[ROOT][Kernel][TWRP] repack of the stock kernel with dm-verity and SONY RIC off - Xperia Z5 Android Development

Changelog:
V5.23 Fix for Android 6 (Freeze on boot logo)
Installation of kcal kernel module for supported kernels. Get the app from https://forum.xda-developers.com/android/software-hacking/dev-kcal-advanced-color-control-t3032080
V5.22 Bug in the vendor overlay creation. Existing directories (like /vendor/bin) have not been replicated correctly
V5.21 Fix issue when running on Linux (some CR/LF)
Patch libsepol in bootimg for backwards compatibility with Android 6
V5.20 Support for superuser as an alternative to SuperSU (https://github.com/phhusson/Superuser)
Fix for the missing internal storage link in TWRP
V5.11 Support for Android 7.0
Fix in the overlay layout which could prevent some libraries from loading and cause battery drain
V5.1 Support for Android 7.0
Updated bootimg to deal with Android 7.0 policies
New tool inside bootimg for adding new contexts to binary file contexts
New system overlay layout due to a more restrictive linker in Android 7
V5.0 New system overlay method using the /vendor directory. As this directory is also in the library search path even libraries can be easily replaced without modifying the system partition
System-less SuperSU integration improved (Version 2.76 or higher recommended)
System-less xposed integration (using the standard distribution)
Support for 32.A.0.253
V4.51 Fix for awk script for Linux kernel version detection when running on Linux
V4.5 Fixed adb and mtp file access in TWRP for 32.2.A.0.224
V4.42 Added support for Z2 (Sirius) and TWRP fstab fix for leo and aries (thanks to waleedsq81)
V4.41 Fixed issue with Y/N choice on non-english Windows. Added support for Z3 (leo)
V4.4 Support for Z3+/Z4, Tablet Z2, Tablet Z3 and Tablet Z4 added (Z4 still has an issue with TWRP, but DRM fix works)
SuperSU integration reworked in order to need less SELinux exceptions and to be more secure
All tasks can now be individually selected. Therefore there is no separate DRM only script required
V4.31 Renabled Z5P (satsuki) and Z5C (suzuran) for TWRP and drmfix
V4.3 Support for older Lollipop added
Script execution for Linux fixed
V4.24 Fix for for a bug in SuperSU integration in V4.23
V4.23 Fix for repacking 3rd party kernel (Some permissions were on custom directories were lost)
V4.22 Bugfix for readta (flash_dk reported unit not)
V4.21 Fix for the Linux binary of bootimg
V4.2 Updated TWRP to 3.0.2
V4.1
Fix for WideWine (if you have your device key) Thanks a lot to goofnorf101 for testing
unpackinitfs and makeinitfs in my bootimg tool now maintain date/time of files correctly
Automatic SuperSU installation
V4.0
Fix for older kernels (Lollipop)
Binary for Linux (The older version had the ARM version packaged)
Device is not stored in the kernel image anymore
TWRP updated to version 3.0.1
FAQ - Please read
Is is possible to have root with locked bootloader?
Short answer: no
Long answer: The locked bootloader only boots unmodified kernel packages signed by Sony. The stock kernel only mounts unmodified /system partitions (dm-veritiy) -> No modification without unlocking
So any change to the kernel (like this script) or system partition requires unlocked bootloader
What is dm-verity?
A hash checksum on all blocks of a filesystem in order to verify the integrity
What is Sony RIC?
A protection to avoid mounting the root filesystem or system read/write
What happens if I unlock my bootloader
The device key (TA unit 0x1046b) will be wiped, which deactives everything DRM related. In addition a full wipe of your phone will be perfomed.
So extract your TA partition before with this great tool http://forum.xda-developers.com/crossdevice-dev/sony/iovyroot-temp-root-tool-t3349597 from zxz0O0
If you already unlocked the bootloader before, then at least the credentials will be restored, which will reactivate stuff like x-reality and camera de-noise
Why do I need to flash my device key?
Without your device only some functions can be reactivated, like x-reality. Other functions like widevine do not work with out your device key.
How do I enter TWRP recovery?
Restart your phone and press the volume key up as soon as the LED switches to yellow
I want to use a custom kernel with the DRM fix
Just say "N" to all other options. Nevertheless be prepared for problems if the custom kernel does not match your Android version.
What should I do if there is an update to this script?
First check if you really need to run this update by checking the changelog. E.g. if it says binary for Linux fixed and you are using Windows then probably you don't care. If you did not change your Android version then all you have to do is to update the kernel package with fastboot flash boot. If you do not use the automatic SuperSU integration then you have to reinstall SuperSU in TWRP.
This tool repacks an existing kernel package (usually the stock kernel) in order to make it rootable and adds TWRP recovery as well. Version 4 has been succesfully tested with LP and MM.
In particular it adresses the following issues:
DM-Verity: Android is now using dm-verity to verfy the integrity of the system partition. Until you switch it off your phone won't boot after modifying /system
SONY RIC: RIC is blocking the write access to the system partition
DRM Keys: After unlocking the bootloader your device key is wiped, which deactivates some functionaliy. E.g. x-reality, denoise in camera aso.
Recompiling the kernel is not required as only the init ramdisk needs to be modified. You can run these scripts either in Windows or Linux.
Thanks to the excellent work of zxz0O0 you can now backup the TA partition before unlocking the bootloader with this tool http://forum.xda-developers.com/crossdevice-dev/sony/iovyroot-temp-root-tool-t3349597
If you managed to backup your TA partition before you unlocked the bootloader then this version will fully reactivate your keys as well. (many thanks to addicted1900 for helping me with the testing)
As there has been some confusion I would like to point out one more time that you cannot run any kernel package which is not signed by Sony without unlocking the bootloader. So this works only with unlocked bootloader.
As it seems that it is not clear to everyone I also want to mention that <...> is a placeholder. E.g. <extracted kernel> means that you should replace it with then name of your extracted kernel, which could be kernel.elf
There was a report that having SuperSU in the system partition installed may lead to a bootloop. Therfore you shoud first install the bootimage created by this script and then install SuperSU afterwards, as it will then use the system-less strategy.
In order to use these scripts you need the kernel boot image of your current version. There two different ways to obtain it:
Method1:
If you have a .ftf image then open it with zip application (7Zip, WinZip, Windows Compressed Folder) and extract kernel.sin. Afterwards use Flashtool -> Tools -> SIN Editor to extract the kernel. You should end up with the boot image with extension .elf.
Method2:
Run your favourite recovery and connect via
Code:
adb -d shell
Now run
Code:
find /dev -name boot
dd if=<output of the find command before> of=/sdcard/kernel.img
Once you have the kernel image you are ready to use the script.
The newest version support superuser as an alternative to SuperSU. This is available open source and can be verified. In order to integrated you need the current superuser.zip from http://superuser.phh.me/superuser.zip and to be install the app afterwards from Google Play (look for superuser phh) or build it yourself from github.
To integrate the kernel part just place superuser.zip in the rootkernel directory.
You can also still use SuperSU, although it is causing a huge battery draining on my Z5 with Android 7.0 If you place SuperSU in the same directory (SuperSU*.zip, case sensitive) then it will be also installed automatically . It did all the tests with 2.76, but newer versions should work as well. Please be aware that you can not update SuperSU within the application. For a newer SuperSU version you need to rerun the script.
If you want to integrate xposed as well just place the distribution for you device and Android version in the same directory. (e.g. xposed-v86-sdk23-arm64.zip). Only support with Android 6.0 (sdk 23) and higher.
xPosed for Android 7.0+ is still not available.
Code:
rootkernel <extracted kernel> boot.img
You are prompted for several choices:
Sony RIC is enabled. Disable?
I prefer not to disable it in order to keep my phone more secure. Unfortunately there are a lot of bad guys in this world and SELinux and RIC still can save us if someone discovers a new kernel exploit.
Sony RIC basically prevents mounting the /system partition for write. You can still modify it in recovery of of course, but if you require write access to /system without entering recovery then you need to disable it.
Install TWRP recovery? Here you should say yes unless you are trying to patch a non-stock kernel, which comes already with a recovery
Install busybox? For security reasons I prefer not to install. In recovery you have it anyway. This choice is only available if you chose install TWRP
Found SuperSU-v....zip. Install? Integrates SuperSU. For this option to show up you have to place the SuperSU package into the same directory with the name SuperSU*.zip (case sensitive)
Found superuser.zip. Install? Integrates superuser. For this option to show up you have to place superuser.zip into the same directory (case sensitive)
# Make su permissive (Permits any action as su)? This only appears if you install superuser. Permissive means you can anything as root, without it is restricted mainly to file operations (sufficient for e.g. Titanium Backup)
Found xposed-v....zip. Install? Integrates xposed system-less. For this option to show up you have to place the xposed for your device and Android version into the same directory. (e.g. xposed-v86-sdk23-arm64.zip)
Install DRM fix? Installs the DRM fix. First it tries to use the device key which you flashed with flash_dk. If it does not exist it uses an alternative method which cannot fix everything (e.g. Widevine will not work, but X-reality, Camera denoise etc. will work)
Now put your phone into fastboot mode (Volume Up + connect USB) and then run:
To test it without actually flashing it:
Code:
fastboot boot boot.img
For flashing it:
Code:
fastboot flash boot boot.img
If you managed to backup for TA partition before then you can reactivate your original device key as follows:
Code:
flash_dk <ta backup image> DK.ftf
Flashing this file with flashtool will write your device key to an alternative unit, from where the drmfix library will pick it up.
This is a one-time task. It will survive a complete reset of the phone or Android system upgrade. The device key has a length of just 16 bytes, so it is correct that the resulting DK.ftf has a size of only aprox. 500 bytes.
If you like my work you can buy me a coffee
Some background information:
There are two main tools involved (for both Android and Windows)
- busybox
Probably everyone knows it
- bootimg
A multicall binary with several tools for unpacking and packing the boot image as well as adapting the SELinux policy. Part of the code is written by me from scratch, some other parts are cherry picked from other projects. I will also provide the source for it. As Windows doesn't have softlinks I modified the tools for unpacking and packing the init ramdisk to write text files with __lnk__ at the end instead.

