• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!
  • Fill out your device list and let everyone know which phones you have!    Edit Your Device Inventory

[Root/TWRP/Rom]T-Mobile K428sg K10/MetroPCS ms428 K10[4/2/17]

Search This thread

OvrDriVE

Senior Member
Sep 8, 2012
3,750
11,769
Fresno
i am in no way responsible if you brick, break or just plain blow up your device. it's your device and your responsibility. if you blame me i am gonna die laughing!
Disclaimer! the exploits in the rar may be flagged as a virus by your virus software. just add an exception for them! they are not a virus

T-Mobile/MetroPCS Root, TWRP and Deodexed Stock Roms

Cannot Stress this Enuff but Read this Entire Post, when done read it again, and finally read it once more for good measure

ok all. this is dirtycow exploit for the t-mobile k428 - works on the 10g firmware(works for the metropcs ms428 as well - Must have 10c kdz flashed first). the exploit method is almost the same as the v20
i have personally done this multiple times on my t-mobile k10 without issues to make sure it is 100% working

all the needed files you need are in this rar. just extract it to the root of your C drive Download Me
this requires an unlocked bootloader and on the t-mo variant it's very easy to do. check this forum. you'll find instructions on how to do it

Now lets get started!!

copy the supersu file to your sdcard

open a command prompt window.

now copy and paste each line except the lines surrounded by "< >"

adb push dirtycow /data/local/tmp
adb push recowvery-applypatch /data/local/tmp
adb push recowvery-app_process32 /data/local/tmp
adb push recowvery-run-as /data/local/tmp
adb push twrp-3.1.0-0.img /sdcard/twrp.img
adb shell
cd /data/local/tmp
chmod 0777 *
./dirtycow /system/bin/applypatch recowvery-applypatch
"<Note! wait for to finish>"
./dirtycow /system/bin/app_process32 recowvery-app_process32
"<Note! wait for to finish, it should appear to crash, however
the crash will not happen, you have to force the crash.
to do this wait for the exploit to finish. now press and hold
the power button until you see the t-mo logo screen and hear
the jingle. now it's crashed and you can continue onto the next
step>"
exit
adb logcat -s recowvery
"<wait for it to tell you it was successful - Then Press>"
"[CTRL+C]"
adb shell reboot recovery
"<wait for phone to boot up again, your recovery will be reflashed to stock>"
adb shell
getenforce
"<it should say Permissive>"
cd /data/local/tmp
./dirtycow /system/bin/run-as recowvery-run-as
run-as exec ./recowvery-applypatch boot
"<wait for it to flash your boot image this time>"
run-as su
run-as exec dd if=/sdcard/twrp.img of=/dev/block/bootdevice/by-name/recovery
"<wait for it to complete>"
reboot recovery
"<once in twrp do the following>"
click install
select supersu 2.79-sr3.zip
reboot
setup your phone and enjoy

thats it. enjoy root!

Stock Deodexed Roms

Features:

Deodexed
Debloated(if thats what you want to call it) i've removed what i don't want so
Magisk v12.0 with magisk manager 4.3.0
Note! (make sure to enable hide magisk in magisk manager settings) - pass's safetynet check - android pay will work along with pokemon go and any other apps that look for root
Busybox 1.26.2 installed by default
dolby atmos 6.5
Viper4Android 2.5.0.5
Includes a custom app for a reboot menu that ties into the actual power button

As always to install either rom you'll want to wipe system, data, dalvik and cache(this is normal for any rom)

T-Mobile Rom
T-Mobile K10 K428sg 10h rom - Weather Widget has been removed due to deodexing issues. PLZ use an Alternate Weather Widget
K428sg10h Removed Files

MetroPCS Rom
MetroPCS K10 ms428 10h rom - Weather Widget has been removed due to deodexing issues. PLZ use an Alternate Weather Widget
MetroPCS Removed Files

for anyone interested you can freely use these rom as a starting point base for a custom rom.

