How To Guide How to make files in /system writable - ASUS ZenFone 8

How to make files in /system writable
In Android 12 and newer /system is mounted read-only can not be remounted read-write anymore.
Sometimes it's useful that one or more files in /system are writable (for example for develop tasks or for testing)
This can be implemented using Magisk (see How to change files in the directory /system for more details)
Example :
Make the file /system/etc/vimrc writable
Note:
In Android 12 /etc is a symbolic link to /system/etc.
Open a (adb) shell as user root and do
Bash:
# create a dummy Magisk module
#
mkdir -p /data/adb/modules/writable_system/system/etc
# copy the file that should be writable to the Magisk module directory
#
cp /system/etc/vimrc /data/adb/modules/writable_system/system/etc/
# make the file in the Magisk module directory writable
#
chmod +w /data/adb/modules/writable_system/system/etc/vimrc
Now reboot the phone.
After the reboot the file /system/etc/vimrc is writable by the user root, Example:
Code:
ASUS_I006D:/ # id
uid=0(root) gid=0(root) groups=0(root) context=u:r:magisk:s0
ASUS_I006D:/ #
ASUS_I006D:/ # ls -l /system/etc/vimrc
-rw-r--r-- 0 root root 3350 2022-11-04 11:36 /system/etc/vimrc
ASUS_I006D:/ # tail -2 /system/etc/vimrc
\ | wincmd p | diffthis
endif
ASUS_I006D:/ #
ASUS_I006D:/ # echo '" Test Comment' >>/system/etc/vimrc
ASUS_I006D:/ #
ASUS_I006D:/ # tail -2 /system/etc/vimrc
endif
" Test Comment
ASUS_I006D:/ #
Only the user root can access the directory /data/adb. Therefor the files configured using this approach are only writable by the user root.
To make a file in /system writable for non-root users use this method:
Open a (adb) shell and execute as user shell:
Bash:
#
# create a directory that is writable for the user shell
#
mkdir /data/local/tmp/writable_system
mkdir /data/local/tmp/writable_system/etc
#
# copy the file that should be writable to that directory
#
cp /system/etc/vimrc /data/local/tmp/writable_system/etc
The next commands must be executed as user root:
Bash:
# create dummy Magisk module
#
mkdir -p /data/adb/modules/writable_system/system/etc
#
# create a symbolic link to the file in the writable directory in the directory with the dummy Magisk module
#
ln -s /data/local/tmp/writable_system/etc/vimrc /data/adb/modules/writable_system/system/etc
Now reboot the phone.
After the reboot the file /system/etc/vimrc is writable by the user shell, Example:
Code:
ASUS_I006D:/ $ id
uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),1078(ext_data_rw),1079(ext_obb_rw),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid),3012(readtracefs) context=u:r:shell:s0
ASUS_I006D:/ $
ASUS_I006D:/ $ tail -2 /system/etc/vimrc
\ | wincmd p | diffthis
endif
ASUS_I006D:/ $
ASUS_I006D:/ $ echo '" Test Comment' >>/system/etc/vimrc
ASUS_I006D:/ $
ASUS_I006D:/ $ tail -2 /system/etc/vimrc
endif
" Test Comment
ASUS_I006D:/ $
Important:
The writable directory can also be in a sub directory in /sdcard. But be aware that /sdcard is mounted late in the boot process so it might be that the overwritten file in /system will be used by the OS when the bind mount points to a non-existent file if using a sub directory in /sdcard.
The changes to the file done using these methods are "persistent" as long as Magisk is installed in the boot partition.
To restore the file with the original contents after each new reboot of the phone without removing the writable config open a (adb) shell as user root and execute:
Bash:
#
# restore the file /data/adb/modules/writable_system/system/etc/vimrc from the original file /system/etc/vimrc
#
# this must be done before Magisk creates the bind mounts
#
echo "cp /system/etc/vimrc /data/adb/modules/writable_system/system/etc/vimrc">/data/adb/post-fs-data.d/restore_vimrc.sh
chmod 755 /data/adb/post-fs-data.d/restore_vimrc.sh
Now the file in the dummy Magisk module will be restored with the contents of the original file from /system after each reboot
To temporary access the original file from /system just stop the Magisk daemon, Example:
Code:
ASUS_I006D:/ # echo '"Test Test' >>/etc/vimrc
ASUS_I006D:/ #
ASUS_I006D:/ # tail -1 /etc/vimrc
"Test Test
ASUS_I006D:/ #
ASUS_I006D:/ # id
uid=0(root) gid=0(root) groups=0(root) context=u:r:magisk:s0
ASUS_I006D:/ #
ASUS_I006D:/ # magisk --stop
ASUS_I006D:/ #
ASUS_I006D:/ # id
uid=0(root) gid=0(root) groups=0(root) context=u:r:magisk:s0
ASUS_I006D:/ #
ASUS_I006D:/ # tail -1 /etc/vimrc
endif
ASUS_I006D:/ #
Note
Stopping the Magisk daemon will disable all bind mounts done by Magisk.
Restarting the Magisk daemon will not re-create the bind mount - to re-activate the bind mount for the writable file after stopping the Magisk daemon the phone must be rebooted.
To make more then one file writable in a sub directory in /system you can also replace the complete folder using these commands as user root:
Bash:
#
# make all files in /system/etc writable by the user root
#
mkdir -p /data/adb/modules/writable_system/system/etc/
cd /system/etc
find . | cpio -pdum /data/adb/modules/writable_system/system/etc/
touch /data/adb/modules/writable_system/system/etc/.replace
Now Magisk will replace the directory /system/etc with the directory /data/adb/modules/writable_system/system/etc after the next reboot
Notes
You should test these commands with a not important file like /system/etc/vimrc before changing important files.
It is NOT recommended to use this approach on productive phones.
See How to change any file or directory using Magisk for another approach to change files on read-only mounted filesystems.
Trouble Shooting
As always: If something does not work like expected check the Magisk log file /cache/magisk.log and also check the infos in this post.

Does this method require root on device?

FormulaSea said:
Does this method require root on device?
Click to expand...
Click to collapse
yes

Is there any method don't require root?

This looks interesting. Are you using OverlayFS for this? Looks like you did quite the research on this
Read-only is boring even as root. It's time for some RW baby

FormulaSea said:
Does this method require root on device?
Click to expand...
Click to collapse
I don't know a method to do this without root access.
But you can disable the root access in Magisk after implementing the changes . You could even uninstall tne Magisk app afterwards (but not the Magisk part from the boot partition)
regards
Bernd

lebigmac said:
This looks interesting. Are you using OverlayFS for this? Looks like you did quite the research on this
Read-only is boring even as root. It's time for some RW baby
Click to expand...
Click to collapse
I don't know what exactly you mean by "OverlayFS" - I use MagiskModules to modify files in /system and as far as I know Magisk used bind mounts to implement it.
>>Read-only is boring even as root.
Correct, but if you made the changes directly in /system, they would not survive the next OS upgrade.
One of the great advantages of this feature of Magisk is that it survives an OS upgrade - so as long as the change is compatible with the installed OS version, it only needs to be done once.
regards
Bernd

Thanks it worked on the audio folders on my 7t pro but didn't work on the boot animation folder. Both folders appear in the adb though with there files. Let me know op if you figure out how to do the boot animation folder it's moved to /my_product/ instead of /system/ I see that the my product folder and boot animation appear in the adb modules like the audio folder does and I swapped files the same way as with my audio modding but the changes for boot didn't take effect.

cbomb1337 said:
Thanks it worked on the audio folders on my 7t pro but didn't work on the boot animation folder. Both folders appear in the adb though with there files. Let me know op if you figure out how to do the boot animation folder it's moved to /my_product/ instead of /system/ I see that the my product folder and boot animation appear in the adb modules like the audio folder does and I swapped files the same way as with my audio modding but the changes for boot didn't take effect.
Click to expand...
Click to collapse
/my_product is not in the list of folders supported by Magisk so that may not work
Please post the output of these commands (executed as root user):
df -h
mount
ls -ald /*
ls -lZd /my_product
and a
ls -ldZ $( find /data/adb/modules/ )
and
cat /cache/magisk.log
(or attach the log file to the post if too big)
regards
Bernd

Here is this the correct log file. Thank you for responding to me.

cbomb1337 said:
Here is this the correct log file. Thank you for responding to me.
Click to expand...
Click to collapse
can you also post the output of the OS commands listed?

I Don't know how.

It didn't let me add the log here. Sorry that's it's cut and paste I tried a few termux commands to save a log but the were blank. I don't understand how to do it right.
Edit here I managed to upload the log to drive
https://drive.google.com/uc?id=1uWurf_462b5uLC_D21SFcgLcBWiXQZOn&export=download

bnsmb said:
can you also post the output of the OS commands listed?
Click to expand...
Click to collapse
Linefeeds are missing in that file so it's very hard to interpret the file contents correct
Can you do in a adb shell on the phone:
Bash:
(
set -x
set -v
su -
echo
df -h
echo
mount
echo
ls -ald /*
echo
ls -lZd /my_product
echo
ls -ldZ $( find /data/adb/modules/ )
echo
) > /sdcard/Download/oscmds.log 2>&1
then
Bash:
gzip /sdcard/Download/oscmds.log
and post / upload the file
/sdcard/Download/oscmds.log.gz
regards
Bernd
and

Here is the gzip I wasn't sure what was going on after entering that first command the termux was frozen for a few minutes. Also With the folders in the module folder and them being a copy of the original folder is it ok to delete them as a whole folder to remove the rw and revert it of needed. I tried it and didn't see any issues doing it but wanted to know if it reverted it properly and does deleting the module folders make me lose anything original that was in it or is my stock stuff safe because it's through magisk.

cbomb1337 said:
Here is the gzip I wasn't sure what was going on after entering that first command the termux was frozen for a few minutes. Also With the folders in the module folder and them being a copy of the original folder is it ok to delete them as a whole folder to remove the rw and revert it of needed. I tried it and didn't see any issues doing it but wanted to know if it reverted it properly and does deleting the module folders make me lose anything original that was in it or is my stock stuff safe because it's through magisk.
Click to expand...
Click to collapse
Looks like /my_product is a directory in the root filesystem but on the other hand there is a mount point called /mnt/vendor/my_product so I'm not sure about that.
If /my_product is really only a separate directory in the root filesystem the only method to change it is to manipulate the ramdisk used for booting the phone (only if the phone is using a ramdisk, of course).
Can you check if there are other directories called my_product:
find / -type d -name my_product 2>/dev/null
And, if there are any, compare the files in that directory with the files in the directory /my_product?
regards
Bernd

The only folder that has the same boot animation files is the /dev/ ones and the mnt one like you said.
It's all good if it can't be done i just found a magisk module before which works for flashing my boot animation

cbomb1337 said:
The only folder that has the same boot animation files is the /dev/ ones and the mnt one like you said.
Click to expand...
Click to collapse
Then it can't be done using the standard Magisk feature for making r/o mounted filesystems read-write.
cbomb1337 said:
It's all good if it can't be done i just found a magisk module before which works for flashing my boot animation
Click to expand...
Click to collapse
OK, do you have the URL?
And you could just check the contents of the zip file with the Magisk Module on how it's implemented
regards
Bernd

bnsmb said:
Then it can't be done using the standard Magisk feature for making r/o mounted filesystems read-write.
OK, do you have the URL?
And you could just check the contents of the zip file with the Magisk Module on how it's implemented
regards
Bernd
Click to expand...
Click to collapse
I read the module it mentions binding. I don't understand none of it :/ I upload the module here and removed the boot animation to make it small.

cbomb1337 said:
I read the module it mentions binding. I don't understand none of it :/ I upload the module here and removed the boot animation to make it small.
Click to expand...
Click to collapse
Cool -- that's the solution I also found in the meantime (and successfully tested it on my Zenfone 8)
In principle the module does for the bootanimation file what Magisk does if you replace some directories or files in /system
I will write a general HowTo how that works today or in the next days
regards
Bernd

Related

[mod][6T] init.d / services.d framework using Magisk [linux]

