Question Fork Magisk for Vivo Devices - Vivo X70 Pro+

This post seeks attention of Senior XDA developers who are contributors of Magisk:
I have been struggling to fix Magisk mount and SU execution on VIVO devices.
Magisk issue #5148
VIVO/iQOO kernel restictions: "Operation not permitted" when executing `su` or mounting to `/system`, or bootloops if rooted · Issue #5148 · topjohnwu/Magisk
Device: iQOO Z1/VIVO X70 PRO/iQOO NEO3, and more Android version: N/A Magisk version name: N/A Magisk version code: N/A, but more serious since 24302 Magisk fails to mount /system on some Vivo/iQOO...
github.com
I am ready to work together to the best of my technical capacity.
I will pay for your test device and a special bounty for your hard work and development efforts.
Interested developers please reach out to me.

Actual problem is on Vivo devices only. Tested on Vivo Y33s and Y21.
When you call su, it returns: "Operation not permitted"
Trying to run /dev/xxxx/Magisk --daemon: "No daemon is currently running"
Previous attempts:
Problem seems to be SELinux policy, if you attempt to manually run from android debug builds, then the daemon is properly loaded.
2109:/dev/9Lgz # ./supolicy --magisk
Load policy from: /sys/fs/selinux/policy
2109:/dev/9Lgz # magisk --daemon
2109:/dev/9Lgz # magisk --path
/system/bin
2109:/dev/9Lgz # su
2109:/dev/9Lgz # id
uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),1078(ext_data_rw),1079(ext_obb_rw),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:magisk:s0
With this solution, the problem is that we need to run this from "adb root" shell after every boot.
Is there any way to run this locally on a the device having debug build?

Where should I post this thread to find the right developers to solve this problem?
I would highly appreciate some help here.

Maybe you can try change 'su' to 'suu' or 'timesu', as the [ref](http://bbs.ydss.cn/thread-1528844-1-1.html) said.
Good luck and success to you!

JuanLv said:
Maybe you can try change 'su' to 'suu' or 'timesu', as the [ref](http://bbs.ydss.cn/thread-1528844-1-1.html) said.
Good luck and success to you!
Click to expand...
Click to collapse
I tried but no luck (

Looking for developers who have good knowledge of Magisk mount and magiskinit.

NextGenMagisk said:
Looking for developers who have good knowledge of Magisk mount and magiskinit.
Click to expand...
Click to collapse
The developer has made restrictions in the kernel as ref
| https://github.com/topjohnwu/Magisk/issues/5148#issuecomment-1167697477
Maybe we can make a workaround by kernel patch.
I'm not too familiar with these.
Do you have any idea?

JuanLv said:
The developer has made restrictions in the kernel as ref
| https://github.com/topjohnwu/Magisk/issues/5148#issuecomment-1167697477
Maybe we can make a workaround by kernel patch.
I'm not too familiar with these.
Do you have any idea?
Click to expand...
Click to collapse
Thanks for the update. Looks like this issue is not easy to fix and it depends on access to kernel sources for each device model. I am not familiar with Kernel patching.
My ideas are focused around leveraging debug builds to execute SU locally and then make it persist across reboots.

NextGenMagisk said:
Is there any way to run this locally on a the device having debug build?
Click to expand...
Click to collapse
vivo y31, LineageOS 19.1, userdebug
magisk 24.3 can inject code in init.rc, can't mount /system /vendor /oem
magisk >24.3 can't inject code, because magisk switched to new method wich requires mounting /system. Zygisk is broken since 2431*
If you want to have adb root, then you can use phh-su(if you use gsi) and execute in termux
su -c setprop service.adb.root 1
su -c setprop service.adb.tcp.port 5555
su -c stop adbd
su -c start adbd
adb wait-for-device
adb shell whoami
Without phh-su you would need to split screen [termux + developer options/wifi debugging] and pair with code
one time in termux
adb pair localhostort code
no need to split screen anymore
then off -on wifi debugging
adb connect localhost:newport
adb root
off-on wifi debugging again
adb kill-server
adb connect localhost:newnewport
gz! you're root
Another way is to edit init.rc. Just look at magiskrc.inc from the source code.
I have no problems with zygisk and modules on 24.3 magisk. I just mounting overlayfs on top of /system and then just copy all modules into /system.
Here is my .rc script which I pushed in boot.img like this
./magiskboot unpack boot.img
./magiskboot cpio ramdisk.cpio 'add 0644 overlay.d/ofs.rc ofs.rc'
./magiskboot repack boot newboot.img
script
on load_persist_props_action
exec u:r:su:s0 -- /system/bin/mount -t overlay overlay -o lowerdir=/system,upperdir=/data/system/ou,workdir=/data/system/ow /system
on zygote-start
exec u:r:su:s0 -- /system/bin/mount /sbin/.magisk/zygisk/app_process32 /system/bin/app_process32
exec u:r:su:s0 -- /system/bin/mount /sbin/.magisk/zygisk/app_process64 /system/bin/app_process64
Then just create two folders
/data/system/ou
/data/system/ow
And copy modules files in upper layer(real system will not be modified)
su -c cp -r /sbin/.magisk/modules/*/system/* /system
If you need to revert changes then you can delete two folders and create them again. Or you can delete module files like this
cd /sbin/.magisk/modules/{Module Name}/system/
find -exec rm /system/{} \;
cd /data/system/ou
find . -type d -empty -delete
If you want to boot with real /system then just rename two folders

mount -t overlay
overlay on /system type overlay (rw,seclabel,relatime,lowerdir=/system,upperdir=/data/system/ou,workdir=/data/system/ow)
mount | grep " / "
/dev/block/dm-0 on / type ext4 (ro,seclabel,nodev,relatime,discard)

Pervokur said:
mount -t overlay
overlay on /system type overlay (rw,seclabel,relatime,lowerdir=/system,upperdir=/data/system/ou,workdir=/data/system/ow)
mount | grep " / "
/dev/block/dm-0 on / type ext4 (ro,seclabel,nodev,relatime,discard)
Click to expand...
Click to collapse
This is extremely helpful and has given me a very clear path to solve problems with Vivo root. I will implement these suggestions. Thanks a lot.

