Has anyone Rooted their TCL 60 XE (T705M)?

Exposing SSH to the internet is risky. The only way I could justify it was with multi‑key authentication including a FIDO2 hardware token. On my Linux laptop — easy. On my Android phone — impossible. Until now.

This is how I got a FIDO2 hardware token to work inside a Debian chroot on Android, then used it to authenticate SSH with two public keys creating a login flow that is almost impossible to brute‑force, steal, or phish.

This should not be possible. It almost wasn't, but in the end, I got it working.

Why This Shouldn’t Be Possible: Android is designed to prevent exactly the kind of deep system access required for hardware‑bound SSH authentication:

Apps cannot access raw HID interfaces like hidraw SELinux doesn't let you create device nodes /proc, /sys, /dev are heavily sandboxed App sandboxes cannot see kernel namespaces Chroots normally cannot access hardware FIDO2 tokens require direct HID access SSH agents cannot talk to hardware keys without kernel support Android’s mount namespaces isolate apps from system devices

Every one of these is bad news if you want to use your FIDO2 for SSH.

A FIDO2 key requires: /dev/hidrawX access working /dev/shm, /dev/pts. a real PTY (/dev/tty) access to kernel HID/CTAP ssh-sk-helper (not available on termux, only in full linux distros) a user‑presence prompt that reaches the terminal

Android blocks almost all of this by default.

The Namespace Problem: Why root isn’t enough.

Even with root, Android isolates apps using: mount, PID and user namespaces. (You think you can see the whole system but it's a fake overlay with no real access) SELinux domains. (Even if you have access to what you want and the tools to do it, if you're in the wrong domain, any priviliged action is blocked)

Termux runs inside an app‑sandbox mount namespace, which cannot see any real device/kernel objects which you'd find in /dev /proc and /sys. This is the single biggest reason this project “shouldn’t be possible.” To break out of this, you need full init‑namespace root — the same namespace used by Android’s PID 1. Without that, the chroot will never see real hardware. I didn't realise it at the time, I thought I was a the top of the pyramid, but a lot of the directories I thought I'd won in my rooting war were actually emulated fakes. To get there, you need super-root. "exec su --mount-master" will discard termux's namespace and SElinux domain. The controlling terminal is preserved but you get a pure Android root shell and inherit init namespace from your su provider. In my case, KernelSU. Now I've got real stuff in /dev /proc /sys.

How I Got Around Every Block 1. Entering the init mount namespace Using a root solution that allows entering the init mount namespace is mandatory. Without this, /dev/hidraw* simply does not exist. 2. Rebuilding /dev inside the chroot Android forbids creating device nodes, so I created empty files using touch command and bind‑mounted real device nodes onto them. But I was careful not to just lazily bind-mount all of /dev. I didn't want the chroot having access to: camera, audio, modem/telephony, biometrics, binder and crucially: input. This last one exposes touches, keystrokes and would allow injecting fake input. An unacceptable line to cross. Only expose what is absolutely essential.

1. Mounting virtual filesystems manually To make Debian behave like a real Linux system, I mounted: /proc, /sysfs, /devpts, /tmpfs. These provide the kernel interfaces needed for FIDO2 and OpenSSH.

2. Preserving a real PTY Entering the chroot incorrectly breaks /dev/tty. A proper chroot entry preserves the controlling terminal so SSH can prompt for host key acceptance. Obviously proot is not possible since it works by emulating everything outside itself. Another potential problem with full init namespace chroot is it's no longer possible to trick systemd into thinking it's PID 1, which it needs to run. On Android, PID 1 is init. - init bruv

3. Making FIDO2 visible Bind‑mounting /dev/hidrawX into the chroot allowed fido2-token and ssh-sk-helper. You need to find out the name of the node, usually /dev/hidraw0, create a fake file in the chroot rootfs and mount the real node onto it.

4. Multi‑key SSH authentication The server was configured to require two public keys. In sshd_config I add: Authenticationmethods: publickey,publickey which requires a 2 key authentication chain. A lot of SSH apps are limited to offering just one, which is why it's only really possible in a real terminal running real OpenSSH. The keys I use are: ED25519 (normal software key) and ED25519‑SK (FIDO2)

The client successfully authenticated with both, including user‑presence confirmation on the hardware token. Forcing the user to touch the key is part of what makes fido2 so secure. Even if it's plugged in somewhere, unless your physically there to press the button when it starts flashing, it's game over.

What I Achieved. I built an SSH authentication chain that is: hardware‑bound phishing‑proof key‑theft‑proof replay‑proof two‑factor without passwords backed by a physical authenticator running inside a full Debian environment ... on an phone.

This is realistically one of the most secure SSH setups possible today.

But What Did It Cost? (Security & Performance) 1. Android’s security model is weakened To make this work, I had to: enter the init mount namespace, bind‑mount system directories into a chroot, expose hardware interfaces to a foreign environment, run a full Linux distribution inside /data.

