yashsingh1/xdaforums huggingface dataset:
[Google Pixel 2 XL Guides, News, & Discussion] ScottIsMyName:
After doing some further research, I have noticed a few things.

The init binary inside the ramdisk went from roughly 1.5MB to 600KB. I'm not sure if this is normal. I will investigate further when I get home to see if similar things happen when running Magisk on the stock Pixel XL boot img. It may be another case where it's removing unnecessary padding.

The second thing, is that when viewing the patched init binary in a hex editor, the patched contains Android r16-beta1 near the top of the headers. I'm not sure if this matters at all, but just something I noticed (see attachment)
[Google Pixel 2 XL Guides, News, & Discussion] DaMadOne:
From my understanding magisk replaces the stock init with it's own, which would explain the size difference. If you extract the Magisk-V14.3 zip and go into the "arm64" directory I bet the file called 'magiskinit" is the same 618kB file you're finding the stock one is replaced with.

I've uploaded a repacked boot.img to my google drive. I only unpacked it and the ramdisk, then repacked the ramdisk and repacked the boot.img with the kernel and repacked ramdisk. So no modifications, simply unpacked and repacked to see if that works on it's own. If someone flashes it let me know if it boots. If it does then I'll know at least that works. My phone arrives tomorrow. Can't wait to get home from work!

EDIT* file removed
[Google Pixel 2 XL Guides, News, & Discussion] Richard Robertson:
I'm also trying to get Magisk on my Pixel 2 XL, and I'm willing to contribute images/logs if it will help.
[Google Pixel 2 XL Guides, News, & Discussion] northmendo:
[MENTION=2614896]DaMadOne[/MENTION], I'll give it a try. Here is a copy of the original patched image that Magisk spits out from 14.3

https://app.box.com/s/pp733w0a22zcnb5rp5aa33fcmh10uges
[Google Pixel 2 XL Guides, News, & Discussion] ScottIsMyName:
I flashed this and it hung at the google logo for about 5 minutes....I decided to reflash stock boot.img after waiting that long since it seemed like it wasn't going to boot.
[Google Pixel 2 XL Guides, News, & Discussion] DaMadOne:
Hmm. the tools I'm using to unpack and repack are from 2013.. I wonder if they just don't work correctly with newer images. Well, hopefully I can figure out how to properly do it once I get a 2XL in my hands.
[Google Pixel 2 XL Guides, News, & Discussion] northmendo:
Pretty much the same thing here. It booted farther than the original patched image but never boots all the way. I also tried formatting userdata after it didn't boot to be sure there wasn't anything left to rule out. Then it ended up in a bootloop.
[Google Pixel 2 XL Guides, News, & Discussion] ScottIsMyName:
So I followed the same procedures on my OG Pixel XL with Magisk Manager 5.4 on the 7.1.2 image. I flashed the patched_boot.img and it seemed like it worked fine. Booted up and showed that Magisk was installed.

I compared the stock boot.img to the patched one and it doesn't look like any other changes to the ramdisk were made than what were made with the Pixel 2 XL.

At this point this is beyond me, so I'm hoping someone who knows more about this stuff can figure it out. It would be REALLY helpful if logs were written to /sdcard instead of /data so that we could see what was happening.

The only thing I was wondering is if there were changes to 8.0 that is causing the problem, but I never upgraded my Pixel XL to Oreo because ROMs aren't there yet.
[Google Pixel 2 XL Guides, News, & Discussion] ScottIsMyName:
Doing some more digging....

On the Pixel XL, the boot.img contained 2 additional files when I unpacked them, namely

devicetree.dtb
kernelimage

These files weren't present in the stock or patched boot images for the Pixel 2 XL (at least they weren't present when I unpacked them).