NextGenMagisk said:
This is extremely helpful and has given me a very clear path to solve problems with Vivo root. I will implement these suggestions. Thanks a lot.
Click to expand...
Click to collapse
Another tip from me. There is a way to have system rw for magisk root. At least it works for me on LOS19.1 userdebug gsi, vndklite variant, magisk24.3
Normaly
magisk-su: mount -o rw,remount /
operation not permitted
adb root:mount -o rw,remount /
ok
but / is still ro for magisk-su
Then I just kill surfaceflinger which leads to zygote restart(aka soft reboot)
su -c killall surfaceflinger
After booting / is rw for magisk-su and you can work with partition in file manager like Total Commander.

Pervokur said:
Another tip from me. There is a way to have system rw for magisk root. At least it works for me on LOS19.1 userdebug gsi, vndklite variant, magisk24.3
Normaly
magisk-su: mount -o rw,remount /
operation not permitted
adb root:mount -o rw,remount /
ok
but / is still ro for magisk-su
Then I just kill surfaceflinger which leads to zygote restart(aka soft reboot)
su -c killall surfaceflinger
After booting / is rw for magisk-su and you can work with partition in file manager like Total Commander.
Click to expand...
Click to collapse
Again a great tip, thanks!
I am currently testing your previous suggestions to inject custom init script on Y33s.

you can test this with adb root without editing boot.img or init.rc
NextGenMagisk said:
Again a great tip, thanks!
I am currently testing your previous suggestions to inject custom init script on Y33s.
Click to expand...
Click to collapse
adb shell
mount -t overlay overlay -o lowerdir=/system,upperdir=/data/system/ou,workdir=/data/system/ow /system
mount /sbin/.magisk/zygisk/app_process32 /system/bin/app_process32
mount /sbin/.magisk/zygisk/app_process64 /system/bin/app_process64
then restart zygote
killall surfaceflinger
zygote will restart, but mounts will still be there

Pervokur said:
you can test this with adb root without editing boot.img or init.rc
adb shell
mount -t overlay overlay -o lowerdir=/system,upperdir=/data/system/ou,workdir=/data/system/ow /system
mount /sbin/.magisk/zygisk/app_process32 /system/bin/app_process32
mount /sbin/.magisk/zygisk/app_process64 /system/bin/app_process64
Click to expand...
Click to collapse
mount overlay is working when executed from adb root.
but i cant get past the second step:
2109:/data/system/ow # mount /sbin/.magisk/zygisk/app_process32 /system/bin/app_process32
mount: '/sbin/.magisk/zygisk/app_process32'->'/system/bin/app_process32': No such file or directory
1|2109:/data/system/ow #
1|2109:/data/system/ow # mount /sbin/.magisk/zygisk/app_process64 /system/bin/app_process64
mount: '/sbin/.magisk/zygisk/app_process64'->'/system/bin/app_process64': No such file or directory
what must be causing this?

NextGenMagisk said:
mount overlay is working when executed from adb root.
but i cant get past the second step:
2109:/data/system/ow # mount /sbin/.magisk/zygisk/app_process32 /system/bin/app_process32
mount: '/sbin/.magisk/zygisk/app_process32'->'/system/bin/app_process32': No such file or directory
1|2109:/data/system/ow #
1|2109:/data/system/ow # mount /sbin/.magisk/zygisk/app_process64 /system/bin/app_process64
mount: '/sbin/.magisk/zygisk/app_process64'->'/system/bin/app_process64': No such file or directory
what must be causing this?
Click to expand...
Click to collapse
you didn't activate zygisk in magisk settings, so there are no files /sbin/.magisk/zygisk/app_process32
/sbin/.magisk/zygisk/app_process64

Pervokur said:
you didn't activate zygisk in magisk settings, so there are no files /sbin/.magisk/zygisk/app_process32
/sbin/.magisk/zygisk/app_process64
Click to expand...
Click to collapse
I cant enable it because Magisk daemon does not run at boot. Superuser tab in the app is greyed out.
testing this on a Vivo PD2147F debug build with Magisk patched boot and ofs.rc entry included.

NextGenMagisk said:
I cant enable it because Magisk daemon does not run at boot. Superuser tab in the app is greyed out.
testing this on a Vivo PD2147F debug build with Magisk patched boot and ofs.rc entry included.
Click to expand...
Click to collapse
even with magisk 24.3?

Pervokur said:
even with magisk 24.3?
Click to expand...
Click to collapse
Yes, patched magisk 24306. tmp dir with random name under /dev is created with root rights but the magic mount fails and hence the superuser tab is greyed out.
Magisk issue #5148
VIVO/iQOO kernel restictions: "Operation not permitted" when executing `su` or mounting to `/system`, or bootloops if rooted · Issue #5148 · topjohnwu/Magisk
Device: iQOO Z1/VIVO X70 PRO/iQOO NEO3, and more Android version: N/A Magisk version name: N/A Magisk version code: N/A, but more serious since 24302 Magisk fails to mount /system on some Vivo/iQOO...
github.com

Then you should manually add something like this to the end of init.rc
on load_persist_props_action
exec u:r:su:s0 -- /system/bin/mount -t overlay overlay -o lowerdir=/system,upperdir=/data/system/ou,workdir=/data/system/ow /system
on zygote-start
exec u:r:su:s0 -- /system/bin/mount /sbin/.magisk/zygisk/app_process32 /system/bin/app_process32
exec u:r:su:s0 -- /system/bin/mount /sbin/.magisk/zygisk/app_process64 /system/bin/app_process64
on post-fs-data
start logd
rm /dev/.magisk_unblock
start mqVxwb7J
wait /dev/.magisk_unblock 40
rm /dev/.magisk_unblock
service mqVxwb7J /sbin/magisk --post-fs-data
user root
seclabel u:r:magisk:s0
oneshot
service DC83jQtNHiJDw8 /sbin/magisk --service
class late_start
user root
seclabel u:r:magisk:s0
oneshot
on property:sys.boot_completed=1
start Zaw2TLXyH
service Zaw2TLXyH /sbin/magisk --boot-complete
user root
seclabel u:r:magisk:s0
oneshot