This thread will allow you to set up init.d (and services.d) scripts on your phone so they can run at boot time.
Prerequisites
- understanding of what "init.d" scripts mean ...
- your phone must be rooted (see https://www.xda-developers.com/oneplus-6t-unlock-bootloader-root/)
- you must have a working Magisk (see https://forum.xda-developers.com/apps/magisk)
- linux knowledge (I am not a Windows guy but instructions below should easily apply to Windows / PowerShell)
- adb knowledge
If this scares you, stop reading and go play with something else.
Attached zip file contains
- a magisk.img file
- a directory with init.d scripts
- a directory with services.d scripts
You can use the scripts provided or not use (some) of them, or write your own.
What's the difference between init.d and services.d scripts?
The idea is to have 2 directories on your phone with scripts:
Code:
/system/etc/init.d/
/system/etc/services.d/
The init.d scripts are run early in the boot (when Magisk initializes). The scripts in /system/etc/services.d/ will run a bit "later", to be precise: when sys.boot_completed = true.
Important warrning: even when sys.boot_completed = true, this does NOT guarantee that /sdcard is mounted. Your script can "sleep" until /sdcard is mounted if it relies on things on /sdcard. See for example the code in /system/etc/services.d/LS99maxvolumewarning which will show how you can do that.
Scripts in init.d should NOT rely on any of the file systems being mounted !
The framework will run all scripts in parallel. So be careful that you do not write scripts which depend on eachother!
The framework will run all scripts as background processes so that they do not hinder the normal boot of your phone.
Prepare the basic setup
To use the scripts (or your own), you must first create the directories init.d and services.d; to do that open a linux shell and do:
Code:
> adb shell
$ su
# mount -o rw,remount /system
# mkdir /system/etc/init.d/
# mkdir /system/etc/services.d/
# chown 0.0 /system/etc/init.d
# chown 0.0 /system/etc/services.d
# chmod 755 /system/etc/init.d
# chmod 755 /system/etc/services.d
# sync; exit
Putting the scripts on your phone
Download the attached zip file (initd.zip); create a directory in your linux file system and unzip, e.g.
Code:
> mkdir mydir
> cd mydir
> unzip ~/initd.zip
> adb push init.d/ /sdcard/
> adb push services.d/ /sdcard/
> adb shell
$ su
# mount -o rw,remount /system
# mv /sdcard/LS00* /system/etc/init.d/
# mv /sdcard/LS99* /system/etc/services.d/
# chown 0.0 /system/etc/init.d/*
# chown 0.0 /system/etc/services.d/*
# chmod 755 /system/etc/init.d/*
# chmod 755 /system/etc/services.d/*
# sync
# exit
$ exit
Installing the magisk image on your phone
First important remark: I need to turn this really into a proper magisk "module" but I need to study that first. Open a linux shell and do:
Code:
> cd mydir
> gunzip magisk.img.gz
> adb push magisk.img /sdcard/
> adb shell
$ su
# cd /data/adb
# mv magisk.img magisk.img.orig
# cp /sdcard/magisk.img .
# chown 0.0 magisk.img
# chmod 644 magisk.img
# sync
# exit
$ exit
That's all !!! If you now reboot your phone your init.d and services.d scripts will run.
How can I tell this is working?
Each script has a log file in /data/; whose name is LS00 (for init.d) or LS99 (for services.d) appended with the name of the script. That log file is passed as "$1" into the script and the script code can write to this log file using:
Code:
LOGFILE=$1
echo "Hi I am writing to the log" | tee -a $LOGFILE
To check that the log files are there, open a linux shell and do:
Code:
> adb shell
$ su
# ls /data/LS*
And you should see something like:
Code:
16 /data/LS00blockdev 4 /data/LS99bootclean 4 /data/LS99maxvolumewarning 4 /data/LS99sysctl
4 /data/LS00governors 4 /data/LS99callrecording 4 /data/LS99network 4 /data/LS99trimcaches
4 /data/LS00kerneltweaks 4 /data/LS99cputweaks 4 /data/LS99overlays 4 /data/LS99turnoffnightmode
4 /data/LS00procgate 4 /data/LS99enablecallrecording 4 /data/LS99remounts 4 /data/LS99workqueue
4 /data/LS00readahead 4 /data/LS99hdparm 4 /data/LS99resetprop
4 /data/LS00resetprop 4 /data/LS99magiskhide 4 /data/LS99sqlite
To check the contents of the log files, do:
Code:
> adb shell
$ su
# cat /data/LS*
And you will see logging info:
Code:
>> Starting /system/etc/init.d/LS00procgate at 19700110-17:21:12
-- remounting: mount -o remount,hidepid=2,gid=3009 /proc
<< Ending /system/etc/init.d/LS00procgate at 19700110-17:21:12
>> Starting /system/etc/services.d/LS99maxvolumewarning at 20181201-07:34:00
-- slept for 4 seconds waiting for /sdcard/Android
-- disabling max volume warning
<< Ending /system/etc/services.d/LS99maxvolumewarning at 20181201-07:33:58
What's next
Write your own scripts (and share them). Note that scripts must be owned by root (chown 0.0) and have 755 linux permissions (chmod) to run.
How does it really work?
No secrets ... magisk.img is actually a magisk module which runs the scripts. To see the inner details, do the following after you have installed the magisk image and rebooted your phone:
Code:
> adb shell
$ su
# ls -l /sbin/.core/img/template/
total 12
0 -rw-r--r-- 1 root root 0 2018-03-12 21:19 auto_mount
4 -rw-r--r-- 1 root root 935 2018-08-06 17:59 post-fs-data.sh
4 -rwxr-xr-x 1 root root 498 2018-08-05 10:11 scriptwrapper*
4 -rw-r--r-- 1 root root 2750 2018-08-11 12:07 service.sh
Magisk will run the post-fs-data.sh first and service.sh later. Check the code of both of these files to understand how init.d and services.d are ran (using run-parts). If you want more details please read: https://topjohnwu.github.io/Magisk/guides.html#scripts.
Disable ALL scripts from running
If you want to disable any script from running do:
Code:
> adb shell
$ su
# touch /data/noinitrd
To undo this and get your scripts running again, do:
Code:
> adb shell
$ su
# rm /data/noinitrd
What do my init.d scripts do?
Code:
LS00blockdev: change properties of block devices (non rotational, no kernel io stats, ...)
LS00governors: set all CPU governers (to schedutil; which is actually the 6T default)
LS00kerneltweaks: a few basic kernel tweaks + stop debug of kernel modules
LS00procgate: protections against the procgate security vulnerability (thanks to @topjohnwu)
LS00readahead: change the readahead amount on logical disk devicesw
LS00resetprop: reset model, brand, manufacturer (only useful if you would want to get your phone appear externally as a Pixel; check the code)
What do my services.d scripts do?
Code:
LS99bootclean: clean junk and log files
LS99cputweaks: improve scaling governor
LS99enablecallrecording: enable call recording (must be done at every device boot)
LS99execonce: a whole series of settings; this is only executed ONCE
LS99hdparm: increase readahead on /system and /data
LS99magiskhide: hide some packages from seeing root
LS99maxvolumewarning: remove the high volume warning (I am not sure this will always work !!!)
LS99network: TCP transmit queue and congestion control
LS99overlays: enable all overlays automatically (if you use substratum then no need to enable them manually)
LS99remounts: improve file system performance of multiple partitions
LS99resetprop: increase memory used by dalvik
LS99sqlite: REINDEX and VACCUM sqlite database files (the script only runs every 3rd day)
LS99sysctl: optimize linux kernel settings and TCP/IP performance
LS99trimcaches: trim android cache files
LS99turnoffnightmode: reset the night mode to OFF (night mode conflicts with dark mode in newer Google apps)
LS99workqueue: tune kernel work queue
Thanks man I have been trying to get boot scripts to run.
jacksummers said:
Thanks man I have been trying to get boot scripts to run.
Click to expand...
Click to collapse
excuse me for the ignorance, but what is the use of this mod?
Sent from my [device_name] using XDA-Developers Legacy app
isoladisegnata said:
excuse me for the ignorance, but what is the use of this mod?
Sent from my [device_name] using XDA-Developers Legacy app
Click to expand...
Click to collapse
At the end of OP he's got a summary of what the different scripts do.
I am stuck here > unzip ~/initd.zip
It keeps saying:
1|OnePlus6T:/mydir # unzip /initd.zip
unzip: can't open /initd.zip[.zip]
Any ideas I extracted initd to the directory where my platform tools are and where I do my system updates am I supposed to extract it somewhere else? How do I create a directory in my linux shell using windows cmd promts?
kirschdog1 said:
I am stuck here > unzip ~/initd.zip
It keeps saying:
1|OnePlus6T:/mydir # unzip /initd.zip
unzip: can't open /initd.zip[.zip]
Any ideas I extracted initd to the directory where my platform tools are and where I do my system updates am I supposed to extract it somewhere else? How do I create a directory in my linux shell using windows cmd promts?
Click to expand...
Click to collapse
Looks like a simple typo "/initd.zip" implies that the file is located in the root directory. "~/initd.zip" would be in your "home" directory. Since I don't know if "/mydir" is defined as your home directory and presuming initd.zip is located there try "unzip /mydir/initd.zip" (no quotes).
Still not working
Base2 said:
Looks like a simple typo "/initd.zip" implies that the file is located in the root directory. "~/initd.zip" would be in your "home" directory. Since I don't know if "/mydir" is defined as your home directory and presuming initd.zip is located there try "unzip /mydir/initd.zip" (no quotes).
Click to expand...
Click to collapse
1|OnePlus6T:/ # cd mydir
OnePlus6T:/mydir # unzip ~/initd.zip
unzip: can't open //initd.zip[.zip]
1|OnePlus6T:/mydir # unzip /mydir/initd.zip
unzip: can't open /mydir/initd.zip[.zip]
Any ideas? How to get this working? I tried both commands to no avail.
kirschdog1 said:
I am stuck here > unzip ~/initd.zip
It keeps saying:
1|OnePlus6T:/mydir # unzip /initd.zip
unzip: can't open /initd.zip[.zip]
Any ideas I extracted initd to the directory where my platform tools are and where I do my system updates am I supposed to extract it somewhere else? How do I create a directory in my linux shell using windows cmd promts?
Click to expand...
Click to collapse
You have to create the directory mydir on your linux machine, not on your phone.
Base2 said:
Looks like a simple typo "/initd.zip" implies that the file is located in the root directory. "~/initd.zip" would be in your "home" directory. Since I don't know if "/mydir" is defined as your home directory and presuming initd.zip is located there try "unzip /mydir/initd.zip" (no quotes).
Click to expand...
Click to collapse
No, not a typo. mydir is on your PC, not on the phone !
foobar66 said:
No, not a typo. mydir is on your PC, not on the phone !
Click to expand...
Click to collapse
How do I create the directory? I'm using a windows device using adb command prompts?
kirschdog1 said:
How do I create the directory? I'm using a windows device using adb command prompts?
Click to expand...
Click to collapse
Search how to create directories in PowerShell ... I am not a Windows guru :crying:
foobar66 said:
Search how to create directories in PowerShell ... I am not a Windows guru :crying:
Click to expand...
Click to collapse
Ok thank you.ill hold off as it appears to be above my pay grade.
foobar66 said:
You have to create the directory mydir on your linux machine, not on your phone.
Click to expand...
Click to collapse
This won't work anymore as magisk doesn't use magisk.img anymore

How To Guide How to change the home directory for the user root on an Android phone

