[GUIDE] EROFS - Mounting/ Accessing/ Creating system.img

[ph03n!x]

Hiya folks! I'm trying to play with the firmware files for the P30 Pro, and have hit a roadblock. While I've gotten to extract the system.img (and all the other .img images) from update.app, I'm not able to mount or extract it using any of the usual tools because they are using EROFS file system.

I'm using Ubuntu 18.04 LTS, but haven't been able to spend much time on figuring out how to mount or access EROFS file systems yet. Has anyone gotten this figured out already? Any help will be great, thanks!

It started with that question, leading to finding the solution to mount the system.img, building mkfs.erofs and trying out a system.img etc.

I do not intend to work much on this, at least for quite a while owing to RL situations. In case anyone wants to build on this, please go ahead - everything I've used has a git that is linked appropriately

In case anyone's looking to mount the erofs images from the stock firmware, here's what you have to do -

• Download and extract UPDATE.APP from the firmware zip, and use splitupdate binary/ perl script or Huawei Update Extractor. (I have linked to the tools I have tried or used in the past)
• Use simg2img to convert the system.img (or product.img or vendor.img) to raw format. simg2img is a part of android fsutils
  

  sudo apt install android-tools-fsutils

• You will need a linux box or VM with Kernel 5.x running (erofs support is added from 4.20, but I am running 5.x) - mount the raw image using
  

  sudo mount -t erofs  -o loop system.ext4.img /home/test/mnt/try2

(The "-t erofs" is optional - will work just fine with sudo mount -o loop system.ext4.img /home/test/mnt/try2)

You will get the erofs image mounted in the folder you've specified, and you can browse through it

Note that erofs images are not meant to be editable. If you want to modify the system.img, extract it's content and create a new system.img using the mkfs.erofs binary (I had linked to the source code). You'll of course need an unlocked bootloader to flash (or boot) the modified image

For building mkfs.erofs, here's what you need to do (mine is a Ubuntu 19.04 machine)

git clone https://kernel.googlesource.com/pub/scm/linux/kernel/git/xiang/erofs-utils.git -b dev
./autogen.sh
./configure
make

You will have the output in the mkfs/ folder.

More details from this post -

@oslo83 I have attached the mkfs.erofs binary using this git source to the first post.

Please go through the README for this - I built this binary for the x64 architecture, and for lz4-1.9.0

The command options are -

mkfs.erofs 0.1
usage: [options] FILE DIRECTORY

Generate erofs image from DIRECTORY to FILE, and [options] are:
 -zX[,Y]  X=compressor (Y=compression level, optional)
 -d#      set output message level to # (maximum 9)

Note that the system.img that comes within UPDATE.APP is a root file system - here is a structure.

