mtk工程模式应用的教程（MTKeasySU获root权限）
mtk工程模式应用的教程（MTKeasySU获root权限）Temporary root by diplomatic@XDA Home URL: https://forum.xda-developers.com/android/development/amazing-temp-root-mediatek-armv8-t3922213 -------------------------------------------------- aarch64 machine param1: 0x3000 param2: 0x18040 type: 6 Building symbol table kallsyms_addresses pa 0x40a42c00 kallsyms_num_syms 51883 addr_count 51883 kallsyms_names pa 0x40aa8300 size 602430 kallsyms_marker
准 备：
- MTK Easy SU V1.1.3
- MagiskManager-v8.0.4.apk
一、下载安装MTK easy SU，地址：https://github.com/JunioJsv/mtk-easy-su/releases ，版本按需选
adb安装和拷至手机安装都可：
C:\tmp\fastboot>adb devices
* daemon not running; starting now at tcp:5037
* daemon started successfully
List of devices attached
8T8XXXXXBU9PCM4S device
C:\tmp\fastboot>adb install c:/tmp/mtk-easy-su-v1.1.3.apk
Performing Push Install
c:/tmp/mtk-easy-su-v1.1.3.apk: 1 file p...hed. 5.2 MB/s (2857723 bytes in 0.525s)
pkg: /data/local/tmp/mtk-easy-su-v1.1.3.apk
Success
二、打开MTK Easy SU，手机联网，在Assets处选择一个版本的Magisk面具安装。（如果手机时间设置不准确，如比当前日期早3-5年，则可能看不到Magisk的安装列表）
三、安装完成后重新启动手机，不要用快速启动方式：
四、安装完后点击最下边的“ACTIVATE BOOTLESS ROOT”开始处理：
- 成功后，会短暂显示“Success”
- “Activate Bootless ROOT”会变暗
- 每次重启手机后需要再点击“Activate Bootless Root”获取root权限
五、root处理过程记录：
参考log: 可以看到做了哪些操作
Temporary root by diplomatic@XDA
Home URL:
https://forum.xda-developers.com/android/development/amazing-temp-root-mediatek-armv8-t3922213
--------------------------------------------------
aarch64 machine
param1: 0x3000 param2: 0x18040 type: 6
Building symbol table
kallsyms_addresses pa 0x40a42c00
kallsyms_num_syms 51883 addr_count 51883
kallsyms_names pa 0x40aa8300 size 602430
kallsyms_markers pa 0x40b3b500
kallsyms_token_table pa 0x40b3bc00
kallsyms_token_index pa 0x40b3c000
Patching credentials
Parsing current_is_single_threaded
ffffffc0002e7514 50: ADRP x0 0xffffffc000d20000
ffffffc0002e7514 54: ADD Rd x0 0x80
Possible list_head tasks at offset 0x290
comm swapper/0 at offset 0x4d8
Found own task_struct at node 1
cred VA: 0xffffffc038e03f80
init_task VA: 0xffffffc000d20080
Parsing avc_denied
ffffffc00029b058 24: ADRP x2 0xffffffc000e85000
ffffffc00029b058 28: LDR [x2 0x5bc]
selinux_enforcing VA: 0xffffffc000e855bc
Setting selinux_enforcing
Switched selinux to permissive
starting /system/bin/sh
UID: 0 cap: 3fffffffff selinux: permissive
/system/bin/sh: <stdin>[33]: [: gid=0(root): unexpected operator/operand
Load policy from: /sys/fs/selinux/policy
20.4:MAGISK (20400)
client: launching new main daemon process
exit value 0 assets-r23
六、下载并安装面具MagiskManager-v8.0.4.apk，地址 https://github.com/topjohnwu/Magisk/releases
C:\tmp\fastboot>adb install c:/tmp/MagiskManager-v8.0.4.apk
Performing Push Install
c:/tmp/MagiskManager-v8.0.4.apk: 1 file...hed. 5.1 MB/s (3191190 bytes in 0.601s)
pkg: /data/local/tmp/MagiskManager-v8.0.4.apk
Success
七、使用，应用程序申请root权限时会弹出对话框，确认即可
注 意：
- 此操作适用android低版本
- 适用MTK手机
- 获取的是临时ROOT权限
我的类似文章：
- 安装Magisk面具，获取root权限，刷入手机永久生效
- 手机安装magisk获ROOT权限，无须第三方recovery
