• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!
Search This thread

lebigmac

Senior Member
Jan 31, 2017
929
553
Thank You @lebigmac
It's working perfectly...
All i did was...
1. I flash the zip via Orange fox and it failed
2.Open terminal and entered
su
mount -o remount,rw /
3.Install Total commander and then kaboom


Device: Surya
Custom ROM... crdroid 7.10
Hi. I'm not surprised it works perfectly on Xiaomi Poco X3 NFC. That's the device I used to develop the script ;)
What do you mean it failed but still worked? Can you please show me your Orangefox error? Was it error 255? You can find recovery log file @ /tmp/recovery.txt or /sdcard/Orangefox/log.txt. Thanks!

Failed to mount '/system-root' (invalid argument)
Failed to mount '/vendor' (invalid argument)
Failed to mount '/product' (invalid argument)
If you see these errors after successfully running script that's completely normal. Those are TWRP related errors and I can't do anything about that!

Are you sure your Custom ROM... crdroid 7.10 cannot mount your partitions as R/W by default without running my script? Custom ROM's should be able to do that straight out of the box. If your custom ROM cannot mount your partitions as R/W then it's missing some important features. Just my 2 ¢
 
Last edited:

lebigmac

Senior Member
Jan 31, 2017
929
553
i have amlogic s905x2 android tv box which has 8gb storage, 2gb RAM running android 10. that device currently only using stock recovery. can i run this flashable zip file from fastboot mode? i'm sure the device storage is not enough space for the result bin files. can i put in & out folder to external storage?
yes, now i success unlock the bootloader after reflashing many times.. now the problem is i cannot write to system or vendor partition. i also success root with magisk and can run su on the console.
i cannot imagine how the script can be run on the device which has low nand storage.
Hi.
Does your tv box even have got super partition? You can check like this
adb shell "ls -l /dev/block/by-name/super"

Try run expert example in Android mode and add some free space using the size= parameter. The special in= value used here will skip the dumping of super partition process to save some space on your device. Additionally you can export super_fixed.bin to external sdcard using the out= parameter. If size=15 don't work try smaller size. Good luck! (y)
Bash:
adb shell
su
cd /data/local/tmp/systemrw_1.32
chmod +x ./systemrw.sh

# EXPERT EXAMPLE:
./systemrw.sh in=`ls -l /dev/block/by-name/super | awk '{print $NF}'` out=/PATH_TO_EXTERNAL_SDCARD/super_fixed.bin size=15
 
Last edited:

yasfatft

New member
Oct 8, 2021
2
0
This method does not work for me on a Redmi 9A!

I believe the source of failure is that we can't remount /system partition to rw;
Strangely after rooting the device and even going to recovery mode and set the configs as they shoud be (like unchecking boot system partition read-only), it does not work!
But I can remount / parttiton to be rw but not /system, even when I execute
```
mount -o rw,remount,rw /system
```
the command runs successfully (without any errors) but the partition type won't' change (I use mount | grep system to check)
 

lebigmac

Senior Member
Jan 31, 2017
929
553
Hi @yasfatft. Thanks for your interest in this project.
Please send me your log files from this folder. Thanks.
/data/local/tmp/systemrw_1.32/log/

What happens if you do this inside Android after successfully running script?
Please show some screenshots of your errors. Thanks!
Good luck!

1-jpg.5235933
 

yasfatft

New member
Oct 8, 2021
2
0
Hi @yasfatft. Thanks for your interest in this project.
Please send me your log files from this folder. Thanks.
/data/local/tmp/systemrw_1.32/log/

What happens if you do this inside Android after successfully running script?
Please show some screenshots of your errors. Thanks!
Good luck!

1-jpg.5235933
Hi, I have to correct myself, after some more tries, I was able to run the script, but manually (as you have documented).
The script runs correctly but yet /system partition is ro, even when I remount it to rw, not a single error will be returned, but /system is still ro! :| I'll attach the logs...
 

Attachments

  • lpdump.txt
    1.4 KB · Views: 5
  • mylog.txt
    3.2 KB · Views: 9
  • Capture.PNG
    Capture.PNG
    122.9 KB · Views: 30
  • Wow
Reactions: lebigmac

oneironaut2002

New member
Jan 28, 2021
3
1
I have test this script on Mi 10i ( gauguin ). Tested on 2 roms.

1. MIUI 12.5 Global with terminal/fastboot method.

2. Project Sakura with recovery flash method.

It's worked both the times 😁.I have attached both logs. Thanks for your awesome script.
 

Attachments

  • mylog_miui.txt
    6.9 KB · Views: 9
  • mylog_sakura.txt
    6.2 KB · Views: 8
  • Love
Reactions: lebigmac

Miustone

Senior Member
Jul 23, 2012
3,039
5,807
28
Marburg an der Lahn
sites.google.com
Sony Xperia 5
Just found this Project randomly on the Xperia 1 III Forums. Awesome... Just awesome! I will test it on the Xperia Stock Firmwares with My Fams. I will report back. 2019 Xperias dont seem to have a Super Partition. Think 2020+ Xperia have it... Please, Please, Please keep that Project up! It's highly needed for all People who don't have Recoveries available like Xperia Users and for everyone who doesn't cares about these Pseudo Security Mechanisms <3
 
  • Like
Reactions: lebigmac

HyperCriSiS

Senior Member
Nov 23, 2010
390
80
Samsung Galaxy S7
ASUS ZenFone 8
Hi,

when I flash this on Asus Zenfone 8, TWRP restarts.
This is in the logs then:

E:failed to mount /tmp/com.android.apex.cts.shim.apex to loop device /dev/block/loop0. Reason: Device or resource busy
E:Unable to create loop devices to mount apex files
E:Unable to load apex images from /system_root/system/apex

What can I do to fix this?