drwxr-xr-x.  2 root    root       0 Aug  7  2018 3rdmodem
drwxr-xr-x.  2 root    root       0 Aug  7  2018 3rdmodemnvm
drwxr-xr-x.  2 root    root       0 Aug  7  2018 3rdmodemnvmbkp
drwxr-xr-x.  2 root    root       0 Aug  7  2018 acct
lrw-r--r--.  1 root    root      11 Aug  7  2018 bin -> /system/bin
lrw-r--r--.  1 root    root      50 Aug  7  2018 bugreports -> /data/user_de/0/com.android.shell/files/bugreports
drwxrwx---.  2 ph03n1x    2001    0 Aug  7  2018 cache
lrw-r--r--.  1 root    root      13 Aug  7  2018 charger -> /sbin/charger
dr-xr-xr-x.  2 root    root       0 Aug  7  2018 config
drwxr-xr-x.  2 root    root       0 Aug  7  2018 cust
lrw-r--r--.  1 root    root      17 Aug  7  2018 d -> /sys/kernel/debug
drwxrwx--x.  2 ph03n1x ph03n1x    0 Aug  7  2018 data
drwxrwx--x.  2 ph03n1x ph03n1x    0 Aug  7  2018 data_old
lrw-------.  1 root    root      23 Aug  7  2018 default.prop -> system/etc/prop.default
drwxr-xr-x.  2 root    root       0 Aug  7  2018 dev
drwxr-xr-x.  2 root    root      35 Aug  7  2018 dload
drwxr-xr-x.  2 root    root       0 Aug  7  2018 eng
lrw-r--r--.  1 root    root      11 Aug  7  2018 etc -> /system/etc
-rw-r-----.  1 root       2000  423 Aug  7  2018 fstab.zram1024m
-rw-r-----.  1 root       2000  423 Aug  7  2018 fstab.zram1280m
-rw-r-----.  1 root       2000  423 Aug  7  2018 fstab.zram1536m
-rw-r-----.  1 root       2000  422 Aug  7  2018 fstab.zram2240m
-rw-r-----.  1 root       2000  422 Aug  7  2018 fstab.zram256m
-rw-r-----.  1 root       2000  422 Aug  7  2018 fstab.zram4096m
-rw-r-----.  1 root       2000  422 Aug  7  2018 fstab.zram512m
-rw-r-----.  1 root       2000  422 Aug  7  2018 fstab.zram768m
-??????????  ? ?       ?          ?            ? init
-rwxr-x---.  1 root       2000 1717 Aug  7  2018 init.environ.rc
-??????????  ? ?       ?          ?            ? init.rc
-??????????  ? ?       ?          ?            ? init.usb.configfs.rc
-??????????  ? ?       ?          ?            ? init.usb.rc
-rwxr-x---.  1 root       2000  580 Aug  7  2018 init.zygote32.rc
-rwxr-x---.  1 root       2000 1042 Aug  7  2018 init.zygote64_32.rc
lrw-r--r--.  1 root    root       8 Aug  7  2018 log -> /splash2
drwxr-xr-x.  2 root    ph03n1x    0 Aug  7  2018 mnt
drwxr-xr-x.  2 root    root       0 Aug  7  2018 modem_log
drwxr-xr-x.  2 root    root       0 Aug  7  2018 odm
drwxr-xr-x.  2 root    root       0 Aug  7  2018 oem
drwxr-xr-x.  6 root    root      71 Aug  7  2018 patch
drwxr-xr-x.  2 root    root       0 Aug  7  2018 patch_hw
drwxr-xr-x.  2 root    root       0 Aug  7  2018 preload
drwxr-xr-x.  2 root    root       0 Aug  7  2018 proc
drwxr-xr-x.  2 root    root       0 Aug  7  2018 product
drwxr-xr-x.  2 root    root      47 Aug  7  2018 res
-rw-r--r--.  1 root    root      32 Aug  7  2018 resetFactory.cfg
drwxr-xr-x.  2 root    root       0 Aug  7  2018 root
drwxr-x---.  2 root       2000  183 Aug  7  2018 sbin
lrw-r--r--.  1 root    root      21 Aug  7  2018 sdcard -> /storage/self/primary
drwxr-xr-x.  2 root    root       0 Aug  7  2018 sec_storage
drwxr-xr-x.  2 root    root       0 Aug  7  2018 splash2
drwxr-x--x.  2 root       1028    0 Aug  7  2018 storage
drwxr-xr-x.  2 root    root       0 Aug  7  2018 sys
drwxr-xr-x. 23 root    root     478 Aug  7  2018 system
-??????????  ? ?       ?          ?            ? ueventd.rc
drwxr-xr-x.  2 root       2000    0 Aug  7  2018 vendor
-rw-r--r--.  1 root    root     524 Aug  7  2018 verity_key
drwxr-xr-x.  2 root    root       0 Aug  7  2018 version

It would be good if you spend time with the system.img, vendor.img, product.img and understand how the structures are inter-linked. Happy hunting!

 

[Pretoriano80]

Hiya folks! I'm trying to play with the firmware files for the P30 Pro, and have hit a roadblock. While I've gotten to extract the system.img (and all the other .img images) from update.app, I'm not able to mount or extract it using any of the usual tools because they are using EROFS file system.