I started looking around and noticed this thread.

https://xdaforums.com/pixel-2-xl/how-to/tools-tools-building-pixel-2-xl-kernel-t3693955

I'm wondering if this has anything to do with our failures to get stuff to boot.
[Google Pixel 2 XL Guides, News, & Discussion] northmendo:
Nice work. Hopefully someone that deals with this stuff all the time can sort this out.
[Google Pixel 2 XL Guides, News, & Discussion] DaMadOne:
i possibly figured out what I did wrong unpacking/packing the img. I wasn't unpacking/packing as root so it wasn't extracting/creating all the files because of it. DOH!!

I'm headed off to bed, can't wait to get my hands on the phone tomorrow! Work is going to crawl by. Good luck to anyone still tinkering!
[Google Pixel 2 XL Guides, News, & Discussion] northmendo:
If you can post a new image I'll try it.
[Google Pixel 2 XL Guides, News, & Discussion] DaMadOne:
MODERATORS PLEASE DELETE!

Thanks
[Google Pixel 2 XL Guides, News, & Discussion] northmendo:
The first one was the same result. I'm trying the second now.
[Google Pixel 2 XL Guides, News, & Discussion] ScottIsMyName:
Neither one seems to work for me :(

I was looking more into the dtb/dtbo and I noticed part of the factory image contains a dtbo.img which means that the device tree blob overlay is outside of the boot partition, so maybe that explains why the Pixel 1 boot images are different from the pixel 2 boot images. Still curious if we need seperate tools for this to pack/unpack though.

https://source.android.com/devices/architecture/dto/
[Google Pixel 2 XL Guides, News, & Discussion] northmendo:
Same here both fail.
[Google Pixel 2 XL Guides, News, & Discussion] gakio12:
I'm curious if project Treble is the cause of the issues. This is technically the first phone built with it though the og pixel supposedly got updated to Treble with Oreo. Treble also has implications for custom ROMs, better, but different.
[Google Pixel 2 XL Guides, News, & Discussion] twist:
The terrible trouble with treble?
[Google Pixel 2 XL Guides, News, & Discussion] ScottIsMyName:
Well I was able to get a repacked image to boot using this tool:

https://xdaforums.com/showthread.php?t=2073775

So that's some great news. I'm having trouble modifying the image to add magisk to it manually, but at least progress is being made!
[Google Pixel 2 XL Guides, News, & Discussion] Born<ICs:
.

Progress is good! You're first I've read to boot repack. Simply reading osmosis posts makes my head hurt.
[Google Pixel 2 XL Guides, News, & Discussion] ScottIsMyName:
So I unpacked the stock boot img using the tool linked above. I then replaced the init binary and added the overlay directory to the ramdisk, and repacked the image.

The good news. It booted.

The bad news, Magisk still says it's not installed and not rooted.

So to summarize, it seems like the new boot image I created contains the things that Magisk adds:

1) The modified init binary

2) The overlay directory that contains sbin/magisk and init.magisk.rc

Not sure where to go from here. Someone mentioned it's possibly sepolicy not getting patched. I was browsing the magisk code and noticed that it doesn't try to patch sepolicy because our device contains the mount /dev/root.

See lines 180-196 in:

https://github.com/topjohnwu/Magisk/blob/master/scripts/boot_patch.sh
[Google Pixel 2 XL Guides, News, & Discussion] northmendo:
I really doubt that it will make a difference, but we could try the same process on the newly released android 8.1 beta - https://developer.android.com/preview/download.html
[Google Pixel 2 XL Guides, News, & Discussion] ScottIsMyName:
If anyone is feeling adventurous, we might try modifying the magisk code to make sure sepolicy is getting patched.

You'd have to modify

https://github.com/topjohnwu/Magisk/blob/master/scripts/boot_patch.sh

and execute lines 187-195 (probably in addition to lines 181-185). No idea what kind of side effects this would have though.
[Google Pixel 2 XL Guides, News, & Discussion] gakio12:
Can you change

ro.secure=1
.
.
.
ro.debuggable=0

to

ro.secure=0
.
.
.
ro.debuggable=1

in the default.prop then repack the boot.img and test that?

I should add; do all this in the patched_boot.img.