Thanks,
Hyper
 

Miustone

Senior Member
Jul 23, 2012
3,039
5,807
28
Marburg an der Lahn
sites.google.com
Sony Xperia 5
First Log i got with latest Stock on Xperia 5:
systemrw: Initiating procedure...

systemrw: Device is in Android mode. Ignoring
systemrw: Current device: Sony
systemrw: Current Android version: 11
systemrw: Current SELinux status: Permissive
systemrw: Unable to locate super partition on device. Ignoring
systemrw: /system is already R/W capable. Ignoring
systemrw: /product is already R/W capable. Ignoring
systemrw: /vendor is already R/W capable. Ignoring
systemrw: Adjusting permissions...
systemrw: Attempting to disable dm-verity and verification...
verification is already disabled on slot with suffix _a.
verity is already disabled on slot with suffix _a.
systemrw: Partition detected -> system_a @ /dev/block/sda44
systemrw: NO 'shared_blocks feature' detected @ system_a. Ignoring
systemrw: Partition detected -> system_b @ /dev/block/sda54
systemrw: NO 'shared_blocks feature' detected @ system_b. Ignoring
systemrw: Partition detected -> vendor_a @ /dev/block/sda43
systemrw: NO 'shared_blocks feature' detected @ vendor_a. Ignoring
systemrw: Partition detected -> vendor_b @ /dev/block/sda53
systemrw: NO 'shared_blocks feature' detected @ vendor_b. Ignoring
systemrw: There was a problem removing read-only restriction(s) of your device. Abort
 
  • Like
Reactions: lebigmac

NewDwarf

Member
Oct 14, 2021
8
1
I am sure that the script won't work with the Pixel 4a but it is in the confirmed list. The guy who shared the log ran the script on the 'user-debug' build!
Take a look at the line:
systemrw: Current device: Google AOSP on sunfish
Normal 'release' build should print just 'Google':
systemrw: Current device: Google
So, please, fix the supported device list in the initial post. The 'user-debug' build can easily be mounted as RW by just using regular 'adb' tool.

BTW, the same problem on running the script on the Pixel 3. Below is the log:
systemrw: Initiating procedure...

systemrw: Device is in Android mode. Ignoring
systemrw: Current device: Google
systemrw: Current Android version: 11
systemrw: Current SELinux status: Permissive
systemrw: Unable to locate super partition on device. Ignoring
systemrw: /system is already R/W capable. Ignoring
systemrw: /product is read-only
systemrw: /vendor is read-only
systemrw: Adjusting permissions...
systemrw: Attempting to disable dm-verity and verification...
Successfully disabled verification on slot with suffix _a. Reboot the device for changes to take effect.
Successfully disabled verity on slot with suffix _a. Reboot the device for changes to take effect.
systemrw: Partition detected -> product_a @ /dev/block/sda7
tune2fs: Bad magic number in super-block while trying to open /dev/block/sda7
systemrw: NO 'shared_blocks feature' detected @ product_a. Ignoring
systemrw: Partition detected -> product_b @ /dev/block/sda8
systemrw: NO 'shared_blocks feature' detected @ product_b. Ignoring
systemrw: Partition detected -> system_a @ /dev/block/sda5
tune2fs: Bad magic number in super-block while trying to open /dev/block/sda5
systemrw: NO 'shared_blocks feature' detected @ system_a. Ignoring
systemrw: Partition detected -> system_b @ /dev/block/sda6
tune2fs: Bad magic number in super-block while trying to open /dev/block/sda6
systemrw: NO 'shared_blocks feature' detected @ system_b. Ignoring
systemrw: Partition detected -> vendor_a @ /dev/block/sda9
tune2fs: Bad magic number in super-block while trying to open /dev/block/sda9
systemrw: NO 'shared_blocks feature' detected @ vendor_a. Ignoring
systemrw: Partition detected -> vendor_b @ /dev/block/sda10
systemrw: NO 'shared_blocks feature' detected @ vendor_b. Ignoring
systemrw: There was a problem removing read-only restriction(s) of your device. Abort
The script makes a wrong decision that "/system is already R/W capable". It is not true! On running the script it is in the RO mode.

Could someone explain what the script have to do to make "RW" mounting possible?
The 'avbctl' tool modifies the vbmeta.img in-place to disable dm-verity. But it turns out it is not enough.
What is the purpose of further running of the 'tune2fs' tool to make partitions as "RW"?
 

DeviLL2014

Senior Member
Oct 3, 2014
57
6
Everything is done, but the system is still in RO
Code:
E:\RealmeC3\platform-tools>adb shell
* daemon not running; starting now at tcp:5037
* daemon started successfully
RMX2020:/ $ su
RMX2020:/ # cd /data/local/tmp/systemrw_1.32
RMX2020:/data/local/tmp/systemrw_1.32 # chmod +x ./systemrw.sh
RMX2020:/data/local/tmp/systemrw_1.32 #
ev/block/by-name/super | awk '{print $NF}'` out=./img/super_fixed.bin size=50 <
 --------------------------------------------------
|    SystemRW v1.32 automated script by lebigmac   |
|  @xda c2021 Big thank you to @Kolibass @Brepro1  |
|@munjeni @AndyYan @gabrielfrias @YOisuPU @bynarie |
|   without your help this would not be possible!  |
 --------------------------------------------------

systemrw: Custom input detected: /dev/block/mmcblk0p43
systemrw: Custom output detected: ./img/super_fixed.bin
systemrw: Custom size detected: 50 MB
systemrw: Initiating procedure...

systemrw: Device is in Android mode. Ignoring
systemrw: Current device: realme
systemrw: Current Android version: 11
setenforce: Couldn't set enforcing status to '0': Invalid argument
systemrw: Current SELinux status: Enforcing
systemrw: Current slot is: 0
systemrw: Your super partition is located at: /dev/block/mmcblk0p43
systemrw: / is read-only
systemrw: /product is read-only
systemrw: /vendor is read-only
systemrw: Adjusting permissions...
systemrw: Attempting to disable dm-verity and verification...
verification is already disabled.
verity is already disabled.
systemrw: Unpacking embedded partitions from /dev/block/mmcblk0p43
systemrw: Nested partitions were successfully extracted from super

systemrw: Current size of vendor.img in bytes: 692318208
systemrw: Current size of vendor.img in MB: 660
systemrw: Current size of vendor.img in 512-byte sectors: 1352184

systemrw: 'shared_blocks feature' detected @ vendor.img

systemrw: Increasing filesystem size of vendor.img...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/vendor.img to 21127
8 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/vendor.img is now 211278 (4k
) blocks long.

systemrw: Removing 'shared_blocks feature' of vendor.img...
e2fsck 1.45.4 (23-Sep-2019)
systemrw: Read-only lock of vendor.img successfully removed

systemrw: Shrinking size of vendor.img back to minimum size...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/vendor.img to 17890
0 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/vendor.img is now 178900 (4k
) blocks long.

systemrw: Custom size of vendor.img in bytes: 785203200
systemrw: Custom size of vendor.img in MB: 748
systemrw: Custom size of vendor.img in 512-byte sectors: 1533600

systemrw: Increasing filesystem size of vendor.img...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/vendor.img to 19170
0 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/vendor.img is now 191700 (4k
) blocks long.

