[Resolved] How to properly root with magisk - General Questions and Answers

Hi. My phone is: NXT-L29 ( Huawei Mate 8, Europe, unlocked bootl., Marshmallow, EMUI 4.0 ). I installed official TWRP for this device via fastboot, tried all 8 versions available but black screen is all I achieved (probably because they are all for EMUI 4.1). Used SRKtools and TWRP asked me for password to decrypt data, which I don't know. Can I flash magisk with fastboot over encrypted data? Won't that brick the phone? Or should I update to EMUI 4.1? Or what else do you suggest? Also, should I somehow disable dm-verity and RMM or should I just format data partition? Will it get reencrypted on next boot? Any help appreciated.
EDIT: One more question: is firmware update possible with unlocked bootloader or must I relock it first?

Every time I rooted a phone you erase and format data partition first. Nothing encrypted or otherwise should be on the phone iirc... Then flash custom recovery, then rom, then modem / whatever else. Then sideload root script or whatever method to root. Nowadays since there are so many payment methods and ways to get ripped off on phones, I use LineageOS which has a radio button in settings the switches root over adb on or off. Serves my pruposes and avoids the danger of having open bootloader and root 24/7 and brainlessly easy. Don't know if LineageOS supports Mate 8 but it should, it's a popular phone here in USA. Good luck!
PS. If it's not too personal, what are you wanting to achieve once you get root access? All I use it for is to run powermanager over adb and remove bloatware and change hosts files to block malware hosts and social media (internet cancer). I only need to gain root once to do this so no need to run it all the time, too risky to me imo.

SublimeFoxTheater said:
Every time I rooted a phone you erase and format data partition first. Nothing encrypted or otherwise should be on the phone iirc... Then flash custom recovery, then rom, then modem / whatever else. Then sideload root script or whatever method to root. Nowadays since there are so many payment methods and ways to get ripped off on phones, I use LineageOS which has a radio button in settings the switches root over adb on or off. Serves my pruposes and avoids the danger of having open bootloader and root 24/7 and brainlessly easy. Don't know if LineageOS supports Mate 8 but it should, it's a popular phone here in USA. Good luck!
PS. If it's not too personal, what are you wanting to achieve once you get root access? All I use it for is to run powermanager over adb and remove bloatware and change hosts files to block malware hosts and social media (internet cancer). I only need to gain root once to do this so no need to run it all the time, too risky to me imo.
Click to expand...
Click to collapse
Hello and thanks for your reply. I'll try that tomorrow if time allows me. I need root mainly to get rid of ads! There are so many brilliant apps ruined by ads and AdAway is the solution. Bloatware removal also is a good enough reason. Previously I rooted Galaxy Note 3 and it was a breeze, no problem at all, so I hadn't realised how things changed for worse. I found LineageOS but beta version so I think I'll stay with the current system which works absolutely fine for me.

Ok let us know what you did and if it works. I have never heard of AdAway I just add offending urls to hosts file. To do this you need to have root and mount system and edit the hosts file, then reboot even back to rootless and it still works. If you need to block and unblock fast then I could see an app being needed but if you know what you want to get rid of you only need root and to edit human readable hosts once and you're done.

SublimeFoxTheater said:
Ok let us know what you did and if it works. I have never heard of AdAway I just add offending urls to hosts file. To do this you need to have root and mount system and edit the hosts file, then reboot even back to rootless and it still works. If you need to block and unblock fast then I could see an app being needed but if you know what you want to get rid of you only need root and to edit human readable hosts once and you're done.
Click to expand...
Click to collapse
On reflection, I think I won't rush into things. I must read more on dm-verity and other protection mechanisms so at least I have a foggy idea what I'm doing and what can go wrong. AdAway is a great ad blocker working with websites and apps and the idea of doing all this manually seems rather tedious. As for safety, I only ever use one pre-paid card without overdraft and loaded with tiny amounts at a time that's connected to my google account, so if it gets compromised that won't be the end of the world - not that it ever happened.

most fraud comes from social engineering, catfish, etc.
I used supersu back in the day even worked stock rom, as long as bootloader and flashing are unlocked.
The Dev zipped the binary and a script to copy it wherever it goes and make it only accessible to you (after lock screen)
Then install supersu apk and you'll be asked to give root when an app wants it
I used this to use a game editor to give myself more in game currency haha.
I beat people in the game and they did in app purchase to devs in China, received nothing, so I had no problem exploring this flaw and handing out Justice to those in deep nerd rage haha.
In app items, come on bro that ain't what money's for.

I'm immune to social engineering, mate I still have supersu on my Galaxy Note 3 with SlimRom, but I notice it's no longer maintained, so that's how I found out about Magisk which is opensource into the bargain and attemps to hide root so maybe my banking app will work for a change.
I used this to use a game editor to give myself more in game currency haha.
Click to expand...
Click to collapse
Did you use custom editor to hack into the game? Cause I assume the devs weren't so accommodating to provide one for your convenience.

Ok, it works. Got tired of inaction and just did it and no catastrophic scenario materialized. Job done!

Related

temp root through adb?

