[xperia 1/5] temp root exploit via CVE-2020-0041 including magisk setup

Microsoft Windows [Version 10.0.22000.1696]
(c) Microsoft Corporation. Alle Rechte vorbehalten.

C:\Program Files (x86)\Minimal ADB and Fastboot>adb devices
List of devices attached
* daemon not running; starting now at tcp:5037
* daemon started successfully
QV712P371T device


C:\Program Files (x86)\Minimal ADB and Fastboot>adb shell
J9110:/ $ cd /data/local/tmp
J9110:/data/local/tmp $ ./mag
/system/bin/sh: ./mag: not found
127|J9110:/data/local/tmp $ unzip x1x5-mroot.zip
/system/bin/sh: unzip: not found
127|J9110:/data/local/tmp $ exit

C:\Program Files (x86)\Minimal ADB and Fastboot>'adb push x1x5-mroot.zip Magisk-v20.4.zip /data/local/tmp
Der Befehl "'adb" ist entweder falsch geschrieben oder
konnte nicht gefunden werden.

C:\Program Files (x86)\Minimal ADB and Fastboot>adb
Android Debug Bridge version 1.0.39
Version 0.0.1-4500957
Installed as C:\Program Files (x86)\Minimal ADB and Fastboot\adb.exe

global options:
-a listen on all network interfaces, not just localhost
-d use USB device (error if multiple devices connected)
-e use TCP/IP device (error if multiple TCP/IP devices available)
-s SERIAL use device with given serial (overrides $ANDROID_SERIAL)
-t ID use device with given transport id
-H name of adb server host [default=localhost]
-P port of adb server [default=5037]
-L SOCKET listen on given socket for adb server [default=tcp:localhost:5037]

general commands:
devices [-l] list connected devices (-l for long output)
help show this help message
version show version num

networking:
connect HOST[ORT] connect to a device via TCP/IP [default port=5555]
disconnect [HOST[ORT]]
disconnect from given TCP/IP device [default port=5555], or all
forward --list list all forward socket connections
forward [--no-rebind] LOCAL REMOTE
forward socket connection using:
tcp:<port> (<local> may be "tcp:0" to pick any open port)
localabstract:<unix domain socket name>
localreserved:<unix domain socket name>
localfilesystem:<unix domain socket name>
dev:<character device name>
jdwp:<process pid> (remote only)
forward --remove LOCAL remove specific forward socket connection
forward --remove-all remove all forward socket connections
ppp TTY [PARAMETER...] run PPP over USB
reverse --list list all reverse socket connections from device
reverse [--no-rebind] REMOTE LOCAL
reverse socket connection using:
tcp:<port> (<remote> may be "tcp:0" to pick any open port)
localabstract:<unix domain socket name>
localreserved:<unix domain socket name>
localfilesystem:<unix domain socket name>
reverse --remove REMOTE remove specific reverse socket connection
reverse --remove-all remove all reverse socket connections from device

file transfer:
push [--sync] LOCAL... REMOTE
copy local files/directories to device
--sync: only push files that are newer on the host than the device
pull [-a] REMOTE... LOCAL
copy files/dirs from device
-a: preserve file timestamp and mode
sync [system|vendor|oem|data|all]
sync a local build from $ANDROID_PRODUCT_OUT to the device (default all)
-l: list but don't copy

shell:
shell [-e ESCAPE] [-n] [-Tt] [-x] [COMMAND...]
run remote shell command (interactive shell if no command given)
-e: choose escape character, or "none"; default '~'
-n: don't read from stdin
-T: disable PTY allocation
-t: force PTY allocation
-x: disable remote exit codes and stdout/stderr separation
emu COMMAND run emulator console command

app installation:
install [-lrtsdg] PACKAGE
install-multiple [-lrtsdpg] PACKAGE...
push package(s) to the device and install them
-l: forward lock application
-r: replace existing application
-t: allow test packages
-s: install application on sdcard
-d: allow version code downgrade (debuggable packages only)
-p: partial application install (install-multiple only)
-g: grant all runtime permissions
uninstall [-k] PACKAGE
remove this app package from the device
'-k': keep the data and cache directories