Related

Question : "magisk hide unable to watch hidelist" any way to fix?

i use oneplus 3 with OxygenOs 3.5.5 when i use the rom (stock) and install magisk and enable magisk hide it hides root and safetynet succeed and it unmounts
But when i start from the beginning on the stock rom and install RR on the rom (customrom) and full unroot and reinstall magisk and enable magisk hide and reboot i get this in the log and it doesn't unmount :
HTML:
MagiskHide: starting MagiskHide Daemon
MagiskHide: Unable to watch /magisk/.core/magiskhide/hidelist
any help please to get it to unmount and hide root ?
to know after i installed RR and full unrooted safetynet passed
ahmedsasker said:
i use oneplus 3 with OxygenOs 3.5.5 when i use the rom (stock) and install magisk and enable magisk hide it hides root and safetynet succeed and it unmounts
But when i start from the beginning on the stock rom and install RR on the rom (customrom) and full unroot and reinstall magisk and enable magisk hide and reboot i get this in the log and it doesn't unmount :
HTML:
MagiskHide: starting MagiskHide Daemon
MagiskHide: Unable to watch /magisk/.core/magiskhide/hidelist
any help please to get it to unmount and hide root ?
to know after i installed RR and full unrooted safetynet passed
Click to expand...
Click to collapse
Run the following commands in a terminal emulator:
Code:
su
cd /magisk/.core/magiskhide
sh disable
sh enable
You're probably gonna get an output that the hidelist can't be created because of a permissions issue. That probably means the Magisk image doesn't get mounted properly at boot.
Another user (@gunner007dc) that had this issue fixed it by using a different kernel.
Didgeridoohan said:
Run the following commands in a terminal emulator:
Code:
su
cd /magisk/.core/magiskhide
sh disable
sh enable
You're probably gonna get an output that the hidelist can't be created because of a permissions issue. That probably means the Magisk image doesn't get mounted properly at boot.
Another user (@gunner007dc) that had this issue fixed it by using a different kernel.
Click to expand...
Click to collapse
that is what i get and safetynet doesn't pass still ..
Code:
[email protected]:/magisk/.core/magiskhide # sh disable
MagiskHide: Stopping MagiskHide daemon
disable[27]: can't open /magisk/.core/magiskhide/hidelist: No such file or directory
1|[email protected]:/magisk/.core/magiskhide # sh enable
MagiskHide: Removing dangerous read-only system props
touch: '/magisk/.core/magiskhide/hidelist': Read-only file system
chmod: chmod '/magisk/.core/magiskhide' to 40755: Read-only file system
chmod: chmod 'rm' to 100755: Read-only file system
chmod: chmod 'list' to 100755: Read-only file system
chmod: chmod 'enable' to 100755: Read-only file system
chmod: chmod 'disable' to 100755: Read-only file system
chmod: chmod 'add' to 100755: Read-only file system
grep: /magisk/.core/magiskhide/hidelist: Bad file descriptor/magisk/.core/magiskhide/add[14]: [: 0: unexpected operator/operand
enable[65]: can't open /magisk/.core/magiskhide/hidelist: No such file or directory
MagiskHide: Starting MagiskHide daemon
to know without the magisk and have root removed with the custom rom the safetynet passes so what is wrong ?
if magisk doesn't get mounted properly how could i fix that ?
i tried to install another karnel whick support systemless root and i got bootloop maybe cuz of the custom rom RR so i can't install another karnel while the one i tried the only one i saw that support systemless root
please anyway to make magisk work ? (i tried the two versions under 12.0 too)
ahmedsasker said:
that is what i get and safetynet doesn't pass still ..
Code:
[email protected]:/magisk/.core/magiskhide # sh disable
MagiskHide: Stopping MagiskHide daemon
disable[27]: can't open /magisk/.core/magiskhide/hidelist: No such file or directory
1|[email protected]:/magisk/.core/magiskhide # sh enable
MagiskHide: Removing dangerous read-only system props
touch: '/magisk/.core/magiskhide/hidelist': Read-only file system
chmod: chmod '/magisk/.core/magiskhide' to 40755: Read-only file system
chmod: chmod 'rm' to 100755: Read-only file system
chmod: chmod 'list' to 100755: Read-only file system
chmod: chmod 'enable' to 100755: Read-only file system
chmod: chmod 'disable' to 100755: Read-only file system
chmod: chmod 'add' to 100755: Read-only file system
grep: /magisk/.core/magiskhide/hidelist: Bad file descriptor/magisk/.core/magiskhide/add[14]: [: 0: unexpected operator/operand
enable[65]: can't open /magisk/.core/magiskhide/hidelist: No such file or directory
MagiskHide: Starting MagiskHide daemon
to know without the magisk and have root removed with the custom rom the safetynet passes so what is wrong ?
if magisk doesn't get mounted properly how could i fix that ?
i tried to install another karnel whick support systemless root and i got bootloop maybe cuz of the custom rom RR so i can't install another karnel while the one i tried the only one i saw that support systemless root
please anyway to make magisk work ? (i tried the two versions under 12.0 too)
Click to expand...
Click to collapse
Looks like what for a strange reason /magisk is mounted as read-only. Try mount as rw:
Code:
mount -w -o remount /magisk
Deic said:
Looks like what for a strange reason /magisk is mounted as read-only. Try mount as rw:
Code:
mount -w -o remount /magisk
Click to expand...
Click to collapse
Code:
[email protected]:/ $ su
[email protected]:/ # mount -w -o remount /magisk
[email protected]:/ # cd /magisk/.core/magiskhide
[email protected]:/magisk/.core/magiskhide # she disable
sh: she: not found
127|[email protected]:/magisk/.core/magiskhide # sh disable
MagiskHide: Stopping MagiskHide daemon
disable[27]: can't open /magisk/.core/magiskhide/hidelist: No such file or directory
1|[email protected]:/magisk/.core/magiskhide # sh enable
MagiskHide: Removing dangerous read-only system props
touch: '/magisk/.core/magiskhide/hidelist': Read-only file system
chmod: chmod '/magisk/.core/magiskhide' to 40755: Read-only file system
chmod: chmod 'rm' to 100755: Read-only file system
chmod: chmod 'list' to 100755: Read-only file system
chmod: chmod 'enable' to 100755: Read-only file system
chmod: chmod 'disable' to 100755: Read-only file system
chmod: chmod 'add' to 100755: Read-only file system
grep: /magisk/.core/magiskhide/hidelist: Bad file descriptor/magisk/.core/magiskhide/add[14]: [: 0: unexpected operator/operand
enable[65]: can't open /magisk/.core/magiskhide/hidelist: No such file or directory
MagiskHide: Starting MagiskHide daemon
[email protected]:/magisk/.core/magiskhide #
I still get the same result ...
ahmedsasker said:
I still get the same result ...
Click to expand...
Click to collapse
If you type just:
Code:
su
mount
