• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!
Search This thread

DeviLL2014

Senior Member
Oct 3, 2014
57
6
Hi @MinhDat_Vo thanks for your log files and screenshot.
If you get insufficient space error when trying to copy file to /system you must run script again with larger custom size parameter! This should be fixed in next version with auto-resize feature.
Enjoy fully read/write-able system! (y)




Hi @DeviLL2014 thanks for your log! It couldn't look any better. Oh nice I see you did the expert example ;) (y)
Your device still boots properly after flashing super_fixed.bin ? Can you please double-check if shared_blocks feature was properly removed from your device?
You can check like this:

Bash:
adb shell
su
tune2fs -l /dev/block/dm-0 | grep "features"
tune2fs -l /dev/block/dm-1 | grep "features"
tune2fs -l /dev/block/dm-2 | grep "features"

If there is no more shared_blocks feature that means script worked as expected but some other protection feature is preventing you from going fully r/w...
yes everything was sewn and turned on,
Code:
E:\RealmeC3\platform-tools>adb shell
RMX2020:/ $ su
RMX2020:/ # tune2fs -l /dev/block/dm-0 | grep "features"
Filesystem features:      ext_attr dir_index filetype extent sparse_super large_
file huge_file uninit_bg dir_nlink extra_isize
RMX2020:/ # tune2fs -l /dev/block/dm-1 | grep "features"
Filesystem features:      ext_attr dir_index filetype extent sparse_super large_
file huge_file uninit_bg dir_nlink extra_isize
RMX2020:/ # tune2fs -l /dev/block/dm-2 | grep "features"
Filesystem features:      ext_attr dir_index filetype extent sparse_super large_
file huge_file uninit_bg dir_nlink extra_isize
RMX2020:/ #
 
  • Like
Reactions: lebigmac

NewDwarf

Member
Oct 14, 2021
8
1
The automatic installation method (systemrw_1.32_flashable.zip) is worked for me. Thank you 3000!

Google Pixel 4 XL (coral) with Android 10

These are my logs and my screenshot....
Frankly, your log looks weird. It is not clear how the script can reports about the super partition, if Pixel 4 stock images DON'T have it. Also it doesn't have the
'/dev/block/by-name/super' file!
 

lebigmac

Senior Member
Jan 31, 2017
940
557
I am sure that the script won't work with the Pixel 4a but it is in the confirmed list. The guy who shared the log ran the script on the 'user-debug' build!
Take a look at the line:

Normal 'release' build should print just 'Google':

So, please, fix the supported device list in the initial post. The 'user-debug' build can easily be mounted as RW by just using regular 'adb' tool.

BTW, the same problem on running the script on the Pixel 3. Below is the log:

The script makes a wrong decision that "/system is already R/W capable". It is not true! On running the script it is in the RO mode.

Could someone explain what the script have to do to make "RW" mounting possible?
The 'avbctl' tool modifies the vbmeta.img in-place to disable dm-verity. But it turns out it is not enough.
What is the purpose of further running of the 'tune2fs' tool to make partitions as "RW"?
Hi @NewDwarf. Welcome to the XDA developers forum!

If you are referring to this comment by @rhewins2268
I checked his log and it looks pretty good to me hence I added him to the list of successful devices on front page. I personally only use Xiaomi devices. To be honest I know absolutely nothing about Pixel devices.

You might want to contact @rhewins2268 directly and ask him how he got the script to work on his Pixel device.

Did you try to remount as "rw" after loading the patched images?
For example, try to remount the /vendor by:
Remounting partitions as R/W is always a good idea after removing shared_blocks read-only feature.

I believe that is not it. There is a dm-verity specific part in the android kernel which should be patched.

What exactly device you are trying to patch? Do you have access to the kernel sources?

There is a file drivers/md/dm-android-verity.c which has a function:
C:
static int verify_header(struct android_metadata_header *header)
{
        int retval = -EINVAL;

        if (is_userdebug() && le32_to_cpu(header->magic_number) ==
                        VERITY_METADATA_MAGIC_DISABLE)
                return VERITY_STATE_DISABLE;

        if (!(le32_to_cpu(header->magic_number) ==
                        VERITY_METADATA_MAGIC_NUMBER) ||
                        (le32_to_cpu(header->magic_number) ==
                        VERITY_METADATA_MAGIC_DISABLE)) {
                DMERR("Incorrect magic number");
                return retval;
        }

        if (le32_to_cpu(header->protocol_version) !=
                        VERITY_METADATA_VERSION) {
                DMERR("Unsupported version %u",
                        le32_to_cpu(header->protocol_version));
                return retval;
        }

        return 0;
}

Take a look at the above function. If we use the "userdebug" build, we can easily disable the dm-verity by the 'avbctl' tool or by the "adb" tool. The code explains why it is possible. If we try to patch this function, by immediately returning of VERITY_STATE_DISABLE, we, possibly, bypass the dm-verity protection and will be able to mount as RW.
Where did you find this function? I cannot find it in the avbctl source folder. Are you sure avbctl binary uses this function?
If avbctl doesn't work for you then you can try disabling dm-verity and verification like this:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
Good luck!
 
