Amazing Temp Root for MediaTek ARMv8 [2020-08-24]

Software root method for MediaTek MT67xx, MT816x, and MT817x!​

DISCLAIMER​

REQUIREMENTS​

• A PC with ADB installed to interact with your device, or
• A terminal emulator app

INSTRUCTIONS FOR ADB​

1. Make sure you meet all the requirements listed above, especially the first and last ones.
2. Download the current mtk-su zip file to your PC and unzip it. Inside will be 2 directories: 'arm' & 'arm64' with an 'mtk-su' binary in each. Pick one for your device. Differences between the flavors:
   arm64: 64-bit kernel and userspace
   arm: 32-bit userspace on a 64-bit or 32-bit kernel (will also work in 64-bit userspace)
3. Connect your device to ADB and push mtk-su to your /data/local/tmp folder
   adb push path/to/mtk-su /data/local/tmp/
4. Open an adb shell
   adb shell
5. Change to your tmp directory
   cd /data/local/tmp
6. Add executable permissions to the binary
   chmod 755 mtk-su
7. At this point keep your device screen on and don't let it go to sleep. Run the command
   ./mtk-su
   It should only take a second or two. If the program gets stuck for more than a few seconds and your device is awake, press Ctrl+C to close it.
   The -v option turns on verbose printing, which is necessary for me to debug any problems.
   The output of ./mtk-su -v is similar to this:
   
   Spoiler

   Code:

   $ ./mtk-su -v
   param1: 0x3000, param2: 0x18040, type: 2
   Building symbol table
   kallsyms_addresses pa 0x40bdd500
   kallsyms_num_syms 70337, addr_count 70337
   kallsyms_names pa 0x40c66d00, size 862960
   kallsyms_markers pa 0x40d39800
   kallsyms_token_table pa 0x40d3a100
   kallsyms_token_index pa 0x40d3a500
   Patching credentials
   Parsing current_is_single_threaded
   ffffffc000354868+50: ADRP x0, 0xffffffc000fa2000
   ffffffc000354868+54: ADD xd, x0, 2592
   init_task VA: 0xffffffc000fa2a20
   Potential list_head tasks at offset 0x340
   comm swapper/0 at offset 0x5c0
   Found own task_struct at node 1
   cred VA: 0xffffffc0358ac0c0
   Parsing avc_denied
   ffffffc0002f13bc+24: ADRP x0, 0xffffffc001113000
   ffffffc0002f13bc+28: LDR [x0, 404]
   selinux_enforcing VA: 0xffffffc001113194
   Setting selinux_enforcing
   Switched selinux to permissive
   starting /system/bin/sh
   UID: 0  cap: 3fffffffff  selinux: permissive
   #

   Some other options:
   
   mtk-su -c <command>: Runs <command> as root. Default command is /system/bin/sh.​
   mtk-su -s: Prints the kernel symbol table​
   mtk-su -Z <context>: Runs shell in a new selinux context. Example: ./mtk-su -Z u:r:logd:s0​
   If you see any errors other than about unsupported or incompatible platform or don't get a root shell, report it here. When reporting a problem with a device, please post a link to the firmware and/or the kernel sources.
   
   Please post the model of any device that works with mtk-su that's not already confirmed.
   
   Important: in rare cases, it may be necessary to run the tool multiple times before you hit UID 0 and get selinux permissive. If you don't achieve root on a particular run, the "UID: N cap: xxxxx...." line will reflect that. If it doesn't say "UID: 0 cap: 3fffffffff selinux: permissive", type exit to close the subshell and try mtk-su again.

DOWNLOAD​

FAQ​

• It has already been answered in the FAQ or multiple times in the thread.
• Your post is unrelated to this project. It may be specific to your device, which would make it off topic for this thread.
• Your question is extremely vague and you appear to be intentionally leaving out basic information (e.g. fishing).

CREDITS​

• Thank you to everyone who has tested and provided feedback to help me add support for the large variety of MTK-based devices out there. There are simply too many people to list.
• MediaTek, Inc., who leave holes and backdoors in their OS to make software like this possible :good:
• Thank you to everyone who has donated. You're the best!

1. Make sure you meet all the requirements, including the first one.
2. Download and install the init.d scripts support app. Make sure this app gets installed on the internal storage, not the external SD. (Support the developer.)
3. Make a folder named 'init.d' on your internal storage. Also make a 'bin' folder inside 'init.d'. Set up the init.d app up like this:
   • Try to acquire root privileges: unchecked
   • Run scripts at boot time: checked
   • Execution delay: No delay
   • Selected folder: /storage/emulated/0/init.d
   • Execute all files: unchecked
   Remember that the folder structure has to be exactly as described, unless you manually edit the path in the script. You can also, in principle, use a different app if you want, but in that case you have to edit the package name path in the script as well.
4. Download and install the Magisk Manager apk. For Android 9, the highest version that will work is 7.1.1. The latest version should be usable for Android 8.x and lower, but 7.1.1 may be better in all cases. Make sure this app is installed on the internal storage, not external SD.
5. In MM, go to Settings, Update Channel, Custom, and enter this URL: https://raw.githubusercontent.com/topjohnwu/magisk_files/841e978604f989d04549013cd4dcc7e34aea5288/stable.json . This will freeze the update version of Magisk at 18.1. That's necessary for MM to create the right environment for Magisk modules to work.
6. Download the current su-boot script, unzip it, and put suboot.sh inside your /sdcard/init.d folder.
7. Download the current mtk-su zip and put your appropriate mtk-su file in your /sdcard/init.d/bin folder.
8. Download the Magisk 18.1 zip (not 19.x or higher). Extract the arm/magiskinit file and move it to your /sdcard/init.d/bin folder. That is the only file you will need from that zip. (Support the developer.)
9. Now you should be ready to launch the Magisk core. Either reboot or tap 'Run scripts now'. The process will take a few seconds before telling you that 1 script has finished. If it ran successfully, last execution result will show something like this:
   