and look for a line that starts something like:
Code:
/dev/block/loop0 on /magisk
In the parenthesis at the end of the line, the text should start with "rw". Does it?
Didgeridoohan said:
If you type just:
Code:
su
mount
and look for a line that starts something like:
Code:
/dev/block/loop0 on /magisk
In the parenthesis at the end of the line, the text should start with "rw". Does it?
Click to expand...
Click to collapse
No it it does start with ro
Code:
/dev/block/loop0 on /magisk type ext4 (ro,seclabel,noatime,data=ordered)
ahmedsasker said:
No it it does start with ro
Code:
/dev/block/loop0 on /magisk type ext4 (ro,seclabel,noatime,data=ordered)
Click to expand...
Click to collapse
Ok. Next, try:
Code:
mount -o remount,rw /magisk
If that doesn't work, try:
Code:
mount -o remount,rw -t ext4 /dev/block/loop0 /magisk
Didgeridoohan said:
Ok. Next, try:
Code:
mount -o remount,rw /magisk
If that doesn't work, try:
Code:
mount -o remount,rw -t ext4 /dev/block/loop0 /magisk
Click to expand...
Click to collapse
I tried both and it keeps telling me that it is read-only
Code:
[email protected]:/ $ su
[email protected]:/ # mount -o remount,rw /magisk
'/dev/block/loop0' is read-only
ount -o remount,rw -t ext4 /dev/block/loop0 /magisk <
'/dev/block/loop0' is read-only
ahmedsasker said:
I tried both and it keeps telling me that it is read-only
Code:
[email protected]:/ $ su
[email protected]:/ # mount -o remount,rw /magisk
'/dev/block/loop0' is read-only
ount -o remount,rw -t ext4 /dev/block/loop0 /magisk <
'/dev/block/loop0' is read-only
Click to expand...
Click to collapse
Hm... I have no idea...
From your earlier posts I assume you've already uninstalled and reinstalled Magisk a few times, right? Have you tried an unofficial beta snapshot (both Magisk and the Manager)?
I still say you should try a different kernel. I don't know what you mean with "supports systemless root", but I'd try flashing a kernel like Elemental over the one that comes with RR and then install Magisk. Maybe even try installing and running Kernel Auditor, like it says in the link I posted earlier.
Didgeridoohan said:
Hm... I have no idea...
From your earlier posts I assume you've already uninstalled and reinstalled Magisk a few times, right? Have you tried an unofficial beta snapshot (both Magisk and the Manager)?
I still say you should try a different kernel. I don't know what you mean with "supports systemless root", but I'd try flashing a kernel like Elemental over the one that comes with RR and then install Magisk. Maybe even try installing and running Kernel Auditor, like it says in the link I posted earlier.
Click to expand...
Click to collapse
I meant that it was written that it supports systemless root in the XDA forums plus I tried to flash elementalx karnel and went into boot loop ...
I'll try the snapshot one now and thanks alot <3
ahmedsasker said:
I meant that it was written that it supports systemless root in the XDA forums plus I tried to flash elementalx karnel and went into boot loop ... How can I uninstall the elementalx karnel to try another one without reflashing the whole rom ?
I'll try the snapshot one now and thanks alot <3
Click to expand...
Click to collapse
Dirty flash the ROM or open up the ROM zip, extract the boot.img and flash that in TWRP.
Didgeridoohan said:
Dirty flash the ROM or open up the ROM zip, extract the boot.img and flash that in TWRP.
Click to expand...
Click to collapse
OMG thanks alot it works well now and passes with the snapshot version <3
thanks again x3
Didgeridoohan said:
Dirty flash the ROM or open up the ROM zip, extract the boot.img and flash that in TWRP.
Click to expand...
Click to collapse
please do you know compatible version of systemless xposed with snapshot magisk ! cuz latest v87 after I flash it, closed installer says that there's not framework installed but normal official one works
systemless xposed v87 was working fine on magisk v12
i installed the official one now and it is working very well
what is the difference between systemless xposed and the normal one ? (cuz both got caught by safety net)
ahmedsasker said:
please do you know compatible version of systemless xposed with snapshot magisk ! cuz latest v87 after I flash it, closed installer says that there's not framework installed but normal official one works
systemless xposed v87 was working fine on magisk v12
i installed the official one now and it is working very well
what is the difference between systemless xposed and the normal one ? (cuz both got caught by safety net)
Click to expand...
Click to collapse
It's very likely the Xposed Magisk module needs to be updated to work with v13... I don't use Xposed though, so I wouldn't know.
The difference between system and systemless xposed is that one is installed into system and the other one is systemless. :laugh: Seriously... That's the difference. They'll both trigger SafetyNet. Systemlessness is not about passing SafetyNet.
Didgeridoohan said:
Run the following commands in a terminal emulator:
Code:
su
cd /magisk/.core/magiskhide
sh disable
sh enable
You're probably gonna get an output that the hidelist can't be created because of a permissions issue. That probably means the Magisk image doesn't get mounted properly at boot.
Another user (@gunner007dc) that had this issue fixed it by using a different kernel.
Click to expand...
Click to collapse
In my device, no file in /magisk/...why?:crying::crying:
Hooxp17 said:
In my device, no file in /magisk/...why?:crying::crying:
Click to expand...
Click to collapse
No idea. I can't see your device and I can't read your mind... Meaning: you've given very few details.
I'm gonna make a guess though: are you taking about the ".core" folder? It's a hidden folder, so if your file explorer isn't set to see hidden files and folders you won't see it.
If this is not your issue, give more details.
Didgeridoohan said:
Dirty flash the ROM or open up the ROM zip, extract the boot.img and flash that in TWRP.
Click to expand...
Click to collapse
Which ROM? How to Dirty Flash? I have G5 Plus
brandonsisco said:
Which ROM? How to Dirty Flash? I have G5 Plus
Click to expand...
Click to collapse
Uhm... That was a specific advice for a specific issue...
What's your issue?
Didgeridoohan said:
Run the following commands in a terminal emulator:
Code:
su
cd /magisk/.core/magiskhide
sh disable
sh enable
You're probably gonna get an output that the hidelist can't be created because of a permissions issue. That probably means the Magisk image doesn't get mounted properly at boot.
Another user (@gunner007dc) that had this issue fixed it by using a different kernel.
Click to expand...
Click to collapse
hello, i have a problem with magisk, so i found your post. but in the terminal emulator can't see this file.. can you help me?