Last edited:

lebigmac

Senior Member
Jan 31, 2017
940
557
yes everything was sewn and turned on,
Code:
E:\RealmeC3\platform-tools>adb shell
RMX2020:/ $ su
RMX2020:/ # tune2fs -l /dev/block/dm-0 | grep "features"
Filesystem features:      ext_attr dir_index filetype extent sparse_super large_
file huge_file uninit_bg dir_nlink extra_isize
RMX2020:/ # tune2fs -l /dev/block/dm-1 | grep "features"
Filesystem features:      ext_attr dir_index filetype extent sparse_super large_
file huge_file uninit_bg dir_nlink extra_isize
RMX2020:/ # tune2fs -l /dev/block/dm-2 | grep "features"
Filesystem features:      ext_attr dir_index filetype extent sparse_super large_
file huge_file uninit_bg dir_nlink extra_isize
RMX2020:/ #
Thanks for the confirmation. It looks like script worked as expected and successfully removed shared_blocks read-only feature from your device.
I don't know why your device is still read-only!? It doesn't make any sense. There must be another read-only protection feature hidden somewhere deep inside your device...

Can you do this? (see picture below)
Also run dmesg immediately after remount command. Maybe we can figure out what's the problem.
Bash:
adb shell
su
mount -o remount,rw /
dmesg>/sdcard/dmesg_devill2014.txt

1-jpg.5235933
 
Last edited:

xen423

Member
Mar 27, 2009
6
3
OnePlus 8T
Thanks @lebigmac for total awesomeness.
Confirmed working for :
Device : Oneplus 8T / KB2005
Build : 11.0.10.10.KB05AA
[RECOVERY] [11] [ALPHA] TeamWin Recovery Project (8T / Kebab) (2021-09-04)
Magisk v23
 

Attachments

  • lpdump.txt
    1.9 KB · Views: 19
  • mylog.txt
    7.6 KB · Views: 16
  • Love
Reactions: lebigmac

MinhDat_Vo

Member
Dec 15, 2015
11
5
Ho Chi Minh
Google Pixel 4
Frankly, your log looks weird. It is not clear how the script can reports about the super partition, if Pixel 4 stock images DON'T have it. Also it doesn't have the
'/dev/block/by-name/super' file!
I've been using it for a long time, here are some videos before and after I used it
Before I could install it automatically using flashable zip, I followed the instructions here: (and it works on both Android 10 and 11):
Do you use "Magisk" for rooting?
Did you run just ./systemrw.sh without parameters?
- Yes i used Magisk to root
- I simply downloaded and flashed the zip file with TWRP
 

Attachments

  • After.mp4
    2.6 MB · Views: 0
  • Before.mp4
    1.4 MB · Views: 0
  • z2847497615209_45a74d21ff5194d8e425f92c4e6d7fb8.png
    z2847497615209_45a74d21ff5194d8e425f92c4e6d7fb8.png
    140 KB · Views: 19
  • Love
Reactions: lebigmac

hendrysetiadi

Member
Apr 12, 2021
6
0
I have to ask what you want to accomplish after you are successful and have rw capability? This is not a rhetorical question or anything of the sort. I am simply curious.
I want to put custom launcher, and remove all bloatware apk. But is that possible to run this script on low storage ? can i run it and throw the output file to external storage ?
 

NewDwarf

Member
Oct 14, 2021
8
1
Hi @NewDwarf. Welcome to the XDA developers forum!

If you are referring to this comment by @rhewins2268
I checked his log and it looks pretty good to me hence I added him to the list of successful devices on front page. I personally only use Xiaomi devices. To be honest I know absolutely nothing about Pixel devices.

You might want to contact @rhewins2268 directly and ask him how he got the script to work on his Pixel device.


Remounting partitions as R/W is always a good idea after removing shared_blocks read-only feature.


