Immortal rootkit? - Xiaomi Redmi 3 Questions & Answers

Hello
I'm struggling with very annoying malware. Tried almost everything to get rid of it including MiFlash flash_all.bat
I've tried formating system partition - with no effect..
The rootkit infected init.rc. I can't post a code, because it shows that new users are prevented from posting links.....
Also when I'm on TWRP, some thing like this appears when I type TOP command some processes like ADBD, kworker, and smoke scripts running...
Anyway I want to put a hellfire on it, but it always coming back. How to erase all the filesin a safe way? I mean to completely clean partitions.

I saw your code in MIUI Forum
You said it has infected Init.rc, try wiping partition in TWRP, or flashing new ROM or just a boot.img file
And here's ADBD http://forum.xda-developers.com/showthread.php?t=1687590 and kworker a normal process
Can you send a picture of what you see in TWRP ?

Related

Clear Cache and Data from Stock Recovery

I've seen a number of requests for this functionality and recently it became necessary for one user who had a disabled Home Key to clear cache and data without the use of ClockworkMod. I have reserached two methods to address this issue. These instructions require some familiarity of android, computer and tablet terminology and usage. Feel free to ask for clarifications in comments. Here we go...
Method I - Stock Recovery Command File
Technical: Stock Recovery command file can be used to perform a few additional functions as well as to alter the path to update files. These commands will execute with all privileges available to recovery mode.
Advantages: Very easy to use. Very little technical knowledge required. No third party software is required for use.
Prerequisites: You will need a MicroSD card formatted FAT32 and a method for transferring files from your computer to the MicroSD.
Usage:
1) Prepare a text file named "command" (no file extension) with one of the following commands on a single line. The wipe data command will wipe both data and cache. Wipe cache will wipe cache only.
--wipe_data
--wipe_cache
2) Place the file in a folder named "recovery" in the root directory of your MicroSD card.
3) From a powered down state, insert the MicroSD card into your tablet and boot into recovery by powering it on while holding down the Volume Up key.
4) Allow the command to execute completely then the tablet should reboot (this may not occur automatically depending on firmware installed).
Method II - Updater Script
Technical: The attached "Updater Scripts" perform delete commands (recursively if necessary) on the named directory or file(s). The directories are mounted automatically by the system before the script executes but it could be easily revised to include that step if necessary. The partitioning, formatting and directory structure are left untouched. Only files are deleted.
Advantages: No third party software is necessary for execution. Relatively easy to modify for more surgical precision (i.e. leaving installed apps but clearing possibly corrupted system data). Included example: "Clear Battery Stats"
Prerequisites: You will need a MicroSD card formatted FAT32 and a method for transferring files from your computer to the MicroSD.
Usage:
1) Download the attached archive (ClearData.zip) to your computer.
2) Extract the files to your computer. You should then have a folder named "recovery" (which contains a file named "command") and an additional archive named "update.zip"
3) Place the recovery folder and the update.zip in the root directory of the MicroSD card.
4) From a powered down state, insert the MicroSD card into your tablet and boot into recovery by powering it on while holding down the Volume Up key.
5) Allow the script to execute completely then reboot the tablet (this may occur automatically depending on firmware installed).
This will become handy someday.
Thanks for sharing your knowledge.
You're welcome. One quick note... the new stock recovery adds a menu simiilar to ClockworkMod. These methods will still work since the recovery folder/command file are checked first but it really isn't as necessary any more.
Need Help
Tried both methods above but either way I get to the viewsonic splash with the message "Booting recovery kernel image" in the upper left and it just stays there, stuck there, I left it for a long time to see and it never leaves that screen.
Any ideas?
Me too
I can't get into clockworkmod either. My machine is running faster. I almost hate to mess it more.
lrgche said:
Tried both methods above but either way I get to the viewsonic splash with the message "Booting recovery kernel image" in the upper left and it just stays there, stuck there, I left it for a long time to see and it never leaves that screen.
Any ideas?
Click to expand...
Click to collapse
That's an indication that you may have more serious problems. nvflash will be required. http://forum.xda-developers.com/showthread.php?t=861950
Once done you will likely need to install ClockworkMod and repartition your internal storage.
Loukoebel said:
I can't get into clockworkmod either. My machine is running faster. I almost hate to mess it more.
Click to expand...
Click to collapse
If your tablet boots properly but you can't get into CWM then it probably isn't installed properly (or at all). http://forum.xda-developers.com/showthread.php?t=865245
Keep in mind that CWM is NOT compatible with all ROMs. Make sure the developer for your chosen ROM recommends it before installing it.
Does your method in opening post have to be run from external micro sdcard?
Both methods are performed with an external MicroSD card. They will work from internal also but it is a little more difficult to get the files in place if your tablet is not booting properly.
K J Rad said:
Both methods are performed with an external MicroSD card. They will work from internal also but it is a little more difficult to get the files in place if your tablet is not booting properly.
Click to expand...
Click to collapse
