[Sony Xperia XZ2 Compact ROMs, Kernels, Recoveries,] Dom195:
[MENTION=4418980]j4nn[/MENTION], it still doesn´t work. With my little knowledge I would assume the unzipping of the magisk-v20.4.zip doesn´t work properly because command "./magisk-start.sh -2" says "magisk zip is not unpacked!". But if so I don´t know why:

D:\Downloads\XZ2 Compact Temp Root\2. Temp Root durchführen>adb devices
List of devices attached
BH900A5ZBZ device

D:\Downloads\XZ2 Compact Temp Root\2. Temp Root durchführen>adb shell
H8324:/ $ cd /data/local/tmp
H8324:/data/local/tmp $ ./tama-mroot
[+] Detected H8324-52.1.A.0.618 target
[+] Mapped 200000
[+] selinux_enforcing before exploit: 1
[+] pipe file: 0xfffffffb2b7cd400
[+] file epitem at fffffffb1dccbc80
[+] Reallocating content of 'write8_inode' with controlled data.......[DONE]
[+] Overwriting 0xfffffffb2b7cd420 with 0xfffffffb1dccbcd0...[DONE]
[+] Write done, should have arbitrary read now.
[+] file operations: ffffff8aa081ebf8
[+] kernel base: ffffff8a9f680000
[+] Reallocating content of 'write8_selinux' with controlled data..[DONE]
[+] Overwriting 0xffffff8aa1a8f000 with 0x0...[DONE]
[+] init_cred: ffffff8aa182fcd0
[+] memstart_addr: 0xffffffc5c0000000
[+] First level entry: ce7bd003 -> next table at fffffffb0e7bd000
[+] Second level entry: e63b2003 -> next table at fffffffb263b2000
[+] sysctl_table_root = ffffff8aa185c710
[+] Reallocating content of 'write8_sysctl' with controlled data......[DONE]
[+] Overwriting 0xfffffffbb16a2a68 with 0xfffffffb3ac42000...[DONE]
[+] Injected sysctl node!
[+] Node write8_inode, pid 16300, kaddr fffffffb844b2180
[+] Replaced sendmmsg dangling reference
[+] Replaced sendmmsg dangling reference
[+] Replaced sendmmsg dangling reference
[+] Node write8_selinux, pid 16370, kaddr fffffffb43b1b900
[+] Replaced sendmmsg dangling reference
[+] Replaced sendmmsg dangling reference
[+] Replaced sendmmsg dangling reference
[+] Node write8_sysctl, pid 16209, kaddr fffffffb538d4900
[+] Replaced sendmmsg dangling reference
[+] Replaced sendmmsg dangling reference
[+] Replaced sendmmsg dangling reference
[+] Cleaned up sendmsg threads
[+] epitem.next = fffffffb2b7cd420
[+] epitem.prev = fffffffb2b7cd4d8
[+] Launching privileged shell
root_by_cve-2020-0041:/data/local/tmp # pwd
/data/local/tmp
root_by_cve-2020-0041:/data/local/tmp # ls -lZ ./magiskpolicy
lrwxrwxrwx 1 shell shell u:object_r:shell_data_file:s0 22 2020-07-04 03:20 ./mag
iskpolicy -> magisk/magiskinit64
root_by_cve-2020-0041:/data/local/tmp # ls -lZ ./magisk/magiskinit64
ls: ./magisk/magiskinit64: No such file or directory
1|root_by_cve-2020-0041:/data/local/tmp # id
uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdca
rd_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_sta
ts),3009(readproc),3011(uhid) context=u:r:kernel:s0
root_by_cve-2020-0041:/data/local/tmp # id -Z
context=u:r:kernel:s0
root_by_cve-2020-0041:/data/local/tmp # groups
input log adb sdcard_rw sdcard_r net_bt_admin net_bt inet net_bw_stats readproc
uhid
root_by_cve-2020-0041:/data/local/tmp # cat ./magiskpolicy > /dev/null
cat: ./magiskpolicy: No such file or directory
at ./magisk/magiskinit64 > /dev/null <
cat: ./magisk/magiskinit64: No such file or directory
1|root_by_cve-2020-0041:/data/local/tmp # ./magisk-start.sh -1
+ FRESH=false
+ '[' -1 '=' --fresh ']'
+ '[' ! -e /data/adb/magisk/busybox ']'
+ FRESH=true
+ ./magiskpolicy --live --magisk 'allow dumpstate * * *'
./magisk-start.sh[33]: ./magiskpolicy: inaccessible or not found
127|root_by_cve-2020-0041:/data/local/tmp # ./magisk-start.sh -2
+ FRESH=false
+ '[' -2 '=' --fresh ']'
+ '[' ! -e /data/adb/magisk/busybox ']'
+ FRESH=true
+ STAGE=2
+ '[' 2 '=' 2 ']'
+ mount -t tmpfs -o 'mode=755' none /sbin
+ chcon u:object_r:rootfs:s0 /sbin
+ chmod 755 /sbin
+ cp -a magisk/boot_patch.sh /sbin
cp: bad 'magisk/boot_patch.sh': No such file or directory
+ echo 'magisk zip is not unpacked!'
magisk zip is not unpacked!
+ umount /sbin
+ exit 1
1|root_by_cve-2020-0041:/data/local/tmp #