Hi guys,
is it possible to gain a temp root through adb?
after upgrading from Android 4 to 6, there are some applications that has been removed.
For example, Microsoft Account application which provide you the 2-step authentication for your accounts.
I can't install it anymore, i keep getting error code: -505
which is probably related to some data already present on the device which it cannot erase.
right now, that there's permission management for application, i don't see any real reason to be rooted.
therefore, my question is if i can remove this specific application data from the data partition without being rooted?
Thanks
I've read since day one of my Android experience that when you upgrade a full version (as opposed to small incrementals) such as Kitkat to Lollipop, or Lollipop to Marshmallow, you should back up, do a full wipe, and reinstall all your apps from scratch. You have upgraded two full versions, so it's not surprising that you're having problems. Rather than messing around with temporary root and deleting from partitions you should be doing it right as I've stated above.
Thanks dahawthrone,
This might work indeed but will take too much time to accomplish.
not really worth it.
Really? You prefer to put up with a broken phone? This is just one symptom of corruption. Who knows how many others there may be? And particularly with something as important as 2-factor authentication...
root ur phone do wht ever u need to do then unroot through super user
and yes u can delete data from data partition using es explorer and after everything is done unroot ur device through super user!
not broken.. just having a difficulties with his specific app
I just solved it.
root was not needed, although, usb debugging mode was mandatory.
through adb:
1. adb uninstall com.microsoft.msa.authenticator
2. adb install com.microsoft.msa.authenticator-2.apk
and we're done, works like a charm!
thanks for all the advice's.