   Code:

   Temporary root by diplomatic@XDA
   Home URL:
   https://xdaforums.com/android/development/amazing-temp-root-mediatek-armv8-t3922213
   --------------------------------------------------
   
   UID: 0  cap: 3fffffffff  selinux: permissive
   source type magisk does not exist
   Error in: allow magisk (null) (null) (null)
   client: launching new main daemon process

   That output was made by the latest mtk-su & suboot script. If you get a different result, then something may have gone wrong.
10. At this point, you should be able to run 'su' or do a root request from an app and get a prompt.
11. When you open Magisk Manager, it will prompt you with Requires Additional Setup. On this window, you can tap Yes. This is safe. Make sure that you have done step 5 before doing this.
12. Turn off update checking in MM. Never try to do a direct-install Magisk Update on a locked device.

• MagiskHide & SafetyNet pass now work under Android 9
• Modules pass minimum version check
• Faster and more efficient loading
• Logging works properly

1. Make sure you meet all the requirements, including the first one.
2. Download and install the init.d scripts support app. Make sure this app gets installed on the internal storage, not the external SD. (Support the developer.)
3. Make a folder named 'init.d' on your internal storage. Also make a 'bin' folder inside 'init.d'. Set up the init.d app up like this:
   • Try to acquire root privileges: unchecked
   • Run scripts at boot time: checked
   • Execution delay: No delay
   • Selected folder: /storage/emulated/0/init.d
   • Execute all files: unchecked
4. Remember that the folder structure has to be exactly as described, unless you manually edit the path in the script. You can also, in principle, use a different app if you want, but in that case you have to edit the package name path in the script as well.
5. Download and install the latest Magisk Manager apk. Make sure this app is installed on the internal storage, not external SD.
6. Download the current magisk-boot script, unzip it, and put magisk-boot.sh inside your /sdcard/init.d folder.
7. Download the current mtk-su zip and put your appropriate mtk-su file in your /sdcard/init.d/bin folder.
8. Download a Magisk zip package (19.4 to 21.4). Extract either arm/magiskinit64 or arm/magiskinit file and move/rename it to /sdcard/init.d/bin/magiskinit. (i.e. magiskinit64 should be renamed to magiskinit.) Pick one of 64-bit or 32-bit builds that corresponds to your kernel architecture. That is the only file you will need from that zip. (Support the developer.)
9. Now you should be ready to launch the Magisk core. Either reboot or tap 'Run scripts now'. The process will take a few seconds before telling you that 1 script has finished. If it ran successfully, last execution result will show something like this:
   
   Code:

   Temporary root by diplomatic@XDA
   Home URL:
   https://xdaforums.com/android/development/amazing-temp-root-mediatek-armv8-t3922213
   --------------------------------------------------
   /data/data/com.ryosoftware.initd/files/bin
   
   UID: 0 cap: 3fffffffff selinux: permissive
   Load policy from: /sys/fs/selinux/policy
   20.3:MAGISK (20300)
   client: launching new main daemon process

   On Android 9, you may see a 'Segmentation fault' if using v20.3+. This crash does not affect functionality. You can install v20.2 to avoid it.
   If you get a different result, then something may have gone wrong. Report problems here, except for errors about incompatible or unsupported platform.
10. At this point, you should be able to call 'su' or do a root request from an app and get a prompt.
11. When you open Magisk Manager, it will prompt you with Requires Additional Setup. On this window, you can tap Yes. This is safe.
12. Never try to do a direct-install Magisk Update on a locked device. To update Magisk, do so manually. Simply download the latest Magisk package and extract its magiskinit(64) file to the init.d/bin directory.
13. If upgrading from the old Magisk 18.x suboot method, you may need to clear your /data/adb directory in temp root shell before modules will work.

INSTRUCTIONS FOR TERMINAL APP​

1. Make sure you meet all the requirements from the first post, especially the first and last ones.
2. Download the current mtk_su zip to your device and unzip it. Take note of where you extracted it. Pick the variant that fits your device. (See above.)
3. Open Termux and copy the mtk-su binary to its home directory, which in this case is the shell's initial working directory.
   General idea: cp path/to/mtk-su ./
   For example,
   cp /sdcard/mtk-su_r14/arm64/mtk-su ./
   For this to work, you have to enable the Storage permission for your term app. Do not try to circumvent the cp command with clever copying methods involving file managers or external tools. Mtk-su will not get the right permissions that way.
4. Make file executable
   chmod 700 mtk-su
5. Run the program
   ./mtk-su

• Partition Backup Helper for Termux by @mrmazak
  Creates a script that automatically backs up your device's partitions, which may come in handy for repairs or experimenting.
  
  
• Full bootless root with Magisk (for 20.x to 21.4) by @diplomatic
  Loads Magisk without modifying the firmware.
  
  
• Full bootless root with Magisk for 22.x+ by @HemanthJabalpuri
  Loads the latest Magisk version without modifying the firmware.