[Android Software/Hacking General [Developers Only]] Pachacouti:
And for the naysayers...

D:\0\AdbStation>adb reboot download

D:\0\AdbStation>fastboot flashing unlock_critical

(bootloader) Start unlock flow

OKAY [ 4.196s]

Finished. Total time: 4.196s

D:\0\AdbStation>fastboot --disable-verity --disable-verification flash boot boot

-debug.img

Sending 'boot' (32768 KB) OKAY [ 0.764s]

Writing 'boot' OKAY [ 0.515s]

Finished. Total time: 1.420s

D:\0\AdbStation>fastboot -w

Erasing 'userdata' OKAY [ 0.452s]

mke2fs 1.46.2 (28-Feb-2021)

Creating filesystem with 6311931 4k blocks and 1581056 inodes

Filesystem UUID: aa3b871c-2496-11ec-9dd6-d71d0c30be37

Superblock backups stored on blocks:

32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,

4096000

Allocating group tables: done

Writing inode tables: done

Creating journal (32768 blocks): done

Writing superblocks and filesystem accounting information: done

Sending 'userdata' (180 KB) OKAY [ 0.016s]

Writing 'userdata' OKAY [ 0.047s]

Erasing 'cache' OKAY [ 0.016s]

mke2fs 1.46.2 (28-Feb-2021)

Creating filesystem with 110592 4k blocks and 110592 inodes

Filesystem UUID: aa63fe86-2496-11ec-99f6-f719dec4c630

Superblock backups stored on blocks:

32768, 98304

Allocating group tables: done

Writing inode tables: done

Creating journal (4096 blocks): done

Writing superblocks and filesystem accounting information: done

Sending 'cache' (68 KB) OKAY [ 0.016s]

Writing 'cache' OKAY [ 0.031s]

Erasing 'metadata' OKAY [ 0.016s]

Erase successful, but not automatically formatting.

File system type raw data not supported.

Finished. Total time: 0.889s

D:\0\AdbStation>fastboot reboot

Rebooting OKAY [ 0.000s]

Finished. Total time: 0.000s

D:\0\AdbStation>adb disable-verity

Error getting verity state. Try adb root first?

