yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] lebigmac:
@sexyboi Just open the systemrw.sh file in text editor and replace the sdkCheck() function with this upgraded one

then save file and try running script again. Good luck! (y)

@KxKose amd @Facebooook

If next version of my script (EXPECTED RELEASE DATE: THIS MONTH / OR NEXT!) doesn't fix your read-only problem then the version after next (EXPECTED RELEASE DATE: THIS SUMMER!) probably will ;)(y)

Just keep posting that good feedback! (y)

I'll try to answer all unanswered comments when I have more free time!
[Android Software/Hacking General [Developers Only]] AdalisVaxeler:
Hi! Thank you very much for doing this project! Here's my feedback.

Tested in the following device:

Phone model: UMIDIGI A11 Pro Max

Android version: Android 11

Firmware version: UMIDIGI_A11_PRO_MAX_V1.0_20220108

The script apparently worked and generated the expected bin files (I attached the log files). Thus, I flashed the bin using ADB due to the lack of custom recovery for this phone. Command used:

./fastboot flash super (file name)

*My Windows 10's PowerShell normally uses ./ before a command. It gave me no problems when rooting.

File name: super_fixed.bin

Result: Flashed, but phone got into a boot loop afterwards

Details:

Initally unable to flash through most USB ports of my PC after a Error sending sparse file appeared (this ocurred many times with any file at random, which is making me think every file has a certain probability to give that error). After checking some forums, I discovered that UMIDIGI's stock USB connectors apparently have problems with some USB ports. After using the correct port I flashed the bin at the first try.

Sadly, the device entered into a boot loop when rebooting.

File name: super_original.bin

Result: Unable to flash

Details:

An initial Invalid sparse file format at header magic message appeared. After a few seconds, the flashing began and always stopped after a Error sending sparse file appeared (the randomness mentioned before is still present). However, this time I couldn't flash it no matter how many times I tried.

File names: super.img and vbmeta.img

Result: Phone successfully repaired without losing any stored file in the device

Details:

I always have a stock ROM on my PC, so I decided to use the stock super.img:

./fastboot flash super super.img

It worked after a few tries, and immediately after that, I searched here how to enable dm-verity and verification before finally reboot. I discovered that @diogen78 had a similar problem, and that @lebigmac proposed to use this command:

fastboot --enable-verity --enable-verification flash vbmeta vbmeta.img

However, for some reason, the terminal didn't recognize the "enable" commands. Then, tired and kinda desperated after many hours since the beginning of this process, I just inserted this line I used when rooting the device:

./fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
./fastboot reboot

And somehow everything went back to normal.

Update:

Manually disabling dm verity and verification on each A and B partition by flashing vbmeta.img, vbmeta_system.img and vbmeta_vendor.img with ADB doesn't work either.
[Android Software/Hacking General [Developers Only]] vyaskd:
Did that changes in sh file and flashed in terminal emulator on phone it self, but process ended with error 1. Dont have any clue whats wrong. Hope next version will work, if there is some more changes in official release. Btw, thanks for ur work bro.
[Android Software/Hacking General [Developers Only]] darkidz555:
Red Magic 7 android 12 8gen1

Success able to rw using xplore file manager. Don't need to use mount -o remount,rw / command once done flash the super_fixed.bin can rw directly.

Thanks
[Android Software/Hacking General [Developers Only]] chautruongthinh:
Worked great for me
[Android Software/Hacking General [Developers Only]] sexyboi:
When i flash the zip on twrp it says low space on device . but i could run the script perfectly on terminal... But still the phone is read only
[Android Software/Hacking General [Developers Only]] Ericpeterson025:
HI. Thanks for the tool. Worked great for me - to an extent

So I bought a Tmobile version Oneplus 8T+ 5G, rooted with TWRP 3.6 and magisk 23.0. Flashed an international standard ROM.

After using the systemRW tool, I can now mount /(root) and /system_root (where the /system/build.prop is located under, in my device), as RW. I can even delete files, like build.prop from /system (and brick the phone and have to reflash rom).

but if I try to paste in a new file, the file name would appear, but file size would be 0.0 B (empty). This happens whether I paste it with some root browser in Android, or in TWRP recovery mode (file manager). If I try to edit the build.prop file with a root text editor, It would appear to work, and it can even save it, but then if I check the file properties, it becomes a 0.0 B empty file, and I have just bricked the phone again without anyway of restoring the build.prop, short of rom flash.

