Amazing Temp Root for MediaTek ARMv8 [2020-08-24]

[kww__]

and how to try what program ?

i'd suggest to look at 3rd post in this topic
link: https://forum.xda-developers.com/t/...diatek-armv8-2020-08-24.3922213/post-79354355

 

[Luckas Magalhães]

Software root method for MediaTek MT67xx, MT816x, and MT817x!​

So it's no big secret that not too long ago, I found a way to achieve temporary root on MediaTek chipsets. No preinstalled root solution or device unlock was needed. The tool I created, MTK-SU, was originally aimed at helping Amazon Fire HD owners to easily root and unlock their tablets. (Without it, most models need a hardware mod to achieve root & unlock. This tool made rooting accessible to many times the number of owners. It also made possible to root the Fire TV gen 2.) But funny story: this method actually works on virtually all of MediaTek's 64-bit chips. Many devices of various vendors have already been confirmed.

So in case it's not clear, what mtk-su does is give you a root shell to do with as you please. It's like running 'su', but without the need to have su installed. That may be a holy grail for locked devices. On some devices, it may be possible to install a root manager for permanent root using mtk-su as a springboard.

The original thread is here: Rapid Temporary Root for HD 8 & HD 10. It's a great resource for info. But please avoid posting there about non-Amazon devices. This new thread is a catchall topic for other devices and vendors.

DISCLAIMER​

Anything you do that is described in this thread is at your own risk. No one else is responsible for any data loss, corruption or damage of your device, including that which results from bugs in this software. There is a nonzero chance of any of these events happening as a result of using the tools or methods here.

REQUIREMENTS​

Mastery of the Thanks button under XDA posts
A phone or tablet based on Mediatek MT67xx, MT816x, MT817x or MT6580 chipsets
Either:

• A PC with ADB installed to interact with your device, or
• A terminal emulator app

Familiarity with ADB (if using PC) and basic Linux shell commands
You agree to post the model name of any unconfirmed device which ran mtk-su successfully

INSTRUCTIONS FOR ADB​

1. Make sure you meet all the requirements listed above, especially the first and last ones.
2. Download the current mtk-su zip file to your PC and unzip it. Inside will be 2 directories: 'arm' & 'arm64' with an 'mtk-su' binary in each. Pick one for your device. Differences between the flavors:
   arm64: 64-bit kernel and userspace
   arm: 32-bit userspace on a 64-bit or 32-bit kernel (will also work in 64-bit userspace)
3. Connect your device to ADB and push mtk-su to your /data/local/tmp folder
   adb push path/to/mtk-su /data/local/tmp/
4. Open an adb shell
   adb shell
5. Change to your tmp directory
   cd /data/local/tmp
6. Add executable permissions to the binary
   chmod 755 mtk-su
7. At this point keep your device screen on and don't let it go to sleep. Run the command
   ./mtk-su
   It should only take a second or two. If the program gets stuck for more than a few seconds and your device is awake, press Ctrl+C to close it.
   The -v option turns on verbose printing, which is necessary for me to debug any problems.
   The output of ./mtk-su -v is similar to this:
   
   Spoiler

   $ ./mtk-su -v
   param1: 0x3000, param2: 0x18040, type: 2
   Building symbol table
   kallsyms_addresses pa 0x40bdd500
   kallsyms_num_syms 70337, addr_count 70337
   kallsyms_names pa 0x40c66d00, size 862960
   kallsyms_markers pa 0x40d39800
   kallsyms_token_table pa 0x40d3a100
   kallsyms_token_index pa 0x40d3a500
   Patching credentials
   Parsing current_is_single_threaded
   ffffffc000354868+50: ADRP x0, 0xffffffc000fa2000
   ffffffc000354868+54: ADD xd, x0, 2592
   init_task VA: 0xffffffc000fa2a20
   Potential list_head tasks at offset 0x340
   comm swapper/0 at offset 0x5c0
   Found own task_struct at node 1
   cred VA: 0xffffffc0358ac0c0
   Parsing avc_denied
   ffffffc0002f13bc+24: ADRP x0, 0xffffffc001113000
   ffffffc0002f13bc+28: LDR [x0, 404]
   selinux_enforcing VA: 0xffffffc001113194
   Setting selinux_enforcing
   Switched selinux to permissive
   starting /system/bin/sh
   UID: 0  cap: 3fffffffff  selinux: permissive
   #

