Database Users

[Tutorial] Wonderfully Root 6.2.1 with SuperOneClick, ADB, kindleroot_androidpolice

The method is similar to the original Root tutorial before but with help of kindleroot_androidpolice.apk released from http://www.androidpolice.com as more obstacles in 6.2.1.
1. Download kindleroot_androidpolice.apk
http://www.androidpolice.com/2011/1...on-kindle-regardless-of-its-software-version/
2. Copy kindleroot_androidpolice.apk to your Kindle Fire device and install it.
3. Run it! Click Agree > You Rock > Root
4. Now you can connect your Kindle fire to your PC with USB line.
For the Windows System:
Start > Run > CMD
Code:
cd C:\Program Files\Android\android-sdk\platform-tools
(I installed the SDK by default so you can see my directory above that way)
If you installed your SDK to C:\Android then you should
Code:
cd C:\Android
If you download some guy's package for ADB and unzipped it to C:\adb, simply you should enter command
Code:
cd C:\adb
5. Download the latest version for SuperOneClickv2.3.2-ShortFuse from official site http://shortfuse.org/?p=171
Unzip the package and Run SuperOneClick.exe
Click Root Button
Unfortunately you will find that the commands will stop at WaitForDevice.
What should we do now?
6. Don't be panic! Just Run these lines in your command window:
Code:
adb root
adb kill-server
adb remount
Everything is okay now and the commands will be continued to END
Root completely
You can check SuperUser working well again on your KF
Screenshot images and package files are post in a Chinese Kindle Fire Forum, just check them at:
http://www.92kindle.com/thread-2905-1-1.html

Damn I think I'm gonna try that after installing 6.2.1 but it better work.
Sent from my Kindle Fire using Tapatalk

Anyone tried this method yet and can confirm that it works?

The method on androidpolice works. I am running 6.2.1 rooted right now!

Course BurritoRoot works, with a name like that it has to
edit
trollololololol

Actually this method works better. There seems to be a problem with the su program on androidpolice. It gives root alright but some programs don't get root access for some reason. SuperOneClick works better.

jlocohustler said:
Actually this method works better. There seems to be a problem with the su program on androidpolice. It gives root alright but some programs don't get root access for some reason. SuperOneClick works better.
Click to expand...
Click to collapse
i dont know if u read! but superoneclick was broken after last update, and jcase was nice enough to root this blindly so we could root !!!

jlocohustler said:
Actually this method works better. There seems to be a problem with the su program on androidpolice. It gives root alright but some programs don't get root access for some reason. SuperOneClick works better.
Click to expand...
Click to collapse
SuperOneClick can not root 6.21. Hence the use of BurritoRoot in the OP.
Methods to gain root are the same, since they use the same app to do it.
There was a problem with the su binary on AP but its been replaced.

I can verify the Android Police method works just fine without the SuperOneClick. Triedit twice, rooted then unrooted so I could watch Prime Video, then rerooted so I can install OTA Rootkeeper so I could watch video without unrooting. Only difference for me was I had SuperUser already from my pre-6.2.1 root but its the same as the the one AP distributes.
FYI my computer is a Mac so this was executed from shell.

Ibis, can you give me some more information on how you did this on a Mac?
I tried and it seemed to work but don't think it took as I cant copy the framework Apk to system/apps and when I try to run market it force closes with a vending error.

[q] help needed on 6.2.1

Hi all,
I got my KF few days back, Rooted it, before I could install the android market, got forced update to 6.2.1. 2 days ago saw this new root method using BurritoRoot. Tried rooting it, seems successful, however, now when I arrived at the home page, I cant even open the Superuser app at all. It goes the same for the Root Explorer - prompting:
"Root Explorer has not yet managed to obtain root access. Because of issues with Superuser, this often happens the first time the app is run but is usually fine from then on. Click ok and restart the app and try again. Make sure u respond correctly to the Superuser prompt." Then it comes with a force close.
Seriously I do not know whats wrong with it, now i cant even use the root explorer for me to install Android Market.
Anybody can help me with it?
Million Thanks.

