[GUIDE] EROFS - Mounting/ Accessing/ Creating system.img

Search This thread

Dispossible

Member
Dec 17, 2018
44
11
Beijing
ZTE Nubia Z17
Honor Play
@newbit
I have only one SUPER.img. It means that my tools is too old to unpack the UPDATE.APP???

Huawei's erofs has two versions. One supports no more than 4G. The other is large enough. 4*0.931=3.72
May be the super is too large so the version 1 cannot support.
you get the two super.img from emui9.1 or emui10?
 
Last edited:

newbit

Senior Member
Nov 16, 2008
208
74
I have only one SUPER.img. It means that my tools is too old to unpack the UPDATE.APP???
Maybe, why don't you just try it out and see what happens? splituapp.py
Or The Huawei Update Extractor, it tells you what files are in the UPDATE.APP, it even runs very well under Linux via wine.

Huawei's erofs has two versions. One supports no more than 4G. The other is large enough. 4*0.931=3.72
May be the super is too large so the version 1 cannot support.

Do you have any source for that claim?

you get the two super.img from emui9.1 or emui10?
I believe if the Firmware Version contains like 10. something, it also implies it is EMUI10.
So far I didn't see any super.img in Android 9 Firmware files.

If you checkout the Firmware Finder for Huawei it can tell you a lot of details regarding the Firmware files.

Cheers NewBit
 

newbit

Senior Member
Nov 16, 2008
208
74
Hi @oslo83,

Any idea how to make an arm build of lpunpack from termux ?

What a challenging task you have...

Well the source of lpunpack you can get from AOSP -> android / platform / system / extras / partition_tools

Also a build environment from ASOP -> android / platform / build / envsetup.sh

And on top a nice guide from Google on how to actually build the Blueprint Android.bp:
Follow these instructions to begin building Android.

Please let me know on how it goes.

Cheers NewBit
 
  • Like
Reactions: rubiicon59

rubiicon59

Senior Member
Mar 8, 2015
854
273
Liverpool
I've got more interested as this thread has progressed.
Am I right in thinking there may be a chance of getting root on the P30 Pro?
 

Dispossible

Member
Dec 17, 2018
44
11
Beijing
ZTE Nubia Z17
Honor Play
@newbit
I got the max size of EROFS from wiki, and the source of wiki is erofs.txt from linux kernel. You can search the EROFS from wiki. My super.img is less than 4G.

---------- Post added at 01:35 PM ---------- Previous post was at 01:23 PM ----------

I've got more interested as this thread has progressed.
Am I right in thinking there may be a chance of getting root on the P30 Pro?
1. wish that someone would sell the unlock code of Huawei (maybe, I haven't paid attention to this news recently)
2.wish that someone could crack the EMUI9 (maybe, but not now), now, EMUI8.0 8.1 8.2 can read unlock code by using some special method.
3.In my opinion, the key is not in EROFS but in unlock code. EMUI9+EROFS can be unlocked and flash all kinds of ROMs.....
 
  • Like
Reactions: rubiicon59

newbit

Senior Member
Nov 16, 2008
208
74
I got the max size of EROFS from wiki, and the source of wiki is erofs.txt from linux kernel. You can search the EROFS from wiki. My super.img is less than 4G.
Thanks for the hint. I've found it in an Android 10 Opensource Kernel
Code:
Laya_10_EMUI10.0_opensource.tar/Code_Opensource/kernel/fs/erofs/Documentation/filesystems/erofs.txt
The Wiki page you are referring to is probably from LinuxReviews.org !?
They basically copied the content of this View attachment erofs.txt file.

Regarding the size. Is it possible that you are mixing up something?
In both descriptions they write about the main features of EROFS:
  • Currently 4 KB block size (nobh) and therefore maximum 16 TB address space
  • 4KB block size. This limits the total possible capacity of a EROFS filesystem to 16 TB
  • 2 inode versions for different requirements:
    Code:
                              v1            v2
       [B]Max file size:         4 GB          16 EB (also limited by max. vol size)[/B]

This sounds to me that in v1 the maximum file size was limited to 4 GB, inside
this erofs partition, like on FAT32. But in both versions they have 4 KB block size and this limits the
maximum addressable partition size to 16 TB.