[Pixel 3 android P ] how to use magisk to move file into /vendor partition

Hi everyone,
in pixel 2, I can get super su for adb shell, and can remount the system, /vendor partition
mount -o rw,remount -t auto /vendor
mount -o rw,remount -t auto /system
but in pixel 3 with magisk 18 or 19, I always fail to remount /vendor
blueline:/ # mount -o rw,remount -t auto /vendor
mount: '/dev/block/dm-1'->'/vendor': I/O error
I need to modify some file under/vendor/etc
I've disable Preserve AVB 2.0/dm-verity and Preserve forceencryption in advanced Settings from Magisk, unfortunately do no avail,
any idea is appreciated
misslebulletttttt said:
Hi everyone,
in pixel 2, I can get super su for adb shell, and can remount the system, /vendor partition
mount -o rw,remount -t auto /vendor
mount -o rw,remount -t auto /system
but in pixel 3 with magisk 18 or 19, I always fail to remount /vendor
blueline:/ # mount -o rw,remount -t auto /vendor
mount: '/dev/block/dm-1'->'/vendor': I/O error
I need to modify some file under/vendor/etc
I've disable Preserve AVB 2.0/dm-verity and Preserve forceencryption in advanced Settings from Magisk, unfortunately do no avail,
any idea is appreciated
Click to expand...
Click to collapse
This isn't working for me either. Tried with TWRP and regular module install. My changes to files on /vendor/etc just get overwritten. On magisk 18 and Pie.
If there's a Magisk mask active (modules magic mounting files) you might have issues if you want to do something other than systemless modifications.
The real partitions are found in /sbin/.magisk/mirror, you can try editing that. Or, editing in recovery (TWRP) should always work, since Magisk isn't active then.
loserinru said:
This isn't working for me either. Tried with TWRP and regular module install. My changes to files on /vendor/etc just get overwritten. On magisk 18 and Pie.
Click to expand...
Click to collapse
so do I, want to move some file to /vendor/etc, adb push definitely not working, so copy to /sdcard,
mount -o rw,remount -t auto /vendor
cp /sdcard/XXX /vendor,
however
mount -o rw,remount -t auto /vendor
always show mount: '/dev/block/dm-1'->'/vendor': I/O error,
tried with the movement in TWRP, but after booting into system, it's gone,
any other method to overcome ?
Didgeridoohan said:
If there's a Magisk mask active (modules magic mounting files) you might have issues if you want to do something other than systemless modifications.
The real partitions are found in /sbin/.magisk/mirror, you can try editing that. Or, editing in recovery (TWRP) should always work, since Magisk isn't active then.
Click to expand...
Click to collapse
Hi, I've copied the new file to sdcard, boot into TWRP, in TWRP do the file movement from sdcard to /vendor/etc with success, however, every time after booting into system, the modification is gone, same as the guy replied in the second thread,
any method for the movement is pretty appreciated
Magisk is not active in TWRP, so there's something else going on... Check /sbin/.magisk/mirror/vendor/etc if the modification is there, and take a look at the Magisk log (you'll need the Canary debug build for more verbose logging) if anything shows there.
Didgeridoohan said:
Magisk is not active in TWRP, so there's something else going on... Check /sbin/.magisk/mirror/vendor/etc if the modification is there, and take a look at the Magisk log (you'll need the Canary debug build for more verbose logging) if anything shows there.
Click to expand...
Click to collapse
I solved this by modifying the install script of Magisk,
if [ -z $KEEPVERITY ]; then
if $SYSTEM_ROOT; then
- KEEPVERITY=true
+ KEEPVERITY=false
ui_print "- System-as-root, keep dm/avb-verity"
else
KEEPVERITY=false
fi
fi
and install Magisk again in TWRP
this can help to disable dm-verity completely, now I can remount /vendor without I/O error
Didgeridoohan said:
If there's a Magisk mask active (modules magic mounting files) you might have issues if you want to do something other than systemless modifications.
The real partitions are found in /sbin/.magisk/mirror, you can try editing that. Or, editing in recovery (TWRP) should always work, since Magisk isn't active then.
Click to expand...
Click to collapse
Riiii I always do system edits threw twrp instead of Un mounting modules like viper and air audio plug-in and do systemless system edits threw the OS
Sent from my SM-J327P using Tapatalk

