Development [RECOVERY][UNOFFICIAL] TWRP for Galaxy S22 Ultra (Exynos)

Search This thread

Adrixan

Senior Member
Feb 6, 2008
120
11
Is it possible to flash full Samsung firmware updates with this, without any need for Odin?
If so, could someone explain how?
 

marqwe

Member
Feb 21, 2011
10
11
Thank you very much for TWRP for S22 Ultra.

How unpack/pack super.emmc.win?

If I understood correctly "system" cannot be mounted at S22 Ultra as rw. "system" is part of the "super.emmc.win" backup. Is there a description of how to unpack "super.emmc.win" modify files in "system" (for example build.prop) and rebuild new super.emmc.win? Thank you very much for any information. I use linux.
 

afaneh92

Senior Member
Jul 31, 2012
3,364
4,897
Thank you very much for TWRP for S22 Ultra.

How unpack/pack super.emmc.win?

If I understood correctly "system" cannot be mounted at S22 Ultra as rw. "system" is part of the "super.emmc.win" backup. Is there a description of how to unpack "super.emmc.win" modify files in "system" (for example build.prop) and rebuild new super.emmc.win? Thank you very much for any information. I use linux.
Sorry I can't help you with that, maybe soon if I got it working.
 

marqwe

Member
Feb 21, 2011
10
11
This should help you.

Thank you for info.

"Universal Mount SystemRW / SuperRW featuring MakeRW (read/write)" doesn't seem to know f2fs. I tried "superunpack" (superrepack.arm64_pie), which also doesn't know f2fs, but it gave me information about what partitions are in super.emmc.win and at what locations. I found that the conversion of ro partition system to rw makes it significantly larger. So I first made a reorganization of partitions under TWRP (via adb):

Code:
lptools remove system
lptools remove odm
lptools remove product
lptools remove vendor

lptools create system 8178892800
lptools unmap system
lptools map system
lptools create odm 21389312
lptools unmap odm
lptools map odm
lptools create product 1081081856
lptools unmap product
lptools map product
lptools create vendor 2705326080
lptools unmap vendor
lptools map vendor

dd if=super.emmc.win of=/dev/block/dm-0 bs=1M skip=1 count=5426
dd if=super.emmc.win skip=5557248 count=20888 of=/dev/block/dm-1 bs=1K
dd if=super.emmc.win skip=5448 count=1031 of=/dev/block/dm-2 bs=1M
dd if=vendor-from_dm-3.img of=/dev/block/dm-3 bs=1M

(I made the vendor a bit smaller than the original one in super.emmc.win and didn't take it from super.emmc.win)

The system modified above works. system is still ro, but the /dev/block/dm-0 partition has 7800MB and is ready to be enlarged.

Subsequently, I took inspiration from the /system/bin/multidisabler script and created the rw partition system as follows:

Code:
cd /sdcard/sunpack
mount /system_root
truncate -s 7800M system-rw.img
toybox blkid /dev/block/dm-0 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' -o
make_f2fs -g android -O project_quota,extra_attr,inode_checksum,sb_checksum,compression,flexible_inline_xattr,verity,inode_crtime -U 26d6704a-2659-478c-805f-ec7d567357d0 -f -l system system-rw.img
mkdir -p system-rw
mount system-rw.img system-rw
cp -rp /system_root/* system-rw
umount system-rw
fsck.f2fs -f system-rw.img
dd if=system-rw.img of=/dev/block/dm-0 bs=1M

The result is a rw system (which is a bit bigger than the original ro) that I can modify. However, for unknown reasons, the boot doesn't work. Do you know what the problem might be?
 
  • Wow
Reactions: lebigmac

afaneh92

Senior Member
Jul 31, 2012
3,364
4,897
Thank you for info.

"Universal Mount SystemRW / SuperRW featuring MakeRW (read/write)" doesn't seem to know f2fs. I tried "superunpack" (superrepack.arm64_pie), which also doesn't know f2fs, but it gave me information about what partitions are in super.emmc.win and at what locations. I found that the conversion of ro partition system to rw makes it significantly larger. So I first made a reorganization of partitions under TWRP (via adb):

Code:
lptools remove system
lptools remove odm
lptools remove product
lptools remove vendor

lptools create system 8178892800
lptools unmap system
lptools map system
lptools create odm 21389312
lptools unmap odm
lptools map odm
lptools create product 1081081856
lptools unmap product
lptools map product
lptools create vendor 2705326080
lptools unmap vendor
lptools map vendor

dd if=super.emmc.win of=/dev/block/dm-0 bs=1M skip=1 count=5426
dd if=super.emmc.win skip=5557248 count=20888 of=/dev/block/dm-1 bs=1K
dd if=super.emmc.win skip=5448 count=1031 of=/dev/block/dm-2 bs=1M
dd if=vendor-from_dm-3.img of=/dev/block/dm-3 bs=1M

(I made the vendor a bit smaller than the original one in super.emmc.win and didn't take it from super.emmc.win)

The system modified above works. system is still ro, but the /dev/block/dm-0 partition has 7800MB and is ready to be enlarged.