=================================================

systemrw: Current size of system.img in bytes: 2260987904
systemrw: Current size of system.img in MB: 2156
systemrw: Current size of system.img in 512-byte sectors: 4415992

systemrw: 'shared_blocks feature' detected @ system.img

systemrw: Increasing filesystem size of system.img...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/system.img to 68999
8 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/system.img is now 689998 (4k
) blocks long.

systemrw: Removing 'shared_blocks feature' of system.img...
e2fsck 1.45.4 (23-Sep-2019)
systemrw: Read-only lock of system.img successfully removed

systemrw: Shrinking size of system.img back to minimum size...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/system.img to 56605
8 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/system.img is now 566058 (4k
) blocks long.

systemrw: Custom size of system.img in bytes: 2371002368
systemrw: Custom size of system.img in MB: 2261
systemrw: Custom size of system.img in 512-byte sectors: 4630864

systemrw: Increasing filesystem size of system.img...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/system.img to 57885
8 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/system.img is now 578858 (4k
) blocks long.

=================================================

systemrw: Current size of product.img in bytes: 2117632
systemrw: Current size of product.img in MB: 2
systemrw: Current size of product.img in 512-byte sectors: 4136

systemrw: 'shared_blocks feature' detected @ product.img

systemrw: Increasing filesystem size of product.img...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/product.img to 646
(4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/product.img is now 646 (4k)
blocks long.

systemrw: Removing 'shared_blocks feature' of product.img...
e2fsck 1.45.4 (23-Sep-2019)
systemrw: Read-only lock of product.img successfully removed

systemrw: Shrinking size of product.img back to minimum size...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/product.img to 496
(4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/product.img is now 496 (4k)
blocks long.

systemrw: Custom size of product.img in bytes: 54460416
systemrw: Custom size of product.img in MB: 51
systemrw: Custom size of product.img in 512-byte sectors: 106368

systemrw: Increasing filesystem size of product.img...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/product.img to 1329
6 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/product.img is now 13296 (4k
) blocks long.

=================================================

systemrw: Current size of my_product.img in bytes: 42147840
systemrw: Current size of my_product.img in MB: 40
systemrw: Current size of my_product.img in 512-byte sectors: 82320

systemrw: 'shared_blocks feature' detected @ my_product.img

systemrw: Increasing filesystem size of my_product.img...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/my_product.img to 1
2862 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/my_product.img is now 12862
(4k) blocks long.

systemrw: Removing 'shared_blocks feature' of my_product.img...
e2fsck 1.45.4 (23-Sep-2019)
systemrw: Read-only lock of my_product.img successfully removed

systemrw: Shrinking size of my_product.img back to minimum size...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/my_product.img to 1
0367 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/my_product.img is now 10367
(4k) blocks long.

systemrw: Custom size of my_product.img in bytes: 94892032
systemrw: Custom size of my_product.img in MB: 90
systemrw: Custom size of my_product.img in 512-byte sectors: 185336

systemrw: Increasing filesystem size of my_product.img...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/my_product.img to 2
3167 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/my_product.img is now 23167
(4k) blocks long.

=================================================

systemrw: Joining all extracted images back into one single super image...
systemrw: Please wait and ignore the invalid sparse warnings...

Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic

systemrw: Successfully created patched super image @
systemrw: /data/local/tmp/systemrw_1.32/img/super_fixed.bin

systemrw: Congratulations! Your image(s) should now have R/W capability
systemrw: Please reboot into bootloader and flash the file(s) manually

RMX2020:/data/local/tmp/systemrw_1.32 #
 
  • Like
Reactions: lebigmac

MinhDat_Vo

Member
Dec 15, 2015
11
5
Ho Chi Minh
Google Pixel 4
The automatic installation method (systemrw_1.32_flashable.zip) is worked for me. Thank you 3000!

Google Pixel 4 XL (coral) with Android 10

These are my logs and my screenshot....
 

Attachments

  • mylog.txt
    8 KB · Views: 6
  • 1634226331530.png
    1634226331530.png
    321.8 KB · Views: 16
  • lpdump.txt
    1.9 KB · Views: 4
  • Love
Reactions: lebigmac

NewDwarf

Member
Oct 14, 2021
8
1
Everything is done, but the system is still in RO
Code:
E:\RealmeC3\platform-tools>adb shell
* daemon not running; starting now at tcp:5037
* daemon started successfully
RMX2020:/ $ su
RMX2020:/ # cd /data/local/tmp/systemrw_1.32
RMX2020:/data/local/tmp/systemrw_1.32 # chmod +x ./systemrw.sh
RMX2020:/data/local/tmp/systemrw_1.32 #
ev/block/by-name/super | awk '{print $NF}'` out=./img/super_fixed.bin size=50 <
--------------------------------------------------
|    SystemRW v1.32 automated script by lebigmac   |
|  @xda c2021 Big thank you to @Kolibass @Brepro1  |
|@munjeni @AndyYan @gabrielfrias @YOisuPU @bynarie |
|   without your help this would not be possible!  |
--------------------------------------------------

systemrw: Custom input detected: /dev/block/mmcblk0p43
systemrw: Custom output detected: ./img/super_fixed.bin
systemrw: Custom size detected: 50 MB
systemrw: Initiating procedure...

systemrw: Device is in Android mode. Ignoring
systemrw: Current device: realme
systemrw: Current Android version: 11
setenforce: Couldn't set enforcing status to '0': Invalid argument
systemrw: Current SELinux status: Enforcing
systemrw: Current slot is: 0
systemrw: Your super partition is located at: /dev/block/mmcblk0p43
systemrw: / is read-only
systemrw: /product is read-only
systemrw: /vendor is read-only
systemrw: Adjusting permissions...
systemrw: Attempting to disable dm-verity and verification...
verification is already disabled.
verity is already disabled.
systemrw: Unpacking embedded partitions from /dev/block/mmcblk0p43
systemrw: Nested partitions were successfully extracted from super

systemrw: Current size of vendor.img in bytes: 692318208
systemrw: Current size of vendor.img in MB: 660
systemrw: Current size of vendor.img in 512-byte sectors: 1352184

systemrw: 'shared_blocks feature' detected @ vendor.img

systemrw: Increasing filesystem size of vendor.img...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/vendor.img to 21127
8 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/vendor.img is now 211278 (4k
) blocks long.

systemrw: Removing 'shared_blocks feature' of vendor.img...
e2fsck 1.45.4 (23-Sep-2019)
systemrw: Read-only lock of vendor.img successfully removed

systemrw: Shrinking size of vendor.img back to minimum size...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/vendor.img to 17890
0 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/vendor.img is now 178900 (4k
) blocks long.

systemrw: Custom size of vendor.img in bytes: 785203200
systemrw: Custom size of vendor.img in MB: 748
systemrw: Custom size of vendor.img in 512-byte sectors: 1533600

systemrw: Increasing filesystem size of vendor.img...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/vendor.img to 19170
0 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/vendor.img is now 191700 (4k
) blocks long.