did you use the superuser-2.apk ?
http://forum.xda-developers.com/showthread.php?p=20645033&highlight=superuser-2+apk#post20645033

b63 said:
did you use the superuser-2.apk ?
http://forum.xda-developers.com/showthread.php?p=20645033&highlight=superuser-2+apk#post20645033
Click to expand...
Click to collapse
Im using the ROOT INSTALL - Method 1 and I downloaded the file from Rootzwiki, apparently the file is named "com.noshufou.android.su-1.apk". and I used the following commands:
adb root
adb remount
adb push su /system/xbin/su
adb shell chown 0.0 /system/xbin/su
adb shell chmod 06755 /system/xbin/su
adb install com.noshufou.android.su-1.apk
adb reboot
So which means I should use the Superuser -2.apk instead?
What should I do now? Download the Superuser-2 file and repeat the whole process again???
thanks.

yes - the new version seems to be the only one working with burritoroot
consider to use KFU to make things easier:
http://forum.xda-developers.com/showthread.php?t=1399889
should be option 2 (permanent root with superuser)

[ROOT] Disable Automatic Update (OTA) New Kindles

This Method disable ota services.
steps:
-Decompress the attached file
-Execute the following commands:
<important>Please look the screen for superuser permission grant.
Code:
adb push disable_ota_for_kindle.sh /data/local/tmp/
adb shell "su -c 'chmod 777 /data/local/tmp/disable_ota_for_kindle.sh'"
adb shell "su -c '/data/local/tmp/disable_ota_for_kindle.sh'"
adb shell "rm /data/local/tmp/disable_ota_for_kindle.sh"
Tested in a Kindle Fire 2 (10.2.3_user_2313820

julionadal said:
This Method disable ota services.
steps:
-Decompress the attached file
-Execute the following commands:
<important>Please look the screen for superuser permission grant.
Code:
adb push disable_ota_for_kindle.sh /data/local/tmp/
adb shell "su -c 'chmod 777 /data/local/tmp/disable_ota_for_kindle.sh'"
adb shell "su -c '/data/local/tmp/disable_ota_for_kindle.sh'"
adb shell "rm /data/local/tmp/disable_ota_for_kindle.sh"
Tested in a Kindle Fire 2 (10.2.3_user_2313820
Click to expand...
Click to collapse
Guessing this can only be confirmed at the time of the next update for me. Currently running 7.2.2 on KFHD.
Will download and give it a go.
Thanks.

Droidwall is a good solution for this too. You can block all Apps for using the Internet connection to call "home"

This script looks to disable all OTA services. Would that not included whispersync, the personal documents service etc? it is possible that blocking all of these services may have undesired consequences to folks who value those services. That said, thanks for developing this script.

Can you provide more details on how to disable OTAs using Droidwall? I downloaded the application but I am not sure which applications I need to block or how to configure.
Sent from my KFTT using xda premium

Should I disable the system app in the center of the screenshot? Will it lock up the device if I do so?
Sent from my KFTT using xda premium

ameswilliam said:
Should I disable the system app in the center of the screenshot? Will it lock up the device if I do so?
Sent from my KFTT using xda premium
Click to expand...
Click to collapse
I installed DroidWall and blacklist all amazon apps, but it still update to 7.2.2 version. I doubt DroidWall can off OTA update

Did you blacklist the 10000. System file seen in the attachment?
Sent from my SPH-L710 using xda premium

Ok, so I used the OP's .SH file, and then read a bit further on this thread and realized his code would disable whispersync too.
Is there any way to reverse his code? I tried to go into his code and change the word "disable" to "enable" but the file would not execute anymore. I have no idea why. I did not change the file name, but ADB keeps telling me "no such file or directory"
Can anyone please help? I'm using Fire HD 8.9 ver. 8.1.3
After i reverse the code, I will just use droidwall
Thanks for your help.

pullmyfinger123 said:
Ok, so I used the OP's .SH file, and then read a bit further on this thread and realized his code would disable whispersync too.
Is there any way to reverse his code? I tried to go into his code and change the word "disable" to "enable" but the file would not execute anymore. I have no idea why. I did not change the file name, but ADB keeps telling me "no such file or directory"
Can anyone please help? I'm using Fire HD 8.9 ver. 8.1.3
After i reverse the code, I will just use droidwall
Thanks for your help.
Click to expand...
Click to collapse
Try running each command with ADB.
I'm not familiar with the disable 'pm' command but know that services can be enabled/disabled via titanium backup. Dont know if this is the same function but you could install it and give it a go.

