Amazing Temp Root for MediaTek ARMv8 [2020-08-24]

agudelo2543 · May 21, 2021

Vivo v15 mt6771
Failed critical init step 1

#help

iulianhotshot · May 28, 2021

I tried to run those commands but it doesn't work for MT6771 (Elephone U5).
The message is: "Failed critical init step 4. Firmware support not implemented".
Any suggestion, please?

diplomatic said:
Software root method for MediaTek MT67xx, MT816x, and MT817x!

So it's no big secret that not too long ago, I found a way to achieve temporary root on MediaTek chipsets. No preinstalled root solution or device unlock was needed. The tool I created, MTK-SU, was originally aimed at helping Amazon Fire HD owners to easily root and unlock their tablets. (Without it, most models need a hardware mod to achieve root & unlock. This tool made rooting accessible to many times the number of owners. It also made possible to root the Fire TV gen 2.) But funny story: this method actually works on virtually all of MediaTek's 64-bit chips. Many devices of various vendors have already been confirmed.

So in case it's not clear, what mtk-su does is give you a root shell to do with as you please. It's like running 'su', but without the need to have su installed. That may be a holy grail for locked devices. On some devices, it may be possible to install a root manager for permanent root using mtk-su as a springboard.

The original thread is here: Rapid Temporary Root for HD 8 & HD 10. It's a great resource for info. But please avoid posting there about non-Amazon devices. This new thread is a catchall topic for other devices and vendors.

DISCLAIMER
Anything you do that is described in this thread is at your own risk. No one else is responsible for any data loss, corruption or damage of your device, including that which results from bugs in this software. There is a nonzero chance of any of these events happening as a result of using the tools or methods here.

REQUIREMENTS
Mastery of the Thanks button under XDA posts
A phone or tablet based on Mediatek MT67xx, MT816x, MT817x or MT6580 chipsets
Either:

A PC with ADB installed to interact with your device, or

A terminal emulator app

Familiarity with ADB (if using PC) and basic Linux shell commands
You agree to post the model name of any unconfirmed device which ran mtk-su successfully

INSTRUCTIONS FOR ADB

Make sure you meet all the requirements listed above, especially the first and last ones.

Download the current mtk-su zip file to your PC and unzip it. Inside will be 2 directories: 'arm' & 'arm64' with an 'mtk-su' binary in each. Pick one for your device. Differences between the flavors:
arm64: 64-bit kernel and userspace
arm: 32-bit userspace on a 64-bit or 32-bit kernel (will also work in 64-bit userspace)

Connect your device to ADB and push mtk-su to your /data/local/tmp folder
adb push path/to/mtk-su /data/local/tmp/

Open an adb shell
adb shell

Change to your tmp directory
cd /data/local/tmp

Add executable permissions to the binary
chmod 755 mtk-su

At this point keep your device screen on and don't let it go to sleep. Run the command
./mtk-su
It should only take a second or two. If the program gets stuck for more than a few seconds and your device is awake, press Ctrl+C to close it.
The -v option turns on verbose printing, which is necessary for me to debug any problems.
The output of ./mtk-su -v is similar to this:

Code:

$ ./mtk-su -v param1: 0x3000, param2: 0x18040, type: 2 Building symbol table kallsyms_addresses pa 0x40bdd500 kallsyms_num_syms 70337, addr_count 70337 kallsyms_names pa 0x40c66d00, size 862960 kallsyms_markers pa 0x40d39800 kallsyms_token_table pa 0x40d3a100 kallsyms_token_index pa 0x40d3a500 Patching credentials Parsing current_is_single_threaded ffffffc000354868+50: ADRP x0, 0xffffffc000fa2000 ffffffc000354868+54: ADD xd, x0, 2592 init_task VA: 0xffffffc000fa2a20 Potential list_head tasks at offset 0x340 comm swapper/0 at offset 0x5c0 Found own task_struct at node 1 cred VA: 0xffffffc0358ac0c0 Parsing avc_denied ffffffc0002f13bc+24: ADRP x0, 0xffffffc001113000 ffffffc0002f13bc+28: LDR [x0, 404] selinux_enforcing VA: 0xffffffc001113194 Setting selinux_enforcing Switched selinux to permissive starting /system/bin/sh UID: 0 cap: 3fffffffff selinux: permissive #

Some other options:

mtk-su -c <command>: Runs <command> as root. Default command is /system/bin/sh.
mtk-su -s: Prints the kernel symbol table
mtk-su -Z <context>: Runs shell in a new selinux context. Example: ./mtk-su -Z u:r:logd:s0
If you see any errors other than about unsupported or incompatible platform or don't get a root shell, report it here. When reporting a problem with a device, please post a link to the firmware and/or the kernel sources.

Please post the model of any device that works with mtk-su that's not already confirmed.

Important: in rare cases, it may be necessary to run the tool multiple times before you hit UID 0 and get selinux permissive. If you don't achieve root on a particular run, the "UID: N cap: xxxxx...." line will reflect that. If it doesn't say "UID: 0 cap: 3fffffffff selinux: permissive", type exit to close the subshell and try mtk-su again.

WARNING If you have a device with Android 6 or higher, it likely has dm-verity enabled. On such a device one does not simply remount the system partition as read/write. The remount command will probably fail. But if you succeed in forcing it somehow it will trigger dm-verity, which will result in a very bad day. Your device will become inoperable until you restore the stock system partition.

DOWNLOAD
Current Version
Release 23

Release 23 - August 24, 2020

Add support for some early Linux 3.10 tablet firmware

Add support for kernels with some debug features enabled

Release 22 - May 8, 2020

Expand kernel support

Enable seccomp handling for Android 8

Release 21 - March 14, 2020

Add support for more devices

Fix seccomp on 3.18 arm kernels

Release 20 - Dec 28, 2019

Add support for MT6580

Add support for some MT8183 versions

Fix handling of some 32-bit 4.x kernels with stack protection

Move to NDK build

Release 19 - October 20, 2019

Add -Z option for setting custom selinux context

Fix seccomp on armv7

Fix seccomp handling on late-revision 3.18 kernels

Improve error printing for critical failures

Strip supplementary groups in root shell

Do not spawn root shell on critical failures

Release 18 - July 29, 2019

Add support for kernel address space layout randomization (KASLR)

Change status output format

Release 17 - July 13, 2019

Fix missing capabilities under adb shell in Android 9.x

Disable seccomp in app mode of Android 9.x

Add support for MT6771 on Android 8.x

Reliability improvements

Release 16 - June 9, 2019

Add support for 32 & 64-bit kernels compiled with CONFIG_KALLSYMS_BASE_RELATIVE

Add support for MT676x on Android 7.x

Speedups

Release 15 - May 29, 2019

Run shell/command in global mount namespace -- mounting from apps is now visible to the whole system

Release 14 - May 22, 2019

Remove restriction for adb shell initial run on Android 8.0+

Add support for 32-bit kernels compiled under Android 8.0+

Add initial support for MT6771 on Android 9+

Minor bug fixes

Release 13 - May 16, 2019

Improve stack protection detection -- add support for some armv7-kernel 3.x phones

Release 12 - April 26, 2019

Unify the arm and armv7-kernel binaries into one

Support Linux 4.9.x

Improve speed and possibly reliability

Fix arm64 support for phones on kernel 3.10.65

Fix stack protection workaround for armv7 kernels

Update readme file

Release 11 - April 10, 2019

Fix up and enable rooting for 32-bit kernels -- first such device confirmed (thanks @anthonykb)

Improve criteria for detecting strong stack protection

Release 10 - April 7, 2019

Fix support for the latest Oreo devices

Add compatibility for kernels with stack protection (Nokia phones)

Improve reliability

Initial support for 32-bit (armv7) kernels -- needs testing

Release 9 - April 1, 2019

Confirmed support for at least some Oreo devices

Fix bugs with R8

Release 8 - March 30, 2019 (REMOVED)

Lay the groundwork for Oreo devices

Improve performance

Improve reliability

Release 7 - March 17, 2019

Add/fix support for many Linux ver. ≤ 3.18.22 devices

Fix arm binary on Fire HD 10

Release 6 - March 13, 2019

Add support for some devices with kernel 4.4.x (MT8167 confirmed by @cybersaga)

Minor bug fixes

Release 5 - March 7, 2019

Support kernels with CONFIG_KALLSYMS_ALL disabled

Improve reliability

Release 4 - March 4, 2019

Improve compatibility with phones

Support Fire TV 2 new FW

Minor bug fixes

Improve reliability

Release 3 - March 1, 2019

Add support for HD 10 7th gen

Add support for 3.10 kernel layout

Add possible support for MT67xx phones

Improve reliability

Release 2 - Feb. 27, 2019

Add support for HD 8 8th gen and 32-bit only user stacks

FAQ
I got the error, "This firmware cannot be supported". What's up with that?
This means that your device's firmware is not prone to the mechanism used by mtk-su. It may be a new device or it may have started from a firmware update. It will not be feasible to add root support for the current or future firmware versions. Check the last supported firmware version in post 4. If the last working FW is not listed and your device used to work with mtk-su, please report the last working version and/or your current version. In those cases, it may be possible to get mtk-su support by downgrading the firmware.

I got the error, "Firmware support not implemented". What gives?
That means that mtk-su does not recognize the type of firmware on your device. While It's technically possible to add basic detection, most of the time this error happens on devices that have already blocked mtk-su access. So implementing it would only kick the can down the road and probably lead to a, "This firmware cannot be supported" message (see above). If your device has Android 10+ or a security patch level at 03-2020 or higher, or if your firmware is newer than the last compatible version in post 4, there is no need to report this error.