Thanks to @pvineeth97 - for working twrp, @Chainfire - for supersu, @topjohnwu - for magisk, and everyone else i forgot to mention. sorry guys i'm tired!
 
Last edited:

OvrDriVE

Senior Member
Sep 8, 2012
3,750
11,769
Fresno
actually the metropcs twrp you did works like a charm on the t-mo 428. ty for that btw.
i wasn't sure if this worked for metropcs or not but since you say it does i'll mention it as well
 

pvineeth97

Senior Member
Nov 1, 2015
1,251
933
St. Louis
actually the metropcs twrp you did works like a charm on the t-mo 428. ty for that btw.
i wasn't sure if this worked for metropcs or not but since you say it does i'll mention it as well

I don't have a MetroPCS 428 phone but I compiled TWRP for it. I happy it works for you guys ;)

---------- Post added at 03:14 PM ---------- Previous post was at 02:47 PM ----------


@OvrDriVE
Edit the guide properly whenever you are free.

Can you contact me on hangouts: [email protected].
 
Last edited:

OvrDriVE

Senior Member
Sep 8, 2012
3,750
11,769
Fresno
It takes about 2-3 minutes for the "./dirtycow /system/bin/app_process32 recowvery-app_process32" command to finish. It doesn't appear to crash. I'm still waiting for it to happen.

ok, make sure your screen is on and doesn't shutoff. that may help. the crash that happens on the v20 doesn't happen on the k10 unless ypou hold the power button to force it

and you'll know you crashed it because the white t-mo logo screen will pop up and you'll hear part of the t-mo jingle and then phone will appear to be froze
 
ok, make sure your screen is on and doesn't shutoff. that may help. the crash that happens on the v20 doesn't happen on the k10 unless ypou hold the power button to force it

and you'll know you crashed it because the white t-mo logo screen will pop up and you'll hear part of the t-mo jingle and then phone will appear to be froze

I set the screen to stay on. I'm actually using an MS428, the MetroPCS variant. Nothing happening, still. I've run the command four times now.

---------- Post added at 09:53 AM ---------- Previous post was at 09:47 AM ----------

I think I'll need to downgrade. I let the phone update once since I got it. And there's a new 57.1 MB update today.
 

OvrDriVE

Senior Member
Sep 8, 2012
3,750
11,769
Fresno
I set the screen to stay on. I'm actually using an MS428, the MetroPCS variant. Nothing happening, still. I've run the command four times now.

---------- Post added at 09:53 AM ---------- Previous post was at 09:47 AM ----------

I think I'll need to downgrade. I let the phone update once since I got it. And there's a new 57.1 MB update today.

you may need to. i did this on a k428 t-mo version with 10g and i havn't tryed on 10h yet but i gaurentee it works on t-mo. was told it works on metropcs however they could have been wrong on that.
 
it actually shouldn't update because of the modified recovery. although it may still complain about there being an update you can just ignore it

Oh, right, the recovery. Yeah. Alright.

---------- Post added at 10:46 AM ---------- Previous post was at 10:10 AM ----------

I'm on 10g already and it's not working. I tried downgrading, which said it completed, but I'm still on the same version. WTF. And this still isn't working.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 12
    i am in no way responsible if you brick, break or just plain blow up your device. it's your device and your responsibility. if you blame me i am gonna die laughing!
    Disclaimer! the exploits in the rar may be flagged as a virus by your virus software. just add an exception for them! they are not a virus

    T-Mobile/MetroPCS Root, TWRP and Deodexed Stock Roms

    Cannot Stress this Enuff but Read this Entire Post, when done read it again, and finally read it once more for good measure

    ok all. this is dirtycow exploit for the t-mobile k428 - works on the 10g firmware(works for the metropcs ms428 as well - Must have 10c kdz flashed first). the exploit method is almost the same as the v20
    i have personally done this multiple times on my t-mobile k10 without issues to make sure it is 100% working

    all the needed files you need are in this rar. just extract it to the root of your C drive Download Me
    this requires an unlocked bootloader and on the t-mo variant it's very easy to do. check this forum. you'll find instructions on how to do it

