Alcatel/Vodafone VFD720 dm-verity disable - Android Q&A, Help & Troubleshooting

Hi!
This phone has separate system and vendor partitions which are verified with dm-verity. I want to add Polish strings to apks/framework.
So I tried to disable veryfying of vendor and system partition (by editing fstab in boot.img), but there's only fstab.enableswap file available, which doesn't contain system/vendor mountpoints.
Later I found fstab.mt6739 on the vendor image, in /etc, and it had the desirable mounts. But after removing 'verify' flag, the phone still keeps restarting on android logo (only if system was modified).
I've also noticed, that changing anything in vendor image doesn't take effect (tried removing vodafone apps, changing strings in an apk). Is it possible that vendor partition is somehow bypassed? Is there an other way to disable dm-verity?
PS I'm flashing the firmware using NCK box.

Hi
flash the stock Boot.img ,flash it to the recovery partition. using SP flash tools
It allows to boot to the system os with recovery editing permissions
Boot into recovery mode
Hold power + volume up on boot
Adb push fstab.mt6739 /sdcard/
adb Shell
su
mount -o rw,remount /system
mount -o rw,remount /vendor
cp /sdcard/fstab.mt6739 /vendor/etc/
chmod 644 /vendor/etc/fstab.mt6739
Flash back the stock recovery when your finished

Related

If ... then ... else and init.rc

Hi, I'd like to ask a general question about device boot. I'd like to mount /system, /data, and /cache partitions in selected locations based on detection of sdcard in the device.
How could I add an if ... then ... else statement to init.rc before that /system, /data, and /cache partitions are mounted? Any ideas?
Solved
I've found a way to perform this task. It's possible to place if ... then ... else statement into a shell script and put the shell script into ramdisk root directory of boot.img. Then, just run the script by busybox ash command from init.rc (with busybox located into ramdisk root directory).
cristian_c said:
I've found a way to perform this task. It's possible to place if ... then ... else statement into a shell script and put the shell script into ramdisk root directory of boot.img. Then, just run the script by busybox ash command from init.rc (with busybox located into ramdisk root directory).
Click to expand...
Click to collapse
Hey... I managed to mount /dev/block/mmcblk1p2 as my /data partition by editing my boot.img ramdisk(the 3. fstab files and the .rc files... i replaced [email protected] with dev/block/mmcblk1p2 wherever i saw them)
So i was trying to use an if statement in some of the .rc files to check if /dev/block/mmcblk1p2 was mounted on /data and if not then mount /dev/block/mmcblk0p9 (my usrdata partition) on /data... Soon i realised that this isn't exactly bash...
Please explain how you managed to get a .sh to run from your .rc files( or do you only need it in the init.rc, and remove all the /data mounting lines from them and do it all from the script???)
I don't always have access to a pc so if my sdcard somehow dies i want my phone to boot using the internal /data partition otherwise i will bootloop until i flash the original boot.img
nullbyte001 said:
Hey... I managed to mount /dev/block/mmcblk1p2 as my /data partition by editing my boot.img ramdisk(the 3. fstab files and the .rc files... i replaced [email protected] with dev/block/mmcblk1p2 wherever i saw them)
So i was trying to use an if statement in some of the .rc files to check if /dev/block/mmcblk1p2 was mounted on /data and if not then mount /dev/block/mmcblk0p9 (my usrdata partition) on /data... Soon i realised that this isn't exactly bash...
Please explain how you managed to get a .sh to run from your .rc files( or do you only need it in the init.rc, and remove all the /data mounting lines from them and do it all from the script???)
I don't always have access to a pc so if my sdcard somehow dies i want my phone to boot using the internal /data partition otherwise i will bootloop until i flash the original boot.img
Click to expand...
Click to collapse
I've found on fs_property:ro.mount.fs=EXT4 in init.rc. In that section, I've added the following iine:
Code:
exec /busybox ash /mount_partitions.sh
[of course, I've placed busybox arm compiled binary (the version provided by busybox android app should work) and a mount_partitions.sh script (created by myself) into boot image ramdisk (I mean / main directory, the same where init.rc is located) ]
You could also need to give permissions to busybox and to .sh script. You could also need to remount / in read-write mode, in case of issues with the above command.

Su/su.d/script.

