah:
Were you able to unlock the BL @hupengwei ?
[Sony Cross-Device General] jayloofah:
Also, @j4nn do you plan on releasing a tutorial on how you were able to load Lineage on a BL locked device?
[Sony Cross-Device General] j4nn:
@jayloofah, unfortunately the method I am using is very dangerous, with real risk of bricking the phone, particularly those that cannot be unlocked with sony site unlock code. Also you cannot flash any custom rom as is. You need to port kernel patches and other code changes in order to make some custom rom compatible and then with a risk try to use it with a phone with still locked bootloader. To do this, I have a second phone for development with unlocked bootloader, which also is a bit risky, but not that much, so I test it with that.

The procedure to make a custom rom running in this way is so complicated, that I did it only once for single release of LOS 16.1.

This makes this method practically useless for most of the guys here, possibly only few developers may be able to safely use it.

And I am not maintaining all possible roms to make them runnable this way.

There could be a way - if somebody implements kexec working from temproot, then we could run unmodified custom roms.

As temproot is available, it provides good and safe playground for kexec feature injection into stock kernel runtime, so I welcome anybody to implement it.
[Sony Cross-Device General] Uniquehimesh:
unable to execute bindershell.sh , it says permission denied. i m using

G8342_47.1.A.16.20 firmware
[Sony Cross-Device General] nlra:
Hey @j4nn,

"Long time listener, first time caller." I appreciate your clear talents, and thank you for all that you have done for the Xperia community by applying those talents!

I also appreciate your reasons for keeping this exploit close to your chest...it's very responsible of you. Even so, these old phone platforms aren't getting any younger or more valuable as time passes -- all of the SD835-based Yoshino devices are either nearing (XZ1*) or have passed (XZP) the 4+ year mark now -- and since both Sony is very unlikely to release any further Yoshino updates at this point to close this loop, and also since subsequent Xperia platforms based on newer Qualcomm SoC have proven to be resistant to the exploit (at least without dire consequences, thus providing a ready deterrent to most random Joes who might want to try it, assuming they even have the requisite skill to attempt it, which as you pointed out would require a carefully-prepped and tested-in-advance custom kernel build from source at the very least!)

So with these devices nearing the end of their usable lifespan, it begs the question at what point would it no longer be considered irresponsible to at least document & disclose to the public exactly how the exploit works, especially since (arguably) the utility of these phone models as "out of date" products (by most -- perhaps wrong -- standards) would only increase in value as a result *if* this exploit were to escape the confines of your lab. Nobody is asking for you to implement, maintain, and support a dozen different easy-to-install versions of it for various ROMs...at least I'm not! 🙂 But I do think it would be a pity if the knowledge never got written down & disseminated, and instead just withered on the vine...

That said, if what you're primarily concerned about at this point is protecting it because you think Qualcomm SoC with TrustZone might be vulnerable to it up even to the present day, and so letting it leak out would allow Qualcomm to close it on current and future products, then that is a bit more understandable...
[Sony Cross-Device General] diba pranasta:
701SO works fine, use firmware 11.32 and bindershell v2x
[Sony Cross-Device General] gopal404:
is it work for XZ1 47.1.A.12.205?
[Sony Cross-Device General] skypiece:
Thanks for all good advices above!

My job's banking applications not like permanent root (stupid securities). And I must to use unsecured Android 8 (Oreo) with many limitations and breaches (instead of secured modern OS with permanent root) because we have temp root solution.

I have updated and automated all necessary things. Bindershell v2x, official binaries Magisk v23.0 works better than v19.3 (root not lost after clearing Manager app from RAM). SafetyNet working too.

0. You need to be familiar with ADB on Windows; Connect a phone;

1. Unpack attached archive to some folder

2. Run Magisk-v23.0-push.cmd (or port simple commands to unix like) and enjoy this magic

After rebooting of your phone, at any time when root is needed, just run /sdcard/magisk-activate.sh with SManager and root will back without ADB using.

p.s. tested on XZ1 Dual G8342 47.1.A.16.20 with locked bootloader
[Sony Cross-Device General] Sumomaus:
Thanks for your work j4ann!

First of all, excuse my bad english, please.

I read a lot in the xda. Especially the sony-forums.

I've got a problem with one of my g8441. The first g8441 I exploited with renoshell. Everthing is fine. The second g8441 I tried the new method with bindershell. Everthing worked until the push back the TA to the phone.

I flashed the fw G8441_47.1.A.8.49 by newsflasher, then I did a temp root shell by bindershell. Saved the TA. Unlocked the phone, did a root shell, pushed back the TA. No error messages.