How To Guide How to make files in /system writable

How to make files in /system writable
In Android 12 and newer /system is mounted read-only can not be remounted read-write anymore.
Sometimes it's useful that one or more files in /system are writable (for example for develop tasks or for testing)
This can be implemented using Magisk (see How to change files in the directory /system for more details)
Example :
Make the file /system/etc/vimrc writable
Note:
In Android 12 /etc is a symbolic link to /system/etc.
Open a (adb) shell as user root and do
Bash:
# create a dummy Magisk module
#
mkdir -p /data/adb/modules/writable_system/system/etc
# copy the file that should be writable to the Magisk module directory
#
cp /system/etc/vimrc /data/adb/modules/writable_system/system/etc/
# make the file in the Magisk module directory writable
#
chmod +w /data/adb/modules/writable_system/system/etc/vimrc
Now reboot the phone.
After the reboot the file /system/etc/vimrc is writable by the user root, Example:
Code:
ASUS_I006D:/ # id
uid=0(root) gid=0(root) groups=0(root) context=u:r:magisk:s0
ASUS_I006D:/ #
ASUS_I006D:/ # ls -l /system/etc/vimrc
-rw-r--r-- 0 root root 3350 2022-11-04 11:36 /system/etc/vimrc
ASUS_I006D:/ # tail -2 /system/etc/vimrc
\ | wincmd p | diffthis
endif
ASUS_I006D:/ #
ASUS_I006D:/ # echo '" Test Comment' >>/system/etc/vimrc
ASUS_I006D:/ #
ASUS_I006D:/ # tail -2 /system/etc/vimrc
endif
" Test Comment
ASUS_I006D:/ #
Only the user root can access the directory /data/adb. Therefor the files configured using this approach are only writable by the user root.
To make a file in /system writable for non-root users use this method:
Open a (adb) shell and execute as user shell:
Bash:
#
# create a directory that is writable for the user shell
#
mkdir /data/local/tmp/writable_system
mkdir /data/local/tmp/writable_system/etc
#
# copy the file that should be writable to that directory
#
cp /system/etc/vimrc /data/local/tmp/writable_system/etc
The next commands must be executed as user root:
Bash:
# create dummy Magisk module
#
mkdir -p /data/adb/modules/writable_system/system/etc
#
# create a symbolic link to the file in the writable directory in the directory with the dummy Magisk module
#
ln -s /data/local/tmp/writable_system/etc/vimrc /data/adb/modules/writable_system/system/etc
Now reboot the phone.
After the reboot the file /system/etc/vimrc is writable by the user shell, Example:
Code:
ASUS_I006D:/ $ id
uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),1078(ext_data_rw),1079(ext_obb_rw),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid),3012(readtracefs) context=u:r:shell:s0
ASUS_I006D:/ $
ASUS_I006D:/ $ tail -2 /system/etc/vimrc
\ | wincmd p | diffthis
endif
ASUS_I006D:/ $
ASUS_I006D:/ $ echo '" Test Comment' >>/system/etc/vimrc
ASUS_I006D:/ $
ASUS_I006D:/ $ tail -2 /system/etc/vimrc
endif
" Test Comment
ASUS_I006D:/ $
Important:
The writable directory can also be in a sub directory in /sdcard. But be aware that /sdcard is mounted late in the boot process so it might be that the overwritten file in /system will be used by the OS when the bind mount points to a non-existent file if using a sub directory in /sdcard.
The changes to the file done using these methods are "persistent" as long as Magisk is installed in the boot partition.
To restore the file with the original contents after each new reboot of the phone without removing the writable config open a (adb) shell as user root and execute:
Bash:
#
# restore the file /data/adb/modules/writable_system/system/etc/vimrc from the original file /system/etc/vimrc
#
# this must be done before Magisk creates the bind mounts
#
echo "cp /system/etc/vimrc /data/adb/modules/writable_system/system/etc/vimrc">/data/adb/post-fs-data.d/restore_vimrc.sh
chmod 755 /data/adb/post-fs-data.d/restore_vimrc.sh
Now the file in the dummy Magisk module will be restored with the contents of the original file from /system after each reboot
To temporary access the original file from /system just stop the Magisk daemon, Example:
Code:
ASUS_I006D:/ # echo '"Test Test' >>/etc/vimrc
ASUS_I006D:/ #
ASUS_I006D:/ # tail -1 /etc/vimrc
"Test Test
ASUS_I006D:/ #
ASUS_I006D:/ # id
uid=0(root) gid=0(root) groups=0(root) context=u:r:magisk:s0
ASUS_I006D:/ #
ASUS_I006D:/ # magisk --stop
ASUS_I006D:/ #
ASUS_I006D:/ # id
uid=0(root) gid=0(root) groups=0(root) context=u:r:magisk:s0
ASUS_I006D:/ #
ASUS_I006D:/ # tail -1 /etc/vimrc
endif
ASUS_I006D:/ #
Note
Stopping the Magisk daemon will disable all bind mounts done by Magisk.
Restarting the Magisk daemon will not re-create the bind mount - to re-activate the bind mount for the writable file after stopping the Magisk daemon the phone must be rebooted.
To make more then one file writable in a sub directory in /system you can also replace the complete folder using these commands as user root:
Bash:
#
# make all files in /system/etc writable by the user root
#
mkdir -p /data/adb/modules/writable_system/system/etc/
cd /system/etc
find . | cpio -pdum /data/adb/modules/writable_system/system/etc/
touch /data/adb/modules/writable_system/system/etc/.replace
Now Magisk will replace the directory /system/etc with the directory /data/adb/modules/writable_system/system/etc after the next reboot
Notes
You should test these commands with a not important file like /system/etc/vimrc before changing important files.
It is NOT recommended to use this approach on productive phones.
See How to change any file or directory using Magisk for another approach to change files on read-only mounted filesystems.
Trouble Shooting
As always: If something does not work like expected check the Magisk log file /cache/magisk.log and also check the infos in this post.
Does this method require root on device?
FormulaSea said:
Does this method require root on device?
Click to expand...
Click to collapse
yes
Is there any method don't require root?
This looks interesting. Are you using OverlayFS for this? Looks like you did quite the research on this
Read-only is boring even as root. It's time for some RW baby
FormulaSea said:
Does this method require root on device?
Click to expand...
Click to collapse
I don't know a method to do this without root access.
But you can disable the root access in Magisk after implementing the changes . You could even uninstall tne Magisk app afterwards (but not the Magisk part from the boot partition)
regards
Bernd
lebigmac said:
This looks interesting. Are you using OverlayFS for this? Looks like you did quite the research on this
Read-only is boring even as root. It's time for some RW baby
Click to expand...
Click to collapse
I don't know what exactly you mean by "OverlayFS" - I use MagiskModules to modify files in /system and as far as I know Magisk used bind mounts to implement it.
>>Read-only is boring even as root.
Correct, but if you made the changes directly in /system, they would not survive the next OS upgrade.
One of the great advantages of this feature of Magisk is that it survives an OS upgrade - so as long as the change is compatible with the installed OS version, it only needs to be done once.
regards
Bernd
Thanks it worked on the audio folders on my 7t pro but didn't work on the boot animation folder. Both folders appear in the adb though with there files. Let me know op if you figure out how to do the boot animation folder it's moved to /my_product/ instead of /system/ I see that the my product folder and boot animation appear in the adb modules like the audio folder does and I swapped files the same way as with my audio modding but the changes for boot didn't take effect.
cbomb1337 said:
Thanks it worked on the audio folders on my 7t pro but didn't work on the boot animation folder. Both folders appear in the adb though with there files. Let me know op if you figure out how to do the boot animation folder it's moved to /my_product/ instead of /system/ I see that the my product folder and boot animation appear in the adb modules like the audio folder does and I swapped files the same way as with my audio modding but the changes for boot didn't take effect.
Click to expand...
Click to collapse
/my_product is not in the list of folders supported by Magisk so that may not work
Please post the output of these commands (executed as root user):
df -h
mount
ls -ald /*
ls -lZd /my_product
and a
ls -ldZ $( find /data/adb/modules/ )
and
cat /cache/magisk.log
(or attach the log file to the post if too big)
regards
Bernd
Here is this the correct log file. Thank you for responding to me.
cbomb1337 said:
Here is this the correct log file. Thank you for responding to me.
Click to expand...
Click to collapse
can you also post the output of the OS commands listed?
I Don't know how.
It didn't let me add the log here. Sorry that's it's cut and paste I tried a few termux commands to save a log but the were blank. I don't understand how to do it right.
Edit here I managed to upload the log to drive
https://drive.google.com/uc?id=1uWurf_462b5uLC_D21SFcgLcBWiXQZOn&export=download
bnsmb said:
can you also post the output of the OS commands listed?
Click to expand...
Click to collapse
Linefeeds are missing in that file so it's very hard to interpret the file contents correct
Can you do in a adb shell on the phone:
Bash:
(
set -x
set -v
su -
echo
df -h
echo
mount
echo
ls -ald /*
echo
ls -lZd /my_product
echo
ls -ldZ $( find /data/adb/modules/ )
echo
) > /sdcard/Download/oscmds.log 2>&1
then
Bash:
gzip /sdcard/Download/oscmds.log
and post / upload the file
/sdcard/Download/oscmds.log.gz
regards
Bernd
and
Here is the gzip I wasn't sure what was going on after entering that first command the termux was frozen for a few minutes. Also With the folders in the module folder and them being a copy of the original folder is it ok to delete them as a whole folder to remove the rw and revert it of needed. I tried it and didn't see any issues doing it but wanted to know if it reverted it properly and does deleting the module folders make me lose anything original that was in it or is my stock stuff safe because it's through magisk.
cbomb1337 said:
Here is the gzip I wasn't sure what was going on after entering that first command the termux was frozen for a few minutes. Also With the folders in the module folder and them being a copy of the original folder is it ok to delete them as a whole folder to remove the rw and revert it of needed. I tried it and didn't see any issues doing it but wanted to know if it reverted it properly and does deleting the module folders make me lose anything original that was in it or is my stock stuff safe because it's through magisk.
Click to expand...
Click to collapse
Looks like /my_product is a directory in the root filesystem but on the other hand there is a mount point called /mnt/vendor/my_product so I'm not sure about that.
If /my_product is really only a separate directory in the root filesystem the only method to change it is to manipulate the ramdisk used for booting the phone (only if the phone is using a ramdisk, of course).
Can you check if there are other directories called my_product:
find / -type d -name my_product 2>/dev/null
And, if there are any, compare the files in that directory with the files in the directory /my_product?
regards
Bernd
The only folder that has the same boot animation files is the /dev/ ones and the mnt one like you said.
It's all good if it can't be done i just found a magisk module before which works for flashing my boot animation
cbomb1337 said:
The only folder that has the same boot animation files is the /dev/ ones and the mnt one like you said.
Click to expand...
Click to collapse
Then it can't be done using the standard Magisk feature for making r/o mounted filesystems read-write.
cbomb1337 said:
It's all good if it can't be done i just found a magisk module before which works for flashing my boot animation
Click to expand...
Click to collapse
OK, do you have the URL?
And you could just check the contents of the zip file with the Magisk Module on how it's implemented
regards
Bernd
bnsmb said:
Then it can't be done using the standard Magisk feature for making r/o mounted filesystems read-write.
OK, do you have the URL?
And you could just check the contents of the zip file with the Magisk Module on how it's implemented
regards
Bernd
Click to expand...
Click to collapse
I read the module it mentions binding. I don't understand none of it :/ I upload the module here and removed the boot animation to make it small.
cbomb1337 said:
I read the module it mentions binding. I don't understand none of it :/ I upload the module here and removed the boot animation to make it small.
Click to expand...
Click to collapse
Cool -- that's the solution I also found in the meantime (and successfully tested it on my Zenfone 8)
In principle the module does for the bootanimation file what Magisk does if you replace some directories or files in /system
I will write a general HowTo how that works today or in the next days
regards
Bernd