bryanchapman9999 said:
Try running each command with ADB.
I'm not familiar with the disable 'pm' command but know that services can be enabled/disabled via titanium backup. Dont know if this is the same function but you could install it and give it a go.
Click to expand...
Click to collapse
Yea I dont see any service that's already frozen using Titanium Backup. Can anyone else who knows what this guy's code did help me reverse it? Thanks.
This is his code:
#!/system/bin/sh
pm disable "com.amazon.dcp/.ota.OTAUpdateMessageHandler"
pm disable "com.amazon.dcp/.ota.InventoryUploadService"
pm disable "com.amazon.dcp/.ota.UpdatesLookupService"
pm disable "com.amazon.dcp/.ota.OTAService"
pm disable "com.amazon.dcp/.ota.AppStateMonitorService"
pm disable "com.amazon.dcp/.ota.CheckForOTAUpdatesService"
pm disable "com.amazon.dcp/.ota.ViewUpdateActivity"
pm disable "com.amazon.dcp/.ota.OTAStatusActivity"
pm disable "com.amazon.dcp/.ota.ResetOTAMessageHandler"
pm disable "com.amazon.dcp/.ota.InventoryUploadService$InventoryUploadReceiver"
pm disable "com.amazon.dcp/.ota.UpdatesLookupService$MountStatusChangedReceiver"
pm disable "com.amazon.dcp/.ota.OTAService$OTAWakeupReceiver"
pm disable "com.amazon.dcp/.ota.OTAService$OTADedupeReceiver"
pm disable "com.amazon.dcp/.ota.OTAService$OTAInstallNowReceiver"

Disable OTA Updates - Kindle Fire 7" HD
Very well thought out script.
On my Kindle Fire 7" HD all I did was moved /system/ect/security/otacerts.zip to /sdcard/download - Reboot the Kindle.
So far no updates, still on 7.2.2

Thanks!
thanks Bro for sharing.just wanted to feedback after doing these procedures.my kindle fire HD 7" is not updating anymore.i give it two thumbsup!now i still have the same build 7.2.2 for almost more than a month even if Amazon has the newest build 7.2.3 thanks alot.it really helps

Thanks for the script. Looks like it worked ok for me...Just wondering about the whisper sync deal? Does it still work"

Whisper Sync Disabled
ninjabeaver said:
Thanks for the script. Looks like it worked ok for me...Just wondering about the whisper sync deal? Does it still work"
Click to expand...
Click to collapse
ninjabeaver,
This script does disable Whisper Sync which is why we had our developers redesign a scipt to remove the OTA Services
only. Here is the less aggressive version:
http://forum.xda-developers.com/showthread.php?t=2086450
when we developed the attached script we were very careful to only effect OTA and no other services. We also wrote
an enable script for the people who need to send back there Kindles for repair.

Right on thanks..I hadn't seen that thread before.
Sent from my KFTT using Tapatalk HD

prokennexusa said:
Very well thought out script.
On my Kindle Fire 7" HD all I did was moved /system/ect/security/otacerts.zip to /sdcard/download - Reboot the Kindle.
So far no updates, still on 7.2.2
Click to expand...
Click to collapse
Hows it going, did you just move otacerts.zip and not block it tru droidwall?

prokennexusa said:
ninjabeaver,
This script does disable Whisper Sync which is why we had our developers redesign a scipt to remove the OTA Services
only. Here is the less aggressive version:
http://forum.xda-developers.com/showthread.php?t=2086450
when we developed the attached script we were very careful to only effect OTA and no other services. We also wrote
an enable script for the people who need to send back there Kindles for repair.
Click to expand...
Click to collapse
If I had used this script on my KF2 but now have installed TWRP and installed new ROM, would I need to run this again ?