backup/restore:
to show usage run "adb shell bu help"

debugging:
bugreport [PATH]
write bugreport to given PATH [default=bugreport.zip];
if PATH is a directory, the bug report is saved in that directory.
devices that don't support zipped bug reports output to stdout.
jdwp list pids of processes hosting a JDWP transport
logcat show device log (logcat --help for more)

security:
disable-verity disable dm-verity checking on userdebug builds
enable-verity re-enable dm-verity checking on userdebug builds
keygen FILE
generate adb public/private key; private key stored in FILE,
public key stored in FILE.pub (existing files overwritten)

scripting:
wait-for[-TRANSPORT]-STATE
wait for device to be in the given state
State: device, recovery, sideload, or bootloader
Transport: usb, local, or any [default=any]
get-state print offline | bootloader | device
get-serialno print <serial-number>
get-devpath print <device-path>
remount
remount /system, /vendor, and /oem partitions read-write
reboot [bootloader|recovery|sideload|sideload-auto-reboot]
reboot the device; defaults to booting system image but
supports bootloader and recovery too. sideload reboots
into recovery and automatically starts sideload mode,
sideload-auto-reboot is the same but reboots after sideloading.
sideload OTAPACKAGE sideload the given full OTA package
root restart adbd with root permissions
unroot restart adbd without root permissions
usb restart adb server listening on USB
tcpip PORT restart adb server listening on TCP on PORT

internal debugging:
start-server ensure that there is a server running
kill-server kill the server if it is running
reconnect kick connection from host side to force reconnect
reconnect device kick connection from device side to force reconnect
reconnect offline reset offline/unauthorized devices to force reconnect

environment variables:
$ADB_TRACE
comma-separated list of debug info to log:
all,adb,sockets,packets,rwx,usb,sync,sysdeps,transport,jdwp
$ADB_VENDOR_KEYS colon-separated list of keys (files or directories)
$ANDROID_SERIAL serial number to connect to (see -s)
$ANDROID_LOG_TAGS tags to be used by logcat (see logcat --help)

C:\Program Files (x86)\Minimal ADB and Fastboot>'adb push x1x5-mroot.zip Magisk-v20.4.zip /data/local/tmp
Der Befehl "'adb" ist entweder falsch geschrieben oder
konnte nicht gefunden werden.

C:\Program Files (x86)\Minimal ADB and Fastboot>adb push
adb: usage: push requires an argument

C:\Program Files (x86)\Minimal ADB and Fastboot>'adb push C:\Users\Kerem\Downloads\ROOT_DATA\Magisk-v20.4.zipC:\Users\Kerem\Downloads\ROOT_DATA\x1x5-mroot.zip /data/local/tmp
Der Befehl "'adb" ist entweder falsch geschrieben oder
konnte nicht gefunden werden.

C:\Program Files (x86)\Minimal ADB and Fastboot>adb push C:\Users\Kerem\Downloads\ROOT_DATA\Magisk-v20.4.zip /data/local/tmp
C:\Users\Kerem\Downloads\ROOT_DATA\Magisk-v20.4.zip: 1 file pushed. 23.6 MB/s (5942417 bytes in 0.240s)

C:\Program Files (x86)\Minimal ADB and Fastboot>adb push C:\Users\Kerem\Downloads\ROOT_DATA\x1x5-mroot.zip /data/local/tmp
C:\Users\Kerem\Downloads\ROOT_DATA\x1x5-mroot.zip: 1 file pushed. 1.0 MB/s (21114 bytes in 0.021s)

C:\Program Files (x86)\Minimal ADB and Fastboot>cd /data/local/tmp
Das System kann den angegebenen Pfad nicht finden.