How to change the home directory for the user root on an Android phone
When working a lot in a shell via adb on an Android phone it's usefull to be able to store some user dependent config files in the home directory of the user. So let's see how that can be implemented on a phone running Android.
Note: The config was done and tested on a phone running OmniROM (based on Android 12)
The home directory for all user used in an (adb) shell on Android is the root directory "/".
Using a home directory for more then one user is not really usefull and in addition on Android "/" is mounted read-only so more or less useless as home directory.
Therefor this should be changed . Unfortunately there is no /etc/passwd file in Android to configure the home directory for a user.
Well, there is an /etc/passwd file (probably for compatibily reasons) but it's empty:
Code:
[email protected]_I006D:/ $ ls -l /etc/passwd
-rw-r--r-- 1 root root 0 2009-01-01 01:00 /etc/passwd
[email protected]_I006D:/ $
And as far as I know there is no other config file to configure the home directory of the user in the Android OS.
So we must implement some work around to get this working.
The shell on Android behaves like normal shells on Linux and executes the file /etc/profile when starting a new session.
In Android /etc is a symbolic link to /system/etc:
Code:
[email protected]_I006D:/ # ls -ld /etc
lrw-r--r-- 1 root root 11 2009-01-01 01:00 /etc -> /system/etc
[email protected]_I006D:/ #
And in the default config there is no file called profile in that directory:
Code:
[email protected]_I006D:/ $ ls -l /etc/system/profile
ls: /etc/system/profile: No such file or directory
[email protected]_I006D:/ $
Because /system is also mounted read-only we need the magic tool Magisk again to create the file /system/etc/profile.
To create the file /system/etc/profile create these directories and files on the phone as user root (assuming Magisk is already installed on the phone):
Code:
[email protected]_I006D:/ # find /data/adb/modules/initshell/
/data/adb/modules/initshell/
/data/adb/modules/initshell/system
/data/adb/modules/initshell/system/etc
/data/adb/modules/initshell/system/etc/profile
[email protected]_I006D:/ #
and reboot the phone. After the reboot there should be the writable file /etc/profile:
Code:
[email protected]_I006D:/ # ls -l /etc/profile
-rw-rw-rw- 1 root root 1100 2022-07-14 14:51 /etc/profile
[email protected]_I006D:/ #
which is in reality the file
Code:
/data/adb/modules/initshell/system/etc/profile
Now you can edit the file /etc/profile as user root until it fullfills your requirements (be aware that all changes in that file are now persistent).
To test the changes open a new adb session (you should not close the current adb session to be able to fix an error in the profile if opening a new adb session fails).
This file can now be used to define the home directory for the user. The home directory should be on one of the writable filesystem, e.g. in /data:
Code:
# add in /etc/profile
HOME="/data/home/root"
export HOME
and the result is:
Code:
[email protected]_I006D:/ # id
uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),1078(ext_data_rw),1079(ext_obb_rw),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:su:s0
[email protected]_I006D:/ # echo $HOME
/data/home/root
[email protected]_I006D:/ #
Note that there is not really a writable filesystem for the user shell so this approach to change the home directory is mainly usable for the user root.
The file /etc/profile can also be used to init some other settings for (adb) sessions (e..g. change the PATH, etc) . This feature can be used for sessions for non-root users also.
For additional user dependent configs you can also create the file .profile in the home directory of the user; the file ${HOME}/.profile will be executed after the execution of the file /etc/profile.
Notes:
Be aware that creating a profile for the user root and changing the home directory for the user root might have some side effects on other processes using the shell!
Therefor it's recommended to use the command "tty -s" to test if the profile is executed in an interactive session:
Code:
#
# check if we're running in an interactive session
#
if ! tty -s; then
#
# this is not an interactive session - so we're just doing nothing at all
#
:
else
#
# running in an interactive session
#
...
fi
You can also check if the parent process is the adb daemon to not do anything in non-adb sessions.
Code:
ps -fp $PPID| grep adbd >/dev/null
if [ $? -ne 0 ] ; then
#
# not running in an adb session
:
else
#
# running in an adb session
...
fi
For testing purpose I suggest to open at least two shells via adb to be able to fix an error in case opening a new shell fails due to a bug in the profile.
If opening a shell session fails due to an error in the /etc/profile and you do not have another open shell either delete the file /data/adb/modules/initshell/system/etc/profile with a filemanager with root access on the phone or boot the phone from a recovery image (like TWRP) and delete or edit the file /data/adb/modules/initshell/system/etc/profile.
I initially looked at this feature to enable a persistent command history for the shell on the Android phone. But after some google searches I found out that persistent history shells are disabled for the shell binary on Android. So this will not work without recompiling the shell binary.
The attached example for the profile (rename the attached file profile.txt to profile) will use the directory /data/home/root as home directory for the user root and will not change the home directory for other users. The profile will do nothing if not running in an interactive session.
The directory /data/home/root will be created by the profile if it does not yet exist.
As always, if the config is working you should create a real Magisk Module for the profile.
The Magisk Module attached, initshell.zip, can be used to create a Magisk Module with your own profile:
To create a new Magisk Module with your own /etc/profile do:
Code:
# create an empty working directory
#
TEMPDIR="/tmp/newdir"
mkdir "${TEMPDIR}"
cd "${TEMPDIR}"
# unpack the zip file in the new directory
#
unzip ../initshell.zip
# now edit the file ${TEMPDIR}/system/etc/profile
# also (optional) edit the files config.sh and module.prop in the new directory to document your changes
# the script customize.sh from the module will be executed once when the module is installed. You might add the code
# create the home directories or any other code here
#
# and recreate the zip file
#
zip -r ../initshell.zip .
Note:
Both attached files are also available from my web site: http://bnsmb.de/My_HowTos_for_Android.html