From all the Firmware files I investigated the last weeks, all of the unsparsed super.img.raw files were larger
than 5 GB. Which I wouldn't interpret as a rule.

1. wish that someone would sell the unlock code of Huawei (maybe, I haven't paid attention to this news recently)
2.wish that someone could crack the EMUI9 (maybe, but not now), now, EMUI8.0 8.1 8.2 can read unlock code by using some special method.
The only half war serious "ad" I have heard so far is from this website.
Can't give you source-able details, but I've read that in order to get access to present Huawei Bootloader Unlock codes,
one must have some insider contacts from Huawei and its database.
Update 04.06.2020
Found the source I was referring to. It links back to XDA with lots of feedback that they really got the codes back in 2018.
Translated it says:
What's behind it?

Actually, it's almost funny what strange curiosities result in the blocking of the bootloader release from Huawei. We can guess what is actually behind the method on Ministryofsolutions. We have two explanations. Option 1 is that the operator found a hack on the website to get the code. We think this is unlikely since this hack would hardly be possible with the IMEI number alone. So the more likely possibility is that the operator knows an insider at Huawei who has access to a database with the codes. This source is now used to earn a lot of money from it.

3.In my opinion, the key is not in EROFS but in unlock code. EMUI9+EROFS can be unlocked and flash all kinds of ROMs.....
I don't think this is a matter of opinion. It is a fact, no unlocked Bootloader no flashing. But once it is unlocked,
Magisk should do the trick, even without TWRP.

Cheers NewBit
 
Last edited:
  • Like
Reactions: rubiicon59

rubiicon59

Senior Member
Mar 8, 2015
854
273
Liverpool
I've read those references you linked above, and..... WOW lol. Very interesting but way above my level of understanding.
But I'm going to read some more, try and get a better grasp.
Thanks
 

mnitpro

Member
Dec 3, 2020
15
0
I'm using this tutorial to build a custom system.img erofs file system. Is there anyway to convert this .img file to .dat then to .dat.br? I'm using it for a custom EvolutionX ROM for another phone, but the steps are the same.
 

mrbox23

Senior Member
Mar 22, 2010
591
93
Colorado Springs
It's great news. In the past I only managed to sparse a super image. Now I see the missing key was lpunpack.

Any idea how to make an arm build of lpunpack from termux ?
Find lpunpack (along with all the other lp tools) here


unzip systemrw_v1.32_flashable.zip

they are in tools directory and are compiled for arm64

also find lptools binary in phh v414 images under system/bin
 
  • Like
Reactions: oslo83

mrbox23

Senior Member
Mar 22, 2010
591
93
Colorado Springs
Find lpunpack (along with all the other lp tools) here


unzip systemrw_v1.32_flashable.zip

they are in tools directory and are compiled for arm64

also find lptools binary in phh v414 images under system/bin
Here we find extract.erofs for aarch64...

 

DevilAntivirus

New member
Jan 15, 2022
2
0
@oslo83 @newbit
Hope someone can help me...
I have successfully mounted vendor.img (erofs, EMUI9.1, Android 9, not Super.img) on Ubuntu 22.04 (kernel 5.15.0):
1. simg2img vendor.img vendor.raw.img
2. mount -t erofs -o loop vendor.raw.img mnt/
But I don't know how to modify the contents of the mount directory, cp to another directory will prompt a lot of files "error reading xxx: Operation not supported"
 

newbit

Senior Member
Nov 16, 2008
208
74
@oslo83 @newbit
Hope someone can help me...
I have successfully mounted vendor.img (erofs, EMUI9.1, Android 9, not Super.img) on Ubuntu 22.04 (kernel 5.15.0):
1. simg2img vendor.img vendor.raw.img
2. mount -t erofs -o loop vendor.raw.img mnt/
But I don't know how to modify the contents of the mount directory, cp to another directory will prompt a lot of files "error reading xxx: Operation not supported"
You could try it with SuperR Kitchen.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 4
    Hiya folks! I'm trying to play with the firmware files for the P30 Pro, and have hit a roadblock. While I've gotten to extract the system.img (and all the other .img images) from update.app, I'm not able to mount or extract it using any of the usual tools because they are using EROFS file system.