Merlin /system RW, is this possible ? magisk & adb_root installed

Hi, can't have full access to /system folder with adb
Installed magisk OK
Installed magisk extension module 'adb_root' OK
Code:
adb root
adbd is already running as root
but when I try to delete :
Code:
adb shell rm - f /system/app/CloudService/CloudService.apk
receive Read-only file system
any help ?
Code:
adb shell
mount -o rw,remount /
/dev/block/dm-1 is read-only
Code:
adb disable-verity
verity cannot be disabled/enabled - USER build
tried 'systemrw_1.32' and 'systemrw_1.32_modded' with no success, the installation seems to have been just fine
then flashed the only file I found into /img folder with command :
Code:
fastboot flash super super_fixed.bin
but at the end, even if all is gone fine, the command give always same answer as read-only :
Code:
mount -o rw,remount /
/dev/block/dm-1 is read-only
is there a way to make MERLIN as /system RW ???
matteo555 said:
tried 'systemrw_1.32' and 'systemrw_1.32_modded' with no success, the installation seems to have been just fine
then flashed the only file I found into /img folder with command :
Code:
fastboot flash super super_fixed.bin
but at the end, even if all is gone fine, the command give always same answer as read-only :
Code:
mount -o rw,remount /
/dev/block/dm-1 is read-only
is there a way to make MERLIN as /system RW ???
Click to expand...
Click to collapse
With PixelExperienceRecovery. Mount system then with adb remuont it rw. It is mounted in mnt/system/system.