This is basic root.
[Google Pixel 2 XL Guides, News, & Discussion] northmendo:
Did you do it as root or chmod the permissions?
[Google Pixel 2 XL Guides, News, & Discussion] ScottIsMyName:
I chmod the executables appropriately (and also ran as admin).

It's strange, no change I make to the default.prop file shows up after booting (even adding new random prop values, or editing meaningless ones like setting mm.enable.smoothstreaming=false when it defaults to true.)
[Google Pixel 2 XL Guides, News, & Discussion] DaMadOne:
Well damn. My whole reason for wanting to be able to unpack/pack the boot.img was to make those changes to the default.prop mentioned above plus enabling adb at boot time to hopefully be able to pull a logcat while it was booting with magisk 14.3 patched boot. I've read through the scripts and it looked to me like what should be happening was happening to the ramdisk. Good catch on the sepolicy thing [MENTION=2133630]skaforey[/MENTION]. I just got home so I'm setting up mine and working on transferring my gf's stuff to my MXPE, I'll chime in when I'm finally ready to mess around.
[Google Pixel 2 XL Guides, News, & Discussion] ScottIsMyName:
It's very strange....flashing the patched_boot.img file bootloops, but doesn't get far enough in the boot process for adb logcat to capture anything (i.e. it restarts before the adb daemon has started).

If I make the same exact changes to the stock boot img (replace init in the ramdisk and add magisk and init.magisk.rc to the overlay folder), it boots fine but I see nothing about magisk at all in the adb logcat during boot.

So this leads me to believe that Magisk is doing something else to the stock boot image that I am not seeing when I unpack things....

edit:

if ! $KEEPVERITY && [ -f dtb ]; then
./magiskboot --dtb-patch dtb && ui_print "- Patching fstab in dtb to remove dm-verity"
fi

I'll need to look at this on my Pixel XL later, but I wonder if this is happening with the Pixel XL. I know the boot.img had a dtb file in the boot.img (device tree blob), where our boot.img has a seperate image dtbo.img. I wonder if what we're missing is that we're not patching fstab to remove dm-verity.

The more I think about it, the more I think this is what's causing our problems and why changes that we make to the ramdisk aren't showing up when we boot (default.prop changes, etc). I wonder if we need a kernel patch to turn off dm-verity and then apply magisk to the kernel that doesn't enforce it?
[Google Pixel 2 XL Guides, News, & Discussion] gakio12:
This may or may not be of help, but could you run

