yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] Haaleven:
Hello! Yep. Script can create image. Android emulator does not support recovery mode. As I understand I can run emulator with output image, but haven't checked it yet.

I use emulator for reverse engineering purpose, I need put custom certificate to trusted list to run BURP over it (for this I need rw mount). I don't worry about my devices 😉
[Android Software/Hacking General [Developers Only]] Keven11:
That is sooo RAD! Thanks for the write up/tutorial. Congrats, and thank you. I will be doing this the moment I get home from work. You sir are THE EFFIN MAN!
[Android Software/Hacking General [Developers Only]] tha_mechanic:
@Keven11 I hope it is enough info to get you through it!
[Android Software/Hacking General [Developers Only]] Gentisz:
systemrw: Congratulations! Your image(s) should now have R/W capability

systemrw: Please reboot into bootloader and flash the file(s) manually

I Use 9008 rec my phone,Now is Oneplus8T in HOS 11.5.6, It seem works, But I don't know how manually flash it, I don't have like TWRP rec.
[Android Software/Hacking General [Developers Only]] Gentisz:
😭 Oneplus 8T not work, I flash in bootloader and reboot, It display Qualcomm CrashDump Mode ,exitcode=0x00007f00, brick now
[Android Software/Hacking General [Developers Only]] Keven11:
I'm pretty sure I can make it happen. It's layed out very well, and detailed. I am starting on it right now. So I will let you know as today one way or the other. Thanks again for putting this together. It's going to help many more Moto people than just myself.
[Android Software/Hacking General [Developers Only]] tha_mechanic:
@Keven11

I edited my instructions a little
[Android Software/Hacking General [Developers Only]] Keven11:
Ok, I will check it out. Thanks.
[Android Software/Hacking General [Developers Only]] derricksrs:
Hmm maybe you would like to try out superrepack tool. Is working for my OnePlus 8t. https://xdaforums.com/t/tool-win-li...ake-partitions-rw-in-super-partition.4120963/
[Android Software/Hacking General [Developers Only]] wv8023:
Thank you very much for your hard work.

My device: realme Q2 pro 5G

I think I completely failed！
[Android Software/Hacking General [Developers Only]] tha_mechanic:
@wv8023

Make sure you have created a img folder inside the systemrw folder. The script won't make one for you, so it just fails to dump super_original.
[Android Software/Hacking General [Developers Only]] tha_mechanic:
@wv8023 Here are the steps that worked for me
[Android Software/Hacking General [Developers Only]] wv8023:
@lebigmac Realme Q2 pro 5G (China) support Android 10

@tha_mechanic​

Thank you for your help, I succeeded, it would not be possible without your help.
[Android Software/Hacking General [Developers Only]] phanimitra vadlamani:
Followed everything as said....don't know where did it go wrong
[Android Software/Hacking General [Developers Only]] Leandro344:
tambem estou este erro ???
[Android Software/Hacking General [Developers Only]] xaloundros:
@lebigmac hi thanks for your awesome work but i need your your guidance I'm Rog 3 user with own super img so i will make this command first./systemrw.sh in=./img/super_original.bin out=./custom/path/super_fixed.bin size=15 and after this chmod +x /data/local/tmp/systemrw_*VERSION*/systemrw.sh?
[Android Software/Hacking General [Developers Only]] Arik80:
Hello lebigmac, thank you for your hard work!

I did it on RedmiNote 10 pro, MIUI Global Stable 12.5.3, Android 11.

Now it's working!

But I can't change permissions on some folders and files, for example com.android.wifi

Could you help me?
[Android Software/Hacking General [Developers Only]] lebigmac:
My friends I am so busy with real things lately. Not virtual things. I will try to reply to every comment when I have a little bit more time. Thank you for your patience!

Don't forget new version is coming soon. This summer. Stay tuned!​

And it will be much more clean and simple and less automatic installation errors. And hopefully we can finally fix that annoying cow error for the OnePlus users! Oh yeah and the error 73 ;)

Hi @a.dibacco That's just a warning and can be safely ignored.

Hello @xaloundros You're welcome!

Try like this. Good luck!

adb shell
cd /data/local/tmp/systemrw_1.31d
chmod +x ./systemrw.sh
./systemrw.sh in=./PATH/TO/YOUR/SUPER/PARTITION/IMAGE size=15
[Android Software/Hacking General [Developers Only]] Arik80:
Can anybody help me please?