Would be great if someone shared E6653 stock .200 kernel boot.img or flashable zip so we can try this out

Funkmasterchilla said:
Would be great if someone shared E6653 stock .200 kernel boot.img or flashable zip so we can try this out
Click to expand...
Click to collapse
Do you want the kernel.sin of stock . 200?

lordriguez said:
Do you want the kernel.sin of stock . 200?
Click to expand...
Click to collapse
I am downloading the whole firmware again from xperifirm. Thank you mate !
Edit: Working great! I'll stick to stock kernel now since Androplus' consumes more battery while asleep !
Edit2: I successfully flashed recoveries in command window from my PC but can't access TWRP at boot though, no LED flashing.
Edit3: Ok that's cuz there's no recovery boot script obviously, my bad. That's above my pay grade, if somebody is kind enough to create a stock. 200 with recoveries it'd be much appreciated PM me if so
Edit!: I flashed monx new stock based kernel
Thank you Tobias !

tobias.waldvogel said:
Hi everyone,
as most of you know, even after unlocking the bootloader there are a few more requirements before you can modify the system partition, i.e. install SuperSU, xposed etc.
- Android is now using dm-verity to verfy the integrity of the system partition. Until you switch it off your phone won't boot after modifying /system
- SONY RIC is blocking the write access to the system partition
The good news is, that it is not required to recompile the kernel. It is sufficent to modify the init scripts inside the init ram disk. So you can just stick to the stock kernel.
I created a package which precisely does this job for you. Just run it from TRWP after installing a new Android version
With this you don't have to wait anymore until someone creates the right kernel package for your phone
PS: It leaves a copy of the new boot image in the internal sdcard if you want to save it somewhere. (boot.img) It can be flashed with fastboot if required.
Click to expand...
Click to collapse
Hmm... I don't understand what this zip file do with phone.... Can you explain more primitive for me?!
Is that for recover stock kernel with stock drm keys?! I understand correct?!

zavpasha said:
Hmm... I don't understand what this zip file do with phone.... Can you explain more primitive for me?!
Is that for recover stock kernel with stock drm keys?! I understand correct?!
Click to expand...
Click to collapse
Before you can start to install thing like SuperSU and xposed you have to change the kernel, otherwise your phone won't boot anymore. In the past you had to wait for someone to come up with a compatible kernel for your phone, now this package just converts your existing kernel.
Regarding the DRM please install the package from the DRM restore thread.

Funkmasterchilla said:
I am downloading the whole firmware again from xperifirm. Thank you mate !
Edit: Working great! I'll stick to stock kernel now since Androplus' consumes more battery while asleep !
Edit2: I successfully flashed recoveries in command window from my PC but can't access TWRP at boot though, no LED flashing.
Edit3: Ok that's cuz there's no recovery boot script obviously, my bad. That's above my pay grade, if somebody is kind enough to create a stock. 200 with recoveries it'd be much appreciated PM me if so
Edit!: I flashed monx new stock based kernel
Thank you Tobias !
Click to expand...
Click to collapse
Thanks for the feedback. Future versions of this package will add TRWP as well. I am currently working on it.

tobias.waldvogel said:
Thanks for the feedback. Future versions of this package will add TRWP as well. I am currently working on it.
Click to expand...
Click to collapse
As promised the new package with TWRP is out

tobias.waldvogel said:
As promised the new package with TWRP is out
Click to expand...
Click to collapse
Great work thanks ,
How would I go about disabling the vibration for recovery?
Sent from my E6653 using Tapatalk

Well, the script which checks if recovery should be started is bin/init inside the zip. If you don't like the vibrate then just remove the line and run the package again
Gesendet von meinem E6683 mit Tapatalk

huh, so it is possible to have 2 recoveries at the same time? (and why would anyone want 2 recoveries? )

Three Recoveries are als possible
CWM, Phils Touch & TWRP
Sent from my E6653 @ XDA Portal

Sorry for being noob.
I miss my Oneplus one where things were so easy.
After unlocking BL what do i do with this zip.
Is it going to Root my phone and Install TWRP?
Thanks for help.

I flash the v2 and i got bootloop. 4 time red LED and the phone reboot and all over again. What's the problem?