Will this work on my phone?
Yes, it will work on your phone, unless it doesn't. But to be serious, there is no point in asking this question. If you have the device in hand, it is much quicker to just try out the above procedure than to wait for a response. You are usually the best person to answer that question. If your device is listed among the confirmed models or, to a lesser extent, your chipset is supported, that's a good indication that mtk-su will succeed, but that is not guaranteed. You should report your success or failure in this thread, along with the requested materials if it fails.

Why don't you reply to my post?
I read every post in this thread, and respond to practically every post that warrants a response. Sometimes I will only click a Thanks as an acknowledgement. The reasons I may not answer your question are:

It has already been answered in the FAQ or multiple times in the thread.

Your post is unrelated to this project. It may be specific to your device, which would make it off topic for this thread.

Your question is extremely vague and you appear to be intentionally leaving out basic information (e.g. fishing).

After getting a root shell I'm still getting 'permission denied' errors. WTH?
It may be that selinux is still being enforced. Having root with selinux enabled somehow ends up being more restrictive than a normal shell user. First, check that mtk-su succeeded in setting selinux to permissive by running getenforce. If it says Enforcing, then exit your shell and run mtk-su again.

Will this work on an MT65xx or MT8127?
There is no support for most 32-bit chips. But there may be a couple where it's possible.

Does this thing unlock the bootloader?
No, it does nothing to unlock the bootloader.

I ran mtk-su successfully, but my apps still don't have root permissions.
Mtk-su does not give apps root permissions. It is not a permanent root solution in and of itself. It opens a command shell that has root and administrative capabilities within the context of that shell. It's up to you what you want to do with it. But also, there is a way to load Magisk using this tool without the need to unlock your bootloader. Just follow this guide.

How does this tool work?
It overwrites the process credentials & capabilities in the kernel in order to gain privileges. It also turns off selinux enforcement by overwriting the kernel's selinux_enforcing variable. As for how it accesses that memory, the tool involves making use of the vulnerability known as CVE-2020-0069.

Can I include mtk-su in my app or meta-tool?
Generally speaking, you may not distribute any mtk-su zip or binaries with your software. That includes doing any automatic download of those files into your app. You can still use it with your tools. But you should ask your users to visit this thread and download the current release zip themselves. No apps have been permitted to bundle or auto-download mtk-su.

CREDITS

Thank you to everyone who has tested and provided feedback to help me add support for the large variety of MTK-based devices out there. There are simply too many people to list.

MediaTek, Inc., who leave holes and backdoors in their OS to make software like this possible :good:

Thank you to everyone who has donated. You're the best

AlphaGB · May 31, 2021

diplomatic said:
Up-to-date bootless root for Magisk 20+!
Get full root on a locked device with the current Magisk!

This script uses mtk-su to launch Magisk on compatible devices, including locked down ones! It runs entirely from the data partition--no need to modify the firmware. Root is available for any app that wants it.

NEW FEATURES

MagiskHide & SafetyNet pass now work under Android 9

Modules pass minimum version check

Faster and more efficient loading

Logging works properly

General warnings: Read this whole post before starting. Only use this on devices on which you can recover the firmware outside of Android such as recovery mode, download tool, etc. While precautions have been taken to block flashing of the boot partition, not everything has or can be accounted for. You must anticipate when a superuser action might alter your boot or system partitions and avoid doing that command. Do not try to update Magisk through Magisk Manager's Direct Install. Even though testing has shown that that feature will fail, it might succeed in some cases.

REQUIREMENTS
Mastery and comfort with using the Thanks button
A device compatible with mtk-su in app mode
Recent mtk-su from OP
Magisk v19.4 to v21.4 only (not compatible with 22.0+)
Magisk not installed on device

LIMITATIONS
Cannot modify boot partition unless bootloader is unlocked
Cannot modify system/vendor partitions unless boot partition is altered
Your mileage may vary with modules

INSTRUCTIONS

Make sure you meet all the requirements, including the first one.

Download and install the init.d scripts support app. Make sure this app gets installed on the internal storage, not the external SD. (Support the developer.)

Make a folder named 'init.d' on your internal storage. Also make a 'bin' folder inside 'init.d'. Set up the init.d app up like this:

Try to acquire root privileges: unchecked

Run scripts at boot time: checked

Execution delay: No delay

Selected folder: /storage/emulated/0/init.d

Execute all files: unchecked

Remember that the folder structure has to be exactly as described, unless you manually edit the path in the script. You can also, in principle, use a different app if you want, but in that case you have to edit the package name path in the script as well.

Download and install the latest Magisk Manager apk. Make sure this app is installed on the internal storage, not external SD.

Download the current magisk-boot script, unzip it, and put magisk-boot.sh inside your /sdcard/init.d folder.

Download the current mtk-su zip and put your appropriate mtk-su file in your /sdcard/init.d/bin folder.

Download a Magisk zip package (19.4 to 21.4). Extract either arm/magiskinit64 or arm/magiskinit file and move/rename it to /sdcard/init.d/bin/magiskinit. (i.e. magiskinit64 should be renamed to magiskinit.) Pick one of 64-bit or 32-bit builds that corresponds to your kernel architecture. That is the only file you will need from that zip. (Support the developer.)

Now you should be ready to launch the Magisk core. Either reboot or tap 'Run scripts now'. The process will take a few seconds before telling you that 1 script has finished. If it ran successfully, last execution result will show something like this:

Code:

Temporary root by diplomatic@XDA Home URL: https://xdaforums.com/android/development/amazing-temp-root-mediatek-armv8-t3922213 -------------------------------------------------- /data/data/com.ryosoftware.initd/files/bin UID: 0 cap: 3fffffffff selinux: permissive Load policy from: /sys/fs/selinux/policy 20.3:MAGISK (20300) client: launching new main daemon process

On Android 9, you may see a 'Segmentation fault' if using v20.3+. This crash does not affect functionality. You can install v20.2 to avoid it.
If you get a different result, then something may have gone wrong. Report problems here, except for errors about incompatible or unsupported platform.

At this point, you should be able to call 'su' or do a root request from an app and get a prompt.

When you open Magisk Manager, it will prompt you with Requires Additional Setup. On this window, you can tap Yes. This is safe.

Never try to do a direct-install Magisk Update on a locked device. To update Magisk, do so manually. Simply download the latest Magisk package and extract its magiskinit(64) file to the init.d/bin directory.

If upgrading from the old Magisk 18.x suboot method, you may need to clear your /data/adb directory in temp root shell before modules will work.

DOWNLOAD (UPDATED 2020-04-02)
magisk-boot.zip

FAQ
My init.d app does not start at boot time
It may be that your OS is not allowing the app to run in the background. Some OSs are too aggressive in managing background apps. Look in Settings for any background management or battery optimization or similar features, and disable them for the init.d app. The same tweak could benefit Magisk Manager.

My Magisk modules will not load properly. What is going on?
This method can only launch root after the init.d app starts up and runs the script. This is late in the boot cycle. Up to that point, root is not available. Unfortunately, many Magisk modules need to be loaded early in the boot process to work properly. I don't think there is much that can be done about that. (Perhaps a warm reboot would help, but that would cause problems of its own.)

Can I modify or reimplement the magisk-boot script and distribute it?
Yes, absolutely. You may do whatever you want with magisk-boot.sh. However, you may not distribute the mtk-su zip or binary. Instead, please ask your users to download the latest release from this thread.

Works well on LG K10 Power (m320tv) Thanks for mtk su!

vla-511411 · Jun 17, 2021

Hi @diplomatic,

TL;DR level Q:
Is the 'mtk-su' method of getting a bootloader-locked root now dead forever after a 2021MAY firmware updated ZTE pushed onto my ZTE Blade A7 Prime (w Mediatek MT6761 processor) ?

Long version:
Just a few days ago, I decided for the first time to root my ZTE Blade A7 Prime (Visible) phone. I searched up XDA-devels and came upon your post about the Magisk v21.4 installation using mtk-su and the magisk-boot.zip and that failed. Then I dug up more and came upon THIS thread about the mtk-su script to get the root prompt without having to unlock the bootloader. The 'mtk-su -v' fails with the following error:
" armv71 machine
Failed critical init step 1 "
I do note that on post # 1415 of this thread, you have stated that any firmware updates after 2020MAR *will* break this facility. I never had the option to turn OFF automatic "system updates" on my phone, so this should also be the case for many others.

So, the Q now is whether this 'mtk-su' method is dead for us? OR could you PLEASE REVIVE it somehow?

Pippoloness · Jun 24, 2021

diplomatic said:
Software root method for MediaTek MT67xx, MT816x, and MT817x!

So it's no big secret that not too long ago, I found a way to achieve temporary root on MediaTek chipsets. No preinstalled root solution or device unlock was needed. The tool I created, MTK-SU, was originally aimed at helping Amazon Fire HD owners to easily root and unlock their tablets. (Without it, most models need a hardware mod to achieve root & unlock. This tool made rooting accessible to many times the number of owners. It also made possible to root the Fire TV gen 2.) But funny story: this method actually works on virtually all of MediaTek's 64-bit chips. Many devices of various vendors have already been confirmed.

So in case it's not clear, what mtk-su does is give you a root shell to do with as you please. It's like running 'su', but without the need to have su installed. That may be a holy grail for locked devices. On some devices, it may be possible to install a root manager for permanent root using mtk-su as a springboard.