I suspect this is due to the /system folder always having exactly 0 available space? I have tried deleting nonessential files from sub-folders under /system (like ringtones and alarms), but available space remain at 0 no matter what I do.

anyone experienced this ?

UPDATE - Re-ran the tool with the manual method ./systemrw.sh size=300. Got an error code 70. Seems there is not enough spare space to increase the system partitions by 300M. How do I shrink the other partitions to achieve this?

./systemrw.sh size=15 flashed successfully. but that broke the phone. /system_root cannot be mounted at all now. "OS not installed". and phone boots right into crashdump. Oh well

UPDATE #2 - Re flashed rom and did systemrw.sh size=100 this time. this actually worked and allowed pasting/editing in /system. This is actually amazing. But adding net.tethering.noprovisioning=true in build.prop broke the phone again. Im stuck in fastboot loop. Seems bootloader is checking and rejecting modified build.prop? Gonna re-flash rom yet again
[Android Software/Hacking General [Developers Only]] sexyboi:
Excuse me. But how are you able to wipe data without mounting the storage . lol

Or you mean format data?
[Android Software/Hacking General [Developers Only]] MartheusSss:
Yes sorry, i mean format data
[Android Software/Hacking General [Developers Only]] alonsosjumper:
First at all, thanks a lot for your tool!

Secondly, i´m trying to convert to read write my Google Pixel 5 file system but the script tell me:

How could i fix it?

Thanks!
[Android Software/Hacking General [Developers Only]] furomin:
I have this exact same error on my Mi 9T (davinci). Any help much appreciated! <3
[Android Software/Hacking General [Developers Only]] samrattt:
After flashing super fixed bin my phone boots into Qualcomm crashdump mode.oneplus 7t pro android 12..is there any way to boot into system??

No error occured while creating super fixed bin
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi thanks for your interest in this project (y)

Did you check if the files actually exist on your phone?

/data/local/tmp/systemrw_1.32/tools/avbctl

Are they executable? You should be able to make the whole folder and its contents executable like this:

chmod -R +x /data/local/tmp/systemrw_1.32/

Hi there. To undo everything just flash stock read-only super.img (using fastboot) and re-activate dm-verity and verification from recovery using the included avbctl binary. Good luck (y)
[Android Software/Hacking General [Developers Only]] samrattt:
Hey , I managed to fix that..but is there any way I could successfully flash super fixed bin and boot up rather than booting into crashdump??
[Android Software/Hacking General [Developers Only]] marcin kowalski:
Will the script work on miui 13 android 12 Mi 11 lite 5g? Someone wrote that yes, if this is true, please tell me how to run the script, I do not fully understand 1 post.
[Android Software/Hacking General [Developers Only]] ronaldocoyle:
From the logs I guess it works on redmi note 11 but unfortunately I can't 100% confirm as there's no yet official build of twrp or orangefox. Installing either replaces my boot & so I can't boot to system (even after flashing boot) Is there a way to maybe modify the files from pc/ the rom itself?
[Android Software/Hacking General [Developers Only]] goodmeow:
can you add sdk 31 and 32?
[Android Software/Hacking General [Developers Only]] Merotaha:
guys can someone explain

after everything succeeds how to remove bloatware for good?

and are there any precautions?
[Android Software/Hacking General [Developers Only]] Merotaha:
everything succeeded

now i am stuck not knowing what to delete

and what tool to use to uninstall bloatware from its root
[Android Software/Hacking General [Developers Only]] vp1117:
Hi lebigmac,

I wonder if you're aware of such cases when e2fsck -E unshare_blocks xxx.img does not remove shared_blocks flag, however reports success. Thus, your procedure unshareBlocks() incorrectly reports successfull removal of shared blocks while a file system still has it.