=================================================

systemrw: Current size of system.img in bytes: 2260987904
systemrw: Current size of system.img in MB: 2156
systemrw: Current size of system.img in 512-byte sectors: 4415992

systemrw: 'shared_blocks feature' detected @ system.img

systemrw: Increasing filesystem size of system.img...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/system.img to 68999
8 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/system.img is now 689998 (4k
) blocks long.

systemrw: Removing 'shared_blocks feature' of system.img...
e2fsck 1.45.4 (23-Sep-2019)
systemrw: Read-only lock of system.img successfully removed

systemrw: Shrinking size of system.img back to minimum size...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/system.img to 56605
8 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/system.img is now 566058 (4k
) blocks long.

systemrw: Custom size of system.img in bytes: 2371002368
systemrw: Custom size of system.img in MB: 2261
systemrw: Custom size of system.img in 512-byte sectors: 4630864

systemrw: Increasing filesystem size of system.img...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/system.img to 57885
8 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/system.img is now 578858 (4k
) blocks long.

=================================================

systemrw: Current size of product.img in bytes: 2117632
systemrw: Current size of product.img in MB: 2
systemrw: Current size of product.img in 512-byte sectors: 4136

systemrw: 'shared_blocks feature' detected @ product.img

systemrw: Increasing filesystem size of product.img...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/product.img to 646
(4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/product.img is now 646 (4k)
blocks long.

systemrw: Removing 'shared_blocks feature' of product.img...
e2fsck 1.45.4 (23-Sep-2019)
systemrw: Read-only lock of product.img successfully removed

systemrw: Shrinking size of product.img back to minimum size...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/product.img to 496
(4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/product.img is now 496 (4k)
blocks long.

systemrw: Custom size of product.img in bytes: 54460416
systemrw: Custom size of product.img in MB: 51
systemrw: Custom size of product.img in 512-byte sectors: 106368

systemrw: Increasing filesystem size of product.img...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/product.img to 1329
6 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/product.img is now 13296 (4k
) blocks long.

=================================================

systemrw: Current size of my_product.img in bytes: 42147840
systemrw: Current size of my_product.img in MB: 40
systemrw: Current size of my_product.img in 512-byte sectors: 82320

systemrw: 'shared_blocks feature' detected @ my_product.img

systemrw: Increasing filesystem size of my_product.img...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/my_product.img to 1
2862 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/my_product.img is now 12862
(4k) blocks long.

systemrw: Removing 'shared_blocks feature' of my_product.img...
e2fsck 1.45.4 (23-Sep-2019)
systemrw: Read-only lock of my_product.img successfully removed

systemrw: Shrinking size of my_product.img back to minimum size...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/my_product.img to 1
0367 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/my_product.img is now 10367
(4k) blocks long.

systemrw: Custom size of my_product.img in bytes: 94892032
systemrw: Custom size of my_product.img in MB: 90
systemrw: Custom size of my_product.img in 512-byte sectors: 185336

systemrw: Increasing filesystem size of my_product.img...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/my_product.img to 2
3167 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/my_product.img is now 23167
(4k) blocks long.

=================================================

systemrw: Joining all extracted images back into one single super image...
systemrw: Please wait and ignore the invalid sparse warnings...

Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic

systemrw: Successfully created patched super image @
systemrw: /data/local/tmp/systemrw_1.32/img/super_fixed.bin

systemrw: Congratulations! Your image(s) should now have R/W capability
systemrw: Please reboot into bootloader and flash the file(s) manually

RMX2020:/data/local/tmp/systemrw_1.32 #
Did you try to remount as "rw" after loading the patched images?
For example, try to remount the /vendor by:
mount -o rw,remount /vendor
 
  • Like
Reactions: lebigmac

NewDwarf

Member
Oct 14, 2021
8
1
yes , writes is read-only
I believe that is not it. There is a dm-verity specific part in the android kernel which should be patched.

What exactly device you are trying to patch? Do you have access to the kernel sources?

There is a file drivers/md/dm-android-verity.c which has a function:
C:
static int verify_header(struct android_metadata_header *header)
{
        int retval = -EINVAL;

        if (is_userdebug() && le32_to_cpu(header->magic_number) ==
                        VERITY_METADATA_MAGIC_DISABLE)
                return VERITY_STATE_DISABLE;

        if (!(le32_to_cpu(header->magic_number) ==
                        VERITY_METADATA_MAGIC_NUMBER) ||
                        (le32_to_cpu(header->magic_number) ==
                        VERITY_METADATA_MAGIC_DISABLE)) {
                DMERR("Incorrect magic number");
                return retval;
        }

        if (le32_to_cpu(header->protocol_version) !=
                        VERITY_METADATA_VERSION) {
                DMERR("Unsupported version %u",
                        le32_to_cpu(header->protocol_version));
                return retval;
        }

        return 0;
}

Take a look at the above function. If we use the "userdebug" build, we can easily disable the dm-verity by the 'avbctl' tool or by the "adb" tool. The code explains why it is possible. If we try to patch this function, by immediately returning of VERITY_STATE_DISABLE, we, possibly, bypass the dm-verity protection and will be able to mount as RW.
 
  • Wow
Reactions: lebigmac

lebigmac

Senior Member
Jan 31, 2017
929
553
The automatic installation method (systemrw_1.32_flashable.zip) is worked for me. Thank you 3000!

Google Pixel 4 XL (coral) with Android 10

These are my logs and my screenshot....
Hi @MinhDat_Vo thanks for your log files and screenshot.
If you get insufficient space error when trying to copy file to /system you must run script again with larger custom size parameter! This should be fixed in next version with auto-resize feature.
Enjoy fully read/write-able system! :love:(y)



Everything is done, but the system is still in RO
Code:
E:\RealmeC3\platform-tools>adb shell
* daemon not running; starting now at tcp:5037
* daemon started successfully
RMX2020:/ $ su
RMX2020:/ # cd /data/local/tmp/systemrw_1.32
RMX2020:/data/local/tmp/systemrw_1.32 # chmod +x ./systemrw.sh
RMX2020:/data/local/tmp/systemrw_1.32 #
ev/block/by-name/super | awk '{print $NF}'` out=./img/super_fixed.bin size=50 <
--------------------------------------------------
|    SystemRW v1.32 automated script by lebigmac   |
|  @xda c2021 Big thank you to @Kolibass @Brepro1  |
|@munjeni @AndyYan @gabrielfrias @YOisuPU @bynarie |
|   without your help this would not be possible!  |
--------------------------------------------------

systemrw: Custom input detected: /dev/block/mmcblk0p43
systemrw: Custom output detected: ./img/super_fixed.bin
systemrw: Custom size detected: 50 MB
systemrw: Initiating procedure...

