• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!
  • Fill out your device list and let everyone know which phones you have!    Edit Your Device Inventory

Modified boot.imgs (Nougat & Oreo)-Disable forced encryption/dm-verity (1/7/18)

Search This thread

Psychofrantics

Senior Member
Jan 2, 2013
194
147
Lahore
The boot.img itself will not give you root, it's just so encryption isn't forced-used either to decrypt the phone, or keep it decrypted when flashing new builds (the stock ones force encryption on first boot). Even after flashing new custom kernels, you will still need to flash supersu or your preferred root method afterwards. Every time you flash a new boot.img or custom kernel, you will lose root and have to re-flash supersu all over again.
I only mentioned root in the OP because I wanted folks to know that in 7.0 and higher, so far only systemless root is working with these (I could be wrong, but I think that for the most part people seem to prefer systemless anyway). I hope this helps clarify.
Maybe I need to edit the OP if it's misleading.

Sorry I will try to be as clear and precise as I can. I did following steps.
1. Flash stock images
2. fastboot format userdata
3. fastboot flash boot boot.img and fastboot flash recovery twrp.img
4. Reboot
5. Reboot into recovery
6. Flash some mods e.g. Surround sound, Pixel Launcher Zip, Ad Blocking Hosts, etc.
7. Dont flash root.
8. Reboot
9. To my surprise, no modes works. I see ads, no pixel launcher , no surround sound etc. However it is still decrypted.

Now repeat these steps but also flash supersu. All mods working now.
So my problem is that mods dont stick without root.
However on tigerstown modified boot.img and some other on that thread, , I didnt need to root for my mods to stick.
 

stmims1124

Senior Member
Sep 28, 2010
279
196
Gaithersburg, MD
OnePlus 8T
Sorry I will try to be as clear and precise as I can. I did following steps.
1. Flash stock images
2. fastboot format userdata
3. fastboot flash boot boot.img and fastboot flash recovery twrp.img
4. Reboot
5. Reboot into recovery
6. Flash some mods e.g. Surround sound, Pixel Launcher Zip, Ad Blocking Hosts, etc.
7. Dont flash root.
8. Reboot
9. To my surprise, no modes works. I see ads, no pixel launcher , no surround sound etc. However it is still decrypted.

Now repeat these steps but also flash supersu. All mods working now.
So my problem is that mods dont stick without root.
However on tigerstown modified boot.img and some other on that thread, , I didnt need to root for my mods to stick.

With the exception of the very last one he posted for the 5X, all of @Tigerstown 's boot.img's were for marshmallow builds, which worked with system root as well. He's the one that showed me how to do this, and I've just discussed this with him briefly...We both agree that's probably why you're encountering this-these builds are systemless only. He hasn't been able to get system root working with them, so I know I can't lol. I bought my 5X the week nougat was released, so I've never had it on marshmallow-I've always had to reflash SuperSU every time.
On a side note - are you going through that whole process every time there's an update? You could just extract and flash the stock system, modified boot, and stock vendor imgs, then SuperSU & mods from recovery. So you wouldn't have to go through all the trouble of re-decrypting/wiping data, reinstalling everything, etc...
 
Last edited:
  • Like
Reactions: Psychofrantics

Psychofrantics

Senior Member
Jan 2, 2013
194
147
Lahore
With the exception of the very last one he posted for the 5X, all [email protected] 's boot.img's were for marshmallow builds, which worked with system root as well. He's the one that showed me how to do this, and I've just discussed this with him briefly as well... We both agree that's probably why you're encountering this-these builds are systemless only. He hasn't been able to get system root working with them, so I know I can't lol. I bought my 5X the week nougat was released, so I've never had it on marshmallow-I've always had to reflash SuperSU every time.
On a side note - are you going through that whole process every time there's an update? You could just extract and flash the stock system, modified boot, and stock vendor imgs, then SuperSU & mods from recovery. So you wouldn't have to go through all the trouble of re-decrypting/wiping data, reinstalling everything, etc...