so your method is a simple way to replace one of the main uses of Clockword MOD?--Plus you stay stock more or less.
That is correct. Method II can also be modified to be less intrusive (leave user apps installed) or embedded into update scripts to perform a wipe during new ROM installs.
K J Rad said:
That is correct. Method II can also be modified to be less intrusive (leave user apps installed) or embedded into update scripts to perform a wipe during new ROM installs.
Click to expand...
Click to collapse
Wipe data does what--remove the apps installed?
And the partitions?
Your post is very interesting. It implies that you have a knowledge of the g-tabs partition structure. I have played with Linux off and on for the last 10+ years. When I began, I used Slackware and when you set it up you had to manually create partition tables using fdisk. You were only required to create two - the data partition and a swap partition but it was often recommended that you create several others - one to contain the home directory to prevent users from using all the disk space (in the days of small disks) for example. It appears that there are a lot of partition on the g-tab. Up to now, I have used various wiping tools like clockwork or calkulins wipe all on faith. I would really like to know what all the partitions are and what is in them. I have used terminal to get to the root folder and tried to do an fdisk to display the partitions but try as I might everything remains hidden. It would seem that a script like yours could be adapted to do many things but I would certainly want to understand the structure a little better before I did anything. I have searched and been unable to find that information. Can you point a way for the curious to learn more about the partition structure on the g-tab?
Wish I had a direction I could point you in. What I've found so far has mostly been stumbled upon while looking for something else. What I can tell you is this...
1) When using fdisk in Android you must specify the device to look at. Try something like: fdisk /dev/block/mccblk3 That should list the current partitions as defined by CWM or whatever was used originally.
2) Within one of those partitions in the list generated above are sub-partitions holding the bootloader, system, data, etc partitions. You can see how they're described in the .cfg files in the nvflash restores that are lying about.
lsu205 said:
Wipe data does what--remove the apps installed?
Click to expand...
Click to collapse
Removes user apps and their associated data as well as system related data and settings.
K J Rad - any idea if the partition size can be set with these methods (2048 & 0) in case I can't get clockwork installed?
CodeNamePapa said:
K J Rad - any idea if the partition size can be set with these methods (2048 & 0) in case I can't get clockwork installed?
Click to expand...
Click to collapse
I'm looking for a solution to that problem. Unfortunately these methods still require the ability to get into recovery mode which likely won't work if you're having trouble getting CWM installed.
If, however, you can get into recovery... then it is theoretically possible to create a script that would accomplish that. As soon as I have one I'll be adding it to the mix ;-)
Edit: I've found something I think will work. Will do some testing tonight. It will still require access to recovery.
I wasn't sure if you saw my other post but I am seeing no partition 0 when I NVFlash with a verifypartition.
http://forum.xda-developers.com/showpost.php?p=13059520&postcount=57
I haven't yet but I will. Let's try to keep this thread on topic. Thanks.
More thoughts:
because I went w/ cyan7 is it possible i have a "bad" kernel and that the stock bekit-1105 or the roebeet-3588 files are crashing w/ the kernel in place already?
I know custom ROMs can have a custom kernel applied separately, but I have no idea whether cyan7 loads it's own kernel...
I have yet to try the nvflash_gtablet_46 version, as I see the img files w/in are different from the original 1105 .zip
Also:
read on another thread that part 2 and part 3 aren't loading for other users when doing nvflash - I did notice that it pauses, runs some stuff, then starts loading part 4 through to the last part, then success. - do part 2 and 3 run for you?
edit: I see a 4349 downgrade.zip in another thread for those who got the OTA update but want to go back to stock 3588 prior to jumping off somewhere else - I can't expect that would help me as I can't do squat w/ recovery yet, but could that possibly "reset" any bad kernel problems? - again, I'm just thinking out loud.
This is well outside the scope of this thread but I find some of what you mention interesting so I'll address it and then end any further off topic discussions.
I did not build nor have I ever used Cyan7 so I have no basis for an opinion on the matter other than this... Each ROM comes with a kernel installed so if properly done an nvflash should overwrite any "bad" kernel.
Part2 and Part3 do indeed load, they are just displayed differently than the other Parts. Just minutes ago I flashed down from Mountain Laurel (4349 based with the new bootloader and recovery) with absolutely no trouble. I can, and have, read back those partitions after an nvflash to prove that point.
The 4349 downgrade will only work for you if recovery is working. Having never used it I don't know that it would "reset" the kernel but any subsequent flashing of a new ROM image would.
I am working on a stock recovery solution for partitioning but it isn't likely to help anyone who is stuck in an APX loop. I do have some ideas on what might help for that condition but I haven't been able to get my hands on one for testing and trying to help people here is like being a consulting mechanic for a car repair that's in someone else's shop having work done on it that you're not being told about.
I'll be happy to address any further comments or questions regarding your specific issue in an appropriate thread or via PM. Thanks.