How To Guide Some hints for using Magisk on Android phones

In this post I summarize everything I found out about using Magisk (https://topjohnwu.github.io/Magisk) until now. A lot of the infos in this post are already in my other posts in this board but hopefully this summary is useful anyway.
My main purpose is to configure Magisk as much as possible via scripts so this tutorial is mostly about using Magisk via CLI commands in an adb shell or from within scripts.
Please note that I mirror all my HowTos for Android on my web page:
http://bnsmb.de/My_HowTos_for_Android.html
I will update this post when I found something new and interesting. A history of changes in this post is at the end of the post.
PreRequisites
Most of the instructions below need an enabled adb access for the phone and root permissions for the adb shell. In addition, a working Recovery image that is able to mount the /data partition (like for example TWRP) is strongly recommended before starting to play with Magisk.
The Magisk version used for this tutorial is Magisk 25.1 and Magisk 25.2; the ROM used was OmniROM (Android 12 based).
The phone used was an ASUS Zenfone 8 but the instructions should work on other phones also.
Installation
Magisk consists out of two parts:
The Magisk App and the Magisk files in the boot partition. Without the files in the boot partition Magisk can do more or less nothing.
The Magisk App can be installed using the standard Android tools for installing apps.
The installation of the Magisk files into the boot partition can then be done using the Magisk App.
The official instructions to install Magisk into the boot partition are here:
https://topjohnwu.github.io/Magisk/install.html
Magisk can also be installed via script without user intervention into the boot partition -- see How to install Magisk into the boot partition using a script
Update 18.04.2023/bs
see How to install Magisk v26.0 or newer via script for how to install Magisk v26 via script
Note that the Magisk files for the boot partition must be reinstalled after an OS upgrade but this can be done from within the Magisk App.
Uninstalling Magisk
Use the Button "Uninstall Magisk" in the Magisk App to uninstall Magisk.
The Magisk App can also remove the Magisk files from the boot partition.
To uninstall the Magisk App only via script do
Bash:
adb shell pm uninstall com.topjohnwu.magisk
To remove Magisk from the boot partition manually I suggest to flash the image of the original boot partition.
Installing Magisk Modules
Magisk Modules are extensions for Magisk to for example replace or add files to /system (and much more ... I suggest to study the documentation for Magisk for those that are interested in using Magisk)
Magisk Modules are distributed via ZIP files.
As of Magisk v25 or newer the official method to install Magisk Modules is to manually copy the ZIP file with the Magisk Module to the phone and then use the button "Install from storage" in the "Modules" sub menu in the Magisk App.
In previous versions of Magisk a Module browser to list and install Magisk Modules was part of the Magisk App but unfortunately the developer dropped that feature. Therefor you must search and download the available Magisk Modules using a browser on the phone or a PC.
Repositories with Magisk Modules are for example:
https://github.com/Magisk-Modules-Repo/
and
https://github.com/Magisk-Modules-Alt-Repo
A XDA thread about Magisk Modules (including a list of Magisk Modules) is here:
https://forum.xda-developers.com/t/collection-of-magisk-modules-v2.3575758/
There is now a new App for Android called "Fox's Magisk Module Manager" that can be used to list and download Magisk Modules to the phone (see https://github.com/Fox2Code/FoxMagiskModuleManager).
It's also possible to install a Magisk Module via script. The commands to install an Magisk Module via script are:
Bash:
# copy the Magisk Module to the phone
adb push /data/backup/Android/MagiskModules/Nano_for_Android_NDK-6_3-6300.zip /sdcard/Download/
# install the Module
#
# Note:
#
# The command can also be executed in a script runnning on the phone (without "adb shell")
#
adb shell magisk --install-module /sdcard/Download/Nano_for_Android_NDK-6_3-6300.zip
# reboot the phone
adb reboot
Example:
Code:
[[email protected] ~]$ adb push /data/backup/Android/MagiskModules/Nano_for_Android_NDK-6_3-6300.zip /sdcard/Download/
/data/backup/Android/MagiskModules/Nano_for_Android_NDK-6_3-6300.zip: 1 file pushed, 0 skipped. 37.6 MB/s (380554 bytes in 0.010s)
[[email protected] ~]$ adb shell magisk --install-module /sdcard/Download/Nano_for_Android_NDK-6_3-6300.zip
- Current boot slot: _a
- Device is system-as-root
*****************************
Nano for Android NDK
by osm0sis @ xda-developers
*****************************
*******************
Powered by Magisk
*******************
Archive: /storage/emulated/0/Download/Nano_for_Android_NDK-6_3-6300.zip
inflating: diffusion_config.sh
inflating: module.prop
Mounting...
Extracting files...
Archive: /storage/emulated/0/Download/Nano_for_Android_NDK-6_3-6300.zip
inflating: META-INF/com/google/android/updater-script
inflating: META-INF/com/google/android/update-binary
inflating: sbin/nano
...
inflating: etc/terminfo/l/linux
inflating: customize.sh
inflating: update.json
inflating: bin/nano
inflating: bin/nano.bin
inflating: README.md
inflating: diffusion_config.sh
inflating: module.prop
Installing...
Installing nano to /data/adb/modules_update/nano-ndk/system/bin ...
Installing terminfo to /data/adb/modules_update/nano-ndk/system/etc ...
Unmounting...
Done!
[[email protected] ~]$ adb reboot
[[email protected] ~]$
Uninstalling a Magisk Module
Magisk Modules should be uninstalled via Magisk App if possible because there is no parameter for the magisk binary to uninstall a Magisk Module.
To force Magisk via shell command to remove the module after the next reboot create the file
remove
in the module directory.
If uninstalling the Magisk Module via Magisk does not work or if you want to uninstall a Magisk Module via script you can just delete the directory for the Magisk Module in /data/adb/modules and reboot the phone. This can be done in an adb shell or if that does not work anymore after rebooting the phone from a Recovery Image like TWRP, e.g.
Bash:
# uninstall the module "dummy_module" via adb shell commands
#
# check for an uninstall script for this module
#
if [ -x /data/adb/modules/dummy_module/uninstall.sh ] ; then
echo "Executing the module uninstall script ...."
/data/adb/modules/dummy_module/uninstall.sh
fi
adb shell rm -rf /data/adb/modules/dummy_module/
adb reboot
Note:
You should reboot the phone immediately after removing the directory with the Module.
This method is not really recommended.
List all installed Magisk Modules
The Magisk App will list all installed Magisk Modules
To list the installed Magisk Modules via CLI command use either
Bash:
adb shell ls -d /data/adb/modules/* | cut -f5 -d "/"
e.g.
Code:
[[email protected] ~]$ adb shell ls -d /data/adb/modules/* | cut -f5 -d "/"
PlayStore_for_MicroG
ccbins
dummy_module
initshell
nano-ndk
terminalmods
[[email protected] ~]$
# or
[[email protected] /]$ for i in $( adb shell su - -c ls -d /data/adb/modules/* ); do printf "%-30s %s\n" "${i##*/}" "$( adb shell su - -c grep name= $i/module.prop 2>/dev/null | cut -f2 -d "=" | tr -s " " )" ; done
MiXplorer MiXplorer
PlayStore_for_MicroG Patched Playstore from NanoDroid for MicroG (for ARM64 CPUs only)
ccbins Cross Compiled Binaries
dummy_module Dummy Module for testing a new module
initshell Create writable config files (/etc/profile) for sh
nano-ndk Nano for Android NDK
terminalmods Terminal Modifications
[[email protected] /]$
or on the phone:
Code:
[email protected]_I006D:/ # echo; for i in /data/adb/modules/*; do printf "%-30s %s\n" "${i##*/}" "$( grep name= $i/module.prop 2>/dev/null | cut -f2 -d "=" | tr -s " " )" ; done
PlayStore_for_MicroG Patched Playstore from NanoDroid for MicroG (for ARM64 CPUs only)
ccbins Cross Compiled Binaries
dummy_module
initshell Create writable config files (/etc/profile) for sh
nano-ndk Nano for Android NDK
terminalmods Terminal Modifications
[email protected]_I006D:/ #
How to disable a Magisk Module
To disable a Magisk Module via script create a file called disable in the Module directory, e.g.:
Bash:
touch /data/adb/modules/dummy_module/disable
The Magisk Module will then be disabled after the next reboot.
To re-enable the Magisk Module just delete the file disable in the Module directory and reboot the phone.
To list all disabled Magisk Modules do
Bash:
adb shell ls /data/adb/modules/*/disable | cut -f5 -d "/"
Replacing files in /system using a Dummy Magisk Module
One feature of Magisk Modules is the possibility to change files in the sub directories in the directory /system or also add new files to the sub directories in the directory /system. /system is mounted read-only and in the current Android version it is not possible to remount /system read-write anymore so without Magisk it's very difficult to change files in /system.
Please note that you can not create new files or directories in the directory /system using this Magisk feature.
To test this feature you do not need to create a Magisk Module : It's sufficient to simulate a Magisk Module.
For that just create the necessary directory structure and files manually.
Magisk Modules are are installed in the directory /data/adb/modules. Each Magisk Module use an uniqe sub directory in that directory. To simulate a Magisk Module open an adb shell as user root and create the directories for your Dummy Magisk Module, e.g.:
Bash:
mkdir /data/adb/modules/dummy_module
# Next create the sub directory system in that new directory
mkdir /data/adb/modules/dummy_module/system
Now copy the files for /system to that directory: The files in that directory will overwrite existing files in /system after the next reboot. Files in that directory that not already exist in /system will be created in /system.
e.g.
Code:
# contents of my Dummy Magisk Module
#
[email protected]_I006D:/data/adb/modules/dummy_module/system # pwd
/data/adb/modules/dummy_module/system
[email protected]_I006D:/data/adb/modules/dummy_module/system # find .
.
./bin
./bin/my_new_binary
./etc
./etc/my_new_file_for_systme
[email protected]_I006D:/data/adb/modules/dummy_module/system #
After rebooting the phone the files are visible in /system:
Code:
[email protected]_I006D:/ # ls -l /system/etc/my_new_file_for_systme
-rw-rw-rw- 1 root root 20 2022-07-20 16:55 /system/etc/my_new_file_for_systme
[email protected]_I006D:/ # cat /system/etc/my_new_file_for_systme
This is my new file
[email protected]_I006D:/ #
[email protected]_I006D:/ # ls -l /system/bin/my_new_binary
-rwxr-xr-x 1 root root 41 2022-07-20 16:57 /system/bin/my_new_binary
[email protected]_I006D:/ # my_new_binary
Hello world from my dummy binary
[email protected]_I006D:/ #
The permissions for the new files in /system are equal to the permissions of the original files in
/data/adb/modules/dummy_module so if the original files are writable you can also edit the new files in /system, e.g
Code:
[email protected]_I006D:/ # cat /system/etc/my_new_file_for_systme
This is my new file
[email protected]_I006D:/ #
[email protected]_I006D:/ # echo "Test Test" >> /system/etc/my_new_file_for_systme
[email protected]_I006D:/ # cat /system/etc/my_new_file_for_systme
This is my new file
Test Test
[email protected]_I006D:/ #
These changes are persistent (because they change the original file in /data/adb/modules/<modulename>). You can also edit the files in /data/adb/modules/<modulename> but be aware that you can not use tools that create temporary files for changing the files like for example sed: Changes done with these kind of tools are only visible after a reboot of the phone.
To change the file via script I recommend to create a new file and then replace the existing file with the new file using cp.
This Magisk feature can also be used to make files in sub directories in /system writable -- see How to make files in system writable for detailed instructions.
Make sure that the new files for /system are readable for the user using them; e.g some files (like for example apk files) are used by the user system). IMHO it's recommended to add the read permission (chmod o+r) to all new files for /system.
Notes:
Magisk does not really change the files in /system - instead it uses "bind mounts" to replace the files with others. Therefor you can always restore the original files by deleting the files in /data/adb/modules/<module_name> and rebooting the phone. Another big advantage of this technique is that you do not have to take care about an update of the OS:
changes done via Magisk will also work after an OS upgrade (assuming you reinstalled Magisk to the boot partition after installing the OS update)
Please be careful when changing existing files in /system.
To add the necessary infos for the Magisk App to list your dummy module properly just create the file module.prop for your Dummy Magisk Module, e.g.
Code:
[email protected]_I006D:/ # cat /data/adb/modules/dummy_module/module.prop
id=dummy-module
name=Dummy Module for testing a new module
version=1.0
versionCode=1000
[email protected]
description=Dummy Module ..
[email protected]_I006D:/ #
For some examples for this technique see
How to change files in the directory /system with Magisk
How to replace the Fake Store from OmniROM with MicroG with a patched Playstore
How to change the home directory for the user root on an Android phone
How to use this technique to disable an app that can not be uninstalled
Apps that can not be uninstalled can be disabled by creating empty files for the app.
Example:
My Magisk Module for the patched Playstore must disable the FakeStore installed in the OmniROM with MicroG by default.
That's done by creating an empty file in the Magisk Module for the apk file for the FakeStore, the result looks like this:
Code:
[email protected]_I006D:/ # ls -l /data/adb/modules/PlayStore_for_MicroG/system/priv-app/FakeStore/FakeStore.apk
-rw-r--r-- 1 root root 1 2022-07-15 11:54 /data/adb/modules/PlayStore_for_MicroG/system/priv-app/FakeStore/FakeStore.apk
[email protected]_I006D:/ #
[email protected]_I006D:/ # ls -l /system/priv-app/FakeStore/FakeStore.apk
-rw-r--r-- 1 root root 1 2022-07-15 11:54 /system/priv-app/FakeStore/FakeStore.apk
[email protected]_I006D:/ #
In case there are multiple files in the folder for the app you can also hide the entire folder:
From the original documentation from https://topjohnwu.github.io/Magisk/guides.html:
If you place a file named .replace in any of the folders, instead of merging its contents, that folder will directly replace the one in the real system. This can be very handy for swapping out an entire folder.
Click to expand...
Click to collapse
How to access the files replaced by Magisk
Use another bind mount to access the files replaced by Magisk, e.g:
Code:
[email protected]_I006D:/ # head /data/adb/modules/fmradio/system/etc/public.libraries.txt
# See https://android.googlesource.com/platform/ndk/+/master/docs/PlatformApis.md
#
# 04.08.2022 /bs
# added the library libqcomfm_jni.so
#
libandroid.so
libaaudio.so
libamidi.so
libbinder_ndk.so
libc.so
[email protected]_I006D:/ #
[email protected]_I006D:/ #
[email protected]_I006D:/ # head /system/etc/public.libraries.txt
# See https://android.googlesource.com/platform/ndk/+/master/docs/PlatformApis.md
#
# 04.08.2022 /bs
# added the library libqcomfm_jni.so
#
libandroid.so
libaaudio.so
libamidi.so
libbinder_ndk.so
libc.so
[email protected]_I006D:/ #
# -> The file /system/etc/public.libraries.txt is replaced by a file from a Magisk Module
# To access the original version of the file /system/etc/public.libraries.txt do
[email protected]_I006D:/ #
[email protected]_I006D:/ # mkdir -p /data/test
[email protected]_I006D:/ #
[email protected]_I006D:/ # mount -o bind /system /data/test
#
# -> /data/test is now bind mounted to /system
#
# -> /data/test/etc/public.libraries.txt is the original version of that file:
#
[email protected]_I006D:/ #
[email protected]_I006D:/ # head /data/test/etc/public.libraries.txt
# See https://android.googlesource.com/platform/ndk/+/master/docs/PlatformApis.md
libandroid.so
libaaudio.so
libamidi.so
libbinder_ndk.so
libc.so
libcamera2ndk.so
libdl.so
libEGL.so
libGLESv1_CM.so
[email protected]_I006D:/ #
Replacing files in /vendor, /product, or /system_ext using a Dummy Magisk Module
The dummy Magisk Module can also be used to replace files in the directories /vendor, /product, or /system_ext:
from the Magisk documentation at https://topjohnwu.github.io/Magisk/guides.html:
If you want to replace files in /vendor, /product, or /system_ext, please place them under system/vendor, system/product, and system/system_ext respectively. Magisk will transparently handle whether these partitions are in a separate partition or not.
Click to expand...
Click to collapse
Note that this works only to replace existing files in these directories - you can not add new files to these directories using this method.
Example:
Code:
[email protected]_I006D:/ # cd /data/adb/modules/dummy_module/system
#
# files in the Magisk Module
#
[email protected]_I006D:/data/adb/modules/dummy_module/system # find . -type f
./bin/my_new_binary
./etc/my_new_file_for_systme
./product/mynewfile
./product/media/audio/alarms/Krypton.ogg
./vendor/mynewfile
./vendor/etc/sap.conf
./system_ext/mynewfile
./system_ext/etc/dpm/dpm.conf
[email protected]_I006D:/data/adb/modules/dummy_module/system #
#
# the new files for /product, /vendor, and /system_ext in the Magisk Module do not exist:
#
[email protected]_I006D:/data/adb/modules/dummy_module/system # ls -l /product/mynewfile /vendor/mynewfile /system_ext/mynewfile
ls: /product/mynewfile: No such file or directory
ls: /vendor/mynewfile: No such file or directory
ls: /system_ext/mynewfile: No such file or directory
#
# The existing files in /product, /vendor, and /system_ext are replaced with the files from the Magisk Moduel
#
[email protected]_I006D:/data/adb/modules/dummy_module/system # cksum ./product/media/audio/alarms/Krypton.ogg /product/media/audio/alarms/Krypton.ogg
4294967295 0 ./product/media/audio/alarms/Krypton.ogg
4294967295 0 /product/media/audio/alarms/Krypton.ogg
[email protected]_I006D:/data/adb/modules/dummy_module/system #
[email protected]_I006D:/data/adb/modules/dummy_module/system # cksum ./vendor/etc/sap.conf /vendor/etc/sap.conf
1967598015 7121 ./vendor/etc/sap.conf
1967598015 7121 /vendor/etc/sap.conf
[email protected]_I006D:/data/adb/modules/dummy_module/system #
[email protected]_I006D:/data/adb/modules/dummy_module/system # cksum ./system_ext/etc/dpm/dpm.conf /system_ext/etc/dpm/dpm.conf
1970692378 2925 ./system_ext/etc/dpm/dpm.conf
1970692378 2925 /system_ext/etc/dpm/dpm.conf
[email protected]_I006D:/data/adb/modules/dummy_module/system #
[email protected]_I006D:/data/adb/modules/dummy_module/system # grep mynewfile /cache/magisk.log
01-01 00:11:51.764 767 769 W : Unable to add: /product/mynewfile, skipped
01-01 00:11:51.771 767 769 W : Unable to add: /system_ext/mynewfile, skipped
01-01 00:11:51.771 767 769 W : Unable to add: /vendor/mynewfile, skipped
[email protected]_I006D:/data/adb/modules/dummy_module/system #
A work around to create new files in sub directories in /product, /vendor, or /system_ext:
Copy the complete existing folder to the sub directory in
/data/adb/modules/<magisk_module>/system/[product|vendor|system_ext]/
and create the file .replace in that directory and add the new file(s) to that directory.
Example:
Code:
[email protected]_I006D:/ # find /data/adb/modules/testmodule/
/data/adb/modules/testmodule/
/data/adb/modules/testmodule/system
/data/adb/modules/testmodule/system/product
/data/adb/modules/testmodule/system/product/lib
/data/adb/modules/testmodule/system/product/lib/.replace
/data/adb/modules/testmodule/system/product/lib/libframesequence.so
/data/adb/modules/testmodule/system/product/lib/libgiftranscode.so
/data/adb/modules/testmodule/system/product/lib/newfile001
/data/adb/modules/testmodule/system/vendor
/data/adb/modules/testmodule/system/vendor/app
/data/adb/modules/testmodule/system/vendor/app/TimeService
/data/adb/modules/testmodule/system/vendor/app/TimeService/TimeService.apk
/data/adb/modules/testmodule/system/vendor/app/TimeService/oat
/data/adb/modules/testmodule/system/vendor/app/TimeService/oat/arm64
/data/adb/modules/testmodule/system/vendor/app/TimeService/oat/arm64/TimeService.vdex
/data/adb/modules/testmodule/system/vendor/app/TimeService/oat/arm64/TimeService.odex
/data/adb/modules/testmodule/system/vendor/app/TimeService/newfile002
/data/adb/modules/testmodule/system/vendor/app/TimeService/.replace
/data/adb/modules/testmodule/system/system_ext
/data/adb/modules/testmodule/system/system_ext/app
/data/adb/modules/testmodule/system/system_ext/app/FM2
/data/adb/modules/testmodule/system/system_ext/app/FM2/.replace
/data/adb/modules/testmodule/system/system_ext/app/FM2/FM2.apk
/data/adb/modules/testmodule/system/system_ext/app/FM2/lib
/data/adb/modules/testmodule/system/system_ext/app/FM2/lib/arm64
/data/adb/modules/testmodule/system/system_ext/app/FM2/lib/arm64/libqcomfm_jni.so
/data/adb/modules/testmodule/system/system_ext/app/FM2/oat
/data/adb/modules/testmodule/system/system_ext/app/FM2/oat/arm64
/data/adb/modules/testmodule/system/system_ext/app/FM2/oat/arm64/FM2.odex
/data/adb/modules/testmodule/system/system_ext/app/FM2/oat/arm64/FM2.vdex
/data/adb/modules/testmodule/system/system_ext/app/FM2/newfile003
[email protected]_I006D:/ #
[email protected]_I006D:/ # find /data/adb/modules/testmodule/system | grep newfile
/data/adb/modules/testmodule/system/product/lib/newfile001
/data/adb/modules/testmodule/system/vendor/app/TimeService/newfile002
/data/adb/modules/testmodule/system/system_ext/app/FM2/newfile003
[email protected]_I006D:/ #
[email protected]_I006D:/ # pwd
/
[email protected]_I006D:/ # ls -l $( find /data/adb/modules/testmodule/system | grep newfile | cut -f6- -d "/" )
-rw-r--r-- 1 root root 0 2022-08-07 14:34 system/product/lib/newfile001
-rw-r--r-- 1 root root 0 2022-08-07 14:24 system/system_ext/app/FM2/newfile003
-rw-r--r-- 1 root root 0 2022-08-07 14:36 system/vendor/app/TimeService/newfile002
[email protected]_I006D:/ #
See How to change any file or directory using Magisk for another approach to change files on read-only mounted filesystems.
Executing scripts while booting the phone
Magisk also supports executing additional scripts while booting the phone.
The scripts to be executed must be copied to one of these directories
/data/adb/post-fs-data.d/
/data/adb/service.d/
see the description in the original Magisk documentation: https://topjohnwu.github.io/Magisk/details.html
Working examples for this technique are described in these posts:
How to run a script atevery boot using Magisk
How to disable or change the swap device in the Android 12 from ASUS for the Zenfone 8
How to create or change a swap device in the OmniROM 12 using Magisk
Another example for using this technique I found here
https://gist.github.com/niikoo/3f6bd13a69f2d68f3dd51cc667e79bdc :
Bash:
# Boot logging
# Create the file: /data/adb/post-fs-data.d/0001logcatboot
#!/system/bin/sh
mkdir -p /cache/logs
/system/bin/logcat -r 1024 -n 9 -v threadTime -f /cache/logs/log >info.log 2>err.log &
Note that I added commands to create / cleanup the log directory and changed the logcat command on my phone:
Bash:
#!/system/bin/sh
mkdir -p /cache/logs
rm -rf /cache/logs/*
/system/bin/logcat -r 102400 -n 9 -v threadTime -f /cache/logs/log >/cache/logs/info.log 2>/cache/logs/err.log &
To execute additional scripts earlier in the boot process you must add them to the boot image -- see the section Using Magisk to unpack and repack the boot image below for details.
Creating Magisk Modules
The official documentation for creating a Magisk Module is here: https://topjohnwu.github.io/Magisk/guides.html
Creating Magisk Modules that only use the standard features isn't that difficult and the official documentation should be sufficient.
I suggest to download an existing simple Magisk Module; unzip the ZIP file and study the contents.
Using Magisk to unpack and repack the boot image
The binary magiskboot that is part of the Magisk package can be used to unpack and repack the boot partition for every phone supported by Magisk.
For details see here: How to change files in the boot image using Magisk
Magisk also supports changing files in the root directory via Root Directory Overlays (see https://github.com/topjohnwu/Magisk/blob/master/docs/guides.md) :
This feature can be used to create additional start or stop services for the Android OS:
Android uses init *rc files to define the services to start when booting and also to define the services to run when doing the shutdown (like the systemd or initd in other Linux implementations).
These files are read early in the boot process and therefore reside only in the ramdisk on the boot partition. To add new init* rc files the boot image must be modified. This can be done with Magisk:
Just add the new init*rc files and optimal other scripts or files to the boot image using Magisk . Magisk will then take care of processing the new init*rc files by the Android operating system when booting the phone.
See these posts:
How to run a script at shutdown
How to trigger an action when a property is changed
How to enable root access using Magisk in a script
for examples for using that feature.
There are also magiskboot binaries for x86 in the Magisk apk file that can be used on a PC running the Linux OS:
see How to process Android boot image files on a PC running the Linux OS for more details about this feature.
Using Magisk to change the active slot
The Magisk App can also be used to change the active slot on phones with A/B slots -- for details see here :
How to manually switch the active slot
Directories and files used by Magisk
The directories and files used by Magisk are documented here https://topjohnwu.github.io/Magisk/guides.html
Some important directories and files for developing and trouble shooting Magisk Modules are:
The logfile used by Magisk is
/cache/magisk.log
In case something goes wrong with a Magisk Module you should first check that file.
The base directory for the data files for Magisk is
/data/adb
The config setttings for Magisk are stored in the SQLite database
/data/adb/magisk.db
To view (or probably) change the database entries via script you can either use sqlite3 binary (if installed)
Code:
ASUS_I006D:/ # sqlite3 /data/adb/magisk.db
SQLite version 3.7.6.3-Titanium
Enter ".help" for instructions
Enter SQL statements terminated with a ";"
sqlite> .headers on
sqlite> .mode column
sqlite>
sqlite> .tables
denylist policies settings strings
sqlite>
sqlite> .schema
CREATE TABLE denylist (package_name TEXT, process TEXT, PRIMARY KEY(package_name, process));
CREATE TABLE policies (uid INT, policy INT, until INT, logging INT, notification INT, PRIMARY KEY(uid));
CREATE TABLE settings (key TEXT, value INT, PRIMARY KEY(key));
CREATE TABLE strings (key TEXT, value TEXT, PRIMARY KEY(key));
sqlite>
sqlite> select * from denylist ;
sqlite>
sqlite> select * from policies ;
uid policy until logging notification
---------- ---------- ---------- ---------- ------------
2000 2 0 1 1
10134 1 0 1 1
sqlite>
sqlite> select * from settings ;
key value
---------- ----------
denylist 0
su_biometr 0
sqlite>
sqlite> select * from strings ;
sqlite>
or the magisk binary, e.g:
Code:
ASUS_I006D:/ # magisk --sqlite 'select * from policies'
logging=1|notification=1|policy=2|uid=2000|until=0
ASUS_I006D:/ #
ASUS_I006D:/ # magisk --sqlite 'select * from settings'
key=denylist|value=0
key=su_biometric|value=0
ASUS_I006D:/ #
There is a handy little script to list all apps with root access in the XDA thread https://forum.xda-developers.com/t/magisk-general-support-discussion.3432382/page-2681 .
How to create the Magisk database manually
To create the Magisk database manually (e.g. after installing Magisk manually via script) these commands can be used:
Bash:
# start the Magisk daemon if necessary
#
MAGISK_DAEMON_IS_RUNNING=true
/data/adb/magisk/magisk64 -v || /data/adb/magisk/magisk64 --daemon && MAGISK_DAEMON_IS_RUNNING=false
#
# force Magisk to create the Magisk database if it not yet exists
#
/data/adb/magisk/magisk64 --sqlite "PRAGMA user_version"
# stop the Magisk daemon again
#
[ ${MAGISK_DAEMON_IS_RUNNING} = false ] && /data/adb/magisk/magisk64 --stop
To create the Magisk database using sqlite3 use these commands:
SQL:
.open ${CUR_MAGISK_DATABASE_FILE}
CREATE TABLE IF NOT EXISTS policies (uid INT, policy INT, until INT, logging INT,notification INT, PRIMARY KEY(uid));
CREATE TABLE IF NOT EXISTS settings (key TEXT, value INT, PRIMARY KEY(key));
CREATE TABLE IF NOT EXISTS strings (key TEXT, value TEXT, PRIMARY KEY(key));
CREATE TABLE IF NOT EXISTS denylist (package_name TEXT, process TEXT, PRIMARY KEY(package_name, process));
PRAGMA user_version=6;
.exit
Note:
The Magisk database will be upgraded to the latest version automatically by the Magisk daemon after the next restart
Magisk root access configuration details
Magisk uses the table policies in the sqlite database /data/adb/magisk.db to store the list of root enabled apps.
See this post https://forum.xda-developers.com/t/how-to-enable-root-access-using-magisk-in-a-script.4527035/ for details about this feature and how to enable root access via Magisk using a script.
Magisk App installation directory
Use
Bash:
pm list packages -f | grep magisk
to get the Magisk App installation directory.
Credits: https://forum.xda-developers.com/t/magisk-general-support-discussion.3432382/page-2689#post-87694851
The Magisk App Configuration files
The Magisk App stores the configuration (e.g. the app settings) in the default directory for App Settings, on my phone this is