systemrw: Device is in Android mode. Ignoring
systemrw: Current device: realme
systemrw: Current Android version: 11
setenforce: Couldn't set enforcing status to '0': Invalid argument
systemrw: Current SELinux status: Enforcing
systemrw: Current slot is: 0
systemrw: Your super partition is located at: /dev/block/mmcblk0p43
systemrw: / is read-only
systemrw: /product is read-only
systemrw: /vendor is read-only
systemrw: Adjusting permissions...
systemrw: Attempting to disable dm-verity and verification...
verification is already disabled.
verity is already disabled.
systemrw: Unpacking embedded partitions from /dev/block/mmcblk0p43
systemrw: Nested partitions were successfully extracted from super

systemrw: Current size of vendor.img in bytes: 692318208
systemrw: Current size of vendor.img in MB: 660
systemrw: Current size of vendor.img in 512-byte sectors: 1352184

systemrw: 'shared_blocks feature' detected @ vendor.img

systemrw: Increasing filesystem size of vendor.img...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/vendor.img to 21127
8 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/vendor.img is now 211278 (4k
) blocks long.

systemrw: Removing 'shared_blocks feature' of vendor.img...
e2fsck 1.45.4 (23-Sep-2019)
systemrw: Read-only lock of vendor.img successfully removed

systemrw: Shrinking size of vendor.img back to minimum size...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/vendor.img to 17890
0 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/vendor.img is now 178900 (4k
) blocks long.

systemrw: Custom size of vendor.img in bytes: 785203200
systemrw: Custom size of vendor.img in MB: 748
systemrw: Custom size of vendor.img in 512-byte sectors: 1533600

systemrw: Increasing filesystem size of vendor.img...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/vendor.img to 19170
0 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/vendor.img is now 191700 (4k
) blocks long.

=================================================

systemrw: Current size of system.img in bytes: 2260987904
systemrw: Current size of system.img in MB: 2156
systemrw: Current size of system.img in 512-byte sectors: 4415992

systemrw: 'shared_blocks feature' detected @ system.img

systemrw: Increasing filesystem size of system.img...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/system.img to 68999
8 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/system.img is now 689998 (4k
) blocks long.

systemrw: Removing 'shared_blocks feature' of system.img...
e2fsck 1.45.4 (23-Sep-2019)
systemrw: Read-only lock of system.img successfully removed

systemrw: Shrinking size of system.img back to minimum size...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/system.img to 56605
8 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/system.img is now 566058 (4k
) blocks long.

systemrw: Custom size of system.img in bytes: 2371002368
systemrw: Custom size of system.img in MB: 2261
systemrw: Custom size of system.img in 512-byte sectors: 4630864

systemrw: Increasing filesystem size of system.img...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/system.img to 57885
8 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/system.img is now 578858 (4k
) blocks long.

=================================================

systemrw: Current size of product.img in bytes: 2117632
systemrw: Current size of product.img in MB: 2
systemrw: Current size of product.img in 512-byte sectors: 4136

systemrw: 'shared_blocks feature' detected @ product.img

systemrw: Increasing filesystem size of product.img...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/product.img to 646
(4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/product.img is now 646 (4k)
blocks long.

systemrw: Removing 'shared_blocks feature' of product.img...
e2fsck 1.45.4 (23-Sep-2019)
systemrw: Read-only lock of product.img successfully removed

systemrw: Shrinking size of product.img back to minimum size...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/product.img to 496
(4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/product.img is now 496 (4k)
blocks long.

systemrw: Custom size of product.img in bytes: 54460416
systemrw: Custom size of product.img in MB: 51
systemrw: Custom size of product.img in 512-byte sectors: 106368

systemrw: Increasing filesystem size of product.img...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/product.img to 1329
6 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/product.img is now 13296 (4k
) blocks long.

=================================================

systemrw: Current size of my_product.img in bytes: 42147840
systemrw: Current size of my_product.img in MB: 40
systemrw: Current size of my_product.img in 512-byte sectors: 82320

systemrw: 'shared_blocks feature' detected @ my_product.img

systemrw: Increasing filesystem size of my_product.img...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/my_product.img to 1
2862 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/my_product.img is now 12862
(4k) blocks long.

systemrw: Removing 'shared_blocks feature' of my_product.img...
e2fsck 1.45.4 (23-Sep-2019)
systemrw: Read-only lock of my_product.img successfully removed

systemrw: Shrinking size of my_product.img back to minimum size...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/my_product.img to 1
0367 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/my_product.img is now 10367
(4k) blocks long.

systemrw: Custom size of my_product.img in bytes: 94892032
systemrw: Custom size of my_product.img in MB: 90
systemrw: Custom size of my_product.img in 512-byte sectors: 185336

systemrw: Increasing filesystem size of my_product.img...
resize2fs 1.45.4 (23-Sep-2019)
Resizing the filesystem on /data/local/tmp/systemrw_1.32/img/my_product.img to 2
3167 (4k) blocks.
The filesystem on /data/local/tmp/systemrw_1.32/img/my_product.img is now 23167
(4k) blocks long.

=================================================

systemrw: Joining all extracted images back into one single super image...
systemrw: Please wait and ignore the invalid sparse warnings...

Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic
Invalid sparse file format at header magic

systemrw: Successfully created patched super image @
systemrw: /data/local/tmp/systemrw_1.32/img/super_fixed.bin

systemrw: Congratulations! Your image(s) should now have R/W capability
systemrw: Please reboot into bootloader and flash the file(s) manually

RMX2020:/data/local/tmp/systemrw_1.32 #
Hi @DeviLL2014 thanks for your log! It couldn't look any better. It's nice to see you did the expert example ;)(y)
Your device still boots properly after flashing super_fixed.bin ? Can you please double-check if shared_blocks feature was properly removed from your device?
You can check like this:

Bash:
adb shell
su
tune2fs -l /dev/block/dm-0 | grep "features"
tune2fs -l /dev/block/dm-1 | grep "features"
tune2fs -l /dev/block/dm-2 | grep "features"

If there is no more shared_blocks feature that means script worked as expected but some other protection feature is preventing you from going fully r/w...



Hi, I have to correct myself, after some more tries, I was able to run the script, but manually (as you have documented).
The script runs correctly but yet /system partition is ro, even when I remount it to rw, not a single error will be returned, but /system is still ro! :| I'll attach the logs...

Hi again @yasfatft. Please see my answer above to @DeviLL2014
Same thing applies to you. If shared_blocks was successfully removed by script that means it worked! If your device is still locked to r/o after that , then you have more additional protection features that must be disabled!



I have test this script on Mi 10i ( gauguin ). Tested on 2 roms.