[Q] Clockworkmod hanging on backing up system...

I apologize if this has been covered in another thread but I have been doing multiple searches on XDA and in google trying to find a solution but so far no luck. Long time reader of XDA but first time poster.
Details -
I successfully used NVFLASH, loaded Clockworkmod 0.8 and loaded Vega-Ntab gingerbread edition (stable RC1 I believe its called). I have been running this for a month or so with no major issues but I want to test out Vega-Ntab 5.1 and Brilliant Corners. Thinking of going with 5.1 for the hardware acceleration for gaming etc. Oh I also received my new Gtab with bootloader 1.2 and I downgraded that to 1.1 successfully before loading Vega-Ntab gingerbread. I think I can handle loading the new roms etc (may have to switch to 1.2 for Brilliant Corners I believe) but I want to do a full backup before doing so with clockworkmod so I can go back to gingerbread if I decide I liked it the best. But clockworkmod will not do a backup for me. I have tried multiple times and it always freezes/hangs at the same point. On the screen I see
ClockworkMod Recovery v2.5.1.1-bekit-0.8
SD card space free: 9697MB
Backing up boot...
Backing up recovery...
Backing up system... and here it will go no further
I have let it set at that point for hours but nothing changes. I checked the clockworkmod backup folder and it has a folder dated the current date of the backup but the contents is only boot.img and recovery.img and nothing else so I think that confirms it really isnt completing the backup.
I am unsure what the cause or solution to this is. I thought about reloading clockworkmod 0.8 but I don't think I can do this since it's already loaded. I thought about loading a newer version but from what I have read gingerbread and the other 1.1 roms will not work with anything but 0.8. I could just do a melt and repour and just go back to stock level and load 5.1 or Brilliant Corners but then I lose any apps I have loaded. I am not concerned about the majority of them but I have loaded a couple good ones as of late from Amazon that were the free app of the day and I am unsure whether I can "reload" these at a later date without being forced to pay. I have also paid for a couple games but I am assuming I can reload those without issue. I did back up all of the apps I paid for and amazon games that I loaded that I got for free (normally have to pay) with titanium backup. So assuming I can restore these with titanium backup after loading brilliant corners or vegan 5.1 then I guess the only thing that I lose by not being able to do a full backup/restore with clockwork is that if I want to go back to gingerbread then I have to start from scratch for reloading the rom.
So is the problem I am having running the back up successfully a known issue that I just can't seem to find a discussion thread about?
Thanks in advance for any help or advice.
Boot into ClockworkMod Recovery and get me a dmesg output (kernel messages) using adb. See this post for how.
Attach the dmesg.txt to your next post.
thanks for the reply. Unfortunately I am not having any luck getting the dmesg.txt file for you. I downloaded the iso image for Knoppix 6 but when I boot off the disc it starts processing everything but then it gives an error "the file /mnt-system/knoppix/knoppix is broken. then after about 30 secs it gives the following
/sbin/init: line 76: syntax error near unexpected token '/usr/share/fonts/type1/gsfonts/a010013l.pfb'
/sbin/init: line 76: '/URWGothicL-Book (usr/share/fonts/type1/gsfonts/a010013l.pfb);
I will try and download the iso from a different site and burn another disc.
I also tried a different route and loaded SDK manager to get to ADB by that route. I am running windows 7 if that makes a difference. I am not 100% sure when I am supposed to run the adb command line you listed. Do I have my gtab running clockworkmod and then mount USB so it will show up on my pc? Do I have to try and perform a backup and then run the adb command when it freezes? I don't think I can do that because if I navigate away from the mount USB it automatically unmounts it. Anyway adb doesn't appear to be seeing the gtab anyway. When I run the SDK manager it does not find any android devices. If I run the "adb devices" command it comes back with no devices. So I am not sure what basic thing I am missing to get adb or SDK to recognize the gtab.
I apologize for my lack of knowledge on adb. Your first link says if I have adb already set up to run adb shell dmesg > dmesg.txt while in clockworkmod so I am assuming I do this after mounting USB to get the pc to recognize the gtab.
I will try download and burn another iso image from a different location and see if I can boot off a disc. Assuming this time it is successful do I run the ADB command you listed in the second link while the GTab is mounted to USB and recognized by the pc? Hopefully ADB will see it if I can get this to work.
*update* I downloaded the ISO image from a different location. When I went to the folder it was downloaded to I noticed that the first ISO image I downloaded was only approx 100MB in size instead of 700+ mb. So I am re-burning another disc. Hopefully this will allow me to boot properly.
*update #2* I was able to successfully boot off of the new disc. Now I just need to figure out how and where to enter the adb command line in your link ($ sudo ./adb shell dmesg > dmesg.txt) i tried this using the Shell option but it says command not found. If I choose the File Manager option and navigate to where the adb file is that was in your linked zip file it just prompts me to edit/copy/move/rename or delete the file. I am out of time tonight so I will work on it more tomorrow. The good news though is that when I use File Manager the Gtab is listed so it is at least recognized. Now I just need to figure out how to get the dmesg.txt file you request but making some progress... I think
ashton555 said:
*update #2* I was able to successfully boot off of the new disc. Now I just need to figure out how and where to enter the adb command line in your link ($ sudo ./adb shell dmesg > dmesg.txt)
Click to expand...
Click to collapse
Step by step instructions in this post.
thanks a bunch. Those instructions were easy to follow and made sense. I have never used linux before but alot of it reminded me back of my old unix days (terminal commands that is).
Anyway I think I did everything correct and I am now attaching the txt file.
Thanks again for your help and patience with this Linux newbie let me know if I need to provide any additional information.
ashton555 said:
Anyway I think I did everything correct and I am now attaching the txt file.
Click to expand...
Click to collapse
You did indeed. And I can't see any obvious problems with the NAND-flash device, judging from the kernel messages.
Since you've already tried to take backups using CWM before, that action should've created a log file. This file might be useful. Retrieve it. Inside an xterm window on Linux, run:
Code:
hostpc$ [B]sudo ./adb pull /cache/recovery/log recovery.log[/B]
Attach this "recovery.log" file.
Next, try to read, one by one, the NAND flash partitions that CWM usually backs up. Here's an example run on my gTablet:
Code:
hostpc$ [B]sudo ./adb shell[/B] [I]Get into the shell in CWM[/I]
~ # [B]dump_image boot /dev/null[/B]
~ # [B]dump_image recovery /dev/null[/B]
~ # [B]dump_image system /dev/null[/B]
mtd: read error at 0x029a0000 (I/O error)
mtd: read error at 0x02da0000 (I/O error)
~ # [B]dump_image cache /dev/null[/B]
~ #
Type in only the commands in bold.
As you can see, my "system" partition on the NAND flash has errors (and the kernel also report this when it boots), but, the command will not hang. According to the kernel message that you just supplied, you don't have any errors on your onboard NAND flash, so, theoretically, you shouldn't get any errors at all. But, we'll see if the dump_image command hangs when reading system just like CWM does.
And if the dump_image command does hang somewhere, we can see if formatting just that system partition will get it working again. There is a utility on this board which we could use for doing that, though I've never tried it.
I successfully completed the next two tasks. I am attaching the recovery.log file. Note I had an issue copying the .log file to where I could access it in win7 (for some reason I cant attach a file while in linux). I opened it with a word processor and then saved it to my c drive which messed up the formatting. So I opened it in Word to get the formatting correct and saved it as a txt file so thats why the attached file is recovery.txt. Let me know if it messed it up to where its not useable.
On the second task
~ # dump_image boot /dev/null
this worked fine and quick
~ # dump_image recovery /dev/null
this worked fine and quick
~ # dump_image system /dev/null
this worked but took maybe 10-15 seconds
~ # dump_image cache /dev/null
this one gave an I/O error but completed the dump
mtd: read error at 0x00080000 (I/O error)
ashton555 said:
Let me know if it messed it up to where its not useable.
Click to expand...
Click to collapse
The file is just fine... and I can't see any error messages in it.
~ # dump_image system /dev/null
this worked but took maybe 10-15 seconds
Click to expand...
Click to collapse
This is normal -- "system" partition is ~200MB.
~ # dump_image cache /dev/null
this one gave an I/O error but completed the dump
mtd: read error at 0x00080000 (I/O error)
Click to expand...
Click to collapse
This also looks like normal behaviour, but, I'm puzzled that the kernel did not report any bad blocks on this partition. Check if this is a transient error:
1. Repeat the "dump_image cache ..." command a few times and see if the I/O error location is the same.
2. Try to "fix" the error on the cache partition by using the "wipe cache partition" menu item in CWM. Do this a couple of times.
3. Run the "dump_image cache ..." command again.
4. Attempt another full system backup using CWM.
If step 4 fails, we'll see if the writing of the backup to the sdcard is the problem, because the reading seems to be completing without any hangs as of now.
BTW, the most important partitions are all being read fine. The "cache" partition is not that important -- it can be empty (but not corrupt) each time the system boots and only the initial bootup might go a little slower.
And, if, in the end of all this, you can't use CWM at all, you can still make a full system backup using nvflash and a few Unix commands.
1. Repeat the "dump_image cache ..." command a few times and see if the I/O error location is the same
....i did the dump 4 times and it always gave the same I/O location
2. Try to "fix" the error on the cache partition by using the "wipe cache partition" menu item in CWM. Do this a couple of times
.... I wiped the cache 4 times successsfully
3. Run the "dump_image cache ..." command again.
.... same I/O error location
4. Attempt another full system backup using CWM
.... still freezing at backing up system
So I guess I need to try and do the backup with NVFlash and unix/linux commands? If you have a link on how to do that I will give it a try or I can search for it and see if there is a discussion thread on it.
Thanks again for your help and trying to resolve this
Question - if I started over from scratch and went back to stock and then loaded vegan gingerbread would this issue possibly correct itself? Also more importantly if I back up some apps using titanium backup before I go back to stock can I then restore them with Titanium once I have vegan ginger back loaded? Also if I loaded vegan 5.1.1 could I restore the same apps I backed up in vegan ginger? Hopefully that made sense. I don't mind starting from scratch if I need to I just wasnt sure if I would permanently lose certain apps I have loaded. It's only about 10 apps I care about
*update* - well I think I am going to be forced to start over anyway. After wiping the cache a couple times and attempting another backup (froze again at backing up system) I now can't get the gtab to boot completely. It is stuck at the flashing vegan ginger edition screen. It flashes for awhile then the screen goes black then it goes back to the flashing screen again. I know you said it would take longer to boot up the first time after wiping the cache but was doing the flash cycling for over an hour which I assume is too long? I tried wiping the cache again and I also wiped the davlik cache as someone suggested in another thread but it is back to being stuck in the flashing screen loop. Assuming I do have to start over can I at least boot to CWM, mount ext USB and copy off the titanium backup files I made so I can restore some of the paid for apps?
ashton555 said:
3. Run the "dump_image cache ..." command again.
.... same I/O error location
Click to expand...
Click to collapse
Looks like a permanent I/O error in the cache partition, then. But, I don't understand why it is "system" which is hanging on backup.
4. Attempt another full system backup using CWM
.... still freezing at backing up system
Click to expand...
Click to collapse
Get me the recovery.log.
So I guess I need to try and do the backup with NVFlash and unix/linux commands?
Click to expand...
Click to collapse
I'll think this over during the weekend. In the mean-time, read through this thread. You can safely take a complete backup of your tablet while I do a bit of experimentation on a clockworkmod-like solution. But, I suspect that you may not be able to backup "cache" using nvflash going by the I/O errors. I have errors on my "system" partition and a nvflash backup fails on it, but CWM doesn't have any problems backing up and restoring.
Question - if I started over from scratch and went back to stock and then loaded vegan gingerbread would this issue possibly correct itself?
Click to expand...
Click to collapse
Probably not. But, see this thread. It shows you how to wipe all the partitions on the NAND flash device. We don't need to format the entire NAND flash. We can see if doing a few repeated formats of the "system" and "cache" partitions gets CWM working again, if you're willing to wipe "system"--you will have to load Vegan-Ginger right after this.
Also more importantly if I back up some apps using titanium backup before I go back to stock can I then restore them with Titanium once I have vegan ginger back loaded? Also if I loaded vegan 5.1.1 could I restore the same apps I backed up in vegan ginger? Hopefully that made sense. I don't mind starting from scratch if I need to I just wasnt sure if I would permanently lose certain apps I have loaded. It's only about 10 apps I care about
Click to expand...
Click to collapse
I haven't used Titanium backup so I can't say how well it works, but, judging from the reports that other users have made, what you're suggesting should work without any problems. User downloaded applications are stored either on /data or on /mnt/sdcard (for apps moved to SD card). Since your SD cards don't seem to be affected, you can go ahead with Titanium backup.
ashton555 said:
Assuming I do have to start over can I at least boot to CWM, mount ext USB and copy off the titanium backup files I made so I can restore some of the paid for apps?
Click to expand...
Click to collapse
Yeah, copy the files in CWM, then just do a "wipe data/factory reset" and see if it boot loop goes away.
But, before you do that, gimme a half-hour and I'll send you commands which you can use to save the files in /data and /sdcard. I just have to compile and test a new version of busybox. The tar command already present in CWM doesn't seem to work properly for me.
Attaching the recovery file
I am running the nvflash back up right now.
It successfully did part-1.img through part-11.img with no errors. The last thing it said though is
"rem CACHE PARTITION BACKUP NOT NEEDED
"nvflash.exe" -r --read 12 part-12.img
press enter to continue
Is this maybe because I wiped the cache and it's empty?
I looked on my ext SD card and the titanium backup files are there (except for a couple I had forgotten do ....) so I think I am okay for going back to square one if need be.
I will go ahead (tomorrow probably) try doing what is described thread about wiping partitions on the NAND device and just formating the system and cache partitions. I am assuming that at this point I guess its okay to go ahead and try to load vegan tab 5.1.1 instead of ginger again since I wanted to try out 5.1.1 anyway or if you have any experience with it would you recommend Brilliant Corners instead since its a newer rom. I think I will have to reload the 1.2 bootloader which is okay.
ashton555 said:
Attaching the recovery file
Click to expand...
Click to collapse
No errors in there.
The last thing it said though is
"rem CACHE PARTITION BACKUP NOT NEEDED
"nvflash.exe" -r --read 12 part-12.img
press enter to continue
Is this maybe because I wiped the cache and it's empty?
Click to expand...
Click to collapse
I think so. The cache partition isn't that important anyway, so it can be skipped.
I will go ahead (tomorrow probably) try doing what is described thread about wiping partitions on the NAND device and just formating the system and cache partitions.
Click to expand...
Click to collapse
I would suggest that you copy the Titanium backed-up apps safely away immediately, then format just the system and cache partitions as per that thread. You will need to be in APX mode to use nvflash.
Immediately after the nvflash, (since the system partition is now gone), boot into CWM, then do a factory reset, repartition the internal sdcard, copy the Vegan-5.1.1 update file onto the now clean sdcard through the PC and then flash it. This should give you a clean slate.
Then check if you can do a backup using CWM. If you still can't, then I'll see if a solution can be devised to do partial backups.
And, I have tried neither Vegan* nor Brilliant Corners, so the choice is up to you.
Sorry, my test commands aren't working so I can't send you those commands I promised to back up your /data and /system--I suspect a bad USB cable.