[HOW-TO] [GUIDE] Encrypt device with custom rom, knox 1, twrp installed, rooted

This Guide will work on S7 and S7 Edge Variants, probably also on other Samsung Phones. It doesn't matter if you have xposed and/or supersu installed
I did lately try to encrypt my device after installing my rom. So I tried to search on xda but I couldn't find anything useful until now.
After quit some time I finally managed it to get a working encryption, even with custom rom installed (which contains root and xposed). I will present the following steps here to help you folks to get an encrypted device.
Root will work as always after encryption :highfive:
Attention, TWRP can't read /data partition after this guide, that's because twrp doesn't support samsungs encryption at all
Pre requests:
- A working pc with adb installed
- Enough battery (at least 80%)
- Charger in your near field
- Working internet connection
Steps:
1. Go to SuperSU application on your device
2. Head over to the settings Tab
3. Scroll down and hit Full unroot
4. Click continue, when it asks you to install stock boot.img say NO, also NO on restoring stock recovery
5. SuperSU app should disappear
6. Make one full reboot
7. Head over to settings, lock screen and security, set a password
8. Plug in your charger and start encryption
9. Wait until your phone has fully encrypted (this can take quit some time)
10. After your device has successfully encrypted, we want to gain root access again
11. Boot into TWRP recovery
12. You now need a pc with working adb connection
13. Click adb sideload on twrp
14. Download latest super su to your PC, you can get that from here: Beta Thread
15. Open a terminal on your PC
16. Put the supersu.zip in the same direction as your terminal is opened (example: user/home)
17. Type into terminal: adb sideload *supersu_name*.zip
18. Reboot your phone and you have a working, encrypted phone with root installed!
If this guide helped you, please share it and hit thanks as well! :good:
@Tkkg1994
I don't think it could protect your data.
Here is a simple way to steal data from a encrypted phone with unlocked FRP.
Just add this script to ramdisk of kernel.
Code:
#!/system/bin/sh
rm -rf /data/system/lock*
rm -rf /data/system/gatekeep*
And this script will automaticlly remove any screen locks after the data partition is already unlocked by the system after boot.
You may ask:
Could I prevent unauthorized kernel from booting? (by re-enable FRP lock)
No, you can't because systemless install of SuperSU already modify the kernel and you can't boot modified kernel with FRP on.
Could I restore to stock kernel after finish this and then enable FRP?
You will lose your root.
And this way cannot prevent theft from reset your phone and then use it.
So, in a word, any tries to keep your phone safely after root are stupid.
It could only stop those low-IQ theft but it could not stop someone who really concern your data.
Jesse Chan said:
@Tkkg1994
I don't think it could protect your data.
Here is a simple way to steal data from a encrypted phone with unlocked FRP.
Just add this script to ramdisk of kernel.
Code:
#!/system/bin/sh
rm -rf /data/system/lock*
rm -rf /data/system/gatekeep*
And this script will automaticlly remove any screen locks after the data partition is already unlocked by the system after boot.
You may ask:
Could I prevent unauthorized kernel from booting? (by re-enable FRP lock)
No, you can't because systemless install of SuperSU already modify the kernel and you can't boot modified kernel with FRP on.
Could I restore to stock kernel after finish this and then enable FRP?
You will lose your root.
And this way cannot prevent theft from reset your phone and then use it.
So, in a word, any tries to keep your phone safely after root are stupid.
It could only stop those low-IQ theft but it could not stop someone who really concern your data.
Click to expand...
Click to collapse
Some guys need encrypted phones for their work (as some exchange server or email clients only work on encrypted devices)
I know that it is pretty much useless (since we have root access and can pretty much do anything with it)
So basically it brings you some more security but mainly gives those guys who need an encrypted phone for work a chance to have root and encryption together
Sent with my SM-G930F powered by SuperMan
Maybe my remark is stupid but with lollipop the user had to enter the decryption key just before loading the system... So even if the system was rooted, without the key it was impossible to recover the data...
You are saying me that now, in marshmallow Android is storing the key directly in the device ? And if one day there is a small flaw in the kernel all the data could be decrypt...
Thanks for you answer, i'am not an expert in security but i'am really interested in.
Hi,
I installed SuperMan rom without root/xposed and I can't get it to encrypt. It just restart the phone.
is there something else I need to do?
jesec said:
@Tkkg1994
I don't think it could protect your data.
Here is a simple way to steal data from a encrypted phone with unlocked FRP.
Just add this script to ramdisk of kernel.
Code:
#!/system/bin/sh
rm -rf /data/system/lock*
rm -rf /data/system/gatekeep*
And this script will automaticlly remove any screen locks after the data partition is already unlocked by the system after boot.
You may ask:
Could I prevent unauthorized kernel from booting? (by re-enable FRP lock)
No, you can't because systemless install of SuperSU already modify the kernel and you can't boot modified kernel with FRP on.
Could I restore to stock kernel after finish this and then enable FRP?
You will lose your root.
And this way cannot prevent theft from reset your phone and then use it.
So, in a word, any tries to keep your phone safely after root are stupid.
It could only stop those low-IQ theft but it could not stop someone who really concern your data.
Click to expand...
Click to collapse
Even with a locked FRP=1 I have been able to defeat it and gain access to the phone to USE, but never the data. Your script will only remove the locks once the data partition has beenunlocked, you still have not successfully recovered the data.
remixtech said:
Maybe my remark is stupid but with lollipop the user had to enter the decryption key just before loading the system... So even if the system was rooted, without the key it was impossible to recover the data...
You are saying me that now, in marshmallow Android is storing the key directly in the device ? And if one day there is a small flaw in the kernel all the data could be decrypt...
Thanks for you answer, i'am not an expert in security but i'am really interested in.
Click to expand...
Click to collapse
The key is ofc stored on the device, but it is in an encrypted state. ofc if there is a flaw in the kernel, unreported, this can be exploited to remove encryption somehow. Also you could remove the system rom chips and virtual simulate them and try to unlock thousands/millions of times defeating any format on bad password, etc. IF someone wants to access your data, they will. Just like the FBI iphones were opened. Its only a matter of money and time, no encryption is safe forever.
cridtohs said:
Even with a locked FRP=1 I have been able to defeat it and gain access to the phone to USE, but never the data. Your script will only remove the locks once the data partition has beenunlocked, you still have not successfully recovered the data.