Does this script prevent syncing with google play?
I rooted my kindle fire 2 and I ran this script. I uploaded songs onto google play music, but i'm unable to find songs I'd uploaded to the site.
Is it because of this script that google play is unable to sync with my kindle?
Thanks

julionadal said:
This Method disable ota services.
steps:
-Decompress the attached file
-Execute the following commands:
<important>Please look the screen for superuser permission grant.
Code:
adb push disable_ota_for_kindle.sh /data/local/tmp/
adb shell "su -c 'chmod 777 /data/local/tmp/disable_ota_for_kindle.sh'"
adb shell "su -c '/data/local/tmp/disable_ota_for_kindle.sh'"
adb shell "rm /data/local/tmp/disable_ota_for_kindle.sh"
Tested in a Kindle Fire 2 (10.2.3_user_2313820
Click to expand...
Click to collapse
Good afternoon:
Is it possible to provide this service in an APK?
This would allow the user to simply install the APK and then select enable or disable OTA as required?
The User would not have to know anything about ADB and related commands.
If I knew how to create APK apps I would give it a try.
Regards

[TUTORIAL] How to Manually ROOT your RK3066 Device (UG007, iMitio MX1/2, mk808?)

These are instructions for rooting Android devices that utilize the RK3066 chipset (Cortex A9 Dual Core, MALI Quad-Core GFX).
I have tested and verified that these instructions work for the UG007 Android-on-a-stick...they *should* work with any other devices that utilize the same USB chipset. I can almost guarantee this will work on the Imito MX1/2 as you can swap ROMS from this device.
(Basically, if you have the right ADB drivers, you should be good to go)
As per every other thread you read on this site - I TAKE NO RESPONSIBILITY FOR ANY DAMAGES YOU MAY CAUSE TO YOUR DEVICE.
This is a fairly risk-free mod, but you know...$hit happens.
Okay. Let's start.
THIS TUTORIAL ASSUMES YOU HAVE ADB AND KNOW HOW TO USE IT, and that you're in a Windows environment. There are numerous places on the web where you can find this info...and I ain't yo mamma.
1. Download all the files attached to this thread.
2. Attach your RK3066 device to your computer via it's microUSB port. You'll need to have it hooked to a display too.
3. Once booted, go to system settings. Under settings > developer options, enable USB Debugging. Under settings > USB, click "connect to computer" (This may vary depending on your ROM configuration. The point here is to have debugging enabled and your computer to recognize the stick in device manager as something other than USB storage)
4. Extract the right drivers for your system (x86/x64)
5. Go to device manager on your computer. Look for the new "unknown device". Right-click, pick "update driver software"., "browse my computer".
6. Browse to wherever you extracted the drivers in step 4. Click Next. Confirm that you want to install.
7. Open a command window in the directory where you have ADB. Type "adb devices". Still nothing, right?
8. Navigate to C:\users\MYUSERNAME\.android, where "MYUSERNAME" is your User Name. (Duh?)
9. Create a file called adb_usb.ini
10. Open it in a text editor. Add the following string and save (This tells ADB to look for our Vendor ID:
0x2207
11. You should now be able to type "adb devices" at CMD and see your device.
12. Now for the fun. Extract the stuff from "pushme" to the same directory as ADB.
13. Enter the following commands (note: The "$" and "#" symbols do not get keyed in):
Code:
adb push psneuter /data/local/tmp
adb shell
$ cd /data/local/tmp
$ chmod 777 psneuter
$ ./psneuter
14. Psneuter should run and close shell when done. Enter MOAR commands:
Code:
adb kill-server
adb devices
adb shell
15. Take a good look. Is there now a "#" sign? Good. You now have root access. You may continue. If not, then proceed to go yell at me in the comments. If yes, then proceed to enter the last batch of commands to make your newfound privileges permanent:
Code:
mount -o remount,rw -t rfs /dev/block/st19 /system
exit
adb push busybox /system/bin
adb push su /system/bin
adb install Superuser.apk
adb shell
# chmod 4755 /system/bin/busybox
# chmod 4755 /system/bin/su
# mount -o remount,ro -t rfs /dev/block/st19 /system
# exit
adb reboot
After a reboot, download a root app from Play Store to see if it worked! I find Root Checker is boffo for this sort of thing:
https://play.google.com/store/apps/...tcheck&feature=nav_result#?t=W251bGwsMSwyLDNd
THANKS/CREDITS:
Aaron Orquia @ Pocketables.com for the original "universal" root method.
AMJtech's tutorial where I found working ADB drivers and the adb_usb.ini bit to get it recognized.
The guy(s) who make Super1ClickRoot for putting all the necessary files in one easy-to-find spot.