The original thread is here: Rapid Temporary Root for HD 8 & HD 10. It's a great resource for info. But please avoid posting there about non-Amazon devices. This new thread is a catchall topic for other devices and vendors.

DISCLAIMER
Anything you do that is described in this thread is at your own risk. No one else is responsible for any data loss, corruption or damage of your device, including that which results from bugs in this software. There is a nonzero chance of any of these events happening as a result of using the tools or methods here.

REQUIREMENTS
Mastery of the Thanks button under XDA posts
A phone or tablet based on Mediatek MT67xx, MT816x, MT817x or MT6580 chipsets
Either:

A PC with ADB installed to interact with your device, or

A terminal emulator app

Familiarity with ADB (if using PC) and basic Linux shell commands
You agree to post the model name of any unconfirmed device which ran mtk-su successfully

INSTRUCTIONS FOR ADB

Make sure you meet all the requirements listed above, especially the first and last ones.

Download the current mtk-su zip file to your PC and unzip it. Inside will be 2 directories: 'arm' & 'arm64' with an 'mtk-su' binary in each. Pick one for your device. Differences between the flavors:
arm64: 64-bit kernel and userspace
arm: 32-bit userspace on a 64-bit or 32-bit kernel (will also work in 64-bit userspace)

Connect your device to ADB and push mtk-su to your /data/local/tmp folder
adb push path/to/mtk-su /data/local/tmp/

Open an adb shell
adb shell

Change to your tmp directory
cd /data/local/tmp

Add executable permissions to the binary
chmod 755 mtk-su

At this point keep your device screen on and don't let it go to sleep. Run the command
./mtk-su
It should only take a second or two. If the program gets stuck for more than a few seconds and your device is awake, press Ctrl+C to close it.
The -v option turns on verbose printing, which is necessary for me to debug any problems.
The output of ./mtk-su -v is similar to this:

Code:

$ ./mtk-su -v param1: 0x3000, param2: 0x18040, type: 2 Building symbol table kallsyms_addresses pa 0x40bdd500 kallsyms_num_syms 70337, addr_count 70337 kallsyms_names pa 0x40c66d00, size 862960 kallsyms_markers pa 0x40d39800 kallsyms_token_table pa 0x40d3a100 kallsyms_token_index pa 0x40d3a500 Patching credentials Parsing current_is_single_threaded ffffffc000354868+50: ADRP x0, 0xffffffc000fa2000 ffffffc000354868+54: ADD xd, x0, 2592 init_task VA: 0xffffffc000fa2a20 Potential list_head tasks at offset 0x340 comm swapper/0 at offset 0x5c0 Found own task_struct at node 1 cred VA: 0xffffffc0358ac0c0 Parsing avc_denied ffffffc0002f13bc+24: ADRP x0, 0xffffffc001113000 ffffffc0002f13bc+28: LDR [x0, 404] selinux_enforcing VA: 0xffffffc001113194 Setting selinux_enforcing Switched selinux to permissive starting /system/bin/sh UID: 0 cap: 3fffffffff selinux: permissive #

Some other options:

mtk-su -c <command>: Runs <command> as root. Default command is /system/bin/sh.
mtk-su -s: Prints the kernel symbol table
mtk-su -Z <context>: Runs shell in a new selinux context. Example: ./mtk-su -Z u:r:logd:s0
If you see any errors other than about unsupported or incompatible platform or don't get a root shell, report it here. When reporting a problem with a device, please post a link to the firmware and/or the kernel sources.

Please post the model of any device that works with mtk-su that's not already confirmed.

Important: in rare cases, it may be necessary to run the tool multiple times before you hit UID 0 and get selinux permissive. If you don't achieve root on a particular run, the "UID: N cap: xxxxx...." line will reflect that. If it doesn't say "UID: 0 cap: 3fffffffff selinux: permissive", type exit to close the subshell and try mtk-su again.

WARNING If you have a device with Android 6 or higher, it likely has dm-verity enabled. On such a device one does not simply remount the system partition as read/write. The remount command will probably fail. But if you succeed in forcing it somehow it will trigger dm-verity, which will result in a very bad day. Your device will become inoperable until you restore the stock system partition.

DOWNLOAD
Current Version
Release 23

Release 23 - August 24, 2020

Add support for some early Linux 3.10 tablet firmware

Add support for kernels with some debug features enabled

Release 22 - May 8, 2020

Expand kernel support

Enable seccomp handling for Android 8

Release 21 - March 14, 2020

Add support for more devices

Fix seccomp on 3.18 arm kernels

Release 20 - Dec 28, 2019

Add support for MT6580

Add support for some MT8183 versions

Fix handling of some 32-bit 4.x kernels with stack protection

Move to NDK build

Release 19 - October 20, 2019

Add -Z option for setting custom selinux context

Fix seccomp on armv7

Fix seccomp handling on late-revision 3.18 kernels

Improve error printing for critical failures

Strip supplementary groups in root shell

Do not spawn root shell on critical failures

Release 18 - July 29, 2019

Add support for kernel address space layout randomization (KASLR)

Change status output format

Release 17 - July 13, 2019

Fix missing capabilities under adb shell in Android 9.x

Disable seccomp in app mode of Android 9.x

Add support for MT6771 on Android 8.x

Reliability improvements

Release 16 - June 9, 2019

Add support for 32 & 64-bit kernels compiled with CONFIG_KALLSYMS_BASE_RELATIVE

Add support for MT676x on Android 7.x

Speedups

Release 15 - May 29, 2019

Run shell/command in global mount namespace -- mounting from apps is now visible to the whole system

Release 14 - May 22, 2019

Remove restriction for adb shell initial run on Android 8.0+

Add support for 32-bit kernels compiled under Android 8.0+

Add initial support for MT6771 on Android 9+

Minor bug fixes

Release 13 - May 16, 2019

Improve stack protection detection -- add support for some armv7-kernel 3.x phones

Release 12 - April 26, 2019

Unify the arm and armv7-kernel binaries into one

Support Linux 4.9.x

Improve speed and possibly reliability

Fix arm64 support for phones on kernel 3.10.65

Fix stack protection workaround for armv7 kernels

Update readme file

Release 11 - April 10, 2019

Fix up and enable rooting for 32-bit kernels -- first such device confirmed (thanks @anthonykb)

Improve criteria for detecting strong stack protection

Release 10 - April 7, 2019

Fix support for the latest Oreo devices

Add compatibility for kernels with stack protection (Nokia phones)

Improve reliability

Initial support for 32-bit (armv7) kernels -- needs testing

Release 9 - April 1, 2019

Confirmed support for at least some Oreo devices

Fix bugs with R8

Release 8 - March 30, 2019 (REMOVED)

Lay the groundwork for Oreo devices

Improve performance

Improve reliability

Release 7 - March 17, 2019

Add/fix support for many Linux ver. ≤ 3.18.22 devices

Fix arm binary on Fire HD 10

Release 6 - March 13, 2019

Add support for some devices with kernel 4.4.x (MT8167 confirmed by @cybersaga)

Minor bug fixes

Release 5 - March 7, 2019

Support kernels with CONFIG_KALLSYMS_ALL disabled

Improve reliability

Release 4 - March 4, 2019

Improve compatibility with phones

Support Fire TV 2 new FW

Minor bug fixes

Improve reliability

Release 3 - March 1, 2019

Add support for HD 10 7th gen

Add support for 3.10 kernel layout

Add possible support for MT67xx phones

Improve reliability

Release 2 - Feb. 27, 2019

Add support for HD 8 8th gen and 32-bit only user stacks

FAQ
I got the error, "This firmware cannot be supported". What's up with that?
This means that your device's firmware is not prone to the mechanism used by mtk-su. It may be a new device or it may have started from a firmware update. It will not be feasible to add root support for the current or future firmware versions. Check the last supported firmware version in post 4. If the last working FW is not listed and your device used to work with mtk-su, please report the last working version and/or your current version. In those cases, it may be possible to get mtk-su support by downgrading the firmware.

I got the error, "Firmware support not implemented". What gives?
That means that mtk-su does not recognize the type of firmware on your device. While It's technically possible to add basic detection, most of the time this error happens on devices that have already blocked mtk-su access. So implementing it would only kick the can down the road and probably lead to a, "This firmware cannot be supported" message (see above). If your device has Android 10+ or a security patch level at 03-2020 or higher, or if your firmware is newer than the last compatible version in post 4, there is no need to report this error.

Will this work on my phone?
Yes, it will work on your phone, unless it doesn't. But to be serious, there is no point in asking this question. If you have the device in hand, it is much quicker to just try out the above procedure than to wait for a response. You are usually the best person to answer that question. If your device is listed among the confirmed models or, to a lesser extent, your chipset is supported, that's a good indication that mtk-su will succeed, but that is not guaranteed. You should report your success or failure in this thread, along with the requested materials if it fails.

Why don't you reply to my post?
I read every post in this thread, and respond to practically every post that warrants a response. Sometimes I will only click a Thanks as an acknowledgement. The reasons I may not answer your question are:

It has already been answered in the FAQ or multiple times in the thread.

Your post is unrelated to this project. It may be specific to your device, which would make it off topic for this thread.

Your question is extremely vague and you appear to be intentionally leaving out basic information (e.g. fishing).

After getting a root shell I'm still getting 'permission denied' errors. WTH?
It may be that selinux is still being enforced. Having root with selinux enabled somehow ends up being more restrictive than a normal shell user. First, check that mtk-su succeeded in setting selinux to permissive by running getenforce. If it says Enforcing, then exit your shell and run mtk-su again.