The key is ofc stored on the device, but it is in an encrypted state. ofc if there is a flaw in the kernel, unreported, this can be exploited to remove encryption somehow. Also you could remove the system rom chips and virtual simulate them and try to unlock thousands/millions of times defeating any format on bad password, etc. IF someone wants to access your data, they will. Just like the FBI iphones were opened. Its only a matter of money and time, no encryption is safe forever.
Click to expand...
Click to collapse
Admittedly, yes.
It could only remove screen lock AFTER data partition is unlocked.
But in most situations, it could recover data because most people didn't set password as startup password.(What means data partition is already unlocked automatically before UI appear)
jesec said:
Admittedly, yes.
It could only remove screen lock AFTER data partition is unlocked.
But in most situations, it could recover data because most people didn't set password as startup password.(What means data partition is already unlocked automatically before UI appear)
Click to expand...
Click to collapse
how do we make sure that we set a "start up" password then? Is it the same if you use a long pin instead of a password?
|mickey said:
how do we make sure that we set a "start up" password then? Is it the same if you use a long pin instead of a password?
Click to expand...
Click to collapse
in security Lock screen and security there is an option for set pin on startup.
Also as an update to this method, if you had Xposed and magisk root, or if you had supersu and suhide, they need to all be reinstalled. This is the same method as flashing a stock bootloader then re-rooting afterwards. With new TWRP though you do not need to sideload because it has password to decrypt /data and allow flashing of the ramdisk, so you dont HAVE to sideload the supersu, but I suggest following TKK's tutorial exactly for sucess
cridtohs said:
in security Lock screen and security there is an option for set pin on startup.
Also as an update to this method, if you had Xposed and magisk root, or if you had supersu and suhide, they need to all be reinstalled. This is the same method as flashing a stock bootloader then re-rooting afterwards. With new TWRP though you do not need to sideload because it has password to decrypt /data and allow flashing of the ramdisk, so you dont HAVE to sideload the supersu, but I suggest following TKK's tutorial exactly for sucess
Click to expand...
Click to collapse
When you press encrypt you have to set such a password anyway so I don't see your point... You have to set a password, that is requested whenever you start your device... Is that not the same thing your describing?
Can't get encryption to work. The process starts and after a few seconds my phone just reboots.
Tested on several ROMs and Kernels, same result.
Anybody got an idea? I'm clueless...
unique730 said:
Can't get encryption to work. The process starts and after a few seconds my phone just reboots.
Tested on several ROMs and Kernels, same result.
Anybody got an idea? I'm clueless...
Click to expand...
Click to collapse
Same problem here - one more scream for HELP
unique730 said:
Can't get encryption to work. The process starts and after a few seconds my phone just reboots.
Tested on several ROMs and Kernels, same result.
Anybody got an idea? I'm clueless...
Click to expand...
Click to collapse
darkman088 said:
Same problem here - one more scream for HELP
Click to expand...
Click to collapse
When I tested this I had similar issues due to root. You made both a full unroot and followed all steps?
Sent from my SuperMan powered SM-G930F
Tkkg1994 said:
When I tested this I had similar issues due to root. You made both a full unroot and followed all steps?
Sent from my SuperMan powered SM-G930F
Click to expand...
Click to collapse
Hello and thanks for replying.
No, I didn't do a full unroot, because when I was testing this, I hadn't come across this thread And now I am not willing to invest that much time again, just to find out, that it's not working, once again
But I've tried many other strategies, which are very similar, but didn't work:
1) Disable SuperSU from the Application manager
2) Disable SuperSU from the settings of the app
3) Install busybox, boot in safe mode, connect the phone to my laptop, launche adb and enter there pkill -KILL daemonsu - this must be equivalent, as ps | grep daemonsu was not showing anything...
4) Tilting my phone in landscape mode
5) Repeating the attempt to encrypt several times after eachother
6) Many many more useless tips, which I found on the internet
Please kindly advise. Many thanks!
P. S.: HOW COME only the ROM of artas182x has encryption working PERFECTLY and I couldn't manage to encrypt my phone with no other ROM ? For example, I tried Slim ROM, which (if I'm not wrong) is not rooted and again - encryption didn't work, it hung somewhere along the process This is really terrible. Please excuse my total frustration
darkman088 said:
Hello and thanks for replying.
No, I didn't do a full unroot, because when I was testing this, I hadn't come across this thread And now I am not willing to invest that much time again, just to find out, that it's not working, once again
But I've tried many other strategies, which are very similar, but didn't work:
1) Disable SuperSU from the Application manager
2) Disable SuperSU from the settings of the app
3) Install busybox, boot in safe mode, connect the phone to my laptop, launche adb and enter there pkill -KILL daemonsu - this must be equivalent, as ps | grep daemonsu was not showing anything...
4) Tilting my phone in landscape mode
5) Repeating the attempt to encrypt several times after eachother
6) Many many more useless tips, which I found on the internet
Please kindly advise. Many thanks!
P. S.: HOW COME only the ROM of artas182x has encryption working PERFECTLY and I couldn't manage to encrypt my phone with no other ROM ? For example, I tried Slim ROM, which (if I'm not wrong) is not rooted and again - encryption didn't work, it hung somewhere along the process This is really terrible. Please excuse my total frustration
Click to expand...
Click to collapse
Ehm what is artas182x rom? or slim rom? we don't have that on our s7 as far as I know.
This guide may needs some adaptions to work on other devices
Tkkg1994 said:
Ehm what is artas182x rom? or slim rom? we don't have that on our s7 as far as I know.
This guide may needs some adaptions to work on other devices
Click to expand...
Click to collapse
It's a Marshmallow port from Galaxy S5 made by artas182x. I didn't like Slim ROM - it doesn't even have a file maanger
installed with it and when I tried encryption with it, it didn't work
Thank you!
We need someone xposed module to emulate knox 0x0 so that we can use knox again.
Tried with King Nougat V5 custom tom
After encryption finish and boot it keep showing "system ui has closed" error
I cannot type my password
Now doing full wipe
jimmod said:
Tried with King Nougat V5 custom tom
After encryption finish and boot it keep showing "system ui has closed" error
I cannot type my password
Now doing full wipe
Click to expand...
Click to collapse
I assume you have a modded systemUI. Try it with a stock one
Sent from my SuperMan powered SM-G930F
data encryption and root and TWRP toegether - is that working in android nougat ?
I really, really want encyption on my rooted S7 (930FD) incl. TWRP - but before I try this method here I have two questions:
- you are using the "terminal" - means you are using Linux? Or can I do this with windows powershell as well?
- encryption and root incl. TWRP works with Marshmallow MM only or will this work in Nougat as well?

