[Sony Xperia XZ2 Compact ROMs, Kernels, Recoveries,] Dom195:
[MENTION=4418980]j4nn[/MENTION], here you have it and thanks again for helping me:

D:\Downloads\XZ2 Compact Temp Root\2. Temp Root durchführen>adb devices
List of devices attached
BH900A5ZBZ device

D:\Downloads\XZ2 Compact Temp Root\2. Temp Root durchführen>adb shell
H8324:/ $ cd /data/local/tmp
H8324:/data/local/tmp $ pwd
/data/local/tmp
H8324:/data/local/tmp $ ls -lZ ./magiskpolicy
lrwxrwxrwx 1 shell shell u:object_r:shell_data_file:s0 22 2020-07-04 03:20 ./mag
iskpolicy -> magisk/magiskinit64
H8324:/data/local/tmp $ ls -lZ ./magisk/magiskinit64
ls: ./magisk/magiskinit64: No such file or directory
1|H8324:/data/local/tmp $ id
uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(ad
b),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),300
6(net_bw_stats),3009(readproc),3011(uhid) context=u:r:shell:s0
H8324:/data/local/tmp $ id -Z
context=u:r:shell:s0
H8324:/data/local/tmp $ groups
input log adb sdcard_rw sdcard_r net_bt_admin net_bt inet net_bw_stats readproc
uhid
H8324:/data/local/tmp $ cat ./magiskpolicy > /dev/null
cat: ./magiskpolicy: No such file or directory
1|H8324:/data/local/tmp $ cat ./magisk/magiskinit64 > /dev/null
cat: ./magisk/magiskinit64: No such file or directory
1|H8324:/data/local/tmp $ ./tama-mroot
[+] Detected H8324-52.1.A.0.618 target
[+] Mapped 200000
[+] selinux_enforcing before exploit: 0
[+] pipe file: 0xfffffffaee642700
[+] file epitem at fffffffaf47a1300
[+] Reallocating content of 'write8_inode' with controlled data.......[DONE]
[+] Overwriting 0xfffffffaee642720 with 0xfffffffaf47a1350...[DONE]
[+] Write done, should have arbitrary read now.
[+] file operations: ffffff8aa081ebf8
[+] kernel base: ffffff8a9f680000
[+] Reallocating content of 'write8_selinux' with controlled data....[DONE]
[+] Overwriting 0xffffff8aa1a8f000 with 0x0...[DONE]
[+] init_cred: ffffff8aa182fcd0
[+] memstart_addr: 0xffffffc5c0000000
[+] First level entry: 131aa9003 -> next table at fffffffb71aa9000
[+] Second level entry: 1446c7003 -> next table at fffffffb846c7000
[+] sysctl_table_root = ffffff8aa185c710
[+] Reallocating content of 'write8_sysctl' with controlled data........[DONE]
[+] Overwriting 0xfffffffbb16a2a68 with 0xfffffffb8b04c000...[DONE]
[+] Injected sysctl node!
[+] Node write8_inode, pid 31021, kaddr fffffffbb51c4a80
[+] Replaced sendmmsg dangling reference
[+] Replaced sendmmsg dangling reference
[+] Replaced sendmmsg dangling reference
[+] Node write8_selinux, pid 31442, kaddr fffffffaf9bf3b00
[+] Replaced sendmmsg dangling reference
[+] Replaced sendmmsg dangling reference
[+] Replaced sendmmsg dangling reference
[+] Node write8_sysctl, pid 31236, kaddr fffffffb64dbf900
[+] Replaced sendmmsg dangling reference
[+] Replaced sendmmsg dangling reference
[+] Replaced sendmmsg dangling reference
[+] Cleaned up sendmsg threads
[+] epitem.next = fffffffaee642720
[+] epitem.prev = fffffffaee6427d8
[+] Launching privileged shell
root_by_cve-2020-0041:/data/local/tmp # pwd
/data/local/tmp
root_by_cve-2020-0041:/data/local/tmp # ls -lZ ./magiskpolicy
lrwxrwxrwx 1 shell shell u:object_r:shell_data_file:s0 22 2020-07-04 03:20 ./mag
iskpolicy -> magisk/magiskinit64
root_by_cve-2020-0041:/data/local/tmp # ls -lZ ./magisk/magiskinit64
ls: ./magisk/magiskinit64: No such file or directory
1|root_by_cve-2020-0041:/data/local/tmp # id
uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdca
rd_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_sta
ts),3009(readproc),3011(uhid) context=u:r:kernel:s0
root_by_cve-2020-0041:/data/local/tmp # id -Z
context=u:r:kernel:s0
root_by_cve-2020-0041:/data/local/tmp # groups
input log adb sdcard_rw sdcard_r net_bt_admin net_bt inet net_bw_stats readproc
uhid
root_by_cve-2020-0041:/data/local/tmp # cat ./magiskpolicy > /dev/null
cat: ./magiskpolicy: No such file or directory
at ./magisk/magiskinit64 > /dev/null <
cat: ./magisk/magiskinit64: No such file or directory
1|root_by_cve-2020-0041:/data/local/tmp # ls
Magisk-v20.4.zip magisk-setup.sh magisk-v20.4.zip tama-mroot
magisk magisk-start.sh magiskpolicy tama-mroot.zip
root_by_cve-2020-0041:/data/local/tmp #