    I'm using Ubuntu 18.04 LTS, but haven't been able to spend much time on figuring out how to mount or access EROFS file systems yet. Has anyone gotten this figured out already? Any help will be great, thanks!


    It started with that question, leading to finding the solution to mount the system.img, building mkfs.erofs and trying out a system.img etc.

    I do not intend to work much on this, at least for quite a while owing to RL situations. In case anyone wants to build on this, please go ahead - everything I've used has a git that is linked appropriately :)

    In case anyone's looking to mount the erofs images from the stock firmware, here's what you have to do -
    • Download and extract UPDATE.APP from the firmware zip, and use splitupdate binary/ perl script or Huawei Update Extractor. (I have linked to the tools I have tried or used in the past)
    • Use simg2img to convert the system.img (or product.img or vendor.img) to raw format. simg2img is a part of android fsutils
      Code:
      sudo apt install android-tools-fsutils
    • You will need a linux box or VM with Kernel 5.x running (erofs support is added from 4.20, but I am running 5.x) - mount the raw image using
      Code:
      sudo mount -t erofs  -o loop system.ext4.img /home/test/mnt/try2
    (The "-t erofs" is optional - will work just fine with sudo mount -o loop system.ext4.img /home/test/mnt/try2)

    You will get the erofs image mounted in the folder you've specified, and you can browse through it

    Note that erofs images are not meant to be editable. If you want to modify the system.img, extract it's content and create a new system.img using the mkfs.erofs binary (I had linked to the source code). You'll of course need an unlocked bootloader to flash (or boot) the modified image :)

    For building mkfs.erofs, here's what you need to do (mine is a Ubuntu 19.04 machine)
    Code:
    git clone https://kernel.googlesource.com/pub/scm/linux/kernel/git/xiang/erofs-utils.git -b dev
    ./autogen.sh
    ./configure
    make

    You will have the output in the mkfs/ folder.

    More details from this post -
    @oslo83 I have attached the mkfs.erofs binary using this git source to the first post.

    Please go through the README for this - I built this binary for the x64 architecture, and for lz4-1.9.0

    The command options are -
    Code:
    mkfs.erofs 0.1
    usage: [options] FILE DIRECTORY
    
    Generate erofs image from DIRECTORY to FILE, and [options] are:
     -zX[,Y]  X=compressor (Y=compression level, optional)
     -d#      set output message level to # (maximum 9)

    Note that the system.img that comes within UPDATE.APP is a root file system - here is a structure.
    Code:
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 3rdmodem
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 3rdmodemnvm
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 3rdmodemnvmbkp
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 acct
    lrw-r--r--.  1 root    root      11 Aug  7  2018 bin -> /system/bin
    lrw-r--r--.  1 root    root      50 Aug  7  2018 bugreports -> /data/user_de/0/com.android.shell/files/bugreports
    drwxrwx---.  2 ph03n1x    2001    0 Aug  7  2018 cache
    lrw-r--r--.  1 root    root      13 Aug  7  2018 charger -> /sbin/charger
    dr-xr-xr-x.  2 root    root       0 Aug  7  2018 config
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 cust
    lrw-r--r--.  1 root    root      17 Aug  7  2018 d -> /sys/kernel/debug
    drwxrwx--x.  2 ph03n1x ph03n1x    0 Aug  7  2018 data
    drwxrwx--x.  2 ph03n1x ph03n1x    0 Aug  7  2018 data_old
    lrw-------.  1 root    root      23 Aug  7  2018 default.prop -> system/etc/prop.default
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 dev
    drwxr-xr-x.  2 root    root      35 Aug  7  2018 dload
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 eng
    lrw-r--r--.  1 root    root      11 Aug  7  2018 etc -> /system/etc
    -rw-r-----.  1 root       2000  423 Aug  7  2018 fstab.zram1024m
    -rw-r-----.  1 root       2000  423 Aug  7  2018 fstab.zram1280m
    -rw-r-----.  1 root       2000  423 Aug  7  2018 fstab.zram1536m
    -rw-r-----.  1 root       2000  422 Aug  7  2018 fstab.zram2240m
    -rw-r-----.  1 root       2000  422 Aug  7  2018 fstab.zram256m
    -rw-r-----.  1 root       2000  422 Aug  7  2018 fstab.zram4096m
    -rw-r-----.  1 root       2000  422 Aug  7  2018 fstab.zram512m
    -rw-r-----.  1 root       2000  422 Aug  7  2018 fstab.zram768m
    -??????????  ? ?       ?          ?            ? init
    -rwxr-x---.  1 root       2000 1717 Aug  7  2018 init.environ.rc
    -??????????  ? ?       ?          ?            ? init.rc
    -??????????  ? ?       ?          ?            ? init.usb.configfs.rc
    -??????????  ? ?       ?          ?            ? init.usb.rc
    -rwxr-x---.  1 root       2000  580 Aug  7  2018 init.zygote32.rc
    -rwxr-x---.  1 root       2000 1042 Aug  7  2018 init.zygote64_32.rc
    lrw-r--r--.  1 root    root       8 Aug  7  2018 log -> /splash2
    drwxr-xr-x.  2 root    ph03n1x    0 Aug  7  2018 mnt
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 modem_log
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 odm
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 oem
    drwxr-xr-x.  6 root    root      71 Aug  7  2018 patch
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 patch_hw
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 preload
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 proc
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 product
    drwxr-xr-x.  2 root    root      47 Aug  7  2018 res
    -rw-r--r--.  1 root    root      32 Aug  7  2018 resetFactory.cfg
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 root
    drwxr-x---.  2 root       2000  183 Aug  7  2018 sbin
    lrw-r--r--.  1 root    root      21 Aug  7  2018 sdcard -> /storage/self/primary
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 sec_storage
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 splash2
    drwxr-x--x.  2 root       1028    0 Aug  7  2018 storage
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 sys
    drwxr-xr-x. 23 root    root     478 Aug  7  2018 system
    -??????????  ? ?       ?          ?            ? ueventd.rc
    drwxr-xr-x.  2 root       2000    0 Aug  7  2018 vendor
    -rw-r--r--.  1 root    root     524 Aug  7  2018 verity_key
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 version

