## https://sploitus.com/exploit?id=70841B9A-820C-5CAF-B892-E26A6A1035FA
# M7S Rooting Toolkit
Permanent root for the **Multilaser M7S** (a.k.a. `ML11-M7sQuadCore`, `AQ7`,
`astar-ococci`) — an Allwinner A33 (sun8iw5p1) Android 4.4.2 tablet with raw
NAND flash.
This repo contains everything needed to reproduce the root from scratch:
exploit source, the custom `su`, the boot-image backdoor, the installer, and a
step-by-step guide.
> **Status: working.** Verified on the stock 2017-03-30 firmware
> (`V6-sig-20170330`): `/system/xbin/su` survives full reboots and gives
> `uid=0(root)`.
---
## Why this is different from a normal root
Traditional rooting (SuperSU, Magisk, TowelRoot, stock DirtyCow on `run-as`) all
**fail** on this device:
- `/data` is mounted `nosuid`, so a setuid `su` placed on `/data` is inert.
- SELinux is Enforcing; `/dev/mem` is blocked.
- The stock DirtyCow `run-as` target is hardened on this ROM.
- There is no custom recovery / TWRP for this Allwinner raw-NAND device.
The working approach combines three pieces:
1. **DirtyCow variant (`exploit/dc_v5.c`)** — races the page cache of
`/system/lib/libcutils.so` to inject ARM Thumb shellcode into
`__android_log_print`. When vold logs (triggered by SD-card (re)insertion)
the shellcode runs as **root** and `chmod 0666`s the NAND block devices
(`nandc`, `nandd`, `nandf`).
2. **Custom boot image (`boot/boot_rooted_final.img`)** — stock boot ramdisk
with a `flashsystem` init service added. Triggering `setprop
debug.flash_system 1` makes Android init run `/data/local/tmp/flash.sh` as
root.
3. **`installer/flash.sh`** — remounts `/system` rw, installs
`su` as setuid at `/system/xbin/su`, remounts ro. The custom `su` is built
without libc/TLS (raw syscalls) because modern NDK binaries crash on KitKat's
Bionic.
## Quick start
```bash
# 1. Host tools (mkbootimg, imagewty-tool, sparse utils)
./tools/setup.sh
# 2. Connect the tablet with USB debugging enabled
adb devices
# 3. Open the NAND write window and dump your original boot/system (backup!)
./scripts/02_dump_partitions.sh
# 4. Flash the rooted boot image (needs an SD card to trigger the exploit)
./scripts/03_flash_custom_boot.sh
# 5. Install persistent su via the boot backdoor
./scripts/04_install_su.sh
# 6. Enjoy
adb shell /system/xbin/su -c id # -> uid=0(root)
```
Prebuilt `exploit/dc_v5` and `su/su` are included, so you can skip building.
To build from source: `./exploit/build.sh` and `./su/build.sh` (requires an
Android NDK with `armv7a-linux-androideabi21-clang`).
## Repo layout
```
docs/ROOTING.md Full step-by-step guide (read this first)
exploit/ DirtyCow exploit: dc_v5.c, shellcode, prebuilt binary
su/ Custom no-libc su: su_main.c + su_entry.s, prebuilt
boot/ init.rc backdoor patch, repack script, prebuilt boot image
installer/ flash.sh (runs as root via the boot backdoor)
scripts/ 01-04 reproducible host-side scripts
tools/setup.sh Clones/builds mkbootimg, imagewty-tool, sparse utils
CHECKSUMS.sha256 Hashes of all shipped artifacts + the official firmware
```
## Files NOT in this repo
- **Official firmware** `AQ7-ML11-M7sQuadCore.V6-sig-20170330.img` (829 MB) is
not committed. SHA-256:
`29d946e851c5e64329b1f9433bc00008f98433e8cbab4ecc0279b63c6eafd3d8`.
You don't strictly need it: `scripts/02_dump_partitions.sh` dumps every
partition straight off the device through the exploit.
## Safety
- Raw NAND has no wear leveling. Excessive writes can wear it out.
- **Back up `nandc` (boot) before flashing** (`scripts/02_dump_partitions.sh`).
A corrupt boot partition bricks the device.
- If bricked: the Allwinner BROM checks the SD card before NAND, and FEL mode
(`sunxi-fel`) is an always-available recovery path.
## Notes for contributors
- The walk-through of the original session is in `docs/ROOTING.md`.
- Offsets/hashes in `CHECKSUMS.sha256` are for the stock 2017-03-30 firmware.
On a different firmware version, verify the `libcutils.so` offset `0x6a04`
(the `__android_log_print` entry) before running the exploit.
- When the SD card is inserted, USB ADB can drop (shared bus on some Allwinner
boards) — use WiFi ADB (`adb tcpip 5555; adb connect :5555`).
## Legal
Use on your own hardware. DirtyCow is CVE-2016-5195; the original research is
public. Repackaged/redistributed binaries (mkbootimg, imagewty-tool, AOSP
sparse tools) keep their own upstream licenses.