After mounting system read write R/W, some folders are still RO.

How can I make folder (com.android.wifi) RW?

/dev/block/loop24
[Android Software/Hacking General [Developers Only]] tha_mechanic:
@Arik80

Did you put in a custom size or just use the built in 15 in the config? If the partitions are not expanded enough it will not allow you to edit or possibly not even let you mount r/w. I had to redo the process with a custom size =50 to make it all work correctly.
[Android Software/Hacking General [Developers Only]] Arik80:
No, I've just built it in 15mb. Ok, thank you, I'll try to extend it up to 50mb
[Android Software/Hacking General [Developers Only]] xaloundros:
@lebigmac i try only ./systemrw.sh size=15 because I can't figure out with your command, and then when say reboot to bootloader to flash manually i make restart boot into recovery and ny data is 0mb any advice?
[Android Software/Hacking General [Developers Only]] munjeni:
https://xdaforums.com/t/script-andr...t-system-read-write-r-w.4247311/post-85210671
[Android Software/Hacking General [Developers Only]] munjeni:
A bit of offtopic... android is a spy os created to collect personal belongings and habits and pass it on to companies that live off all that data, and even data when you wake up at night to go to the toilet. This RO partition lock in recent android is so pathetic that I'm speechless. This RO is made to make it harder to wipe the faeces that float in the android, and things will go on indefinitely and it will be harder and harder to be able to do anything. What they will invent in android 12 and 13, I can't imagine but this is slowly becoming a brutal violation of personal ownership of the phone.
[Android Software/Hacking General [Developers Only]] phanimitra vadlamani:
Is this normal?

super_fixed is almost half the size of super_original....and when i flashed it with "fastboot flash super super_fixed.bin" , my device didn't boot into system
[Android Software/Hacking General [Developers Only]] Arik80:
I tried to increase up to 50mb, but it didn't work((
[Android Software/Hacking General [Developers Only]] Arik80:
So, it's impossible to make this partition as RW?
[Android Software/Hacking General [Developers Only]] munjeni:
I don't know, I'm guesed it from your post 803 and gaved you link for more info. Did you try :

mount -o remount,rw /apex/com.android.wifi
[Android Software/Hacking General [Developers Only]] Arik80:
Thank you! Yeah, I tried, but it didn't work for me.

Now I'm trying to enlarge partitions up to 100mb. Perhaps it will work))
[Android Software/Hacking General [Developers Only]] Arik80:
Think it isn't depend on size, I've made it 100mb, but I still get message "mount: 'apex/com.android.wifi' not in /proc/mounts"
[Android Software/Hacking General [Developers Only]] munjeni:
Can you shouw output of the commands

mount

and also

losetup -a
[Android Software/Hacking General [Developers Only]] munjeni:
What you get with command without additional arguments, just type this:

mount
[Android Software/Hacking General [Developers Only]] munjeni:
Hmm this going interesting:

tmpfs on /apex type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,size=2840212k,nr_inodes=710053,mode=755)

/dev/block/loop24 on /apex/com.android.wifi@300000000 type ext4 (ro,dirsync,seclabel,nodev,noatime)

curently we don't know which partition is put to the loop24 probably those partition is RO, offset used from partition is 12288 with size 5332992, you can research ramdisk for what is put to the loop24 for idea
[Android Software/Hacking General [Developers Only]] Arik80:
Thank you munjeni, I thought that if the com.android.wifi folder is located inside the apex folder, their partitions should be the same. I googled a little bit about what is put to the loop 24, but since I'm new, I didn't find an answer)).

So, what do you think, is it possible to remount type ext4 partition to rw?
[Android Software/Hacking General [Developers Only]] lebigmac:
Thank you @munjeni for chiming in and sharing your expertise with us. Without your contributions this project would not exist!

@Arik80 do you get same result if you do:

mount -o remount,rw /dev/block/loop24

Does the partition have shared_blocks feature?

You should be able to check it by doing:

tune2fs -l /dev/block/loop24

Please keep in mind the script will only change the contents of your super partition to r/w and /apex/com.android.wifi doesn't look like it's part of your super partition.
[Android Software/Hacking General [Developers Only]] Arik80:
Hi lebigmac, thank you for helping me.

Yeah, I have the same result when I do mount -o remount,rw /dev/block/loop24

Unfortunately I don't know what is shared_blocks feature, so I've attached screenshot.
[Android Software/Hacking General [Developers Only]] lebigmac:
Yes It does have shared blocks feature if you look closely. That explains why you couldn't remount it as r/w.