    It would be good if you spend time with the system.img, vendor.img, product.img and understand how the structures are inter-linked. Happy hunting!
    4
    @oslo83 I have attached the mkfs.erofs binary using this git source to the first post.

    Please go through the README for this - I built this binary for the x64 architecture, and for lz4-1.9.0

    The command options are -
    Code:
    mkfs.erofs 0.1
    usage: [options] FILE DIRECTORY
    
    Generate erofs image from DIRECTORY to FILE, and [options] are:
     -zX[,Y]  X=compressor (Y=compression level, optional)
     -d#      set output message level to # (maximum 9)

    Note that the system.img that comes within UPDATE.APP is a root file system - here is a structure.
    Code:
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 3rdmodem
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 3rdmodemnvm
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 3rdmodemnvmbkp
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 acct
    lrw-r--r--.  1 root    root      11 Aug  7  2018 bin -> /system/bin
    lrw-r--r--.  1 root    root      50 Aug  7  2018 bugreports -> /data/user_de/0/com.android.shell/files/bugreports
    drwxrwx---.  2 ph03n1x    2001    0 Aug  7  2018 cache
    lrw-r--r--.  1 root    root      13 Aug  7  2018 charger -> /sbin/charger
    dr-xr-xr-x.  2 root    root       0 Aug  7  2018 config
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 cust
    lrw-r--r--.  1 root    root      17 Aug  7  2018 d -> /sys/kernel/debug
    drwxrwx--x.  2 ph03n1x ph03n1x    0 Aug  7  2018 data
    drwxrwx--x.  2 ph03n1x ph03n1x    0 Aug  7  2018 data_old
    lrw-------.  1 root    root      23 Aug  7  2018 default.prop -> system/etc/prop.default
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 dev
    drwxr-xr-x.  2 root    root      35 Aug  7  2018 dload
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 eng
    lrw-r--r--.  1 root    root      11 Aug  7  2018 etc -> /system/etc
    -rw-r-----.  1 root       2000  423 Aug  7  2018 fstab.zram1024m
    -rw-r-----.  1 root       2000  423 Aug  7  2018 fstab.zram1280m
    -rw-r-----.  1 root       2000  423 Aug  7  2018 fstab.zram1536m
    -rw-r-----.  1 root       2000  422 Aug  7  2018 fstab.zram2240m
    -rw-r-----.  1 root       2000  422 Aug  7  2018 fstab.zram256m
    -rw-r-----.  1 root       2000  422 Aug  7  2018 fstab.zram4096m
    -rw-r-----.  1 root       2000  422 Aug  7  2018 fstab.zram512m
    -rw-r-----.  1 root       2000  422 Aug  7  2018 fstab.zram768m
    -??????????  ? ?       ?          ?            ? init
    -rwxr-x---.  1 root       2000 1717 Aug  7  2018 init.environ.rc
    -??????????  ? ?       ?          ?            ? init.rc
    -??????????  ? ?       ?          ?            ? init.usb.configfs.rc
    -??????????  ? ?       ?          ?            ? init.usb.rc
    -rwxr-x---.  1 root       2000  580 Aug  7  2018 init.zygote32.rc
    -rwxr-x---.  1 root       2000 1042 Aug  7  2018 init.zygote64_32.rc
    lrw-r--r--.  1 root    root       8 Aug  7  2018 log -> /splash2
    drwxr-xr-x.  2 root    ph03n1x    0 Aug  7  2018 mnt
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 modem_log
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 odm
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 oem
    drwxr-xr-x.  6 root    root      71 Aug  7  2018 patch