Hi Tobias,
can you please build a v2 for the z5 compact too?
thx
stiffmeister

FakeSmile said:
I flash the v2 and i got bootloop. 4 time red LED and the phone reboot and all over again. What's the problem?
Click to expand...
Click to collapse
On which model did you use it and with which firmware version?
If you used flashtool before then you can just flash the kernel one more time (i.e. deselect everything else).

stiffmeister75 said:
Hi Tobias,
can you please build a v2 for the z5 compact too?
thx
stiffmeister
Click to expand...
Click to collapse
This should work on Z5 compact with stock kernel as well, without any change.
In case of any issues you can flash the kernel again via flashtool
If it did not work you can pass me the generated boot.img from your interal sdcard for further analysis

hi tobias,
i didn't try the v2, because i thought, that the twrp recovery wouldn't be compatible.
but when you say it's ok, than i'll try it
br
stiffmeister

stiffmeister75 said:
hi tobias,
i didn't try the v2, because i thought, that the twrp recovery wouldn't be compatible.
but when you say it's ok, than i'll try it
br
stiffmeister
Click to expand...
Click to collapse
I flashed zombie kernel without making backup of stock kernel, can you share it with me so I can try this method (I doubt it will work on zombie)
ps : I have .200 fw

tobias.waldvogel said:
On which model did you use it and with which firmware version?
If you used flashtool before then you can just flash the kernel one more time (i.e. deselect everything else).
Click to expand...
Click to collapse
E6653 on .200 firmware

Related

[RECOVERY][TWRP&CWM][Updated: 6-Feb-2013]Stock Kernel on Official Jellybean

Note: This has been deprecated in favour of LK for Xperia T
This kernel image is based on stock using the FreeXperia ramdisk method of loading stock and recovery. It also includes the new FOTA partition trick by Dees_Troy for easy updates in the future to TWRP.
Dees_Troy and I worked on figuring out the reason recovery binaries would not load on the stock kernel without patches, fixed this up in bionic, and rebuilt recovery linked against the fixed bionic.
F.A.Q
Q. The title says TWRP and CWM but when I boot recovery I only see TWRP. How do I get CWM?
A. TWRP is the default recovery, if you want CWM you should download the CWM update.zip in the second post and flash it with twrp.
Technical Info​
In 3.4 Qualcomm have changed the fb_var_screeninfo struct slightly. They have added an extra field called colorspace which increases the size of the stuct by __u32. When a binary linked against bionic tries to pass a struct the size of the old fb_var_screeninfo to kernelspace the application breaks as the kernel is expecting more data than it was given.
The patch to fix this in kernel solves the problem by removing one of the reserved fields, bringing the struct back to the same size it was prior to the new field being added. While this keeps compatibility with older recovery binaries, it does introduce the problem of needing a custom kernel to run recovery. Sony have not yet released source for 9.1.A.0.489 which means the kernel cannot be rebuilt without issues such as WiFi not working. The patch that Dees_Troy applied to the build system was to add the new colorspace field into the header for bionic which means the new recovery binary can run on an unmodified stock Sony kernel.
Flashing​
Boot device in fastboot mode:
Code:
adb reboot bootloader
Flash image with fastboot:
Code:
fastboot flash boot mint489stock.img
Source for TWRP available from here.​
Updates:
1. Updated image in first post to fix bug where creating a backup would fail and crash twrp.
2. Updated first post to show CWM in title and answer questions about how to get CWM.
Flashable zips:
In the first post it is mentioned about using the FOTAKernel trick by Dees_Troy to offer easy updates. The 2 zips attached to this post are examples of the ease of use.
flashCWM.zip - This will flash CWM to the FOTAKernel and replace TWRP as your recovery.
flashTWRP.zip - This will flash TWRP to the FOTAKernel and replace TWRP that is built into the image that was flashed to your device by fastboot, or to replace CWM with TWRP again if you used the flashCWM.zip
This also makes updates easier as you do not need to replace the kernel image you currently have flashed to your device.
Re: [RECOVERY][TWRP]Stock Kernel on Official Jellybean
Many thanks, can you just clear up one thing please, does Wi-Fi work on this image?
Sent from my LT30p xda premium app.
How do I customise the signature on xda premium app?
gregbradley said:
Many thanks, can you just clear up one thing please, does Wi-Fi work on this image?
Sent from my LT30p xda premium app.
How do I customise the signature on xda premium app?
Click to expand...
Click to collapse
Yes, wifi does work because it is just the stock kernel with TWRP added. I am running it right now with no problems.
I thought so, but I just wanted to make it obvious to all users as it was not 100% clear from the OP. I didnt have time to flash myself and check as I was just abbout to leave for work, now I am at work I will also flash it....
lilstevie said:
This kernel image is based on stock using the FreeXperia ramdisk method of loading stock and recovery. It also includes the new FOTA partition trick by Dees_Troy for easy updates in the future to TWRP.
Dees_Troy and I worked on figuring out the reason recovery binaries would not load on the stock kernel without patches, fixed this up in bionic, and rebuilt recovery linked against the fixed bionic.
Technical Info​
In 3.4 Qualcomm have changed the fb_var_screeninfo struct slightly. They have added an extra field called colorspace which increases the size of the stuct by __u32. When a binary linked against bionic tries to pass a struct the size of the old fb_var_screeninfo to kernelspace the application breaks as the kernel is expecting more data than it was given.
The patch to fix this in kernel solves the problem by removing one of the reserved fields, bringing the struct back to the same size it was prior to the new field being added. While this keeps compatibility with older recovery binaries, it does introduce the problem of needing a custom kernel to run recovery. Sony have not yet released source for 9.1.A.0.489 which means the kernel cannot be rebuilt without issues such as WiFi not working. The patch that Dees_Troy applied to the build system was to add the new colorspace field into the header for bionic which means the new recovery binary can run on an unmodified stock Sony kernel.
Flashing​
Boot device in fastboot mode:
Code:
adb reboot bootloader
Flash image with fastboot:
Code:
fastboot flash boot mint489stock.img
Source for TWRP available from here.​
Click to expand...
Click to collapse
Such a good news!I will port it to TX JellyBean firmware if you don' mind
gregbradley said:
I thought so, but I just wanted to make it obvious to all users as it was not 100% clear from the OP. I didnt have time to flash myself and check as I was just abbout to leave for work, now I am at work I will also flash it....
Click to expand...
Click to collapse
only for unlocked bl, correct?
hi,
i wanted to create with this version a backup, but it doesn't work.
it was just created the folder system,
the other folders such as data and boot not.
the created folder system, that was created after backup, is empty.
the 'backup' also takes only a few seconds, then the 'backup' is done.
what have i done?
installed the .img with instructions above.
boot xt into recovery, push backup, select system, data & boot, choose destination folder and start backup.
where is my failure?
hkjr said:
only for unlocked bl, correct?
Click to expand...
Click to collapse
Yes
MysticEnforcer said:
hi,
i wanted to create with this version a backup, but it doesn't work.
it was just created the folder system,
the other folders such as data and boot not.
the created folder system, that was created after backup, is empty.
the 'backup' also takes only a few seconds, then the 'backup' is done.
what have i done?
installed the .img with instructions above.
boot xt into recovery, push backup, select system, data & boot, choose destination folder and start backup.
where is my failure?
Click to expand...
Click to collapse
Same here....seems backup is not working
MysticEnforcer said:
the 'backup' also takes only a few seconds, then the 'backup' is done.
Click to expand...
Click to collapse
Updated first post with a fixed image.
Thank you very much, this is the best message of day.
Just flashed new image
Doing a backup and it seems to work...will update in few minutes when it is finished
EDIT:
It works
Backup complete in 385 seconds
FYI,
both times on rebooting system from recovery I initially got the grey triangle, both times it was only for 10-15 seconds before the phone rebooted...
Testing it now ....
Edit:
[Backup completed in 461 seconds] External SD card with compression on. No Grey triangle for me.
[Restore completed in 192 seconds] Restored backup without any problems. No grey triangle on second reboot either.
Seems to work great for me.
(only clock seems to be incorrect. 7 hours and 16 minutes behind)
Edit 2: thirth boot up seems to get stuck on grey triangle for about 15 seconds
Edit 3: Seems only the first time reboot after using the recovery the grey triangle is there. Rebooted the phone 4 times and only got the triangle 1 time.
Updated first and second post
USB storage does not work at all both on TWRP and CWM
tested 2nd version, works fine for me & no grey triangle :good:
romcio47 said:
USB storage does not work at all both on TWRP and CWM
Click to expand...
Click to collapse
Noticed that to
romcio47 said:
USB storage does not work at all both on TWRP and CWM
Click to expand...
Click to collapse
This appears to be more of a technical limitation.
The internal storage space is formatted ext4, so only linux would be able to mount that by default so it doesn't offer that.
With the MicroSD the issue seems to be a little more complex and may possibly need a custom kernel.
lilstevie said:
This appears to be more of a technical limitation.
The internal storage space is formatted ext4, so only linux would be able to mount that by default so it doesn't offer that.
With the MicroSD the issue seems to be a little more complex and may possibly need a custom kernel.
Click to expand...
Click to collapse
Thanks for the reply I guess we just have to wait for the kernel sources to be published
Besides another issue - in CWM wiping dalvik-cache does not work.
romcio47 said:
Besides another issue - in CWM wiping dalvik-cache does not work.
Click to expand...
Click to collapse
I can't reproduce this, if I wipe dalvik-cache in CWM it removes /data/dalvik-cache as it should.

