yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] Anhlatuananh:
Sorry i did't find the log file on android 12
[Android Software/Hacking General [Developers Only]] Bonoboo:
Recently I asked about inability to edit certain files in /vendor, especially in /etc folder. Finally I figured it out. This problem is not script or file-system fault.

I posting this for awareness of thread members, they can advice people who probably ask this in future. Also pasted link on this post into original question for googlers.

Since Android 10 Google introduced "Vendor overlay" mechanism.

Your ROM may have folder /product/vendor_overlay/<number>/, files there virtually replacing files in /vendor partition.

Google not assumed, that partitions will be writeable, so this merging causing file managers to be crazy when mounting r/w. As result while you booted into Android you can't edit, replace or delete files in any affected folder.

But here are variants in ascending order by difficulty. In all of them don't forget to set same permissions, group / owner and SELinux context.

Also keep in mind, that if partition have low space (e.g. default 15 Mb) probably new files can't be copied even if they fits in size and replaced or edited files can be 0 bytes size. In this case delete something obviously unnecessary or resize partition by this script. In archive edit config.ini and set size=30 or more Mb's.

Solutions:

– Copy file which you want to edit into corresponding folder structure into /product/vendor_overlay/<number>/. Or just edit it, if it already present there.

– Temporary rename needed folder in /product, reboot phone. This may cause bootloop or some bugs like distorted sound. Then you can edit or delete any file in same folder on /vendor. Then restore original folder name and reboot again.

– Boot into TWRP, in Mounts menu tick "Vendor", then in Advanced > Shell or via ADB execute this: mount -o remount,rw /vendor, then make you edits via Advanced > File manager or ADB.

– Most hard, make backup of /super partition before continue.

Prepare TWRP like above, additionally mount /product similarly.

Extract and copy attached rsync binary into /bin, execute chmod 0777 /bin/rsync

Now by one folder copy them all keeping metadata: rsync -pErlptgoDHX /product/vendor_overlay/<number>/<folder> /vendor

Rename to disable overlay: mv /product/vendor_overlay /product/vendor_overlay2
[Android Software/Hacking General [Developers Only]] Lem092100:
Tried to Poco x3 pro eu 12.5.7 on twrp. After flashed it just exit in twrp and get back to twrp again. Tried to check log files no any new folder for logs
[Android Software/Hacking General [Developers Only]] elek3kons:
Greetings. With all due respect. Thank you for your work.

Is it possible to create a script to convert the original super.img from firmware archive to super_fixed.img?

Any way will do. PC: CMD/Shell or Android TWRP/ADB
[Android Software/Hacking General [Developers Only]] RBDoMGaM:
What am I doing wrong here? (Device: Redmi Note 9, codename: merlinnfc, rooted with Magisk 23.0)

Removed the screen lock/password/data encryption, rebooted to recovery and flashed the script flashable package, everything goes well, rebooted to system.

Tried to mount /system and /system_root but got an error: /system is not in /proc/mounts (same for /system_root)

Also restore my proginal super partition and tried the script from terminal, flashed the super_fixed.bin with fastboot, same result as before

But, if I reboot to OrangeFox recovery, mount system here with its mount menu and then mount /system_root (/system still shows error that it its not in the /proc/mounts) it mounts and i can debloat my phone going to /system_root/system/ and deleting useless stuff.

But doesnt work while the system its running/termux/any other terminal, just cant mount system or system_root

Here its my /proc/mounts file: https://pastebin.com/gzXVVBzD

Here are some screenshots from the recovery process:

Here are the recovery log: https://pastebin.com/h4zdesZH

Here are the mylog.txt generated by the script: https://pastebin.com/1EMRYyEB

Here are the lpdump.txt generated by the script: https://pastebin.com/4JenMbm1

Thanks in advance, and if more information is required, please let me know.
[Android Software/Hacking General [Developers Only]] Lem092100:
Finally it works on me, im using TWRP Poco X3 Pro Xiaomi eu 12.5.7 ill share what i did.

I place the systemrw_1.32 and systemrw_1.32(flashable) on data/local/tmp go to recovery and flash :)
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi again @Anhlatuananh. Log file should be in this path: /data/local/tmp/systemrw_1.32/log/

Your feedback is very useful for development of next version. Thanks! ;)(y)

Hi @elek3kons you're welcome.

I'm not exactly sure I understand what you mean?

You can try to look into the excellent superrepack tool by @munjeni (link available on front page)

Maybe that's what you're looking for?

