[Root/TWRP/Rom]T-Mobile K428sg K10/MetroPCS ms428 K10[4/2/17]

ok all. this is dirtycow exploit for the t-mobile k428 - works on the 10g firmware(works for the metropcs ms428 as well - Must have 10c kdz flashed first). the exploit method is almost the same as the v20
i have personally done this multiple times on my t-mobile k10 without issues to make sure it is 100% working

all the needed files you need are in this rar. just extract it to the root of your C drive Download Me
this requires an unlocked bootloader and on the t-mo variant it's very easy to do. check this forum. you'll find instructions on how to do it

Now lets get started!!

copy the supersu file to your sdcard

open a command prompt window.

now copy and paste each line except the lines surrounded by "< >"

adb push dirtycow /data/local/tmp
adb push recowvery-applypatch /data/local/tmp
adb push recowvery-app_process32 /data/local/tmp
adb push recowvery-run-as /data/local/tmp
adb push twrp-3.1.0-0.img /sdcard/twrp.img
adb shell
cd /data/local/tmp
chmod 0777 *
./dirtycow /system/bin/applypatch recowvery-applypatch
"<Note! wait for to finish>"
./dirtycow /system/bin/app_process32 recowvery-app_process32
"<Note! wait for to finish, it should appear to crash, however
the crash will not happen, you have to force the crash.
to do this wait for the exploit to finish. now press and hold
the power button until you see the t-mo logo screen and hear
the jingle. now it's crashed and you can continue onto the next
step>"
exit
adb logcat -s recowvery
"<wait for it to tell you it was successful - Then Press>"
"[CTRL+C]"
adb shell reboot recovery
"<wait for phone to boot up again, your recovery will be reflashed to stock>"
adb shell
getenforce
"<it should say Permissive>"
cd /data/local/tmp
./dirtycow /system/bin/run-as recowvery-run-as
run-as exec ./recowvery-applypatch boot
"<wait for it to flash your boot image this time>"
run-as su
run-as exec dd if=/sdcard/twrp.img of=/dev/block/bootdevice/by-name/recovery
"<wait for it to complete>"
reboot recovery
"<once in twrp do the following>"
click install
select supersu 2.79-sr3.zip
reboot
setup your phone and enjoy

thats it. enjoy root!

Stock Deodexed Roms

Features:

Deodexed
Debloated(if thats what you want to call it) i've removed what i don't want so
Magisk v12.0 with magisk manager 4.3.0
Note! (make sure to enable hide magisk in magisk manager settings) - pass's safetynet check - android pay will work along with pokemon go and any other apps that look for root
Busybox 1.26.2 installed by default
dolby atmos 6.5
Viper4Android 2.5.0.5
Includes a custom app for a reboot menu that ties into the actual power button

As always to install either rom you'll want to wipe system, data, dalvik and cache(this is normal for any rom)

T-Mobile Rom
T-Mobile K10 K428sg 10h rom - Weather Widget has been removed due to deodexing issues. PLZ use an Alternate Weather Widget
K428sg10h Removed Files

MetroPCS Rom
MetroPCS K10 ms428 10h rom - Weather Widget has been removed due to deodexing issues. PLZ use an Alternate Weather Widget
MetroPCS Removed Files

for anyone interested you can freely use these rom as a starting point base for a custom rom.

Thanks to @pvineeth97 - for working twrp, @Chainfire - for supersu, @topjohnwu - for magisk, and everyone else i forgot to mention. sorry guys i'm tired!

reserved 1

actually the metropcs twrp you did works like a charm on the t-mo 428. ty for that btw.
i wasn't sure if this worked for metropcs or not but since you say it does i'll mention it as well

GuyInDogSuit said:

On the very first command I'm already facing issues:

Code:

adb push dirtycow /data/local/tmp
adb: error: cannot stat 'dirtycow': No such file or directory

Click to expand...

Click to collapse

make sure your running cmd from the adb dir. also you need to make sure usb debugging is enabled in dev options along with oem unlock

GuyInDogSuit said:

I am running it from the adb directory. And USB debugging and OEM unlock are enabled.

Click to expand...

Click to collapse

then it should work as the file is in that folder if you grabbed my zip at the top of OP

GuyInDogSuit said:

I got it! The "dirtycow" file was being removed by ESET. You should add a disclaimer in the OP about it possibly being flagged by antivirus software.

Click to expand...

Click to collapse

yeah it's a false positive. anyway disclaimer added.

GuyInDogSuit said:

OK, now I'm stuck. The part where I'm supposed to hold the power button? It doesn't reboot. It just brings up the power menu and stays there.

Click to expand...

Click to collapse

redo the exploit line right before your supposed to hold the power button. wait for it to finish then hold the power button to crash the phone

GuyInDogSuit said:

It takes about 2-3 minutes for the "./dirtycow /system/bin/app_process32 recowvery-app_process32" command to finish. It doesn't appear to crash. I'm still waiting for it to happen.

Click to expand...

Click to collapse

ok, make sure your screen is on and doesn't shutoff. that may help. the crash that happens on the v20 doesn't happen on the k10 unless ypou hold the power button to force it

and you'll know you crashed it because the white t-mo logo screen will pop up and you'll hear part of the t-mo jingle and then phone will appear to be froze

GuyInDogSuit said:

I set the screen to stay on. I'm actually using an MS428, the MetroPCS variant. Nothing happening, still. I've run the command four times now.

---------- Post added at 09:53 AM ---------- Previous post was at 09:47 AM ----------

I think I'll need to downgrade. I let the phone update once since I got it. And there's a new 57.1 MB update today.

Click to expand...

Click to collapse

you may need to. i did this on a k428 t-mo version with 10g and i havn't tryed on 10h yet but i gaurentee it works on t-mo. was told it works on metropcs however they could have been wrong on that.

GuyInDogSuit said:

Once rooted, will I lose root if I update? I kinda figure I will.

Click to expand...

Click to collapse

it actually shouldn't update because of the modified recovery. although it may still complain about there being an update you can just ignore it