yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] Pachacouti:
Anyway, here is the process so far:

Grab the boot-debug.img below, if it works for you good.

From stock, unlocked bootloader, set adb keys:

fastboot flash boot boot-debug.img

fastboot reboot <- just to see what we got

adb root

adb disable-verity <- the proper way to disable verity. No blank vbmetas required.

adb reboot

adb wait-for-device

adb root

adb remount <- wont work, because boot-debug.img is not a user-debug version of boot-debug.img, so I need to use a magisk'd boot to gain 'other' access.. later...

Note: adb shell avbctl disable-verification is only available in user-debug builds, so instead of boot-debug.img, prob look like user-debug.img. Notice how I disable it below.

fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img 2>nul >nul <- Notice how I flash genuine vbmeta, including the end part '2>nul >nul' to flash twrp to recovery. This clears the way to flash super without flashing blank vbmetas... this will reset when flashing stock boot, so no problem to a dev...

fastboot flash recovery MyTwrp.img (rebooted after just to make sure the recovery stayed after typing '2>nul >nul' after the vbmeta) -it stayed.

fastboot flash super super_fixed.img <- Same test as above, now reboot into twrp to test rw capabilities. Mine all working.

fastboot reboot-recovery <- Go immediately to mount, tick system and vendor, if tick stays, voila, mine stays ticked...

Do twrp test using adb:

adb shell

# mount -o rw,remount rootfs /

Find way to install su lol, this is where I'm at now.

Dont say install the killer of su...
[Android Software/Hacking General [Developers Only]] optimumpro:
So, your bootloader is unlocked and your bootimage-debug gives root to you and the entire world. In other words, here is the key to my house, and by the way, there is no lock. And by another way, there will be nothing left in the house soon. Nice.
[Android Software/Hacking General [Developers Only]] Pachacouti:
Oi... EVERY rooted fone has an unlocked bootloader, your point being?

Oh... I'm taking away profit from some... never noticed until you came along.. {Mod edit}

And you trust magisk... {Mod edit}

That would not tell you of THIS exploit:

{Mod edit: Disrespectful behaviour removed - Regards Oswald Boelcke}
[Android Software/Hacking General [Developers Only]] Pachacouti:
Edit:

(Do all this offline... )

Flash magisk'd boot, but in gui, dont update internet, in fact, dont run it.

Install busybox-1.31.1-46.apk (do all this offline) but u cant install it yet, because magisk has no internet, but busybox will give you an option to install to, or edit the install.sh to say install dir / instead of /system, it did install what it could to the required directory, and if magisk'd bootloader grants su to busybox...

(it did in mine...) Reboot back into bootloader

Then reflash boot-debug.img, flash stock recovery, and reboot again, wot no magisk?

Now see:

D:\0\AdbStation>adb root

restarting adbd as root

D:\0\AdbStation>adb remount

/system/bin/remount exited with status 2

remount failed

D:\0\AdbStation>adb shell

Armor_X5_Q:/ # su

Armor_X5_Q:/ #

D:\0\AdbStation>adb root

restarting adbd as root

D:\0\AdbStation>adb remount

/system/bin/remount exited with status 2

remount failed

D:\0\AdbStation>adb shell

Armor_X5_Q:/ # su

Armor_X5_Q:/ # ^C

130|Armor_X5_Q:/ #

130|Armor_X5_Q:/ #

Notice it said nothing of user build or production build, and oh, you need to cntrl/c to exit this... then type exit... but notice who is logged in before :/

Su working in my fone, now to try with boot.img ;)

Rememer: All stock ;)
[Android Software/Hacking General [Developers Only]] optimumpro:
"Oi... EVERY rooted fone has an unlocked bootloader, your point being?"

LOL. My roms (and not mine only) work on locked bootloaders with Magisk prebuilt.

Magisk: I know exactly what Magisk is doing. Also with AVB-2 fully enforced and Magisk applied during build and before the final signing, it can do nothing to any protected partition after rom installation. Any change would alter the hushes and result in a red screen warning: 'your device is corrupt and cannot boot'.