@Lem092100 I'm happy you got the script to work on your device in the end.

Do you know what caused the initial problem?

Enjoy customizing your fully read/write-able device! :love:(y)

Hi @RBDoMGaM. Thanks for your log files! (y)

Try this code inside android and please show screenshot of results. Thanks! Good luck! (y)

adb shell
su
for a in /dev/block/dm-*; do mount -o remount,rw $a; done
[Android Software/Hacking General [Developers Only]] RBDoMGaM:
Thanks for answering me!

I did run the script again with recovery before and if I remember well, at least this "dm-2" thing shows "already read write" or something like this...

---edit---

Yeah, judging by the log, on recovery it shows this:

systemrw: /dev/block/dm-0 is already R/W capable. Ignoring

systemrw: /dev/block/dm-1 is already R/W capable. Ignoring

systemrw: /dev/block/dm-2 is already R/W capable. Ignoring
[Android Software/Hacking General [Developers Only]] lebigmac:
@RBDoMGaM wait a second your device has NO shared_blocks read-only feature and you still can't mount as RW? That's ridiculous! I wonder which additional protection feature is responsible for that. You could try to find out more info by calling dmesg right after the mount command.

Oh I guess this looks like an error in my checkRW function. Don't worry it's already fixed in next version ;)(y)
[Android Software/Hacking General [Developers Only]] Bang latss:
can i use this on android 11 ?
[Android Software/Hacking General [Developers Only]] Anhlatuananh:
i forgot to tell you, after flash the script my phone won't boot ,it going to fashbootd and ask me for factory reset , so i lost my log too. but after that system completely R/W
[Android Software/Hacking General [Developers Only]] elek3kons:
What I meant was: take out the zip firmware - super.img without mount r/w and convert it to super_fixed.img using the script on PC. Return the corrected super.img to the firmware zip and then install the ready firmware on android. Is that a viable option?

Update. I understand having to do it from scratch, but it would make life easier for many users.
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi @elek3kons sorry but Linux-only version of the script has been deprecated long time ago. The remnants of it can still be found in the included sysrw_repair script ;)(y)

I've only received 2 Linux-only requests in the past 10 months.

And 2 people wanted me to make a magisk module out of it :ROFLMAO:

@Anhlatuananh you shouldn't have to do a factory reset to get back out of bootloop. Flashing stock read-only super image and re-activating dm-verity and verification should be enough.

What do you mean system completely r/w? Please run these commands below and show screenshot thanks!(y)

adb shell
su
for a in /dev/block/dm-*; do mount -o remount,rw $a; done

Hi @Bang latss thanks for your interest in this project (y)

Sure!

Please send me your log files after running script. Thanks. It helps with further development (y)

/data/local/tmp/systemrw_1.32/log/
[Android Software/Hacking General [Developers Only]] simora.lesha:
Hi @lebigmac . I flash "systemrw_1.32_flashable.zip" on my pixel 3 (rom stock A12, rooted magisk 23).

twrp version 3.6.0

Without errors , but R/W not working.

Maybe there is another way?

Log file and adb shell command:
[Android Software/Hacking General [Developers Only]] Anhlatuananh:
here the screeen shot , and about the factory resset, it not boot loop , it even not show boot animation after show warning bootloader it show fastbootd immediately
[Android Software/Hacking General [Developers Only]] Anhlatuananh:
I am reflash my rom then flash the zip file againt so i can get the log file for you
[Android Software/Hacking General [Developers Only]] sarbazg180:
I flash the script using recovery mode and it succusfully installed and reboot

It still say

'/dev/block/dm-1' is read-only'

There is log files
[Android Software/Hacking General [Developers Only]] footjobs:
This works on my moto g stylus 2021 android 11
[Android Software/Hacking General [Developers Only]] sarbazg180:
Should i use bigger size??

I want rw😭😭

I have redmi 9 fully rooted with magisk
[Android Software/Hacking General [Developers Only]] simora.lesha:
thanks for the help (no)
[Android Software/Hacking General [Developers Only]] Peter1212:
Hello there, I tried this on Mi11x running AICP rom. Even after successful installation I don't see any difference in particular. I can only copy to the system/priv-apps when in android and it reverts to normal when I reboot. When in recovery it doesn't even see it as rw at all, keeps saying the partition is read-only. @lebigmac
[Android Software/Hacking General [Developers Only]] footjobs:
I just flashed the imgs files manually through my custom recovery that had fastboot mode
[Android Software/Hacking General [Developers Only]] footjobs:
And after I reboot vendor system and product are rw
[Android Software/Hacking General [Developers Only]] CaptianXLAB:
SystemRW script worked successfully using manual method on AVD / Android 11 Emulator x86_64 (with arm64 support - Google API version), but can't find a way to flash the super_fixed.bin file on the emulator.