Will this work on an MT65xx or MT8127?
There is no support for most 32-bit chips. But there may be a couple where it's possible.

Does this thing unlock the bootloader?
No, it does nothing to unlock the bootloader.

I ran mtk-su successfully, but my apps still don't have root permissions.
Mtk-su does not give apps root permissions. It is not a permanent root solution in and of itself. It opens a command shell that has root and administrative capabilities within the context of that shell. It's up to you what you want to do with it. But also, there is a way to load Magisk using this tool without the need to unlock your bootloader. Just follow this guide.

How does this tool work?
It overwrites the process credentials & capabilities in the kernel in order to gain privileges. It also turns off selinux enforcement by overwriting the kernel's selinux_enforcing variable. As for how it accesses that memory, the tool involves making use of the vulnerability known as CVE-2020-0069.

Can I include mtk-su in my app or meta-tool?
Generally speaking, you may not distribute any mtk-su zip or binaries with your software. That includes doing any automatic download of those files into your app. You can still use it with your tools. But you should ask your users to visit this thread and download the current release zip themselves. No apps have been permitted to bundle or auto-download mtk-su.

CREDITS

Thank you to everyone who has tested and provided feedback to help me add support for the large variety of MTK-based devices out there. There are simply too many people to list.

MediaTek, Inc., who leave holes and backdoors in their OS to make software like this possible :good:

Thank you to everyone who has donated. You're the best!

Hi, i have get the access to the shell, but of i perform the command mtk-su, i get platform incompatible, i have a mtk6889, , model istituzionale i12pro

diplomatic said:
Software root method for MediaTek MT67xx, MT816x, and MT817x!

So it's no big secret that not too long ago, I found a way to achieve temporary root on MediaTek chipsets. No preinstalled root solution or device unlock was needed. The tool I created, MTK-SU, was originally aimed at helping Amazon Fire HD owners to easily root and unlock their tablets. (Without it, most models need a hardware mod to achieve root & unlock. This tool made rooting accessible to many times the number of owners. It also made possible to root the Fire TV gen 2.) But funny story: this method actually works on virtually all of MediaTek's 64-bit chips. Many devices of various vendors have already been confirmed.

So in case it's not clear, what mtk-su does is give you a root shell to do with as you please. It's like running 'su', but without the need to have su installed. That may be a holy grail for locked devices. On some devices, it may be possible to install a root manager for permanent root using mtk-su as a springboard.

The original thread is here: Rapid Temporary Root for HD 8 & HD 10. It's a great resource for info. But please avoid posting there about non-Amazon devices. This new thread is a catchall topic for other devices and vendors.

DISCLAIMER
Anything you do that is described in this thread is at your own risk. No one else is responsible for any data loss, corruption or damage of your device, including that which results from bugs in this software. There is a nonzero chance of any of these events happening as a result of using the tools or methods here.

REQUIREMENTS
Mastery of the Thanks button under XDA posts
A phone or tablet based on Mediatek MT67xx, MT816x, MT817x or MT6580 chipsets
Either:

A PC with ADB installed to interact with your device, or

A terminal emulator app

Familiarity with ADB (if using PC) and basic Linux shell commands
You agree to post the model name of any unconfirmed device which ran mtk-su successfully

INSTRUCTIONS FOR ADB

Make sure you meet all the requirements listed above, especially the first and last ones.

Download the current mtk-su zip file to your PC and unzip it. Inside will be 2 directories: 'arm' & 'arm64' with an 'mtk-su' binary in each. Pick one for your device. Differences between the flavors:
arm64: 64-bit kernel and userspace
arm: 32-bit userspace on a 64-bit or 32-bit kernel (will also work in 64-bit userspace)

Connect your device to ADB and push mtk-su to your /data/local/tmp folder
adb push path/to/mtk-su /data/local/tmp/

Open an adb shell
adb shell

Change to your tmp directory
cd /data/local/tmp

Add executable permissions to the binary
chmod 755 mtk-su

At this point keep your device screen on and don't let it go to sleep. Run the command
./mtk-su
It should only take a second or two. If the program gets stuck for more than a few seconds and your device is awake, press Ctrl+C to close it.
The -v option turns on verbose printing, which is necessary for me to debug any problems.
The output of ./mtk-su -v is similar to this:

Code:

$ ./mtk-su -v param1: 0x3000, param2: 0x18040, type: 2 Building symbol table kallsyms_addresses pa 0x40bdd500 kallsyms_num_syms 70337, addr_count 70337 kallsyms_names pa 0x40c66d00, size 862960 kallsyms_markers pa 0x40d39800 kallsyms_token_table pa 0x40d3a100 kallsyms_token_index pa 0x40d3a500 Patching credentials Parsing current_is_single_threaded ffffffc000354868+50: ADRP x0, 0xffffffc000fa2000 ffffffc000354868+54: ADD xd, x0, 2592 init_task VA: 0xffffffc000fa2a20 Potential list_head tasks at offset 0x340 comm swapper/0 at offset 0x5c0 Found own task_struct at node 1 cred VA: 0xffffffc0358ac0c0 Parsing avc_denied ffffffc0002f13bc+24: ADRP x0, 0xffffffc001113000 ffffffc0002f13bc+28: LDR [x0, 404] selinux_enforcing VA: 0xffffffc001113194 Setting selinux_enforcing Switched selinux to permissive starting /system/bin/sh UID: 0 cap: 3fffffffff selinux: permissive #

Some other options:

mtk-su -c <command>: Runs <command> as root. Default command is /system/bin/sh.
mtk-su -s: Prints the kernel symbol table
mtk-su -Z <context>: Runs shell in a new selinux context. Example: ./mtk-su -Z u:r:logd:s0
If you see any errors other than about unsupported or incompatible platform or don't get a root shell, report it here. When reporting a problem with a device, please post a link to the firmware and/or the kernel sources.

Please post the model of any device that works with mtk-su that's not already confirmed.

Important: in rare cases, it may be necessary to run the tool multiple times before you hit UID 0 and get selinux permissive. If you don't achieve root on a particular run, the "UID: N cap: xxxxx...." line will reflect that. If it doesn't say "UID: 0 cap: 3fffffffff selinux: permissive", type exit to close the subshell and try mtk-su again.

WARNING If you have a device with Android 6 or higher, it likely has dm-verity enabled. On such a device one does not simply remount the system partition as read/write. The remount command will probably fail. But if you succeed in forcing it somehow it will trigger dm-verity, which will result in a very bad day. Your device will become inoperable until you restore the stock system partition.

DOWNLOAD
Current Version
Release 23

Release 23 - August 24, 2020

Add support for some early Linux 3.10 tablet firmware

Add support for kernels with some debug features enabled

Release 22 - May 8, 2020

Expand kernel support

Enable seccomp handling for Android 8

Release 21 - March 14, 2020

Add support for more devices

Fix seccomp on 3.18 arm kernels

Release 20 - Dec 28, 2019

Add support for MT6580

Add support for some MT8183 versions

Fix handling of some 32-bit 4.x kernels with stack protection

Move to NDK build

Release 19 - October 20, 2019

Add -Z option for setting custom selinux context

Fix seccomp on armv7

Fix seccomp handling on late-revision 3.18 kernels

Improve error printing for critical failures

Strip supplementary groups in root shell

Do not spawn root shell on critical failures

Release 18 - July 29, 2019

Add support for kernel address space layout randomization (KASLR)

Change status output format

Release 17 - July 13, 2019

Fix missing capabilities under adb shell in Android 9.x

Disable seccomp in app mode of Android 9.x

Add support for MT6771 on Android 8.x

Reliability improvements

Release 16 - June 9, 2019

Add support for 32 & 64-bit kernels compiled with CONFIG_KALLSYMS_BASE_RELATIVE

Add support for MT676x on Android 7.x

Speedups

Release 15 - May 29, 2019

Run shell/command in global mount namespace -- mounting from apps is now visible to the whole system

Release 14 - May 22, 2019

Remove restriction for adb shell initial run on Android 8.0+

Add support for 32-bit kernels compiled under Android 8.0+

Add initial support for MT6771 on Android 9+

Minor bug fixes

Release 13 - May 16, 2019

Improve stack protection detection -- add support for some armv7-kernel 3.x phones

Release 12 - April 26, 2019

Unify the arm and armv7-kernel binaries into one

Support Linux 4.9.x

Improve speed and possibly reliability

Fix arm64 support for phones on kernel 3.10.65

Fix stack protection workaround for armv7 kernels

Update readme file

Release 11 - April 10, 2019

Fix up and enable rooting for 32-bit kernels -- first such device confirmed (thanks @anthonykb)

Improve criteria for detecting strong stack protection

Release 10 - April 7, 2019

Fix support for the latest Oreo devices

Add compatibility for kernels with stack protection (Nokia phones)

Improve reliability

Initial support for 32-bit (armv7) kernels -- needs testing

Release 9 - April 1, 2019

Confirmed support for at least some Oreo devices

Fix bugs with R8

Release 8 - March 30, 2019 (REMOVED)

Lay the groundwork for Oreo devices

Improve performance

Improve reliability

Release 7 - March 17, 2019

Add/fix support for many Linux ver. ≤ 3.18.22 devices

Fix arm binary on Fire HD 10

Release 6 - March 13, 2019

Add support for some devices with kernel 4.4.x (MT8167 confirmed by @cybersaga)

Minor bug fixes

Release 5 - March 7, 2019

Support kernels with CONFIG_KALLSYMS_ALL disabled

Improve reliability

Release 4 - March 4, 2019

Improve compatibility with phones

Support Fire TV 2 new FW

Minor bug fixes

Improve reliability

Release 3 - March 1, 2019

Add support for HD 10 7th gen

Add support for 3.10 kernel layout

Add possible support for MT67xx phones

Improve reliability

Release 2 - Feb. 27, 2019

Add support for HD 8 8th gen and 32-bit only user stacks

FAQ
I got the error, "This firmware cannot be supported". What's up with that?
This means that your device's firmware is not prone to the mechanism used by mtk-su. It may be a new device or it may have started from a firmware update. It will not be feasible to add root support for the current or future firmware versions. Check the last supported firmware version in post 4. If the last working FW is not listed and your device used to work with mtk-su, please report the last working version and/or your current version. In those cases, it may be possible to get mtk-su support by downgrading the firmware.

