[Samsung Gear S3] adfree:
:rolleyes:

I'm stuck still in Security jungle... :o :(

With Combination Firmware and Tizen 5... 5.5 Development Firmware I have nearly full access...

I can delete what I want, copy and replace...

I can install RPM packages...

:angel:

With my rooted Firmwares for SM-R760 I have not so much luck... :crying:

Permission denied

:rolleyes:

So I need to increase my "skills" with Security... of rootfs.img

No idea if I can create own vaild rootfs.img with valid verity crap...

Here is what i can do on Combination Firmware:

sh-3.2# verityctl -h
Usage: verityctl [OPTION...] <action> <action-specific>
--hash-offset Starting offset of hash meta
--verbose Be verbosely
-h, --help Show help

Action commands:
format <device> - format device
create <name> <device> - create active device
verify <device> - verify device
remove <name> - remove (deactivate) device
dump <device> - show on-disk information
get-mode <device> - show verity mode of device
disable <device> - disable dm-verity. reboot is needed
if <device> is not given, assume as rootfs

Cool. Parameter verbose is not useless...

sh-3.2# verityctl --verbose verify /dev/mmcblk0p14
# Allocating crypt device /dev/mmcblk0p14 context.
# Trying to open and read device /dev/mmcblk0p14 with direct-io.
# Initialising device-mapper backend library.
# Trying to load VERITY crypt type from device /dev/mmcblk0p14.
# Crypto backend (gcrypt 1.7.7) initialized.
# Detected kernel Linux 3.18.14 aarch64.
# Reading VERITY header of size 512 on device /dev/mmcblk0p14, offset 1310752768.
# Setting ciphertext data device to /dev/mmcblk0p14.
# Trying to open and read device /dev/mmcblk0p14 with direct-io.
# Activating volume [none] by volume key.
# Trying to activate VERITY device [none] using hash sha256.
# Verification of data in userspace required.
# Hash verification sha256, data device /dev/mmcblk0p14, data blocks 320000, hash_device /dev/mmcblk0p14, offset 320009.
# Using 3 hash levels.
# Data device size required: 1310720000 bytes.
# Hash device size required: 1321082880 bytes.
# Verification of data area succeeded.
# Verification of root hash succeeded.
# Releasing crypt device /dev/mmcblk0p14 context.
# Releasing device-mapper backend.
Verity verification successed.

My Combination Firmware is CRB1... not CQL1 or earlier...

sh-3.2# verityctl --verbose dump /dev/mmcblk0p14
HASH name : dm-verity
HASH magic : c001c001
HASH mode : on
HASH type : 1
HASH algorithm : sha256
HASH data block size: 4096
HASH data size : 320000
HASH block size : 4096
HASH offset : 1310752768
HASH root hash : 6db8203a60ec468137197e7321521c1c36ce7e158152c51b588589c2bd525791
HASH salt hash : 1084dd35ce093c224140544b5497984800602e18404571c0fc5c68ca43810aa7
sh-3.2# verityctl --verbose get-mode /dev/mmcblk0p14
verity mode is 'on'
sh-3.2# verityctl --verbose disable
sh-3.2# verityctl dump /dev/mmcblk0p14
HASH name : dm-verity
HASH magic : c001c001
HASH mode : off
HASH type : 1
HASH algorithm : sha256
HASH data block size: 4096
HASH data size : 320000
HASH block size : 4096
HASH offset : 1310752768
HASH root hash : 6db8203a60ec468137197e7321521c1c36ce7e158152c51b588589c2bd525791
HASH salt hash : 1084dd35ce093c224140544b5497984800602e18404571c0fc5c68ca43810aa7
sh-3.2# verityctl --verbose get-mode /dev/mmcblk0p14
verity mode is 'off'

Partition p14 because ROOTFS aka rootfs.img...

On other devices like LTE... other partition...

Here some theory ... background infos about SMACK:

https://wiki.tizen.org/Security:Smack

I see differences between Stock Firmware and Combination Firmware... but i was not able yet to get rid off... :cyclops:

Best Regards