/data/user_de/0/com.topjohnwu.magisk/shared_prefs
The file in that directory used to store the settings is
com.topjohnwu.magisk_preferences.xml
For more details about the file see the post Where does the Magisk App store the settings?.
Temporary Magisk config directory
While running Magisk uses a temporary directory for the configuration.
The path to the config directory can be retrieved via magisk binary:
Code:
ASUS_I006D:/dev/hP3B # magisk --path
/dev/hP3B
ASUS_I006D:/dev/hP3B#
The contents of that directory look like :
Code:
ASUS_I006D:/dev/hP3B # ls -al /dev/hP3B/
total 568
drwx------ 3 root root 200 1970-01-01 04:08 .
drwxr-xr-x 27 root root 5480 2022-11-06 18:32 ..
drwxr-xr-x 8 root root 180 1970-01-01 04:08 .magisk
lrwxrwxrwx 1 root root 10 1970-01-01 04:08 magisk -> ./magisk64
-rwxr-xr-x 1 root root 0 1970-01-01 04:08 magisk32
-rwxr-xr-x 1 root root 247168 1970-01-01 04:08 magisk64
-rwxr-xr-x 1 root root 328240 1970-01-01 04:08 magiskpolicy
lrwxrwxrwx 1 root root 8 1970-01-01 04:08 resetprop -> ./magisk
lrwxrwxrwx 1 root root 8 1970-01-01 04:08 su -> ./magisk
lrwxrwxrwx 1 root root 14 1970-01-01 04:08 supolicy -> ./magiskpolicy
ASUS_I006D:/dev/hP3B # ls -al /dev/hP3B/.magisk/
total 7
drwxr-xr-x 8 root root 180 1970-01-01 04:08 .
drwx------ 3 root root 200 1970-01-01 04:08 ..
d--------- 2 root root 160 1970-01-01 04:08 block
drwxr-xr-x 2 root root 7240 1970-01-01 04:08 busybox
---------- 1 root root 127 1970-01-01 04:08 config
d--------- 7 root root 220 1970-01-01 04:08 mirror
drwxr-xr-x 3 root root 3452 2022-11-06 18:32 modules
drwxr-xr-x 2 root root 0 1970-01-01 04:08 pts
d--------- 2 root root 80 1970-01-01 04:08 selinux
ASUS_I006D:/dev/hP3B # cat /dev/hP3B/.magisk/config
KEEPVERITY=false
KEEPFORCEENCRYPT=false
PATCHVBMETAFLAG=false
RECOVERYMODE=false
SHA1=1a05ccb9844d3ad4f6d1873dfbf76ebf83a5bdeb
ASUS_I006D:/dev/hP3B #
Backup of the boot partitions
Magisk creates backups of the boot partitions in sub directories in /data/adb with filenames starting with magisk_backup_, e.g.:
Code:
[email protected]_I006D:/data/adb # ls -l /data/magisk_backup_*
/data/magisk_backup_79f3370cd83d03441325998a8875888780c3182f:
total 31712
-rwxr-xr-x 1 root root 32436260 2022-09-26 12:20 boot.img.gz
/data/magisk_backup_a0c712541fd002c331c25772a3b8609ae2fba546:
total 31712
-rwxr-xr-x 1 root root 32436965 2022-09-27 19:30 boot.img.gz
[email protected]_I006D:/data/adb #
The uniq string after the second underscore in the name of the directory with the backup is the SHA-1 from the boot image that was patched to install Magisk:
Code:
[[email protected] /data/develop/android/scripts_on_linux]$ ./install_magisk_via_twrp.sh
install_magisk_via_twrp.sh version - v2.0.0.1 - add Magisk to the boot partition of a phone running Android using TWRP
....
Creating the boot image file "/sdcard/Download/boot_b.1086412.img" from the partition "/dev/block/by-name/boot_b" ...
196608+0 records in
196608+0 records out
100663296 bytes (96 M) copied, 0.313082 s, 307 M/s
Checking the result ...
-rw-rw---- 1 root media_rw 100663296 2022-11-06 16:01 /sdcard/Download/boot_b.1086412.img
...
OK, patching the boot partition "/dev/block/by-name/boot_b" was successfull
....
[[email protected] /data/develop/android/scripts_on_linux]$
The image file patched by Magisk in this example is /sdcard/Download/boot_b.1086412.img.
The backup of the boot partition on the phone created by Magisk for this installation is:
Code:
ASUS_I006D:/ # ls -ld /data/magisk_backup*
drwxr-xr-x 2 root root 3452 2022-11-06 17:14 /data/magisk_backup_1a05ccb9844d3ad4f6d1873dfbf76ebf83a5bdeb
ASUS_I006D:/ #
ASUS_I006D:/ # ls -l /data/magisk_backup_1a05ccb9844d3ad4f6d1873dfbf76ebf83a5bdeb
total 50692
-rw-r--r-- 1 root root 51852324 2022-11-06 17:14 boot.img.gz
ASUS_I006D:/ #
1a05ccb9844d3ad4f6d1873dfbf76ebf83a5bdeb is the SHA-1 from the image file used for the installation of Magisk:
Code:
ASUS_I006D:/ # sha1sum /sdcard/Download/boot_b.1086412.img
1a05ccb9844d3ad4f6d1873dfbf76ebf83a5bdeb /sdcard/Download/boot_b.1086412.img
ASUS_I006D:/ #
or
Code:
ASUS_I006D:/data/adb/workdir/unpack/ramdisk # /data/adb/magisk/magiskboot sha1 /sdcard/Download/boot_b.1086412.img
1a05ccb9844d3ad4f6d1873dfbf76ebf83a5bdeb
ASUS_I006D:/data/adb/workdir/unpack/ramdisk #
The SHA1 from the previous boot image is stored in the file /dev/hP3B/.magisk/config used by Magisk while running, e.g.:
Code:
ASUS_I006D:/data/adb/workdir/unpack/ramdisk # cat /dev/hP3B/.magisk/config
KEEPVERITY=false
KEEPFORCEENCRYPT=false
PATCHVBMETAFLAG=false
RECOVERYMODE=false
SHA1=1a05ccb9844d3ad4f6d1873dfbf76ebf83a5bdeb
ASUS_I006D:/data/adb/workdir/unpack/ramdisk #
/dev/hP3B is a directory on the temporary ramdisk used by Magisk while it is running.
Use the command magisk --path to retrieve the path for the current ramdisk while Magisk is running, e.g.:
Code:
ASUS_I006D:/data/adb/workdir/unpack/ramdisk # magisk --path
/dev/hP3B
ASUS_I006D:/data/adb/workdir/unpack/ramdisk #
The SHA1 from the previous boot image is also stored in the file .backup/.magisk in the ramdisk of a boot image, e.g:
Code:
# Note: unpack the boot image and the ramdisk from the boot image to get that file
#
ASUS_I006D:/data/adb/workdir/unpack/ramdisk # cat .backup/.magisk
KEEPVERITY=false
KEEPFORCEENCRYPT=false
PATCHVBMETAFLAG=false
RECOVERYMODE=false
SHA1=1a05ccb9844d3ad4f6d1873dfbf76ebf83a5bdeb
ASUS_I006D:/data/adb/workdir/unpack/ramdisk #
To do it all in once use:
Bash:
grep "^SHA1=" $( magisk --path )/.magisk/config | cut -f2 -d "="
e.g.:
Code:
ASUS_I006D:/data/adb/workdir/unpack/ramdisk # grep "^SHA1=" $( magisk --path )/.magisk/config | cut -f2 -d "="
1a05ccb9844d3ad4f6d1873dfbf76ebf83a5bdeb
ASUS_I006D:/data/adb/workdir/unpack/ramdisk # #
Backup the Magisk config
To backup the Magisk config just copy the directories in /data/adb except the directory /data/adb/magisk (that directory is used for the binaries only)
Code:
adb shell tar --exclude data/adb/magisk/ -czf /sdcard/Download/magisk_config_$( date +%Y-%m-%d).$$.tar /data/adb/
To restore the backup unpack the tar file on the phone and reboot the phone.
To also create a backup the settings from the Magisk App create a backup of the directory with the Magisk App Settings (see above for details).
Start/Stop the Magisk App
To start the Magisk App via CLI command use
Bash:
am start -n com.topjohnwu.magisk/.ui.MainActivity
To stop the Magisk App via CLI command use:
Bash:
am force-stop com.topjohnwu.magisk
Start/Stop the Magisk Daemon
To stop the Magisk Daemon use
Bash:
magisk --stop
Be aware that stopping the magisk daemon will remove all bind mounts for files in /system. To re-enable these bind mounts a reboot is required.
To start the Magisk Daemon use
Bash:
/data/adb/magisk/magisk64 --daemon
To check if the Magisk Daemon is running use
Bash:
/data/adb/magisk/magisk64 -v
Example output:
Code:
# Magisk Daemon is running
ASUS_I006D:/ # /data/adb/magisk/magisk64 -v
25.2:MAGISK:R
ASUS_I006D:/ #
# Magisk Daemon is not running
|ASUS_I006D:/ # /data/adb/magisk/magisk64 -v
No daemon is currently running!
1|ASUS_I006D:/ #
Building Magisk
The Magisk source code is available at
https://github.com/topjohnwu/Magisk
There are also instructions how to create a local copy of the repository and compile Magisk on that page. I've successfully build Magisk using these instructions.
Miscellaneous
magiskboot can also be used compress or decompress files:
Code:
1|ASUS_I006D:/data/adb/magisk # ./magiskboot
MagiskBoot - Boot Image Modification Tool
Usage: ./magiskboot <action> [args...]
Supported actions:
...
compress[=format] <infile> [outfile]
Compress <infile> with [format] to [outfile].
<infile>/[outfile] can be '-' to be STDIN/STDOUT.
If [format] is not specified, then gzip will be used.
If [outfile] is not specified, then <infile> will be replaced
with another file suffixed with a matching file extension.
Supported formats: gzip zopfli xz lzma bzip2 lz4 lz4_legacy lz4_lg
decompress <infile> [outfile]
Detect format and decompress <infile> to [outfile].
<infile>/[outfile] can be '-' to be STDIN/STDOUT.
If [outfile] is not specified, then <infile> will be replaced
with another file removing its archive format file extension.
Supported formats: gzip zopfli xz lzma bzip2 lz4 lz4_legacy lz4_lg
1|ASUS_I006D:/data/adb/magisk #
magiskboot is also used in TWRP to unpack and repack the boot image for installing Magisk
Using the magisk binary while the phone is booted into TWRP
If the used TWRP can mount the volume for /data you can also use the binary magisk while in TWRP. The magisk binary is not in the path while booted into TWRP - therefor you must use the fully qualified filename:
This is
/data/adb/magisk/magisk64
for 64 Bit CPUs and
/data/adb/magisk/magisk32
for 32 Bit CPUs.
Some functions of Magisk are only usable if the Magisk daemon is running. To start the Magisk daemon the Magisk binary can also be used - example:
Code:
# read the policies table from the Magisk squlite database
#
ASUS_I006D:/ # /data/adb/magisk/magisk64 --sqlite "select * from policies ;"
No daemon is currently running!
#
# -> the Magisk daemon is not running -> start it
#
1|ASUS_I006D:/ # /data/adb/magisk/magisk64 --daemon
ASUS_I006D:/ #
ASUS_I006D:/ # /data/adb/magisk/magisk64 --sqlite "select * from policies ;"
logging=1|notification=1|policy=2|uid=2000|until=0
logging=1|notification=1|policy=2|uid=10135|until=0
logging=1|notification=1|policy=2|uid=10143|until=0
logging=1|notification=1|policy=2|uid=10055|until=0
logging=1|notification=1|policy=2|uid=10142|until=0
ASUS_I006D:/ #
Use
Bash:
/data/adb/magisk/magisk64 -V
to check if the Magisk daemon is running
Use
Bash:
/data/adb/magisk/magisk64 --stop
to stop the Magisk Daemon, e.g.:
Code:
ASUS_I006D:/ # /data/adb/magisk/magisk64 -V
25200
# -> The Magisk Daemon is running
ASUS_I006D:/ # /data/adb/magisk/magisk64 --stop
ASUS_I006D:/ #
ASUS_I006D:/ # /data/adb/magisk/magisk64 -V
No daemon is currently running!
1|ASUS_I006D:/ # 2D
Trouble Shooting
If something went wrong and booting the phone does not work anymore after installing a Magisk Module just remove the files in /data/adb/modules/<modulename> and reboot the phone :
Either connect via adb to the not booting phone (this should be possible in most cases even if the boot process does not finish), delete the files, and reboot the phone. Or reboot the phone from a Recovery image like TWRP, delete the files in /data/adb/modules/<modulename>, and reboot the phone.
The same procedure can be used if booting the phone does not work anymore after adding another init script - just delete the new script in /data/adb/post-fs-data.d or /data/adb/service.d and reboot the phone
An error like this
Code:
08-06 18:41:39.341 +0000 1356 1726 W ziparchive: Unable to open '/system/app/AsusFMRadio/AsusFMRadio.apk': Permission denied
08-06 18:41:39.341 +0000 1356 1726 E system_server: Failed to open APK '/system/app/AsusFMRadio/AsusFMRadio.apk': I/O error
08-06 18:41:39.354 +0000 1356 1356 W PackageManager: Failed to parse /system/app/AsusFMRadio: Failed to parse /system/app/AsusFMRadio/AsusFMRadio.apk
is most of the time caused by missing read permissions for the file.
Use
Bash:
chmod o+r /system/app/AsusFMRadio/AsusFMRadio.apk
to fix it.
To catch errors from a script executed by Magisk you might use this technique:
Bash:
# redirect STDERR of all commands in the script to a file
#
exec 2>/data/script_stderr.log
set -x
... rest of your script
To remove all installed Magisk Modules using the official method use:
Code:
magisk --remove-modules
to remove all modules (but not the new init scripts!) and reboot the phone
According to the FAQ Magisk will not start if the phone is booted into safe mode (see
https://topjohnwu.github.io/Magisk/faq.html)
Be aware that after rebooting the phone again in normal mode all Magisk Modules are disabled and must be enabled again using either the Magisk App or a CLI command:
To reenable all Magisk Modules via shell command do
Bash:
adb shell rm /data/adb/modules/*/disable
Spoiler: History
HIstory
07.08.2022 /bs
Added additional infos about the permissions for new files for /system.
Added additional commands to the script for catching the OS logs while booting the phone
Added infos about a workaround to add new files to /product, /vendor, or /system_ext
Added infos about how to access file replaced by a Magisk Module
20.09.2022 /bs
Added new links to posts about configuring swap devices via Magisk script
Added a link to the post about how to use Magisk to unpack and repack the boot image
28.09.2022 /bs
Added infos about the backups of the boot partitions created by Magisk
30.09.2022 /bs
Added a short info about using Magisk Overlays to change files in the root filesystem
Added the URL for the post with how to change the active slot using the Magisk App
02.10.2022 /bs
Added a short info about Root Directory Overlay system from Magisk
04.10.2022 /bs
Add an URL to another post to use the Root Directory Overlay system from Magsik
Fixed some spelling errors and also some errors in the code examples
Added more details about changing files in /system
26.10.2022/bs
Added the section Miscellaneous
28.10.2022/bs
Added the section Start/Stop the Magisk App
Added the section Start/Stop the Magisk Daemon
02.11.2022 /bs
added the infos about the x86 version of the magiskboot executables in the Magisk apk file
fixed some spelling and formatting errors
04.11.2022/bs
add the link to the Howto about making a file in /system writable
corrected some formatting errors
06.11.2022/bs
added more details about the boot partition backups created by Magisk
added missing "su - -c" to some adb shell commands
07.11.2022/bs
added more details about the boot partition backups created by Magisk
added the section about the temporary Magisk config directory
08.11.2022/bs
added the section about how to get the Magisk App installation directory
25.11.2022/bs
added infos about how to build Magisk using a local copy of the repository
02.12.2022 /bs
added the infos about sing the magisk binary while the phone is booted into TWRP
06.12.2022 /bs
added the section Magisk root access configuration details
added infos about the files used to store the settings for the Magisk App
30.12.2022 /bs
added more infos about how to add new start / stop services in Android
07.05.2023 /bs
add infos about how to create the Magisk database manuallay
Nice.
Thank you very much for all the details and explanations.
possible to change "Automatic Response" setting via adb command?
LEENO said:
possible to change "Automatic Response" setting via adb command?
Click to expand...
Click to collapse
What do you mean with "Automatic Response"?
bnsmb said:
What do you mean with "Automatic Response"?
Click to expand...
Click to collapse
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Most probably yes ... I will check that
LEENO said:
View attachment 5778489
Click to expand...
Click to collapse
Where does the Magisk App store the settings?