Subsequently, I took inspiration from the /system/bin/multidisabler script and created the rw partition system as follows:

Code:
cd /sdcard/sunpack
mount /system_root
truncate -s 7800M system-rw.img
toybox blkid /dev/block/dm-0 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' -o
make_f2fs -g android -O project_quota,extra_attr,inode_checksum,sb_checksum,compression,flexible_inline_xattr,verity,inode_crtime -U 26d6704a-2659-478c-805f-ec7d567357d0 -f -l system system-rw.img
mkdir -p system-rw
mount system-rw.img system-rw
cp -rp /system_root/* system-rw
umount system-rw
fsck.f2fs -f system-rw.img
dd if=system-rw.img of=/dev/block/dm-0 bs=1M

The result is a rw system (which is a bit bigger than the original ro) that I can modify. However, for unknown reasons, the boot doesn't work. Do you know what the problem might be?
I will answer the last part, if it boot I wouldn't mind share a script. I just cant test to fix it. This will take me multiple data wipe and end up with no main phone.
 

marqwe

Member
Feb 21, 2011
10
11
This should help you.

I will re-enter my procedure. It has been completed and corrected - I omitted to specify umount /system_root and changed the size of the partitions to rounded to MB.

If someone would like to try the above, you need to check what blkid has, how big its partitions are... This is a specific procedure on my device. To find out the size of partitions I use superunpack and hex data in brackets: "extent target_data" and "extent num_sectors" - sometimes they need to be specified in MB (/(1024*1024)) or in KB (/1024).

"Universal Mount SystemRW / SuperRW featuring MakeRW (read/write)" doesn't seem to know f2fs. I tried "superunpack" (superrepack.arm64_pie), which also doesn't know f2fs, but it gave me information about what partitions are in super.emmc.win and at what locations.

I made the vendor a bit smaller than the original one in super.emmc.win and didn't take it from super.emmc.win:

Code:
cd /sdcard/sunpack
mount -o ro /vendor
truncate -s 2344M vendor-from_dm-3.img
toybox blkid /dev/block/dm-3 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' -o
make_f2fs -g android -O project_quota,extra_attr,inode_checksum,sb_checksum,compression,flexible_inline_xattr,verity,inode_crtime -U a91c0907-76eb-415e-9435-d5b6999be324 -f -l vendor vendor-from_dm-3.img
mkdir -p vendor-from_dm-3
mount vendor-from_dm-3.img vendor-from_dm-3
cp -rp /vendor/* vendor-from_dm-3
umount vendor-from_dm-3
umount /vendor
fsck.f2fs -f vendor-from_dm-3.img

I found that the conversion of ro partition system to rw makes it significantly larger. So I first made a reorganization of partitions under TWRP (via adb):

Code:
lptools remove system
lptools remove odm
lptools remove product
lptools remove vendor

lptools create system 8178892800
lptools unmap system
lptools map system
lptools create odm 22020096
lptools unmap odm
lptools map odm
lptools create product 1081081856
lptools unmap product
lptools map product
lptools create vendor 2457862144
lptools unmap vendor
lptools map vendor

dd if=super.emmc.win of=/dev/block/dm-0 bs=1M skip=1 count=5426
dd if=super.emmc.win skip=5557248 count=20888 of=/dev/block/dm-1 bs=1K
dd if=super.emmc.win skip=5448 count=1031 of=/dev/block/dm-2 bs=1M
dd if=vendor-from_dm-3.img of=/dev/block/dm-3 bs=1M

The system modified above works. system is still ro, but the /dev/block/dm-0 partition has 7799MB and is ready to be enlarged.

Subsequently, I took inspiration from the /system/bin/multidisabler script and created the rw partition system as follows:

Code:
cd /sdcard/sunpack
mount /system_root
truncate -s 7800M system-rw.img
toybox blkid /dev/block/dm-0 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' -o
make_f2fs -g android -O project_quota,extra_attr,inode_checksum,sb_checksum,compression,flexible_inline_xattr,verity,inode_crtime -U 26d6704a-2659-478c-805f-ec7d567357d0 -f -l system system-rw.img
mkdir -p system-rw
mount system-rw.img system-rw
cp -rp /system_root/* system-rw
umount system-rw
umount /system_root
fsck.f2fs -f system-rw.img
dd if=system-rw.img of=/dev/block/dm-0 bs=1M

The result is a rw system (which is a bit bigger than the original ro) that I can modify. However, for unknown reasons, the boot doesn't work. Do you know what the problem might be?
 
  • Wow
Reactions: lebigmac

tids2k

Senior Member
Apr 21, 2009
2,650
920
Sydney
Google Pixel 6 Pro
I will re-enter my procedure. It has been completed and corrected - I omitted to specify umount /system_root and changed the size of the partitions to rounded to MB.