[MM] [Flashable] Patcher to provide root access without /system modification

This patcher is now outdated. Use the new SuperSU instead. http://forum.xda-developers.com/showpost.php?p=64161125&postcount=3
This zip is a systemless version. That means that you'll get root and be able to use it normally, but your system partition will not be modified, like in normal root methods. Only for Marshmallow.
Keep reading for disadvantages and advantages
Chainfire had released a newer version of his SuperSU that doesn't need to modify the system partition to provide root access. This method doesn't have much of a practical application right now, but it allows you to flash OTA updates without having to unroot or flash the stock system partition.
HOW TO USE:
If you have rooted before, flash the system partition (or reinstall the ROM) before flashing this zip.
Download the attached zip, and flash it from a recovery (I tested it with TWRP).
Download SuperSU 2.56 from here: http://forum.xda-developers.com/showpost.php?p=63197935&postcount=2 (Just download the apk)
Reboot to TWRP. If it asks you whether you want system to be mounted as r/w, and if you want to take OTAs later, choose to keep system read-only (this will replace TWRP with stock recovery on reboot).
Flash SuperSU-v2.56-20151030013730.zip
Reboot
TWRP will say that you are not rooted, just ignore that. Do not tell it to root it.
This will work with all Marshmallow kernels, even the stock kernel.
Drawback : A factory data reset will remove superuser privileges. If that happens, simply flash SuperSU-v2.56-20151030013730.zip again.
TO RECEIVE OTA UPDATES :
Just make sure not to do anything that modifies /system. For example, no build.prop changes, and no system app removal. Or even if you do these, make sure to undo these changes before flashing an OTA. You can flash OTAs without unrooting now.
Flash the stock boot.img for your current Android version before flashing OTAs.
BUGS :
I didn't find any, yet, but Chainfire wrote the following on his thread:
Apps with hardcoded paths to su (seriously?) will bork
Factory reset unroots
Factory reset wipes pin
...
Bugs... Bugs everywhere!
ADDITIONAL INFO :
This zip will replace sepolicy as mentioned on Chainfire's thread (thanks to @metaspook for the patched sepolicy, which I extracted from his zip), so you'll be able to get root access even on SELinux enforcing kernels (only the stock MM kernels right now). Also, you can flash any other kernel (as long as it comes in a zip format, not as an img) before or after flashing this, and you'll still have root access.
out386 said:
Chainfire had released a newer version of his SuperSU that doesn't need to modify the system partition to provide root access. This method doesn't have much of a practical application right now, but it allows you to flash OTA updates without having to unroot or flash the stock system partition.
HOW TO USE:
Download the attached zip, and flash it from a recovery (I tested it with TWRP).
Download SuperSU 2.56 (or newer, if it supports systemless mode) from here: http://forum.xda-developers.com/showpost.php?p=63197935&postcount=2 (Just download the apk)
Flash SuperSU-v2.56-20151030013730.zip
Reboot
This will work with all Marshmallow kernels, even the stock kernel.
Drawback : A factory data reset will remove superuser privileges. If that happens, simply flash SuperSU-v2.56-20151030013730.zip again.
TO RECEIVE OTA UPDATES :
Just make sure not to do anything that modifies /system. For example, no build.prop changes, and no system app removal. Or even if you do these, make sure to undo these changes before flashing an OTA. You can flash OTAs without unrooting now.
Flash the stock boot.img for your current Android version before flashing OTAs.
BUGS :
I didn't find any, yet, but Chainfire wrote the following on his thread:
Apps with hardcoded paths to su (seriously?) will bork
Factory reset unroots
Factory reset wipes pin
...
Bugs... Bugs everywhere!
ADDITIONAL INFO :
This zip will replace sepolicy as mentioned on Chainfire's thread (thanks to @metaspook for the patched sepolicy, which I extracted from his zip), so you'll be able to get root access even on SELinux enforcing kernels (only the stock MM kernels right now). Also, you can flash any other kernel (as long as it comes in a zip format, not as an img) before or after flashing this, and you'll still have root access.
Click to expand...
Click to collapse
Well done bro!
I'm just waiting for this
Help regarding installation
I am using MicroMax Android One with Marshmallow
Currently, I've not tired the phone.
When I open recovery, I see some options like Apply update from SD card, mount, cache wipe, factory reset, etc.
So which option should I use to flash the zip file.
out386 said:
Chainfire had released a newer version of his SuperSU that doesn't need to modify the system partition to provide root access. This method doesn't have much of a practical application right now, but it allows you to flash OTA updates without having to unroot or flash the stock system partition.
HOW TO USE:
Download the attached zip, and flash it from a recovery (I tested it with TWRP).
Download SuperSU 2.56 (or newer, if it supports systemless mode) from here: http://forum.xda-developers.com/showpost.php?p=63197935&postcount=2 (Just download the apk)
Flash SuperSU-v2.56-20151030013730.zip
Reboot
This will work with all Marshmallow kernels, even the stock kernel.
Drawback : A factory data reset will remove superuser privileges. If that happens, simply flash SuperSU-v2.56-20151030013730.zip again.
TO RECEIVE OTA UPDATES :
Just make sure not to do anything that modifies /system. For example, no build.prop changes, and no system app removal. Or even if you do these, make sure to undo these changes before flashing an OTA. You can flash OTAs without unrooting now.
Flash the stock boot.img for your current Android version before flashing OTAs.
BUGS :
I didn't find any, yet, but Chainfire wrote the following on his thread:
Apps with hardcoded paths to su (seriously?) will bork
Factory reset unroots
Factory reset wipes pin
...
Bugs... Bugs everywhere!
ADDITIONAL INFO :
This zip will replace sepolicy as mentioned on Chainfire's thread (thanks to @metaspook for the patched sepolicy, which I extracted from his zip), so you'll be able to get root access even on SELinux enforcing kernels (only the stock MM kernels right now). Also, you can flash any other kernel (as long as it comes in a zip format, not as an img) before or after flashing this, and you'll still have root access.
Click to expand...
Click to collapse
Good work n thanks for mention bt can't understand why u created a patcher again where I'v already created one!
Its ok, good job.
Good.... Thanks for posting
metaspook said:
Good work n thanks for mention bt can't understand why u created a patcher again where I'v already created one!
Its ok, good job.
Click to expand...
Click to collapse
Yes, well, I would never have reposted the same thing, so, I'm sorry if it seemed like that.
This one uses Chainfire's new systemless root method. Unlike other root methods that need modifications to /system, this method uses modifications to the boot image to set up and run the su daemon from a loop device on the /data partition and achieve root. Right now, that doesn't have much of an advantage except to make flashing OTAs easier. Chainfire made it because future devices might need it. I made the patch because someone on FB asked about it.
<accidental double post, sorry. Can't delete>
kalpitandroid said:
I am using MicroMax Android One with Marshmallow
Currently, I've not tired the phone.
When I open recovery, I see some options like Apply update from SD card, mount, cache wipe, factory reset, etc.
So which option should I use to flash the zip file.
Click to expand...
Click to collapse
You need to install a custom recovery first. Go to the Android One (First generation) General forums on this site. You'll find a how-to at the very top of the list of threads. Once you have a custom recovery, flash this using the "install zip" option.
out386 said:
Yes, well, I would never have reposted the same thing, so, I'm sorry if it seemed like that.
This one uses Chainfire's new systemless root method. Unlike other root methods that need modifications to /system, this method uses modifications to the boot image to set up and run the su daemon from a loop device on the /data partition and achieve root. Right now, that doesn't have much of an advantage except to make flashing OTAs easier. Chainfire made it because future devices might need it. I made the patch because someone on FB asked about it.
Click to expand...
Click to collapse
Hmm... gotcha now.. Good work!
If u ever need any help just pm.
Thank you...
out386 said:
<accidental double post, sorry. Can't delete>
Click to expand...
Click to collapse