{Mod: Quotation edited}
[Android Software/Hacking General [Developers Only]] Pachacouti:
{Mod edited}

D:\0\AdbStation>adb root

restarting adbd as root

D:\0\AdbStation>adb remount

/system/bin/remount exited with status 2

remount failed

D:\0\AdbStation>adb shell

Armor_X5_Q:/ # su

Armor_X5_Q:/ # ^C

130|Armor_X5_Q:/ #

130|Armor_X5_Q:/ # exit

130|Armor_X5_Q:/ #

130|Armor_X5_Q:/ #

130|Armor_X5_Q:/ # ^C

130|Armor_X5_Q:/ #

130|Armor_X5_Q:/ #

130|Armor_X5_Q:/ # exit

D:\0\AdbStation>adb reboot bootloader

D:\0\AdbStation>fastboot flash boot boot.img

Sending 'boot' (32768 KB) OKAY [ 0.769s]

Writing 'boot' OKAY [ 0.575s]

Finished. Total time: 1.482s

D:\0\AdbStation>fastboot reboot

Rebooting OKAY [ 0.001s]

Finished. Total time: 0.006s

D:\0\AdbStation>adb root

adb: unable to connect for root: no devices/emulators found

D:\0\AdbStation>adb shell

Armor_X5_Q:/ $ su

Armor_X5_Q:/system/app $ ls

Armor_X5_Q:/system/app $ mount -o remount,rw /

mount: '/dev/block/dm-1' not user mountable in fstab

1|Armor_X5_Q:/system/app $ mount -o rw,remount rootfs /

mount: '/' not in /proc/mounts

1|Armor_X5_Q:/system/app $ cd /

Armor_X5_Q:/ $ mount -o rw,remount rootfs /

mount: '/' not in /proc/mounts

1|Armor_X5_Q:/ $ exit

D:\0\AdbStation>adb shell stop

stop: must be root

D:\0\AdbStation>adb sync

adb.exe: product directory not specified; set $ANDROID_PRODUCT_OUT

D:\0\AdbStation>adb shell start

start: must be root

D:\0\AdbStation>adb shell

Armor_X5_Q:/ $ sudo

/system/bin/sh: sudo: inaccessible or not found

127|Armor_X5_Q:/ $ su

1|Armor_X5_Q:/ $ sudo

/system/bin/sh: sudo: inaccessible or not found

127|Armor_X5_Q:/ $ su

1|Armor_X5_Q:/ $ su

1|Armor_X5_Q:/ $ su

1|Armor_X5_Q:/ $ so su is working

/system/bin/sh: so: inaccessible or not found

127|Armor_X5_Q:/ $ my fone tells lies lol...

/system/bin/sh: my: inaccessible or not found

127|Armor_X5_Q:/ $ mkdir test

mkdir: 'test': Read-only file system

1|Armor_X5_Q:/ $ sudo su

/system/bin/sh: sudo: inaccessible or not found

127|Armor_X5_Q:/ $ su sudo

1|Armor_X5_Q:/ $

I like the last 6 lines,,,

Yeah, all stock.... su working root apps shows working, fone says I dont have root, but hey, su works... using stock boot... {Mod edit}

{Mod edit: Disrespectful language removed - Regards Oswald Boelcke}
[Android Software/Hacking General [Developers Only]] optimumpro:
Another lol. Here is the final stage of my rom building:

DTC arch/arm64/boot/dts/vendor/qcom/kona-v2.1.dtb
DTC arch/arm64/boot/dts/vendor/qcom/instantnoodle-overlay-dvt.dtbo
DTC arch/arm64/boot/dts/vendor/qcom/instantnoodle-overlay-evt1.dtbo
DTC arch/arm64/boot/dts/vendor/qcom/instantnoodle-overlay-t0.dtbo
DTC arch/arm64/boot/dts/vendor/qcom/instantnoodlep-overlay-dvt.dtbo
DTC arch/arm64/boot/dts/vendor/qcom/instantnoodlep-overlay-evb.dtbo
DTC arch/arm64/boot/dts/vendor/qcom/instantnoodlep-overlay-evt1.dtbo
DTC arch/arm64/boot/dts/vendor/qcom/instantnoodlep-overlay-t0.dtbo
DTC arch/arm64/boot/dts/vendor/qcom/instantnoodlev-overlay-dvt.dtbo
DTC arch/arm64/boot/dts/vendor/qcom/instantnoodlev-overlay-evt1.dtbo
DTC arch/arm64/boot/dts/vendor/qcom/instantnoodlev-overlay-t0.dtbo
DTC arch/arm64/boot/dts/vendor/qcom/kebab-overlay.dtbo
DTC arch/arm64/boot/dts/vendor/qcom/lemonades-overlay.dtbo
make[1]: Leaving directory '/out/target/product/instan
tnoodle/obj/KERNEL_OBJ'
make: Leaving directory '/kernel/oneplus/sm8250'
[ 70% 342/487] Target boot image: out/target/product/instantnoodle/boot.img
++++ PRE-ROOTing BOOT image!!! ++++
- 64bit detected: true, arm64
- Unpacking boot image

Parsing boot image: [/out/target/product/instantnoodle
/boot.img]
HEADER_VER [2]
KERNEL_SZ [33503248]
RAMDISK_SZ [835315]
SECOND_SZ [0]
RECOV_DTBO_SZ [0]
DTB_SZ [486017]
OS_VERSION [11.0.0]
OS_PATCH_LEVEL [2021-09]
PAGESIZE [4096]
NAME []
CMDLINE [androidboot.hardware=qcom androidboot.console=ttyMSM0 android
boot.memcg=1 lpm_levels.sleep_disabled=1 msm_rtb.filter=0x237 service_locator.
enable=1 androidboot.usbcontroller=a600000.dwc3 swiotlb=2048 loop.max_part=7 c
group.memory=nokmem,nosocket reboot=panic_warm buildvariant=userdebug]
CHECKSUM [036a6b3e1871ef0d25b9dc40b66ac3b08000000000000000000000
000]
KERNEL_FMT [raw]
RAMDISK_FMT [gzip]
- Checking ramdisk status

Loading cpio: [ramdisk.cpio]
- Stock boot image detected

- Patching ramdisk
- - Repacking boot image

{Mod edit}

Best regards.

{Mod: Quotation edited and disrespectful language removed - Regards Oswald Boelcke}
[Android Software/Hacking General [Developers Only]] Pachacouti:
{Mod edit}

{Mod edit} my wee root find here will last longer, cause it's made by gooogle... no any one here... and it kill's magisk... {Mod edit} I only moved on after john wu made it official magisk is dead.

Magisk mtk, not made by magisk...

mtk-su was NOT made by john wu.

I put su in my fone, unrooted it, and su stayed in this ro system that is supposed to revert, but I used legit vbmeta, so no revert... you {Mod edit} really need a few laymen like me instead of blowing us over for advancing your cause, cause magisk sucks.

{Mod edit}

{Mod: Disrespectful parts removed - Regards Oswald Boelcke}
[Android Software/Hacking General [Developers Only]] heinhuiz:
That is not possible. I reckon the disk burning program was clever enough to correct your mistake.
[Android Software/Hacking General [Developers Only]] Pachacouti:
Not in the test done afterwards with no actual image... reproducable anytime.
[Android Software/Hacking General [Developers Only]] heinhuiz:
I still fail to see in which line you flash a stock image...
[Android Software/Hacking General [Developers Only]] Pachacouti:
The very first post, after the central separation... stating when I do.
[Android Software/Hacking General [Developers Only]] heinhuiz:
No you flash boot and recovery. Anyone can do that with a bootloader unlocked phone. And then you change to another directory and you list the contents of that. Nothing else.
[Android Software/Hacking General [Developers Only]] munjeni:
Someone need root on phone e.g. for terminal emulator, not all use adb at all, think about that! You need to take more care to android world instead of magisk, magisk is innoxious, for example google chrome with default option "allow sites to access microphone and camera" and option "allow chrome run in background"! Worried?
[Android Software/Hacking General [Developers Only]] Pachacouti:
I'm not worried, I just wanna block everything due to their involvement with the paedo ring they say they are not... so why spy?