1. MIUI 12.5 Global with terminal/fastboot method.

2. Project Sakura with recovery flash method.

It's worked both the times 😁.I have attached both logs. Thanks for your awesome script.
Hello @oneironaut2002. Thanks for your log files and your positive feedback! I'm happy the script works perfectly on both of your Xiaomi devices. I will add you to list of successful devices on front page ;)
Enjoy a fully read/write-able device! :love:(y)




Just found this Project randomly on the Xperia 1 III Forums. Awesome... Just awesome! I will test it on the Xperia Stock Firmwares with My Fams. I will report back. 2019 Xperias dont seem to have a Super Partition. Think 2020+ Xperia have it... Please, Please, Please keep that Project up! It's highly needed for all People who don't have Recoveries available like Xperia Users and for everyone who doesn't cares about these Pseudo Security Mechanisms <3
First Log i got with latest Stock on Xperia 5:
Hi @Miustone. Thanks for your interest in this project.
I checked your log and apparently your Sony device doesn't use shared_blocks read-only feature. Are you sure your device is still locked to read-only? Then you must have additional protection features that stop you from going fully R/W!
Did you try to remount your partitions as r/w yet (see picture below) ?
If you find out why your device is still read-only please let us know!
Good luck!

1-jpg.5235933




aunghtay.plastic said:
Not work by flashing zip with TWRP in Redmi 9 (Lancelot). In this thread, it says work in Redmi 9. I don't know what's wrong with my phone.
Hi @aunghtay.plastic. What do you mean not work? Flashable zip give error 255? Did you run script manually in recovery mode?
I checked your log and it looks good. It looks like you ran script multiple times. That's no big deal.
If you can still boot device after running script I'd call that a success ;) A partial one that is.
What happens if you execute the commands from the picture above while phone is in Android mode? Good luck!



Hi,

when I flash this on Asus Zenfone 8, TWRP restarts.
This is in the logs then:

E:failed to mount /tmp/com.android.apex.cts.shim.apex to loop device /dev/block/loop0. Reason: Device or resource busy
E:Unable to create loop devices to mount apex files
E:Unable to load apex images from /system_root/system/apex

What can I do to fix this?

Thanks,
Hyper
Hi @HyperCriSiS. Thanks for your feedback. I've never heard of this error before. It looks like TWRP related error.
Did you try installing and running script manually as described on front page? Phone can remain in recovery mode while doing this.
After successfully running script please send me your log files from /log subfolder inside script folder. Thanks.
Good luck!
 
Last edited:

DeviLL2014

Senior Member
Oct 3, 2014
57
6
I believe that is not it. There is a dm-verity specific part in the android kernel which should be patched.

What exactly device you are trying to patch? Do you have access to the kernel sources?

There is a file drivers/md/dm-android-verity.c which has a function:
C:
static int verify_header(struct android_metadata_header *header)
{
        int retval = -EINVAL;

        if (is_userdebug() && le32_to_cpu(header->magic_number) ==
                        VERITY_METADATA_MAGIC_DISABLE)
                return VERITY_STATE_DISABLE;

        if (!(le32_to_cpu(header->magic_number) ==
                        VERITY_METADATA_MAGIC_NUMBER) ||
                        (le32_to_cpu(header->magic_number) ==
                        VERITY_METADATA_MAGIC_DISABLE)) {
                DMERR("Incorrect magic number");
                return retval;
        }

        if (le32_to_cpu(header->protocol_version) !=
                        VERITY_METADATA_VERSION) {
                DMERR("Unsupported version %u",
                        le32_to_cpu(header->protocol_version));
                return retval;
        }

        return 0;
}

Take a look at the above function. If we use the "userdebug" build, we can easily disable the dm-verity by the 'avbctl' tool or by the "adb" tool. The code explains why it is possible. If we try to patch this function, by immediately returning of VERITY_STATE_DISABLE, we, possibly, bypass the dm-verity protection and will be able to mount as RW.
there is no source code, only boot, system keys
 

Top Liked Posts

  • There are no posts matching your filters.
  • 3
    i use poco m3 rom xtrv hellas....your script is rock..i remove permanently bloatware with root explorer...nice job
    Hi @masricky I'm happy you like the script. Please send me your log files from this folder. Thanks (y)
    /data/local/tmp/systemrw_1.32/log/

    Enjoy tinkering with your fully read/write-able device and make lots of backups before modding stuff! :love:(y)

    Yes it's true. I wrote this script but it wouldn't exist as such without
    Thank you to everyone who contributed positively to this project! :D(y)
    Also keep in mind script is not perfect for all devices out there yet. Rest assured I'm always working hard on next version ;)(y)
    2
    Thanks! It works flawlessly (although I had to do it manually, it's easy enough). My device is a Redmi Note 9S (curtana). If I update my device, do I need to remake the fixed super.img or should I flash the one made before the update?
    Hi @LanceLot9980. Congratulations for getting the script to work on your device! Enjoy a fully read/write-able device! :love:(y)
    If you upload your log files from script folder and a screenshot of your system mounted as r/w then I can add you to the list of successful devices on front page ;)(y)

    @LanceLot9980 yes I noticed your question but I was on the road.
    If you update OTA this will most likely restore the shared_blocks read-only feature on your super partition which means you will have to run script again if you want to go full r/w again ;)
    Thanks! It works flawlessly (although I had to do it manually, it's easy enough). My device is a Redmi Note 9S (curtana). If I update my device, do I need to remake the fixed super.img or should I flash the one made before the update?
    The flashable zip gave you error 255? Don't worry I already fixed this issue in next version ;) Hopefully I can release it soon!
    2
    hi and thank's for your work...
    I have an issue with your script, I flash it on twrp on my renoir on A11 LOS and the flash is correct but at the end got these errors messages
    failed to mount system/ext/product/vendor (invalid argument) here are the logs and the ss...

    when I try to copy a .xml on vendor partition got, no more space available and it copy a .xml but empty..
    Hello @rayman95. You're welcome. Thanks for your log files and the screenshot (y)
    Don't worry about this TWRP related error at the very end. This has nothing to do with the script. This only means you must reboot the device. That's all ;)(y)
    Failed to mount '/system_ext' (Invalid argument)
    Failed to mount '/product' (Invalid argument)
    Failed to mount '/vendor' (Invalid argument)

    According to your log it looks like everything worked as expected but I think you must run script again with larger custom size. Which custom size did you use? I can't see it in the log :(
    Hopefully I can release that new version soon. The included auto-resize feature should fix this kind of issue in next version ;)(y)



    it worked great on poco x3 pro, but vendor didn't, when I try to edit an XML located in "vendor/etc/device_features" it doesn't work, even so, thank you very much for the work.
    Hi @Revokke. You're welcome. Thanks for your feedback.
    Please feel free to send me your log files from this folder and I'll have a look at your specific issue. Thanks (y)
    /data/local/tmp/systemrw_1.32/log/

    Which MIUI version number are you using? Official stock MIUI or Xiaomi.eu ROM ?
    What do you mean it doesn't work? I just tried it on my device and it just works. I can create and delete files in this directory /vendor/etc/device_features
    Make sure you remount /vendor partition as rw before copying or deleting files.
    If you can only write empty files to /system, /product or /vendor that means you must run script again with larger custom size. Good luck! (y)
    2
    @tids2k için çok fazlaki geri bildiriminiz için teşekkür edilir. Evet, bu bootloop bekleniyordu. Sanırım bu, [2470925]@Hippie459MN[/KULLANICI]'nın birkaç gün önce genel Sony Xperia amiral gemisi yemekta aynı inatçı çekirdekli paniksi.
    gerçek betiğin bir sürüm, Almanya'da kötü durumdaki 255, motorola sürücüsündeki can sıkıcı 73 ve bu inatçı hata siniri gibi bu sorunlardan bazılarını çözecektir. Tam Android 12 olur de harika olurdu.