[ROOT][6.0][XT1097] Systemless root for Moto X 2014

Hello, everyone!
TL;DR: You're about to perform a systemless root installation on your phone so make sure you have uninstalled Xposed Framework, uninstalled root, the device's bootloader is unlocked and your phone's boot image is in its untouched stock state. Then boot into TWRP and install SuperSU-v.279-SR3 or newer.
UPDATE 2017-01-19:
- Provided missing bootloader information regarding root. Thanks, @Charlita for the heads-up!
- Moved TL;DR section to the top.
UPDATE 2017-01-15:
- SuperSU-v.279-SR3 learned how to use systemless mode as default flashing method for Motos. This is great news as the installation process now is just a matter of flashing the SuperSU installer. The segmentation fault had been fixed on SR2 and this version also includes that fix.
- Included a TL;DR section.
UPDATE 2016-12-25:
- SuperSU-v.279-SR1 contains a regression bug regarding the "segmentation fault". Skip this version for now. I've already contacted Chainfire.
- suhide: as the Chainfire himself stated, the tool is a losing game so I'm not putting any further effort here.
UPDATE 2016-11-03:
- As of SuperSU-v2.78-SR3 boot image patching works out-of-the-box. Just install it and you're done!
- TWRP version 3.x works as expected.
- Unfortunately, SafetyNet checking fails as Google constantly updates the server-side code.
- WIP: Check if Chainfire's suhide are able to help here.
UPDATE 2016-08-08:
- Added a backup reminder.
- Added flashable zip systemless_root_enabler_by_glauberlima.zip.
After a few days playing with it, I finally managed to perform a systemless root install for our beloved Moto X 2014
Benefits:
- Install OTA updates when they arrive;
- SafetyNet checking will pass so Android Pay can be used (not available in Brazil yet).
Requirements (links below) :
- Android 6 Marshmallow
- Bootloader must be unlocked otherwise you won't be able to root your phone;
- Boot partition must be in its original untouched stock state otherwise, SuperSU installer won't be able to patch it;
- System partition must be untouched as well but a simple uninstall of applications that have changed it should be enough. This step is not mandatory but if your system partition remains changed SafetyNet checking will fail;
- Your device must be unrooted. SuperSU has the option "Completly remove root". Use it;
- If you have Xposed Framework installed, uninstall it;
- You'll need ADB and Fastboot in order to flash stock boot.img if applicable;
- TWRP. Version 3.0.2-2 works just fine. If you prefer 2x series, I highly recommend version 2.8.7.1;
- SuperSU-v2.79-SR3 zip installer (or a newer version). DO NOT TRY AN OLDER VERSION. WILL NOT WORK;
Install guide:
- Make a Nandroid backup first using TWRP;
- Uninstall Xposed Framework if applicable;
- Uninstall SuperSU;
- Connect your device to your computer via USB;
- Reboot into bootloader:
Code:
adb reboot-bootloader
- Restore stock boot partition (you can skip this step if you already been on stock boot):
Code:
fastboot flash boot xt1097_boot_stock_with_may_2016_update.img
VERY IMPORTANT: The binary file boot xt1097_boot_stock_with_may_2016_update.img is device dependent. I have extracted stock boot.img from victara May 2016 update full ROM package and put it here. If you are trying on the other variants, make sure you will use the right image.
- Reboot into Recovery (TWRP);
- Flash the attached zip file systemless_root_enabler_by_glauberlima.zip. This will set both variables SYSTEMLESS=true and BINDSYSTEMXBIN=false. Without these variables set, SuperSU will fail to systemless root the device. Feel free if you want to manually enter the commands in the Command Prompt:
Code:
adb shell "echo SYSTEMLESS=true>/data/.supersu"
adb shell "echo BINDSYSTEMXBIN=false>>/data/.supersu"
- Install SuperSU and reboot system. If the first boot fails, just wait - the second will work I promise you!
- As soon as Android UI shows up you should be systemless rooted;
- Confirm SuperSU is installed by recognizing the green icon on your app drawer;
- Open up any root app you have. The world-famous Superuser permission request dialog should pop-up;
- Install SafetyNet Helper, in order to attest your Android, is passing Google's SafetyNet checking: https://play.google.com/store/apps/details?id=com.scottyab.safetynet.sample
Now you should be good. Congrats!
Go ahead and get some systemless apps:
- Systemless Xposed Framework
- Systemless Adaway
This procedure should work for the other variants too - all you need is the original boot.img
If you need any help feel free to ask.
Attached you can find the screenshots taken from my XT1097 after the procedure
Related links:
SuperSU-v2.79-SR3:
https://download.chainfire.eu/1021/SuperSU/SR3-SuperSU-v2.79-SR3-20170114223742.zip
Latest stable SuperSU:
http://download.chainfire.eu/supersu-stable
Systemless Xposed Framework:
http://forum.xda-developers.com/xposed/unofficial-systemless-xposed-t3388268
Systemless AdAway:
http://forum.xda-developers.com/showthread.php?t=2190753
Material Design Xposed Installer:
http://forum.xda-developers.com/xposed/material-design-xposed-installer-t3137758
Minimal ADB and Fastboot:
http://forum.xda-developers.com/showthread.php?t=2317790
TWRP for Moto X 2014:
http://forum.xda-developers.com/mot...recovery-twrp-2-8-0-0-touch-recovery-t2911523
Thanks:
@Chainfire
Even if I am on stock I have to flash boot*.img?
Sent from my XT1097 using Tapatalk
rtrotsky said:
Even if I am on stock I have to flash boot*.img?
Sent from my XT1097 using Tapatalk
Click to expand...
Click to collapse
Since your device already has the untouched stock boot you don't need to flash anything.
I seem to be having trouble installing the "Systemless Xposed". It errors out with - ! Failed: Unable to extract zip file!
I have verified "systemless root - ver 2.76" and tried re-downloading the zip. Any thoughts?
jbaumert said:
I seem to be having trouble installing the "Systemless Xposed". It errors out with - ! Failed: Unable to extract zip file!
I have verified "systemless root - ver 2.76" and tried re-downloading the zip. Any thoughts?
Click to expand...
Click to collapse
Could you provide your recovery.log from TWRP so we can see the detailed logging information?
You can pull it from your device by running the following command in command prompt:
Code:
adb shell cat /tmp/recovery.log | clip
This will copy recovery.log contents to the clipboard. Paste it into notepad then save and attach here.
glauberlima said:
Could you provide your recovery.log from TWRP?
You can pull it from your device by running the following command in command prompt:
Code:
adb shell cat /tmp/recovery.log | clip[code]
This will copy contents to the clipboard. Paste it in notepad then save and attach here.[/QUOTE]
This is pretty neat. Given what I read as the requirements am I correct this only works with stock ROM? (and test will only pass on stock).
Click to expand...
Click to collapse
vpxf said:
This is pretty neat. Given what I read as the requirements am I correct this only works with stock ROM? (and test will only pass on stock).
Click to expand...
Click to collapse
Hi @vpxf
The unmodified boot.img is a requirement for SuperSU as it tries to patch the boot image on-the-fly during the install process (by the time you flash it using TWRP). If the image is not in its original state, SuperSU will fail to install in systemless mode.
Regarding your question about custom ROMs compatibility I don't know if the SafetyNet checking will pass/fail. That's a good test to perform.
glauberlima said:
Could you provide your recovery.log from TWRP so we can see the detailed logging information?
You can pull it from your device by running the following command in command prompt:
Code:
adb shell cat /tmp/recovery.log | clip
This will copy recovery.log contents to the clipboard. Paste it into notepad then save and attach here.
Click to expand...
Click to collapse
I've attached the log. I did notice "unzip: zip flags 1 and 8 are not supported".
NOTE: I was able to flash the 85.7 version found in the second post of the "Systemless Xposed" thread. The newest 86.2 is the one giving me troubles.
As glauberlima found out in the other thread, you need to re-zip the xposed installer with 7-zip (that's what i used at least) and the install will work.
bertolehm said:
As glauberlima found out in the other thread, you need to re-zip the xposed installer with 7-zip (that's what i used at least) and the install will work.
Click to expand...
Click to collapse
jbaumert said:
I've attached the log. I did notice "unzip: zip flags 1 and 8 are not supported".
NOTE: I was able to flash the 85.7 version found in the second post of the "Systemless Xposed" thread. The newest 86.2 is the one giving me troubles.
Click to expand...
Click to collapse
As stated by @bertolehm I've discussed in the other posts the exactly same issue with the zip installer you have reported @jbaumert. Take a look at them:
http://forum.xda-developers.com/showpost.php?p=67792193&postcount=1193
http://forum.xda-developers.com/showpost.php?p=67805517&postcount=1233
Regarding your device being systemless rooted check with SafetyNet Helper Sample app. If everything turns green you are good
** Duplicated **
Thanks for the tutorial.
The first boot fails, ok ; but how long is the second boot ?
I wait a long time (around 15 minutes) blocked at the first screent (static moto logo) and I stop it, reboot and reinstall my backup. I panic a little
oyoyl said:
Thanks for the tutorial.
The first boot fails, ok ; but how long is the second boot ?
I wait a long time (around 15 minutes) blocked at the first screent (static moto logo) and I stop it, reboot and reinstall my backup. I panic a little
Click to expand...
Click to collapse
Which variant is your X?
glauberlima said:
Which variant is your X?
Click to expand...
Click to collapse
XT1092
oyoyl said:
XT1092
Click to expand...
Click to collapse
15 minutes... That's definitely too much.
I'm about to update this guide with my new findings so If you don't mind I'd like to suggest you this:
Repeat the steps but this time skip the update to latest version. After the reboot access SuperSU. It should display a message regarding your su needs update. Accept it.
Make sure your nandroid backup is up to date.
Same thing, but it's possible that my boot image is not up to date and I have no other boot backup to test.
I have only a complete backup (boot + system without root), perahps I'll try later with complete restore ...
Thanks
Something went wrong, the root works fine, but when I run the SafetyNet test, I got "CTS profile match: false", I just want to keep the OTA upgrades working, if I did something wrong, is there any way to unroot and do the systemless root again?? Thankss
Hi! Hey, I followed the steps and my MotoX got stuck when rebooting after flashing. I'm trying to enter fastboot with power+Volume down but no luck so far, any idea? I hope you can help me!
oyoyl said:
Same thing, but it's possible that my boot image is not up to date and I have no other boot backup to test.
I have only a complete backup (boot + system without root), perahps I'll try later with complete restore ...
Thanks
Click to expand...
Click to collapse
OK. Just leave a reply by the time you have the result of your test.
guilhermoaraujo said:
Something went wrong, the root works fine, but when I run the SafetyNet test, I got "CTS profile match: false", I just want to keep the OTA upgrades working, if I did something wrong, is there any way to unroot and do the systemless root again?? Thankss
Click to expand...
Click to collapse
One of your installed apps modified system partition. Did you test on a completly stock image?