Where did you find this function? I cannot find it in the avbctl source folder. Are you sure avbctl binary uses this function?
If avbctl doesn't work for you then you can try disabling dm-verity and verification like this:
fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
Good luck!
Thanks. I dug more and found some new things.
1. The script makes a wrong decision in the case if the FS being mounted is not in the /proc/mounts
Code:
+ mount -o rw,remount /system
+ result='mount: '\''/system'\'' not in /proc/mounts'
+ printf 'systemrw: %s is already R/W capable. Ignoring\n' /system

2. For unknown for me reasons, tune2fs doesn't work:
Code:
+ printf 'systemrw: Partition detected -> %s @ %s\n' vendor_a /dev/block/sda9
systemrw: Partition detected -> vendor_a @ /dev/block/sda9
+ tune2fs -l /dev/block/sda9
+ grep feat
tune2fs: Bad magic number in super-block while trying to open /dev/block/sda9
But at the same time, on mounting the 'vendor' partition as RW, I got in the kernel log:
Code:
EXT4-fs (dm-1): couldn't mount RDWR because of unsupported optional features (4000)
where '4000' is actually the "EXT4_FEATURE_RO_COMPAT_SHARED_BLOCKS" feature which your script tries to remove by:
Code:
    printf "$app: Removing 'shared_blocks feature' of %s...\n" $fiName
    if ( ! e2fsck -y -E unshare_blocks $1 > /dev/null ); then
        printf "$app: There was a problem removing the read-only lock of %s. Ignoring\n\n" $fiName
    else
        printf "$app: Read-only lock of %s successfully removed\n\n" $fiName
    fi

Any idea of why tune2fs doesn't work on the Pixel family partitions? Pixels don't use super partition concept and all RO images are sparse.
Any suggestions to fix it?

UPDATE1: As I mentioned, Pixels use the sparse images.
On regular Linux machine, I tried to run tune2fs with the sparse image and got:
Code:
tune2fs -l vendor.img
tune2fs 1.46.2 (28-Feb-2021)
tune2fs: Bad magic number in super-block while trying to open vendor.img
This is exactly I got on Android running the script.

Then I converted the sparse image to raw one by the 'simg2img' and got:
Code:
tune2fs -l vendor.raw | grep feat
Filesystem features:      ext_attr resize_inode dir_index filetype extent sparse_super large_file huge_file uninit_bg dir_nlink extra_isize shared_blocks

UPDATE2: it turns out that at least Pixel3, Pixel4/4a, and Pixel5 are all super partition based devices. But the Pixel3 doesn't have the '/dev/block/by-name/super' file. That's why the script doesn't work on the Pixel3. The script cannot define the correct path for the 'super' file and it fails.

So, the Pixel3 is out of line in the Pixel family. Do you have an idea how to identify the path to the 'super' partition?
 
Last edited:

lebigmac

Senior Member
Jan 31, 2017
940
557
I want to put custom launcher, and remove all bloatware apk. But is that possible to run this script on low storage ? can i run it and throw the output file to external storage ?
Hi again @hendrysetiadi I already answered your question last week. Please see comment #1122 on previous page! Good luck!



running the script on the Pixel 3. Below is the log:
systemrw: Initiating procedure...

systemrw: Device is in Android mode. Ignoring
systemrw: Current device: Google
systemrw: Current Android version: 11
systemrw: Current SELinux status: Permissive
systemrw: Unable to locate super partition on device. Ignoring
systemrw: /system is already R/W capable. Ignoring
systemrw: /product is read-only
systemrw: /vendor is read-only
systemrw: Adjusting permissions...
systemrw: Attempting to disable dm-verity and verification...
Successfully disabled verification on slot with suffix _a. Reboot the device for changes to take effect.
Successfully disabled verity on slot with suffix _a. Reboot the device for changes to take effect.
systemrw: Partition detected -> product_a @ /dev/block/sda7
tune2fs: Bad magic number in super-block while trying to open /dev/block/sda7
systemrw: NO 'shared_blocks feature' detected @ product_a. Ignoring
systemrw: Partition detected -> product_b @ /dev/block/sda8
systemrw: NO 'shared_blocks feature' detected @ product_b. Ignoring
systemrw: Partition detected -> system_a @ /dev/block/sda5
tune2fs: Bad magic number in super-block while trying to open /dev/block/sda5
systemrw: NO 'shared_blocks feature' detected @ system_a. Ignoring
systemrw: Partition detected -> system_b @ /dev/block/sda6
tune2fs: Bad magic number in super-block while trying to open /dev/block/sda6
systemrw: NO 'shared_blocks feature' detected @ system_b. Ignoring
systemrw: Partition detected -> vendor_a @ /dev/block/sda9
tune2fs: Bad magic number in super-block while trying to open /dev/block/sda9
systemrw: NO 'shared_blocks feature' detected @ vendor_a. Ignoring
systemrw: Partition detected -> vendor_b @ /dev/block/sda10
systemrw: NO 'shared_blocks feature' detected @ vendor_b. Ignoring
systemrw: There was a problem removing read-only restriction(s) of your device. Abort

@NewDwarf
Why would your block device be in sparse format? I thought block devices are always in raw format?

If the file is really in sparse format that would explain why querying partition features with tune2fs -l command fails.
This issue should be easy to fix by unsparsing the file first with the included simg2img tool...
 