If someone would like to try the above, you need to check what blkid has, how big its partitions are... This is a specific procedure on my device. To find out the size of partitions I use superunpack and hex data in brackets: "extent target_data" and "extent num_sectors" - sometimes they need to be specified in MB (/(1024*1024)) or in KB (/1024).

"Universal Mount SystemRW / SuperRW featuring MakeRW (read/write)" doesn't seem to know f2fs. I tried "superunpack" (superrepack.arm64_pie), which also doesn't know f2fs, but it gave me information about what partitions are in super.emmc.win and at what locations.

I made the vendor a bit smaller than the original one in super.emmc.win and didn't take it from super.emmc.win:

Code:
cd /sdcard/sunpack
mount -o ro /vendor
truncate -s 2344M vendor-from_dm-3.img
toybox blkid /dev/block/dm-3 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' -o
make_f2fs -g android -O project_quota,extra_attr,inode_checksum,sb_checksum,compression,flexible_inline_xattr,verity,inode_crtime -U a91c0907-76eb-415e-9435-d5b6999be324 -f -l vendor vendor-from_dm-3.img
mkdir -p vendor-from_dm-3
mount vendor-from_dm-3.img vendor-from_dm-3
cp -rp /vendor/* vendor-from_dm-3
umount vendor-from_dm-3
umount /vendor
fsck.f2fs -f vendor-from_dm-3.img

I found that the conversion of ro partition system to rw makes it significantly larger. So I first made a reorganization of partitions under TWRP (via adb):

Code:
lptools remove system
lptools remove odm
lptools remove product
lptools remove vendor

lptools create system 8178892800
lptools unmap system
lptools map system
lptools create odm 22020096
lptools unmap odm
lptools map odm
lptools create product 1081081856
lptools unmap product
lptools map product
lptools create vendor 2457862144
lptools unmap vendor
lptools map vendor

dd if=super.emmc.win of=/dev/block/dm-0 bs=1M skip=1 count=5426
dd if=super.emmc.win skip=5557248 count=20888 of=/dev/block/dm-1 bs=1K
dd if=super.emmc.win skip=5448 count=1031 of=/dev/block/dm-2 bs=1M
dd if=vendor-from_dm-3.img of=/dev/block/dm-3 bs=1M

The system modified above works. system is still ro, but the /dev/block/dm-0 partition has 7799MB and is ready to be enlarged.

Subsequently, I took inspiration from the /system/bin/multidisabler script and created the rw partition system as follows:

Code:
cd /sdcard/sunpack
mount /system_root
truncate -s 7800M system-rw.img
toybox blkid /dev/block/dm-0 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' -o
make_f2fs -g android -O project_quota,extra_attr,inode_checksum,sb_checksum,compression,flexible_inline_xattr,verity,inode_crtime -U 26d6704a-2659-478c-805f-ec7d567357d0 -f -l system system-rw.img
mkdir -p system-rw
mount system-rw.img system-rw
cp -rp /system_root/* system-rw
umount system-rw
umount /system_root
fsck.f2fs -f system-rw.img
dd if=system-rw.img of=/dev/block/dm-0 bs=1M

The result is a rw system (which is a bit bigger than the original ro) that I can modify. However, for unknown reasons, the boot doesn't work. Do you know what the problem might be?
Have you tried to post in the original SuperRW thread ? Does TWRP has option to change the filesystem ( repair ) to a fat based filesystem. Have you tried changing the filesystem first and then try the script ? I think f2fs support can be added to the script but I am not the original handler. reach out to @lebigmac , he might be able to help you out.
 

marqwe

Member
Feb 21, 2011
10
11
Thank you for the information.

I do everything in TWRP. The problem in desktop Linux (Debian 11 for me) was that the tools for f2fs there are evidently not compatible with images f2fs on S22 Ultra. It is also about a lot of data and copying partitions within S22 Ultra, where I have so far a lot of space is lightning (600MB/s).

"Rom Kitchen" is unfortunately only for Windows and I do not have it.

Finally I managed to create a working system image rw - I will mention it in the next post.
 

marqwe

Member
Feb 21, 2011
10
11
I was able to create a bootable rw system (from the original ro system). The problem was that the command "cp -rp /system_root/* system-rw" is insufficient and does not transfer everything needed.