Thanks for this tutorial.
A couple of notes:
Wow !! That's a lot of extra steps for you Windows users. Mac and Linux users start at step 11 (but if you are a Mac or Linux user, you already knew that. )
Linux: If the device still does not show up in Step 11, post, and I can help (Hint: It may not be /just/ the udev stuff.)
Is step 13 necessary? adb remount works on mine. (not sure if I had to adb root first or not) but I can have a root shell via adb without psnueter.
If adb remount succeeds, skip step 14, and continue with the 3rd line of step 15.

Linuxslate said:
Thanks for this tutorial.
A couple of notes:
Wow !! That's a lot of extra steps for you Windows users. Mac and Linux users start at step 11 (but if you are a Mac or Linux user, you already knew that. )
Linux: If the device still does not show up in Step 11, post, and I can help (Hint: It may not be /just/ the udev stuff.)
Is step 13 necessary? adb remount works on mine. (not sure if I had to adb root first or not) but I can have a root shell via adb without psnueter.
If adb remount succeeds, skip step 14, and continue with the 3rd line of step 15.
Click to expand...
Click to collapse
Thanks for the input! Yes, yes, I know windoze makes more work. It's also pretty widespread for folks.
For step 13 - I think it depends on the device. It would be nice for others to weigh in and let me know if it's needed. If not, I can totally remove it.
Also, in the other ROM thread, I made, it's even easier to root - you just grab one of the pre-rooted ROMS and drop it in SD card...the system does the rest. Mind you, this is for the UG007.

Links UG007
If you Bluetooth connection is not working properly, try to install this custom ROM: http://blog.geekbuying.com/index.php/category/android-tv-stick-tv-box/ug007/
How to install CWM-based Recovery: http://androtab.info/clockworkmod/rockchip/
Both worked for me. I was able to connect my BT Keyboard/Mouse Pad combo

./psneuter
Failed to set prot mask (Inappropriate ioctl for device) ??

nice tutorial.. while finding the best way to work my ug007 i stumbled upon this thread via armtvtech.com
currently i only knew this tutorial to root the device, but looking at yours ill give it a try first.
digitalhigh said:
Also, in the other ROM thread, I made, it's even easier to root - you just grab one of the pre-rooted ROMS and drop it in SD card...the system does the rest. Mind you, this is for the UG007.
Click to expand...
Click to collapse
you cant install custom roms without flashmode, cant do flashmode without opening device.. or did i get it wrong!? talking about the ug007
actually you can install a custom rom once you are rooted without opening the device, here
Linuxslate said:
(Hint: It may not be /just/ the udev stuff.)
Click to expand...
Click to collapse
ehm.. im still preparing to root, i guess you hint at the android sdk?
if not ill holla back at you and complain why you didnt write it out in first place
but very good to know that i skip alot by "almost" only installing ubuntu to a vm

I may be missing something, but I couldn't get this to work on my UG007
psneuter didn't work for me, gave me an error about 'invalid ioctl' or something. But the strangest thing is that "adb shell" already shows the # in the prompt.
To confirm my suspitions, I also typed "adb root", which returned "adb is already running as root".
So I proceeded with the rest of the instructions. No errors appeared, installed Superuser and I can see su and busybox in system/bin
But when I download root checker it says it wasn't properly rooted. installing terminal and type "su" says permission denied - and that's it.
Am I missing something? I'm new to this rooting thing, so please don't be angry with my noobish questions

I managed to do it - but *not* by following this tutorial.
I used this: armtvtech.com/armtvtechforum/viewtopic.php?t=28 (Cant post links yet, sorry!)
Only ran the "TPSarky-VonDroid-Root" bat, and presto! I had root on UG007.
I even fixed the changing MAC address problem with wlan.ko from armtvtech.com/armtvtechforum/viewtopic.php?f=69&t=632&start=10 (link on page 2). I just copied it to /data/local/tmp, set permissions as rwr--r-- and then used root explorer to copy it to /system/lib/modules - now I have wifi signal every time I boot the device, and don't need to mess with my router config every time
I also manage to get xbox360 wired controller working. xpad.ko on /data/local/tmp and then insmod /data/local/tmp/xpad.ko - just connect the joystick after that, and it will be recognized. Only problem is, after a reboot I have to insmod again.
I tried doing the same thing I did with wlan.ko, but nothing happens - system won't load it on boot. Am I missing something here?