Realme c25s (RMX3195) ROM based on A11 is such an example. Your script does not remove ro flag from following 3 components of super: my_carrier.img / my_company.img / my_manifest. No need to say, no RW as a result. Well, I'm not an expert here so I cannot 100% guarantee that absence of RW is entirely a result of failure to remove shared_blocks from a.m. img's. Probably, some other factors might exist. Just to let you know whatyou might know already.
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi @vp1117 thanks for your useful feedback! (y)

Did you double check if the file don't got shared_blocks feature by first unpacking your super image and then calling

tune2fs -l /data/local/tmp/systemrw_1.32/img/my_company.img

And what output do you get from the e2fsck command?

e2fsck -y -E unshare_blocks /data/local/tmp/systemrw_1.32/img/my_company.img > /sdcard/my_company.txt

To unpack the super image you can either try the standard lpunpack that's included or try the amazing superunpack tool by @munjeni (for link click below)

Or just comment out line #190 of script by adding # symbol in front and then save file and run it again. And it should unpack the files for you. You should comment out line #252 too if you want to deactivate the flash function.
[Android Software/Hacking General [Developers Only]] lebigmac:
Mod Edit: Quotes removed since posts removed.

Hi @Merotaha

Thanks for your interest in this project (y)

Does my script work on your device? Can you please show log or screenshot? Thanks!(y)

Can you do this now?

Congratulations!

Once you have reached this step you have successfully unlocked full RW access to your device :love:(y)

Spoiler content hidden.
[Android Software/Hacking General [Developers Only]] vitalez06:
This works on my OnePlus 9 Pro OOS11 10.2.10.10 with the flashable zip, but sadly I lose the ability to use my fingerprint scanner after. Any ideas?
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi @vp1117 thanks for your additional feedback! (y)

Yes I know you are just giving useful feedback to improve the project and that's commendable (y)

Try running again that unshare_blocks command but this time redirect both stdout and stderr to the file by using the &> symbols. The file should contain much more info than what you showed.

e2fsck -yf -E unshare_blocks my_company.img &> my_company.txt

I like how you are doing the good detective work on your physical Linux machine vs Android device :ROFLMAO:

I wish I knew why that command fails to remove shared_blocks read-only feature from your Realme device...

Since I only have Xiaomi device I'm afraid you will have to experiment further and please let me know if you find a solution to this Realme issue and I'll do my best to include your solution in next version of script (of course I will give credit to you). Thank you! (y)

Hopefully I can release new version this month... So much work... 🛠️⚙️🔥⛏️🔪⚖️🔨🔱✂️🔧

That's interesting. Did you check dmesg after booting up the phone? You might find a clue there. Good luck! (y)
[Android Software/Hacking General [Developers Only]] vitalez06:
So, I've checked dmesg as you suggested, and it was being read. Even my finger tapping was read, but I just scrapped it all out and started over for god knows how many today.

Anyway, after all the flashing back and forth, I somehow made it work even with fingerprints! What I did was go back to the original rom it shipped with. Unlocked the bootloader and all that jazz, then at this point without updating Android yet, I ran this script on TWRP.

After that, booted up, I see the fingerprint working! I was optimistic, and went for the last A11 update for the OP9 Pro, which is 11.2.10.10. So I followed the guide for updating without losing root, then reinstalled TWRP and all that good stuff since everything obviously gets replaced to non-rw state. Reran the script after rebooting back to TWRP from reinstall, and bam! Fingerprint still working. All of this work just to make updated Adreno drivers work😌

Although it wasn't really smooth sailing from there, since I've hit a small bump involving the /vendor free space allocation being too small - which is why the Adreno driver thing wasn't applying, the default was too small! I just changed the .ini file inside to give me 75MB of space instead and reran it, now it shows up properly!

I've had a wild ride, but I thank you for making this awesome script. Honestly, I haven't really tested too much if it did apply properly, like editing /system files etc., but right now I'm happy that I'm able to properly flash into /vendor without problems whatsoever. I'll deal with the /system editing problems another time if there really are some🤣

Again, thank you very much for this script! More power to you my guy.
[Android Software/Hacking General [Developers Only]] JohnTheFarm3r:
Tried running System RW through ADB Shell. According to the logs all looked "OK", but after flashing the exported patched super.img the system doesn't boot. Restoring the backed up Super.img which SystemRW made and flashing it makes the phone boot again.

Used ADB shell method since OnePlus 9 Pro doesn't have a working TWRP on Android 12 ROM's. SystemRW works fine as flashable on Android 11 ROM's when flashed through TWRP.
[Android Software/Hacking General [Developers Only]] TNSMANI:
MOD ACTION:

Thread cleaned,

Guys please don't expect support round the clock in any thread. Given the different time zones users live in and given RL situations, it just will not be possible. And please don't act entitled. No developer is indebted to you for anything so please don't use language that hurts.