C:\Program Files (x86)\Minimal ADB and Fastboot>adb shell
J9110:/ $ cd /data/local/tmp
J9110:/data/local/tmp $ unzip x1x5-mroot.zip
/system/bin/sh: unzip: not found
127|J9110:/data/local/tmp $ exit

C:\Program Files (x86)\Minimal ADB and Fastboot>adb push C:\Users\Kerem\Downloads\ROOT_DATA\x1x5-mroot\magisk-setup.sh /data/local/tmp
C:\Users\Kerem\Downloads\ROOT_DATA\x1x5-mroot\magisk-setup.sh: 1 file pushed. 0.0 MB/s (624 bytes in 0.027s)

C:\Program Files (x86)\Minimal ADB and Fastboot>adb push C:\Users\Kerem\Downloads\ROOT_DATA\x1x5-mroot\magisk-start.sh /data/local/tmp
C:\Users\Kerem\Downloads\ROOT_DATA\x1x5-mroot\magisk-start.sh: 1 file pushed. 0.2 MB/s (3946 bytes in 0.017s)

C:\Program Files (x86)\Minimal ADB and Fastboot>adb push C:\Users\Kerem\Downloads\ROOT_DATA\x1x5-mroot\x1x5-mroot /data/local/tmp
C:\Users\Kerem\Downloads\ROOT_DATA\x1x5-mroot\x1x5-mroot: 1 file pushed. 2.0 MB/s (42984 bytes in 0.021s)

C:\Program Files (x86)\Minimal ADB and Fastboot>chmod 755 x1x5-mroot magisk-setup.sh magisk-start.sh
Der Befehl "chmod" ist entweder falsch geschrieben oder
konnte nicht gefunden werden.

C:\Program Files (x86)\Minimal ADB and Fastboot>adb shell
J9110:/ $ chmod 755 x1x5-mroot magisk-setup.sh magisk-start.sh
chmod: x1x5-mroot: No such file or directory
chmod: magisk-setup.sh: No such file or directory
chmod: magisk-start.sh: No such file or directory
1|J9110:/ $ cd /data/local/tmp
J9110:/data/local/tmp $ chmod 755 x1x5-mroot magisk-setup.sh magisk-start.sh
J9110:/data/local/tmp $ ./magisk-setup.sh
+ '[' '=' --cleanup ']'
+ ZIPFILE=Magisk-v20.4.zip
+ '[' ! -d magisk ']'
+ mkdir -p magisk
+ cd magisk
+ unzip ../Magisk-v20.4.zip
./magisk-setup.sh[28]: unzip: not found
+ mv META-INF/com/google/android/update-binary arm/magiskboot arm/magiskinit64 'common/*.sh' .
mv: bad 'META-INF/com/google/android/update-binary': No such file or directory
mv: bad 'arm/magiskboot': No such file or directory
mv: bad 'arm/magiskinit64': No such file or directory
mv: bad 'common/*.sh': No such file or directory
+ sh ./update-binary -x
sh: ./update-binary: No such file or directory
+ pm install -r common/magisk.apk
Error: Unable to open file: common/magisk.apk
Consider using a file under /data/local/tmp/
Error: Can't open file: common/magisk.apk