I'm using Ubuntu 18.04 LTS, but haven't been able to spend much time on figuring out how to mount or access EROFS file systems yet. Has anyone gotten this figured out already? Any help will be great, thanks!

Current tools aren't working with EROFS, we will need new ones, compatible with EROFS.

 

[ph03n!x]

Update as of today -

I have cloned erofs-utils git and have compiled mkfs for creating EROFS images. Will work on it whenever I have time to see if I can get an img to mount...

UPDATE 2 - SUCCESS!
In case anyone's looking to mount the erofs images from the stock firmware, here's what you have to do -

• Download and extract UPDATE.APP from the firmware zip, and use splitupdate binary/ perl script or Huawei Update Extractor. (I have linked to the tools I have tried or used in the past)
• Use simg2img to convert the system.img (or product.img or vendor.img) to raw format. simg2img is a part of android fsutils
  

  sudo apt install android-tools-fsutils

• You will need a linux box or VM with Kernel 5.x running (erofs support is added from 4.20, but I am running 5.x) - mount the raw image using
  

  sudo mount -t erofs  -o loop system.ext4.img /home/test/mnt/try2

(The "-t erofs" is optional - will work just fine with sudo mount -o loop system.ext4.img /home/test/mnt/try2)

You will get the erofs image mounted in the folder you've specified, and you can browse through it

Note that erofs images are not meant to be editable. If you want to modify the system.img, extract it's content and create a new system.img using the mkfs.erofs binary (I had linked to the source code). You'll of course need an unlocked bootloader to flash (or boot) the modified image

 

[Pretoriano80]

Update as of today -

I have cloned erofs-utils git and have compiled mkfs for creating EROFS images. Will work on it whenever I have time to see if I can get an img to mount...

Have a look (read) here - > https://zhuanlan.zhihu.com/p/60617375

 

[ph03n!x]

Have a look (read) here - > https://zhuanlan.zhihu.com/p/60617375

I had come across that link earlier, but that is for compiling mkfs for arm/ arm64...
Got what I needed, mission accomplished

 

[freeza]

So have you actually modified system and packaged it back up as erofs and booted it?

 

[ph03n!x]

So have you actually modified system and packaged it back up as erofs and booted it?

I do not have an unlocked bootloader yet - I have gotten as far as editing and recreating the EROFS image. One of these days I'll get the bootloader unlocked too :good:

 

[Pretoriano80]

I do not have an unlocked bootloader yet - I have gotten as far as editing and recreating the EROFS image. One of these days I'll get the bootloader unlocked too :good:

Be careful with this kind of stuff after unlocking, Huawei devices are tricky as hell. Afaik Magisk already support EroFS, so it might be better to use that.
Of course,that's if you don't want to create some kind of custom rom, based on stock.

 

[ph03n!x]

Be careful with this kind of stuff after unlocking, Huawei devices are tricky as hell. Afaik Magisk already support EroFS, so it might be better to use that.
Of course,that's if you don't want to create some kind of custom rom, based on stock.

That is why I have two active phones, plus a few more right from the legendary HD2 to fall back on... what fun is it if you don't experiment with the flashy new hardware?!

I don't know when I will make credible progress on anything at all now though - am relocating to a different country shortly - to the home of Huawei

 

[JazonX]

Hey! Congratulations and thank you for the time and effort you spent on this.
Also, It's awesome to see another LEO user! Mine died a while back, but that was the modders heaven!

I've got an unlocked device and rooted using Magisk.
Root Explorer or any other root tools available today cannot read the system partition. It shows as free space is 0 MB.
Actually, I can see the content inside /system but I cannot move anything to it - Like patching the hosts file.

Any clue on how to achieve that?

 

[Pretoriano80]

Hey! Congratulations and thank you for the time and effort you spent on this.
Also, It's awesome to see another LEO user! Mine died a while back, but that was the modders heaven!

I've got an unlocked device and rooted using Magisk.
Root Explorer or any other root tools available today cannot read the system partition. It shows as free space is 0 MB.
Actually, I can see the content inside /system but I cannot move anything to it - Like patching the hosts file.