How to format Android partitions without a custom recovery?

Due to various errors I think the partition / system is corrupt. Since after reinstalling the firmware the errors remain.
Unfortunately for my device there is no custom recovery with formatting options.
I have searched for an ADB command but I have not found it.
Can partitions be formatted from ADB or Linux or better from Windows?
Here you go, this link should give you all the necessary commands you require to format or erase any partitions you need to. May also pay to ask in your device forums Q&A section of you ain't already done so before going to town erasing stuff just to be on the safe side.
Good luck
https://android.tutorials.how/fastboot-commands/

Ulefone Armor x5 boot-debug.img

Ok, I get that boot-debug has been around for years... since android 10 for me, before that, it was variant=user, or variant=eng(ineer).
Strange how after I show boot-debug.img, magisk chooses this very path, but only after. Keeping in mind many people come here asking questions, and all those that know sit back and say nothing. Until they dont like what they see.
If you know better, and cant help, please keep your comments to yourself. This thread is intended to HELP, and is targetted toward those who CHOOSE to HELP because they CAN.
How I got su to work. Is this root? Now this is a good question. I dont want ANY overlaid system in my fone. I want to write to system like many others want to.
Not some google way of forcing us to use their mirrored online version of a locked filesystem already on my f'n.
Priority 1: I want to root my f'n without internet. Period. I do NOT want magisk using my credit. This proves we pay for magisk. I sometimes live so far from the world wide web, that offline is the only way to work. So I need to be able to root without google or THEIR employees offerings.
Priority 2: RW-able system.
So, I discover boot-debug.img for my f'n. Had it for a year, before I discovered it. Yeah, I discovered it after a year here asking, and getting NO replies that worked. Only after I'm vindicated to the naysayers 'thats been around forever...' yeah, try helping instead of useless comments.
In the end, I learned so much in such a short time. Constructive critiscism is NOT insulting. Magisk kills root in MY f'n. PERIOD. Camera does not work, location does not work, and I cant make/receive calls. But hey, it's an overlaid file system, of course it wont ALL work, I mean, I'd expect to lose a lil functionality, but disabling the GSI ability in dev options? I dont think so.. Worse, lack of adb or fastboot is produced in my f'n when using magisk, so tata magisk.
My logs actually explain all, so no more crappy adb logs. Yeah, I like simple adb, it works, or I'll MAKE it work.
Like this:
Attempt every possible method of flashing magisk according to tut's, nada. 3 different paths lead me to...?
1: The note9 recovery I found, that lopstom was kind enough to twrp for me (well appreciated) is the KEY to gaining root on my ulefone armor x5 mt6765. It turns out that the note9 recovery is actually an android 9 os, with a 'super' .img - and being android 9, the bootloader I used is an OLD bootloader, in particular, the variant=eng type. Note this, this is key.
2: With the note9 flashed to recovery I can RW system in android 10 properly, but only in twrp.
3: Discover boot-debug.img - yup, it's not quite a variant=eng build, but it does work for the following:
Flash boot-debug.img. By doing so, you get the adb root command, and the disable-verity options, way better than wiping vbmeta, which contains the 'is it rw, or ro' of every file in every partition to be mounted in their own partitions, but what most dont know, is each file mounted in it's own mountpoint also has the information contained by vbmeta, but for each seperate file. So unless you add the /null (one for system, the other for vendor) after the disable-verity...
Nah, wipe most of your directory structure, then wonder why in a RW-able system, it still dont work. Because each file in it's own mountpoint knows if the system directory SHOULD be ro or rw. That's EACH and EVERY stock file in it's OWN mountpoint, has the RW or RO inf for the system & vendor directory, ie, is system RW?
Example: Camera wont work, get it?
In the end, this is how I went about installing su.
Flashed boot-debug.img did NOT flash recovery. Flashed meefik busybox-arm64 to f'n, but did NOT install it, instead, I opened it to install it, top left, saved the busybox-arm64 and then flashed twrp, and while there, flashed the system_rw, to defeat the system_RW saying not enough space, I chose 1024, did the copy over of super_fixed, then rebooted, enabled system, THEN flashed the busybox-arm64 from twrp, and rebooted.
Results: I copied the busybox-arm64 su, from xbin to system. In order to defeat the system_RW saying not enough space, I chose 1024. Round numbers matter with system_RW, same senario as memory, so use sizes equal to how memory works. ie, 32, 64, 128, and multiples of.
Look at the adb posts in my closed thread.
With Su installed, I have to type exit TWICE to exit. without su in system, exit only needs typed once.
Now here is why I continue. I found root, but dont have the experience, but it's like this:
See all those lovely new file that end in .cel? Mine says platinum. That means I AM ROOT. By swapping out .cel files, I have all the access magisk denies me. .cel files... get on it devs... swap them out, try try try... find what I found.
I dont actually need su, but i need it for some apps. What I have proven, is that SU does NOT kill android 10_Q.
variant=user or variant=eng, is NOW dependant on .cel files, like, say, boot-debug.cel.
Have a nice discovery... I hacked googles latest offering my-cel-f
Edit: Cel files are found in the bootloader, a zero byte file, the file NAME decides what the loader can or cant do, PERIOD.
New root tools only require swapping these out, as well as a few system edits when done.
Ok, slight mistake in spelling so I'll add the following for you to 'see'..
userdebug_plat_sepolicy.cil
So it's not cel as I wrote in the first post, my point being just as valid.
Platinum clearly states there are more who's names I have yet to obtain...
Theoretically in my mind, if I swap the .cil file in the bootloader for say hypothetically:
engdebug_plat_sepolicy.cil... with the few edits seen in the android 10 notes I posted from china, the one where people say 'too much hassle' - I say, for them. Those notes show the rest of the cil files, so yeah, I got root OPTIONS to play with
Stay tuned for more scottish inventor style NOTES.
Edit: for the record: https://source.android.com/compatibility/vts/vts-on-gsi