The psneuter is broken
I'm on Linux, running a RK3066, and psneuter gives "Failed to set prot mask (Inappropriate ioctl for device)". Running Ice Cream Sandwich 4.1.1, kernel 3.0.8+, build RK30_anpei10w1am-r4.0.57.20121207, A10-2 cpu.

SLotman said:
I may be missing something, but I couldn't get this to work on my UG007
psneuter didn't work for me, gave me an error about 'invalid ioctl' or something. But the strangest thing is that "adb shell" already shows the # in the prompt.
To confirm my suspitions, I also typed "adb root", which returned "adb is already running as root".
So I proceeded with the rest of the instructions. No errors appeared, installed Superuser and I can see su and busybox in system/bin
But when I download root checker it says it wasn't properly rooted. installing terminal and type "su" says permission denied - and that's it.
Am I missing something? I'm new to this rooting thing, so please don't be angry with my noobish questions
Click to expand...
Click to collapse
Try renaming old "su".
Check permissions on the su and busybox you installed.

MK808, MK809 [model T002], and the MK802 III anyone?
Hi,
Thanks OP for this information.
I have a Samsung S3 [my first android device] which I rooted with no problem, but am a total noob when it comes to these android sticks.
One can say they are very similar, so I wont be completely in the dark. OK, now that we got that out of the way...
Can anyone please confirm whether they have used this with the MK808, MK809 [model T002], and the MK802 III,
I have ordered these from 1 from amazon and 2 from ebay and am expecting delivery shortly, therefore I just want to make sure before I go bricking them one by one...
I notice that they all have RK3066 Cortex A9 chips but are manufactured by different companies. The ones I see on eBay, although they all bear the same code MK8xx, they all look very different! I presume the MK8xx code is a universal model?? just like 80486 was to the PC? given the case does this method work universally?
I intend to set them up with XBMC media centres and to use with a Xbox controller. Any advice on the best way for achieving this would be nice too.
Thanks
:good:

Linuxslate said:
Thanks for this tutorial.
Linux: If the device still does not show up in Step 11, post, and I can help (Hint: It may not be /just/ the udev stuff.)
Click to expand...
Click to collapse
Linuxslate, I have an MK808 that shows up in lsusb as 2207:300a when I put it in "flash mode" but it never shows up via "adb devices".

I got mine the other day and it turned out to be rooted already?
I decided to install SuperSu and that's how I found out it was rooted.
Immediately, installed Busybox, System Tuner Pro and Titanium Backup.
Rob
Rob sent this from his SPH-D710 via Tapatalk

So would this possibly work on this - http://www.zoostorm.com/Products/357-zoostorm-sl8-3305-1030-tablet-pc.aspx
States it's a Rockchip RK3066 Cortex A9 Dual Core 1.5GHz, running 4.1.1 Jelly Bean, quite interested in getting one & root would be a bonus.

psneuter broken
Hello,
the psneuter attached to the first post doesn't do anything to my ug007. I have the same error others have posted here and haven't gotten a reply about.
To unlock, I used the script that's mentioned in a post above, TPSarky-VonDroid-Root. If you google that, you'll find a download link amongst the results.

Thank u very much...:thumbup:
................................................................................................

Linuxslate said:
Try renaming old "su".
Check permissions on the su and busybox you installed.
Click to expand...
Click to collapse
Can you elaborate a little bit what you mean by renaming "su"?
I'm having the same issue..
Both su and busybox are having the same permission -rwsr-xr-x.
Sent from my Transformer Prime TF201 using XDA Premium HD app

I configured one of these at work. Upon using the terminal app and typing in su I got the # sign. They seem to come from the factory rooted already.
Sent from my Nexus 4 using xda app-developers app

ageerer84 said:
I configured one of these at work. Upon using the terminal app and typing in su I got the # sign. They seem to come from the factory rooted already.
Click to expand...
Click to collapse
Not exactly: this particular su can be used only from adb console, or at least that how it was on my tablet. So you need to replace it with a Superuser apk's su to get all features of rooted android. You can get one e.g. from FDroid
--
blog