For my progress from the post above, you need to change the last steps:

Code:
cd /sdcard/sunpack
mount /system_root
truncate -s 7800M system-rw-cpapa-mychcon.img
toybox blkid /dev/block/dm-0 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' -o
make_f2fs -g android -O project_quota,extra_attr,inode_checksum,sb_checksum,compression,flexible_inline_xattr,verity,inode_crtime -U 26d6704a-2659-478c-805f-ec7d567357d0 -f -l system system-rw-cpapa-mychcon.img
mkdir -p system-rw
mount system-rw-cpapa-mychcon.img system-rw
cp -a --preserve=a /system_root/* system-rw
chcon u:object_r:rootfs:s0 system-rw

I have also taken the following steps, but they do not seem to be necessary:

Code:
cd /system_root
chmod 700 /sdcard/sunpack/mychcon
find . -type d -exec /sdcard/sunpack/mychcon {} \;
cd /sdcard/sunpack

For the previous commands you need to create a script /sdcard/sunpack/mychcon, with the following content:

Code:
#!/system/bin/sh
FILE=$1
CON=`ls -adZ1 $FILE | cut -d' ' -f1`
#echo "chcon $CON '/sdcard/sunpack/system-rw/$FILE'"
#ls -adZ1 "/sdcard/sunpack/system-rw/$FILE"
chcon $CON "/sdcard/sunpack/system-rw/$FILE"

Final steps:
Code:
umount system-rw
umount /system_root
fsck.f2fs -f system-rw-cpapa-mychcon.img
dd if=system-rw-cpapa-mychcon.img of=/dev/block/dm-0 bs=1M

So far I have only successfully changed the build.prop file within Total Commander. I will see if there is any problem.
 

lebigmac

Senior Member
Jan 31, 2017
1,134
769
"Universal Mount SystemRW / SuperRW featuring MakeRW (read/write)" doesn't seem to know f2fs. I tried "superunpack" (superrepack.arm64_pie), which also doesn't know f2fs, but it gave me information about what partitions are in super.emmc.win and at what locations.
haha I know old v1.32 of my script has no idea that such a thing as f2fs even exists! :ROFLMAO:
Hopefully I can add proper f2fs support in next version of my script but without access to a next-gen Samsung device it's not very easy to debug (Xiaomi user here).
I definitely like where this is going so please everyone keep up the good work! :D(y)
Being locked to read-only mode sucks! It's time for some RW baby ;)(y)

giphy.gif
 
Last edited:
  • Like
Reactions: tids2k

starbucks2010

Senior Member
Jun 30, 2010
3,181
1,900
I was able to create a bootable rw system (from the original ro system). The problem was that the command "cp -rp /system_root/* system-rw" is insufficient and does not transfer everything needed.

For my progress from the post above, you need to change the last steps:

Code:
cd /sdcard/sunpack
mount /system_root
truncate -s 7800M system-rw-cpapa-mychcon.img
toybox blkid /dev/block/dm-0 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' -o
make_f2fs -g android -O project_quota,extra_attr,inode_checksum,sb_checksum,compression,flexible_inline_xattr,verity,inode_crtime -U 26d6704a-2659-478c-805f-ec7d567357d0 -f -l system system-rw-cpapa-mychcon.img
mkdir -p system-rw
mount system-rw-cpapa-mychcon.img system-rw
cp -a --preserve=a /system_root/* system-rw
chcon u:object_r:rootfs:s0 system-rw

I have also taken the following steps, but they do not seem to be necessary:

Code:
cd /system_root
chmod 700 /sdcard/sunpack/mychcon
find . -type d -exec /sdcard/sunpack/mychcon {} \;
cd /sdcard/sunpack

For the previous commands you need to create a script /sdcard/sunpack/mychcon, with the following content:

Code:
#!/system/bin/sh
FILE=$1
CON=`ls -adZ1 $FILE | cut -d' ' -f1`
#echo "chcon $CON '/sdcard/sunpack/system-rw/$FILE'"
#ls -adZ1 "/sdcard/sunpack/system-rw/$FILE"
chcon $CON "/sdcard/sunpack/system-rw/$FILE"

Final steps:
Code:
umount system-rw
umount /system_root
fsck.f2fs -f system-rw-cpapa-mychcon.img
dd if=system-rw-cpapa-mychcon.img of=/dev/block/dm-0 bs=1M

So far I have only successfully changed the build.prop file within Total Commander. I will see if there is any problem.
Hi,

Have you done this procedure only for system.img or for all 4 partitions (system, vendor, odm and product)?
Have you tried to boot rooted on these rw images with latest magisk?

Thanks.
 

marqwe

Member
Feb 21, 2011
10
11
Hi,

Have you done this procedure only for system.img or for all 4 partitions (system, vendor, odm and product)?
Have you tried to boot rooted on these rw images with latest magisk?

Thanks.

First I applied TWRP according to the procedure in this forum. Part of this procedure is running script "multidisabler" (2x), which converts "vendor" to rw. Part of the procedure is also application of modified kernel with selinux in "permissive" mode.

The script "multidisabler" was my main inspiration when converting "system" to rw. And I created the rw image "system" from it. Unfortunately, this image is much larger than the original ro "system" and it is not possible to apply it to the original /dev/block/dm-0. I was looking for a way to change the location and size of dm-X partitions - I was able to do that with the "lptools". I think that the rw image "system" doesn't do compressions unlike the ro image and that's why it's so big. It's quite lucky that after rearranging the partitions (inside "super") everything fits - there's not much extra space left.