Block their access to our kids.. start now.
[Android Software/Hacking General [Developers Only]] Pachacouti:
All I've done here is meddle with the tools google provided and {Mod edit} devs stuck in the old app trap think they can dis just anyone? Are you supposed to be better?

You've been working on your old apps for so long you are still trying to defeat safety net.. in fact that's all you'll do... work on old os's... the best are too busy on rich mans fones to bother with custom roms, we're too f'n rich to know not to custom rom the fone.. it's how we got rich...

No contacts or sim in test fone... EVER...

A guy with not much android experience tore y'all apart.. now show your users the truth...

Google since android 10, system_as_root, is rooted, you just cant do user/eng at same time.

{Mod edit}

People asking if it works... {Mod edit}

They know it works.. but they use magisk... {Mod edit}

{Mod edit}

{Mod: Removed disrespectful parts - Regards Oswald Boelcke}
[Android Software/Hacking General [Developers Only]] Full House:
hi i'm not a developer, i don't know anything about code basically what i understood is that you found a new way to root without triggering safetynet is that it?

If so can you explain to me in the easiest way how to root without using magisk ...
[Android Software/Hacking General [Developers Only]] mllllnmmn:
I gotta try this sounds too good to be tru . However when android is bricked or for some reason your not connected online an md5 hash is not what ill be saving to an sdcard. That I plan to rely on fixing what i screwed up thru trial n error. Ive crashed more pcs and crashed more networks then i care to speak of ! Not to mention the several hundred android devices that are now overflowing my grandmas garage lol .Just saying cause im always right Myself

well root is one thing but I can alter one app and another appwill not function cause it sees my mod to a totally different appnso i think his Claim is System root via his way is not consided hacked and Exp google pay will still work ? I think

The Real question is Will this method be detected by live Emulation such as online Gaming ? Pachouti?
[Android Software/Hacking General [Developers Only]] Pachacouti:
This thread is NOT a claim by me regarding anything. It is a thread about what I found.

{Mod edit} FOUND! In STOCK firmware. A genuine engineering bootloader.

Supplied by ulefone.

All ulefone 'a' only come with boot-debug.img. I checked all last night. It's OFFICIAL.

Google seperated variant=user from variant=eng. user-debug are not to be made available to the public. FACT. So many people using android 10, 11, 12, and even john wu says nothing. {Mod edit}

Why? They're trying to hold onto what they have left. NOTHING.

A legit fone pass's safety net. When the boot-debug is flashed to the boot, I cannot pass safety net, because my bootloader in UNLOCKED. I dont fake safety net, it works or it can f' off.. safety net is not what I found. it's not why I'm here. YOUR the hacker that's better than me, so YOU make it work. I only proved that GOOGLE provides a new version of debug, in that you MUST flash boot-debug to get engineering access.

That's why the only comment's I received HERE are negative, {Mod edit}. Those that know it works click like, knowing there's nothing more to say once they see they have root... most folks never come back when the purpose of this site has served them.. til there next fone...

But then I cant say if other manufacturer's are offering a boot-debug... I only have 2 fones.

Google have stated they will not provide anymore 'eng' variant bootloaders, which came into effect in android 10 Q. This nip's magisk in the {Mod edit}, cause once these variant=eng bootloaders disappear (it's already started) you wont be getting root.

Understand: They seperatated eng from user build. Simple. And in another year, even boot-debug will be made obsolete...

Android 10_q is WHEN they started.

{Mod edit} I cant believe your {Mod edit} blinded you from the fact google has CHANGED how root works. In that they provided a boot-debug, and since android 10, it took an android noob like me to show all you where you are going wrong. {Mod edit}

Root that works OFFLINE.

Provided by google.

Cant argue with this. {Mod edit}

{Mod: Disrespectful parts removed - Regards Oswald Boelcke}
[Android Software/Hacking General [Developers Only]] lebigmac:
Pachacouti your boot-debug.img not work for Xiaomi devices. How to make it work on other devices? Please provide universal solution so that everybody can enjoy your new discovery. Not everyone has ulefone...