Then I rebooted, but phone didn't start.

Hardreset didn't work. The notification light flashes green during that.

If I connect it to the PC, it´s going to flashmode. So I can flash the fw G8441_47.1.A.8.49 by newsflasher again. But after that, reboot isn't possible.

What did I wrong?
[Sony Cross-Device General] j4nn:
@Sumomaus, I am sorry, I have no idea what might went wrong there, except that ta partition got corrupted for some reason?

But if it boots to flash mode, you may try to run newflasher in empty directory to get the phone information logged - there you may see if everything is returned valid or not.

Can it forcefully boot into fastboot mode? And then twrp boot from usb?
[Sony Cross-Device General] Pocoio:
Hi, I proceeded flawlessly, gaining root access with magisk, confirmed with a few apps, but after removing from USB cable, a few minutes later no root exists anymore. What am I'm missing? (running docomo version with your specific build number)
[Sony Cross-Device General] rizky_ykg:
thangks to you, put magisk on oem and no more temproot on pc again

#tested on XZ1 Softbank

*here I added Magisk on sdcard
[Sony Cross-Device General] j4nn:
thanks, I did not test it but it looks interesting
[Sony Cross-Device General] rizky_ykg:
sure
[Sony Cross-Device General] rizky_ykg:
*here magisk v25.1

-can't enable zygisk, idk how to do this on temproot

-can't hide magisk apps, like v24.xx down

-but the modules normal
[Sony Cross-Device General] asseforlife:
EDIT: it works, but after reboot, when the script start, it say "no daemon is running"
[Sony Cross-Device General] roomraditz:
how to fix it?
[Sony Cross-Device General] rizky_ykg:
deleted /data/adb/magisk.db then restart the phone, re-temp root again
[Sony Cross-Device General] eparr:
Thank you for this j4nn! Bindershell allowed me to do this XZ1 Compact - MetroPCS VoLTE + Latest Pie + Fingerprint + Wi-Fi Calling Step by Step Guide and write a guide for others to follow. The improvement in call quality and data speeds on the MetroPCS network is stunning.

Donation sent.
[Sony Cross-Device General] j4nn:
@eparr thank you for the donation!

I guess it was not necessary particularly when considering your guide post...

I see that as very useful possibly for many others - thank you!
[Sony Cross-Device General] bulieme0:
@j4nn Is this works on latest firmware?
[Sony Cross-Device General] Nik¹:
@j4nn hi,

I have sony xperia xz1 docomo SO-01K. I want to temproot but failed because the bindershell targeted version is SO-01K_47.1.F.1.105 but mine is SO-01K_47.1.B.0.542. Can anyone help me to temproot? Please help me🙏😔
[Sony Cross-Device General] j4nn:
Anybody, can you please share me TA partition of your SO-02K (or the fake G8441 which is in fact SO-02K)?

I am on the verge of enabling LTE band 20 on my SO-02K, but I need to compare several TA partitions of that model in order to identify ta units that are device specific vs that are identical within the SO-02K model range.
[Sony Cross-Device General] nitrams:
I only have sov36 if that could help. I also hope you can help to enable volte to my xz1. The network that I'm using was just recently become operational in 2021 so i think the modem configuration (.mbn) is not present in any ROM either stock au or global. I did some research and found out that other people was able to use volte using the same network but on different phone and there are some that needs root. I have tried your temp root but knowing it's limitation im not sure if i can make it work with it. I have xperia 5 au with working volte using the same network and im thinking if its possible to port the modem config to xz1 tho I'm still in between whether it will work or not since they have different chipset. The fact that xz1 au has bl unlock no, there is no much thing to try for me. Although I've seen some post that even japan units can turn to bl unlock yes through s1 unlock tool but also need to pay for the one time use account. I've also seen some post about qpst tool to enable volte and probably update the modem config files but i think the phone needs to be rooted. My guts tells me that it is possible, i just dont know how. Or maybe I'm just wrong at all and these research of mine just gave me falls hopes lol 😂. Anyway, i would really appreciate if you look into this and im willing to participate on testings if ever. Btw, the network im using is DITO telecom, whos parent company is china telecom. We very much appreciate your work and contributions. Sending thanks from. Philippines 😊
[Sony Cross-Device General] braveheartleo:
You could try this, read particularly sections APN and VoLTE / 4G calling

https://xdaforums.com/t/howto-custo...he-japanese-xperia-xz1-with-temproot.4313977/
[Sony Cross-Device General] nitrams:
Appreciate it man, thank! . I have a question on thread.
[Sony Cross-Device General] j4nn:
@nitrams SOV36 is not ideal, but TA from it might also provide some hints.