Unfortunately, it turned out that with rw "system" the phone wouldn't start (boot loop). I did a little research on /proc/last_kmsg (see: https://android.stackexchange.com/questions/213722/how-to-debug-boot-loop) and concluded that the problem could be that rw "system" doesn't have everything well migrated compared to ro. Command:

Code:
cp -rp /system_root/* system-rw

is insufficient. That's why I replaced it:

Code:
cp -a --preserve=a /system_root/* system-rw

Subsequently, I found the listings:

Code:
ls -laZ /system_root
ls -laZ system-rw

that the security context data did not transfer well. Therefore, I manually applied the command to the root of the new rw "system":

Code:
chcon u:object_r:rootfs:s0 system-rw

and created the "mychcon" script with which I used "find" to correctly transfer the security context to all files.

With the resulting rw system, the phone was already starting. Later I tried to skip the "find" start with "mychcon" and even here the start took place, but I went back to the image where I used "find" because I believe it is more faithful to the original ro.

For a working boot all you need is only cp -a --preserve=a /system_root/* system-rw and chcon u:object_r:rootfs:s0 system-rw . I didn't try to see if everything would work after skipping chcon u:object_r:rootfs:s0 system-rw.

It might be a good idea to make changes to "multidisabler" when converting "vendor" to rw, but so far there doesn't seem to be any problem.

I haven't done the conversion of "odn" and "product" yet. So far I'm trying to get my bearings on a number of different partitions - for my planned modifications I'll hopefully make do with the rw "system". With the conversion of "product" to rw on the S22 Ultra there would be a problem with its magnification and it might be a problem to fit all the partitions into "super".

Already before the transfer I had a Magisk 25.2.

I'm not an expert - I'm trying to get my bearings so I can make some adjustments to the "system".
 

afaneh92

Senior Member
Jul 31, 2012
3,364
4,897
First I applied TWRP according to the procedure in this forum. Part of this procedure is running script "multidisabler" (2x), which converts "vendor" to rw. Part of the procedure is also application of modified kernel with selinux in "permissive" mode.

The script "multidisabler" was my main inspiration when converting "system" to rw. And I created the rw image "system" from it. Unfortunately, this image is much larger than the original ro "system" and it is not possible to apply it to the original /dev/block/dm-0. I was looking for a way to change the location and size of dm-X partitions - I was able to do that with the "lptools". I think that the rw image "system" doesn't do compressions unlike the ro image and that's why it's so big. It's quite lucky that after rearranging the partitions (inside "super") everything fits - there's not much extra space left.

Unfortunately, it turned out that with rw "system" the phone wouldn't start (boot loop). I did a little research on /proc/last_kmsg (see: https://android.stackexchange.com/questions/213722/how-to-debug-boot-loop) and concluded that the problem could be that rw "system" doesn't have everything well migrated compared to ro. Command:

Code:
cp -rp /system_root/* system-rw

is insufficient. That's why I replaced it:

Code:
cp -a --preserve=a /system_root/* system-rw

Subsequently, I found the listings:

Code:
ls -laZ /system_root
ls -laZ system-rw

that the security context data did not transfer well. Therefore, I manually applied the command to the root of the new rw "system":

Code:
chcon u:object_r:rootfs:s0 system-rw

and created the "mychcon" script with which I used "find" to correctly transfer the security context to all files.

With the resulting rw system, the phone was already starting. Later I tried to skip the "find" start with "mychcon" and even here the start took place, but I went back to the image where I used "find" because I believe it is more faithful to the original ro.

For a working boot all you need is only cp -a --preserve=a /system_root/* system-rw and chcon u:object_r:rootfs:s0 system-rw . I didn't try to see if everything would work after skipping chcon u:object_r:rootfs:s0 system-rw.

It might be a good idea to make changes to "multidisabler" when converting "vendor" to rw, but so far there doesn't seem to be any problem.

I haven't done the conversion of "odn" and "product" yet. So far I'm trying to get my bearings on a number of different partitions - for my planned modifications I'll hopefully make do with the rw "system". With the conversion of "product" to rw on the S22 Ultra there would be a problem with its magnification and it might be a problem to fit all the partitions into "super".

Already before the transfer I had a Magisk 25.2.

I'm not an expert - I'm trying to get my bearings so I can make some adjustments to the "system".
Thanks for your efforts, I will decrease vendor size and make an external zip to convert all to rw, I already did but not released for some reasons.
 
  • Like
Reactions: tids2k

Top Liked Posts

  • There are no posts matching your filters.
  • 5
    I was able to create a bootable rw system (from the original ro system). The problem was that the command "cp -rp /system_root/* system-rw" is insufficient and does not transfer everything needed.