Thanks!
[Android Software/Hacking General [Developers Only]] Pachacouti:
Well, I cant get anyone to help me find what I need so I cant help, due to the boot-debug.img being for my fone. It works on other ulefones that are 32mb in size, which I presume to be what is called 'a-only' - so in a nutshell, are you a/b or a-only partition?

I know of at least 8 different bootloader setups since android 10.

Which are you?

I'm a-only. So it's an a-only boot-debug.img, 32mb in size.

I presume if your a/b partition your boot.img size is 64mb in size.

I GUESS I'd flash the 32mb boot-debug.img to EITHER a or b partition, which-ever is free to load into... yeah, I do read...

Noticed a few comments from nay-sayers stating I dont have a super.

Wish they'd look at my fone online before they prove what twats they are... but I need a laf...

Android 10 and above = super. PERIOD.

If not yet, within a year.

What I did not say yet, is that I dscovered this after loading this boot-debug.img to the recovery, not boot. I only decided to use it as my default boot after learning it's rooted, and believe me, when you can do su commands when terminal shows $ instead of # -you know it's about to get, well, crazy... everything's telling lies lol...

$su --context u:r:system_app:s0 -c "pm uninstall --user 0 com.google.android.apps.wellbeing" < /dev/null

$success...

In an unrooted fone.

Pay atention. within one year, rooted MYSELF.
[Android Software/Hacking General [Developers Only]] Didgeridoohan:
Just build a boot image for your device with the userdebug buildtype set. Plenty of info on how to do that all over the interweb...

Many custom ROMs come with it by default even.
[Android Software/Hacking General [Developers Only]] Pachacouti:
All I did was have a lucky find ;)

But google are blocking eng builds, and tying engineers to their own self build(s) holding them accountable for any release, I read the docs regarding it, they are defo removing eng/user-debug, because then they CAN find those using safetynet hacks, which wont work depending on build ;)

I got a mate I enjoi talking to regarding what we're GONNA do...

He doe's it..
[Android Software/Hacking General [Developers Only]] Didgeridoohan:
Got a link? Would love to read it myself.
[Android Software/Hacking General [Developers Only]] Pachacouti:
My next post will be a proper tutorial on HOW to use this WITH stock.
[Android Software/Hacking General [Developers Only]] Pachacouti:
Ahem, um, like, I go through so many pages, but I believe the information you ask is in one of the links I posted regarding Android, look for VTS... If you read my latest threads from 3 months ago, you'll see the path I took :) treble claims it works but it dont. This fone lies.

Here you are ;)

VTS testing with debug ramdisk | Android Open Source Project

source.android.com
[Android Software/Hacking General [Developers Only]] Pachacouti:
Ok, yeah, I likadagringo... it's bad enough finding out your everyones god wether they believe or not lol... so I try to keep busy...

The following link proves I have root, and by design. Mine is the FIRST fone to offer the root as boot-debug.img.

VTS testing with debug ramdisk | Android Open Source Project

source.android.com

Thanks for the insult's.

Now instead of insults, if someone would like to point me in the direction of a use-debug version I can load into my fone, I can do tests...

Aside's from that, I'm vindicated.

It took the monkey king (height of mans intelligence) to show you who knew better..

The customer.
[Android Software/Hacking General [Developers Only]] munjeni:
Thats something very wrong in that phone model software, security hole. Are you getting su work while on stock boot.img or you getting it work only while having boot debug img installed? Where you have put su binary? You do not have bootloop while keeping su installed (to the system?) after relocking bootloader?
[Android Software/Hacking General [Developers Only]] optimumpro:
It's joke. A good sign of a hoaxer is when he immediately jumps to effing everybody who questions his nonsense. That's a red flag that is all over this thread. {Mod edit}

Apart from that, {Mod edit}, there is no difference between ADB root and root. In reality, debug_boot.img does not provide full root access, it only provides root access for adb commands, and even that requires system_debug image, which you will never get on stock: to have a stock system_debug, one must recompile from sources with that flag. Show me an OEM who provides sources for anything other than kernel.