Temporary root shell for developers on locked bootloaders.

Hello All! I am me2151.
I am here to tell you some kind of good news.
We have achieved a temporary root shell using a modified recowvery script. Originally Recowvery installed a custom "recovery" but I have modified it to instead create a temporary root shell using the System_Server SELinux context and disable the flashing portion of the script. Yes we are still limited until we can get Kernel or Init context but I am working on that as well.
This exploit will be useful down the line because of one major thing. WE CAN INSERT KERNEL MODULES!!! But they need to be signed. So I am releasing this out here so we can take the next step into our full root! We also have rw to the /data partition and changes save over a reboot.
If we can get someone to sign a kernel module that the system accepts we can set SELinux to permissive.
This exploit SHOULD work for all variants.
NOTE: This should only be used by devs who know what they are doing.
Instructions(this should work on MacOS and Linux only!):
Download linked file below.
Extract to either adb directory OR a directory you have adb access in.
Give execute permissions to temp.sh.
Run temp.sh.
When you are all done with your exploring and stuff type "Reboot" to reboot normally.
https://drive.google.com/open?id=0B8CP3g3AqMuHcmNJUUJWLUJUelE
Credit:
 @jcadduono - For recowvery, and pointing me in the right direction on IRC.
 @brenns10 - Wrote the lsh used in the exploit to spawn the shell.
The group over here for ideas and solutions.
Very cool work! Glad to see people putting my shell (such as it is) to good use. Wish I had a V20 to try it out
I don't think you'll ever be able to sign a kernel module (SHA512 hash). You'd probably have better luck signing your own boot image.
Here's a theory to toy with:
I think the way to do it would be to gain read access to /init binary allowing you to dirtycow /init with the same init binary but change a very specific (but not vital to system integrity) set of instructions to point back to the setenforce code with a value of 0 without disturbing the rest of the binary/instructions. This way, init should continue running without crashing and taking down the whole system, and you can do something that might trigger that specific instruction set - which would then result in selinux becoming permissive.
This is beyond me, unfortunately. This method would also be very device specific until someone also finds an intelligent way to read init, modify instructions, then dirtycow it back.
I think system server context might be able to read init?
Once you get your permissive selinux, you'll also have to deal with Unix capabilities limitations (find a way around them).
jcadduono said:
I don't think you'll ever be able to sign a kernel module (SHA512 hash). You'd probably have better luck signing your own boot image.
Here's a theory to toy with:
I think the way to do it would be to gain read access to /init binary allowing you to dirtycow /init with the same init binary but change a very specific (but not vital to system integrity) set of instructions to point back to the setenforce code with a value of 0 without disturbing the rest of the binary/instructions. This way, init should continue running without crashing and taking down the whole system, and you can do something that might trigger that specific instruction set - which would then result in selinux becoming permissive.
This is beyond me, unfortunately. This method would also be very device specific until someone also finds an intelligent way to read init, modify instructions, then dirtycow it back.
I think system server context might be able to read init?
Once you get your permissive selinux, you'll also have to deal with Unix capabilities limitations (find a way around them).
Click to expand...
Click to collapse
if system_server can read init then thats a serious flaw.... Question for you. you said it would be very device specific. does that mean its unique for each individual phone or each model?
EDIT:Unfortunately we only have access to the init.rc not the binary it self.
@jcadduono I appreciate your input and direction in this matter another idea we have been toying with is
We have the aboot boot recovery and system dump. From the tmob variant would it be possible to make a tot from that for our devices changing the props to match our device, build, and carrier info? We can also pull apks from /system/apps and /privapps to our ext sdcard
@me2151, @jcadduono, @brenns10: Great work guys, keep it up. Good to see some people are trying for root. What model/s are being tested, or should this theoretically work on all models? Whilst you probably aren't doing it for the cash, there is a bounty I hope someone can claim soon, for a functonal root alone (not boot unlock) posted on this board.
RoOSTA
roosta said:
@me2151, @jcadduono, @brenns10: Great work guys, keep it up. Good to see some people are trying for root. What model/s are being tested, or should this theoretically work on all models? Whilst you probably aren't doing it for the cash, there is a bounty I hope someone can claim soon, for a functonal root alone (not boot unlock) posted on this board.
RoOSTA
Click to expand...
Click to collapse
It should work on all models. I personally use a sprint model(LS997). I think it MAY have been tested on VZW as well.
I can confirm that work on H990DS
Sent from my MI PAD using XDA-Developers mobile app
We know from earlier LG phone releases that the laf partition when bypassed in some way (corrupted, etc) aboot will boot to fastboot when going into download mode. It was my thought that the bootloader could be unlocked from there. However corrupting laf eliminates device recovery. Catch-22.
I think the best way to proceed is to get a working .TOT first which is just a waiting game. That would ensure device recovery and replacing the bootloader in the .TOT and signing it with something unlockable.
This is a great way to explore the locked phones in the meantime, thanks.
ATT Pretty Please
me2151 said:
Hello All! I am me2151.
I am here to tell you some kind of good news.
We have achieved a temporary root shell using a modified recowvery script. Originally Recowvery installed a custom "recovery" but I have modified it to instead create a temporary root shell using the System_Server SELinux context and disable the flashing portion of the script. Yes we are still limited until we can get Kernel or Init context but I am working on that as well.