Ramdisk Compression Exchanger - systemless SuperSU/root on non-gzipped ramdisks

Some of you might face the next error during systemless SuperSU install:
...
- Decompressing ramdisk
failed
--- Failure, aborting
*************************
IMPORTANT NOTICES
*************************
First reboot may take a
few minutes. It can also
...
This means that the ramdisk of your boot image was compressed in a non gzip format.
Unfortunately SuperSU can only decompress and tweak gzip compressed ramdisks up to now.
However i tried to make a little script that will uncompress your boot image/ramdisk and recompress it to gzip then after flashing SuperSU it recompresses the ramdisk to the original format.
This way one can achieve systemless root temporarily on such devices by installing SuperSU.
Idk maybe it can also be used for Magisk???
Download v1.1 (rce_univ.zip):
http://viid.me/qoESak
in case you face any proglems with the above version, try the old one v1.0 (rce_univ_1.0):
http://viid.me/qir1u5
How to:
Boot into TWRP 3.0.0 or above (never tested below) and install rce_univ.zip before and after SuperSU.zip!
Video: http://viid.me/quIbOi
Consider flashing Chainfire's Boot image signer (in case you get soft bricked after the above steps):
https://forum.xda-developers.com/an...signing-boot-images-android-verified-t3600606
Detailed description in comment nr.3 (https://forum.xda-developers.com/showpost.php?p=70428981&postcount=3)
Supported ramdisk compressions:
bzip2, lz4, lzo, lzma, xz
Requirements:
Unlocked bootloader on most newer (marshmallow and lollipop) devices
Don't expect it to be working on every device!
The script is basically fool proof. I mean if anything goes wrong it will promt you and quit.
Then you can simply restore your boot partition (if you didn't forget to back it up) and boot up normally and deal with the non rooted idea...
Also it's not supposed to mess up anything that would cost you a hard brick. Soft brick is only possible if you forget to make backup of your boot image or if you get SuperSU intalled and rec_univ.zip cannot recompress your ramdisk (this is pretty much impossible anyways)
Naturally there are those Samsung and Sony devices with some tricky boot images... idk. Never tested but most likely not gonna work.
Probably there will be many devices on which there are not enough space to decompress and recompress ramdisks/boot images in TWRP.
In comment nr. 2 i will collect the devices that are compatible with this script and the method itself.
If you can't find your device there as i said it's fool proof but you better be careful! You can simply test it by backing up your boot images between each install and with the mount mtp function you put it on PC (you can't quit TWRP during the whole process - i mean during step 2) and with carliv image kitchen (https://forum.xda-developers.com/android/development/tool-cika-carliv-image-kitchen-android-t3013658) you check if you can unpack them normally.
Or if you don't care so much you just try and the worst case you reflash your framework...
If you are about to post any errors or complains do it the right way:
- attach recovery.log
- describe your device (model name, firmware version, ...)
- attach your boot image you backed up (upload it somewhere and link it)
If you are about to post a succesful attempt of a not yet added device:
- describe your device (model name, firmware version, ...)
- maybe link to its thread
No promises... and no responsibility i take... !!!
Please don't upload it anywhere else just use link to this thread!
I have to say thanks jcadduono for LazyFlasher boot image patcher script i used for the ramdisk compression exchanger and also thanks goes to Chainfire for SuperSU (especially for the boot image finder srcipt which is took from the SuperSU installer).
The xz archiver was used from XZ Utility For Android by Tukaani http://tukaani.org/xz/ - i hope he doesn't mind. Let me know if he does!
Supported devices until now:
Lg K8 - https://forum.xda-developers.com/lg-k10/how-to/friendly-root-method-lg-k8-k10-t3531223
Lg K10 - https://forum.xda-developers.com/lg-k10/how-to/friendly-root-method-lg-k8-k10-t3531223
Note 4 n910v (7.1.1 rom) https://forum.xda-developers.com/showpost.php?p=72491391&postcount=18
Detailed description
Systemless root with SuperSU on devices with non gzip compressed ramdisk bootimage
0. Download rce_univ.zip from here: http://viid.me/qir1u5 and download SuperSU (latest or there are some cases that requires earlier versions): https://forum.xda-developers.com/apps/supersu/stable-2016-09-01supersu-v2-78-release-t3452703 and put them on your sd card (external sd card is usually necessary since sometimes TWRP cannot decrypt your data partition/internal sd).
1. Unlock your bootloader
1.1. Additional step for those who has no "...device corrupt..." message during every boot up after unlocking bootloader on Marshmallow and some Lollipop devices(*)
- Boot into TWRP
- on the keep system read only? screen of the TWRP let it allow modifications (swipe!)
- reboot to System
- from now on you should have the message at every boot up
2. Boot into TWRP
- cancel decrypt data
- keep system read only
- go to Backup -> Backup your boot image! Maybe it comes handy later.
- go back from backup to install and install rce_univ.zip right after install SuperSUxxx.zip and then rce_univ.zip again.
- do not wipe anything during and after this step, just reboot! (this might take a while and a few bootloops...)
Video guide: http://viid.me/quIbOi
(3.) Verified boot?
In case of soft brick (or if you're sure you need the proper signature in the end of your boot partition - cos your device has verified boot) try flashing Chainfire's Boot image signer as a very last step before rebooting from TWRP:
https://forum.xda-developers.com/an...signing-boot-images-android-verified-t3600606
(*) on some devices if there is no "device corrupt" message at every boot up after bootloader unlock then anything you do or change in your boot image or system partition your device will not boot up anymore but turning off right after showing you that device corrupt message.
but if you do that trick as written in step 1.1 and that message appears at every boot up then most likely you're goot to go...
You can find some video guides on my thread for the above steps: https://forum.xda-developers.com/lg-k10/how-to/friendly-root-method-lg-k8-k10-t3531223
Pricniple of the installer - rce_univ.zip
What the script does:
Install rce_univ.zip before SuperSU:
1. Finds the boot partition (same way as SuperSU)
2. Dumps the boot image and unpacks it