Hi guys. Does any of you know how to push su.d directory into su folder? I mean I need radio.sh script in su/su.d to get root call sms manager working. Every time I try it disappears after reboot.
Rooted rom 34.3.A.0.217 with TWRP.
Anyone?
It's late though, but for the guidance of other noobs like me. /su/su.d/ can't be flashed in recovery because this isn't available. For system-less roots, binaries/libraries required to start supersu daemon and to manage root permissions, don't reside in /system/bin but in /data/su.img while (at least) two files reside in boot.img i.e. boot.img/ramdisk/init.supersu.rc and boot.img/ramdisk/sbin/.*daemonsu*.sh. When ROM boots, init.supersu.rc mounts /data/su.img on /su directory and calls /sbin/*daemonsu*.sh for initial setup which starts /su/bin/daemonsu and other se-linux related stuff and then executes any scripts found in /su/su.d/ and /system/su.d.
You can find this:
Code:
mido:/ # mount | grep loop
/dev/block/loop0 on /su type ext4 (rw,seclabel,noatime,data=ordered)
So, the init.d scripts placed in /su/su.d actually reside in /data/su.img which isn't mounted in recovery mode and anything flashed to /su/su.d goes to volatile rootfs which is gone on reboot. Either mount su.img in recovery, or place this script while ROM is running or instead flash to /system/su.d which is permanent filesystem unlike rootfs (which lives in RAM). And finally don't forget to set permissions to 0700 as advised here. Another thing, mostly init.d scripts don't work with .sh extension. Avoid this too.

[HELP] TWRP on MT6771V/CT Android 9 (Pie)