Last edited:

NewDwarf

Member
Oct 14, 2021
8
1
Hi @hendrysetiadi please see comment #1122 on previous page! Good luck!






@NewDwarf
Is this your full log?
Why would your block device be in sparse format? I thought block device is always in raw format? Maybe @munjeni knows more about this.

If it's really sparse format that would explain why querying partition features with tune2fs -l command fails.
This issue should be easy to fix by unsparsing the file first with the included simg2img tool...
Yes, this is a full log. In the last message I mentioned:
It turns out that at least Pixel3, Pixel4/4a, and Pixel5 are all super partition based devices. But the Pixel3 doesn't have the '/dev/block/by-name/super' file. That's why the script doesn't work on the Pixel3. The script cannot define the correct path for the 'super' file and it fails.
Actually, Pixel3 is a super partition based device. Because of absence of the /dev/block/by-name/super' file, the script tries to dump and then process ( tune2fs -l ...) each RO partition as a RAW partition. As the 'tune2fs' tool processes nested partitions, it fails.

The problem is how to find location of the super partition on the Pixel3 if the '/dev/block/by-name/super' is not present.

All Pixel family devices has the 'super_empty.img' file inside the stock ROM. It is pretty short file and at the first glance it describes layout of RO partitions. You can find it attached.
 

Attachments

  • super_empty.img
    4.7 KB · Views: 7
Last edited:

HyperCriSiS

Senior Member
Nov 23, 2010
390
80
Samsung Galaxy S7
ASUS ZenFone 8
I tried running it manually but it is not executed.
What am I doing wrong here :)?

ASUS_I006D:/data/local/tmp/sysrw_repair_v1.32 # ls -l
total 14
drwxr-xr-x 2 root root 3452 2021-10-16 17:50 img
-rw-r--r-- 1 root root 128 2021-10-16 17:53 log.txt
-rwxr-xr-x 1 root root 2630 2021-07-26 00:32 sysrw_repair.sh
drwxr-xr-x 4 root root 3452 2021-10-16 17:50 tools

ASUS_I006D:/data/local/tmp/sysrw_repair_v1.32 # ./sysrw_repair.sh size=15

/system/bin/sh: ./sysrw_repair.sh: No such file or directory
 
  • Haha
Reactions: lebigmac

JimmyMX

Member
Jun 29, 2012
37
9
36
Tripoli
Google Nexus 5
Huawei Nexus 6P
Hello and good day all

"User data is not affected"

i found out the hard way that this piece of information is misleading , I did everything by the book on ROG III on android 11 after success I had to wipe data to get access to android , I lost data stored on SD card plus all my apps and my apps data , anyways I have rw system now but I want to install an update to ROG III but I don't want to go through wiping data again.


I don't know but maybe i am missing something,

any suggestions would be appreciated,

thanx for the hardcore work
 
  • Wow
Reactions: lebigmac

lebigmac

Senior Member
Jan 31, 2017
940
557
Hello and good day all

"User data is not affected"

i found out the hard way that this piece of information is misleading , I did everything by the book on ROG III on android 11 after success I had to wipe data to get access to android , I lost data stored on SD card plus all my apps and my apps data , anyways I have rw system now but I want to install an update to ROG III but I don't want to go through wiping data again.


I don't know but maybe i am missing something,

any suggestions would be appreciated,

thanx for the hardcore work
Hi @JimmyMX
That's sad to hear that you lost your private data. In over 8 months and 60 pages of development and 10000 downloads later nobody has experienced this issue to my knowledge.

How the hell did you do that?!

after success I had to wipe data to get access to android
I never said to wipe data after running script. Who told you to do that?

Script only modifies super and vbmeta partitions and only uses /data/local/tmp/systemrw_1.32 folder to execute script and dump some files...

Why didn't you backup /data before wiping it?

Try to see the positive side. Now your device is finally read/writable. Congratulations!
 
Last edited:
  • Like
Reactions: JimmyMX

DeviLL2014

Senior Member
Oct 3, 2014
57
6
Thanks for the confirmation. It looks like script worked as expected and successfully removed shared_blocks read-only feature from your device.
I don't know why your device is still read-only!? It doesn't make any sense. There must be another read-only protection feature hidden somewhere deep inside your device...