So is apex/com.android.wifi

A part of your super partition or not? You never sent me your log files.

What I could do in next version of script is implement a special script argument where you can pass only a specific partition to the script and it will only make r/w that specific partition and then exit script again.

Another option would be to make r/w all the device's partitions by default. Not only the contents of super partition.
[Android Software/Hacking General [Developers Only]] Arik80:
I removed a systemrw_1.31d folder yesterday, how can I regenerate the log files? Should I ran the script again?

It would be great, if the next version of your script will solve this issue, I look forward to it))
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi @PokeRekoP

Thanks for your interest in this project. Apparently your device have no shared_blocks (read-only) feature so my script cannot do much other than maybe resize your partitions which I wouldn't recommend if you've got no super partition.

I don't have your full logs but from your quotes it looks like you can successfully mount /vendor as r/w.

Thanks for your feedback. Yes at line 372 the script is trying to check if you can mount your partitions as r/w.

It is checking if your mount command output string ends with the words "read-only". Currently there is no I/O error check implemented. I've never seen that I/O error before when mounting stuff. Did you check dmesg during first mount command?

Try again like this and upload screenshot. Good luck!

adb shell
su
mount -o remount,rw /vendor
echo "hello">/vendor/test.txt
cat /vendor/test.txt
rm /vendor/test.txt
[Android Software/Hacking General [Developers Only]] rakoncwy:
hi

i useed Realme gt.

i work makesysrw.

but boot loader bootloop
[Android Software/Hacking General [Developers Only]] dna1982:
Device: OnePlus 8 Pro

OS: OOS 11.0.7.7.IN11AA

Script: systemrw_1.31d

Aslo getting 70 errorCode.
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi. According to your log files your OnePlus device have no cow files. Therefore it should be possible to make it work with a smaller custom size. Try with size=15
[Android Software/Hacking General [Developers Only]] dna1982:
Thanks for your suggestion.

I tried with size=15, then getting 73 errorCode.

I think I should try "sysrw_repair.sh" on Linux next. fingers cross.
[Android Software/Hacking General [Developers Only]] rakoncwy:
my have realme gt neo flash worked makesysrw

but same same...

bootloader bootloop
[Android Software/Hacking General [Developers Only]] PokeRekoP:
@lebigmac : thanks for responding. G**gling for the IO Error quickly pointed at "dm-verity" being in the way. The fact that a "remount,rw" *appears* to have worked doesn't mean it actually *has* worked. As I wrote, the file created afterwards isn't there really, and at any rate not across reboots.

So I digged deeper and deeper.

In the end, this was the key article to read:

https://android.stackexchange.com/q...ty-on-android-with-user-build-type-rom/215907

And in there, this bit of information was the correct and most important:

SO, looking at my situation with the (magisk-rooted but still dm-verity protected) boot.img, I found this:

/proc/device-tree/firmware/android/fstab/vendor/fsmgr_flags lists "wait,verify"

/proc/device-tree/firmware/android/fstab/vendor/mnt_flags lists "ro,barrier=1,discard"

Only solution was to get rid of the "verify" flag in the dtb device tree for the "fsmgr_flags". Only way I found to do this was by using the "magsikboot" binary tool - many sources seem to be outdated in this matter, as the ways to disable this for example through the magisk user interface don't exist any longer (as they apparently didn't work for each and every device reliably and led to too many "false complains" - hence only for the "devs" via the command line route). There might be an easier way, but I didn't find one.

I'll write up a howto for all the steps I had to go through for this Poke3 device.
[Android Software/Hacking General [Developers Only]] munjeni:
Do you know location of the dtb?
[Android Software/Hacking General [Developers Only]] PokeRekoP:
Yes, its in boot.img:

/data/adb/magisk/magiskboot unpack boot.img

gives us “kernel” and “kernel_dtb”

/data/adb/magisk/magiskboot dtb kernel_dtb print -f

tells us that for /vendor the relevant flags are:

[fsmgr_flags]: [wait,verify]

We then do

export KEEPVERITY=false

which controls what magiskboot shall do (no idea why TopJohnWu decided to do it via an ENV variable instead of a command line parameter... but he will have his reasons)

And then

/data/adb/magisk/magiskboot dtb kernel_dtb patch

makes magiskboot to change the flags to [wait] only.