This exploit will be useful down the line because of one major thing. WE CAN INSERT KERNEL MODULES!!! But they need to be signed. So I am releasing this out here so we can take the next step into our full root! We also have rw to the /data partition and changes save over a reboot.
If we can get someone to sign a kernel module that the system accepts we can set SELinux to permissive.
This exploit SHOULD work for all variants.
NOTE: This should only be used by devs who know what they are doing.
Instructions(this should work on MacOS and Linux only!):
Download linked file below.
Extract to either adb directory OR a directory you have adb access in.
Give execute permissions to temp.sh.
Run temp.sh.
When you are all done with your exploring and stuff type "Reboot" to reboot normally.
https://drive.google.com/open?id=0B8CP3g3AqMuHcmNJUUJWLUJUelE
Credit:
@jcadduono - For recowvery, and pointing me in the right direction on IRC.
@brenns10 - Wrote the lsh used in the exploit to spawn the shell.
The group over here for ideas and solutions.
Click to expand...
Click to collapse
At the moment all I am using root for is to add a line within my build.prop to disable Tethering checks, so I can tether at full 4G speed and not get throttled. Would this be possible using the method above, or would build.prop immediately get replaced at the reboot?
Thanks, and keep up the good work!
NRadonich said:
At the moment all I am using root for is to add a line within my build.prop to disable Tethering checks, so I can tether at full 4G speed and not get throttled. Would this be possible using the method above, or would build.prop immediately get replaced at the reboot?
Thanks, and keep up the good work!
Click to expand...
Click to collapse
no. it is a tcp root shell that can only do a few things such as kernel modules.. only section we were able to write to and have it stick was the /data partition which wont help you in this scenario
elliwigy said:
no. it is a tcp root shell that can only do a few things such as kernel modules.. only section we were able to write to and have it stick was the /data partition which wont help you in this scenario
Click to expand...
Click to collapse
So if we can write to data partition then in theory can we adb push to it using this? I ask because I'd like to install some tbo apps that normally would require flashing. But if we could push them we would be solid
markbencze said:
So if we can write to data partition then in theory can we adb push to it using this? I ask because I'd like to install some tbo apps that normally would require flashing. But if we could push them we would be solid
Click to expand...
Click to collapse
Unfortunately its a tcp shell. not a pure adb shell. so we cannot push or pull to those directories
Wow great progress keep up the good work. You guys are helping those assholes from LG sell more phones. Obviously some people have not made the switch because the lack of root. Root users are very influential leaders to get others to try out a new device.
Sent from my LG-LS997 using XDA-Developers mobile app
Works on the LG G5 also...
Hey guys, with the expectation of many that 'root is coming' to the other v20 models...are we likely to see the same type of root format that applied to the LG G4, where you have to (either) download or rip your own image to a PC. Use commands to insert root, then reflash to the device?
Any root is better than nothing, I know...but I ask because with the amount of software updates for the G4 (v10c software through to v10k before MM came out), meant the sheer amount of times you'd have to go through this process to keep your phone up to date whilst maintaining root was extremely frustrating - as it also meant xposed and related settings/apps needed to be reinstalled each time you performed an OTA update and re-flashed root.
Is this going to be a side effect of dealing with a locked bootloader? PS: If I sound dumb, it's probably because I am.
RoOSTA
roosta said:
Hey guys, with the expectation of many that 'root is coming' to the other v20 models...are we likely to see the same type of root format that applied to the LG G4, where you have to (either) download or rip your own image to a PC. Use commands to insert root, then reflash to the device?
Any root is better than nothing, I know...but I ask because with the amount of software updates for the G4 (v10c software through to v10k before MM came out), meant the sheer amount of times you'd have to go through this process to keep your phone up to date whilst maintaining root was extremely frustrating - as it also meant xposed and related settings/apps needed to be reinstalled each time you performed an OTA update and re-flashed root.
Is this going to be a side effect of dealing with a locked bootloader? PS: If I sound dumb, it's probably because I am.
RoOSTA
Click to expand...
Click to collapse
it shouldnt be an expectation as weve made it clear we do not have root and are hitting hurdles.. we have been advised we need to atack selinux and or the bl but at this point were wanting to try to use debug firmware which hoprfully would allow a bl unlock..
unfortunately nobody can creat a .tot with the debug firmware at al and theres no way at all to flash the images..
we need to somehow leverage an exploit to gain a temp adb root shell before we could even attempt anything and this has not been done in a way thats useful to us..
unfortunately we need more experienced devs at this point.
LG Australia (and as such, Taiwan) have effectively confirmed their H990DS v20 mobile phone's bootloader is confirmed as being unlockable. However (and for no apparent reason) they will not confirm why one region have released a variant of the phone with the bootloader unlock and why they are refusing this to others phones/regions. Because of course, they have zero training and information about anything related to their company expect for goods released in a specific region. That comes from a 'product expert'
Titanium Backup
Howdy,
Just reading through the thread, I understand that it's not quite a "full" root, but would it be enough to run Titanium Backup? I'm hoping to move away from root access with my V20 but it would be really helpful if I could do it temporarily, restore some application and data backups, reboot and uninstall Titanium.
Tim

