What steps did you take exactly? it sounds like you didn't properly sign the OTA with AVBRoot, didn't flash the new AVB Key or didn't properly flash the new OTAI did this on my pixel 7, shouldnt be a problem ig, but can't relock my bootloader with error message "FAILED (remote: 'invalid android images, skip locking')".
Anyone have any idea why this happens, because im able to boot into the system without any problems.
Update: found the error, forgot something
I just made a new VM using ubuntu 22.04 @baraasoliman
sudo apt install openssl python3-lz4 python3-protobuf
sudo apt install adb fastboot
sudo usermod -aG plugdev $LOGNAME
reboot
mkdir AVB_dir
cd AVB_dir
openssl genrsa 4096 | openssl pkcs8 -topk8 -scrypt -out avb.key
openssl genrsa 4096 | openssl pkcs8 -topk8 -scrypt -out ota.key
git clone --recursive https://github.com/chenxiaolong/avbroot.git
python3 avbroot/external/avb/avbtool.py extract_public_key --key avb.key --output avb_pkmd.bin
openssl req -new -x509 -sha256 -key ota.key -out ota.crt -days 10000 -subj '/CN=OTA/'
python3 avbroot/avbroot.py \
patch \
--input bramble-ota_update-2023030400.zip \
--privkey-avb avb.key \
--privkey-ota ota.key \
--cert-ota ota.crt \
--magisk Magisk.apk
python3 avbroot/avbroot.py \
extract \
--input bramble-ota_update-2023030400.zip.patched \
--directory extracted
Traceback (most recent call last):
File "/home/marki/avbroot/avbroot.py", line 3, in <module>
from avbroot import main
File "/home/marki/avbroot/avbroot/main.py", line 13, in <module>
from . import boot
File "/home/marki/avbroot/avbroot/boot.py", line 14, in <module>
from .formats import compression
File "/home/marki/avbroot/avbroot/formats/compression.py", line 5, in <module>
import lz4.block
File "/usr/lib/python3/dist-packages/lz4/__init__.py", line 17, in <module>
from ._version import ( # noqa: F401
ModuleNotFoundError: No module named 'lz4._version'Have you followed the instructions on the AVBRoot page? what command are you trying to run exactly?
KEEPVERITY=true
KEEPFORCEENCRYPT=true
PATCHVBMETAFLAG=false
RECOVERYMODE=false
SHA1=3d8bc4d2a114fc9f4d554420b00f99834f5919c4
from https://github.com/chenxiaolong/avbroot:
Ah yes I see now, 25207. Thank you. I'm up and running with guide on a pixel 6a. Thank you @i_bl00dy and @FireRattus
python ... invokations with python3 .... To access host file system add VM shared folder (with auto-mount checked, empty mount point). Files in folder path are accessed with prefix /media/sf_<folder_name>/ from guest.cd ~/avbroot
python3 avbroot.py patch --input /media/sf_artem/Documents/bluejay-ota-tq1a.230105.001.a2-deb3f832.zip --privkey-avb /media/sf_artem/Documents/avb.key --privkey-ota /media/sf_artem/Documents/ota.key --cert-ota /media/sf_artem/Documents/ota.crt --magisk /media/sf_artem/Documents/Magisk-v25.2.apkifconfig and find address of form '10.0.X.X' in command output). On linux host connect from terminal using command ssh -p 2222 [email protected].