And then

/data/adb/magisk/magiskboot repack boot.img

gives us "new-boot.img" in the same folder, with the patch applied.
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi @rakoncwy. Thanks for your log. It looks so weird. I'm surprised it successfully created super_fixed.bin despite your device being OnePlus with cow group. OnePlus really squeezed a whole lot of useless partitions into your super partition!

What I don't understand is why shared_blocks feature is not showing up in the log and it's not being removed by script?

Can you please boot into Android and check if your partitions have shared_blocks feature by running this code in terminal? Thanks.

adb shell
su
for i in `ls -l /dev/block/by-name | awk '{print $NF}'`; do tune2fs -l $i; done;

Or try like this :

adb shell
su
tune2fs -l /dev/block/dm-0
tune2fs -l /dev/block/dm-1
tune2fs -l /dev/block/dm-2
[Android Software/Hacking General [Developers Only]] KyneA:
Thank you!

Works like magic on my Poco X3 Pro
[Android Software/Hacking General [Developers Only]] munchy_cool:
trying on Poco F3 running a custom rom.

got error 6, data partition is already mounted.

logs attached.

well , looks like logs aint uploading

Hastebin: Send and Save Text or Code Snippets for Free | Toptal®

Hastebin is a free web-based pastebin service for storing and sharing text and code snippets with anyone. Get started now.

hastebin.com

line 1639
[Android Software/Hacking General [Developers Only]] Keven11:
If you're running a custom ROM shouldn't you already be able to mount system and vendor as r/w?
[Android Software/Hacking General [Developers Only]] Ayoub$#:
My phone does not support twrp
[Android Software/Hacking General [Developers Only]] lebigmac:
@baxal0 please send me your log files so I can check it.

./makesysrw.sh in=./files/super/super_original.bin size=100 > ./mylog.txt

Also the lpdump.txt and myargs.txt

@Ayoub$# do you have unlocked bootloader? Then you can simply boot into twrp without flashing it like this:

fastboot boot twrp.img
[Android Software/Hacking General [Developers Only]] Ayoub$#:
Yes, I have an unlocked bootloader, but I searched for my phone on a site twrp And I could not find it
[Android Software/Hacking General [Developers Only]] Ayoub$#:
My phone is umidigi a3s
[Android Software/Hacking General [Developers Only]] lebigmac:
@Ayoub$# Did you check the xda subforum for your phone model? They should have twrp there. Good luck finding it!
[Android Software/Hacking General [Developers Only]] Frxhb:
maybe this LINK will help you
[Android Software/Hacking General [Developers Only]] Ayoub$#:
I searched but found umidigi a3 which is on Android 8 and umidigi a3s is system 10 which is not mentioned
[Android Software/Hacking General [Developers Only]] Ayoub$#:
Is there a way without twrp through terminal or windows
[Android Software/Hacking General [Developers Only]] Frxhb:
I think its not possible without Custom Recovery. I am sorry if there is no TWRP for you
[Android Software/Hacking General [Developers Only]] Ayoub$#:
Well I see, so is there a way to use lunix or windows or mac without twrp?
[Android Software/Hacking General [Developers Only]] pnin:
Ran this in Termux with/out su and got the same error back:

... +Alg: No such file or directory

What am I missing?
[Android Software/Hacking General [Developers Only]] lebigmac:
@pnin try this:

ls -al /dev/block/by-name | grep "super"

If you have Xiaomi X3 NFC then you should have super. I wonder if yours is also located at /dev/block/sda15 like mine ;)
[Android Software/Hacking General [Developers Only]] Ayoub$#:
Is there a way in Windows 10 with adb or phone no twrp
[Android Software/Hacking General [Developers Only]] eyesoftheangels:
hi. how use it from on twrp terminal. is it possible or only linux os?
[Android Software/Hacking General [Developers Only]] Ayoub$#:
I found a way to make the system folders readable and write using magisk units, which is as follows: copy, for example, bin from the system folder and paste it into the following path / sbin / magisk / moduls / appsystemizer / system. Restart the phone and enter the / system / bin folder and you will find it turned To rw knowing that the Appsystemless module will be looking for it in Magisk
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi. This is not Linux version. For Linux version check this thread

Please check first comment for detailed instructions on how to use this version. Also the script itself contains examples on how to use it. Just open it in text editor
[Android Software/Hacking General [Developers Only]] walid77dz:
i can't found appsystemiser folder
[Android Software/Hacking General [Developers Only]] Ayoub$#:
You have to download the Systemless App from Magisk and find it

