How to install Magisk without an unlocked bootloader?

Before you say, "It cannot be done," read the link below by topjohnwu. I too had been under the impression that Magisk could not be installed unless the device had an unlocked bootloader. However, yesterday I was reading this: [Deployment | Magisk](https://topjohnwu.github.io/Magisk/deploy.html#exploits) (from which I quote the contents below): > ## Exploits > --- > **(Note: Magisk could only be used as root)** > > Occasionally, there would be exploits in certain devices that could lead to full fledged root. On modern Android, it is possible to use MagiskSU if you can gain a shell with the following conditions: > > - Effective UID should be privileged (root, or euid=0) > - Have the ability to reload sepolicy (which 99.9% of the time means SELinux permissive) > > You can check out [scripts/emulator.sh](https://github.com/topjohnwu/Magisk/blob/master/scripts/emulator.sh) as a reference for bringing up Magisk with a root shell. Note that these changes are not persistent, and you will need to find ways to rerun the whole process every boot. My device meets the conditions for that "exploit" as shown below: # getenforce Permissive # id -u 0 # id -Z context=u:r:supersu:s0 So I checked out scripts/emulator.sh as suggested. However, I don't understand the code very well. It seems topjohnwu is suggesting one run that script on a device which meets the conditions, but he is also suggesting it is a "reference" implementation I guess. Since I'm not an expert, I have a lot of questions. Could I safely run it and then debug any issues/errors I see? If so, where do I find the referenced "app-debug.apk"? What directory should I run the script from? I appreciate any advice. If running the script is not the right approach, can anyone offer suggestions for how to can install Magisk on my device without an unlocked bootloader? Also, at what point should I remove SuperSU? (BTW, my device is a US Snapdragon S8, so the bootloader will not get unlocked.)