Hello, I have Blackview BV9800Pro with MT6771V/CT and Stock Android Pie and Magisk roots + Riru ckre and edXposed. I need TWRP so I could easily backup and restore system at any time. I test EdXposed and Magisk modules and it is PAIN to do factory reset if something fails cause this is my only smartphone. I tried different twrp already, but it didn't worked. Unofficial twrp contact form on website does not work (gives error). Can You help me guys, please? PLEASE!!
this one works for me (at mega)
#!GWwXDKjC!vPERdlfIiP-hylz3R7SEcU105PGAP4oi0QC3FtNWsyU
from the hovatek forum (32580)
the only problem is that, like said on that forum, it won't decrypt the user partition. Someone on there says to use the Disable_Dm-Verity_ForceEncrypt_03.04.2020.zip
to disable encryption, but another poster says that it disables the phone, no touch, no mouse, etc. I have the same issue. I'd like to be able to decrypt with TWRP or turn off encryption. Then ill be able to make backups of the user partition. Anyone have any ideas?
tecs.ottawa said:
this one works for me (at mega)
#!GWwXDKjC!vPERdlfIiP-hylz3R7SEcU105PGAP4oi0QC3FtNWsyU
from the hovatek forum (32580)
the only problem is that, like said on that forum, it won't decrypt the user partition. Someone on there says to use the Disable_Dm-Verity_ForceEncrypt_03.04.2020.zip
to disable encryption, but another poster says that it disables the phone, no touch, no mouse, etc. I have the same issue. I'd like to be able to decrypt with TWRP or turn off encryption. Then ill be able to make backups of the user partition. Anyone have any ideas?
Click to expand...
Click to collapse
that TWRP looks fine to me, the one who did this was expert. the display driver is hex patched against getbootmode in order to get touch screen working. some user reported that TWRP is asking for password, that indicates to me encryption is supported (/etc/recovery.fstab has entry for full-disk encryption with metadata partition). furthermore this TWRP build is signed with AVBv1 signature that mean it passes Verified Boot and is flashable even on locked bootloader
have you seen Method 3 for disabling dm-verity by disabling AVB with dummy vbmeta?
Code:
fastboot --disable-verity -disable-verification flash vbmeta vbmeta.img
also it seems like you can do it with Method 2 patching boot.img with Magisk Manager, the only discrepancy i recommend on step 4. to keep the checkbox for preserve force encryption enabled, then patch it manually in fstab against force encryption by changing the flag from forceencrypt= into encryptable=
if this device has fstab in boot.img then you can use Android.Image.Kitchen.v3.7-Win32.zip for unpack/repack boot.img and do the change in ramdisk/fstab.mt6771 with Notepad++
otherwise fstab is located /system_root/system/vendor/etc/fstab.mt6771 you can use adb pull in TWRP recovery, modify the file, and adb push it back
Code:
adb pull /vendor/etc/fstab.mt6771
adb push fstab.mt6771 /tmp
adb shell
cat /tmp/fstab.mt6771 > /vendor/etc/fstab.mt6771
or do it directly with sed
Code:
adb shell
sed -r ',s,(^/[^[:space:]]+[[:space:]]+/data[[:space:]]+[^[:space:]]+[[:space:]]+[^[:space:]]+[[:space:]]+[^[:space:]]*)force[def]+[cno]+r[befpty]{3}=([^[:space:]]+),\1encryptable=\2,' /vendor/etc/fstab.mt6771 > /tmp/fstab.mt6771
cat /tmp/fstab.mt6771 > /vendor/etc/fstab.mt6771
of course vendor must be mounted. cat is recommended to preserve file permissions
But, before modifying vendor, make sure AVB is disabled (flash empty vbmeta.img)
I tried method 1:
it just stalled on the first splash screen when turned on.
for method 3:
i looked in the root and there's no vmbeta folder (vendor is the last one)
for method 2:
i tried it and it has the same issue as when i use the disabler, no touch. i made the boot img in magisk with the force encryption unchecked and the verity checked. i unpacked the boot img but there was no fstab in it. i found the one on the phone but it already had "encryptable=", here is the main section:
/dev/block/platform/bootdevice/by-name/system / ext4 ro wait,recoveryonly
/dev/block/platform/bootdevice/by-name/vendor /vendor ext4 ro wait,recoveryonly
/dev/block/platform/bootdevice/by-name/userdata /data ext4 noatime,nosuid,nodev,noauto_da_alloc,errors=panic wait,check,formattable,quota,resize,reservedsize=128m,=/dev/block/platform/bootdevice/by-name/metadata
/dev/block/platform/bootdevice/by-name/cache /cache ext4 noatime,nosuid,nodev,noauto_da_alloc,discard wait,check,formattable
/dev/block/platform/bootdevice/by-name/protect1 /mnt/vendor/protect_f ext4 noatime,nosuid,nodev,noauto_da_alloc,commit=1,nodelalloc wait,check,formattable
/dev/block/platform/bootdevice/by-name/protect2 /mnt/vendor/protect_s ext4 noatime,nosuid,nodev,noauto_da_alloc,commit=1,nodelalloc wait,check,formattable
/dev/block/platform/bootdevice/by-name/nvdata /mnt/vendor/nvdata ext4 noatime,nosuid,nodev,noauto_da_alloc,discard wait,check,formattable
/dev/block/platform/bootdevice/by-name/nvcfg /mnt/vendor/nvcfg ext4 noatime,nosuid,nodev,noauto_da_alloc,commit=1,nodelalloc wait,check,formattable
/dev/block/platform/bootdevice/by-name/apd /mnt/vendor/apd ext4 noatime,nosuid,nodev,noauto_da_alloc,commit=1,nodelalloc wait,check,formattable
/devices/platform/externdevice* auto auto defaults voldmanaged=sdcard1:auto,encryptable=userdata
when i flashed back the magisk boot img that doesnt have the custom settings, it booted OK, but then twrp cant access the userdata again.
please read more careful
method 2
force encryption checked and the verity unchecked
i can see your fstab is broken already, there is no forceencrypt= forcefdeorfbe= or encryptable= flag (it's gone) furthermore this is not the only file otherwise it wouldn't encrypt again
method 3
flashing vbmeta is required. please download dummy vbmeta and flash it from fastboot
in TWRP you can list partitions with
Code:
ls -d $(find /dev/block -name by-name)/*
don't flash magisk zip this will affect encryption. patch fstab manually in the respective line for /data in the flags in 5th column
Code:
/dev/block/platform/bootdevice/by-name/userdata /data ext4
noatime,nosuid,nodev,noauto_da_alloc,errors=panic
wait,check,formattable,quota,resize,reservedsize=128m,encryptable=/dev/block/platform/bootdevice/by-name/metadata
which fstab is it? maybe there is another one in nvdata? at least, it is the only explanation i have why device encryptes anyway..
i am not sure why TWRP does not work for you, please provide recovery.log
edit: btw i wonder why magisk only boot with dm-verity enabled.. are you sure you have unlocked bootloader?
sorry about that, i was really tired. that is what i had. under advanced settings in magisk manager: preserve force encryption (checked), preserve AVB 2.0/dm-verity (unchecked), recovery mode (unchecked)
I just typed it wrong in my message
I didn't modify that fstab actually. So unless the disabler did it, that is the original one. I tried to unpack the vendor.img from the stock rom to see if that fstab is the same, but that image kitchen .bat threw an error.
i've added "encryptable" after "reservedsize=128m,". i then flashed the magisk boot.img and replaced the fstab using cat with the new one by copying it to /tmp/ and then running cat /tmp/fstab.mt6771 > /vendor/etc/fstab.mt6771
there is also an fstab in nvdata, that one says:
/dev/block/platform/bootdevice/by-name/userdata /data ext4 noatime,nosuid,nodev,noauto_da_alloc,errors=panic wait,check,formattable,quota,resize,reservedsize=128m,forcefdeorfbe=/dev/block/platform/bootdevice/by-name/metadata
i edited that one : replaced forcefdeorfbe with encryptable and replaced the file in the same way as the other.
after rebooting with the 2 fstab files with "encryptable" and the custom magisk boot.img (that had no touch before), it works!
i guess that second nvdata fstab was the one we needed to edit or the regular one had been broken somehow and fixing it was the thing. im guessing it was the nvdata one.
now the phone says its unencrypted and twrp can backup the userpartition.
thank you so much