Her name app systemless

Make sure that the folders are not hidden in File Manager

When downloading app systemless from Magisk you will go to a course /sbin/magisk/module/terminal-systemize/system
[Android Software/Hacking General [Developers Only]] walid77dz:
i found a module called " app systemizer"
[Android Software/Hacking General [Developers Only]] walid77dz:
any way to decript my root files please!
[Android Software/Hacking General [Developers Only]] alangkato:
success. I'm using Redmi 9T miui 12 Indonesia. thanks for helping me to uninstall system apps which i find useless.
[Android Software/Hacking General [Developers Only]] Greenspoof:
If you are on a custom ROM, great are the chances that you're already R/W
[Android Software/Hacking General [Developers Only]] lebigmac:
@Leandro344 @wv8023

Okay folks I just uploaded a long overdue hotfix for you.

This should fix error signal 6 and maybe also error 255 in recovery. Thanks for all the feedback you guys gave me!

This time I've included the official platform-tools in the sysrw_repair tools subfolder.

Error 73 and 70 still need to be fixed within the script.

Check first post for download link. Enjoy!

Warning to OnePlus users: COW error is not fully fixed yet! Make sure you backup your original super before flashing!
[Android Software/Hacking General [Developers Only]] Keven11:
Awesome! An amazing feat in and of itself. You sir are A GOD!
[Android Software/Hacking General [Developers Only]] rakoncwy:
I tried it on Realme GT, but the same symptom.

boot infinite loop.

And it cannot be restored with the "super_original.bin" file.

Realme gt does not have a proper recovery tool, so recovery is very difficult.
[Android Software/Hacking General [Developers Only]] lebigmac:
@tha_mechanic That's not true. The script will try to create ./img folder in current path if it doesn't exist.

And the sysrw_repair script is bundled together with the img folder ;)

@rakoncwy Your log looks very unusual.

To undo the boot loop you could try reactivating the verity and verification as well as restoring original stock super image.

Sometimes messing with the vbmeta can cause boot loop.

Just boot into recovery and try reactivating verity and verification using the avbctl program that's included in the script's tools subfolder.

If your device have no custom recovery simply flash the stock vbmeta.img and stock super.img using fastboot. You can download these files from your device manufacturer's website.

This should re-enable both dm-verity and verification.

The script only modifies super partition and vbmeta partition.

Good luck!
[Android Software/Hacking General [Developers Only]] Keven11:
HaHa😂?? What's so funny Mr Hamburger? Hmmm? I congratulate u on overcoming a hurdle in these hard times, and you laugh at me? Phh! Whatever!,,....................,...................Lulz
[Android Software/Hacking General [Developers Only]] DeathShot9:
I can't download this from yandex, can any one upload it someplace else?
[Android Software/Hacking General [Developers Only]] lebigmac:
It looks like the maximum amount of downloads per day was reached (70). Try again after midnight.
[Android Software/Hacking General [Developers Only]] DeathShot9:
Thank you.

I am trying to run this on my Xperia 1II. I just used Newflahser to flash the latest Android 11 US firmware from XperiFirm (58.1.A.5.222-R6B) and I installed Shinyquagsire24's TWRP but when I run the script it says:

Installing zip file '/sdcard/Download/systemrw_1.32_BUNDLE.zip'
Unmounting System...
tw_has_recovery_partitio
E: Unable to open block device /dev/block/loop19: No such device or address
E: Unable to open block device /dev/block/loop19: No such device or address
E: Unable to open block device /dev/block/loop18: No such device or address
E: Unable to open block device /dev/block/loop17: No such device or address
Error installing zip file '/sdcard/Download/systemrw_1.32_BUNDLE.zip'
Updating partition details...
...done
[Android Software/Hacking General [Developers Only]] lebigmac:
🤦‍♂️ The flashable zip is inside the BUNDLE :ROFLMAO: Just extract the BUNDLE file... Good luck!
[Android Software/Hacking General [Developers Only]] DeathShot9:
HAHAHAHA. Okay, it's running now, I'll let you know how it goes. Thanks :)

Edit: Got Error 73. NBD, I don't have time to boot into Linux right this minute, but I'll do it later tonight.
[Android Software/Hacking General [Developers Only]] lebigmac:
Before you run the linux repair script please open the sysrw_repair.sh script file with text editor and change version number from 1.31d to 1.32 and save file.

I forgot to do that!