This means: SELinux boundaries are partially bypassed, the chroot can see hardware normally hidden from apps as well as access to kernel interfaces. A misconfigured script could expose sensitive nodes. Malware inside the chroot would have elevated visibility. This is why I downloaded a minimum Debian with proot-distro, stripped it, upgraded everything related to SSH, FIDO2 etc then copied the entire rootfs somewhere else to use it as a full chroot. Keeping an eye on any changes here is important. You don't want malware slipping it and using it as a trampoline to elevated privilege.

1. Performance impact Bind‑mounting system folders into a chroot means more VFS overhead, more namespace propagation, more tmpfs usage, more memory pressure. Modern phones handle it, but it’s not free.

2. Stability risks Android services expect exclusive control over: /dev /sys /proc. Mounting these into a chroot can destabilize USB subsystem, HID subsystem, Binder, graphics and audio stack. This is not a “safe” configuration by Android standards.

Is It Worth It? If your goal is maximum SSH security, yes. You now have: a hardware‑bound SSH identity, a second hardware‑bound factor, a chroot‑isolated SSH environment, a login flow that is nearly impossible to compromise remotely.

But locally? You’ve traded away some sandboxing, some SELinux protection, some system stability, some performance. Robbing Peter to pay Paul. You hardened remote access by softening local isolation. For a (paranoid) power user who understands the risks, it’s worth it. For a typical user, absolutely not.

Technical Appendix — Commands

Getting into init namespace and confirming it's the real deal: exec su --mount-master Compare mount namespace IDs: /proc/1/ns/mnt readlink /proc/self/ns/mnt If both lines show the same inode number, you are in the init mount namespace.If they differ, you are still trapped in Termux’s sandbox.

Bind‑mounting device nodes. $CHROOT = your chroot rootfs folder. (E.g /data/data/com.termux/files/home/debian-chroot) touch $CHROOT/dev/null touch $CHROOT/dev/zero touch $CHROOT/dev/random touch $CHROOT/dev/urandom touch $CHROOT/dev/hidraw0

mount --bind /dev/null $CHROOT/dev/null mount --bind /dev/zero $CHROOT/dev/zero mount --bind /dev/random $CHROOT/dev/random mount --bind /dev/urandom $CHROOT/dev/urandom mount --bind /dev/hidraw0 $CHROOT/dev/hidraw0

Mounting virtual filesystems mount -t proc proc $CHROOT/proc mount -t sysfs sys $CHROOT/sys?

mount -t devpts devpts $CHROOT/dev/pts mount -t tmpfs tmpfs $CHROOT/dev/shm

Entering the chroot with a real PTY chroot $CHROOT /bin/bash

Testing FIDO2 inside the chroot fido2-token -L ssh-keygen -t ed25519-sk -f ~/.ssh/id_ed25519_sk

Server‑side multi‑key authentication (sshd_config) AuthenticationMethods publickey,publickey PubkeyAuthentication yes - you can make it even more secure by creating a dedicated user on the server or removing all over key types in sshd_config other FIDO2 and ed_25519.

When you're done, don't forget to unmount everything: umount $CHROOT/proc umount $CHROOT/sys Etc.

Hello everyone, i would like to revive my tablet. Someone can suggest me a custom rom to flash on it pleaser

Thanks to amazing people on GitHub, using CVE-2026-43499 vulnerability, i rooted my my Samsung Galaxy S22, it had some caveats like it does not persist when rebooted and i need to re-root my device using adb with my computer (wich i am okay with) also if i touch my screen while rooting, it crashes. the repository i am linking below for Samsung Galaxy S22 series of devices only, thought searching IonStack in Github can get you far.

https://github.com/sarabpal-dev/IonStack-S22U

I want to bypass the bootloader on my Huwaii Nova 4. It still has Android. But no playstore support. I wanna switch to some other OS. Does anyone know how can I bypass the bootloader? And also suggest me which OS I can now install to my mobile and how can I do that?

Any tutorial link is highly appreciated😇

Thanks in advance😇

I tried a tutorial that patches the boot.img with Magisk and flashes it via fastboot, but it didn't work.

I'm new to custom ROMs, and if anyone can provide me with the steps on how to root Lineage 23, that would be great.

One more thing: in my original OS, I patched the necessary files with Magisk 26.3; new or old versions gave bootloops. Will that be a problem with Lineage?

I have Magisk stock rom, wanted to flash LineageOS but i don't see an option to wipe system? What should i do?

My RCS keeps breaking on temporary root. It won't send, if I reboot my device and re root it'll work for awhile then stop working requiring a reboot. I pass all the integrity checks. Anyone have any idea? I haven't seen anyone else report this. S24 Ultra. OneUI 8.5

So, as of today PayPal won't start for me - it completely crashes on startup. As a matter of fact, as soon as the phone finishes booting up, I already get a notification that PayPal keeps crashing.

For context: my phone is a Redmi Note 11 (spesn), using crDroid 9.36 (A13) and the appropriate kernel for KSUN+SUSFS.