Can you do this? (see picture below)
Also run dmesg immediately after remount command. Maybe we can figure out what's the problem.
Bash:
adb shell
su
mount -o remount,rw /
dmesg>/sdcard/dmesg_devill2014.txt

1-jpg.5235933
 

Attachments

  • dmesg_devill2014.txt
    505.6 KB · Views: 7
  • Like
Reactions: lebigmac

Top Liked Posts

  • 1
    To test if everything worked properly you can run each of these commands individually:
    Good luck! (y)
    Bash:
    adb shell
    su
    for a in `ls /dev/block/dm-*`; do mount -o remount,rw $a; done
    var="it's work!"
    echo $var>/test.txt
    echo $var>/product/test.txt
    echo $var>/vendor/test.txt
    echo $var>/system_ext/test.txt
    cat /test.txt && cat /product/test.txt && cat /vendor/test.txt && cat /system_ext/test.txt
    rm -f /test.txt /product/test.txt /vendor/test.txt /system_ext/test.txt
    1
    Working smoothly for MI 10T Android 10 Firmware Global 12.0.3 with argument size=100
    1
    Hello @QuaZero. I'm very happy that my script works smoothly on your Xiaomi device! Congratulations! (y)
    Please send me your other log files from this folder /data/local/tmp/systemrw_1.32/log/
    Thanks! Your feedback is very useful for further script development (y)
    Enjoy debloating and customizing your fully read/write-able device! :love:(y)




    Hi again @jhayprince. Thanks for your log files and screenshots. It's very useful to better understand your problem.

    According to your latest log everything worked correctly and shared_blocks read-only feature of your most important partitions was successfully removed by script :D(y)

    Don't worry error 255 it's already fixed in next version which shall be released soon ;)(y)
    In the meantime you can simply launch script manually in terminal (y)
    You can subscribe to the thread and you will be notified when a new version of the script will be released (y)
    o think its working now see the screenshot..before the vendor its in RO...but now its in RW...
    1
    lebigmac Hello bro from Russia! Your script works without any problems on the POCO X3 PRO phone! There was a problem mounting partitions in TWRP from Nebrassy. Installed Orangefox and everything went smoothly! Thanks for your work!
    P.S. size=250
  • 3
    i use poco m3 rom xtrv hellas....your script is rock..i remove permanently bloatware with root explorer...nice job
    Hi @masricky I'm happy you like the script. Please send me your log files from this folder. Thanks (y)
    /data/local/tmp/systemrw_1.32/log/

    Enjoy tinkering with your fully read/write-able device and make lots of backups before modding stuff! :love:(y)

    Yes it's true. I wrote this script but it wouldn't exist as such without
    Thank you to everyone who contributed positively to this project! :D(y)
    Also keep in mind script is not perfect for all devices out there yet. Rest assured I'm always working hard on next version ;)(y)
    2
    Hi @Flashfire5606 thanks for your log files.
    Hi @Rahamatulla thanks for your interest in this project.
    Please keep in mind that removing shared_blocks read-only feature will duplicate lots of blocks that used to be shared. This will increase size of each partition which is embedded inside your super partition by approximately 200 MB.
    Maybe that's why @Flashfire5606 gets error 70 (insufficient space) despite using size=0 (shrink to minimum).
    I'm sure this can easily be fixed somehow...
    2
    Thanks! It works flawlessly (although I had to do it manually, it's easy enough). My device is a Redmi Note 9S (curtana). If I update my device, do I need to remake the fixed super.img or should I flash the one made before the update?
    Hi @LanceLot9980. Congratulations for getting the script to work on your device! Enjoy a fully read/write-able device! :love:(y)
    If you upload your log files from script folder and a screenshot of your system mounted as r/w then I can add you to the list of successful devices on front page ;)(y)

    @LanceLot9980 yes I noticed your question but I was on the road.
    If you update OTA this will most likely restore the shared_blocks read-only feature on your super partition which means you will have to run script again if you want to go full r/w again ;)
    Thanks! It works flawlessly (although I had to do it manually, it's easy enough). My device is a Redmi Note 9S (curtana). If I update my device, do I need to remake the fixed super.img or should I flash the one made before the update?
    The flashable zip gave you error 255? Don't worry I already fixed this issue in next version ;) Hopefully I can release it soon!
    2
    hi and thank's for your work...
    I have an issue with your script, I flash it on twrp on my renoir on A11 LOS and the flash is correct but at the end got these errors messages
    failed to mount system/ext/product/vendor (invalid argument) here are the logs and the ss...

    when I try to copy a .xml on vendor partition got, no more space available and it copy a .xml but empty..
    Hello @rayman95. You're welcome. Thanks for your log files and the screenshot (y)
    Don't worry about this TWRP related error at the very end. This has nothing to do with the script. This only means you must reboot the device. That's all ;)(y)
    Failed to mount '/system_ext' (Invalid argument)
    Failed to mount '/product' (Invalid argument)
    Failed to mount '/vendor' (Invalid argument)