3. Determines the format the ramdisk was compressed in
4. Uncomresses it then recompresses to gzip (so SuperSU can handle it).
5. Repacks the boot image and flashes it back on boot partition
Here is where you install SuperSU
Install rce_univ.zip after SuperSU:
1. Finds the boot partition
2. Dumps the boot image and unpacks it
3. Reads back the original format of the ramdisk compression
4. Uncomresses it then recompresses the ramdisk with the original compression method(so now the device can handle it).
5. Repacks the boot image and flashes it back on boot partition
As about me:
I was not a complete noob when i started it however it took a lot of effort and time. If you care to understand a bit more what it's about and you want to follow my struggling this is where it started (you can click through the threads):
https://forum.xda-developers.com/apps/supersu/supersu-v2-66-installed-lz4-compressed-t3296508
didn't work at samsung galaxy S2, it only have 8Mb space at boot partition. any solution ?
edit i use LineageOS 14.1 (cm 14.1) android 7.1.1
haris1976 said:
didn't work at samsung galaxy S2, it only have 8Mb space at boot partition. any solution ?
edit i use LineageOS 14.1 (cm 14.1) android 7.1.1
Click to expand...
Click to collapse
Can attach recovery log? And maybe boot image that you backed up in TWRP
this recovery log
haris1976 said:
this recovery log
Click to expand...
Click to collapse
I can not fully open it (no editor can fully load it). Could you zip it and attach compressed or just attach again?
gottlasz said:
Can attach recovery log? And maybe boot image that you backed up in TWRP
Click to expand...
Click to collapse
back up boot from twrp
---------- Post added at 03:23 PM ---------- Previous post was at 03:05 PM ----------
gottlasz said:
I can not fully open it (no editor can fully load it). Could you zip it and attach compressed or just attach again?
Click to expand...
Click to collapse
maybe tommorow i have bad connection when upload recovery & boot with the zip
haris1976 said:
back up boot from twrp
---------- Post added at 03:23 PM ---------- Previous post was at 03:05 PM ----------
maybe tommorow i have bad connection when upload recovery & boot with the zip
Click to expand...
Click to collapse
Okay, you can send it in PM if you want...
gottlasz said:
Okay, you can send it in PM if you want...
Click to expand...
Click to collapse
recovery & boot
haris1976 said:
this recovery log
Click to expand...
Click to collapse
Now i could open the recovery log.
Unfortunately this part means that even if it's a 3.0.2 TWRP something is missing:
"- Found boot partition at: /dev/block/mmcblk0p5- Dumping & unpacking original boot image...WARNING: linker: /tmp/boot_repack/tools/armv7/unpackbootimg: unused DT entry: type 0x6ffffef5 arg 0x560"
Maybe you should try with a newer version of TWRP if there is one.
Or if you follow my older guide which was a manual unpacking and repaking with carliv image kitchen, that could work.
Check my old guide: https://forum.xda-developers.com/lg-k10/how-to/twrp-root-lg-k8-k350n-t3475807
Anyways give me until tomorrow, ill take a look at the script maybe i can avoid this error.
gottlasz said:
Now i could open the recovery log.
Unfortunately this part means that even if it's a 3.0.2 TWRP something is missing:
"- Found boot partition at: /dev/block/mmcblk0p5- Dumping & unpacking original boot image...WARNING: linker: /tmp/boot_repack/tools/armv7/unpackbootimg: unused DT entry: type 0x6ffffef5 arg 0x560"
Maybe you should try with a newer version of TWRP if there is one.
Or if you follow my older guide which was a manual unpacking and repaking with carliv image kitchen, that could work.
Check my old guide: https://forum.xda-developers.com/lg-k10/how-to/twrp-root-lg-k8-k350n-t3475807
Anyways give me until tomorrow, ill take a look at the script maybe i can avoid this error.
Click to expand...
Click to collapse
Same error for me on LG K8 4G Vodafone Spain (LGK350n, build MRA58K, MT6735, Android 6.0), i fix it change booting the TWRP image to k350n10f (k8_10f_twrp.img, https://forum.xda-developers.com/lg-k10/development/recovery-twrp-3-0-2-lg-k8-k350-mtk-t3517894). It avoid for me" Error: Unpacking boot image failed!- Aborting..."
Works like a charm!!! thanks to gottlasz and XDA group!
sorry for my english
You should recompile all the used binaries as static, that should avoid a lot of issues.
Also, don't bother with older Samsung (everything before S3) and older Sony devices (not really sure until when). These use non-standard boot images that are very tricky to patch without outright recompiling. It can be done - I have done it in the past - but it is a major hassle and very errorprone.
Chainfire said:
You should recompile all the used binaries as static, that should avoid a lot of issues.
Also, don't bother with older Samsung (everything before S3) and older Sony devices (not really sure until when). These use non-standard boot images that are very tricky to patch without outright recompiling. It can be done - I have done it in the past - but it is a major hassle and very errorprone.
Click to expand...
Click to collapse
Thank you Master!
I know about the compiling situation, however the problem is that i did not compile anything since the whole stuff is based on jcadduono's LazyFlasher. He compiled the binaries I only tweaked the script and added some stuff... i don't have the resources to compile. Now i'm collecting static binaries to exchange them in the installer in order to solve these compatibility issues.
Basically i just wanted to help some of those unfortunate as me who has lz4 or other compressed ramdisks and unable to intall SuperSU. Well..., at least a handful of them.
New version is up. A few TWRP related compatibility issues are solved.
gottlasz said:
New version is up. A few TWRP related compatibility issues are solved.
Click to expand...
Click to collapse
i test the new version but no luck
this is the recovery log
haris1976 said:
i test the new version but no luck
this is the recovery log
Click to expand...
Click to collapse
How far does supersu intaller goes?
I mean can it unpack your boot image?
Install only supersu and make a recovery log please.
I tried to unpack your boot image with carliv image kitchen and no luck...
I think supersu can't even unpack your boot image and then there is no chance to install it. Even if we could change the ramdisk compression...
Are you sure supersu intaller gives you the same error message as it is stated in the OP?
I believe you have a non standard boot image as chainfire talked about.
It works great on 7.1.1 roms on Note 4 n910v. Thanks!

