[Nexus 9 General] vovams:
Force-Encrypt Toggler

Now that CyanogenMod developers stated that they are going to follow Google's guidelines about forced encryption in their ROM for Nexus 9, those of us who want their tablets unencrypted will have to flash a modified boot image every time they update CM. I hate doing such things manually every time, so i created a patch that disables forced encryption the right way - flash once and forget forever.

force-encrypt-toggler reads and unpacks your boot image, patches the ramdisk, creates a new boot image and flashes it back to the boot partition. And all that is done right on your tablet. Than it uses CM's addon.d framework, so that each time you flash a new CM zip, force-encrypt-toggler is invoked automatically to patch the newly flashed boot image. Thus, you can just upgrade through CM's built-in updater and everything will be patched automatically every time :) . Also, the script itself can be used on any Linux computer to patch (probably) any boot.img you have.

Thus far i have used it on my Nexus 9 to stay unencrypted starting from 20150216 through 20150224 nightlies. It seems to be quite stable, i believe ;) . See some notes in the second post.

Download

force-encrypt-toggler-1.1-flounder.zip : https://goo.gl/bw7YDq

force-encrypt-toggler-1.1-flounder-dbg.zip : https://goo.gl/95JN34 - this one creates log files in /cache every time

force-encrypt-toggler-1.1-linux.tar.gz : https://goo.gl/3PF6ru - to be used on a desktop to patch arbitrary boot.img

old versions (for CM12): https://goo.gl/125eey

Sorry, it looks like i can not post clickable links yet. Remove space between "https" and colon.

Compatibility

I have tested this script only on my Nexus 9 Wi-Fi with TWRP recovery and CM stock boot image. However, i believe that it should be possible to make it work on other devices (e.g. Nexus 6) by just changing a few constants at the beginning.

Version 1.1

requires

TWRP version >= 2.8.7.1 and a CM13 nightly >= 20160110. Version 1.0 will work for CM12.x (but not for recent CM13 nightlies).

Known issues

The addon.d script uses a dirty hack to trick the recovery. While this never happened to me, if you ever encounter a strange recovery behavior regarding installation or backup of boot images after flashing CM zip over CM with this mod, this might be it. Just reboot and it should be ok. See the second post for more info.

If CM changes something in their updater or if something changes in the recovery, this mod may easily break due to the hack mentioned above. Read the disclaimer.

Each time you flash a CM zip over a CM installation with this mod installed, TWRP recovery will hang for 5-10 seconds after reporting successful completion and before showing buttons at the bottom (or before rebooting in case of open recovery script execution). It is possible to fix this easily, but than this mod might be much easier to break.

Installation

First, you should read the disclaimer above and backup your data. Than you just have to flash the zip you downloaded with TWRP recovery. CyanogenMod must be installed first. If your /data is currently encrypted, you will have to do a full factory reset to decrypt it (backup your data first!).

Your current boot image will be patched during installation process (it should not hurt, if it's already patched). In case if something goes wrong, installation script will tell you. In any case you can get force-encrypt-toggler debug output by something like:

adb pull /tmp/fet.log

Be sure to do this before you reboot, because that file is created in the RAM.

Removal

In order to remove force-encrypt-toggler you have to delete the following files from your /system partition:

/system/xbin/mkbootimg (v1.1)
/system/xbin/unpackbootimg (v1.1)
/system/bin/force-encrypt-toggler
/system/addon.d/90-force-encrypt-toggler.sh
/system/bin/mkbootimg (v1.0)
/system/bin/unpackbootimg (v1.0)

And than restore your original boot image. You can also just format /system and flash CM again, but that is such an overkill ;) .

Usage

Normally you will not need to run force-encrypt-toggler yourself, but in case you need, you should be able to run it both in Android and in recovery via adb shell. Just run it with --help option to see what it can do. In case you will have to debug some glitches, this command may be useful:

force-encrypt-toggler --set-not-forced --debug --dry-run --no-cleanup

If you use it on a Linux computer, this is what you will probably need:

sudo ./force-encrypt-toggler --set-not-forced [ --input path/to/boot.img --output path/to/new/boot.img ]

Note that Android and computer versions are functionally equivalent, so you can theoretically patch boot images for one Android device on another one...

Changelog

v1.1
+ use toybox instead of busybox because CM now ships only the later
+ mkbootimg and unpackbootimg are now installed to /system/xbin
+ the --help option can now be used without root privileges

v1.0 - initial release

Credits

mkbootimg is built from AOSP source

unpackbootimg is taken from this GitHub page: https://github.com/Dees-Troy/unpackbootimg

update-binary is taken from a CM zip