Thank you.
[Android Software/Hacking General [Developers Only]] galeka99:
I used the script on Redmi Note 11 Pro 5G (Android 11 - MIUI 13.0.2) and successfully generated super_fixed.bin, but when I flashed the image it only flashes 9/9 part instead of 12/12 when I flashed the super_original.bin, and ended up stuck on fastboot, so I flashed back the original super.bin
[Android Software/Hacking General [Developers Only]] JohnTheFarm3r:
The original and the fixed BIN* have different files size and therefore, there won't be the same amount of parts to flash.
[Android Software/Hacking General [Developers Only]] ShadoV90:
Different sizes are ok, but why fixed image have much smaller size than original? I honestly thought if you add more space to some partitions, fixed img should be bigger than original. My OP8Pro super fixed img have 10,1GB size and original have 14GB. This is huge difference. Question is... why? :D
[Android Software/Hacking General [Developers Only]] JohnTheFarm3r:
Original BIN* file is in RAW, while the fixed BIN* is in sparse, hence why the size difference. Like a compressed file, when it's in ZIP (or any other kind of archive which supports compression), it's smaller than it is when unpacked.
[Android Software/Hacking General [Developers Only]] mhddonip:
Very Successful On Redmi Note 10, without Constraints And Problems. i tried On miui ID 12.5.6.0. I want to ask if flash Clean from miflash will restore everything to its original state. Thank you.
[Android Software/Hacking General [Developers Only]] Ayoub$#:
This is good news
[Android Software/Hacking General [Developers Only]] po_dMerOn:
Xiaomi Mi Note 10 Lite Android 11

OrangeFOX

Working
[Android Software/Hacking General [Developers Only]] HemanthJabalpuri:
@lebigmac

I am happy to say that, all the things went fine with my Realme C12.

I have removed original super.img right after lpunpack finishes. This makes me use your tool with just 15GiB free space.

A small thing is that, in your update-binary, please create a dir /data/local/tmp if it does not exist.

If it does not exist, your tool will fail to install.

It will be not present if a person clean flashes your tool(wipe data).

Also system RW works fine, but vendor RW gives operation not permitted.

Do I need use chattr with the block of vendor?

Also, we can use like this sh makesysrw.sh. Advantage of this is that, we don't need to make it executable and shebang is ignored.

Thanks
[Android Software/Hacking General [Developers Only]] shady_soldier:
No Orangefox recovery too for Oneplus 7T , unfortunately. Oneplus really messed up 7T's decryption with android 10. I'm hoping for it to fixed with OOS 11 update which too, got delayed because they didn't care for its decryption issues in the first place. Its mind boggling that the 7T doesn't have a working TWRP even after 1 ½ years of being launched.
[Android Software/Hacking General [Developers Only]] Morello12:
@lebigmac Any chance to uninstall It?

Thx!!
[Android Software/Hacking General [Developers Only]] Ayoub$#:
But is it a new version or what?

Does it work without disabling DM-verify?
[Android Software/Hacking General [Developers Only]] Ayoub$#:
hahaha >all those unfortunate ones
[Android Software/Hacking General [Developers Only]] lebigmac:
Hello HemanthJabalpuri. Did you actually get my script to work on your device? This is wonderful news.

Thanks for the suggestion about creating /data/local/tmp folder if it doesn't exist. I will do it in the next version.

vendor RW gives operation not permitted.

Do I need use chattr with the block of vendor?

Operation not permitted? I never seen this error before. Do you get this error in the script or elsewhere?

Sorry I don't know what is chattr.

Also, we can use like this sh makesysrw.sh. Advantage of this is that, we don't need to make it executable and shebang is ignored.

Thank you very much for this precious piece of advice. Some people have old sh version in their twrp that don't even support basic array functions. Do you think it's possible to bundle my own sh file (that I used for development) with the flashable zip and rule out any sh compatibility issues this way?

In the next version of the script I would like to remove twrp completely from the requirement list so that everybody can enjoy a system that's read write-able, not only those with twrp. Some devices have no twrp or orange fox available.

Hi shady_soldier

Yes that kind of sucks I agree. I wish I knew how to actually compile recovery. Too bad I'm only an amateur!