Spoiler content hidden.

In summary - script generated a modified super image but now it needs to be pushed into the actual system image to work since AVD doesn't have fastboot or recovery.

I opened the original system.img using 7zip on windows and I can see two files:

Any suggestions / advice / ideas on how I can do this? (preferably within the emulator itself for any linux commads I might need to use)

Spoiler content hidden.

Log files are attached (of the time I ran it without size parameter)

Thanks again!
[Android Software/Hacking General [Developers Only]] samy2015:
thanks for the tool

I've been using it since Xiaomi.eu 12.5.18

and now installed on 12.5.19 also working fine

poco f3 xiaomi.eu rom v 12.5.19
[Android Software/Hacking General [Developers Only]] kaidok997:
Works on duoqin F21 pro, thanks. Still testing some things but it does work, i'm able to import/delete/edit in /system
[Android Software/Hacking General [Developers Only]] Johncaffee:
Works on Oneplus 8 Pro with OOS 11.0.10.10 IN11BA.

Good job thanks.
[Android Software/Hacking General [Developers Only]] Ayan Chakraborty:
@lebigmac first of all great work.

I flashed a RW100 zip in 7t pro. Everything went as usual but ur code to test whether script works fails. Not in /proc/mounts is the reply.

But I can copy/delete stuff from /system using total commander.😅.

But unfortunately the OS is broken. Awkward bugs are happening here and there.

So my question is can I make system.img rw before flashing on android. I want to do the job on windows to avoid too much write operation on phone nand after every OS update is release.

Is it possible to do it on windows?
[Android Software/Hacking General [Developers Only]] rysson_:
Confirm, works on Oneplus 8 Pro with OOS 11.0.10.10 IN11BA.

I needed use repair script. adb shell has no root access I modified it a little.

adb_shell(){
./tools/bin/adb shell "su -c $@"
}

Awesome job, thanks a lot.

EDIT: I used munheni's superrepack tool and I socked on R/W /vendor but not writable. I've lost /vendor/etc/mixer_paths.xml than all audio. This lebigmac's script has fixed my phone!

Of course file content has been restored from old backup.
[Android Software/Hacking General [Developers Only]] alex_theta:
(accidental post, can't delete)
[Android Software/Hacking General [Developers Only]] alex_theta:
Well following directions it says it patched correctly, then I flashed the super_fixed.bin, and it went through all steps "okay." But then it went into a bootloader bootloop. Tried to flash super_original.bin, which also all went through "okay" but still in bootloop. Posts say "re-activating dm-verity and verification" also but i'm not on custom recovery and I don't know how to do this. From the bootloader, "fastbook enable dm-verity" does nothing.

Rog Phone 5s, Android 11, stock rom (no twrp/custom recovery)

Update: Went to recovery (stock) and factory reset/wiped all data. Been trying to flash the stock android image and the magisk patched image, but leaves me in either total bootloop, leading to "your device is corrupt" message, or reboots into bootloader.

In the end I saved my following this guide.
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi @simora.lesha .Thanks for your interest in this project.

According to your log it looks like something went wrong and it flashed a corrupted file to your device?!

I can't believe your device still works after that! :ROFLMAO:

Did you check if shared_blocks read-only feature was successfully removed from your partition /dev/block/sda6 ? tune2fs -l /dev/block/sda6

Don't worry the new version which is just around the corner should fix your problem! (y)

Hi @alex_theta thanks for your interest in this project. Please send me your log files from script folder if you want me to check for errors.

I'm sad to hear about your bootloop issue. Please understand that all devices are different and while the script works perfectly on older devices, it can cause bootloop on newer devices. Phone manufacturers had plenty of time to close this vulnerability and implement new annoying bootloops should the user decide to install the script.

Did you make full phone backup as recommended in first post before running script? Then it shouldn't be too difficult to undo the bootloop.

Script only modifies super partition and it uses the included avbctl binary to disable dm-verity & verification which to my knowledge only modifies vbmeta / vbmeta_system partition.

To get back out of the bootloop you can flash back stock read-only super image (with same firmware version) that you downloaded from your phone manufacturer's website or use the super_original.bin dumped by the script.