fastboot getvar all

and post the results? Blank out serialno, IMEI, and MEID, though.
[Google Pixel 2 XL Guides, News, & Discussion] northmendo:
Just so no one else wastes their time. This same process on the 8.1 beta and I just get the same bootloops.
[Google Pixel 2 XL Guides, News, & Discussion] DaMadOne:
(bootloader) keep_efs:no
(bootloader) is_oem_unlocked:yes
(bootloader) have_oem_lock_id:yes
(bootloader) avb_stored_rollback_indexes:
(bootloader) avb_user_settable_key_set:no
(bootloader) avb_version:1.0.0
(bootloader) hw-color:VB
(bootloader) hw-variant:GA00137-US
(bootloader) hw-revision:rev_10
(bootloader) cid:00000000
(bootloader) erase-block-size:0x1000
(bootloader) logical-block-size:0x1000
(bootloader) unlocked:yes
(bootloader) off-mode-charge:1
(bootloader) battery-soc-ok:yes
(bootloader) battery-voltage:4379
(bootloader) version-laf:0.0.16
(bootloader) version-baseband:g8998-00122-1708311414
(bootloader) version-bootloader:TMZ10n
(bootloader) version-abl:TMZ10n
(bootloader) version-aes:TMZ10n
(bootloader) version-cmnlib:TMZ10n
(bootloader) version-cmnlib64:TMZ10n
(bootloader) version-devcfg:TMZ10n
(bootloader) version-hyp:TMZ10n
(bootloader) version-keymaster:TMZ10n
(bootloader) version-pmic:TMZ10n
(bootloader) version-rpm:TMZ10n
(bootloader) version-xbl:TMZ10n
(bootloader) variant:MSM UFS
(bootloader) partition-type:laf_b:raw
(bootloader) partition-size:laf_b: 0x3000000
(bootloader) partition-type:laf_a:raw
(bootloader) partition-size:laf_a: 0x3000000
(bootloader) partition-type:dtbo_b:raw
(bootloader) partition-size:dtbo_b: 0x800000
(bootloader) partition-type:dtbo_a:raw
(bootloader) partition-size:dtbo_a: 0x800000
(bootloader) partition-type:boot_b:raw
(bootloader) partition-size:boot_b: 0x2800000
(bootloader) partition-type:boot_a:raw
(bootloader) partition-size:boot_a: 0x2800000
(bootloader) partition-type:vendor_b:ext4
(bootloader) partition-size:vendor_b: 0x1F400000
(bootloader) partition-type:vendor_a:ext4
(bootloader) partition-size:vendor_a: 0x1F400000
(bootloader) partition-type:persist:ext4
(bootloader) partition-size:persist: 0x2000000
(bootloader) partition-type:userdata:ext4
(bootloader) partition-size:userdata: 0x1C26BFB000
(bootloader) partition-type:system_b:ext4
(bootloader) partition-size:system_b: 0xA0000000
(bootloader) partition-type:system_a:ext4
(bootloader) partition-size:system_a: 0xA0000000
(bootloader) has-slot:laf:yes
(bootloader) has-slot:bootloader:yes
(bootloader) has-slot:vendor:yes
(bootloader) has-slot:dtbo:yes
(bootloader) has-slot:vbmeta:yes
(bootloader) has-slot:cmnlib64:yes
(bootloader) has-slot:cmnlib:yes
(bootloader) has-slot:keymaster:yes
(bootloader) has-slot:devcfg:yes
(bootloader) has-slot:hyp:yes
(bootloader) has-slot:pmic:yes
(bootloader) has-slot:abl:yes
(bootloader) has-slot:rpm:yes
(bootloader) has-slot:tz:yes
(bootloader) has-slot:xbl:yes
(bootloader) has-slot:radio:yes
(bootloader) has-slot:modem:yes
(bootloader) has-slot:system:yes
(bootloader) current-slot:a
(bootloader) has-slot:boot:yes
(bootloader) slot-retry-count:b:0
(bootloader) slot-unbootable:b:no
(bootloader) slot-successful:b:no
(bootloader) slot-retry-count:a:6
(bootloader) slot-unbootable:a:no
(bootloader) slot-successful:a:yes
(bootloader) slot-count:2
(bootloader) slot-suffixes:a,b,
(bootloader) secure:yes
(bootloader) serialno:
(bootloader) product:taimen
(bootloader) max-download-size:0x20000000
(bootloader) kernel:uefi
all:
finished. total time: 0.004s
[Google Pixel 2 XL Guides, News, & Discussion] ScottIsMyName:
I'm almost 100% sure I found the problem.....just not sure how to fix it.

So with devices with a/b partitions, the SKIP_INITRAMFS flag gets set. When this flag is set, an additional patch to the kernel is made:

See https://github.com/topjohnwu/Magisk/blob/master/scripts/boot_patch.sh line 220.

# skip_initramfs -> want_initramfs
$SKIP_INITRAMFS && ./magiskboot --hexpatch kernel \
736B69705F696E697472616D6673 \
77616E745F696E697472616D6673

I was looking at the modifications made to the the OG Pixel XL, and found that the boot.img ramdisk contains the kernelimage. Comparing the stock kernelimage to the patched kernelimage it's plain to see that the code above is replacing skip_initramfs with want_initramfs. I can see those in a hex comparison (see attachment).