Exception occurred while executing:
java.lang.IllegalArgumentException: Error: Can't open file: common/magisk.apk
at com.android.server.pm.PackageManagerShellCommand.setParamsSize(PackageManagerShellCommand.java:328)
at com.android.server.pm.PackageManagerShellCommand.runInstall(PackageManagerShellCommand.java:906)
at com.android.server.pm.PackageManagerShellCommand.onCommand(PackageManagerShellCommand.java:158)
at android.os.ShellCommand.exec(ShellCommand.java:103)
at com.android.server.pm.PackageManagerService.onShellCommand(PackageManagerService.java:21598)
at android.os.Binder.shellCommand(Binder.java:634)
at android.os.Binder.onTransact(Binder.java:532)
at android.content.pm.IPackageManager$Stub.onTransact(IPackageManager.java:2821)
at com.android.server.pm.PackageManagerService.onTransact(PackageManagerService.java:3976)
at android.os.Binder.execTransact(Binder.java:731)
+ rm -rf update-binary META-INF arm chromeos common x86
+ cd ..
+ ln -s magisk/magiskinit64 magiskpolicy
J9110:/data/local/tmp $ cd /data/local/tmp
J9110:/data/local/tmp $ ./x1x5-mroot
./magisk-start.sh -1
./magisk-start.sh -2
./magisk-start.sh -3[+] factoryversion = 'J9110-55.0.A.6.16'
target is not supported.
1|J9110:/data/local/tmp $ ./magisk-start.sh -1
+ FRESH=false
+ '[' -1 '=' --fresh ']'
+ '[' ! -e /data/adb/magisk/busybox ']'
+ FRESH=true
+ ./magiskpolicy --live --magisk 'allow dumpstate * * *'
./magisk-start.sh[33]: ./magiskpolicy: not found
127|J9110:/data/local/tmp $ ./magisk-start.sh -2
+ FRESH=false
+ '[' -2 '=' --fresh ']'
+ '[' ! -e /data/adb/magisk/busybox ']'
+ FRESH=true
+ STAGE=2
+ '[' 2 '=' 2 ']'
+ mount -t tmpfs -o 'mode=755' none /sbin
mount: bad /etc/fstab: No such file or directory
+ chcon ubject_r:rootfs:s0 /sbin
chcon: '/sbin' to ubject_r:rootfs:s0: Read-only file system
+ chmod 755 /sbin
chmod: chmod '/sbin' to 40755: Read-only file system
+ cp -a magisk/boot_patch.sh /sbin
cp: bad 'magisk/boot_patch.sh': No such file or directory
+ echo 'magisk zip is not unpacked!'
magisk zip is not unpacked!
+ umount /sbin
umount: /sbin: Operation not permitted
+ exit 1
1|J9110:/data/local/tmp $ ./magisk-start.sh -3cd /data/local/tmp
1x5-mroot
./magisk-start.sh -1
./magisk-start.sh -2
./magisk-start.sh -3+ FRESH=false
+ '[' -3cd '=' --fresh ']'
+ '[' ! -e /data/adb/magisk/busybox ']'
+ FRESH=true
+ echo 'Usage: magisk-start.sh [--fresh] <-1 | -2 | -3>'
Usage: magisk-start.sh [--fresh] <-1 | -2 | -3>
+ exit 1
1|J9110:/data/local/tmp $ ./x1x5-mroot
[+] factoryversion = 'J9110-55.0.A.6.16'
target is not supported.
1|J9110:/data/local/tmp $ ./magisk-start.sh -1
+ FRESH=false
+ '[' -1 '=' --fresh ']'
+ '[' ! -e /data/adb/magisk/busybox ']'
+ FRESH=true
+ ./magiskpolicy --live --magisk 'allow dumpstate * * *'
./magisk-start.sh[33]: ./magiskpolicy: not found
127|J9110:/data/local/tmp $ ./magisk-start.sh -2
+ FRESH=false
+ '[' -2 '=' --fresh ']'
+ '[' ! -e /data/adb/magisk/busybox ']'
+ FRESH=true
+ STAGE=2
+ '[' 2 '=' 2 ']'
+ mount -t tmpfs -o 'mode=755' none /sbin
mount: bad /etc/fstab: No such file or directory
+ chcon ubject_r:rootfs:s0 /sbin
chcon: '/sbin' to ubject_r:rootfs:s0: Read-only file system
+ chmod 755 /sbin
chmod: chmod '/sbin' to 40755: Read-only file system
+ cp -a magisk/boot_patch.sh /sbin
cp: bad 'magisk/boot_patch.sh': No such file or directory
+ echo 'magisk zip is not unpacked!'