    For my progress from the post above, you need to change the last steps:

    Code:
    cd /sdcard/sunpack
    mount /system_root
    truncate -s 7800M system-rw-cpapa-mychcon.img
    toybox blkid /dev/block/dm-0 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' -o
    make_f2fs -g android -O project_quota,extra_attr,inode_checksum,sb_checksum,compression,flexible_inline_xattr,verity,inode_crtime -U 26d6704a-2659-478c-805f-ec7d567357d0 -f -l system system-rw-cpapa-mychcon.img
    mkdir -p system-rw
    mount system-rw-cpapa-mychcon.img system-rw
    cp -a --preserve=a /system_root/* system-rw
    chcon u:object_r:rootfs:s0 system-rw

    I have also taken the following steps, but they do not seem to be necessary:

    Code:
    cd /system_root
    chmod 700 /sdcard/sunpack/mychcon
    find . -type d -exec /sdcard/sunpack/mychcon {} \;
    cd /sdcard/sunpack

    For the previous commands you need to create a script /sdcard/sunpack/mychcon, with the following content:

    Code:
    #!/system/bin/sh
    FILE=$1
    CON=`ls -adZ1 $FILE | cut -d' ' -f1`
    #echo "chcon $CON '/sdcard/sunpack/system-rw/$FILE'"
    #ls -adZ1 "/sdcard/sunpack/system-rw/$FILE"
    chcon $CON "/sdcard/sunpack/system-rw/$FILE"

    Final steps:
    Code:
    umount system-rw
    umount /system_root
    fsck.f2fs -f system-rw-cpapa-mychcon.img
    dd if=system-rw-cpapa-mychcon.img of=/dev/block/dm-0 bs=1M

    So far I have only successfully changed the build.prop file within Total Commander. I will see if there is any problem.
    4
    Hi,

    Have you done this procedure only for system.img or for all 4 partitions (system, vendor, odm and product)?
    Have you tried to boot rooted on these rw images with latest magisk?

    Thanks.

    First I applied TWRP according to the procedure in this forum. Part of this procedure is running script "multidisabler" (2x), which converts "vendor" to rw. Part of the procedure is also application of modified kernel with selinux in "permissive" mode.

    The script "multidisabler" was my main inspiration when converting "system" to rw. And I created the rw image "system" from it. Unfortunately, this image is much larger than the original ro "system" and it is not possible to apply it to the original /dev/block/dm-0. I was looking for a way to change the location and size of dm-X partitions - I was able to do that with the "lptools". I think that the rw image "system" doesn't do compressions unlike the ro image and that's why it's so big. It's quite lucky that after rearranging the partitions (inside "super") everything fits - there's not much extra space left.

    Unfortunately, it turned out that with rw "system" the phone wouldn't start (boot loop). I did a little research on /proc/last_kmsg (see: https://android.stackexchange.com/questions/213722/how-to-debug-boot-loop) and concluded that the problem could be that rw "system" doesn't have everything well migrated compared to ro. Command:

    Code:
    cp -rp /system_root/* system-rw

    is insufficient. That's why I replaced it:

    Code:
    cp -a --preserve=a /system_root/* system-rw

    Subsequently, I found the listings:

    Code:
    ls -laZ /system_root
    ls -laZ system-rw

    that the security context data did not transfer well. Therefore, I manually applied the command to the root of the new rw "system":

    Code:
    chcon u:object_r:rootfs:s0 system-rw

    and created the "mychcon" script with which I used "find" to correctly transfer the security context to all files.

    With the resulting rw system, the phone was already starting. Later I tried to skip the "find" start with "mychcon" and even here the start took place, but I went back to the image where I used "find" because I believe it is more faithful to the original ro.

    For a working boot all you need is only cp -a --preserve=a /system_root/* system-rw and chcon u:object_r:rootfs:s0 system-rw . I didn't try to see if everything would work after skipping chcon u:object_r:rootfs:s0 system-rw.

    It might be a good idea to make changes to "multidisabler" when converting "vendor" to rw, but so far there doesn't seem to be any problem.

    I haven't done the conversion of "odn" and "product" yet. So far I'm trying to get my bearings on a number of different partitions - for my planned modifications I'll hopefully make do with the rw "system". With the conversion of "product" to rw on the S22 Ultra there would be a problem with its magnification and it might be a problem to fit all the partitions into "super".

    Already before the transfer I had a Magisk 25.2.

    I'm not an expert - I'm trying to get my bearings so I can make some adjustments to the "system".
    2
    Thank you @afaneh92 and @marqwe
    Just made S908E system rw

    I have abandon project just beacuse of couldn't figure out issue was causing by
    Code:
    cp -rp /system_root/* system-rw

    Thanks you once again @marqwe for great sharing!

    Screenshot_20220909-231950_Settings.jpg
    1
    "Universal Mount SystemRW / SuperRW featuring MakeRW (read/write)" doesn't seem to know f2fs. I tried "superunpack" (superrepack.arm64_pie), which also doesn't know f2fs, but it gave me information about what partitions are in super.emmc.win and at what locations.
    haha I know old v1.32 of my script has no idea that such a thing as f2fs even exists! :ROFLMAO:
    Hopefully I can add proper f2fs support in next version of my script but without access to a next-gen Samsung device it's not very easy to debug (Xiaomi user here).
    I definitely like where this is going so please everyone keep up the good work! :D(y)
    Being locked to read-only mode sucks! It's time for some RW baby ;)(y)

    giphy.gif
    1
    First I applied TWRP according to the procedure in this forum. Part of this procedure is running script "multidisabler" (2x), which converts "vendor" to rw. Part of the procedure is also application of modified kernel with selinux in "permissive" mode.