    Now lets get started!!

    copy the supersu file to your sdcard

    open a command prompt window.

    now copy and paste each line except the lines surrounded by "< >"

    adb push dirtycow /data/local/tmp
    adb push recowvery-applypatch /data/local/tmp
    adb push recowvery-app_process32 /data/local/tmp
    adb push recowvery-run-as /data/local/tmp
    adb push twrp-3.1.0-0.img /sdcard/twrp.img
    adb shell
    cd /data/local/tmp
    chmod 0777 *
    ./dirtycow /system/bin/applypatch recowvery-applypatch
    "<Note! wait for to finish>"
    ./dirtycow /system/bin/app_process32 recowvery-app_process32
    "<Note! wait for to finish, it should appear to crash, however
    the crash will not happen, you have to force the crash.
    to do this wait for the exploit to finish. now press and hold
    the power button until you see the t-mo logo screen and hear
    the jingle. now it's crashed and you can continue onto the next
    step>"
    exit
    adb logcat -s recowvery
    "<wait for it to tell you it was successful - Then Press>"
    "[CTRL+C]"
    adb shell reboot recovery
    "<wait for phone to boot up again, your recovery will be reflashed to stock>"
    adb shell
    getenforce
    "<it should say Permissive>"
    cd /data/local/tmp
    ./dirtycow /system/bin/run-as recowvery-run-as
    run-as exec ./recowvery-applypatch boot
    "<wait for it to flash your boot image this time>"
    run-as su
    run-as exec dd if=/sdcard/twrp.img of=/dev/block/bootdevice/by-name/recovery
    "<wait for it to complete>"
    reboot recovery
    "<once in twrp do the following>"
    click install
    select supersu 2.79-sr3.zip
    reboot
    setup your phone and enjoy

    thats it. enjoy root!

    Stock Deodexed Roms

    Features:

    Deodexed
    Debloated(if thats what you want to call it) i've removed what i don't want so
    Magisk v12.0 with magisk manager 4.3.0
    Note! (make sure to enable hide magisk in magisk manager settings) - pass's safetynet check - android pay will work along with pokemon go and any other apps that look for root
    Busybox 1.26.2 installed by default
    dolby atmos 6.5
    Viper4Android 2.5.0.5
    Includes a custom app for a reboot menu that ties into the actual power button

    As always to install either rom you'll want to wipe system, data, dalvik and cache(this is normal for any rom)

    T-Mobile Rom
    T-Mobile K10 K428sg 10h rom - Weather Widget has been removed due to deodexing issues. PLZ use an Alternate Weather Widget
    K428sg10h Removed Files

    MetroPCS Rom
    MetroPCS K10 ms428 10h rom - Weather Widget has been removed due to deodexing issues. PLZ use an Alternate Weather Widget
    MetroPCS Removed Files

    for anyone interested you can freely use these rom as a starting point base for a custom rom.

    Thanks to @pvineeth97 - for working twrp, @Chainfire - for supersu, @topjohnwu - for magisk, and everyone else i forgot to mention. sorry guys i'm tired!
    2
    then it should work as the file is in that folder if you grabbed my zip at the top of OP

    I got it! The "dirtycow" file was being removed by ESET. You should add a disclaimer in the OP about it possibly being flagged by antivirus software.
    2
    Hey, this worked perfectly for me after downgrading thanks! I also just want to thank for deciding to share this, I can imagine it took some time and you coulve just kept it to yourself. So thank you, truly:)!
    1
    On the very first command I'm already facing issues:

    Code:
    adb push dirtycow /data/local/tmp
    adb: error: cannot stat 'dirtycow': No such file or directory
    1
    Since this is now a year old...

    Has anyone simply tried flashing latest SuperSU to root, and not doing all the OP steps? Other T-Mo LG models like the K20, Aristo, and others can be rooted the old fashioned way (unlock bootloader, flash TWRP, flash SuperSU) - including on Nougat