Not sure what u mean by on your tablet. Android devices don't typically come rooted but I was surprised to have root access via terminal emulator on this stick PC. I just took it out of the box and definitely didn't have to go through the adb interface on a computer to flash superuser or what have you. Is this just me or is this a typical experience with this particular device?
Sent from my Nexus 4 using xda app-developers app

Temporary Magisk Root on VZW Pixel 2 (XL)

I have moved this from here https://forum.xda-developers.com/pixel-2-xl/how-to/zero-day-vzw-pixel-2-xl-root-t3977851/
Hey everyone!
I am here to post some good news. I have made a set of scripts that can give you temporary root through Magisk. It persists until the next reboot, but setting it up after the initial setup is a lot easier.
The script requires that it be run as root, which means that you need to run the temproot binary provided earlier.
Big thank you to Elliwigy for walking me through the initial process and for providing the commands.
Source code for the "exploit" binary can be found here, and compiled from source if you so desire.
This script is provided with no warranty whatsoever. This script may brick your phone. YOU ARE RUNNING THIS AT YOUR OWN RISK. I ACCEPT NO RESPONSIBILITY FOR WHAT THIS SCRIPT DOES TO YOUR PHONE.
Click to expand...
Click to collapse
IF YOU DO NOT WANT TO RISK YOUR PHONE BEING BRICKED, DO NOT CONTINUE!
Requirements:
A Verizon Pixel 2 (XL) on the September 2019 Security Patch
A computer with ADB If you need ADB, it can be found here
A USB cable
Appropriate USB drivers USB drivers can be found here if needed
Some knowledge of how to use the terminal
The taimentempmagisk.zip file (attached)
The APK for Magisk Manager (included in the zip)
Hope
Magisk and MagiskManager can also be downloaded from here if you wish.
If Magisk Manager prompts you to perform additional setup, DO NOT ACCEPT. (unless you like having a bricked phone)
Install the Magisk Manager APK onto your phone
Use ADB to push the attached ZIP file (taimentempmagisk.zip) to /data/local/tmp
Open an ADB shell and navigate to /data/local/tmp
Extract the ZIP file with the unzip command
Navigate into the scripts folder
Run ./exploit (If this step fails, repeat until you have a root shell)
Run ./installtemproot.sh magiskinit64
After you have done this, you now have root!
If you reboot and want root back, just run /data/local/tmp/scripts/exploit in an adb shell, then run /data/local/tmp/scripts/temproot.sh
Enjoy your root!

Does not work

Hexlay said:
Does not work
Click to expand...
Click to collapse
I'm currently working on a solution, it seems some terminal emulators error out on the mount command.
EDIT: Instructions updated.

logan2611 said:
I'm currently working on a solution, it seems some terminal emulators error out on the mount command.
EDIT: Instructions updated.
Click to expand...
Click to collapse
I'v tried, everything went fine, however magisk still does not detect root

Hexlay said:
I'v tried, everything went fine, however magisk still does not detect root
Click to expand...
Click to collapse
did u install magisk manager? if u dont have it installed then u womt b able to grant su permissions.. it does work as we spent hours testing and ensuring it works before he posted it.. id triple check each instruction and make sure u have magisk apk installed.. if not then reboot and try again from the beginning

elliwigy said:
did u install magisk manager? if u dont have it installed then u womt b able to grant su permissions.. it does work as we spent hours testing and ensuring it works before he posted it.. id triple check each instruction and make sure u have magisk apk installed.. if not then reboot and try again from the beginning
Click to expand...
Click to collapse
Yep, i have it pre-installed, i did follow every step provided, but prompt is not showing up and afterwards it does not detect root... Well, i'v done it several times, i tried ./temproot.sh after install script, but still same...
Well, i guess i have to reboot
Edit: tried reboot, still same.... i'll write down what i have done exactly.
Rebooted dvice
Went into terminal emulator and executed ./taimen
After that went one step back with cd .. and executed chmod -R 777 scripts
Then went to pc and entered ADB shell and executed ./taimen there too, because otherwise i was getting This script must be run as root. Exiting. on install script
Then ran install script. Process did complete successfully, however no magisk prompt was fired and afterwards root was not detected
I'v tried chmod -R 777 . even from adb shell, tried opening magisk app and then doing these whole process... no luck

First, thanks for your supporting and your instruction
I just install October(6/10) update so any risk if i follow your instruction

Anyone know how to delete the update? I've downloaded and refuse to restart my device in the wake of these new development

enigma2446 said:
Anyone know how to delete the update? I've downloaded and refuse to restart my device in the wake of these new development
Click to expand...
Click to collapse
I also want to know this. I need to reboot but I don't want to move to the October patch.