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 patch_hw
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 preload
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 proc
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 product
    drwxr-xr-x.  2 root    root      47 Aug  7  2018 res
    -rw-r--r--.  1 root    root      32 Aug  7  2018 resetFactory.cfg
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 root
    drwxr-x---.  2 root       2000  183 Aug  7  2018 sbin
    lrw-r--r--.  1 root    root      21 Aug  7  2018 sdcard -> /storage/self/primary
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 sec_storage
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 splash2
    drwxr-x--x.  2 root       1028    0 Aug  7  2018 storage
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 sys
    drwxr-xr-x. 23 root    root     478 Aug  7  2018 system
    -??????????  ? ?       ?          ?            ? ueventd.rc
    drwxr-xr-x.  2 root       2000    0 Aug  7  2018 vendor
    -rw-r--r--.  1 root    root     524 Aug  7  2018 verity_key
    drwxr-xr-x.  2 root    root       0 Aug  7  2018 version

    It would be good if you spend time with the system.img, vendor.img, product.img and understand how the structures are inter-linked. Happy hunting!
    4
    Update as of today -

    I have cloned erofs-utils git and have compiled mkfs for creating EROFS images. Will work on it whenever I have time to see if I can get an img to mount...

    UPDATE 2 - SUCCESS!
    In case anyone's looking to mount the erofs images from the stock firmware, here's what you have to do -
    • Download and extract UPDATE.APP from the firmware zip, and use splitupdate binary/ perl script or Huawei Update Extractor. (I have linked to the tools I have tried or used in the past)
    • Use simg2img to convert the system.img (or product.img or vendor.img) to raw format. simg2img is a part of android fsutils
      Code:
      sudo apt install android-tools-fsutils
    • You will need a linux box or VM with Kernel 5.x running (erofs support is added from 4.20, but I am running 5.x) - mount the raw image using
      Code:
      sudo mount -t erofs  -o loop system.ext4.img /home/test/mnt/try2
    (The "-t erofs" is optional - will work just fine with sudo mount -o loop system.ext4.img /home/test/mnt/try2)

    You will get the erofs image mounted in the folder you've specified, and you can browse through it

    Note that erofs images are not meant to be editable. If you want to modify the system.img, extract it's content and create a new system.img using the mkfs.erofs binary (I had linked to the source code). You'll of course need an unlocked bootloader to flash (or boot) the modified image :)
    2
    So have you actually modified system and packaged it back up as erofs and booted it?

    I do not have an unlocked bootloader yet - I have gotten as far as editing and recreating the EROFS image. One of these days I'll get the bootloader unlocked too :good:
    2
    Hi Pretoriano,
    Nice to see you on dead land. Remember those days when I was using Mate 10 Pro. Anyways let's move on and please guide us how to use magisk to push something in to system or remove / replace.
    I'm rooted and looted on P30 Pro:laugh:

    Thanks in advance,
    goldybewon
    Just read Magisk documentation, it's easy to build yourself simple modules. Also you can get some examples from available modules.