    According to your log it looks like everything worked as expected but I think you must run script again with larger custom size. Which custom size did you use? I can't see it in the log :(
    Hopefully I can release that new version soon. The included auto-resize feature should fix this kind of issue in next version ;)(y)



    it worked great on poco x3 pro, but vendor didn't, when I try to edit an XML located in "vendor/etc/device_features" it doesn't work, even so, thank you very much for the work.
    Hi @Revokke. You're welcome. Thanks for your feedback.
    Please feel free to send me your log files from this folder and I'll have a look at your specific issue. Thanks (y)
    /data/local/tmp/systemrw_1.32/log/

    Which MIUI version number are you using? Official stock MIUI or Xiaomi.eu ROM ?
    What do you mean it doesn't work? I just tried it on my device and it just works. I can create and delete files in this directory /vendor/etc/device_features
    Make sure you remount /vendor partition as rw before copying or deleting files.
    If you can only write empty files to /system, /product or /vendor that means you must run script again with larger custom size. Good luck! (y)
    1
    My tests with parted.

    Yeah, I'm a noob with android, most defo. But...

    I flashed your tool, and could not get enough space for add/delete apps, so tested and decided to use 1024 as my size, which worked for me, at least in being able to install busybox, because I wanted to prove SU works in 10_Q. I proved that to myself, in that it does NOT crash 10_Q.

    So I read of parted, and see the auto... and knowing if a command is available, it will run, (wether it does anything or not) I decide to reflash to stock, only this time, when using system_RW, instead of size=80 or whatever, I did use size=auto and set it in the config too, so there was no doubt.

    The script ran, and I could indeed flash super_fixed.img (my f'n uses .img, so for the noob, mb mention to check the file ends in bin or img, will save a lot of noobs saying they cant flash or find it... ) and even though it showed the space I'd have if I used size=1024 (i settled on this number, would'nt go higher, hint hint..) I got the not enough space. I do not get this with make2fs, using 1024, prob because the tools uses make2fs, so it cant instruct the parted I installed to system in order to use size=auto.

    In the end, I stopped using system_RW until make2fs is changed to parted, knowing it will happen eventually...

    The commands are pretty much the same.

    Then you need to spoof the system's rw ability to ro for the files expecting to 'see' ro, even if they are rw.

    Thanks for the priv msg :)
  • 110
    If you can't get this script to work on your device check out the brand new sophisticated superrepack tool by @munjeni


    logo_large.jpg

    SystemRW© v1.32 by lebigmac

    Creation date: February 2021
    Updated: August 2021

    Requirements:
    • rooted STOCK Android 10 or newer (custom ROM should already be R/W!)
    • at least 10+ GB free space on phone for dumping data
    Description:
    A script for all Android power users that wish to make their read-only Android 10+ system read/write-able again to remove bloatware and make more thorough customizations to their device.
    Script only modifies super and vbmeta partitions. /data partition is not affected. It's only used for dumping data and for storing script files.
    In a nutshell this is what the script is doing:
    • dumps your existing super OR your system / product / vendor partitions depending on whether or not you've got super partition
    • extracts embedded read-only partitions (system, vendor, product...) from super if applicable
    • makes these partitions read/write-able
    • joins everything back together to new super.img OR NOT depending on whether or not you've got super partition
    • flashes read/write-able images back to device using the super fast Kolibass technique (only in recovery mode)

    NOTE:
    • Extract BUNDLE.zip (the included sysrw_repair.zip is only for fixing error 73!)
    • Before launching script make sure you've got full read/write access to the /data partition by first decrypting and then mounting /data partition as R/W!
    • Before running this experimental software on your device it is recommended to make a full backup of your device (just in case you are unlucky enough to end up in an irreversible bootloop)
    • The script can be run both inside custom recovery and inside Android operating system.
      If you run script in Android mode you will need to fastboot flash the patched image(s) manually!
    • To check whether or not you've got a super partition on your device you can run this command: adb shell "ls -l /dev/block/by-name/super"
    • To check whether or not your device has the notorious shared_blocks read-only feature you can run these commands in Android:
      Bash:
      adb shell
      su
      touch /sdcard/my_tune2fs_output.txt
      for i in `seq 0 5`; do tune2fs -l /dev/block/dm-$i>>/sdcard/my_tune2fs_output.txt; done
    Manual installation:
    • Extract flashable.zip and copy systemrw_*VERSION* folder into /data/local/tmp/
    • run this command to make the script executable:
      chmod +x /data/local/tmp/systemrw_*VERSION*/systemrw.sh
    Automatic installation:
    Installation of the script has never been this easy!
    Download the flashable.zip below, do NOT enable zip signature verification and simply install it in your custom recovery (works in TWRP, OrangeFox and PBRP!)
    The installer binary will auto-detect whether or not your device has a super partition and launch the script accordingly with the proper command line arguments.