How To Guide How to change any file or directory using Magisk

To change a file (or directory) in one of the read-only mounted filesystems in the Android OS Magisk can be used.
(see How to change files in the directory /system with Magisk and How to make files in /system writable )
But this method only works for files in the directories /system, /vendor, /product, or /system_ext.
In current Android OS implementations there are a lot of other directories on read-only filesystems with files that must be changed or replaced to change the behaviour of Android.
For example on some Android implementations the boot animation is in the file /my_product/media/bootanimation/bootanimation.zip. The standard mechanism to change a file on a read-only mounted filesystem via Magisk can not be used to replace this file with another file.
But Magisk also supports executing scripts while booting the phone (see How to run a script at every boot using Magisk)
And the Magisk init scripts in the directory /data/adb/post-fs-data.d are executed early in the boot process. Therefor we can create a Magisk init script to replace any file with another file using the same method Magisk is using (that is a "mount -o bind ..." ):
Note
All commands in this Howto must be done by the user root.
Example
To replace the boot animation with another one copy the ZIP file with the new boot animation to the directory /data/adb (or any other read-write mounted directory available early in the boot process), e.g:
Code:
ASUS_I006D:/data # ls -l /data/adb/Earth_bootanimation.zip
-rw-r--r-- 1 u0_a130 media_rw 13227720 2022-04-16 10:58 /data/adb/Earth_bootanimation.zip
ASUS_I006D:/data #
Make sure that the permissions and SELinux contexts for the file are okay using these commands:
Bash:
chown root:root /data/adb/Earth_bootanimation.zip
chmod 0644 /data/adb/Earth_bootanimation.zip
chcon -v u:object_r:system_file:s0 /data/adb/Earth_bootanimation.zip
Result:
Code:
ASUS_I006D:/data # ls -ldZ /data/adb/Earth_bootanimation.zip
-rw-r--r-- 1 root root u:object_r:system_file:s0 13227720 2022-04-16 10:58 /data/adb/Earth_bootanimation.zip
ASUS_I006D:/data #
Now create a Magisk init script to replace the file via bind mount:
Bash:
echo "mount -o bind /data/adb/Earth_bootanimation.zip /system/media/bootanimation.zip " >/data/adb/post-fs-data.d/change_bootanimation.sh
chmod 755 /data/adb/post-fs-data.d/change_bootanimation.sh
That's it .. Reboot the phone and enjoy the new animation.
To remove the new animation just delete the script /data/adb/post-fs-data.d/change_bootanimation.sh and reboot the phone.
The same method can be used to replace a complete directory using these steps:
e.g. to make the directory /odm/etc writable do:
Bash:
#
# create the new directory
#
mkdir /data/adb/odm_etc
#
# copy the existing files in /odm/etc to the new directory
#
cd /odm/etc && find . | cpio -pdum /data/adb/odm_etc
#
# create the Magisk init script to replace /odm/etc with the new directory /data/adb/odm_etc
#
echo "# make /odm writable
mount -o bind /data/adb/odm_etc /odm/etc
" >/data/adb/post-fs-data.d/make_odm_etc_writable
chmod 0755 /data/adb/post-fs-data.d/make_odm_etc_writable
Now reboot the phone and check the result:
Code:
ASUS_I006D:/ #
ASUS_I006D:/ # ls -l /odm/etc
total 15
-rw-r--r-- 1 root root 4961 2009-01-01 01:00 NOTICE.xml.gz
-rw------- 1 root root 1136 2009-01-01 01:00 build.prop
-r--r--r-- 1 root root 0 2009-01-01 01:00 fs_config_dirs
-r--r--r-- 1 root root 0 2009-01-01 01:00 fs_config_files
-rw-r--r-- 1 root root 0 2009-01-01 01:00 group
-rw-r--r-- 1 root root 0 2009-01-01 01:00 passwd
drwxr-xr-x 2 root root 3452 2023-01-18 16:30 selinux
ASUS_I006D:/ #
#
# create a new file in the directory used to replace /odm/etc
#
ASUS_I006D:/ # touch /data/adb/odm_etc/test.$$
ASUS_I006D:/ # ls -l /data/adb/odm_etc/test.$$
-rw-r--r-- 1 root root 0 2023-01-18 16:41 /data/adb/odm_etc/test.4597
ASUS_I006D:/ #
#
# check the contents of the directory /odm/etc
#
ASUS_I006D:/ # ls -l /odm/etc/test.$$
-rw-r--r-- 1 root root 0 2023-01-18 16:41 //odm/etc/test.4597
ASUS_I006D:/ #
Caution
I'm sure there is a reason why this feature is not implemented for all directories by default in Magisk
And, for example, if you make the directory /odm/etc writable using the method described above Android will complain after the next reboot with an error message that something is wrong with your phone.
Therefor please use with care! If possible only use this approach to make single files writable.
Trouble Shooting
In case the phone does not boot anymore after replacing a file or directory using this method:
Reboot the phone from a recovery with adb support (like TWRP) and delete the script in /data/adb/post-fs-data to fix the error
Notes
Files or directories that are used by Android before the Magisk init scripts are executed can not be changed using this method. These files must be replaced by changing the files in the ramdisk on the boot partition (see How to change files in the boot image using Magisk and How to trigger an action when a property is changed )
There are various Magisk Modules available in the internet to replace the animation that use this technique
To test a boot animation while the Android OS is running do:
Bash:
mount -o bind /data/adb/bootanimation_android12.zip /system/media/bootanimation.zip
bootanimation
Update 24.06.2023/bs
See the post https://forum.xda-developers.com/t/...directory-using-magisk.4543103/#post-88679517 below in this thread for using an overlayfs to make files read-write.
Can it be used to add a self-signed SSL certificate? And also this method works only with ASUS ZenFone 8 or also with others (e.g. OnePlus 9 pro)?
Romano36 said:
Can it be used to add a self-signed SSL certificate? And also this method works only with ASUS ZenFone 8 or also with others (e.g. OnePlus 9 pro)?
Click to expand...
Click to collapse
Hi
Can it be used to add a self-signed SSL certificate?
Click to expand...
Click to collapse
What is the purpose of the new SSL certificate?
If you intend to change the SSL certificate that was used to create the OS :
I did not test this but I'm pretty sure that you can not replace that certificate in an installed OS.
And also this method works only with ASUS ZenFone 8 or also with others (e.g. OnePlus 9 pro)?
Click to expand...
Click to collapse
This method works for all phones and OS that are supported by Magisk.
regards
Bernd
Modded by moderator
Romano36 said:
My purpose is to put a new certificate in this folder /system/etc/security/cacerts/. I have to try.
Click to expand...
Click to collapse
That should work . But I suggest to use a "dummy" Magisk module for that purpose -- see:
How to change files in the directory /system with Magisk
How to change files in the directory /system with Magisk Note: I tested the instructions below with Magisk 24. 25.0, and 25.2 on an ASUS Zenfone 8 running OmniROM (Android 12 ) . The filesystem for /system is normally mounted read-only In...
forum.xda-developers.com
regards
Bernd
Thanks!!!
bnsmb said:
To change a file (or directory) in one of the read-only mounted filesystems in the Android OS Magisk can be used.
(see How to change files in the directory /system with Magisk and How to make files in /system writable )
But this method only works for files in the directories /system, /vendor, /product, or /system_ext.
In current Android OS implementations there are a lot of other directories on read-only filesystems with files that must be changed or replaced to change the behaviour of Android.
For example on some Android implementations the boot animation is in the file /my_product/media/bootanimation/bootanimation.zip. The standard mechanism to change a file on a read-only mounted filesystem via Magisk can not be used to replace this file with another file.
But Magisk also supports executing scripts while booting the phone (see How to run a script at every boot using Magisk)
And the Magisk init scripts in the directory /data/adb/post-fs-data.d are executed early in the boot process. Therefor we can create a Magisk init script to replace any file with another file using the same method Magisk is using (that is a "mount -o bind ..." ):
Note
All commands in this Howto must be done by the user root.
Example
To replace the boot animation with another one copy the ZIP file with the new boot animation to the directory /data/adb (or any other read-write mounted directory available early in the boot process), e.g:
Code:
ASUS_I006D:/data # ls -l /data/adb/Earth_bootanimation.zip
-rw-r--r-- 1 u0_a130 media_rw 13227720 2022-04-16 10:58 /data/adb/Earth_bootanimation.zip
ASUS_I006D:/data #
Make sure that the permissions and SELinux contexts for the file are okay using these commands:
Bash:
chown root:root /data/adb/Earth_bootanimation.zip
chmod 0644 /data/adb/Earth_bootanimation.zip
chcon -v u:object_r:system_file:s0 /data/adb/Earth_bootanimation.zip
Result:
Code:
ASUS_I006D:/data # ls -ldZ /data/adb/Earth_bootanimation.zip
-rw-r--r-- 1 root root u:object_r:system_file:s0 13227720 2022-04-16 10:58 /data/adb/Earth_bootanimation.zip
ASUS_I006D:/data #
Now create a Magisk init script to replace the file via bind mount:
Bash:
echo "mount -o bind /data/adb/Earth_bootanimation.zip /system/media/bootanimation.zip " >/data/adb/post-fs-data.d/change_bootanimation.sh
chmod 755 /data/adb/post-fs-data.d/change_bootanimation.sh
That's it .. Reboot the phone and enjoy the new animation.
To remove the new animation just delete the script /data/adb/post-fs-data.d/change_bootanimation.sh and reboot the phone.
The same method can be used to replace a complete directory using these steps:
e.g. to make the directory /odm/etc writable do:
Bash:
#
# create the new directory
#
mkdir /data/adb/odm_etc
#
# copy the existing files in /odm/etc to the new directory
#
cd /odm/etc && find . | cpio -pdum /data/adb/odm_etc
#
# create the Magisk init script to replace /odm/etc with the new directory /data/adb/odm_etc
#
echo "# make /odm writable
mount -o bind /data/adb/odm_etc /odm/etc
" >/data/adb/post-fs-data.d/make_odm_etc_writable
chmod 0755 /data/adb/post-fs-data.d/make_odm_etc_writable
Now reboot the phone and check the result:
Code:
ASUS_I006D:/ #
ASUS_I006D:/ # ls -l /odm/etc
total 15
-rw-r--r-- 1 root root 4961 2009-01-01 01:00 NOTICE.xml.gz
-rw------- 1 root root 1136 2009-01-01 01:00 build.prop
-r--r--r-- 1 root root 0 2009-01-01 01:00 fs_config_dirs
-r--r--r-- 1 root root 0 2009-01-01 01:00 fs_config_files
-rw-r--r-- 1 root root 0 2009-01-01 01:00 group
-rw-r--r-- 1 root root 0 2009-01-01 01:00 passwd
drwxr-xr-x 2 root root 3452 2023-01-18 16:30 selinux
ASUS_I006D:/ #
#
# create a new file in the directory used to replace /odm/etc
#
ASUS_I006D:/ # touch /data/adb/odm_etc/test.$$
ASUS_I006D:/ # ls -l /data/adb/odm_etc/test.$$
-rw-r--r-- 1 root root 0 2023-01-18 16:41 /data/adb/odm_etc/test.4597
ASUS_I006D:/ #
#
# check the contents of the directory /odm/etc
#
ASUS_I006D:/ # ls -l /odm/etc/test.$$
-rw-r--r-- 1 root root 0 2023-01-18 16:41 //odm/etc/test.4597
ASUS_I006D:/ #
Caution
I'm sure there is a reason why this feature is not implemented for all directories by default in Magisk
And, for example, if you make the directory /odm/etc writable using the method described above Android will complain after the next reboot with an error message that something is wrong with your phone.
Therefor please use with care! If possible only use this approach to make single files writable.
Trouble Shooting
In case the phone does not boot anymore after replacing a file or directory using this method:
Reboot the phone from a recovery with adb support (like TWRP) and delete the script in /data/adb/post-fs-data to fix the error
Notes
Files or directories that are used by Android before the Magisk init scripts are executed can not be changed using this method. These files must be replaced by changing the files in the ramdisk on the boot partition (see How to change files in the boot image using Magisk and How to trigger an action when a property is changed )
There are various Magisk Modules available in the internet to replace the animation that use this technique
To test a boot animation while the Android OS is running do:
Bash:
mount -o bind /data/adb/bootanimation_android12.zip /system/media/bootanimation.zip
bootanimation
Click to expand...
Click to collapse
Hello,
I would like to create a Magisk module that targets the file /odm/etc/mixer_paths.xml.
I am a little confused about the examples you have given. Can you please guide me using the directory I mentioned? It would be very helpful. Thank you.
sargodian2 said:
Hello,
I would like to create a Magisk module that targets the file /odm/etc/mixer_paths.xml.
I am a little confused about the examples you have given. Can you please guide me using the directory I mentioned? It would be very helpful. Thank you.
Click to expand...
Click to collapse
Hi
no Magisk module necessary (but it can be done also via Magisk Module, of course)
Use
- install Magisk
- become root user
- create the file /data/adb/mixer_paths.xml with the changed contents
- create the script /data/adb/post-fs-data.d/change_odm_etc_mixer.sh :
echo "mount -o bind /data/adb/mixer_paths.xml /odm/etc/mixer_paths.xml " >/data/adb/post-fs-data.d/change_odm_etc_mixer.sh
- make the script executable
chmod 755 /data/adb/post-fs-data.d/change_odm_etc_mixer.sh
- reboot
Note that these instructions only work if the file /odm/etc/mixer_paths.xml already exists - you can not create additional files using this approach.
regards
Bernd
bnsmb said:
Hi
no Magisk module necessary (but it can be done also via Magisk Module, of course)
Use
- install Magisk
- become root user
- create the file /data/adb/mixer_paths.xml with the changed contents
- create the script /data/adb/post-fs-data.d/change_odm_etc_mixer.sh :
echo "mount -o bind /data/adb/mixer_paths.xml /odm/etc/mixer_paths.xml " >/data/adb/post-fs-data.d/change_odm_etc_mixer.sh
- make the script executable
chmod 755 /data/adb/post-fs-data.d/change_odm_etc_mixer.sh
- reboot
Note that these instructions only work if the file /odm/etc/mixer_paths.xml already exists - you can not create additional files using this approach.
regards
Bernd
Click to expand...
Click to collapse
Thank You, It worked.
thank you bnsmb
i fallowed your clear steps to modify cscfeature.xml on my S23
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
amk316 said:
View attachment 5938113
Click to expand...
Click to collapse
what's the message of this screenshot?
bnsmb said:
what's the message of this screenshot?
Click to expand...
Click to collapse
when i bind cscfeature.xml on my s23 MemoryDetector app detected it!!!
amk316 said:
when i bind cscfeature.xml on my s23 MemoryDetector app detected it!!!
Click to expand...
Click to collapse
>>when i bind cscfeature.xml on my s23 MemoryDetector app detected it!!!
and do you think that shouldn't be?
I don't know what the MemoryDetector app is used for but is quite easy for an app to check the current mounts to find bind mounts. So it works like expected.
regards
Bernd
Another method to change files in read-only filesystems is to use an overlay filesystem.
This method is implemented in the Magisk Module Magisk Overlayfs.
The source code for this Magisk module is available here:
https://github.com/HuskyDG/magic_overlayfs
Using this Magisk Module every file in most of the read-only filesystems in Android can be changed;
excerpt from the documentation:
Make most parts of system partition (/system, /vendor, /product, /system_ext, /odm, /odm_dlkm, /vendor_dlkm, ...) become read-write.
Click to expand...
Click to collapse
I successfully tested this Magisk Module on an ASUS Zenfone 8 running OmniROM 13.
Notes:
There is no installable zip file in the repository for the Magisk Overlayfs . But the repository contains a script to create the zip file (build.sh).
Note that I had to change the code to create the Magisk module zip file in the script build.sh to create an installable Magisk Module:
I replaced the line
Bash:
zip -r9 out/magisk-module-release.zip out/magisk-module
with
Bash:
cd out/magisk-module && zip -r9 ../magisk-module-release.zip