and the preinit device name for the Pixel 6 Pro, for GrapheneOS at least is metadata
This hasn't changed, it's mostly an issue that Graphene isn't going to fix
./adb wait-for-device shell magisk --remove-modules
index 7a269336e..998fad6a5 100644
--- a/native/src/core/module.cpp
+++ b/native/src/core/module.cpp
@@ -587,6 +587,7 @@ void magic_mount() {
char buf[4096];
LOGI("* Loading modules\n");
+ /*
for (const auto &m : *module_list) {
const char *module = m.name.data();
char *b = buf + sprintf(buf, "%s/" MODULEMNT "/%s/", MAGISKTMP.data(), module);
@@ -614,6 +615,7 @@ void magic_mount() {
system->collect_files(module, fd);
close(fd);
}
+ */
if (MAGISKTMP != "/sbin") {
// Need to inject our binaries into /system/bin
inject_magisk_bins(system);
diff --git a/native/src/zygisk/main.cpp b/native/src/zygisk/main.cpp
index 58200df3f..9398bf493 100644
--- a/native/src/zygisk/main.cpp
+++ b/native/src/zygisk/main.cpp
@@ -123,6 +123,7 @@ static void zygiskd(int socket) {
// Load modules
using comp_entry = void(*)(int);
vector<comp_entry> modules;
+ /*
{
vector<int> module_fds = recv_fds(socket);
for (int fd : module_fds) {
@@ -139,10 +140,11 @@ static void zygiskd(int socket) {
LOGW("Failed to dlopen zygisk module: %s\n", dlerror());
}
}
- modules.push_back(entry);
+ // modules.push_back(entry);
close(fd);
}
}
+ */
// ack
write_int(socket, 0);You could try patching the latest OTA update using AVBRoot but with the older Magisk 25.2
AVBROOT=/path/to/avbroot.py
MAGISK=/path/to/Magisk-v26.1.apk
MAGISK_PREINIT_DEVICE=persist
cd $ANDROID_BUILD_TOP
if [ ! -f keys/$TARGET_PRODUCT/releasekey.pem ] ; then openssl pkcs8 -topk8 -inform DER -in keys/$TARGET_PRODUCT/releasekey.pk8 -out keys/$TARGET_PRODUCT/releasekey.pem ; fi
python $AVBROOT patch \
--input out/release-$TARGET_PRODUCT-$BUILD_NUMBER/$TARGET_PRODUCT-ota_update-$BUILD_NUMBER.zip \
--privkey-avb keys/$TARGET_PRODUCT/avb.pem \
--privkey-ota keys/$TARGET_PRODUCT/releasekey.pem \
--cert-ota keys/$TARGET_PRODUCT/releasekey.x509.pem \
--magisk $MAGISK \
--magisk-preinit-device=$MAGISK_PREINIT_DEVICEDEVICE=cheetah
cd /path/to/android-build-top
source script/envsetup.sh
choosecombo release $DEVICE userThanks
AVBROOT=/path/to/avbroot.py
MAGISK=/path/to/Magisk-v26.1.apk
MAGISK_PREINIT_DEVICE=persist
cd $ANDROID_BUILD_TOP
if [ ! -f keys/$TARGET_PRODUCT/releasekey.pem ] ; then openssl pkcs8 -topk8 -inform DER -in keys/$TARGET_PRODUCT/releasekey.pk8 -out keys/$TARGET_PRODUCT/releasekey.pem ; fi
python $AVBROOT patch \
--input out/release-$TARGET_PRODUCT-$BUILD_NUMBER/$TARGET_PRODUCT-ota_update-$BUILD_NUMBER.zip \
--privkey-avb keys/$TARGET_PRODUCT/avb.pem \
--privkey-ota keys/$TARGET_PRODUCT/releasekey.pem \
--cert-ota keys/$TARGET_PRODUCT/releasekey.x509.pem \
--magisk $MAGISK \
--magisk-preinit-device=$MAGISK_PREINIT_DEVICEDEVICE=cheetah
cd /path/to/android-build-top
source script/envsetup.sh
choosecombo release $DEVICE userThank you, I am glad that it has been helpful for you, I have not encountered that error myself but I did use a password initially for the steps to create the keys for Graphene, I don't think this should matter thoughHey, thanks for the excellent guide, this is all about to be applicable to me
I have run into a small issue though, when generating the avb.key, openssl gives me an unsupported error
openssl rsa -outform der -in avb.pem -out avb.key
routines:ssl_store_handle_load_result:unsupported:crypto/store/store_result.c:151:
Unable to load certificate
I am wondering if since I didn't put a password on the keys if that caused an issue. I tried encrypted/decrypted, same issue. It's a fresh arch linux install, so packages are up to date.
Thanks!
I do clearly say in the first post