    Flashable zip custom usage:
    You can set these custom installation arguments in the included config.ini file.
    Simply extract the flashable.zip and modify the included config.ini file and then save the file. Then compress the systemrw_*VERSION* and META-INF folders again as a new .zip and install it in recovery.
    First line of config.ini contains the script arguments for those WITHOUT super partition.
    By default this line is completely empty (no space).
    Second line of config.ini contains the script arguments for those WITH super partition.
    For example if you already dumped your super_original.bin and want to skip that process next time you install the .zip then put this in line #2 of config.ini :
    in=`ls -l /dev/block/by-name/super | awk '{print $NF}'` size=15
    Remember if you decide to use custom arguments in config.ini then the first character should always be an empty space. If no arguments are used such as by default in line #1 (no super) then the line should be completely empty, no space, nothing.

    Script usage:
    If you've got no super partition then simply call the script with no arguments from the shell (see examples below).
    If you've got a super partition I would recommend using the optional size=15 parameter as well to give some extra free space (in MB) to each partition.
    Optional script arguments:
    Replace x with your custom value
    • in=x *THIS IS IGNORED IF YOU'VE GOT NO SUPER PARTITION*
      With this flag you can specify an existing super image as input and skip the entire dumping of the super image process. Here you can use the super_original.bin which you dumped earlier with systemrw or the official unsparsed super.img from your downloaded firmware. (unsparse with simg2img). It's also possible to use your super partition block device as input.
      If omitted, systemrw will dump super image from phone to ./img/super_original.bin
      (path is relative to the script)
    • out=x *THIS IS IGNORED IF YOU'VE GOT NO SUPER PARTITION*
      With this argument you can specify the output path of the new patched super file.
      If omitted, default output value is ./img/super_fixed.bin
    • size=x *ONLY RECOMMENDED IF YOU'VE GOT SUPER PARTITION*
      With this parameter you can specify the extra free space (in megabytes) that will be added to each partition. There is a limit as to how much extra free space you can add per partition. Check your lpdump.txt to find out the exact maximum extra size.
      If omitted, default extra size is 0 (shrink to minimum)

    Examples:
    Bash:
    adb shell
    su
    cd /data/local/tmp/systemrw_1.32
    chmod +x ./systemrw.sh
    
    # Run this command *IF YOU'VE GOT NO SUPER PARTITION*
    ./systemrw.sh
    
    # Run this command if you're first time user *AND YOU'VE GOT SUPER PARTITION*
    # Specify the extra free space in megabytes for each partition:
    ./systemrw.sh size=15
    
    # Plug an existing super image into the script like this *ONLY IF YOU'VE GOT SUPER PARTITION*
    ./systemrw.sh in=./img/super_original.bin size=15
    
    # Specify both the input file as well as the output destination *ONLY IF YOU'VE GOT SUPER PARTITION*
    ./systemrw.sh in=./img/super_original.bin out=./custom/path/super_fixed.bin size=15
    
    # EXPERT EXAMPLE:
    ./systemrw.sh in=`ls -l /dev/block/by-name/super | awk '{print $NF}'` out=./img/super_fixed.bin size=50

    Uninstallation:
    • To free up space and keep script as well as r/w capability you can simply delete /img subfolder at /data/local/tmp/systemrw_1.32/img
    • To delete script and keep r/w capability you can simply delete whole script folder at /data/local/tmp/systemrw_1.32
    • To undo all changes performed by the script you can simply reflash original stock read-only super image and re-enable dm-verity and verification either through adb/fastboot or with the included avbctl binary (inside /tools/ subfolder - also available in recovery).

    Troubleshooting:
    If you get error 255 in custom recovery when trying to install flashable zip then try to install it manually. If you encounter this error please send me this file /tmp/recovery.log
    Make sure the script folder was correctly extracted to:
    /data/local/tmp/systemrw_*VERSION*
    If you can't run the script try making the file executable like this: chmod +x ./systemrw.sh
    If you still can't get it to work run which sh in your shell and replace the shebang in the first line of the script with the output of that command. Don't remove the first two #! symbols though. Then save the file and try again.
    Make sure you have full read write access to the /data/local/tmp directory and that the containing files are not encrypted in custom recovery!
    If you get bootloop after successfully flashing super_fixed.bin then you can undo bootloop simply by re-flashing original stock super image and re-enabling dm-verity and verification with the included avbctl binary (inside /tools/ subfolder - also available in recovery). Those are the only changes performed by the script.
    Good luck!

    About:
    I did not come up with all this by myself. After searching for a solution for countless days without success, going even as far as learning hex editing - I accidentally came across a couple of very interesting threads burried deep inside the new forum interface where this method has been described by various enthousiasts (links can be found in the credits section below). Therefore I take absolutely no credit for the underlying core mechanisms of the script. I'm only the amateur who put it all together into a compact script so that everybody can enjoy an Android system that's read/write-able again. Just like it used to be in Android 9 or earlier. Before this annoying 'shared_blocks feature' was implemented.