Now the problem is that our stock boot.img doesn't contain the kernelimage file, so that same patch probably needs to be made, but the question that remains is WHERE does that change go under our boot image?
[Google Pixel 2 XL Guides, News, & Discussion] gakio12:
I believe the zImage is the kernel image.
[Google Pixel 2 XL Guides, News, & Discussion] ScottIsMyName:
Actually I used another tool (imgtool) to extract stock and patched boot images and I DO in fact see the init changed to want, so maybe that's not the problem after all? Though there is one additional change in the kernel that I don't know what it's for....it's too late for me so I'll pick this up in the morning.

I'm not sure why the Pixel boot img contains the kernel file as well as the kernelimage file inside the ramdisk and ours does not.
[Google Pixel 2 XL Guides, News, & Discussion] ScottIsMyName:
I have figured out what is causing the bootloop exactly. The modified kernel that I mentioned above that changes init_ramfs to want_ramfs causes a bootloop. Without that kernel change, it will boot properly, but of course magisk does not run or get installed....so somehow we need to do more things than what it's currently doing.

Comparing the modified zImage kernel from the OG Pixel to the stock zImage kernel shows a lot more has changed, though the changes are too much. Not sure where those changes are coming from, but it's clear something more needs to be done. This is probably where the ship stops for me, as I don't really have any idea about this stuff.
[Google Pixel 2 XL Guides, News, & Discussion] gakio12:
I'm curious as to why ro.secure didn't become 0 when you booted up the image that you changed the value in. Did it attempt to boot with slot-a, fail, then boot with the img in slot-b? Running fastboot gervar would say if there was a failed boot in one of the slots. I haven't been in the modding game for some time, so I'm trying to wrap my head around the slots and all the new partitions.

Perhaps an adb log of the normal boot process would explain some things, especially with the img you changed ro.secure to 0 but became 1 after boot.

So far, this is what I've gathered:

1. boot.img can be unpacked and repacked just fine.

2. manually adding magisk files does nothing

3. patching with MagiskManager results in a bootloop

4. changing ro.secure and repacking has no effect

5. the kernel image is being patched to want_initramfs

You did say there was another change to the kernel image, but the script only shows another change being done with something for Samsung, I wonder if that is being applied when it shouldn't?

Just saw your post, hmmm. Are you comparing an Oreo boot.img from the OG Pixel?

---------- Post added at 01:19 PM ---------- Previous post was at 01:08 PM ----------

I'm going to grep through the kernel source and see what I can find.

---------- Post added at 02:18 PM ---------- Previous post was at 01:19 PM ----------

I found this code related to the initramfs:

static int __init skip_initramfs_param(char *str)
{
if (*str)
return 0;
do_skip_initramfs = 1;
return 1;
}

I could make it return 0 all the time to force it to use initramfs, thereby loading the magisk stuff (I think). If that is even the issue, however. I will look into this later today and maybe build a kernel for someone to test. My thinking here is maybe MagiskManager is incorrectly patching the hex.
[Google Pixel 2 XL Guides, News, & Discussion] ScottIsMyName:
The other change is probably some checksum of some sort since it's near the bottom of the kernel. Probably need to research this file a bit more closely to see exactly what the change is:

https://github.com/topjohnwu/Magisk/blob/master/jni/magiskboot/bootimg.c

I could try modifying the patched boot image from the OG Pixel and modifying the prop values to see if those change.

No, I was comparing the stock 7.1.2 boot image from the Pixel XL to the patched boot img magisk created on 14.3 (generated on the OG Pixel XL).

I thought about this as well (and talked about it a few pages back), but I'm not sure that's the best idea. I guess it can't hurt to try though :)

The reason is because that initramfs will cause sepolicy to be patched as well as a couple of other things that I can't think of off the top of my head. The old Pixel didn't need to do those things and Magisk still works for it.

Good luck though!
[Google Pixel 2 XL Guides, News, & Discussion] cmo220:
Are you guys just doing this with the stock kernel?