   Some other options:
   If you see any errors other than about unsupported or incompatible platform or don't get a root shell, report it here. When reporting a problem with a device, please post a link to the firmware and/or the kernel sources.
   
   Please post the model of any device that works with mtk-su that's not already confirmed.
   
   Important: in rare cases, it may be necessary to run the tool multiple times before you hit UID 0 and get selinux permissive. If you don't achieve root on a particular run, the "UID: N cap: xxxxx...." line will reflect that. If it doesn't say "UID: 0 cap: 3fffffffff selinux: permissive", type exit to close the subshell and try mtk-su again.
   
   mtk-su -c <command>: Runs <command> as root. Default command is /system/bin/sh.​
   mtk-su -s: Prints the kernel symbol table​
   mtk-su -Z <context>: Runs shell in a new selinux context. Example: ./mtk-su -Z u:r:logd:s0​

WARNING If you have a device with Android 6 or higher, it likely has dm-verity enabled. On such a device one does not simply remount the system partition as read/write. The remount command will probably fail. But if you succeed in forcing it somehow it will trigger dm-verity, which will result in a very bad day. Your device will become inoperable until you restore the stock system partition.

DOWNLOAD​

Current Version
Release 23

Spoiler: Changelog

Release 23 - August 24, 2020

• Add support for some early Linux 3.10 tablet firmware
• Add support for kernels with some debug features enabled

Release 22 - May 8, 2020

• Expand kernel support
• Enable seccomp handling for Android 8

Release 21 - March 14, 2020

• Add support for more devices
• Fix seccomp on 3.18 arm kernels

Release 20 - Dec 28, 2019

• Add support for MT6580
• Add support for some MT8183 versions
• Fix handling of some 32-bit 4.x kernels with stack protection
• Move to NDK build

Release 19 - October 20, 2019

• Add -Z option for setting custom selinux context
• Fix seccomp on armv7
• Fix seccomp handling on late-revision 3.18 kernels
• Improve error printing for critical failures
• Strip supplementary groups in root shell
• Do not spawn root shell on critical failures

Release 18 - July 29, 2019

• Add support for kernel address space layout randomization (KASLR)
• Change status output format

Release 17 - July 13, 2019

• Fix missing capabilities under adb shell in Android 9.x
• Disable seccomp in app mode of Android 9.x
• Add support for MT6771 on Android 8.x
• Reliability improvements

Release 16 - June 9, 2019

• Add support for 32 & 64-bit kernels compiled with CONFIG_KALLSYMS_BASE_RELATIVE
• Add support for MT676x on Android 7.x
• Speedups

Release 15 - May 29, 2019

• Run shell/command in global mount namespace -- mounting from apps is now visible to the whole system

Release 14 - May 22, 2019

• Remove restriction for adb shell initial run on Android 8.0+
• Add support for 32-bit kernels compiled under Android 8.0+
• Add initial support for MT6771 on Android 9+
• Minor bug fixes

Release 13 - May 16, 2019

• Improve stack protection detection -- add support for some armv7-kernel 3.x phones

Release 12 - April 26, 2019

• Unify the arm and armv7-kernel binaries into one
• Support Linux 4.9.x
• Improve speed and possibly reliability
• Fix arm64 support for phones on kernel 3.10.65
• Fix stack protection workaround for armv7 kernels
• Update readme file

Release 11 - April 10, 2019

• Fix up and enable rooting for 32-bit kernels -- first such device confirmed (thanks @anthonykb)
• Improve criteria for detecting strong stack protection