    The script "multidisabler" was my main inspiration when converting "system" to rw. And I created the rw image "system" from it. Unfortunately, this image is much larger than the original ro "system" and it is not possible to apply it to the original /dev/block/dm-0. I was looking for a way to change the location and size of dm-X partitions - I was able to do that with the "lptools". I think that the rw image "system" doesn't do compressions unlike the ro image and that's why it's so big. It's quite lucky that after rearranging the partitions (inside "super") everything fits - there's not much extra space left.

    Unfortunately, it turned out that with rw "system" the phone wouldn't start (boot loop). I did a little research on /proc/last_kmsg (see: https://android.stackexchange.com/questions/213722/how-to-debug-boot-loop) and concluded that the problem could be that rw "system" doesn't have everything well migrated compared to ro. Command:

    Code:
    cp -rp /system_root/* system-rw

    is insufficient. That's why I replaced it:

    Code:
    cp -a --preserve=a /system_root/* system-rw

    Subsequently, I found the listings:

    Code:
    ls -laZ /system_root
    ls -laZ system-rw

    that the security context data did not transfer well. Therefore, I manually applied the command to the root of the new rw "system":

    Code:
    chcon u:object_r:rootfs:s0 system-rw

    and created the "mychcon" script with which I used "find" to correctly transfer the security context to all files.

    With the resulting rw system, the phone was already starting. Later I tried to skip the "find" start with "mychcon" and even here the start took place, but I went back to the image where I used "find" because I believe it is more faithful to the original ro.

    For a working boot all you need is only cp -a --preserve=a /system_root/* system-rw and chcon u:object_r:rootfs:s0 system-rw . I didn't try to see if everything would work after skipping chcon u:object_r:rootfs:s0 system-rw.

    It might be a good idea to make changes to "multidisabler" when converting "vendor" to rw, but so far there doesn't seem to be any problem.

    I haven't done the conversion of "odn" and "product" yet. So far I'm trying to get my bearings on a number of different partitions - for my planned modifications I'll hopefully make do with the rw "system". With the conversion of "product" to rw on the S22 Ultra there would be a problem with its magnification and it might be a problem to fit all the partitions into "super".

    Already before the transfer I had a Magisk 25.2.

    I'm not an expert - I'm trying to get my bearings so I can make some adjustments to the "system".
    Thanks for your efforts, I will decrease vendor size and make an external zip to convert all to rw, I already did but not released for some reasons.
  • 8
    home.png
    backupname.png

    Team Win Recovery Project 3.x, or twrp3 for short, is a custom recovery built with ease of use and customization in mind. Its a fully touch driven user interface no more volume rocker or power buttons to mash. The GUI is also fully XML driven and completely theme-able. You can change just about every aspect of the look and feel.

    Code:
     * Your warranty is now void.
    * I am not responsible for bricked devices, dead SD cards,
    * thermonuclear war, or your getting fired because the alarm app failed. Please
    * do some research if you have any concerns about features included in this ROM
    * before flashing it! YOU are choosing to make these modifications, and if
    * you point the finger at me for messing up your device, I will laugh at you.

    Supported Models:
    Galaxy S22 Ultra S908B

    Download & Guide:
    1. Unlock your bootloader.
    2. Downloads for S22 Ultra: b0s twrp and kernel
    3. Reboot to download mode
    4. Put the TWRP TAR for your device with Odin in the AP slot, vbmeta_disabled_R.tar in USERDATA slot and click start.
    5. Reboot to recovery via recovery key combo (Vol up + power + USB connected).
    6. Disable encryption:
    - Go to Advanced > Terminal, type: multidisabler.​
    If vendor complain about free space left on device, will attempt to resize vendor. and it ask to - Run multidisabler again!.​
    - Type: multidisabler again. will see - Finished. when done.​
    - Go back to Wipe > Format Data > type yes.​
    - Reboot to recovery.​
    7. Flash custom kernel and magisk apk in twrp.
    8. Reboot to system, Enjoy.

    Support:
    Live support is available via #twrp on Freenode with your IRC client or just click this link.

    Telegram group

    Bugs:
    - Encryption not fully working.

    Thanks:
    TWRP team
    @ianmacd for multidisabler
    @Dan_FFM (David Dean) for helping with convert readonly f2fs vendor to readwrite
    Donators

    Sources:
    Kernel tree
    Device tree
    5
    I was able to create a bootable rw system (from the original ro system). The problem was that the command "cp -rp /system_root/* system-rw" is insufficient and does not transfer everything needed.