About volte on your xz1, I am not sure - it depends on stock fw setup - for example those docomo devices are very difficult as they have modem configured as single variant with no option for customizations.

I am not sure how it is with AU one? Some hints from volte working xperia 5 au might help, but it will not be simple as flashing oem content from it to sov36.

That s1 unlock paid tool will most likely work for sov36 too.

Unfortunately there is no way to do it without the payment - we analyzed the s1 unlock tool.

They are running a server with access to sony signature service to re-sign modified hwconfig TA unit where they switch the flag to allow normal bootloader unlock.

It may be possible to do the changes without bl unlock just with using the temp root, but it may not be enough - that is not possible to guess.

For qpst you do not need root. You can use it without root with oreo firmware. There are also other tools to access the modem via diag - easily readable backup can be saved via dfsqt tool.
[Sony Cross-Device General] nitrams:
@j4nn just tell me what you need and I will try to provide what I can on my sov36. Perhaps you can also drop by on braveheartleo's post here. It is such a big help for those who want to do some/limited modifications on their handsets. I have also found out that your temp root also works on my xz1 au even it was flashed to global rom and that volte provisioned can also be allowed, tho im still unable to make it work. At least i am getting something new and discovering other things because of that. I have a feeling that one day i can make it work through your help guys. The hardware/chipset supports it or at least thats what i know. When it comes to the software or firmware, i assume there is a way. Like what @braveheartleo shared on his posts.
[Sony Cross-Device General] Dematen:
edit
[Sony Cross-Device General] NEIL3104:
Hello j4nn. I would like to know if this exploit works on older firmware? like 47.1.D.2.83? or that it only works on certain firmware? I have a SoftBank XZ1 and I downgraded it. I wonder is there any possibility to unlock bootloader by modifying firmware or efs…… I don't want to pay for unlocking a phone.
[Sony Cross-Device General] j4nn:
@NEIL3104 the supported versions are listed in the thread. It would not work with a different version unless somebody adds support for it into the tool (and it is a question if such version is vulnerable to the exploit in general).
[Sony Cross-Device General] nitrams:
hi @j4nn do you have temp root support for service exchange unit build number 45.0.a.1.229. There are no updates for this Market/Operator and is running android 7 only. Or do you have a way on how to convert it to global? tried flashing via newflasher and I just get bootloop.
[Sony Cross-Device General] nitrams:
@j4nn this variant is up to android 7 only so it would be a big help if there will be a temp root available at least. Or if there would be a way to flash it to other global region firmware so it could be update at least to android 9. Tho, this has also unlock bl yes so it would be just a waste if the mods couldn't be applied.
[Sony Cross-Device General] nitrams:
This is all good. I was able to find fw 45.0.a.7.90 fw and flashed successfully. From there I just did OTA updates.
[Sony Cross-Device General] ALUCARD4DEAD:
I'm not in luck my friends.

Even with this root method my bank app detect root even when the root is not activated, I update magisk with the tools of the partner above but not help n nothing, so I lost fate on root and now I will update to 9, because I have a Docomo xz1c not even bootloader unlock possible :(
[Android Q&A, Help & Troubleshooting] xda411:
I have a samsung galaxy A8 A530W this morning i was using it perfectly fine and after i went back to it after 10 min it had some weird thing saying 100% with a blue screen then when ever i try to turn it on it says kernel rev check fail device 8 binary 7 at the top left and the samsung galxy a8 logo i the middle it stays like this for a couple seconds then turns off i can boot into download mode it says in the top left

odin mode

download speed fast

productname sm-a530w

current binary samsung official

frp lock on

oem lock on

secure download enabled

ccic=S2MU004

carrier id xac

warranty void 0

Ap swrev b:9 k:8 s:8

DID 0475f

696daf4

i had stock everything i had encrypted storage and sd card i really need to recover the data on it what do i do?
[Miscellaneous Android Development] shumway66:
ok guys heres my atempt at a rom need some testers it CrDroid andriod 10 ported for our device used AP_A205GUBU4ASK2_CL16481871_QB26958069_REV00_user_low_ship_meta_OS9 so need to be on bootloader 4 has magisk in it already no gapps if i can get some testers ill do one for u2

https://drive.google.com/open?id=1hewocUrZNjMWqiSas58WfP4VmmBdyriy
[Miscellaneous Android Development] Gollo99:
the link is down
[Miscellaneous Android Development] hooooossamq:
Great work
[Miscellaneous Android Development] hooooossamq:
Link not working