Release 10 - April 7, 2019

• Fix support for the latest Oreo devices
• Add compatibility for kernels with stack protection (Nokia phones)
• Improve reliability
• Initial support for 32-bit (armv7) kernels -- needs testing

Release 9 - April 1, 2019

• Confirmed support for at least some Oreo devices
• Fix bugs with R8

Release 8 - March 30, 2019 (REMOVED)

• Lay the groundwork for Oreo devices
• Improve performance
• Improve reliability

Release 7 - March 17, 2019

• Add/fix support for many Linux ver. ≤ 3.18.22 devices
• Fix arm binary on Fire HD 10

Release 6 - March 13, 2019

• Add support for some devices with kernel 4.4.x (MT8167 confirmed by @cybersaga)
• Minor bug fixes

Release 5 - March 7, 2019

• Support kernels with CONFIG_KALLSYMS_ALL disabled
• Improve reliability

Release 4 - March 4, 2019

• Improve compatibility with phones
• Support Fire TV 2 new FW
• Minor bug fixes
• Improve reliability

Release 3 - March 1, 2019

• Add support for HD 10 7th gen
• Add support for 3.10 kernel layout
• Add possible support for MT67xx phones
• Improve reliability

Release 2 - Feb. 27, 2019

• Add support for HD 8 8th gen and 32-bit only user stacks

FAQ​

I got the error, "This firmware cannot be supported". What's up with that?
This means that your device's firmware is not prone to the mechanism used by mtk-su. It may be a new device or it may have started from a firmware update. It will not be feasible to add root support for the current or future firmware versions. Check the last supported firmware version in post 4. If the last working FW is not listed and your device used to work with mtk-su, please report the last working version and/or your current version. In those cases, it may be possible to get mtk-su support by downgrading the firmware.

I got the error, "Firmware support not implemented". What gives?
That means that mtk-su does not recognize the type of firmware on your device. While It's technically possible to add basic detection, most of the time this error happens on devices that have already blocked mtk-su access. So implementing it would only kick the can down the road and probably lead to a, "This firmware cannot be supported" message (see above). If your device has Android 10+ or a security patch level at 03-2020 or higher, or if your firmware is newer than the last compatible version in post 4, there is no need to report this error.

Will this work on my phone?
Yes, it will work on your phone, unless it doesn't. But to be serious, there is no point in asking this question. If you have the device in hand, it is much quicker to just try out the above procedure than to wait for a response. You are usually the best person to answer that question. If your device is listed among the confirmed models or, to a lesser extent, your chipset is supported, that's a good indication that mtk-su will succeed, but that is not guaranteed. You should report your success or failure in this thread, along with the requested materials if it fails.

Why don't you reply to my post?
I read every post in this thread, and respond to practically every post that warrants a response. Sometimes I will only click a Thanks as an acknowledgement. The reasons I may not answer your question are:

• It has already been answered in the FAQ or multiple times in the thread.
• Your post is unrelated to this project. It may be specific to your device, which would make it off topic for this thread.
• Your question is extremely vague and you appear to be intentionally leaving out basic information (e.g. fishing).

After getting a root shell I'm still getting 'permission denied' errors. WTH?
It may be that selinux is still being enforced. Having root with selinux enabled somehow ends up being more restrictive than a normal shell user. First, check that mtk-su succeeded in setting selinux to permissive by running getenforce. If it says Enforcing, then exit your shell and run mtk-su again.

Will this work on an MT65xx or MT8127?
There is no support for most 32-bit chips. But there may be a couple where it's possible.

Does this thing unlock the bootloader?
No, it does nothing to unlock the bootloader.

I ran mtk-su successfully, but my apps still don't have root permissions.
Mtk-su does not give apps root permissions. It is not a permanent root solution in and of itself. It opens a command shell that has root and administrative capabilities within the context of that shell. It's up to you what you want to do with it. But also, there is a way to load Magisk using this tool without the need to unlock your bootloader. Just follow this guide.