SP Flash tool - How to open ROM_0 file created with SP Flash tool

Hi everyone and Happy New Year,
I am trying to open ROM_0 file created with SP Flash tool. I have tried ROM explorer 0.9.1, I have tried various option converting with simg2img and opening with 7zip but nothing has worked so far.
The file is about 100GB and it is a SP Flash tool backup of my userdata on which I have a lot of images which i need to save.
I was using Dot OS 5.2 general image and a message popped up about trying Android 12 and I have clicked on it just to get rid of it but I assume it has triggered a download. My phone crashed yesterday evening when I started the cmera app and once restarted it was in a boot loop mode stuck on the dot os logo.
So far I have tried various options unsuccessful - I have reflashed the image which I originally flashed, I have set the partitions active - a and b and reverted to the initial active one which was "a".
I have also flashed system.img (with the treble general image) but still it is in a boot loop mode.
I have just decided to flash back the super.img image from the stock and guess what - still stuck.
Flashed the stock boot.img again thinking there might be an issue with the kernel but that didn't help.
I understand that it is the case of fully flashing back the stock ROM which will lock the bootloader and delete all my userdata in order to have the phone back.
However the phone IS NOT important, the ONLY IMPORTANT thing are the images in the userdata.
I have created the backup of it straight after the boot loop appeared. Tried to read here on XDA but it is not clear what format is that file and how I can access the data on it.
Looked for a recovery partition but there is none. Potentially hidden as you can get into stock recovery via fastbootd. But the options there are only to wipe the partitions/reset.
The phone is Umidigi Bison Pro and I have been having all but troubles with it.
Any help greatly appreciated it.
Regards
s80_gad said:
Hi everyone and Happy New Year,
I am trying to open ROM_0 file created with SP Flash tool. I have tried ROM explorer 0.9.1, I have tried various option converting with simg2img and opening with 7zip but nothing has worked so far.
The file is about 100GB and it is a SP Flash tool backup of my userdata on which I have a lot of images which i need to save.
I was using Dot OS 5.2 general image and a message popped up about trying Android 12 and I have clicked on it just to get rid of it but I assume it has triggered a download. My phone crashed yesterday evening when I started the cmera app and once restarted it was in a boot loop mode stuck on the dot os logo.
So far I have tried various options unsuccessful - I have reflashed the image which I originally flashed, I have set the partitions active - a and b and reverted to the initial active one which was "a".
I have also flashed system.img (with the treble general image) but still it is in a boot loop mode.
I have just decided to flash back the super.img image from the stock and guess what - still stuck.
Flashed the stock boot.img again thinking there might be an issue with the kernel but that didn't help.
I understand that it is the case of fully flashing back the stock ROM which will lock the bootloader and delete all my userdata in order to have the phone back.
However the phone IS NOT important, the ONLY IMPORTANT thing are the images in the userdata.
I have created the backup of it straight after the boot loop appeared. Tried to read here on XDA but it is not clear what format is that file and how I can access the data on it.
Looked for a recovery partition but there is none. Potentially hidden as you can get into stock recovery via fastbootd. But the options there are only to wipe the partitions/reset.
The phone is Umidigi Bison Pro and I have been having all but troubles with it.
Any help greatly appreciated it.
Regards
Click to expand...
Click to collapse
May I'm wrong, but I guess that if you didn't give it an extension then the file doesn't have a format; when you make a backup of a partition using SP Flash tool you should give it an extension, for example userdata_backup.img will work, in some devices, for some partition the .bin extension is used.
And to restore the device to a working state without losing data you could flash the stock ROM unchecking the userdata partition and using Download only option won't re-lock your bootloader.
If actually your userdata was not overwritten you still can try a second attempt to preserve it using mtk-client, search for it in GitHub, also consider what I stated about re-flash your original ROM preserving the userdata partition.
Thanks SubwayChamp, I appreciate your comment.
I have tried .img, .bin, ext4 etc but cannot open it - I am not sure if there is another application that can convert it in a readable format or maybe if we can mount it and access the files.
I had the impression that if you flash the stock rom the bootloader is locked and you loose everything.
But thanks for your advice - I will flash everything apart from the userdata partition which is last in the order anyway. Should I select or deselect the preloader partition- will that make a difference?
Regards
Just flashed the full stock rom without the userdata partition - still stuck on the logo in a boot loop . I really need to open the userdata backup file from SP flash tool as I feel I have to do a full reset/wipe.
Any other suggestions about explorer for the sp flash dump file, please?
Regards
s80_gad said:
Just flashed the full stock rom without the userdata partition - still stuck on the logo in a boot loop . I really need to open the userdata backup file from SP flash tool as I feel I have to do a full reset/wipe.
Any other suggestions about explorer for the sp flash dump file, please?
Regards
Click to expand...
Click to collapse
No, I didn't say to change the extension now and try it in various format, unfortunately I feel that if you didn't give you the extension at the time to make a backup then the file is unreadable, what I mean is that when you make the dump through SP Flash tool you have to give to the file a name and an extension, not letting it as is offered by SP Flash tool, for example you did see the name ROM_0 or similar, but you have to give it a name and an extension, in this case userdata_backup.img would work.
Did you check mtk-client?, you can read (dump) the userdata partition through this CLI tool, and after that you can restore it at any time.
Using the download option (only) you never re-lock your bootloader.
But wait a minute, keep in mind that your device is A/b, so you have to double-try all the things, for example, if you want to flash a specific partition like boot you have to be sure in which partition you are right now BUT unfortunately you don't know which partition is the working one, so better use fastboot to flash the missed partition, target to both slots.
And what about the option to get to a custom recovery? (I guess you had it previously to flash CR Droid) either taking a backup of userdata or re-flashing the same CR Droid that was functional previously.
Thanks SubwayChamp for your reply.
So I will try to dump the userdata again then - I still haven't touched it so I hope the partition and the data on it is fine.
I assume it is that mtkclient you are referring to. Will see if I can get some time today to try the live cd first as I am on Windows at this moment.
So my device is indeed A/B - the system is on "a" and I have flashed dot os using fastbootd and overwriting the system.img within the super.img. It worked fine for about 20 days until that crash (I only assume it is due to the update - nothing else has happened that could create trouble).
Also tried to set the b partition active but didn't help so switched back to "a".
Unfortunately there is no recovery partition, from what I learned the recovery is within the boot img. I have tried to load temporary unofficial twrp - fastboot boot twrp.img - and the first step is ok, but then it crashes. so no luck to load custom recovery even temporary in order to save the userdata on sdcard.
Tried to get to the contents trough adb shell but while some directories are listed, I get access denied to the userdata - I think maybe the links are broken?
I will try with the mtk to see if I can back it up - and what I'll do is I'll flash the full stock rom including the userdata and potentially will try to flash the old userdata through fastboot or sp flash or mtk.
TBH I don't understand why the phone is still in a bootloop - can't be only because I haven't cleared the userdata?
Regards
s80_gad said:
Thanks SubwayChamp for your reply.
So I will try to dump the userdata again then - I still haven't touched it so I hope the partition and the data on it is fine.
I assume it is that mtkclient you are referring to. Will see if I can get some time today to try the live cd first as I am on Windows at this moment.
Click to expand...
Click to collapse
It works on Windows though.
s80_gad said:
So my device is indeed A/B - the system is on "a" and I have flashed dot os using fastbootd and overwriting the system.img within the super.img. It worked fine for about 20 days until that crash (I only assume it is due to the update - nothing else has happened that could create trouble).
Click to expand...
Click to collapse
The issue was originated due to the lack of the other system files that also occupy this space; vendor, odm, product (may vary depending on the device), can be fixed flashing the super.img using fastbootd again.
s80_gad said:
Also tried to set the b partition active but didn't help so switched back to "a".
Unfortunately there is no recovery partition, from what I learned the recovery is within the boot img. I have tried to load temporary unofficial twrp - fastboot boot twrp.img - and the first step is ok, but then it crashes. so no luck to load custom recovery even temporary in order to save the userdata on sdcard.
Click to expand...
Click to collapse
Yes, this device doesn't have a dedicated recovery partition, but it is placed in a tiny portion of the boot image (usually the ramdisk) you can try by flashing the TWRP image onto the boot partition (flashing, not booting only) then boot to it, do the stuff you need through TWRP, from there you could solve the bootloop. To can boot to Android again you should need to flash a boot image.
s80_gad said:
Tried to get to the contents trough adb shell but while some directories are listed, I get access denied to the userdata - I think maybe the links are broken?
Click to expand...
Click to collapse
No, it's encrypted.
s80_gad said:
I will try with the mtk to see if I can back it up - and what I'll do is I'll flash the full stock rom including the userdata and potentially will try to flash the old userdata through fastboot or sp flash or mtk.
TBH I don't understand why the phone is still in a bootloop - can't be only because I haven't cleared the userdata?
Regards
Click to expand...
Click to collapse
When you flashed a system image onto the super partition the other partitions that are set dynamically didn't find a place to be recreated or couldn't play its role, added to this, a different system image that which is contained in the super image can differ in sizes either logical and/or dynamical (virtual sized).
SubwayChamp said:
The issue was originated due to the lack of the other system files that also occupy this space; vendor, odm, product (may vary depending on the device), can be fixed flashing the super.img using fastbootd again.
Click to expand...
Click to collapse
Flashed already the original stock rom super. img and everything else apart from userdata - it doesn't work.
see below
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
SubwayChamp said:
Yes, this device doesn't have a dedicated recovery partition, but it is placed in a tiny portion of the boot image (usually the ramdisk) you can try by flashing the TWRP image onto the boot partition (flashing, not booting only) then boot to it, do the stuff you need through TWRP, from there you could solve the bootloop. To can boot to Android again you should need to flash a boot image.
Click to expand...
Click to collapse
Tried to flash it - it just restarts the phone straight away - in fact replaced it with sp flash tool as well which recognises only the "a" partition and flashes it there.
SubwayChamp said:
No, it's encrypted.
Click to expand...
Click to collapse
I see
SubwayChamp said:
When you flashed a system image onto the super partition the other partitions that are set dynamically didn't find a place to be recreated or couldn't play its role, added to this, a different system image that which is contained in the super image can differ in sizes either logical and/or dynamical (virtual sized).
Click to expand...
Click to collapse
I am guessing this is why I have to reflash the whole rom incl userdata in order to make the phone usable.
What I'll do is I'll try to dump userdata with mtk and then will reflash everything with the stock rom ()hopefully the phone will boot) and then will flash the dumped userdata with mtk. Hopefully that will work.
I'll see if I can somehow mount the mtk .bin file to see if I can get to the contents of it
Will have to use the live dvd as I have win 7 and python 3.9 cannot run on win 7.
EDIT: Can't start anything through the live dvd - is there any workaround for win 7 or is there a direct executable file which I can get to start the mtkclient?
Regards
Hello,
I also have an Umidigi Bison Pro that I am going to use as a daily driver. (It's a pity that it's unpopular it would be a great device for modding, it's cheap, rugged and has source code availability of the official ROM and kernel). I created a Telegram group about this phone if you want to join is https://t.me/UmidigiBisonPro
About your problem you can read this guide (it describes how to backup and extract from the file created by SP Flash Tool even the partitions that not visible such as the b slots) https://www.hovatek.com/forum/thread-21970.html
To give you an idea on my Bison Pro a total of 52 partitions were extracted.
If you have the full backup from before the bootloop (before the upgrade, when it was still working) my advice is to restore all partitions.
I consider myself a novice regarding modding but it is likely that after the upgrade the userdata partition is no longer readable.
I have read that you should not update the GSI ROMs but repeat the whole flash sequence.
I also recommend removing the forced encryption of the userdata partition (you can do this when rooting) to avoid exactly these problems where you have the partition backup but not the decryption key.
s80_gad said:
Flashed already the original stock rom super. img and everything else apart from userdata - it doesn't work.
see below
View attachment 5499133
Tried to flash it - it just restarts the phone straight away - in fact replaced it with sp flash tool as well which recognises only the "a" partition and flashes it there.
I see
I am guessing this is why I have to reflash the whole rom incl userdata in order to make the phone usable.
What I'll do is I'll try to dump userdata with mtk and then will reflash everything with the stock rom ()hopefully the phone will boot) and then will flash the dumped userdata with mtk. Hopefully that will work.
I'll see if I can somehow mount the mtk .bin file to see if I can get to the contents of it
Will have to use the live dvd as I have win 7 and python 3.9 cannot run on win 7.
EDIT: Can't start anything through the live dvd - is there any workaround for win 7 or is there a direct executable file which I can get to start the mtkclient?
Regards
Click to expand...
Click to collapse
Sorry for delay, I didn't receive any notification on this (or I didn't notice it), I hope you sorted out your issue, if not, let me know.
SubwayChamp said:
Sorry for delay, I didn't receive any notification on this (or I didn't notice it), I hope you sorted out your issue, if not, let me know.
Click to expand...
Click to collapse
I didn't received notification too on your message and I found out on profile account that the notification for new message on a thread are default disabled.
I recently had some problems and experimented with partitions.
Reducing the possible cases I think the decryption key for the userdata partition might be in these partitions: super , misc , nvdata , nvcfg , md_udc
and I noticed that if one of them is corrupted/different version the dm-verity check fails (in my case it is written on the screen) and it was necessary to reflash all partitions except userdata (I don't know if there is a faster combination, from the few tests done in this case I didn't find any)
Do you have more information about where the decryption key might be between those partitions?
I have made a brief description of the role of all the partitions encountered but I still don't know some of them:
boot_para
gz_a (/ gz_b)
md_udc
otp
spmfw_a (/ spmfw_b)
sspm_a (/ sspm_b)
teksunhw_a (/ teksunhw_b)
Werve said:
I didn't received notification too on your message and I found out on profile account that the notification for new message on a thread are default disabled.
I recently had some problems and experimented with partitions.
Reducing the possible cases I think the decryption key for the userdata partition might be in these partitions: super , misc , nvdata , nvcfg , md_udc
and I noticed that if one of them is corrupted/different version the dm-verity check fails (in my case it is written on the screen) and it was necessary to reflash all partitions except userdata (I don't know if there is a faster combination, from the few tests done in this case I didn't find any)
Do you have more information about where the decryption key might be between those partitions?
I have made a brief description of the role of all the partitions encountered but I still don't know some of them:
boot_para
gz_a (/ gz_b)
md_udc
otp
spmfw_a (/ spmfw_b)
sspm_a (/ sspm_b)
teksunhw_a (/ teksunhw_b)
Click to expand...
Click to collapse
Why do you think userdata has a decryption key? Unless the user set it in a backup done through a custom recovery or through the device itself, I don't think so, may I'm wrong, but which is your scenario?
SubwayChamp said:
Why do you think userdata has a decryption key? Unless the user set it in a backup done through a custom recovery or through the device itself, I don't think so, may I'm wrong, but which is your scenario?
Click to expand...
Click to collapse
Since the userdata partition is now usually encrypted either with FBE or FDE but once the system loads the files are readable and moveable even externally then it is clear that somehow the data has been decrypted precisely using the relevant decryption key, AES encryption usually.
So if the user has not specified any key this must be derived from the information already in the partitions from the factory.
Then by restoring the right combination of partitions the system can boot correctly by decrypting the userdata partition. Hence the tests and the report I wrote in my last post.
At the moment I was able to remove the forced encryption of the userdata partition by modifying super (specifically fstab present in the /vendor sub partition) but I would like to achieve the same systemless modification using Magisk (to be OTA compatible). Unfortunately, the options to remove dm-verity and forceencrypt have been hidden in the latest versions of Magisk to avoid problems with inexperienced uses.
Since I don't have a custom recovery on the Umidigi Bison Pro I can't force flag those options in the .magisk file so I have to find another way.
Werve said:
Since the userdata partition is now usually encrypted either with FBE or FDE but once the system loads the files are readable and moveable even externally then it is clear that somehow the data has been decrypted precisely using the relevant decryption key, AES encryption usually.
So if the user has not specified any key this must be derived from the information already in the partitions from the factory.
Then by restoring the right combination of partitions the system can boot correctly by decrypting the userdata partition. Hence the tests and the report I wrote in my last post.
At the moment I was able to remove the forced encryption of the userdata partition by modifying syper (specifically fstab present in the /vendor sub partition) but I would like to achieve the same systemless modification using Magisk (to be OTA compatible). Unfortunately, the options to remove dm-verity and forceencrypt have been hidden in the latest versions of Magisk to avoid problems with inexperienced uses.
Since I don't have a custom recovery on the Umidigi Bison Pro I can't force flag those options in the .magisk file so I have to find another way
Click to expand...
Click to collapse
Well, what I said is a different thing, the other user had a different interest than this. They did want to access to some data from a backup in a non-booting device, I referred to that, the userdata image backed up doesn't have an encryption by default, unless the user set one through a custom recovery, suppose that someone did take a backup from the userdata partition, this userdata image can be opened/readable for anyone with minimum skills and the appropriate tool.
In regard to your issue, I don't think, the userdata partition has any kind of restrictions to take OTA updates, most likely this resides in the bootloader, kernel or even a "silent/hidden" partition with no more functions than that.
As a side note, you should check some custom recoveries, specially in Xiaomi devices that easily allow taking OTA updates, for example I always can take OTA, when I use Orange Fox recovery, although I'm not interested, so I make updates manually, to be sure that all run fine.
SubwayChamp said:
Well, what I said is a different thing, the other user had a different interest than this. They did want to access to some data from a backup in a non-booting device, I referred to that, the userdata image backed up doesn't have an encryption by default, unless the user set one through a custom recovery, suppose that someone did take a backup from the userdata partition, this userdata image can be opened/readable for anyone with minimum skills and the appropriate tool.
In regard to your issue, I don't think, the userdata partition has any kind of restrictions to take OTA updates, most likely this resides in the bootloader, kernel or even a "silent/hidden" partition with no more functions than that.
As a side note, you should check some custom recoveries, specially in Xiaomi devices that easily allow taking OTA updates, for example I always can take OTA, when I use Orange Fox recovery, although I'm not interested, so I make updates manually, to be sure that all run fine.
Click to expand...
Click to collapse
The methodology I was referring to that is not OTA supported is to modify the super partition (the dynamic partition that from Android 8? contains system, vendor, product--for Project Treble) to disable the forced encryption of the userdata partition. In my case FBE (File Based Encryption) Android 11 encryption.
Even having disabled the dm-verity if you apply an OTA update the super partition is replaced with the one that does not have the modification to remove the forced encryption and from the tests I have done this refuses to read unencrypted partitions and asks to do a factory reset.
So, the userdata partition makes the OTA update problematic (it doesn't block it, but you lose your personal data).
I am sure that instead of modifying the super partition to disable encryption you can achieve the same result via Magisk and a modified boot partition.
Unfortunately despite many trials due to my inexperience with Magisk I could not do it.
I wanted to do all this to avoid problems as described in the case of this thread that is, have the userdata partition intact but not the rest to be able to describe it. But seems I must let the encryption and do a backup after every OTA update.
Werve said:
The methodology I was referring to that is not OTA supported is to modify the super partition (the dynamic partition that from Android 8? contains system, vendor, product--for Project Treble) to disable the forced encryption of the userdata partition. In my case FBE (File Based Encryption) Android 11 encryption.
Even having disabled the dm-verity if you apply an OTA update the super partition is replaced with the one that does not have the modification to remove the forced encryption and from the tests I have done this refuses to read unencrypted partitions and asks to do a factory reset.
So, the userdata partition makes the OTA update problematic (it doesn't block it, but you lose your personal data).
I am sure that instead of modifying the super partition to disable encryption you can achieve the same result via Magisk and a modified boot partition.
Unfortunately despite many trials due to my inexperience with Magisk I could not do it.
I wanted to do all this to avoid problems as described in the case of this thread that is, have the userdata partition intact but not the rest to be able to describe it. But seems I must let the encryption and do a backup after every OTA update.
Click to expand...
Click to collapse
If you want to apply an OEM vendor stock update then it is a restriction from the OEM itself, and if you want to apply a GSI based update, it's a different approach, not sure if the restriction is FBE related or if the userdata is encrypted or not but probably related to AVB.
There are some tools/scripts you should search for, that can unpack and repack super partition, maybe you find something in the ODM or product image, this is assuming that the super partition it is the culprit.
Just know that it's a nonsense that an order (script) to restore a specific partition, be placed just there, but in other partition.
You should check what the OTA update contains, try to catch the OTA update through some ADB script, then unpack it, and see inside.
Also, you can try backing up every partition, and restoring them one by one, seeing if it boots.
SubwayChamp said:
If you want to apply an OEM vendor stock update then it is a restriction from the OEM itself, and if you want to apply a GSI based update, it's a different approach, not sure if the restriction is FBE related or if the userdata is encrypted or not but probably related to AVB.
There are some tools/scripts you should search for, that can unpack and repack super partition, maybe you find something in the ODM or product image, this is assuming that the super partition it is the culprit.
Just know that it's a nonsense that an order (script) to restore a specific partition, be placed just there, but in other partition.
You should check what the OTA update contains, try to catch the OTA update through some ADB script, then unpack it, and see inside.
Also, you can try backing up every partition, and restoring them one by one, seeing if it boots.
Click to expand...
Click to collapse
I have already done these tests, not with an OTA update but with a different version of the firmware for all partitions, and set out the conclusions.
Obviously it's an OEM restriction since it left the forced FBE encryption on and the way it was created (so I guess also from AOSP) it refuses to read the userdata partition if it doesn't find it encrypted.

Categories

Resources