How can I make changes to /system in nougat?

Quick summary, I can not:
mount -o remount,rw /system in normal mode even with root permission. Error is "Device busy"
modify files in /system in twrp and keep it persistent. It somehow roll back to the stock state after reboot into normal mode.
I'm a long-time linux user, and fairly familiar with rooting in pre-nougat versions. My previous phone is Oneplus-X in LineageOS-14, and I could do whatever I like with the system partition. Recently I received a P9 as present. I updated the rom to B377 and flashed OldDroid's TWRP-3.1.0+phh su. But I can not find a way to modify the /system partition. I need to change a lot of things, like /system/etc/hosts, adding apk into /system/priv-app, etc.
Could someone help?
ccaappton said:
Quick summary, I can not:
mount -o remount,rw /system in normal mode even with root permission. Error is "Device busy"
modify files in /system in twrp and keep it persistent. It somehow roll back to the stock state after reboot into normal mode.
I'm a long-time linux user, and fairly familiar with rooting in pre-nougat versions. My previous phone is Oneplus-X in LineageOS-14, and I could do whatever I like with the system partition. Recently I received a P9 as present. I updated the rom to B377 and flashed OldDroid's TWRP-3.1.0+phh su. But I can not find a way to modify the /system partition. I need to change a lot of things, like /system/etc/hosts, adding apk into /system/priv-app, etc.
Could someone help?
Click to expand...
Click to collapse
Hopefully this might help:
1. revert back to unmodified boot image (in TWRP flash from here[/URL or restore your backup from the unmodified boot image] , leave anything else untouched (especially TWRP 3.1.0-0 for EMUI 5)
2. flash this [URL="https://forum.xda-developers.com/showpost.php?p=71588837&postcount=102"]SuperSU image in TWRP (read the comments in the post please ... single bootloop ... then everything is ok and rooted)
3. install JRummy's BusyBox from Google Play (Stephen's won't work)
You are done and good to modify /system.
Note: resulting earthquakes, thunderstorms and spring floods from this work are solely under your own responsibility :laugh:
hakaz said:
Hopefully this might help:
1. revert back to unmodified boot image (in TWRP flash from here[/URL or restore your backup from the unmodified boot image] , leave anything else untouched (especially TWRP 3.1.0-0 for EMUI 5)
2. flash this [URL="https://forum.xda-developers.com/showpost.php?p=71588837&postcount=102"]SuperSU image in TWRP (read the comments in the post please ... single bootloop ... then everything is ok and rooted)
3. install JRummy's BusyBox from Google Play (Stephen's won't work)
You are done and good to modify /system.
Note: resulting earthquakes, thunderstorms and spring floods from this work are solely under your own responsibility :laugh:
Click to expand...
Click to collapse
1. I did a backup of boot partition before phh root, so should be able to restore the backup, instead of download the boot partition from others?
2. Is systemless supersu binaries need be individualized for every phone? Can I download systemless supersu from somewhere more semi-official? I'm not exactly comfortable installing zips from random links. ()
Ad 1. Till now rooting on our P9 works through injection of the su mounting routine into the kernel in boot section (if using a modified kernel + su installation or modifying the kernel during su installation itself doesn't make a difference). So any su installation modifies the boot section and you mess things up if you try to install another su on top of the other. Therefore reverting to the original boot image is mandatory before installation of another su.
Ad 2. The su is compiled against different platforms​ not phones (in our case arm64). So @Chainfire has the different platform variations in his package. The "shady" package in our case is basically the v2.79 stable version of 12/20 2016 (you can unpack both packages and compare them against each other, they are bit for bit equal) but has an P9 specific injection routine to modify the kernel. After installation you have pure su v2.79 stable on board - not more, not less.
Sorry, "normal" SuperSU packages won't work due to lacking the kernel modification (phh uses a modified kernel instead you have to flash separately on P9).
Cheers!
hakaz said:
Ad 1. Till now rooting on our P9 works through injection of the su mounting routine into the kernel in boot section (if using a modified kernel + su installation or modifying the kernel during su installation itself doesn't make a difference). So any su installation modifies the boot section and you mess things up if you try to install another su on top of the other. Therefore reverting to the original boot image is mandatory before installation of another su.
Ad 2. The su is compiled against different platforms​ not phones (in our case arm64). So @Chainfire has the different platform variations in his package. The "shady" package in our case is basically the v2.79 stable version of 12/20 2016 (you can unpack both packages and compare them against each other, they are bit for bit equal) but has an P9 specific injection routine to modify the kernel. After installation you have pure su v2.79 stable on board - not more, not less.
Sorry, "normal" SuperSU packages won't work due to lacking the kernel modification (phh uses a modified kernel instead you have to flash separately on P9).
Cheers!
Click to expand...
Click to collapse
Thanks buddy! I flashed systemless supersu, and stucked in infinite bootloop(it is only once in your post), probably because my model is EVA-AL00. I have to restore the previous boot.img.
ccaappton said:
Quick summary, I can not:
mount -o remount,rw /system in normal mode even with root permission. Error is "Device busy"
modify files in /system in twrp and keep it persistent. It somehow roll back to the stock state after reboot into normal mode.
I'm a long-time linux user, and fairly familiar with rooting in pre-nougat versions. My previous phone is Oneplus-X in LineageOS-14, and I could do whatever I like with the system partition. Recently I received a P9 as present. I updated the rom to B377 and flashed OldDroid's TWRP-3.1.0+phh su. But I can not find a way to modify the /system partition. I need to change a lot of things, like /system/etc/hosts, adding apk into /system/priv-app, etc.
Could someone help?
Click to expand...
Click to collapse
Same here with Oneplus 3T.
I just posted in another post (Google Pixel).
There I just guess it was a new encription way, now Im sure, all three devices with Android 7.1.1.....

Categories

Resources