How does this tool work?
It overwrites the process credentials & capabilities in the kernel in order to gain privileges. It also turns off selinux enforcement by overwriting the kernel's selinux_enforcing variable. As for how it accesses that memory, the tool involves making use of the vulnerability known as CVE-2020-0069.

Can I include mtk-su in my app or meta-tool?
Generally speaking, you may not distribute any mtk-su zip or binaries with your software. That includes doing any automatic download of those files into your app. You can still use it with your tools. But you should ask your users to visit this thread and download the current release zip themselves. No apps have been permitted to bundle or auto-download mtk-su.

CREDITS​

• Thank you to everyone who has tested and provided feedback to help me add support for the large variety of MTK-based devices out there. There are simply too many people to list.
• MediaTek, Inc., que deixam buracos e backdoors em seu SO para tornar um software como este possível :bom:
• Thank you to everyone who has donated. You're the best!

Motorola Moto G8 Power Lite (blackjack) the following error appears in step 7:
Someone to help me?

 

[silentashes]

Anybody have a cpu- compatible version of mtk su still they can share or DM?
8.1.0 GO
Security Patch level April 2019
ARMv7 Processor rev 5 (v7l)
Board: VLE5

DROID INFO REPORT


DEVICE
Model: VLE5 (Poblano)
Manufacturer: Hot Pepper Inc
Baseband Version: MPSS.JO.3.0-00429-8909_GEN_PACK-1
RIL Version: Qualcomm RIL 1.0
Build Number: HPP-VLE5190413
Build Fingerprint: HotPepper/Poblano/VLE5:8.1.0/OPM1.171019.011/30:user/release-keys
Bootloader: unknown
Java VM: ART 2.1.0
OS Version: O MR1 (8.1.0)
SDK: 27

DISPLAY
Resolution: FWVGA, 480x854 pixels
Software Density: 204 dpi
Refresh Rate: 60 Hz

PROCESSOR
CPU Architecture: ARMv7 Processor rev 5 (v7l)
Board: VLE5
Chipset: Qualcomm Technologies, Inc MSM8909
Cores: 4
Clock Speed: 1094 MHz - 1094 MHz
Instruction Sets: armeabi-v7a, armeabi
CPU Features: half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm
CPU Governor: interactive
Kernel Version: 3.18.71-perf
Kernel Architecture: armv7l

GRAPHICS
Renderer: Adreno (TM) 304
Vendor: Qualcomm
OpenGL Version: OpenGL ES 3.0

RAM
Total: 894 MB
Java Heap: 96 MB

STORAGE
Internal: 5.2 GB
EXTERNAL: Not Detected

FEATURES
Bluetooth: Yes
Bluetooth LE: Yes
GPS: Yes
NFC: No
USB Accessory: Yes
WiFi: Yes
WiFi Direct: Yes

BATTERY
Technology:
Health: Good

SENSORS
stk8baxx-accel
txc_alsprx-proximity
txc_alsprx-light


Created by Droid Info

 

[AdamProgrammer]

.

 

[AdamProgrammer]

Hi,
I have this error code when I execute this on OPPO A5S CPH1909 ;

CPH1909:/data/local/tmp $ ./mtk-su -v
armv8l machine
Failed critical init step 1

Does someone knows what is the problem please?

 

[vayaviya]

Motorola Moto G8 Power Lite (blackjack) the following error appears in step 7:
Someone to help me?

I have the same error "Failed critical init step 1" with Vivo Y21. Any help pls.

 

[susetoyix]

[deleted]

 

[גלגל]

Up-to-date bootless root for Magisk 20+!
Get full root on a locked device with the current Magisk!​

This script uses mtk-su to launch Magisk on compatible devices, including locked down ones! It runs entirely from the data partition--no need to modify the firmware. Root is available for any app that wants it.