    Merhaba [KULLANICI=11226285]@kafeinsiz[/KULLANICI] geri bildiriminiz için teşekkürler! Senaryomun Xiaomi azda çok memnunum. Tebrikler! Okunabilir/yazılabilir bir ürünlerden çıkarılabilir!:Aşk :()

    mevcut özel boyutlar=25 (MB) mi kullandınız?

    Android 11 çalıştırdığınızdan emin misiniz? Günlüğünüzde söylüyor diyor ki:
    Evet kesinlikle A11. A10 bir hata nedeniyle burada görünüyor.
    1
    Can you please look into my logs. It shows successful but not got rw capabilities. In twrp after last line of mylog.txt there were two line warning regarding something Mount related
  • 110
    If you can't get this script to work on your device check out the brand new sophisticated superrepack tool by @munjeni


    logo_large.jpg

    SystemRW© v1.32 by lebigmac

    Creation date: February 2021
    Updated: August 2021

    Requirements:
    • rooted STOCK Android 10 or newer (custom ROM should already be R/W!)
    • at least 10+ GB free space on phone for dumping data
    Description:
    A script for all Android power users that wish to make their read-only Android 10+ system read/write-able again to remove bloatware and make more thorough customizations to their device.
    Script only modifies super and vbmeta partitions. /data partition is only used for dumping data and for storing script files
    In a nutshell this is what the script is doing:
    • dumps your existing super OR your system / product / vendor partitions depending on whether or not you've got super partition
    • extracts embedded read-only partitions (system, vendor, product...) from super if applicable
    • makes these partitions read/write-able
    • joins everything back together to new super.img OR NOT depending on whether or not you've got super partition
    • flashes read/write-able images back to device using the super fast Kolibass technique (only in recovery mode)

    NOTE:
    • Extract BUNDLE.zip (the included sysrw_repair.zip is only for fixing error 73!)
    • Before launching script make sure you've got full read/write access to the /data partition by first decrypting and then mounting /data partition as R/W!
    • Before running this experimental software on your device it is recommended to make a full backup of your device (just in case you are unlucky enough to end up in an irreversible bootloop)
    • The script can be run both inside custom recovery and inside Android operating system.
      If you run script in Android mode you will need to fastboot flash the patched image(s) manually!
    • To check whether or not you've got a super partition on your device you can run this command: adb shell "ls -l /dev/block/by-name/super"
    • To check whether or not your device has the notorious shared_blocks read-only feature you can run these commands in Android:
      Bash:
      adb shell
      su
      touch /sdcard/my_tune2fs_output.txt
      for i in `seq 0 5`; do tune2fs -l /dev/block/dm-$i>>/sdcard/my_tune2fs_output.txt; done
    Manual installation:
    • Extract flashable.zip and copy systemrw_*VERSION* folder into /data/local/tmp/
    • run this command to make the script executable:
      chmod +x /data/local/tmp/systemrw_*VERSION*/systemrw.sh
    Automatic installation:
    Installation of the script has never been this easy!
    Download the flashable.zip below, do NOT enable zip signature verification and simply install it in your custom recovery (works in TWRP, OrangeFox and PBRP!)
    The installer binary will auto-detect whether or not your device has a super partition and launch the script accordingly with the proper command line arguments.

    Flashable zip custom usage:
    You can set these custom installation arguments in the included config.ini file.
    Simply extract the flashable.zip and modify the included config.ini file and then save the file. Then compress the systemrw_*VERSION* and META-INF folders again as a new .zip and install it in recovery.
    First line of config.ini contains the script arguments for those WITHOUT super partition.
    By default this line is completely empty (no space).
    Second line of config.ini contains the script arguments for those WITH super partition.
    For example if you already dumped your super_original.bin and want to skip that process next time you install the .zip then put this in line #2 of config.ini :
    in=`ls -l /dev/block/by-name/super | awk '{print $NF}'` size=15
    Remember if you decide to use custom arguments in config.ini then the first character should always be an empty space. If no arguments are used such as by default in line #1 (no super) then the line should be completely empty, no space, nothing.

    Script usage:
    If you've got no super partition then simply call the script with no arguments from the shell (see examples below).
    If you've got a super partition I would recommend using the optional size=15 parameter as well to give some extra free space (in MB) to each partition.
    Optional script arguments:
    Replace x with your custom value
    • in=x *THIS IS IGNORED IF YOU'VE GOT NO SUPER PARTITION*
      With this flag you can specify an existing super image as input and skip the entire dumping of the super image process. Here you can use the super_original.bin which you dumped earlier with systemrw or the official unsparsed super.img from your downloaded firmware. (unsparse with simg2img). It's also possible to use your super partition block device as input.
      If omitted, systemrw will dump super image from phone to ./img/super_original.bin
      (path is relative to the script)
    • out=x *THIS IS IGNORED IF YOU'VE GOT NO SUPER PARTITION*
      With this argument you can specify the output path of the new patched super file.
      If omitted, default output value is ./img/super_fixed.bin
    • size=x *ONLY RECOMMENDED IF YOU'VE GOT SUPER PARTITION*
      With this parameter you can specify the extra free space (in megabytes) that will be added to each partition. There is a limit as to how much extra free space you can add per partition. Check your lpdump.txt to find out the exact maximum extra size.
      If omitted, default extra size is 0 (shrink to minimum)

    Examples:
    Bash:
    adb shell
    su
    cd /data/local/tmp/systemrw_1.32
    chmod +x ./systemrw.sh
    
    # Run this command *IF YOU'VE GOT NO SUPER PARTITION*
    ./systemrw.sh
    
    # Run this command if you're first time user *AND YOU'VE GOT SUPER PARTITION*
    # Specify the extra free space in megabytes for each partition:
    ./systemrw.sh size=15
    
    # Plug an existing super image into the script like this *ONLY IF YOU'VE GOT SUPER PARTITION*
    ./systemrw.sh in=./img/super_original.bin size=15
    
    # Specify both the input file as well as the output destination *ONLY IF YOU'VE GOT SUPER PARTITION*
    ./systemrw.sh in=./img/super_original.bin out=./custom/path/super_fixed.bin size=15
    
    # EXPERT EXAMPLE:
    ./systemrw.sh in=`ls -l /dev/block/by-name/super | awk '{print $NF}'` out=./img/super_fixed.bin size=50

    Uninstallation:
    • To free up space and keep script as well as r/w capability you can simply delete /img subfolder at /data/local/tmp/systemrw_1.32/img
    • To delete script and keep r/w capability you can simply delete whole script folder at /data/local/tmp/systemrw_1.32
    • To undo all changes performed by the script you can simply reflash original stock read-only super image and re-enable dm-verity and verification either through adb/fastboot or with the included avbctl binary (inside /tools/ subfolder - also available in recovery).