D:\0\AdbStation>adb root

restarting adbd as root

D:\0\AdbStation>adb shell

Armor_X5_Q:/ # whoami

root

Armor_X5_Q:/ # mount -o rw,remount /

'/dev/block/dm-3' is read-only

Armor_X5_Q:/ # mount -o rw,remount /sys

Armor_X5_Q:/ # cd sys

Armor_X5_Q:/sys # ls

block bus dev firmware kernel mtk_rgu

bootinfo class devices fs module power

Armor_X5_Q:/sys # bootinfo

/system/bin/sh: bootinfo: inaccessible or not found

127|Armor_X5_Q:/sys # bootinfo --help

/system/bin/sh: bootinfo: inaccessible or not found

127|Armor_X5_Q:/sys # devices

/system/bin/sh: devices: inaccessible or not found

127|Armor_X5_Q:/sys # cd dev

Armor_X5_Q:/sys/dev # ls

block char

Armor_X5_Q:/sys/dev # cd /

Armor_X5_Q:/ # cd /

Armor_X5_Q:/ # ls

acct d init.environ.rc metadata sbin

apex data init.rc mnt sdcard

bin debug_ramdisk init.usb.configfs.rc odm storage

bugreports default.prop init.usb.rc oem sys

cache dev init.zygote32.rc proc system

charger etc init.zygote64_32.rc product ueventd.rc

config init lost+found product_services vendor

Armor_X5_Q:/ # cd system

Armor_X5_Q:/system # cd bin

Armor_X5_Q:/system/bin # ls

AudioSetParam hwclock printenv

abb hwservicemanager printf

acpi i2cdetect procrank

adbd i2cdump profman

aee i2cget ps

aee_aed i2cset pwd

aee_aed64 iconv racoon

aee_archive id readlink

aee_core_forwarder idmap realpath

aee_dumpstate idmap2 reboot

am idmap2d recovery-persist

apexd ifconfig renice

app_process ime requestsync

app_process32 incident resize.f2fs

app_process64 incident_helper resize2fs

applypatch incidentd restorecon

appops init rm

appwidget inotifyd rmdir

art_apex_boot_integrity input rmmod

ashmemd insmod rss_hwm_reset

atrace install rtt

audioserver install-recovery.sh run-as

auditctl installd runcon

awk ionice schedtest

badblocks iorapd screencap

base64 iorenice screenrecord

basename ip sdcard

batterywarning ip-wrapper-1.0 secdiscard

bc ip6tables secilc

bcc ip6tables-restore sed

blank_screen ip6tables-save sendevent

blkid ip6tables-wrapper-1.0 sensorservice

blockdev iptables seq

bmgr iptables-restore service

boot_logo_updater iptables-save servicemanager

bootstat iptables-wrapper-1.0 setenforce

bootstrap keystore setprop

bpfloader keystore_cli_v2 setsid

bu kill settings

bugreport killall sgdisk

bugreportz kpoc_charger sh

bunzip2 lbs_dbg sha1sum

bzcat lcdc_screen_cap sha224sum

bzip2 ld.mc sha256sum

cal librank sha384sum

cameraserver linker sha512sum

cat linker64 showmap

charger linker_asan simpleperf

chcon linker_asan64 simpleperf_app_runner

chgrp lmkd sleep

chmod ln sload_f2fs

chown load_policy sm

chroot locksettings sort

chrt log split

cksum logcat ss

clatd logd sspm_log_writer

clear loghidlsysservice st_factorytests

cmd logname start

cmp logwrapper stat

comm losetup statsd

connsyslogger lpdump stop

content lpdumpd storaged

cp ls strings

cpio lshal stty

crash_dump32 lsmod surfaceflinger

crash_dump64 lsof svc

cut lspci swapoff

dalvikvm lsusb swapon

dalvikvm32 make_f2fs sync

dalvikvm64 md5sum sysctl

date mdlogger tac

dd mdnsd tail

debuggerd media tar

defrag.f2fs mediadrmserver taskset

device_config mediaextractor tc

devmem mediametrics tc-wrapper-1.0

dex2oat mediaserver tcpdump

dexdiag met-cmd tee

dexdump met_log_d telecom

dexlist microcom terservice

dexoptanalyzer migrate_legacy_obb_data.sh thermald

df mini-keyctl time

diff mkdir timeout

dirname mke2fs tombstoned

dmctl mkfifo toolbox

dmesg mkfs.ext2 top

dnsmasq mkfs.ext3 touch

dos2unix mkfs.ext4 toybox

dpm mknod tr

drmserver mkswap traced

du mktemp traced_probes

dumpstate mobile_log_d trigger_perfetto

dumpsys modemdbfilter_client true

e2fsck modinfo truncate

e2fsdroid modprobe tty

echo monkey tune2fs

egrep more tzdatacheck

emdlogger1 mount ueventd

emdlogger2 mountpoint uiautomator

emdlogger3 move_widevine_data.sh ulimit

emdlogger5 mtkbootanimation umount

env mtpd uname

expand mv uncrypt

expr nc uniq

fallocate ndc unix2dos

false ndc-wrapper-1.0 unlink

fgrep netcat unshare

file netd unzip

find netdiag uptime

flags_health_check netstat usbd

flock netutils-wrapper-1.0 usleep

fmt newfs_msdos uudecode

free nfcstackp uuencode

fsck.f2fs nice uuidgen

fsck_msdos nl vdc

fsverity_init nohup viewcompiler

fsync notify_traceur.override.sh vintf

gatekeeperd notify_traceur.sh vmstat

getconf nproc vold

getenforce nsenter vold_prepare_subdirs

getevent oatdump vr

getprop od vtservice

gpuservice oem-iptables-init.sh wait_for_keymaster

grep paste watch

groups patch watchdogd

gsi_tool perfetto wc

gsid pgrep which

gunzip pidof whoami

gzip ping wificond

head ping6 wm

heapprofd pkill xargs

hid pm xxd

hostname pmap yes

hw pppd zcat

Armor_X5_Q:/system/bin # getenforce

Enforcing

Armor_X5_Q:/system/bin # setenforce 0

Armor_X5_Q:/system/bin # get enforce

/system/bin/sh: get: inaccessible or not found

127|Armor_X5_Q:/system/bin # getenforce

Permissive

Armor_X5_Q:/system/bin # root mofo's, System-As-Root! boot-debug rocks!

> ^C

130|Armor_X5_Q:/system/bin # Who needs su

/system/bin/sh: Who: inaccessible or not found

127|Armor_X5_Q:/system/bin # whoami

root

Armor_X5_Q:/system/bin #