whoami: bad uid 0

I replaced old /system/bin/toybox with a new binary from http://landley.net/toybox/bin then I created symlinks with for i in $(./toybox); do ln -s toybox $i. There is su in symlinks.
Now I cannot open Magisk anymore, stuck at splash screen mask.
Also MiXplorer cannot browse root dirs.
With Terminal Emulator I can still browse root dirs.
If I type which su I get /sbin/su which is a symlink to /sbin/magisk.
I have not yet tried to reboot because I fear to get stuck, maybe it would repair by itself but who knows?
If I type whoami I get bad uid 0, after su shell I get bad uid 2000 and so on.
How can I restore root? I can access TWRP recovery.
how about /sbin/su -c unlink /system/bin/su or wherever you symlinked toybox applets?
are you sure that binary is actually a replacement including all android specific applets (like getevent) for built-in toybox?
why did you replace system files in first place if you're actually on Magisk and could just use systemless overlays instead?
If I try to unlink it says it's read-only file system. I could try to do it in recovery but I'm afraid to reboot...
What is strange is that which su points to /sbin/magisk, so it should not consider the other su symlink to toybox
Another thing I noticed is that new symlink to toybox created with my script are root both UID and GID, while existing ones are root UID and shell GID
Toybox binary is specific for my Android ARMv8 http://landley.net/toybox/downloads/binaries/0.8.9/toybox-aarch64.
You are right about systemless overlays.
aarch64 is only the cpu architecture, doesn't say anything about android.
how did you install toybox on read-only file system? remount -o,rw /
ok, however the arch is right for my Snap855, I tried other applets embedded in toybox, like factor, and they work.
I used MiXplorer to write to system, I gave it root permissions so it could work on it. Now MiX is unarmed and Terminal Emulator can only read into root dirs but not write.
quick check with my toybox yours is missing all android specific applets
Code:
:/ $ cd $HOME
:/data/user/0/jackpal.androidterm/app_HOME $ ls -la
total 780
drwxrwx--x 2 u0_a152 u0_a152 4096 2023-01-30 14:46 .
drwxr-x--x 6 u0_a152 u0_a152 4096 2023-01-28 01:58 ..
-rwx--x--x 1 u0_a152 u0_a152 783680 2023-01-30 14:24 toybox
:/data/user/0/jackpal.androidterm/app_HOME $ ./toybox --version
toybox 0.8.9
:/data/user/0/jackpal.androidterm/app_HOME $ toybox --version
toybox 0.7.6-android
:/data/user/0/jackpal.androidterm/app_HOME $ for i in $(toybox); do ./toybox | grep -qw $i || echo $i; done
chcon
dd
diff
expr
getenforce
getfattr
gzip
load_policy
lsof
modprobe
more
restorecon
runcon
sendevent
setenforce
setprop
start
stop
stty
tr
traceroute
traceroute6
you should reinstall stock toybox from TWRP backup.
edit: this might help
Code:
:/ $ ls -lZ /system/bin/toybox
-rwxr-xr-x 1 root shell u:object_r:toolbox_exec:s0 352532 2008-12-31 17:00 /system/bin/toybox
I renamed the old toybox, so I could restore it from recovery.
Btw, I get this with ls -lZ
-rwxr-xr-x 1 0 2000 ? 825176 2023-01-29 07:34 /system/bin/toybox
Seem to have lost context there.
Thanks for your quick replies.
either you're on Jelly bean or you lost secontext. repair with chcon
Code:
chcon u:object_r:toolbox_exec:s0 /system/bin/toybox
You are right, new toybox does not have specific Android applet, like chcon or restorecon.
So, please correct me if I'm wrong, I reboot in TWRP, restore old toybox.
Then should I run chcon / restorecon or reboot straight away?
I lost secontext in all root dirs /, /system, /vendor, /sdcard...
not sure what ROM you're talking about. maybe you used ls of wrong toybox?
Don't understand your answer, what ROM are you referring to?
If I ./"toybox old" restorecon I get restorecon: Needs 1 argument (see "restorecon --help")
If I restorecon I get toybox: Unknown command restorecon (see "toybox --help")
Please advise me if it's right to restore old toybox via TWRP and reboot to system or there's the need to chcon / restorecon, thanks
please give the output of
Code:
grep ro.build.fingerprint /system/build.prop /system*/system/build.prop
it's very unlikely you lost every secontext. either it never existed or you just can't view.
restorecon won't help you much. only restoring TWRP backup could restore secontext as it was before.
grep ro.build.fingerprint /system/build.prop
ro.build.fingerprint=Xiaomi/cepheus_eea/cepheus:10/QKQ1.190825.002/V11.0.9.0.QFAEUXM:user/release-keys
ro.build.fingerprint_real=Xiaomi/cepheus/cepheus:10/QKQ1.190825.002/20.7.2:user/release-keys/1593694646
so your ROM is stock ROM Android 10 it must have secontext of course. in case it's true you lost every secontext best is download cepheus_eea_global_images_V11.0.9.0.QFAEUXM_20200421.0000.00_10.0_eea_31715f4bd1.tgz and flash_all_except_storage.bat
(you can backup boot in TWRP beforehand and flash boot.emmc.win from fastboot right after)
edit: build.prop usually is in /system(_root)/system/build.prop on new devices, so most likely what you think is build.prop is just from the TWRP image used.
maybe you didn't mount System?
Resolved
Rebooted into TWRP, restored original toybox, deleted my symlinks, checked secontexts ok, rebooted to system, all fine.
Thank for your support
you can place toybox in /data/adb/modules/toybox/system/xbin/toybox, make a diff and only symlink missing applets in there.
then create modules.prop, reboot and done.

Categories

Resources