magisk zip is not unpacked!
+ umount /sbin
umount: /sbin: Operation not permitted
+ exit 1
1|J9110:/data/local/tmp $ ./magisk-start.sh -3cd /data/local/tmp
x1x5-mroot
./magisk-start.sh -1
./magisk-start.sh -2
./magisk-start.sh -3+ FRESH=false
+ '[' -3cd '=' --fresh ']'
+ '[' ! -e /data/adb/magisk/busybox ']'
+ FRESH=true
+ echo 'Usage: magisk-start.sh [--fresh] <-1 | -2 | -3>'
Usage: magisk-start.sh [--fresh] <-1 | -2 | -3>
+ exit 1
1|J9110:/data/local/tmp $ ./x1x5-mroot
[+] factoryversion = 'J9110-55.0.A.6.16'
target is not supported.
1|J9110:/data/local/tmp $ ./magisk-start.sh -1
+ FRESH=false
+ '[' -1 '=' --fresh ']'
+ '[' ! -e /data/adb/magisk/busybox ']'
+ FRESH=true
+ ./magiskpolicy --live --magisk 'allow dumpstate * * *'
./magisk-start.sh[33]: ./magiskpolicy: not found
127|J9110:/data/local/tmp $ ./magisk-start.sh -2
+ FRESH=false
+ '[' -2 '=' --fresh ']'
+ '[' ! -e /data/adb/magisk/busybox ']'
+ FRESH=true
+ STAGE=2
+ '[' 2 '=' 2 ']'
+ mount -t tmpfs -o 'mode=755' none /sbin
mount: bad /etc/fstab: No such file or directory
+ chcon ubject_r:rootfs:s0 /sbin
chcon: '/sbin' to ubject_r:rootfs:s0: Read-only file system
+ chmod 755 /sbin
chmod: chmod '/sbin' to 40755: Read-only file system
+ cp -a magisk/boot_patch.sh /sbin
cp: bad 'magisk/boot_patch.sh': No such file or directory
+ echo 'magisk zip is not unpacked!'
magisk zip is not unpacked!
+ umount /sbin
umount: /sbin: Operation not permitted
+ exit 1
1|J9110:/data/local/tmp $ ./magisk-start.sh -3./x1x5-mroot
start.sh -1
./magisk-start.sh -2
./magisk-start.sh -3+ FRESH=false
+ '[' -3./x1x5-mroot '=' --fresh ']'
+ '[' ! -e /data/adb/magisk/busybox ']'
+ FRESH=true
+ echo 'Usage: magisk-start.sh [--fresh] <-1 | -2 | -3>'
Usage: magisk-start.sh [--fresh] <-1 | -2 | -3>
+ exit 1
1|J9110:/data/local/tmp $ ./magisk-start.sh -1
+ FRESH=false
+ '[' -1 '=' --fresh ']'
+ '[' ! -e /data/adb/magisk/busybox ']'
+ FRESH=true
+ ./magiskpolicy --live --magisk 'allow dumpstate * * *'
./magisk-start.sh[33]: ./magiskpolicy: not found
127|J9110:/data/local/tmp $ ./magisk-start.sh -2
+ FRESH=false
+ '[' -2 '=' --fresh ']'
+ '[' ! -e /data/adb/magisk/busybox ']'
+ FRESH=true
+ STAGE=2
+ '[' 2 '=' 2 ']'
+ mount -t tmpfs -o 'mode=755' none /sbin
mount: bad /etc/fstab: No such file or directory
+ chcon ubject_r:rootfs:s0 /sbin
chcon: '/sbin' to ubject_r:rootfs:s0: Read-only file system
+ chmod 755 /sbin
chmod: chmod '/sbin' to 40755: Read-only file system
+ cp -a magisk/boot_patch.sh /sbin
cp: bad 'magisk/boot_patch.sh': No such file or directory
+ echo 'magisk zip is not unpacked!'
magisk zip is not unpacked!
+ umount /sbin
umount: /sbin: Operation not permitted
+ exit 1
1|J9110:/data/local/tmp $ ./magisk-start.sh -3
+ FRESH=false
+ '[' -3 '=' --fresh ']'
+ '[' ! -e /data/adb/magisk/busybox ']'
+ FRESH=true
+ STAGE=3
+ '[' 3 '=' 2 ']'
+ >/sbin/.magisk/magiskd
./magisk-start.sh[150]: can't create /sbin/.magisk/magiskd: No such file or directory
+ chmod 755 /sbin/.magisk/magiskd
chmod: /sbin/.magisk/magiskd: No such file or directory
+ chcon ubject_r:dumpstate_exec:s0 /sbin/.magisk/magiskd
chcon: /sbin/.magisk/magiskd: No such file or directory
+ getprop init.svc.dumpstate
+ SVC=
+ timeout=10
+ '[' 10 -gt 0 ']'
+ stop dumpstate
stop: must be root
+ sleep 1
+ timeout=9
+ '[' 9 -gt 0 ']'
+ stop dumpstate
stop: must be root
+ sleep 1