His other claim about passing Safetynet on stock with bootimage-debug is abracadabra. No phone with unlocked bootloader will pass Safetynet without modifications in framework and kernel: the frameworks usually contain the names of services and applications and kernel has the 'fooling' flags. Yeah, he can modify kernel, if he has sources, but would never be able to modify frameworks.

{Mod edit - Regards Oswald Boelcke}
[Android Software/Hacking General [Developers Only]] Pachacouti:
{Mod edit}

The docs clearly state vbmeta resets when going from boot-img to stock.. from upper to lower whichever way... I dont wipe my vbmeta... I dont need to. The docs state why.

But with 2 =null as written, vbmeta can be disabled, but being legit, registers as such, even though disabled.

{Mod edit}

But read my proof, and deny it, {Mod edit - Disrespect removed! Oswald Boelcke}
[Android Software/Hacking General [Developers Only]] Pachacouti:
Any dev wanna give me commands I can use in adb in order to copy n paste what you need to see my fone do, feel free, am up for testing, and being an android noob, I dont actually know what to look for, never mind post.

Ask away, keep it real, and see what I can do...

Commands please?
[Android Software/Hacking General [Developers Only]] Pachacouti:
Truth of the matter is reader's, yeah, I've a few followers in the midst of it all... I bought a fone I went mad at for a year before I figured this out... it's crazy if you actually read where I stopped writing in the firestick section, see, amazon caught up with ME, and we all got hit. They patched it quick because I found it, no-one else.. I stopped before the hit. Knowing it was coming. No more firestick for me. No more amazon. but before this decision, I bought the armor x5 pro, it clearly stated unlocked, as in shell access. But I could not find it. It was there all that time, and look at how many threads I attempted. No one really showed interest. Then I discover boot-debug.img, and well...

After reading so many dis-heartening thread's saying my fone was android 9 got me. I could not load any twrp, now I know why. I could not use magisk Now I know why. I never did dis magisk, I simply stated it wont work, and magisk is finito as stated by john wu sa.

I believe him. Because I now know why.

I tried everything to get root. No joy. Because I trusted software, Ultracompare stated the boot.img and boot-debug.img were identical. Yeah, the encryption is. The encryption disguises the fact boot-debug is actually variant=eng.

Ultracompare or hexedit show variant=user in both bootloaders, so yeah, my fone lies.

But why when I solve my problem, my own way, does everyone get upset?

Ah, because it shows 2 things.

Root with no magisk

That magisk kills.

Now that I cant explain.

It's just an old app I guess... fit for the fones google will deem eol shortly...
[Android Software/Hacking General [Developers Only]] Full House:
{Mod edit: Quoted post has been deleted}

😮 You bought a phone with Root show me please I want to see this ...

{Mod edit}
[Android Software/Hacking General [Developers Only]] munjeni:
This is if I understand correctly manufacturer mistake with leaked (signed?) boot debug image.
[Android Software/Hacking General [Developers Only]] optimumpro:
No. It's not manufacturer's signed. He probably compiled it from manufacturer's sources with 'debug' flag, but that won't give you root, it will only give you adb_debug root, as most custom roms do. His boot.img won't boot on locked bootloader. Nor would it pass Safetynet. It actually achieves nothing. As I said, every custom user_debug rom has adb_root feature, but not root.
[Android Software/Hacking General [Developers Only]] Dileas:
{Mod edit: Disrespectful part removed - Regards Oswald Boelcke}

You should have just started with that, so that everyone would know to ignore the rest of your comments.
[Android Software/Hacking General [Developers Only]] Pachacouti:
{Mod edit} stock boot-debug = adb root... no mistake... patched with su thus:

Manually install meefiks su.apk, dont attempt to install it, instead, top right, save flashable x64.zip, then into twrp to flash it, after mounting /system_root/, reboot, su-pro to update, flash magisk'd boot to grant su permissions, in gui, uninstall magisk, install busybox, reboot bootloader to reflash back to debug-boot. njoi knowing I dont have magisk, and thanks to systemrw, can reflash stock and recovery back and the su root works.

{Mod edit}

It's a genuine stock rom.

{Mod edit}

Think I'll make a hybrid bootloader...