Thanks for replying. I absolutely admire your work and 99 out of 100 times ,I flash supersu alongside but I just wanted to let you know. I know there is no system root available for nougat yet,
But I have flashed boot.img from this post previously and I didnt have that issue. Man I just want to let you know. I know that you are doing this work for free and in your precious time
http://forum.xda-developers.com/nex...er-preview-t3483758/post69337495#post69337495
And this one too
http://forum.xda-developers.com/nexus-5x/general/4-17-16-t3360574/post68974383#post68974383
 
  • Like
Reactions: stmims1124

stmims1124

Senior Member
Sep 28, 2010
279
196
Gaithersburg, MD
OnePlus 8T
Thanks for replying. I absolutely admire your work and 99 out of 100 times ,I flash supersu alongside but I just wanted to let you know. I know there is no system root available for nougat yet,
But I have flashed boot.img from this post previously and I didnt have that issue. Man I just want to let you know. I know that you are doing this work for free and in your precious time
http://forum.xda-developers.com/nex...er-preview-t3483758/post69337495#post69337495
And this one too
http://forum.xda-developers.com/nexus-5x/general/4-17-16-t3360574/post68974383#post68974383

Thanks for the kind words, it's truly appreciated. And this is something that's super quick so it's not a problm to get a new uploaded fast. I do hope I did not come off as rude.
Perhaps there's something in the new builds that has changed and we need dig deeper into it. In the meantime, I'll upload a new one in the off chance there's something up with the file I have on Google Drive. Which build are you using, the new DP2?
Edit: I saw your signature...I'll upload a new DP2 boot.img to Drive and update the link in the OP
 
Last edited:
  • Like
Reactions: Psychofrantics

Psychofrantics

Senior Member
Jan 2, 2013
194
147
Lahore
Thanks for the kind words, it's truly appreciated. And this is something that's super quick so it's not a problm to get a new uploaded fast. I do hope I did not come off as rude.
Perhaps there's something in the new builds that has changed and we need dig deeper into it. In the meantime, I'll upload a new one in the off chance there's something up with the file I have on Google Drive. Which build are you using, the new DP2?

Thanks a lot. I am using DP2. Just a question. I dont know the technical side of it. So may be I am going to sound foolish. Does your kernel have dm-verity disabled? May be that is the cause
 
  • Like
Reactions: stmims1124

stmims1124

Senior Member
Sep 28, 2010
279
196
Gaithersburg, MD
OnePlus 8T
Thanks a lot. I am using DP2. Just a question. I dont know the technical side of it. So may be I am going to sound foolish. Does your kernel have dm-verity disabled? May be that is the cause

I'm honestly uncertain if disabling dm-verity will help, but certainly worth a shot. The ones I hae in the OP do not have dm-verity disabled. Check you private inbox, I sent you a link to a new one - forced encryption disabled and dm-verity removed. If you want to test it and see how it goes, pelase feel free to.
I'm temporarily taking the DP2 img down until I can get back in front of my computer this evening and test stuff. It's a holiday here and my family is giving me hell for ignoring them.
 

sfhub

Senior Member
Oct 23, 2008
5,342
7,219
I'm honestly uncertain if disabling dm-verity will help, but certainly worth a shot.
I didn't go back and read a lot of context into what you guys were discussing, but if the question was whether disabling dm-verity would help system-based root, it would IMO be a requirement (but not guarantee) for system-based root to work.

The reason is in Android N they added reed-solomon forward error correction to the builds (ie redundant bits for error correction, similar to how RAID works)

With dm-verity enabled, changes you make to "system" get "error-corrected" back to the original data. So if you copied root files into /system, they would physically be on disk, but the kernel would treat them as data corruptions and "error correct" them back to the stock data.

If you disable dm-verity, this error correction is also disabled.
 

stmims1124

Senior Member
Sep 28, 2010
279
196
Gaithersburg, MD
OnePlus 8T
I didn't go back and read a lot of context into what you guys were discussing, but if the question was whether disabling dm-verity would help system-based root, it would IMO be a requirement (but not guarantee) for system-based root to work.

The reason is in Android N they added reed-solomon forward error correction to the builds (ie redundant bits for error correction, similar to how RAID works)

With dm-verity enabled, changes you make to "system" get "error-corrected" back to the original data. So if you copied root files into /system, they would physically be on disk, but the kernel would treat them as data corruptions and "error correct" them back to the stock data.

If you disable dm-verity, this error correction is also disabled.

Thank you for your input....Removing dm-verity is definitely needed for system root, but it requires more that, of which I have yet to figure out and if @Tigerstown hasn't been able to pull it off then I know I can't either lol. I'm actually currently in the process up updating all of my links as we speak so that all my boot.imgs will have dm-verity disabled, not just decryptable. Most have already been updated and the additional info is now reflected in the OP. Modifying the imgs is easy, but testing is proving to be a huge pain in my ass, just because this is now the only phone I have-don't have one solely for testing, so I'm having to do full wipes to downgrade so that I can test the older ones. I'm sure everyone would just LOVE me if I uploaded a bunch of untested files, LOL! I should have the remainder of them up today though.