I got the error, "Firmware support not implemented". What gives?
That means that mtk-su does not recognize the type of firmware on your device. While It's technically possible to add basic detection, most of the time this error happens on devices that have already blocked mtk-su access. So implementing it would only kick the can down the road and probably lead to a, "This firmware cannot be supported" message (see above). If your device has Android 10+ or a security patch level at 03-2020 or higher, or if your firmware is newer than the last compatible version in post 4, there is no need to report this error.

Will this work on my phone?
Yes, it will work on your phone, unless it doesn't. But to be serious, there is no point in asking this question. If you have the device in hand, it is much quicker to just try out the above procedure than to wait for a response. You are usually the best person to answer that question. If your device is listed among the confirmed models or, to a lesser extent, your chipset is supported, that's a good indication that mtk-su will succeed, but that is not guaranteed. You should report your success or failure in this thread, along with the requested materials if it fails.

Why don't you reply to my post?
I read every post in this thread, and respond to practically every post that warrants a response. Sometimes I will only click a Thanks as an acknowledgement. The reasons I may not answer your question are:

It has already been answered in the FAQ or multiple times in the thread.

Your post is unrelated to this project. It may be specific to your device, which would make it off topic for this thread.

Your question is extremely vague and you appear to be intentionally leaving out basic information (e.g. fishing).

After getting a root shell I'm still getting 'permission denied' errors. WTH?
It may be that selinux is still being enforced. Having root with selinux enabled somehow ends up being more restrictive than a normal shell user. First, check that mtk-su succeeded in setting selinux to permissive by running getenforce. If it says Enforcing, then exit your shell and run mtk-su again.

Will this work on an MT65xx or MT8127?
There is no support for most 32-bit chips. But there may be a couple where it's possible.

Does this thing unlock the bootloader?
No, it does nothing to unlock the bootloader.

I ran mtk-su successfully, but my apps still don't have root permissions.
Mtk-su does not give apps root permissions. It is not a permanent root solution in and of itself. It opens a command shell that has root and administrative capabilities within the context of that shell. It's up to you what you want to do with it. But also, there is a way to load Magisk using this tool without the need to unlock your bootloader. Just follow this guide.

How does this tool work?
It overwrites the process credentials & capabilities in the kernel in order to gain privileges. It also turns off selinux enforcement by overwriting the kernel's selinux_enforcing variable. As for how it accesses that memory, the tool involves making use of the vulnerability known as CVE-2020-0069.

Can I include mtk-su in my app or meta-tool?
Generally speaking, you may not distribute any mtk-su zip or binaries with your software. That includes doing any automatic download of those files into your app. You can still use it with your tools. But you should ask your users to visit this thread and download the current release zip themselves. No apps have been permitted to bundle or auto-download mtk-su.

CREDITS

Thank you to everyone who has tested and provided feedback to help me add support for the large variety of MTK-based devices out there. There are simply too many people to list.

MediaTek, Inc., who leave holes and backdoors in their OS to make software like this possible :good:

Thank you to everyone who has donated. You're the best!

My phone is a I12Pro Mtk6889, with the command ./mtk-su i get message:
armv71
Failed critical init step 1
Incompatible platform
How can i risolve the problem, mybe i must try a different version of mtk-su? I'am using rel. 23.
Thanks

Pippoloness · Jun 24, 2021

diplomatic said:
Software root method for MediaTek MT67xx, MT816x, and MT817x!

So it's no big secret that not too long ago, I found a way to achieve temporary root on MediaTek chipsets. No preinstalled root solution or device unlock was needed. The tool I created, MTK-SU, was originally aimed at helping Amazon Fire HD owners to easily root and unlock their tablets. (Without it, most models need a hardware mod to achieve root & unlock. This tool made rooting accessible to many times the number of owners. It also made possible to root the Fire TV gen 2.) But funny story: this method actually works on virtually all of MediaTek's 64-bit chips. Many devices of various vendors have already been confirmed.

So in case it's not clear, what mtk-su does is give you a root shell to do with as you please. It's like running 'su', but without the need to have su installed. That may be a holy grail for locked devices. On some devices, it may be possible to install a root manager for permanent root using mtk-su as a springboard.

The original thread is here: Rapid Temporary Root for HD 8 & HD 10. It's a great resource for info. But please avoid posting there about non-Amazon devices. This new thread is a catchall topic for other devices and vendors.

DISCLAIMER
Anything you do that is described in this thread is at your own risk. No one else is responsible for any data loss, corruption or damage of your device, including that which results from bugs in this software. There is a nonzero chance of any of these events happening as a result of using the tools or methods here.

REQUIREMENTS
Mastery of the Thanks button under XDA posts
A phone or tablet based on Mediatek MT67xx, MT816x, MT817x or MT6580 chipsets
Either:

A PC with ADB installed to interact with your device, or

A terminal emulator app

Familiarity with ADB (if using PC) and basic Linux shell commands
You agree to post the model name of any unconfirmed device which ran mtk-su successfully

INSTRUCTIONS FOR ADB

Make sure you meet all the requirements listed above, especially the first and last ones.

Download the current mtk-su zip file to your PC and unzip it. Inside will be 2 directories: 'arm' & 'arm64' with an 'mtk-su' binary in each. Pick one for your device. Differences between the flavors:
arm64: 64-bit kernel and userspace
arm: 32-bit userspace on a 64-bit or 32-bit kernel (will also work in 64-bit userspace)

Connect your device to ADB and push mtk-su to your /data/local/tmp folder
adb push path/to/mtk-su /data/local/tmp/

Open an adb shell
adb shell

Change to your tmp directory
cd /data/local/tmp

Add executable permissions to the binary
chmod 755 mtk-su

At this point keep your device screen on and don't let it go to sleep. Run the command
./mtk-su
It should only take a second or two. If the program gets stuck for more than a few seconds and your device is awake, press Ctrl+C to close it.
The -v option turns on verbose printing, which is necessary for me to debug any problems.
The output of ./mtk-su -v is similar to this:

Code:

$ ./mtk-su -v param1: 0x3000, param2: 0x18040, type: 2 Building symbol table kallsyms_addresses pa 0x40bdd500 kallsyms_num_syms 70337, addr_count 70337 kallsyms_names pa 0x40c66d00, size 862960 kallsyms_markers pa 0x40d39800 kallsyms_token_table pa 0x40d3a100 kallsyms_token_index pa 0x40d3a500 Patching credentials Parsing current_is_single_threaded ffffffc000354868+50: ADRP x0, 0xffffffc000fa2000 ffffffc000354868+54: ADD xd, x0, 2592 init_task VA: 0xffffffc000fa2a20 Potential list_head tasks at offset 0x340 comm swapper/0 at offset 0x5c0 Found own task_struct at node 1 cred VA: 0xffffffc0358ac0c0 Parsing avc_denied ffffffc0002f13bc+24: ADRP x0, 0xffffffc001113000 ffffffc0002f13bc+28: LDR [x0, 404] selinux_enforcing VA: 0xffffffc001113194 Setting selinux_enforcing Switched selinux to permissive starting /system/bin/sh UID: 0 cap: 3fffffffff selinux: permissive #

Some other options:

mtk-su -c <command>: Runs <command> as root. Default command is /system/bin/sh.
mtk-su -s: Prints the kernel symbol table
mtk-su -Z <context>: Runs shell in a new selinux context. Example: ./mtk-su -Z u:r:logd:s0
If you see any errors other than about unsupported or incompatible platform or don't get a root shell, report it here. When reporting a problem with a device, please post a link to the firmware and/or the kernel sources.

Please post the model of any device that works with mtk-su that's not already confirmed.

Important: in rare cases, it may be necessary to run the tool multiple times before you hit UID 0 and get selinux permissive. If you don't achieve root on a particular run, the "UID: N cap: xxxxx...." line will reflect that. If it doesn't say "UID: 0 cap: 3fffffffff selinux: permissive", type exit to close the subshell and try mtk-su again.

WARNING If you have a device with Android 6 or higher, it likely has dm-verity enabled. On such a device one does not simply remount the system partition as read/write. The remount command will probably fail. But if you succeed in forcing it somehow it will trigger dm-verity, which will result in a very bad day. Your device will become inoperable until you restore the stock system partition.