    Troubleshooting:
    If you get error 255 in custom recovery when trying to install flashable zip then try to install it manually. If you encounter this error please send me this file /tmp/recovery.log
    Make sure the script folder was correctly extracted to:
    /data/local/tmp/systemrw_*VERSION*
    If you can't run the script try making the file executable like this: chmod +x ./systemrw.sh
    If you still can't get it to work run which sh in your shell and replace the shebang in the first line of the script with the output of that command. Don't remove the first two #! symbols though. Then save the file and try again.
    Make sure you have full read write access to the /data/local/tmp directory and that the containing files are not encrypted in custom recovery!
    If you get bootloop after successfully flashing super_fixed.bin then you can undo bootloop simply by re-flashing original stock super image and re-enabling dm-verity and verification with the included avbctl binary (inside /tools/ subfolder - also available in recovery). Those are the only changes performed by the script.
    Good luck!

    About:
    I did not come up with all this by myself. After searching for a solution for countless days without success, going even as far as learning hex editing - I accidentally came across a couple of very interesting threads burried deep inside the new forum interface where this method has been described by various enthousiasts (links can be found in the credits section below). Therefore I take absolutely no credit for the underlying core mechanisms of the script. I'm only the amateur who put it all together into a compact script so that everybody can enjoy an Android system that's read/write-able again. Just like it used to be in Android 9 or earlier. Before this annoying 'shared_blocks feature' was implemented.

    Credits:
    Huge thanks to @Kolibass for allowing me to use his partition tools for Android. Without your tools this script would not work on the Android platform! This genius also showed me how to flash a 5GB file to my partition in just under 30 seconds! Much faster than fastboot! I still can't believe it!
    Big thanks to @Brepro1 for allowing me to basically copy his awesome tutorial and make it into a script. Without your tutorial guiding me I couldn't have created this script.
    Big thanks @munjeni for allowing me to use his superunpack V1 tool in the initial version. It helped me to understand how these super images work.
    Thanks @AndyYan your great tutorial also helped me a lot for automating the script especially the lpdump part.
    Thanks @bynarie for making available his otatools package! A part of it was bundled with the initial version which helped me to create this universal version. It's still part of the troubleshooting repair script to fix error 73.
    More thanks @gabrielfrias for his helpful comment
    Thanks @YOisuPU and of course @topjohnwu for discovering the 'shared_blocks feature'
    Thanks @HemanthJabalpuri for assisting me in optimizing the underlying algorithm!

    Disclaimer:
    #Disclaimer v2.0​
    This open source software is provided as is without any kind of warranty or support whatsoever.
    By using and viewing this software you agree to the following terms:
    • Under no circumstances shall the author be held responsible for any damages that may ensue from the (inappropriate) use of this software.
    • All responsibility, liability and risk lies with the end-user. You hereby agree not to abuse this software for illegal purposes.
    • Under no circumstances shall the comments & title section of the script (lines #1 - #65) as well as the included update-binary be modified or removed by the end-user without the original author's explicit consent.
    • Under no circumstances shall the end-user steal and / or abuse my entire SystemRW project or parts thereof (including but not limited to my update-binary, my script, my program logo, my program name or the names of my functions and my variables and more...) only to rename and republish my SystemRW project (or parts thereof) as his / her own without even mentioning original source or original credits!!! (yes this actually happened :( perpetrated by a fellow forum member...)
    • Unauthorized re-uploads of any files contained within this project to 3rd party websites are not permitted without the original author's prior consent!
    • The end-user is allowed to improve the underlying algorithm (as long as no malicious code is added) and post his/her improvements, results and feedback right here in the official SystemRW project thread @ xda-developers.com
    • If the end-user wants to integrate my SystemRW project into his/her own project then he/she shall first ask me (the original author) for permission.
      If you want to make a video tutorial about my script please contact me first!
      Thank you! I can give you high resolution project logo and more!

    Please make sure to post your feedback and suggestions in the official thread right here.
    Enjoy customizing your fully read/write-able Android device! And feel free to share your Android system mods with other users in this thread! Thanks!


    v1-31d_01-jpg.5309953
    v1-31d_02-jpg.5309955
    v1-31d_03-jpg.5309957


    1-jpg.5235933


    Confirmed working on these devices:




    Download v1.32 mirror #1


    Download v1.32 mirror #2

    current status: experimental

    If you like this project and want to support further development of SystemRW & the creation of more amazing projects like this then please feel free to donate to the developer by clicking the button below.

    Thanks! Your support is very much appreciated!

    Donate
    12
    If the script works on your device please send me your log files from this folder:
    /data/local/tmp/systemrw_1.32/log/

    And please write your phone model /// Android version /// firmware version

    Then I can add you to the list of successful devices and it will be helpful for further development. Thank you!
    6
    New version 1.20 is ready! DOWNLOAD HERE
    Good news for those that don't have TWRP or couldn't get it to work in their TWRP. Now the script can also be run directly inside Android. Keep in mind that you will have to flash the patched images manually in this case using fastboot flash.

    The zip can still be flashed in TWRP (make sure zip signature verification isn't checked). This time I bundled my device's stock sh binary (which I used to develop the script) with the archive. Hopefully this will prevent avoidable sh-related syntax errors for some folks. The flashable zip installer update-binary automatically launches the script with the proper arguments using this bundled sh program (it's inside the tools subfolder).

    To those that were having difficulties running the previous version due to empty partitions or multiple partition groups inside their super : this has finally been fixed :D

    Please give this new version a try and let me know if it works for you or not and I will add it to the first post. Thanks for your feedback!
    5
    I try to redo the procedure, i want to change the size. but i get error, can't remove lock.

    Good news. New hotfix available HERE
    I got rid of that buggy get minimum size function and reworked the size querying algorithm a little bit. Should be more stable now.

    Next step will be to make the script compatible with those devices that have empty partitions embedded inside their super partition...
    Also ronnie was complaining about syntax error but I have yet to find the syntax error... If anyone finds it please let me know so I can fix it. Thank you!