And to re-enable dm-verity and verification you can use the included avbctl binary in /tools subfolder of script folder.

Or you can try to fastboot flash back stock vbmeta / vbmeta_system using the --enable-verity --enable-verification parameters.

Then you have undone all changes that the script has done to your device.

If you still have bootloop after that then I don't know what you changed on your device for getting stuck in such a mess.

Good luck!
[Android Software/Hacking General [Developers Only]] Facebooook:
I have one plus Nord and flash your script successfully and got rw system.

But system/reserve folder still ro how to got rw in this folder. This folder has lot of bloatware.
[Android Software/Hacking General [Developers Only]] iamMG:
Can someone explain what does this script do? ELI15

Do I need it on my OnePlus 7 Pro OOS 11.0.5.1?
[Android Software/Hacking General [Developers Only]] anglican007:
Dear lebigmac,

a BIG THANK YOU.

It works, after a bit of struggle with the error code 73 I was able to run sysrw_repair file from a VM and Linux Mint. Everything was fine and automatic. After the parsing it rebooted to bootloader and flashed. It cost ca. 5 min. The file system is shown as ro, but it behaves like rw. As first I got rid of preinstalled YouTube. Nice.

Moto g30, Stock ROM Android 11, Magisk, A/B, Ramdisk.

Again, you helped to solve the biggest Android problem nowadays. Thank you for it.

Update:

One thing: I tried to change gpio-keys.kl in /system/... With x-plorer the permission set to 777. In system/usr/keylayout/ one can create/delete/change the files, but after every change they become empty, even if copied in here. The same after reboot. Apparently there is still a problem with the /system/ directory. Other things are superb.

Any idea hjw to “fill“ a *.kl file?

Tomas
[Android Software/Hacking General [Developers Only]] Pouya Rezaei:
hi guys

can you help me to change system/product R/O to R/W?

system partition is R/W but system/product R/O and cant change

my device : redmi note 10 pro max

android : 11 miui : 12.5.8.9

root method : magisk 23
[Android Software/Hacking General [Developers Only]] jis251:
HI, lebigmac and all others

I think I cannot install OTA because of this script, is that so?

Is the solution to flash repair zip and then install OTA and then I can run r/w again?

Or any other solution?

Thank you
[Android Software/Hacking General [Developers Only]] sarbazg180:
I have sent my log file here

https://xdaforums.com/t/script-andr...-rw-super-rw-read-write.4247311/post-86136131

And

I check for shared block and this is the result
[Android Software/Hacking General [Developers Only]] rysson_:
No problem enjoy :)

Of course both calls ./tools/bin/adb shell should be replaced with new function adb_shell.
[Android Software/Hacking General [Developers Only]] straightcore:
Good job @lebigmac (y)

I finally got rid of 🖕 google bloatware 😆 , big thanks 🎖️
[Android Software/Hacking General [Developers Only]] Pouya Rezaei:
thank you for answering
[Android Software/Hacking General [Developers Only]] anglican007:
*.kl files are keylayout files, mostly generic.kl and some special *.kl's. They are located in my phone in /system/usr/keylayout. They are important for remapping the hardware keys - e.g. the f*** Google Assistant, which is hardware-bound in Moto g30.

With the file system is shown as ro I meant that in x-plore apk are the parameters red, not violett, that means only set as read only, but they behave like rw.

Update:

After having set the size 50, everything works well. Thank you again. You can add Moto g30, stock Android 11 to your list of devices.

Last, but not least:

How can I donate?

Tomas
[Android Software/Hacking General [Developers Only]] jis251:
HI and thank you for reply.

I am not sure if it is this script or what but I cannot flash OTA.

Pic has error info
[Android Software/Hacking General [Developers Only]] Abhinav453:
Works great (y)

Devices :- Redmi note 9 S or so called redmi note 9 pro (curtuna)

Android version :- 11

Firmware version :-MIUI Global 12.5.3 Stable(RJWEUXM)
[Android Software/Hacking General [Developers Only]] jis251:
HI.

I think I try to revert back to original. This is the instructions but I have no idea how to do that in custom recovery (twrp).

To undo all changes performed by the script you can simply reflash original stock read-only super image and re-enable dm-verity and verification either through adb/fastboot or with the included avbctl binary (inside /tools/ subfolder - also available in recovery).