+ timeout=8
+ '[' 8 -gt 0 ']'
+ stop dumpstate
stop: must be root
+ sleep 1
+ timeout=7
+ '[' 7 -gt 0 ']'
+ stop dumpstate
stop: must be root
+ sleep 1
+ timeout=6
+ '[' 6 -gt 0 ']'
+ stop dumpstate
stop: must be root
+ sleep 1
+ timeout=5
+ '[' 5 -gt 0 ']'
+ stop dumpstate
stop: must be root
+ sleep 1
+ timeout=4
+ '[' 4 -gt 0 ']'
+ stop dumpstate
stop: must be root
+ sleep 1
+ timeout=3
+ '[' 3 -gt 0 ']'
+ stop dumpstate
stop: must be root
+ sleep 1
+ timeout=2
+ '[' 2 -gt 0 ']'
+ stop dumpstate
stop: must be root
+ sleep 1
+ timeout=1
+ '[' 1 -gt 0 ']'
+ stop dumpstate
stop: must be root
+ sleep 1
+ timeout=0
+ '[' 0 -gt 0 ']'
+ killall -9 magiskd
killall: magiskd: No such process
+ stop dumpstate
stop: must be root
+ echo 'failed to stop a service'
failed to stop a service
+ exit 1
1|J9110:/data/local/tmp $
1|J9110:/data/local/tmp $ ./x1x5-mroot
sh -1
./magisk-start.sh -2
./magisk-start.sh -3[+] factoryversion = 'J9110-55.0.A.6.16'
target is not supported.
1|J9110:/data/local/tmp $ ./magisk-start.sh -1
+ FRESH=false
+ '[' -1 '=' --fresh ']'
+ '[' ! -e /data/adb/magisk/busybox ']'
+ FRESH=true
+ ./magiskpolicy --live --magisk 'allow dumpstate * * *'
./magisk-start.sh[33]: ./magiskpolicy: not found
127|J9110:/data/local/tmp $ ./magisk-start.sh -2
+ FRESH=false
+ '[' -2 '=' --fresh ']'
+ '[' ! -e /data/adb/magisk/busybox ']'
+ FRESH=true
+ STAGE=2
+ '[' 2 '=' 2 ']'
+ mount -t tmpfs -o 'mode=755' none /sbin
mount: bad /etc/fstab: No such file or directory
+ chcon ubject_r:rootfs:s0 /sbin
chcon: '/sbin' to ubject_r:rootfs:s0: Read-only file system
+ chmod 755 /sbin
chmod: chmod '/sbin' to 40755: Read-only file system
+ cp -a magisk/boot_patch.sh /sbin
cp: bad 'magisk/boot_patch.sh': No such file or directory
+ echo 'magisk zip is not unpacked!'
magisk zip is not unpacked!
+ umount /sbin
umount: /sbin: Operation not permitted
+ exit 1
1|J9110:/data/local/tmp $ exit

C:\Program Files (x86)\Minimal ADB and Fastboot>su
Der Befehl "su" ist entweder falsch geschrieben oder
konnte nicht gefunden werden.

C:\Program Files (x86)\Minimal ADB and Fastboot>adb su
adb: usage: unknown command su

C:\Program Files (x86)\Minimal ADB and Fastboot>adb shell su
/system/bin/sh: su: not found

C:\Program Files (x86)\Minimal ADB and Fastboot>

Click to expand...

.