DOWNLOAD
Current Version
Release 23

Release 23 - August 24, 2020

Add support for some early Linux 3.10 tablet firmware

Add support for kernels with some debug features enabled

Release 22 - May 8, 2020

Expand kernel support

Enable seccomp handling for Android 8

Release 21 - March 14, 2020

Add support for more devices

Fix seccomp on 3.18 arm kernels

Release 20 - Dec 28, 2019

Add support for MT6580

Add support for some MT8183 versions

Fix handling of some 32-bit 4.x kernels with stack protection

Move to NDK build

Release 19 - October 20, 2019

Add -Z option for setting custom selinux context

Fix seccomp on armv7

Fix seccomp handling on late-revision 3.18 kernels

Improve error printing for critical failures

Strip supplementary groups in root shell

Do not spawn root shell on critical failures

Release 18 - July 29, 2019

Add support for kernel address space layout randomization (KASLR)

Change status output format

Release 17 - July 13, 2019

Fix missing capabilities under adb shell in Android 9.x

Disable seccomp in app mode of Android 9.x

Add support for MT6771 on Android 8.x

Reliability improvements

Release 16 - June 9, 2019

Add support for 32 & 64-bit kernels compiled with CONFIG_KALLSYMS_BASE_RELATIVE

Add support for MT676x on Android 7.x

Speedups

Release 15 - May 29, 2019

Run shell/command in global mount namespace -- mounting from apps is now visible to the whole system

Release 14 - May 22, 2019

Remove restriction for adb shell initial run on Android 8.0+

Add support for 32-bit kernels compiled under Android 8.0+

Add initial support for MT6771 on Android 9+

Minor bug fixes

Release 13 - May 16, 2019

Improve stack protection detection -- add support for some armv7-kernel 3.x phones

Release 12 - April 26, 2019

Unify the arm and armv7-kernel binaries into one

Support Linux 4.9.x

Improve speed and possibly reliability

Fix arm64 support for phones on kernel 3.10.65

Fix stack protection workaround for armv7 kernels

Update readme file

Release 11 - April 10, 2019

Fix up and enable rooting for 32-bit kernels -- first such device confirmed (thanks @anthonykb)

Improve criteria for detecting strong stack protection

Release 10 - April 7, 2019

Fix support for the latest Oreo devices

Add compatibility for kernels with stack protection (Nokia phones)

Improve reliability

Initial support for 32-bit (armv7) kernels -- needs testing

Release 9 - April 1, 2019

Confirmed support for at least some Oreo devices

Fix bugs with R8

Release 8 - March 30, 2019 (REMOVED)

Lay the groundwork for Oreo devices

Improve performance

Improve reliability

Release 7 - March 17, 2019

Add/fix support for many Linux ver. ≤ 3.18.22 devices

Fix arm binary on Fire HD 10

Release 6 - March 13, 2019

Add support for some devices with kernel 4.4.x (MT8167 confirmed by @cybersaga)

Minor bug fixes

Release 5 - March 7, 2019

Support kernels with CONFIG_KALLSYMS_ALL disabled

Improve reliability

Release 4 - March 4, 2019

Improve compatibility with phones

Support Fire TV 2 new FW

Minor bug fixes

Improve reliability

Release 3 - March 1, 2019

Add support for HD 10 7th gen

Add support for 3.10 kernel layout

Add possible support for MT67xx phones

Improve reliability

Release 2 - Feb. 27, 2019

Add support for HD 8 8th gen and 32-bit only user stacks

FAQ
I got the error, "This firmware cannot be supported". What's up with that?
This means that your device's firmware is not prone to the mechanism used by mtk-su. It may be a new device or it may have started from a firmware update. It will not be feasible to add root support for the current or future firmware versions. Check the last supported firmware version in post 4. If the last working FW is not listed and your device used to work with mtk-su, please report the last working version and/or your current version. In those cases, it may be possible to get mtk-su support by downgrading the firmware.

I got the error, "Firmware support not implemented". What gives?
That means that mtk-su does not recognize the type of firmware on your device. While It's technically possible to add basic detection, most of the time this error happens on devices that have already blocked mtk-su access. So implementing it would only kick the can down the road and probably lead to a, "This firmware cannot be supported" message (see above). If your device has Android 10+ or a security patch level at 03-2020 or higher, or if your firmware is newer than the last compatible version in post 4, there is no need to report this error.

Will this work on my phone?
Yes, it will work on your phone, unless it doesn't. But to be serious, there is no point in asking this question. If you have the device in hand, it is much quicker to just try out the above procedure than to wait for a response. You are usually the best person to answer that question. If your device is listed among the confirmed models or, to a lesser extent, your chipset is supported, that's a good indication that mtk-su will succeed, but that is not guaranteed. You should report your success or failure in this thread, along with the requested materials if it fails.

Why don't you reply to my post?
I read every post in this thread, and respond to practically every post that warrants a response. Sometimes I will only click a Thanks as an acknowledgement. The reasons I may not answer your question are:

It has already been answered in the FAQ or multiple times in the thread.

Your post is unrelated to this project. It may be specific to your device, which would make it off topic for this thread.

Your question is extremely vague and you appear to be intentionally leaving out basic information (e.g. fishing).

After getting a root shell I'm still getting 'permission denied' errors. WTH?
It may be that selinux is still being enforced. Having root with selinux enabled somehow ends up being more restrictive than a normal shell user. First, check that mtk-su succeeded in setting selinux to permissive by running getenforce. If it says Enforcing, then exit your shell and run mtk-su again.

Will this work on an MT65xx or MT8127?
There is no support for most 32-bit chips. But there may be a couple where it's possible.

Does this thing unlock the bootloader?
No, it does nothing to unlock the bootloader.

I ran mtk-su successfully, but my apps still don't have root permissions.
Mtk-su does not give apps root permissions. It is not a permanent root solution in and of itself. It opens a command shell that has root and administrative capabilities within the context of that shell. It's up to you what you want to do with it. But also, there is a way to load Magisk using this tool without the need to unlock your bootloader. Just follow this guide.

How does this tool work?
It overwrites the process credentials & capabilities in the kernel in order to gain privileges. It also turns off selinux enforcement by overwriting the kernel's selinux_enforcing variable. As for how it accesses that memory, the tool involves making use of the vulnerability known as CVE-2020-0069.

Can I include mtk-su in my app or meta-tool?
Generally speaking, you may not distribute any mtk-su zip or binaries with your software. That includes doing any automatic download of those files into your app. You can still use it with your tools. But you should ask your users to visit this thread and download the current release zip themselves. No apps have been permitted to bundle or auto-download mtk-su.

CREDITS

Thank you to everyone who has tested and provided feedback to help me add support for the large variety of MTK-based devices out there. There are simply too many people to list.

MediaTek, Inc., who leave holes and backdoors in their OS to make software like this possible :good:

Thank you to everyone who has donated. You're the best!

Hi, i have get the access to the shell, but of i perform the command mtk-su, i get platform incompatible, i have a mtk6889, , model istituzionale i12pro

diplomatic said:
Software root method for MediaTek MT67xx, MT816x, and MT817x!

So it's no big secret that not too long ago, I found a way to achieve temporary root on MediaTek chipsets. No preinstalled root solution or device unlock was needed. The tool I created, MTK-SU, was originally aimed at helping Amazon Fire HD owners to easily root and unlock their tablets. (Without it, most models need a hardware mod to achieve root & unlock. This tool made rooting accessible to many times the number of owners. It also made possible to root the Fire TV gen 2.) But funny story: this method actually works on virtually all of MediaTek's 64-bit chips. Many devices of various vendors have already been confirmed.

So in case it's not clear, what mtk-su does is give you a root shell to do with as you please. It's like running 'su', but without the need to have su installed. That may be a holy grail for locked devices. On some devices, it may be possible to install a root manager for permanent root using mtk-su as a springboard.

The original thread is here: Rapid Temporary Root for HD 8 & HD 10. It's a great resource for info. But please avoid posting there about non-Amazon devices. This new thread is a catchall topic for other devices and vendors.

DISCLAIMER
Anything you do that is described in this thread is at your own risk. No one else is responsible for any data loss, corruption or damage of your device, including that which results from bugs in this software. There is a nonzero chance of any of these events happening as a result of using the tools or methods here.

REQUIREMENTS
Mastery of the Thanks button under XDA posts
A phone or tablet based on Mediatek MT67xx, MT816x, MT817x or MT6580 chipsets
Either:

A PC with ADB installed to interact with your device, or

A terminal emulator app

Familiarity with ADB (if using PC) and basic Linux shell commands
You agree to post the model name of any unconfirmed device which ran mtk-su successfully

INSTRUCTIONS FOR ADB

Make sure you meet all the requirements listed above, especially the first and last ones.