Could you please explain how I mange to revert back (flash super_original.bin)

Thank you
[Android Software/Hacking General [Developers Only]] Walther6:
Well seems like /data/local/tmp is encrypted in TWRP I'm using orangefox I've no idoe how to decrypt it any solutions?
[Android Software/Hacking General [Developers Only]] Peter1212:
Hi there lebigmac. Here's the log for my device below. Apparently there's a couple things to note. I am running a custom ROM (AICP on Alioth/Mi 11x). I tried the normal mount command

mount -o rw,remount /system

which didn't mount my system partition as rw. I guess this one doesn't work for devices with super partitions, which I wasn't aware of and hence I tried out your script then. At that time I also wasn't doing it properly (partitions weren't mounted before flashing, read someone said that it was necessary?... not sure)

And then I also assumed that after that the partitions would be rw by default aka I wouldn't have to use any commands at all. Turns out I was wrong. Since I was already on a custom ROM I only had to use the new command to mount my partitions. Nonetheless I still flashed the script (for another reason) I don't have the shared_blocks flag either.

My reason to flash this was particularly because of a weird scenario. Within the custom rom, when in Android any changes to the system partition or any other partition (that's supposed to be ro only) are reverted back on reboot. Which is weird because I know I had got that to work on a previous install of the same ROM. Totally weird and trying to see it resolved so far with no success. Thought maybe the script might help but it isn't.
[Android Software/Hacking General [Developers Only]] Zesam:
Works nicely on xiaomi.eu_multi_POCOX3Pro_V12.5.7.0.RJUMIXM_v12-11. No problem at all.

Thank you so much. (y)
[Android Software/Hacking General [Developers Only]] jis251:
HI

So if I want to flash original super back, is this the right command?

(I am not good with scripting, sorry about that)

If correct, can I use TWRP terminal?

I changed size to 100 when I run first time, so can I keep this default 15 or do I need to change it to 100

su

cd /data/local/tmp/systemrw_1.32

chmod +x ./systemrw.sh in=./img/super_original.bin size=15
[Android Software/Hacking General [Developers Only]] angel495:
Big thanks script developer.

I have successfully apply fixed super.img and get full RW acces to system partitions.

size=50 in script parameter worked for me.

Xiaomi Redmi note 10s with Indonesian rom.

Respect!
[Android Software/Hacking General [Developers Only]] blaze2051:
so this flashable zip dumps the super.img to individual partitions?
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi @straightcore @Abhinav453 @Zesam @angel495. Thanks for your feedback.

Congratulations! I am happy that my SystemRW / SuperRW script works as expected on your device.

Enjoy debloating and customizing your fully read/write-able device and don't forget to make lots of backups before modding stuff! Have fun! :love:(y)

Hi @woody4165

That's a nice phone you've got ;) I developed this script on that very phone!

Booting TWRP image from fastboot rather than flashing it to your recovery partition works fine on the POCO but on some modern devices this doesn't always work. Not sure why...
[Android Software/Hacking General [Developers Only]] lebigmac:
Hello @sosthenisRR thanks for sharing your logs.

Your logs look good to me. Your Motorola Moto G Stylus 5G is now fully RW ?

In that case enjoy debloating and customizing your fully read/write-able device! :love:(y)
[Android Software/Hacking General [Developers Only]] diogen78:
Hello, Lebigmac, and thank you for your work!

I ran the script in Android mode.

Please take a look at the resulting log file.

Is everything okay in there?

Can I try now to flash in fastboot?
[Android Software/Hacking General [Developers Only]] abdulsametoger:
Why i cant do this :/ @lebigmac @Johncaffee

I'm on OOS 11.0.10.10 IN11BA (OP 8 PRO rooted). I'm using android (script) method.

1.Copy systemrw_1.32 files to /data/local/tmp

In termux;

su

cd /data/local/tmp/systemrw_1.32

chmod +x ./systemrw.sh

2. Run ./systemrw.sh size=50 command after finish flash super_fixed.bin via fastboot

It gave crash dump mode error :/ (I'm also tried size=15 command, it doesnt work too)

Anybody help me ?

Edit: Recovery method not working too. I flashed zip via TWRP. Flash porecces sucessfully ended but Systemwide not socked r/w
[Android Software/Hacking General [Developers Only]] diogen78:
Device: Realme GT Explorer Master Edition (rmx3366). Android - 11. Bootloader - unlock. Root - Magisk.

fastboot flash super super_fixed.bin

After that phone only boots in fastboot or fastbootd

fastboot flash super super_original.bin

All the same. Phone only boots in fastboot or fastbootd.

It won't boot into the system.