Hexlay said:
Yep, i have it pre-installed, i did follow every step provided, but prompt is not showing up and afterwards it does not detect root... Well, i'v done it several times, i tried ./temproot.sh after install script, but still same...
Well, i guess i have to reboot
Edit: tried reboot, still same.... i'll write down what i have done exactly.
Rebooted dvice
Went into terminal emulator and executed ./taimen
After that went one step back with cd .. and executed chmod -R 777 scripts
Then went to pc and entered ADB shell and executed ./taimen there too, because otherwise i was getting This script must be run as root. Exiting. on install script
Then ran install script. Process did complete successfully, however no magisk prompt was fired and afterwards root was not detected
I'v tried chmod -R 777 . even from adb shell, tried opening magisk app and then doing these whole process... no luck
Click to expand...
Click to collapse
Can you post the output of the script?

logan2611 said:
Can you post the output of the script?
Click to expand...
Click to collapse
That's output every time, it finishes script successfully

Hexlay said:
That's output every time, it finishes script successfully
Click to expand...
Click to collapse
Sorry, screenshot didn't load the first time. Looks like all the files are already in place, try rebooting and running temproot.sh

running ./taimen just gives a "permission denied" error

Some1CP said:
running ./taimen just gives a "permission denied" error
Click to expand...
Click to collapse
If you are getting this on the phone, you need to use a terminal emulator with access to a directory in /data. I used Termux in my example.
If you want to use Termux, here is how to get taimen running:
Install Termux
Open Termux and let it install
Run termux-setup-storage
Push the ZIP to /sdcard/Download
On the phone, move the ZIP file from ~/storage/downloads to ~
Continue from step 4 in OP

logan2611 said:
If you are getting this on the phone, you need to use a terminal emulator with access to a directory in /data. I used Termux in my example.
If you want to use Termux, here is how to get taimen running:
Install Termux
Open Termux and let it install
Run termux-setup-storage
Push the ZIP to /sdcard/Download
On the phone, move the ZIP file from ~/storage/downloads to ~
Continue from step 4 in OP
Click to expand...
Click to collapse
How would I move it to ~ without root?
Edit: nevermind, got it to run.
Just need to figure out how to make the temproot work.

Some1CP said:
How would I move it to ~ without root?
Click to expand...
Click to collapse
In Linux ~ is a shortcut for the home directory, which is always owned by the current user. Root is not required to move the ZIP from ~/storage/downloads to ~ on Termux.

Ok I can't run installtemproot.sh in adb, and neither on the phone itself through termux. Is there something I'm missing? su can't be find on the phone.
Edit: It works if you use Jack Pal's terminal emulator and you cd into its directory on adb. Sadly magisk doesn't recognize it's installed.

I'm on October 5 2018 security update and should flash September 5 2019 try temp root?I know stay away October's 2019 that's patch,sean

logan2611 said:
Sorry, screenshot didn't load the first time. Looks like all the files are already in place, try rebooting and running temproot.sh
Click to expand...
Click to collapse
Sorry for wait time, literally had to wait for type-c to type-c connection -_- it's pain....
Anyway i did reboot and tried again with just temproot.sh, without repeating previous stuff. No prompt is fired, but output is success

Hexlay said:
Sorry for wait time, literally had to wait for type-c to type-c connection -_- it's pain....
Anyway i did reboot and tried again with just temproot.sh, without repeating previous stuff. No prompt is fired, but output is success
Click to expand...
Click to collapse
client: launching new main daemon process
Click to expand...
Click to collapse
The output suggests that Magisk started successfully. What does Magisk Manager look like after running that script?