I've deleted some important files by mistake and I would really like to recover them.

Hello,
I hope that this is the right side of the forum to describe my problem. I desperately need help. It's a long story:
I had on my Samsung phone the app of "Chrome", which I always use to surf the internet. Using the google browser IN THAT APP, I have downloaded lots of things (I'm a scholar, so I like to read and I use to download everything that I found interesting). I have updated the app and I was frustrated, because I couldn't take anymore screenshots while surfing in "incognito mode". So, I decided to delete the update: i went into "settings", then "apps", and then I have brought back the app of "Chrome" as it was when i bought my phone. Sadly, I then noticed that I had lost every file in my download folder; I had lost every file downloaded with that app.
I had not synchronized my Google account, I can do no backup. I'm so angry and sad because I've always thought that the files downloaded would have stayed in my phone until I and only I would have decide to delete them.
I have done a lot of research on the internet and I have found out that there are some apps that can recover a very large part of lost files. But, in order to do this, I have to root my phone.
My phone is a Samsung Galaxy J2 SM-J250Y/DS, and the Android version is 7.1.1. I have seen that rooting a phone could be very dangerous; also, to me is very complicated. But there is a program called Kingoroot, which, once installed on my computer, could (it's a possibility, I know!) rooting my phone easily.
What should I do? Should I try the rooting method? It seems to me the only way...
I ask you any suggestions... Please help me. I am a depressed student that, in this life, can only enjoy reading and books...
(I am Italian, and I hope my English is understandable. If I did any mistake, please forgive me.)
Sorry can't help you get what you lost back... I feel your pain.
After losing thousands of bookmarks over the decades I started using Colornotes to save my important bookmarks.
You can save the hyperlink with a title, color, and whatever text you want to add. If you punch the hyperlink it opens in the default browser.
The app allows you to save it's data to your sd card which you can backup on your PC.
Use ApkExport to make a loadable copy of the app to future proof it.
ColorNote Notepad Notes - Apps on Google Play
ColorNote® - Easy to use notepad for notes, shopping list, to-do list, calendar
play.google.com
Thank you very much for your reply.
But... If I root my phone, and if the rooting is done without any damage, is there a possibility to get most of my files back? Or, even if I root my device, I will never be able to recover them?
It sounds like it deleted the data when you rolled the apk back (to factory load?).
If so it's going to be very sketchy at best to recover them.
I guess history's been deleted as well?
There are many coders here that have far greater knowledge than myself with Chrome.
My understanding of rooting is very basic as with Chrome which I rarely use.
If no one else replies in a day or two, bump it back to the top. Hope you find a work around solution.
AlexiusFrigerius said:
But... If I root my phone, and if the rooting is done without any damage, is there a possibility to get most of my files back? Or, even if I root my device, I will never be able to recover them?
Click to expand...
Click to collapse
Rooting Android by means of TWRP and/or Magisk ( keyword: SuperSU ) affects its /data partition where phone's data typically are housed. Therefore it cannot be excluded that data stored there is overwritten and can therefore no longer be restored.
jwoegerbauer said:
Rooting Android by means of TWRP and/or Magisk ( keyword: SuperSU ) affects its /data partition where phone's data typically are housed. Therefore it cannot be excluded that data stored there is overwritten and can therefore no longer be restored.
Click to expand...
Click to collapse
Is there the possibility if deleted that it's still on the system cache and is there a way to recover it if so on a none rooted phone?
Maybe using ABD?
Don't some on the "one touch" root solutions claim to preserve the data?
Android doesn't have a recycle bin thus nothing gets cached. Deleting a file means nothing else than marking the space it occupies - whereever this disk space is located - as usable so that it can be overwritten by the system.
Have never used a "One-Click-Root" utility ...
blackhawk said:
It sounds like it deleted the data when you rolled the apk back (to factory load?).
If so it's going to be very sketchy at best to recover them.
I guess history's been deleted as well?
There are many coders here that have far greater knowledge than myself with Chrome.
My understanding of rooting is very basic as with Chrome which I rarely use.
If no one else replies in a day or two, bump it back to the top. Hope you find a work around solution.
Click to expand...
Click to collapse
Yes, it's just like I told. And yes, even history has been deleted.
Thank you for your help! I will wait until someone may give me a solution, or a possibility for a solution.
jwoegerbauer said:
Rooting Android by means of TWRP and/or Magisk ( keyword: SuperSU ) affects its /data partition where phone's data typically are housed. Therefore it cannot be excluded that data stored there is overwritten and can therefore no longer be restored.
Click to expand...
Click to collapse
Ok, I understand...
jwoegerbauer said:
Android doesn't have a recycle bin thus nothing gets cached. Deleting a file means nothing else than marking the space it occupies - whereever this disk space is located - as usable so that it can be overwritten by the system.
Have never used a "One-Click-Root" utility ...
Click to expand...
Click to collapse
Thank you for your explanation.
jwoegerbauer said:
Android doesn't have a recycle bin thus nothing gets cached. Deleting a file means nothing else than marking the space it occupies - whereever this disk space is located - as usable so that it can be overwritten by the system.
Have never used a "One-Click-Root" utility ...
Click to expand...
Click to collapse
Yeah I was aware of the overwrite issue but on an unrooted device I don't think you can access the system cache. Even if you could the data could be so juxtaposed from lose of file structure as to be unusable.
One-Click-Root worked on older versions of Kitkat allegedly.
So... I understand. But I want to try. I want to root my phone. But I have to know how and I must prevent my phone from all the risks.
blackhawk: you said that the "One-Click-Root" method worked only for Kitkat Android. But I have read here that with Kingoroot i could have a chance:
How to Root Android Nougat (7.0/7.1) | KingoRoot Apk
Root any Android Nougat 7.0 7.1 device with KingoRoot.
www.kingoapp.com
(It's important: I AM NOT SPAMMING Kingoroot, I just want to understand If I can trust what it's written in their site. Also, in the link, at the end of the page, there is written that I can root my phone with my PC, which, to me, seems a safer way. It's the main idea I had when I decided to write in this forum, because I wanted to know the opinions of people that are very able to use these methods and these kind of programs.)
AlexiusFrigerius said:
So... I understand. But I want to try. I want to root my phone. But I have to know how and I must prevent my phone from all the risks.
blackhawk: you said that the "One-Click-Root" method worked only for Kitkat Android. But I have read here that with Kingoroot i could have a chance:
How to Root Android Nougat (7.0/7.1) | KingoRoot Apk
Root any Android Nougat 7.0 7.1 device with KingoRoot.
www.kingoapp.com
(It's important: I AM NOT SPAMMING Kingoroot, I just want to understand If I can trust what it's written in their site. Also, in the link, at the end of the page, there is written that I can root my phone with my PC, which, to me, seems a safer way. It's the main idea I had when I decided to write in this forum, because I wanted to know the opinions of people that are very able to use these methods and these kind of programs.)
Click to expand...
Click to collapse
You can try it; it will either work or nothing will happen. Even if it works it's likely those files are gone. Maybe better to chalk it up to another lesson from the University of Hard Knocks.
You could try contacting Google tech support to see if they have any ideas.
The last AT&T firmware update was specifically to block easy rooting by Kingroot; the rats learn quick.
blackhawk said:
You can try it; it will either work or nothing will happen. Even if it works it's likely those files are gone. Maybe better to chalk it up to another lesson from the University of Hard Knocks.
You could try contacting Google tech support to see if they have any ideas.
The last AT&T firmware update was specifically to block easy rooting by Kingroot; the rats learn quick.
Click to expand...
Click to collapse
Thank you very much for your help. I understand: I must give up. But the most important thing is to learn something about anything we do. Anything could help for future situations.
"It's a shame to stumble twice on the same stone" (Polybius, 31,11, 5).
Thank you again. Goodbye!
AlexiusFrigerius said:
Hello,
I hope that this is the right side of the forum to describe my problem. I desperately need help. It's a long story:
I had on my Samsung phone the app of "Chrome", which I always use to surf the internet. Using the google browser IN THAT APP, I have downloaded lots of things (I'm a scholar, so I like to read and I use to download everything that I found interesting). I have updated the app and I was frustrated, because I couldn't take anymore screenshots while surfing in "incognito mode". So, I decided to delete the update: i went into "settings", then "apps", and then I have brought back the app of "Chrome" as it was when i bought my phone. Sadly, I then noticed that I had lost every file in my download folder; I had lost every file downloaded with that app.
I had not synchronized my Google account, I can do no backup. I'm so angry and sad because I've always thought that the files downloaded would have stayed in my phone until I and only I would have decide to delete them.
I have done a lot of research on the internet and I have found out that there are some apps that can recover a very large part of lost files. But, in order to do this, I have to root my phone.
My phone is a Samsung Galaxy J2 SM-J250Y/DS, and the Android version is 7.1.1. I have seen that rooting a phone could be very dangerous; also, to me is very complicated. But there is a program called Kingoroot, which, once installed on my computer, could (it's a possibility, I know!) rooting my phone easily.
What should I do? Should I try the rooting method? It seems to me the only way...
I ask you any suggestions... Please help me. I am a depressed student that, in this life, can only enjoy reading and books...
(I am Italian, and I hope my English is understandable. If I did any mistake, please forgive me.)
Click to expand...
Click to collapse
Hi, I would suggest you can try free tool for Android Phone such as Stellar Data Recovery for Android which easily recover deleted files like, photos, audio files, videos files from your Android phone internal memory storage.
Source: https://www.stellarinfo.com/media-tools/android-data-recovery.php
{Mod edit: Quoted post has been deleted}
That drfone again. Scamware.
Do Not Use.
Drfone if used will encrypt "recovered" data and ask you to pay for it. After which the original data is gone leaving only the encrypted copy.
It is not free... not to be trusted!
Ran into this scam many years ago.