Download the current mtk-su zip file to your PC and unzip it. Inside will be 2 directories: 'arm' & 'arm64' with an 'mtk-su' binary in each. Pick one for your device. Differences between the flavors:
arm64: 64-bit kernel and userspace
arm: 32-bit userspace on a 64-bit or 32-bit kernel (will also work in 64-bit userspace)

Connect your device to ADB and push mtk-su to your /data/local/tmp folder
adb push path/to/mtk-su /data/local/tmp/

Open an adb shell
adb shell

Change to your tmp directory
cd /data/local/tmp

Add executable permissions to the binary
chmod 755 mtk-su

At this point keep your device screen on and don't let it go to sleep. Run the command
./mtk-su
It should only take a second or two. If the program gets stuck for more than a few seconds and your device is awake, press Ctrl+C to close it.
The -v option turns on verbose printing, which is necessary for me to debug any problems.
The output of ./mtk-su -v is similar to this:

Code:

$ ./mtk-su -v param1: 0x3000, param2: 0x18040, type: 2 Building symbol table kallsyms_addresses pa 0x40bdd500 kallsyms_num_syms 70337, addr_count 70337 kallsyms_names pa 0x40c66d00, size 862960 kallsyms_markers pa 0x40d39800 kallsyms_token_table pa 0x40d3a100 kallsyms_token_index pa 0x40d3a500 Patching credentials Parsing current_is_single_threaded ffffffc000354868+50: ADRP x0, 0xffffffc000fa2000 ffffffc000354868+54: ADD xd, x0, 2592 init_task VA: 0xffffffc000fa2a20 Potential list_head tasks at offset 0x340 comm swapper/0 at offset 0x5c0 Found own task_struct at node 1 cred VA: 0xffffffc0358ac0c0 Parsing avc_denied ffffffc0002f13bc+24: ADRP x0, 0xffffffc001113000 ffffffc0002f13bc+28: LDR [x0, 404] selinux_enforcing VA: 0xffffffc001113194 Setting selinux_enforcing Switched selinux to permissive starting /system/bin/sh UID: 0 cap: 3fffffffff selinux: permissive #

Some other options:

mtk-su -c <command>: Runs <command> as root. Default command is /system/bin/sh.
mtk-su -s: Prints the kernel symbol table
mtk-su -Z <context>: Runs shell in a new selinux context. Example: ./mtk-su -Z u:r:logd:s0
If you see any errors other than about unsupported or incompatible platform or don't get a root shell, report it here. When reporting a problem with a device, please post a link to the firmware and/or the kernel sources.

Please post the model of any device that works with mtk-su that's not already confirmed.

Important: in rare cases, it may be necessary to run the tool multiple times before you hit UID 0 and get selinux permissive. If you don't achieve root on a particular run, the "UID: N cap: xxxxx...." line will reflect that. If it doesn't say "UID: 0 cap: 3fffffffff selinux: permissive", type exit to close the subshell and try mtk-su again.

WARNING If you have a device with Android 6 or higher, it likely has dm-verity enabled. On such a device one does not simply remount the system partition as read/write. The remount command will probably fail. But if you succeed in forcing it somehow it will trigger dm-verity, which will result in a very bad day. Your device will become inoperable until you restore the stock system partition.

DOWNLOAD
Current Version
Release 23

Release 23 - August 24, 2020

Add support for some early Linux 3.10 tablet firmware

Add support for kernels with some debug features enabled

Release 22 - May 8, 2020

Expand kernel support

Enable seccomp handling for Android 8

Release 21 - March 14, 2020

Add support for more devices

Fix seccomp on 3.18 arm kernels

Release 20 - Dec 28, 2019

Add support for MT6580

Add support for some MT8183 versions

Fix handling of some 32-bit 4.x kernels with stack protection

Move to NDK build

Release 19 - October 20, 2019

Add -Z option for setting custom selinux context

Fix seccomp on armv7

Fix seccomp handling on late-revision 3.18 kernels

Improve error printing for critical failures

Strip supplementary groups in root shell

Do not spawn root shell on critical failures

Release 18 - July 29, 2019

Add support for kernel address space layout randomization (KASLR)

Change status output format

Release 17 - July 13, 2019

Fix missing capabilities under adb shell in Android 9.x

Disable seccomp in app mode of Android 9.x

Add support for MT6771 on Android 8.x

Reliability improvements

Release 16 - June 9, 2019

Add support for 32 & 64-bit kernels compiled with CONFIG_KALLSYMS_BASE_RELATIVE

Add support for MT676x on Android 7.x

Speedups

Release 15 - May 29, 2019

Run shell/command in global mount namespace -- mounting from apps is now visible to the whole system

Release 14 - May 22, 2019

Remove restriction for adb shell initial run on Android 8.0+

Add support for 32-bit kernels compiled under Android 8.0+

Add initial support for MT6771 on Android 9+

Minor bug fixes

Release 13 - May 16, 2019

Improve stack protection detection -- add support for some armv7-kernel 3.x phones

Release 12 - April 26, 2019

Unify the arm and armv7-kernel binaries into one

Support Linux 4.9.x

Improve speed and possibly reliability

Fix arm64 support for phones on kernel 3.10.65

Fix stack protection workaround for armv7 kernels

Update readme file

Release 11 - April 10, 2019

Fix up and enable rooting for 32-bit kernels -- first such device confirmed (thanks @anthonykb)

Improve criteria for detecting strong stack protection

Release 10 - April 7, 2019

Fix support for the latest Oreo devices

Add compatibility for kernels with stack protection (Nokia phones)

Improve reliability

Initial support for 32-bit (armv7) kernels -- needs testing

Release 9 - April 1, 2019

Confirmed support for at least some Oreo devices

Fix bugs with R8

Release 8 - March 30, 2019 (REMOVED)

Lay the groundwork for Oreo devices

Improve performance

Improve reliability

Release 7 - March 17, 2019

Add/fix support for many Linux ver. ≤ 3.18.22 devices

Fix arm binary on Fire HD 10

Release 6 - March 13, 2019

Add support for some devices with kernel 4.4.x (MT8167 confirmed by @cybersaga)

Minor bug fixes

Release 5 - March 7, 2019

Support kernels with CONFIG_KALLSYMS_ALL disabled

Improve reliability

Release 4 - March 4, 2019

Improve compatibility with phones

Support Fire TV 2 new FW

Minor bug fixes

Improve reliability

Release 3 - March 1, 2019

Add support for HD 10 7th gen

Add support for 3.10 kernel layout

Add possible support for MT67xx phones

Improve reliability

Release 2 - Feb. 27, 2019

Add support for HD 8 8th gen and 32-bit only user stacks

FAQ
I got the error, "This firmware cannot be supported". What's up with that?
This means that your device's firmware is not prone to the mechanism used by mtk-su. It may be a new device or it may have started from a firmware update. It will not be feasible to add root support for the current or future firmware versions. Check the last supported firmware version in post 4. If the last working FW is not listed and your device used to work with mtk-su, please report the last working version and/or your current version. In those cases, it may be possible to get mtk-su support by downgrading the firmware.

I got the error, "Firmware support not implemented". What gives?
That means that mtk-su does not recognize the type of firmware on your device. While It's technically possible to add basic detection, most of the time this error happens on devices that have already blocked mtk-su access. So implementing it would only kick the can down the road and probably lead to a, "This firmware cannot be supported" message (see above). If your device has Android 10+ or a security patch level at 03-2020 or higher, or if your firmware is newer than the last compatible version in post 4, there is no need to report this error.

Will this work on my phone?
Yes, it will work on your phone, unless it doesn't. But to be serious, there is no point in asking this question. If you have the device in hand, it is much quicker to just try out the above procedure than to wait for a response. You are usually the best person to answer that question. If your device is listed among the confirmed models or, to a lesser extent, your chipset is supported, that's a good indication that mtk-su will succeed, but that is not guaranteed. You should report your success or failure in this thread, along with the requested materials if it fails.

Why don't you reply to my post?
I read every post in this thread, and respond to practically every post that warrants a response. Sometimes I will only click a Thanks as an acknowledgement. The reasons I may not answer your question are:

It has already been answered in the FAQ or multiple times in the thread.

Your post is unrelated to this project. It may be specific to your device, which would make it off topic for this thread.

Your question is extremely vague and you appear to be intentionally leaving out basic information (e.g. fishing).

After getting a root shell I'm still getting 'permission denied' errors. WTH?
It may be that selinux is still being enforced. Having root with selinux enabled somehow ends up being more restrictive than a normal shell user. First, check that mtk-su succeeded in setting selinux to permissive by running getenforce. If it says Enforcing, then exit your shell and run mtk-su again.

Will this work on an MT65xx or MT8127?
There is no support for most 32-bit chips. But there may be a couple where it's possible.

Does this thing unlock the bootloader?
No, it does nothing to unlock the bootloader.

I ran mtk-su successfully, but my apps still don't have root permissions.
Mtk-su does not give apps root permissions. It is not a permanent root solution in and of itself. It opens a command shell that has root and administrative capabilities within the context of that shell. It's up to you what you want to do with it. But also, there is a way to load Magisk using this tool without the need to unlock your bootloader. Just follow this guide.

How does this tool work?
It overwrites the process credentials & capabilities in the kernel in order to gain privileges. It also turns off selinux enforcement by overwriting the kernel's selinux_enforcing variable. As for how it accesses that memory, the tool involves making use of the vulnerability known as CVE-2020-0069.

Can I include mtk-su in my app or meta-tool?
Generally speaking, you may not distribute any mtk-su zip or binaries with your software. That includes doing any automatic download of those files into your app. You can still use it with your tools. But you should ask your users to visit this thread and download the current release zip themselves. No apps have been permitted to bundle or auto-download mtk-su.

CREDITS

Thank you to everyone who has tested and provided feedback to help me add support for the large variety of MTK-based devices out there. There are simply too many people to list.

MediaTek, Inc., who leave holes and backdoors in their OS to make software like this possible :good:

Thank you to everyone who has donated. You're the best!

My phone is a I12Pro Mtk6889, with the command ./mtk-su i get message:
armv71
Failed critical init step 1
Incompatible platform
How can i risolve the problem, mybe i must try a different version of mtk-su? I'am using rel. 23.
Thanf

ShouryaMahajan · Jun 24, 2021

How to temp root helio g80

diplomatic · Jun 30, 2021

vla-511411 said:
TL;DR level Q:
Is the 'mtk-su' method of getting a bootloader-locked root now dead forever after a 2021MAY firmware updated ZTE pushed onto my ZTE Blade A7 Prime (w Mediatek MT6761 processor) ?