    For my progress from the post above, you need to change the last steps:

    Code:
    cd /sdcard/sunpack
    mount /system_root
    truncate -s 7800M system-rw-cpapa-mychcon.img
    toybox blkid /dev/block/dm-0 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' -o
    make_f2fs -g android -O project_quota,extra_attr,inode_checksum,sb_checksum,compression,flexible_inline_xattr,verity,inode_crtime -U 26d6704a-2659-478c-805f-ec7d567357d0 -f -l system system-rw-cpapa-mychcon.img
    mkdir -p system-rw
    mount system-rw-cpapa-mychcon.img system-rw
    cp -a --preserve=a /system_root/* system-rw
    chcon u:object_r:rootfs:s0 system-rw

    I have also taken the following steps, but they do not seem to be necessary:

    Code:
    cd /system_root
    chmod 700 /sdcard/sunpack/mychcon
    find . -type d -exec /sdcard/sunpack/mychcon {} \;
    cd /sdcard/sunpack

    For the previous commands you need to create a script /sdcard/sunpack/mychcon, with the following content:

    Code:
    #!/system/bin/sh
    FILE=$1
    CON=`ls -adZ1 $FILE | cut -d' ' -f1`
    #echo "chcon $CON '/sdcard/sunpack/system-rw/$FILE'"
    #ls -adZ1 "/sdcard/sunpack/system-rw/$FILE"
    chcon $CON "/sdcard/sunpack/system-rw/$FILE"

    Final steps:
    Code:
    umount system-rw
    umount /system_root
    fsck.f2fs -f system-rw-cpapa-mychcon.img
    dd if=system-rw-cpapa-mychcon.img of=/dev/block/dm-0 bs=1M

    So far I have only successfully changed the build.prop file within Total Commander. I will see if there is any problem.
    4
    Hi,

    Have you done this procedure only for system.img or for all 4 partitions (system, vendor, odm and product)?
    Have you tried to boot rooted on these rw images with latest magisk?

    Thanks.

    First I applied TWRP according to the procedure in this forum. Part of this procedure is running script "multidisabler" (2x), which converts "vendor" to rw. Part of the procedure is also application of modified kernel with selinux in "permissive" mode.

    The script "multidisabler" was my main inspiration when converting "system" to rw. And I created the rw image "system" from it. Unfortunately, this image is much larger than the original ro "system" and it is not possible to apply it to the original /dev/block/dm-0. I was looking for a way to change the location and size of dm-X partitions - I was able to do that with the "lptools". I think that the rw image "system" doesn't do compressions unlike the ro image and that's why it's so big. It's quite lucky that after rearranging the partitions (inside "super") everything fits - there's not much extra space left.

    Unfortunately, it turned out that with rw "system" the phone wouldn't start (boot loop). I did a little research on /proc/last_kmsg (see: https://android.stackexchange.com/questions/213722/how-to-debug-boot-loop) and concluded that the problem could be that rw "system" doesn't have everything well migrated compared to ro. Command:

    Code:
    cp -rp /system_root/* system-rw

    is insufficient. That's why I replaced it:

    Code:
    cp -a --preserve=a /system_root/* system-rw

    Subsequently, I found the listings:

    Code:
    ls -laZ /system_root
    ls -laZ system-rw

    that the security context data did not transfer well. Therefore, I manually applied the command to the root of the new rw "system":

    Code:
    chcon u:object_r:rootfs:s0 system-rw

    and created the "mychcon" script with which I used "find" to correctly transfer the security context to all files.

    With the resulting rw system, the phone was already starting. Later I tried to skip the "find" start with "mychcon" and even here the start took place, but I went back to the image where I used "find" because I believe it is more faithful to the original ro.

    For a working boot all you need is only cp -a --preserve=a /system_root/* system-rw and chcon u:object_r:rootfs:s0 system-rw . I didn't try to see if everything would work after skipping chcon u:object_r:rootfs:s0 system-rw.

    It might be a good idea to make changes to "multidisabler" when converting "vendor" to rw, but so far there doesn't seem to be any problem.

    I haven't done the conversion of "odn" and "product" yet. So far I'm trying to get my bearings on a number of different partitions - for my planned modifications I'll hopefully make do with the rw "system". With the conversion of "product" to rw on the S22 Ultra there would be a problem with its magnification and it might be a problem to fit all the partitions into "super".

    Already before the transfer I had a Magisk 25.2.

    I'm not an expert - I'm trying to get my bearings so I can make some adjustments to the "system".
    2
    Thank you @afaneh92 and @marqwe
    Just made S908E system rw

    I have abandon project just beacuse of couldn't figure out issue was causing by
    Code:
    cp -rp /system_root/* system-rw

    Thanks you once again @marqwe for great sharing!

    Screenshot_20220909-231950_Settings.jpg
    1
    Any love for s22/s22+?
    Soon, join the group and provide me with some files