Any clue on how to achieve that?

You can't! You must use Magisk for that.

 

[goldybewon]

You can't! You must use Magisk for that.

Hi Pretoriano,
Nice to see you on dead land. Remember those days when I was using Mate 10 Pro. Anyways let's move on and please guide us how to use magisk to push something in to system or remove / replace.
I'm rooted and looted on P30 Pro:laugh:

Thanks in advance,
goldybewon

 

[Pretoriano80]

Hi Pretoriano,
Nice to see you on dead land. Remember those days when I was using Mate 10 Pro. Anyways let's move on and please guide us how to use magisk to push something in to system or remove / replace.
I'm rooted and looted on P30 Pro:laugh:

Thanks in advance,
goldybewon

Just read Magisk documentation, it's easy to build yourself simple modules. Also you can get some examples from available modules.

 

[ph03n!x]

Actually, I can see the content inside /system but I cannot move anything to it - Like patching the hosts file.

Any clue on how to achieve that?

You can't! You must use Magisk for that.

Yes, Pretoriano80 is right - EROFS by design is not meant to be modified. While I might take sometime later on to create a modified system.img, it'll be just an academic exercise - Magisk can easily add/ replace the contents of /system during boot, making system.img mods passe :angel:

 

[ph03n!x]

@oslo83 I have attached the mkfs.erofs binary using this git source to the first post.

Please go through the README for this - I built this binary for the x64 architecture, and for lz4-1.9.0

The command options are -

mkfs.erofs 0.1
usage: [options] FILE DIRECTORY

Generate erofs image from DIRECTORY to FILE, and [options] are:
 -zX[,Y]  X=compressor (Y=compression level, optional)
 -d#      set output message level to # (maximum 9)

Note that the system.img that comes within UPDATE.APP is a root file system - here is a structure.