NEW FEATURES​

• MagiskHide & SafetyNet pass now work under Android 9​
• Modules pass minimum version check​
• Faster and more efficient loading​
• Logging works properly​

General warnings: Read this whole post before starting. Only use this on devices on which you can recover the firmware outside of Android such as recovery mode, download tool, etc. While precautions have been taken to block flashing of the boot partition, not everything has or can be accounted for. You must anticipate when a superuser action might alter your boot or system partitions and avoid doing that command. Do not try to update Magisk through Magisk Manager's Direct Install. Even though testing has shown that that feature will fail, it might succeed in some cases.

REQUIREMENTS
Mastery and comfort with using the Thanks button
A device compatible with mtk-su in app mode
Recent mtk-su from OP
Magisk v19.4 to v21.4 only (not compatible with 22.0+)
Magisk not installed on device

LIMITATIONS
Cannot modify boot partition unless bootloader is unlocked
Cannot modify system/vendor partitions unless boot partition is altered
Your mileage may vary with modules

INSTRUCTIONS​

1. Make sure you meet all the requirements, including the first one.​
2. Download and install the init.d scripts support app. Make sure this app gets installed on the internal storage, not the external SD. (Support the developer.)​
3. Make a folder named 'init.d' on your internal storage. Also make a 'bin' folder inside 'init.d'. Set up the init.d app up like this:
   

   • Try to acquire root privileges: unchecked
   • Run scripts at boot time: checked
   • Execution delay: No delay
   • Selected folder: /storage/emulated/0/init.d
   • Execute all files: unchecked
4. Remember that the folder structure has to be exactly as described, unless you manually edit the path in the script. You can also, in principle, use a different app if you want, but in that case you have to edit the package name path in the script as well.​
5. Download and install the latest Magisk Manager apk. Make sure this app is installed on the internal storage, not external SD.​
6. Download the current magisk-boot script, unzip it, and put magisk-boot.sh inside your /sdcard/init.d folder.​
7. Download the current mtk-su zip and put your appropriate mtk-su file in your /sdcard/init.d/bin folder.​
8. Download a Magisk zip package (19.4 to 21.4). Extract either arm/magiskinit64 or arm/magiskinit file and move/rename it to /sdcard/init.d/bin/magiskinit. (i.e. magiskinit64 should be renamed to magiskinit.) Pick one of 64-bit or 32-bit builds that corresponds to your kernel architecture. That is the only file you will need from that zip. (Support the developer.)
9. Now you should be ready to launch the Magisk core. Either reboot or tap 'Run scripts now'. The process will take a few seconds before telling you that 1 script has finished. If it ran successfully, last execution result will show something like this:
   

   Temporary root by [email protected]
   Home URL:
   https://forum.xda-developers.com/android/development/amazing-temp-root-mediatek-armv8-t3922213
   --------------------------------------------------
   /data/data/com.ryosoftware.initd/files/bin
   
   UID: 0 cap: 3fffffffff selinux: permissive
   Load policy from: /sys/fs/selinux/policy
   20.3:MAGISK (20300)
   client: launching new main daemon process

   On Android 9, you may see a 'Segmentation fault' if using v20.3+. This crash does not affect functionality. You can install v20.2 to avoid it.
   If you get a different result, then something may have gone wrong. Report problems here, except for errors about incompatible or unsupported platform.
10. At this point, you should be able to call 'su' or do a root request from an app and get a prompt.
11. When you open Magisk Manager, it will prompt you with Requires Additional Setup. On this window, you can tap Yes. This is safe.
12. לעולם אל תנסה לבצע עדכון Magisk התקנה ישירה במכשיר נעול. כדי לעדכן את Magisk, עשה זאת באופן ידני. כל שעליך לעשות הוא להוריד את החבילה האחרונה Magisk ולחלץ קובץ magiskinit(64) שלה לספריה init.d/bin.​
13. אם אתה משדרג משיטת suboot הישנה של Magisk 18.x, ייתכן שיהיה עליך לנקות את ספריית /data/adb שלך במעטפת בסיס זמנית לפני שהמודולים יפעלו.​

הורדה (עודכן 2020-04-02)​

מג'יק-אתחול.zip

שאלות נפוצות
אפליקציית init.d שלי אינה מופעלת בזמן האתחול
ייתכן ש- OS שלך אינו מאפשר לאפליקציה לפעול ברקע. מערכות הפעלה מסוימות אגרסיביות מדי בניהול אפליקציות רקע. חפש בהגדרות כל ניהול רקע או מיטוב סוללה או תכונות דומות, והשבת אותם עבור האפליקציה init.d. אותו ציתות יכול להועיל למנהל מג'יק.