samsung galaxy s9 root android 10 exynos

Hello, is there a way to root the phone where everything works now (Bluetooth, Face ID, etc.)?
I would very much like to see this answered. I've seen some application-specific instructions such as this reddit thread for enabling Samsung Health, and I've read about hiding the fact that the phone is rooted from apps by using MagiskHide, but it's not clear whether this works for all apps and features or just some. There's also this recently updated guide to rooting that claims:
Magisk is a highly advanced way of rooting android systemless-ly. This means that Magisk root android without changing or modifying the system partition. Hence you can receive OTA updates, run apps that require to pass Google’s SafetyNet tests.
Click to expand...
Click to collapse
However, many hacks that sound good when you read about them in advance run into snags and gotchas once you actually get into implementing them, and I'm hesitant to just give it a try and see how it works out when tripping Knox is irreversible and if things stop working you can't get them back by flashing the stock ROM.
I'd be grateful if anyone who has actual experience on this subject could vouch for being able to re-enable all lost functionality after rooting or to not lose it in the first place, or whether even some lost functionality can be enabled (and if so, what have you been able to get working and what haven't you? I don't know about OP, but to me the most important ones are Secure Folder and Samsung Health).
Also, does anyone have experience with retaining Knox-sensitive functionality on rooted S9 Exynos with Android 11 (either rooting after upgrading to 11, or rooting first and retaining root when upgrading)?
@bis225
IMO noone needs Magisk to root a device's Android. Rooting Android means having the SU-binary present on Android - a ~100KB file - nothing else. Copying SU-binary onto Android allows you to temporariy give you root access when needed.
jwoegerbauer said:
@bis225
IMO noone needs Magisk to root a device's Android. Rooting Android means having the SU-binary present on Android - a ~100KB file - nothing else. Copying SU-binary onto Android allows you to temporariy give you root access when needed.
Click to expand...
Click to collapse
I'm not sure I understand what you're saying. Are you telling me that you can simply copy the file onto an unrooted phone, and voila, you can gain root access?? Can you point to information about what to do and how this works? It runs contrary to everything I've ever read on the subject.
To the best of my understanding, in order to install su binary unto an unrooted phone you need to install a custom recovery, and use that to flash the su binary onto the phone. I thought the idea of Magisk was to provide root access without modifying system files so that SafetyNet can't detect that the system has been modified. Unless I'm missing something there's no disadvantage to rooting with Magisk, only advantages, but regardless, I don't see how it makes a difference with respect to this topic. Installing a custom recovery is what trips Knox and prevents some features and apps from working, so it doesn't really matter what root method you use if you have to use a custom recovery to install it.
If you know of a way to root a Galaxy S9 without using a custom recovery or tripping Knox and that can't be detected by SafetyNet, please elaborate.
Rooting Android simply means to add a ( hidden ) user called root ( AKA super-user ) who has ALL rights to Android's file system.
For example from within ADB you activate this user and let run him any command what requires to have ALL rights - assumed the SU-binary is located in /sdcard
Code:
adb shell "/sdcard/su -c '<command-here>'"
AFAIK Magisk installs the SU-binary in /data/adb/magisk/busybox, but I may err.
@jwoegerbauer
But I didn't ask what rooting means. Unfortunately, this doesn't answer any of my questions.
I think I clearly expressed that neither a Custom Revovery nor Magisk itself is needed to have root, that simply copying SU-binary to Android's user-space is enough.
If you want to root via Magisk then do it.
Personally never would do it this way.
jwoegerbauer said:
I think I clearly expressed that neither a Custom Revovery nor Magisk itself is needed to have root, that simply copying SU-binary to Android's user-space is enough.
If you want to root via Magisk then do it.
Personally never would do it this way.
Click to expand...
Click to collapse
This really seems contrary to everything I've read, and this Stack Exchange thread specifically explains why that wouldn't work, but if you say you have experience with this and it works for you, I'm certainly willing to give it a try and see how far it gets me. Do you know where a copy of the su binary can be obtained? All my searches for su binary lead to the supersu APK and instructions for installing it by flashing, or something along those lines. I can't find an su executable that can just be copied to internal storage as-is anywhere.

Categories

Resources