Side note: @sfhub , I just wanted to say I appreciate all of your work here in the 5X forums. Been meaning to tell you that for a while. You're the man!
 
Last edited:

stmims1124

Senior Member
Sep 28, 2010
279
196
Gaithersburg, MD
OnePlus 8T
My sincerest apologies, to all- I've had to take all links down temporarily for maintenance. I will have them back online as soon as possible. Thank you everyone for your patience.

Edit: LINKS BACK ONLINE, now with option for disabled forced encryption imgs & disabled forced encryption w/ dm-verity removed
 
Last edited:
  • Like
Reactions: Tigerstown

sfhub

Senior Member
Oct 23, 2008
5,342
7,219
Thank you for your input....Removing dm-verity is definitely needed for system root, but it requires more that
Yes, there is more selinux stuff and maybe some newer roadblocks in N. I think we are on the same page, was just saying you couldn't even put new files in the system directory and have them stick without dm-verity enabled.
 
  • Like
Reactions: stmims1124

jimichunga

Member
Aug 31, 2011
8
1
SF
No force encrypt works but I'm still getting corruption message after 7.1.1 fresh install. dm verify is what causes the message, right? Pls forgive me for my ignence!
 

stmims1124

Senior Member
Sep 28, 2010
279
196
Gaithersburg, MD
OnePlus 8T
No force encrypt works but I'm still getting corruption message after 7.1.1 fresh install. dm verify is what causes the message, right? Pls forgive me for my ignence!
There's no reason to apologize, if something's not working I want to help. When you say you're still getting the corruption message, you mean at boot, correct? Also, am I correct in understanding when you say "still", that you mean you had been getting that error before?
I don't believe it's the dm-verify being removed-I've never once gotten that message in the time I've owned this phone but I know it happens. If that's the case, may I suggest trying to flash the first boot.img in the first link, the one that's only disabling forced encryption and see how it goes?
I definitely test all of these (pain in the ass) and I do use them as well, but usually afterwards I end up flashing Elemental X kernel. I then just flash these boot.imgs again before trying out other kernels... I always end up going back to EX though.
 

jimichunga

Member
Aug 31, 2011
8
1
SF
There's no reason to apologize, if something's not working I want to help. When you say you're still getting the corruption message, you mean at boot, correct? Also, am I correct in understanding when you say "still", that you mean you had been getting that error before?
I don't believe it's the dm-verify being removed-I've never once gotten that message in the time I've owned this phone but I know it happens. If that's the case, may I suggest trying to flash the first boot.img in the first link, the one that's only disabling forced encryption and see how it goes?
I definitely test all of these (pain in the ass) and I do use them as well, but usually afterwards I end up flashing Elemental X kernel. I then just flash these boot.imgs again before trying out other kernels... I always end up going back to EX though.

Yes, the phone has given me the corruption message at startup since unlocking the bootloader (stock kernel).
What I meant to say is this message a result of dm verify and that disabling it (dm verify) with the 2nd modified boot image a fix for this? Or is this assumption incorrect and the only way to avoid this message through flashing a custom kernel?

Thank you for your help!
 

Top Liked Posts

  • There are no posts matching your filters.
  • 23
    *8.1 Official is here! -Updated 1/7/18*

    Thank you to @osm0sis for the Android Image Kitchen tool used to modify the boot.img's, found here. An especially huge thanks to @Tigerstown for teaching my Windows-using rookie ass, and just for supporting a device he doesn't even own for so long. It is incredibly appreciated.

    Next to each build number you'll find the first links are simply boot.imgs modified to just disable forced encryption. The second links are stock boot.imgs that have both disabled forced encryption, and dm verity has been disabled as well - take your pick. Only SYSTEMLESS ROOT is working with these boot.imgs. Tigerstown has put a lot of effort into trying to get system root working, but unfortunately it doesn't seem doable yet.

    Naturally, the regular warnings and disclaimers apply here. I cannot be held responsible if anything goes wrong, no warranties, etc. Of course should something happen, myself and the community are here to help.

    Going from using a boot.img that is just decrypted to one that also has dm-verity disabled will cause SuperSU to fail when flashing - specifically when the script gets to patching sepolicy.

    Starting with NRD90R and on, see the download links in this thread below. Any build prior you will find the modified boot.imgs for your respective builds in Tigerstowns thread here.