מודולי Magisk שלי לא ייטענו כראוי. מה קורה?
שיטה זו יכולה להפעיל את root רק לאחר שהאפליקציה init.d מופעלת ומפעילה את קובץ ה- Script. זה מאוחר במחזור האתחול. עד לנקודה זו, השורש אינו זמין. למרבה הצער, מודולי Magisk רבים צריכים להיות נטענים בשלב מוקדם בתהליך האתחול כדי לעבוד כראוי. אני לא חושב שיש הרבה מה לעשות בקשר לזה. (אולי אתחול חם יעזור, אבל זה יגרום לבעיות משלו.)

האם ניתן לשנות או לחדש את קובץ ה- Script של אתחול המג'יק ולהפיץ אותו?
כן, בהחלט. אתה יכול לעשות מה שאתה רוצה עם magisk-boot.sh. עם זאת, אינך רשאי להפיץ את ה- zip או הבינארי של mtk-su. במקום זאת, בקש מהמשתמשים שלך להוריד את המהדורה האחרונה מהליך משנה זה.​

Works great on soyes xs 12
you're huge

 

[ToxaMacTep]

Huawei GR3 (TAG-L21) - works!

 

[Skorpion96]

i really hope someone does a similar method for unisoc devices.

 

[Bom jonas]

 

[sketchscarz]

/data/user/0/juniojsv.mtk.easy.su/files/magisk-boot.sh[124]: ./mtk-su: Permission denied
exit: 1

This is the result I get on my revvl v tmrvl4g

 

[Biggie_still]

I'm guessing this won't work on vivo devices running Android 5.1

 

[Biggie_still]

Mtk-easy-su 2.1.0
extracted magisk-boot.sh
extracted 32/magiskinit
extracted 64/magiskinit
extracted 32/mtk-su
extracted 64/mtk-su
[0]

[0] 5.1

[0] Thu May 5 18:07:23 WAT 2022

[1] ls: Unknown option '-1'. Aborting.

[0] Processor : AArch64 Processor rev 2 (aarch64)
processor : 4
BogoMIPS : 26.00
Features : fp asimd aes pmull sha1 sha2 crc32
CPU implementer : 0x41
CPU architecture: AArch64
CPU variant : 0x0
CPU part : 0xd03
CPU revision : 2
processor : 5
BogoMIPS : 26.00
Features : fp asimd aes pmull sha1 sha2 crc32
CPU implementer : 0x41
CPU architecture: AArch64
CPU variant : 0x0
CPU part : 0xd03
CPU revision : 2

Hardware : MT6750

[0] MemTotal: 2827584 kB
MemFree: 43256 kB
Buffers: 7496 kB
Cached: 683148 kB
SwapCached: 2572 kB
Active: 1495052 kB
Inactive: 634876 kB
Active(anon): 1156652 kB
Inactive(anon): 297292 kB
Active(file): 338400 kB
Inactive(file): 337584 kB
Unevictable: 11100 kB
Mlocked: 48 kB
SwapTotal: 524284 kB
SwapFree: 52528 kB
Dirty: 960 kB
Writeback: 0 kB
AnonPages: 1448568 kB
Mapped: 495200 kB
Shmem: 3512 kB
Slab: 138412 kB
SReclaimable: 58288 kB
SUnreclaim: 80124 kB
KernelStack: 57168 kB
PageTables: 51540 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 1938076 kB
Committed_AS: 60463900 kB
VmallocTotal: 251658176 kB
VmallocUsed: 784344 kB
VmallocChunk: 250780928 kB