whoami: bad uid 0

I replaced old /system/bin/toybox with a new binary from http://landley.net/toybox/bin then I created symlinks with for i in $(./toybox); do ln -s toybox $i. There is su in symlinks.
Now I cannot open Magisk anymore, stuck at splash screen mask.
Also MiXplorer cannot browse root dirs.
With Terminal Emulator I can still browse root dirs.
If I type which su I get /sbin/su which is a symlink to /sbin/magisk.
I have not yet tried to reboot because I fear to get stuck, maybe it would repair by itself but who knows?
If I type whoami I get bad uid 0, after su shell I get bad uid 2000 and so on.
How can I restore root? I can access TWRP recovery.
how about /sbin/su -c unlink /system/bin/su or wherever you symlinked toybox applets?
are you sure that binary is actually a replacement including all android specific applets (like getevent) for built-in toybox?
why did you replace system files in first place if you're actually on Magisk and could just use systemless overlays instead?
If I try to unlink it says it's read-only file system. I could try to do it in recovery but I'm afraid to reboot...
What is strange is that which su points to /sbin/magisk, so it should not consider the other su symlink to toybox
Another thing I noticed is that new symlink to toybox created with my script are root both UID and GID, while existing ones are root UID and shell GID
Toybox binary is specific for my Android ARMv8 http://landley.net/toybox/downloads/binaries/0.8.9/toybox-aarch64.
You are right about systemless overlays.
aarch64 is only the cpu architecture, doesn't say anything about android.
how did you install toybox on read-only file system? remount -o,rw /
ok, however the arch is right for my Snap855, I tried other applets embedded in toybox, like factor, and they work.
I used MiXplorer to write to system, I gave it root permissions so it could work on it. Now MiX is unarmed and Terminal Emulator can only read into root dirs but not write.
quick check with my toybox yours is missing all android specific applets
Code:
:/ $ cd $HOME
:/data/user/0/jackpal.androidterm/app_HOME $ ls -la
total 780
drwxrwx--x 2 u0_a152 u0_a152 4096 2023-01-30 14:46 .
drwxr-x--x 6 u0_a152 u0_a152 4096 2023-01-28 01:58 ..
-rwx--x--x 1 u0_a152 u0_a152 783680 2023-01-30 14:24 toybox
:/data/user/0/jackpal.androidterm/app_HOME $ ./toybox --version
toybox 0.8.9
:/data/user/0/jackpal.androidterm/app_HOME $ toybox --version
toybox 0.7.6-android
:/data/user/0/jackpal.androidterm/app_HOME $ for i in $(toybox); do ./toybox | grep -qw $i || echo $i; done
chcon
dd
diff
expr
getenforce
getfattr
gzip
load_policy
lsof
modprobe
more
restorecon
runcon
sendevent
setenforce
setprop
start
stop
stty
tr
traceroute
traceroute6
you should reinstall stock toybox from TWRP backup.
edit: this might help
Code:
:/ $ ls -lZ /system/bin/toybox
-rwxr-xr-x 1 root shell u:object_r:toolbox_exec:s0 352532 2008-12-31 17:00 /system/bin/toybox
I renamed the old toybox, so I could restore it from recovery.
Btw, I get this with ls -lZ
-rwxr-xr-x 1 0 2000 ? 825176 2023-01-29 07:34 /system/bin/toybox
Seem to have lost context there.
Thanks for your quick replies.
either you're on Jelly bean or you lost secontext. repair with chcon
Code:
chcon u:object_r:toolbox_exec:s0 /system/bin/toybox
You are right, new toybox does not have specific Android applet, like chcon or restorecon.
So, please correct me if I'm wrong, I reboot in TWRP, restore old toybox.
Then should I run chcon / restorecon or reboot straight away?
I lost secontext in all root dirs /, /system, /vendor, /sdcard...
not sure what ROM you're talking about. maybe you used ls of wrong toybox?
Don't understand your answer, what ROM are you referring to?
If I ./"toybox old" restorecon I get restorecon: Needs 1 argument (see "restorecon --help")
If I restorecon I get toybox: Unknown command restorecon (see "toybox --help")
Please advise me if it's right to restore old toybox via TWRP and reboot to system or there's the need to chcon / restorecon, thanks
please give the output of
Code:
grep ro.build.fingerprint /system/build.prop /system*/system/build.prop
it's very unlikely you lost every secontext. either it never existed or you just can't view.
restorecon won't help you much. only restoring TWRP backup could restore secontext as it was before.
grep ro.build.fingerprint /system/build.prop
ro.build.fingerprint=Xiaomi/cepheus_eea/cepheus:10/QKQ1.190825.002/V11.0.9.0.QFAEUXM:user/release-keys
ro.build.fingerprint_real=Xiaomi/cepheus/cepheus:10/QKQ1.190825.002/20.7.2:user/release-keys/1593694646
so your ROM is stock ROM Android 10 it must have secontext of course. in case it's true you lost every secontext best is download cepheus_eea_global_images_V11.0.9.0.QFAEUXM_20200421.0000.00_10.0_eea_31715f4bd1.tgz and flash_all_except_storage.bat
(you can backup boot in TWRP beforehand and flash boot.emmc.win from fastboot right after)
edit: build.prop usually is in /system(_root)/system/build.prop on new devices, so most likely what you think is build.prop is just from the TWRP image used.
maybe you didn't mount System?
Resolved
Rebooted into TWRP, restored original toybox, deleted my symlinks, checked secontexts ok, rebooted to system, all fine.
Thank for your support
you can place toybox in /data/adb/modules/toybox/system/xbin/toybox, make a diff and only symlink missing applets in there.
then create modules.prop, reboot and done.

Categories

Resources