Yes, any FW update on or after March, 2020 will break mtk-su, or rather fix the loophole that it uses. There's nothing to be done about it unless you can downgrade. There are probably not going to be any more updates of this tool.

Pippoloness said:
Hi, i have get the access to the shell, but of i perform the command mtk-su, i get platform incompatible, i have a mtk6889, , model istituzionale i12pro

My phone is a I12Pro Mtk6889, with the command ./mtk-su i get message:
armv71
Failed critical init step 1
Incompatible platform
How can i risolve the problem, mybe i must try a different version of mtk-su? I'am using rel. 23.
Thanks

That phone's hardware and software are way too new for this tool. Look into unlocking the bootloader if you haven't already...

- D

Pippoloness · Jul 1, 2021

diplomatic said:
Yes, any FW update on or after March, 2020 will break mtk-su, or rather fix the loophole that it uses. There's nothing to be done about it unless you can downgrade. There are probably not going to be any more updates of this tool.

That phone's hardware and software are way too new for this tool. Look into unlocking the bootloader if you haven't already...

- D

Come devo fare?
Grazie

luridphantom · Jul 2, 2021

Coyhardt48 said:
Just wanted to pop in and say that this root solution (as well as the Magisk installation process) worked for me on my Coolpad Legacy S.

Thanks for the work!

strange, mtk-su r23 fails with


1|cp3648at:/data/local/tmp $ ./mtk-su -v  
armv8l machine
Failed critical init step 4
This firmware cannot be supported

on an october 5, 2019 patch, android 9 pie. what's your phone config that you got to work?

Pippoloness · Jul 2, 2021

luridphantom said:
strange, mtk-su r23 fails with 1|cp3648at:/data/local/tmp $ ./mtk-su -v armv8l machine Failed critical init step 4 This firmware cannot be supported

on an october 5, 2019 patch, android 9 pie. what's your phone config that you got to work?

I have Android 10, i12Pro , Mtk6889, SeLinux Kernel 3.10.65 , Language: Italiano, OpenGL ES: 2.0 , ARMv7 rev. 5 (v7I) Cpu: 10 x 1,30 , Gpu: Mali-400 MP Arm (OpenGL ES 2.0) Thanks

0000.0000.00 · Jul 7, 2021

I have a TCL A1 model A501DL but when I try running mtk-su I get this error:

Code:

Failed critical init step 4
This firmware cannot be supported

The phone is on the february 5th, 2020 security patch and rom seems to have been built on february 10th so not sure why it didn't work, especially since it worked for someone else with the same model.

Hutchpd · Jul 12, 2021

My amazon Fire 7 tablet fails.

Tablet Codename: mustang
FireOS Version: 7.3.1.9
Android Version: 9
Chipset: MT8163

I see

> mustang:/data/local/tmp $ ./mtk-su
> Failed critical init step 3

Pippoloness · Jul 16, 2021

Pippoloness said:
I have Android 10, i12Pro , Mtk6889, SeLinux Kernel 3.10.65 , Language: Italiano, OpenGL ES: 2.0 , ARMv7 rev. 5 (v7I) Cpu: 10 x 1,30 , Gpu: Mali-400 MP Arm (OpenGL ES 2.0) Thanks

How can i risolve this problem?

Pippoloness said:
can i risolve?

diplomatic · Jul 16, 2021

Pippoloness said:
How can i risolve this problem?

Your device is not compatible with this tool. Also, those specs are a lie. It's far from an mt6889. Judging by the kernel version & GPU, the chip is more likely to be mt658x or mt657x. The OS is probably closer to Android 5 than Android 10.

Pippoloness · Jul 19, 2021

diplomatic said:
Your device is not compatible with this tool. Also, those specs are a lie. It's far from an mt6889. Judging by the kernel version & GPU, the chip is more likely to be mt658x or mt657x. The OS is probably closer to Android 5 than Android 10.

I detected the features with cpu-z, so what should i do? Thank you

diplomatic · Jul 22, 2021

Pippoloness said:
I detected the features with cpu-z, so what should i do? Thank you

Can you use a system info app to look up the phone's API Level, as well as the Platform or Hardware (aka the property ro.board.platform)? It might be something like mt65xx or mt67xx. This isn't directly related to mtk-su, but it would shed light on the mystery.

To install root, you need to unlock the bootloader and patch the boot image with Magisk. You need to get a copy of the firmware from somewhere or extract it from the phone with SP Flash Tool. Here is a guide on how to install Magisk.

Pippoloness · Jul 22, 2021

diplomatic said:
Puoi utilizzare un'app di informazioni di sistema per cercare il livello API del telefono , nonché la piattaforma o l' hardware (ovvero la proprietà ro.board.platform)? Potrebbe essere qualcosa come mt65xx o mt67xx. Questo non è direttamente correlato a mtk-su, ma farebbe luce sul mistero.

Per installare root, devi sbloccare il bootloader e correggere l'immagine di avvio con Magisk. È necessario ottenere una copia del firmware da qualche parte o estrarla dal telefono con SP Flash Tool. Ecco una guida su come installare Magisk.

example app?

diplomatic · Jul 23, 2021

@Pippoloness, that's weird, I didn't know I spoke Italian.

Just use any device info app from Play store. You mentioned CPU-Z. That will probably work. Another example: https://play.google.com/store/apps/details?id=com.ytheekshana.deviceinfo

Pippoloness · Jul 23, 2021

diplomatic said:
@Pippoloness, è strano, non sapevo di parlare italiano.

Usa qualsiasi app per le informazioni sul dispositivo dal Play Store. Hai citato CPU-Z. Probabilmente funzionerà. Un altro esempio: https://play.google.com/store/apps/details?id=com.ytheekshana.deviceinfo

diplomatic said:
@Pippoloness, è strano, non sapevo di parlare italiano.

Usa qualsiasi app per le informazioni sul dispositivo dal Play Store. Hai citato CPU-Z. Probabilmente funzionerà. Un altro esempio:https://play.google.com/store/apps/details?id=com.ytheekshana.deviceinfo

The information are:
I have Android Q 10.0, Model: i12Pro (Mtk6889_project), Hardware: Mtk6889 (32 bit), SeLinux Kernel 3.10.65, Language: Italiano, OpenGL ES: 2.0, ARMv7 rev. 5 (v7I) Cpu: 10 x 1,30 , Gpu: Mali-400 MP Arm (OpenGL ES 2.0) , Level API: 23 october 5 2015
Level patch securety: 5 march 2017, bootloader: unknown , Productor: Welcome, Google Play Services: 21.24.18, Architecture: 10x Arm Cortex-A7 @ 1,30 Ghz) rev. r0p5, with command adb getprop ro.board.platform i get: sc8830 , with command adb shell getprop ro.build.version.release i getprop this: 6.0
Grazie

Amazing Temp Root for MediaTek ARMv8 [2020-08-24]

New member

New member

DISCLAIMER​

REQUIREMENTS​

INSTRUCTIONS FOR ADB​

DOWNLOAD​

FAQ​

CREDITS​

New member

Member

Member

DISCLAIMER​

REQUIREMENTS​

INSTRUCTIONS FOR ADB​

DOWNLOAD​

FAQ​

CREDITS​

DISCLAIMER​

REQUIREMENTS​

INSTRUCTIONS FOR ADB​

DOWNLOAD​

FAQ​

CREDITS​

DISCLAIMER​

REQUIREMENTS​

INSTRUCTIONS FOR ADB​

DOWNLOAD​

FAQ​

CREDITS​

Member

DISCLAIMER​

REQUIREMENTS​

INSTRUCTIONS FOR ADB​

DOWNLOAD​

FAQ​

CREDITS​

DISCLAIMER​

REQUIREMENTS​

INSTRUCTIONS FOR ADB​

DOWNLOAD​

FAQ​

CREDITS​

DISCLAIMER​

REQUIREMENTS​

INSTRUCTIONS FOR ADB​

DOWNLOAD​

FAQ​

CREDITS​

Member

Senior Member

Member

Senior Member

Member

Senior Member

New member

Member

Senior Member

Member

Senior Member

Member

Senior Member

Member

Similar threads

Top Liked Posts

DISCLAIMER​

REQUIREMENTS​

INSTRUCTIONS FOR ADB​

DOWNLOAD​

FAQ​

CREDITS​

INSTRUCTIONS FOR TERMINAL APP​

DISCLAIMER

REQUIREMENTS

INSTRUCTIONS FOR ADB

DOWNLOAD

FAQ

CREDITS

DISCLAIMER

REQUIREMENTS

INSTRUCTIONS FOR ADB

DOWNLOAD

FAQ

CREDITS

DISCLAIMER

REQUIREMENTS

INSTRUCTIONS FOR ADB

DOWNLOAD

FAQ

CREDITS

DISCLAIMER

REQUIREMENTS

INSTRUCTIONS FOR ADB

DOWNLOAD

FAQ

CREDITS

DISCLAIMER

REQUIREMENTS

INSTRUCTIONS FOR ADB

DOWNLOAD

FAQ

CREDITS

DISCLAIMER

REQUIREMENTS

INSTRUCTIONS FOR ADB

DOWNLOAD

FAQ

CREDITS

DISCLAIMER

REQUIREMENTS

INSTRUCTIONS FOR ADB

DOWNLOAD

FAQ

CREDITS

DISCLAIMER

REQUIREMENTS

INSTRUCTIONS FOR ADB

DOWNLOAD

FAQ

CREDITS

INSTRUCTIONS FOR TERMINAL APP