[Android Software/Hacking General [Developers Only]] PokeRekoP:
Hi everyone.

Trying to apply this on an "Onyx Boox Poke3" e-reader running Android10.

Got that thing rooted by patching it's boot.img with magisk.

There's no alternative recovery for it yet (afaik), no TWRP. So I can only run the script from within the running system. Alternative might be to run things from my linux host, but the predecessor "linux only" version has been taken down.

Eventually, I'd like to "poke around" :) somewhat with the unit. For starters, I want to tweak (change, add) things on /vendor, but I can't write to it properly. I *think* before I looked into this systemrw thing today that /vendor was mounted "ro" yesterday.

Running it as root in ADB shell from within /data/local/tmp/systemrw_1.31d I get this:

systemrw: Initiating procedure...
systemrw: Device is in Android mode. Ignoring
systemrw: Current device: ONYX
systemrw: Current Android version: 10
systemrw: Current SELinux status: Permissive
systemrw: Unable to locate super partition on device. Ignoring
systemrw: /system is already R/W capable. Ignoring
systemrw: /product is already R/W capable. Ignoring
systemrw: /vendor is already R/W capable. Ignoring
systemrw: Attempting to disable dm-verity and verification...
systemrw: Partition detected: system @ /dev/block/mmcblk0p10
systemrw: NO 'shared_blocks feature' detected @ system
systemrw: Partition detected: vendor @ /dev/block/mmcblk0p11
systemrw: NO 'shared_blocks feature' detected @ vendor
systemrw: There was a problem removing read-only restriction(s) of your device. Abort

Looking at "mount", I see "vendor" indeed rw mounted. But I can't write to it properly.

Spoiler content hidden.

trying to write to /vendor or any folder below I get strange effects:

Poke3:/data/local/tmp/systemrw_1.31d # cd /vendor/
Poke3:/vendor # ls
app build.prop etc lib odm rfs
bin default.prop firmware lib64 overlay ueventd.rc
bt_firmware dsp firmware_mnt lost+found radio
Poke3:/vendor # touch test
Poke3:/vendor # ls
app build.prop etc lib odm rfs
bin default.prop firmware lib64 overlay ueventd.rc
bt_firmware dsp firmware_mnt lost+found radio
### note how test is not showing
Poke3:/vendor # ls test
test
### note how test is showing if 'ls' is explicitly asked for it
Poke3:/vendor # ls -la
total 232
drwxr-xr-x 16 root shell 4096 2021-07-16 23:27 .
drwxr-xr-x 22 root root 4096 2009-01-01 01:00 ..
drwxr-xr-x 8 root shell 4096 2009-01-01 01:00 app
drwxr-xr-x 4 root shell 8192 2009-01-01 01:00 bin
dr-xr-x--- 3 bluetooth net_bt 16384 1970-01-01 01:00 bt_firmware
-rw------- 1 root root 6323 2009-01-01 01:00 build.prop
-rw------- 1 root root 485 2009-01-01 01:00 default.prop
drwxr-xr-x 4 root root 4096 1970-01-01 01:00 dsp
drwxr-xr-x 19 root shell 4096 2009-01-01 01:00 etc
drwxr-xr-x 4 root shell 4096 2009-01-01 01:00 firmware
dr-xr-x--- 4 system system 16384 1970-01-01 01:00 firmware_mnt
drwxr-xr-x 11 root shell 81920 2009-01-01 01:00 lib
drwxr-xr-x 7 root shell 16384 2009-01-01 01:00 lib64
drwx------ 2 root root 16384 2009-01-01 01:00 lost+found
drwxr-xr-x 3 root shell 4096 2009-01-01 01:00 odm
drwxr-xr-x 3 root shell 4096 2009-01-01 01:00 overlay
drwxr-xr-x 3 root shell 4096 2009-01-01 01:00 radio
drwxr-xr-x 5 root shell 4096 2009-01-01 01:00 rfs
-rw-r--r-- 1 root root 20702 2009-01-01 01:00 ueventd.rc
### note how test is not showing
Poke3:/vendor # mkdir test
mkdir: 'test': File exists
1|Poke3:/vendor # rm test
rm: test: No such file or directory
### so is "test" there, or not!?

Also copying files into /vendor/lib for example gives no error, but the file is not there afterwards.

If I understand correctly what systemrw.sh is doing on line 372 to determine whether /vendor is ro or rw: It tries to remount "rw" and judges by the resulting message. If I run 'mount -o ro,remount /vendor' (or with "rw") manually, I get

Poke3:/ # mount -o ro,remount /vendor
mount: '/dev/block/dm-0'->'/vendor': I/O error
1|Poke3:/ # mount -o ro,remount /vendor
Poke3:/ # mount -o ro,remount /vendor
Poke3:/ # mount -o rw,remount /vendor

So it let's me re-mount any way I want - but gives that strange "I/O error" once.

Out of depth, what's going on on this thingy?

Any hints where to start looking, what other information should I provide?