    Simply flash the corresponding boot.img for your build number via fastboot:
    Code:
    fastboot flash boot boot.img

    If your device is currently encrypted and you are looking to decrypt it, use the commands below. Please note that coming from an encrypted device, when you decrpyt it you WILL WIPE YOUR PHONE AND YOU LOSE YOUR DATA.
    Code:
    fastboot flash boot boot.img
    fastboot format userdata
    fastboot format cache

    LG NEXUS 5X NOUGAT & OREO MODIFIED BOOT.IMG DOWNLOADS

    Android Nougat 7.0
    NRD90R 7.0 September Security Update #1- forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link
    NRD90S 7.0 September Security Update #2- forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link
    NBD90W 7.0 October Security Update- forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link
    NDR91N 7.0 November Security Update #1- forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link
    N5D91L 7.0 November Security Update #2- forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link
    NRD91P 7.0 December Security Update- forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link

    Android Nougat 7.1.1
    NMF26F 7.1.1- forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link
    N4F26I 7.1.1 January Security Update- forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link
    N4F26O 7.1.1 February Security Update- forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link
    N4F26T 7.1.1 March Security Update- forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link

    Android Nougat 7.1.2
    N2G47F 7.1.2 April- forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link
    N2G47O 7.1.2 May- forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link
    N2G47W 7.1.2 June- forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link
    N2G47Z 7.1.2 July- forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link
    N2G48C 7.1.2 August- forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link

    Android Nougat 8.0 Oreo
    OPR6.170623.013 8.0 Aug. forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link
    OPR4.170623.006 8.0 Sept. forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link
    OPR4.170623.009 8.0 Oct. forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link
    OPR6.170623.023 8.0 Nov. forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link

    ***Android 8.1 Oreo***
    OPM1.171019.011 8.1 Dec. forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link
    OPM3.171019.013 8.1 Jan. forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link

    DEVELOPER PREVIEW DOWNLOADS FOR NOUGAT & OREO
    Android Nougat 7.1 Developer Preview
    NPF10C (DP1) forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link
    NPF26F (DP2) forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link

    Android Nougat 7.1.2 Developer Preview
    NPG05D (DP1)-forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link
    NPG47I (DP2)-forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link

    Android 8.0 Developer Preview
    OPP1.170223.012 DP1- forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link
    OPP2.170420.019 DP2- forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link
    OPP3.170518.006 DP3- forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link
    OPP4.170623.014 DP4- forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link

    Android Oreo 8.1 Developer Preview
    OPP5.170921.005 DP5 - forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link
    OPP6.171019.012 DP6 - forced encryption disabled - link / forced encryption disabled & dm-verity disabled - link
    7
    How do you disable dm-verity in the boot.img just out of interest?

    Once the boot.img file has been extracted (like with the Android Image Kitchen I have linked in the OP), It's simply editing 2 lines. Within the ramdisk folder resides the fstab.bullhead file (file system table). Lines 6 & 7 are edited so that everything after the word "wait," in both lines is deleted. It's super simple, and I can't take any credit for any of this. @Tigerstown showed me what to do, I simply just do it for any new firmware to make it easy for people who want stock kernels and want to keep decrypted and/or dm-verity disabled. See below-
    From this:
    Code:
    /dev/block/platform/soc.0/f9824900.sdhci/by-name/system       /system         ext4    ro,barrier=1,inode_readahead_blks=8                             [B]wait,verify=/dev/block/platform/soc.0/f9824900.sdhci/by-name/metadata[/B]
    /dev/block/platform/soc.0/f9824900.sdhci/by-name/vendor       /vendor         ext4    ro,barrier=1,inode_readahead_blks=8                             [B]wait,verify=/dev/block/platform/soc.0/f9824900.sdhci/by-name/metadata[/B]
    To this:
    Code:
    /dev/block/platform/soc.0/f9824900.sdhci/by-name/system       /system         ext4    ro,barrier=1,inode_readahead_blks=8                             [B]wait,[/B]
    /dev/block/platform/soc.0/f9824900.sdhci/by-name/vendor       /vendor         ext4    ro,barrier=1,inode_readahead_blks=8                             [B]wait,[/B]
    4
    If anyone needs it, I'll have the img for today's update to 7.1.1. up in just a couple of hours once I'm home from work.
    4
    OPM7.181205.001, Dec 2018

    incase someone still need this.
    p.s. currently using forceencrypt_disabled_dm-verity_disabled, I didn't test forceencrypt_disabled
    4
    OPM3.171019.016, Mar 2018