I tried to compile Xiaomi stock recovery the other day but no luck so far...

Hi Morello12. Did you actually run the script successfully or not?

Sure simply delete the entire folder /data/local/tmp/makesysrw_1.15c

No. Disable dm verity and verification is always a good idea!

@Ayoub$# You could also try flashing an empty vbmeta with fastboot if you can't disable dm verity manually.

fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img
[Android Software/Hacking General [Developers Only]] Morello12:
Yes, works perfectly!! but it takes up too much space...

Thx!!
[Android Software/Hacking General [Developers Only]] lebigmac:
You've got to be kidding me! I'm always surprised when it works on somebody else's device as well :D

Can you please tell me more about your device? What model, android version and is there a super partition or not? Thanks for your feedback. It helps with further development!

The current version seems to work really well on various Xiaomi devices which isn't too surprising as it was developed on a Xiaomi.

Hopefully the compatibility with more devices will be even better in the next version!

Soon I should have access to a Sony device for further experimentation!
[Android Software/Hacking General [Developers Only]] Morello12:
Nothing new around here: POCO X3 NFC (A10).

Just a curiosity. After deleting the directory you indicated and rebooting the device, the system is still read-write-able. It's possible?
[Android Software/Hacking General [Developers Only]] lebigmac:
lol Poco X3 NFC. I love this device. It's literally impossible to destroy it! It's almost as rugged as that phone on the previous page!

Xiaomi did a wonderful job with it. I even managed to unbrick it from a hard brick the other day! Try doing that on a Samsung for example that doesn't even have fastboot!!!

If you successfully run the script it will flash the patched super image, then it's safe to completely delete the makesysrw folder and your partitions should still be read-write. If you ever update to a newer official stock firmware simply run the script again and then delete the folder again.
[Android Software/Hacking General [Developers Only]] zelipukin:
it's not bad (for the price) but this gigantic screen cutout and rounded corners...

and impossibility to get US bands on Euro version...

and stupid left button (to change launcher to "F150 mode" with all kindergarten bells'n'whistles.. very loud whistles)

Yesterday I was experimenting doing full memory backup for different phone states (stock nonrooted, stock rooted, stock rooted systemRW) just in case to help someone with dead-bricked gadget. At some point (non-rooted) I decided to install OTA to see what's new.

Of course, nothing to improve usability, but they patch that hole that let to install your script.

Rolled back to the original version and successfully installed your script (via TWRP)

Thank you again.

Super trick to restore hard bricked mt67xx (erased/formatted emmc)

to avoid SP Flash Error:

STATUS_SEC_PUBK_AUTH_MISMATCH_N (Verified boot is enabled. Please download signed image)

You need to have (or borrow) full memory dump. (from address 0x0)

- Rename memory dump file to whatever has no -verified extension in stock firmware folder (i.e. ROM_1 -> boot.img)

- place just created "boot.img" and preloader.bin for your phone in new folder

- add MTK_scatter.txt for your phone to this folder and edit it - leave only preloader and boot sections, adjust boot section linear_start_addr: 0x0 physical_start_addr: 0x0 partition_size: YOUR_DUMP_SIZE

- Flash via "Format All + Download"
[Android Software/Hacking General [Developers Only]] Ayoub$#:
I warn you not to do so Flash via "Format All + Download"

Check this out />https://community.umidigi.com/forum.php?mod=viewthread&tid=16931&extra=page=1
[Android Software/Hacking General [Developers Only]] zelipukin:
you cant flash resized partition w/o pmt_has_changed error. this is the only way and in case you have deadbricked phone w erased emmc -only preliader partition is alive and spent ~ a month trying to resurrect it , you just dont care any warnings(tested on rabbits - myself)
[Android Software/Hacking General [Developers Only]] Ayoub$#:
According to my personal experience, there are areas where you never get close and the phone might die

When you need boxes like jtaj, Miracle and more, don't worry, there are tons of people repair phones in stores.
[Android Software/Hacking General [Developers Only]] Ayoub$#:
I'm sorry, Libigmac. I got off topic but this is my advice because it is the cause of my phone damage
[Android Software/Hacking General [Developers Only]] warhawk971:
@lebgimac tried to flash the zip in redmi k20 pro having corvus A11 rom, got this error....