drwxr-xr-x.  2 root    root       0 Aug  7  2018 3rdmodem
drwxr-xr-x.  2 root    root       0 Aug  7  2018 3rdmodemnvm
drwxr-xr-x.  2 root    root       0 Aug  7  2018 3rdmodemnvmbkp
drwxr-xr-x.  2 root    root       0 Aug  7  2018 acct
lrw-r--r--.  1 root    root      11 Aug  7  2018 bin -> /system/bin
lrw-r--r--.  1 root    root      50 Aug  7  2018 bugreports -> /data/user_de/0/com.android.shell/files/bugreports
drwxrwx---.  2 ph03n1x    2001    0 Aug  7  2018 cache
lrw-r--r--.  1 root    root      13 Aug  7  2018 charger -> /sbin/charger
dr-xr-xr-x.  2 root    root       0 Aug  7  2018 config
drwxr-xr-x.  2 root    root       0 Aug  7  2018 cust
lrw-r--r--.  1 root    root      17 Aug  7  2018 d -> /sys/kernel/debug
drwxrwx--x.  2 ph03n1x ph03n1x    0 Aug  7  2018 data
drwxrwx--x.  2 ph03n1x ph03n1x    0 Aug  7  2018 data_old
lrw-------.  1 root    root      23 Aug  7  2018 default.prop -> system/etc/prop.default
drwxr-xr-x.  2 root    root       0 Aug  7  2018 dev
drwxr-xr-x.  2 root    root      35 Aug  7  2018 dload
drwxr-xr-x.  2 root    root       0 Aug  7  2018 eng
lrw-r--r--.  1 root    root      11 Aug  7  2018 etc -> /system/etc
-rw-r-----.  1 root       2000  423 Aug  7  2018 fstab.zram1024m
-rw-r-----.  1 root       2000  423 Aug  7  2018 fstab.zram1280m
-rw-r-----.  1 root       2000  423 Aug  7  2018 fstab.zram1536m
-rw-r-----.  1 root       2000  422 Aug  7  2018 fstab.zram2240m
-rw-r-----.  1 root       2000  422 Aug  7  2018 fstab.zram256m
-rw-r-----.  1 root       2000  422 Aug  7  2018 fstab.zram4096m
-rw-r-----.  1 root       2000  422 Aug  7  2018 fstab.zram512m
-rw-r-----.  1 root       2000  422 Aug  7  2018 fstab.zram768m
-??????????  ? ?       ?          ?            ? init
-rwxr-x---.  1 root       2000 1717 Aug  7  2018 init.environ.rc
-??????????  ? ?       ?          ?            ? init.rc
-??????????  ? ?       ?          ?            ? init.usb.configfs.rc
-??????????  ? ?       ?          ?            ? init.usb.rc
-rwxr-x---.  1 root       2000  580 Aug  7  2018 init.zygote32.rc
-rwxr-x---.  1 root       2000 1042 Aug  7  2018 init.zygote64_32.rc
lrw-r--r--.  1 root    root       8 Aug  7  2018 log -> /splash2
drwxr-xr-x.  2 root    ph03n1x    0 Aug  7  2018 mnt
drwxr-xr-x.  2 root    root       0 Aug  7  2018 modem_log
drwxr-xr-x.  2 root    root       0 Aug  7  2018 odm
drwxr-xr-x.  2 root    root       0 Aug  7  2018 oem
drwxr-xr-x.  6 root    root      71 Aug  7  2018 patch
drwxr-xr-x.  2 root    root       0 Aug  7  2018 patch_hw
drwxr-xr-x.  2 root    root       0 Aug  7  2018 preload
drwxr-xr-x.  2 root    root       0 Aug  7  2018 proc
drwxr-xr-x.  2 root    root       0 Aug  7  2018 product
drwxr-xr-x.  2 root    root      47 Aug  7  2018 res
-rw-r--r--.  1 root    root      32 Aug  7  2018 resetFactory.cfg
drwxr-xr-x.  2 root    root       0 Aug  7  2018 root
drwxr-x---.  2 root       2000  183 Aug  7  2018 sbin
lrw-r--r--.  1 root    root      21 Aug  7  2018 sdcard -> /storage/self/primary
drwxr-xr-x.  2 root    root       0 Aug  7  2018 sec_storage
drwxr-xr-x.  2 root    root       0 Aug  7  2018 splash2
drwxr-x--x.  2 root       1028    0 Aug  7  2018 storage
drwxr-xr-x.  2 root    root       0 Aug  7  2018 sys
drwxr-xr-x. 23 root    root     478 Aug  7  2018 system
-??????????  ? ?       ?          ?            ? ueventd.rc
drwxr-xr-x.  2 root       2000    0 Aug  7  2018 vendor
-rw-r--r--.  1 root    root     524 Aug  7  2018 verity_key
drwxr-xr-x.  2 root    root       0 Aug  7  2018 version

It would be good if you spend time with the system.img, vendor.img, product.img and understand how the structures are inter-linked. Happy hunting!

 

[dimon222]

@ph03n!x
Is it possible to compile/assemble such software piece for Windows, or its unrealistical? There's millions of examples to explore ext4 images, but 0 about erofs.
I mean, we see sources. in C... i guess it should be still possible to translate it to something portable in Python or simply compile some component on Windows

 

[ph03n!x]

@ph03n!x
Is it possible to compile/assemble such software piece for Windows, or its unrealistical? There's millions of examples to explore ext4 images, but 0 about erofs.
I mean, we see sources. in C... i guess it should be still possible to translate it to something portable in Python or simply compile some component on Windows

I will explore this when I find time.. relocating between countries at the moment. That said, please do not hold your breath - I'm more comfortable with Linux than with Windows. But I'll still give it a shot!

 

[oslo83]

https://forum.xda-developers.com/mate-20-pro/help/emui-9-1-partition-rw-t3947916/post80059824
Thanks @ante0 for his mkfs.erofs arm build.

 

[Azan Mughal]

How do you convert system.img to raw img? System partion is erofs can you tell the trick clearly? With method... Plz

 

[MishaalRahman]

Has anyone tried this with WSL v2? Curious to see if it works.