I'm pretty sure on the first Pixel XL you had to flash a custom kernel before Magisk could work. Have you tried with this?

https://xdaforums.com/pixel-2-xl/development/kernel-snoke-kernel-t3694266
[Google Pixel 2 XL Guides, News, & Discussion] ScottIsMyName:
I've tried with stock kernel and snork's kernel, both patched images bootloop.
[Google Pixel 2 XL Guides, News, & Discussion] DaMadOne:
I didn't really get any time to dig around but it looks to me like [MENTION=2133630]skaforey[/MENTION] has probably made it as far as I would have. I'm going to look anyways MAYBE ill find something.
[Google Pixel 2 XL Guides, News, & Discussion] cmo220:
Sorry, I hadn't noticed, or more likely forgot that it was mentioned. I'm out of ideas. Thanks to everyone for trying!
[Google Pixel 2 XL Guides, News, & Discussion] Ketawa:
I have a Pixel XL and there is no need to flash a custom kernel for Magisk to work.

Thanks to everyone working on this! I'm holding off on switching to my Pixel 2 XL until there is a working root solution. Unfortunately I am useless at debugging these things.
[Google Pixel 2 XL Guides, News, & Discussion] Aikar:
:( I was intending to do that, but I caved. Now trying to use adb backup to restore app data. Though since I'm on FI, I can reactivate my 6P and go back to it.
[Google Pixel 2 XL Guides, News, & Discussion] gakio12:
I wonder if

fastboot boot patched_boot.img

will work with the raw magisk patched boot.img. There may be an issue with signing when flashing it permanently, but temporarily booting from it, the phone may allow it to boot.

https://xdaforums.com/android/software-hacking/signing-boot-images-android-verified-t3600606
[Google Pixel 2 XL Guides, News, & Discussion] northmendo:
Just booting the image doesn't work either. I tried it early on. It just bootloops then boots up the flashed image.
[Google Pixel 2 XL Guides, News, & Discussion] abuttino:
You guys might want to take a look at the Snoke Kernel thread.
[Google Pixel 2 XL Guides, News, & Discussion] stevetrooper:
Are you referring to this entry:

Quote:

Originally Posted by Megaflop666

Gotcha! Thanks for the update on the.

If I can find a way to get root I'll let you know. So far I'm crapping out with magisk and SuperSU.

If you want to play, try doing this

https://github.com/topjohnwu/Magisk/.../boot_patch.sh
[Google Pixel 2 XL Guides, News, & Discussion] psychotropic:
My phone just came in yesterday and I've not even opened it up yet. I'm cool with allowing mine to be a guinea pig. What do you need me to do?
[Google Pixel 2 XL Guides, News, & Discussion] ScottIsMyName:
I was messing around with trying to do that manually a few days ago (from my Pixel XL), but I don't think it would work since that needs to mount vendor and other things. We need a debugging version of Magisk Manager so that we can see all of it's output (lots of stuff in the code prints to stderr which isn't shown in the output in the app).
[Google Pixel 2 XL Guides, News, & Discussion] gakio12:
If you build the apk from the Magisk repo, it enables debugging. I've attached the built debug MagiskManager apk.
[Google Pixel 2 XL Guides, News, & Discussion] ScottIsMyName:
Hmm, this shows the same output....the output we really want are from the binaries that MagiskManager uses (magiskboot, magiskinit, etc).
[Google Pixel 2 XL Guides, News, & Discussion] gakio12:
It looks like those print out to stderr all the time, regardless of a debug flag. I've attached a zip file with the compiled binaries for arm64-v8a and the scripts. Unzip that and put the directory on the device, place the stock boot.img in that directory, then run boot_patch.sh from a terminal on the phone? That's my understanding of how to patch without the apk, and with a terminal it should show the stderr messages from the binaries.
[Google Pixel 2 XL Guides, News, & Discussion] gakio12:
Eh, I tried running it on my S8 with the pixel 2 boot.img, but I got an operation not permitted when running ./boot_patch.sh.
[Google Pixel 2 XL Guides, News, & Discussion] ScottIsMyName:
Yeah you can't run it on device because we only have access to /sdcard and you can't change permissions away from root on the sdcard.

If your S8 is rooted you can move the files to /data/local/tmp or somewhere like that and run it as root