    Credits:
    Huge thanks to @Kolibass for allowing me to use his partition tools for Android. Without your tools this script would not work on the Android platform! This genius also showed me how to flash a 5GB file to my partition in just under 30 seconds! Much faster than fastboot! I still can't believe it!
    Big thanks to @Brepro1 for allowing me to basically copy his awesome tutorial and make it into a script. Without your tutorial guiding me I couldn't have created this script.
    Big thanks @munjeni for allowing me to use his superunpack V1 tool in the initial version. It helped me to understand how these super images work.
    Thanks @AndyYan your great tutorial also helped me a lot for automating the script especially the lpdump part.
    Thanks @bynarie for making available his otatools package! A part of it was bundled with the initial version which helped me to create this universal version. It's still part of the troubleshooting repair script to fix error 73.
    More thanks @gabrielfrias for his helpful comment
    Thanks @YOisuPU and of course @topjohnwu for discovering the 'shared_blocks feature'
    Thanks @HemanthJabalpuri for assisting me in optimizing the underlying algorithm!

    Disclaimer:
    #Disclaimer v2.0​
    This open source software is provided as is without any kind of warranty or support whatsoever.
    By using and viewing this software you agree to the following terms:
    • Under no circumstances shall the author be held responsible for any damages that may ensue from the (inappropriate) use of this software.
    • All responsibility, liability and risk lies with the end-user. You hereby agree not to abuse this software for illegal purposes.
    • Under no circumstances shall the comments & title section of the script (lines #1 - #65) as well as the included update-binary be modified or removed by the end-user without the original author's explicit consent.
    • Under no circumstances shall the end-user steal and / or abuse my entire SystemRW project or parts thereof (including but not limited to my update-binary, my script, my program logo, my program name or the names of my functions and my variables and more...) only to rename and republish my SystemRW project (or parts thereof) as his / her own without even mentioning original source or original credits!!! (yes this actually happened :( perpetrated by a fellow forum member...)
    • Unauthorized re-uploads of any files contained within this project to 3rd party websites are not permitted without the original author's prior consent!
    • The end-user is allowed to improve the underlying algorithm (as long as no malicious code is added) and post his/her improvements, results and feedback right here in the official SystemRW project thread @ xda-developers.com
    • If the end-user wants to integrate my SystemRW project into his/her own project then he/she shall first ask me (the original author) for permission.
      If you want to make a video tutorial about my script please contact me first!
      Thank you! I can give you high resolution project logo and more!

    Please make sure to post your feedback and suggestions in the official thread right here.
    Enjoy customizing your fully read/write-able Android device! And feel free to share your Android system mods with other users in this thread! Thanks!


    v1-31d_01-jpg.5309953
    v1-31d_02-jpg.5309955
    v1-31d_03-jpg.5309957


    1-jpg.5235933


    Confirmed working on these devices:

    Download v1.32 mirror #1

    Download v1.32 mirror #2
    more official download mirrors coming soon!
    current status: experimental


    If you like this project and want to support further development of SystemRW & the creation of more amazing projects like this then please feel free to donate to the developer by clicking the button below. Thanks! Your support is very much appreciated!
    Donate
    12
    If the script works on your device please send me your log files from this folder:
    /data/local/tmp/systemrw_1.32/log/

    And please write your phone model /// Android version /// firmware version

    Then I can add you to the list of successful devices and it will be helpful for further development. Thank you!
    6
    New version 1.20 is ready! DOWNLOAD HERE
    Good news for those that don't have TWRP or couldn't get it to work in their TWRP. Now the script can also be run directly inside Android. Keep in mind that you will have to flash the patched images manually in this case using fastboot flash.

    The zip can still be flashed in TWRP (make sure zip signature verification isn't checked). This time I bundled my device's stock sh binary (which I used to develop the script) with the archive. Hopefully this will prevent avoidable sh-related syntax errors for some folks. The flashable zip installer update-binary automatically launches the script with the proper arguments using this bundled sh program (it's inside the tools subfolder).

    To those that were having difficulties running the previous version due to empty partitions or multiple partition groups inside their super : this has finally been fixed :D

    Please give this new version a try and let me know if it works for you or not and I will add it to the first post. Thanks for your feedback!
    5
    I try to redo the procedure, i want to change the size. but i get error, can't remove lock.

    Good news. New hotfix available HERE
    I got rid of that buggy get minimum size function and reworked the size querying algorithm a little bit. Should be more stable now.

    Next step will be to make the script compatible with those devices that have empty partitions embedded inside their super partition...
    Also ronnie was complaining about syntax error but I have yet to find the syntax error... If anyone finds it please let me know so I can fix it. Thank you!