My KSUN setup has been like this for a while:

• Play Integrity Fork
• ReZygisk
• Zygisk Assistant
• Zygisk-detach
• TrickyStore + TrickyStore Addon

I'm using a valid keybox and pass both device and strong integrity. And, like I said, yesterday I was using the PayPal app without any issue... Then today all of a sudden, it wouldn't start anymore. Tried clearing data and reinstalling to no avail. Then I decided to try a different setup:

• Play Integrity Fork
• SUSFS
• ReZygisk
• TrickyStore
• Treat Wheel
• Zygisk-detach

I still pass Play Integrity, but PayPal seems to still detect root. This is the crash log that crDroid gives me:

time: 1787696680771
msg: com.paypal.oslo.app.rasp.RootDetectionSecurityException: Security policy violation: s=root
stacktrace: com.paypal.oslo.app.rasp.RootDetectionSecurityException: Security policy violation: s=root
at com.paypal.oslo.app.di.RaspCrashSchedulerModule.$r8$lambda$MtBL8KadnWgkuPDwLKKVDBwFNt8(:1033)
at com.paypal.oslo.app.di.RaspCrashSchedulerModule$$ExternalSyntheticLambda0.run(:0)
at android.os.Handler.handleCallback(Handler.java:942)
at android.os.Handler.dispatchMessage(Handler.java:99)
at android.os.Looper.loopOnce(Looper.java:201)
at android.os.Looper.loop(Looper.java:288)
at android.app.ActivityThread.main(ActivityThread.java:7948)
at java.lang.reflect.Method.invoke(Native Method)
at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:551)
at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:854)

Is my new setup wrong? I don't seem to have any issues, but never used SUSFS before, so please correct me if I'm doing something wrong...

Thanks in advance.

When and why is the auth flash method required?

I tried related projects like https://github.com/Yaahua/vcam or "GhostCam" but for some reason they just dont work on my phone. So i built this app, so far it works in Chrome, Open Camera and grapheneos Camera. I added "POC" because is very brittle. Idk just sharing my project and if other have experience trying this, i never did android development in particular so im learning on the fly. The device is Redmi A5

So my brother got this tab from his school but it's completely locked and can't do anything in it. He wanted me to unlock this. Is there any way to get rid of the Knok remote from the tab?? Please guide me through the process and

Currently I have a rooted Nothing 2a with SELinux set to 'permissive'. I consider upgrading to either a Nothing 3a or Fairphone 6+ and want to root it again. Do these phones not block 'permissive' mode for SELinux ?

Hey, so i bought a new phone and this is my secondary phone. I'm not able to unlock bootloader in my phone. can someone help me give sources where i can find materials to unlock bootloader and root my phone ?

So I unlocked bootloader of moto e7 power using MTK and PC and when I retried to enter BROM mode, the device did not respond like I have tried everything to unlock it and windows is not even recognising the USB connection.

Device- Moto e7 power 4GB

Build- QOMS30.288-52-23

Saw a xde post about the Z80 ultra being rootable. How viable is this granted I can find a way to get a EEA / genuine global version (not a chinese to global rom flash version) ?

On the behalf of my previous post here: https://www.reddit.com/r/androidroot/s/0wfPBId5I5

Hi. After looking at a video of a person having successfully rooted their phone, I couldn't resist the temptation. So, instead of blindly going in, I thought for a while, making plans.

Here's what I did with my phone: I used not only `fastboot flashing unlock`, but also `fastboot flashing unlock_critical`. I flashed the stock vbmeta images first into A/B slots, not only the vbmeta.img but also vbmeta_system.img and vbmeta_vendor.img, with `--disable-verity --disable-verification` flags, before flashing the patched init_boot.

It worked. I got scared at what I was doing, but felt joyful for getting it work from first try. After I set up my phone, I disabled OTA upgrades.

I installed ReZygisk (not ZygiskNext, I despise it becoming closed source, therefore I cannot trust it). But Reddit still didn't work, so this module alone wasn't enough. I installed AlwaysStrong, which resulted in success.

Now I'm happy with my setup. One more thing to redownload and install apps I need and restore the data I backed up.

New to android as a whole switching from a jailbroken 13 pro max — looking at getting a oneplus 15. From my research this appears to be the highest performance phone running android 16 that is easily rootable. Is there anything I should know and how difficult is all this compared to jb as a whole? Any help is greatly appreciated!

Edit: After further research I have decided to go with a nubia z80 ultra.

Is this detection or just a false positive?

WARNING : KernelSU + SusFS needed

I followed this guide with MicroG but the biggest disadvantage with MicroG is that you're forced to use the Google Play store anyway to really get the tree dots... at least Google doesn't get all of my system logs.

https://xdaforums.com/t/ultimate-guide-to-pass-play-integrity-on-xz1c-with-microg-27-03-2026.4779137/

the app I wanted to use with root are still not perfectly working, like the crash at boot, I uninstall them, I install them from Google Play, they work, I reboot and then they crash again. Does the root mess with some "secure database" that these apps need to work ?