Android x86 Pie magisk installation "Read-only file system"

Hey,
My setup:
Android-x86_9.0-r2_(x8) running on Proxmox (using QEMU and qcow2 formatted image)
GRUB, GBT installed, and I selected install with write permissions at the android installation
I tried to install magisk using the following guide: https://forum.xda-developers.com/android/general/guide-android-x86-rooted-magisk-t4077477
I successfully patched the boot.img and got the new kernel and ramdisk.img file. However, I wanted to replace them now, but I get the following error when I want to modify something in the folder where the old kernel and ramdisk.img is located:
Code:
Read-only file system
I connected to android using ADB (but also tried the terminal emulator on android itself). I already tried adb remount and other mounting options, but nothing works. Android runs as root.
The folder where the ramdisk.img and boot is located: /mnt/media_rw/Android-x86_9.0-r2_(x86)/
When running
Code:
mount | grep mnt
I receive the following (which means the folder Android-x86_9.0-r2_(x86) where the ramdisk.img etc. is stored is read-only:
Code:
/dev/block/vold/public:11,0 on /mnt/media_rw/Android-x86_9.0-r2_(x86) type iso9660 (ro,dirsync,nosuid,nodev,noexec,relatime,nojoliet,utf8,check=s,map=n,blocksize=2048,uid=1023,gid=1023)
When I try to mount it to rw using:
Code:
mount -o remount,rw /dev/block/vold/public:11,0 /mnt/media_rw/Andro*
I get:
Code:
'/dev/block/vold/public:11,0' is read-only
What can I do to change the ramdisk.img and kernel so I can install magisk?
Thank you very much!

How to edit build.prop. - Read and write rights

=== Moto G Power (2020) XT2041-4-SS FIRMWARE: Android 10 "SOFIA_RETAIL_QPMS30.80-109-5" ===
1)
systemrw_1.32 (./makesysrw.sh size=50) => error code 73 (either way auto or manual)
2)
sysrw_repair_v1.32 (USB stick Ubuntu Mate 21.4) => Successfully created patched super image at /media/ubuntu-mate/Drive-C/sysrw_repair/img/super_fixed.bin
3)
"fastboot flash super super_fixed.bin" (in FASTBOOTD) => was sent 8 sparses SUPER out of 8, no errors
4)
restarted phone => OK
5)
adb shell
su
mount -o remount,rw /
mount -o remount,rw /system
mount -o remount,rw /product
mount -o remount,rw /vendor
6)
weird things started appear...
build.prop 0 Kb and copying saved earlier file build.prop to /system does not help it stays empty... I could change permissions in properties but it didn't help build.prop empty and nothing I could do... I repeated system rw remount but now I started getting bad returns like "mount: '/system' not in /proc/mounts" as I never flashed rw super image...
7)
flashed super image again in FASTBOOTD => same results: build.prop empty and nothing you can do with it
8)
flashed super image again now just in BOOTLOADER but weirdly in bootloader there were only 6 sparses SUPER out of 6 (in FASTBOOTD there were 8 sparses out of 8) => same results: build.prop empty and nothing you can do with it
9)
flashed and restored my FIRMWARE: SOFIA_RETAIL_QPMS30.80-109-5 (without erasing: boot, recovery, metadata and user data partitions) phone is fine but ROOT the same RO
-----------------------------------------
P.S. I was afraid to flash SUPER to slots A and B like:
fastboot flash super_a super_fixed.bin
fastboot flash super_b super_fixed.bin
and I didn't do it even though I remember some guy mentioned that it helped with two slots...
I didn't take a chance... I just got my phone back after being dead bricked from Motorola service... in the bricked phone i had perfect touch screen in TWRP (3.5.0_10) damn! in the phone of the same model they send me back TWRP touch screen does not work... (looks like the different drivers are set for the touch screen)
I've run into the same issue with the Self-Erasing Build.prop. Did you ever find a work-around? Maybe patching the build.prop on pc in SUPER and reflashing the Patched.Super.img would work?

Categories

Resources