Error running exec(). Command: [free] Working Directory: null Environment: null[0] Linux version 3.10.72+ ([email protected]) (gcc version 4.9 20140514 (mtk-20150408) (GCC) ) #1 SMP PREEMPT Wed Apr 21 21:42:06 CST 2021

[1] /data/data/juniojsv.mtk.easy.su/files/magisk-boot.sh[13]: dirname: not found
/data/data/juniojsv.mtk.easy.su/files/magisk-boot.sh[113]: cd: /64: No such file or directory

deleted magisk-boot.sh
deleted 32/magiskinit
deleted 64/magiskinit
deleted 32/mtk-su
deleted 64/mtk-su

 

[Biggie_still]

Can't acquire root privileges (May 5 at 6:06:20 PM)



Executing scripts from /storage/emulated/0/init.d (May 5 at 6:06:20 PM)



magisk-boot.sh

Temporary root by [email protected]
Home URL:

Amazing Temp Root for MediaTek ARMv8 [2020-08-24]

Software root method for MediaTek MT67xx, MT816x, and MT817x! So it's no big secret that not too long ago, I found a way to achieve temporary root on MediaTek chipsets. No preinstalled root solution or device unlock was needed. The tool I...

forum.xda-developers.com

--------------------------------------------------

cmp: invalid option -- s
cmp: invalid option -s
cmp: invalid option -- s
cmp: invalid option -s
0000000000000000 is not a valid address
UID: 10012 cap: 0000000000 selinux: permissive
/system/bin/sh: [33]: [: gid=10012(u0_a12): unexpected operator/operand
Unable to chmod /sys/dev/block/179:20/uevent: Operation not permitted
Load policy from: /sys/fs/selinux/policy
open: /sys/fs/selinux/load failed with 13: Permission denied
mount: Operation not permitted
Unable to chmod /root: Read-only file system
ln: /sbin/*: Permission denied
Error making /sbin hardlinks
setenforce: Could not set enforcing status: Permission denied

 

[Biggie_still]

Any help

 

[phigan]

Umidigi X with MT6771V no worky. Failed critical init step 4. This is Android 9 and security patch level Aug 5, 2019. Kernel version is somehow 4.4.146+ from May 9 2020. Build number is UMIDIGI_X_V1.0_20190912.

 

[catapult1]

Thanks! It works on Cubot Rainbow 2 (MT6580A)

mtk-su version: r23 arm
Android version: 7.0
Security patch: 5 February 2017
Build: CUBOT_RAINBOW 2_7021C_V04_20170221

 

[catapult1]

Confirmed working on Oukitel K6000 Pro (MT6753)

mtk-su version: r23 arm64
Android version: 6.0
Security patch: 5 October 2016
Build: OUKITEL_K6000_Pro_FZ_V12_20161129

 

[likwidchz]

Hiya everyone,

I'm having a weird time trying this. I have two tablets,
Tablet 1 = firmware 5.3.7.0 Nov 17th 650601220
Tablet 2 = firmware5.6.6.0 May 14th 654620620

I'm trying to execute the mtk-su exploit. Ive tried the R22 and R23 releases and all of them spit out
Both of the tablets do exactly the same thing, see the output below.


[email protected]:/usr/src/suez/amonet/r22/arm64$ adb push mtk-su /data/local/tmp
mtk-su: 1 file pushed. 3.7 MB/s (65216 bytes in 0.017s)
[email protected]:/usr/src/suez/amonet/r22/arm64$ adb shell
[email protected]:/ $ cd data/local/tmp
[email protected]:/data/local/tmp $ chmod 755 mtk-su
[email protected]:/data/local/tmp $ ./mtk-su
Failed critical init step 4
1|[email protected]:/data/local/tmp $


What's the scoop with the exploit? Let me know if I'm doing something weird.

Thank you,
Take care.