yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] JesusChrist<3:
1- Sorry for spamming the thread.

2- Thank you Keven11 and lebigmac

3- Finally I got it, first flashed the stock rom (android 11) and started it just to create the /data/media/ folder. Right after that I turned off the device, flashed the twrp and magisk, and placed the systemrw_1.32 in the /data/local/tmp/ folder. I started the script from the twrp terminal "sh /data/local/tmp/systemrw_1.32/systemrw.sh size=15. After getting the error "73" screen, I started sysrw_repair_v1.32 in vmware emulating linux mint... And everything went really well! :)
[Android Software/Hacking General [Developers Only]] Keven11:
It is definitely a journey. Well worth the work, and time invested in then end. Also, it helps many people understand their devices just that much more. I am glad that you were successful.

Also, everytime a person manages to get this to work for themselves, and explains how they did. That alone helps many others. So thank you for putting in the work, and sharing your experience.
[Android Software/Hacking General [Developers Only]] Keven11:
If you read any few pages of the thread you will see that this community is reliant upon people helping others. If, and when they can. That is one of the many beautiful parts of this amazing community.

P.S. This is not my thread, or my project either.
[Android Software/Hacking General [Developers Only]] Keven11:
My apologies. I did not realize that you hadn't unlocked your BL yet. As Pachacouti said, it is up to you to find out how to unlock the BL on your specific device. If the BL isn't locked by the OEM then you are able to figure it out.
[Android Software/Hacking General [Developers Only]] hendrysetiadi:
yes, now i success unlock the bootloader after reflashing many times.. now the problem is i cannot write to system or vendor partition. i also success root with magisk and can run su on the console.

i cannot imagine how the script can be run on the device which has low nand storage.
[Android Software/Hacking General [Developers Only]] Keven11:
I have to ask what you want to accomplish after you are successful and have rw capability? This is not a rhetorical question or anything of the sort. I am simply curious.
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi @The_Tablet. Thanks for your helpful feedback! Could I please include your directory structure visualisation on front page? It looks very clear and easy to understand.

Yes currently project path is hardcoded as: /data/local/tmp/systemrw_1.32 but I might change that in a future version.

There is a path check feature. Apparently it doesn't always work as expected. I'll try to improve it ;)

if [ "$PWD" != "$LOC" ]; then
cd $LOC
if [ "$PWD" != "$LOC" ]; then
printf "$app: Please make sure %s exists and try again\n\n" $LOC
exit 1
fi
fi

Hello @krasevalex. Thanks for your comment.

You are welcome. I am happy that you were able to fix that annoying error 73 simply by using the included sysrw_repair script.

Enjoy a fully read/write-able device!

Hi @Dobrozol. Thank you. Did script work well on your device? Please feel free to send me your log files. Thank you!

To undo what the script has done simply flash black original stock super image to super image block device as suggested by @fire7ly on previous page. Script usually dumps original stock super image to /img/ subfolder. You can also download original read-only stock super image from your manufacturer's website. Good luck!

Hi @daintycloud. You are welcome. Did script work well on your device? Please feel free to send me your log files. Thank you!

Hi @Jr.17. Thanks for your feedback.

Please feel free to send me your log files if you want me to look for any errors. Thank you!

Did you fastboot flash super_fixed.bin to your super partition?

If you can remount your system partition as R/W and you get no output that means it worked. Congratulations!

Enjoy a fully read/write-able system!
[Android Software/Hacking General [Developers Only]] Ringsofsaturn777:
Thank You @lebigmac

It's working perfectly...

All i did was...

1. I flash the zip via Orange fox and it failed

2.Open terminal and entered

su

mount -o remount,rw /

3.Install Total commander and then kaboom

Device: Surya

Custom ROM... crdroid 7.10
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi. I'm not surprised it works perfectly on Xiaomi Poco X3 NFC. That's the device I used to develop the script ;)

What do you mean it failed but still worked? Can you please show me your Orangefox error? Was it error 255? You can find recovery log file @ /tmp/recovery.txt or /sdcard/Orangefox/log.txt. Thanks!

If you see these errors after successfully running script that's completely normal. Those are TWRP related errors and I can't do anything about that!

Are you sure your Custom ROM... crdroid 7.10 cannot mount your partitions as R/W by default without running my script? Custom ROM's should be able to do that straight out of the box. If your custom ROM cannot mount your partitions as R/W then it's missing some important features. Just my 2 ¢
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi.

Does your tv box even have got super partition? You can check like this

adb shell "ls -l /dev/block/by-name/super"

Try run expert example in Android mode and add some free space using the size= parameter. The special in= value used here will skip the dumping of super partition process to save some space on your device. Additionally you can export super_fixed.bin to external sdcard using the out= parameter. If size=15 don't work try smaller size. Good luck! (y)

adb shell
su
cd /data/local/tmp/systemrw_1.32
chmod +x ./systemrw.sh

# EXPERT EXAMPLE:
./systemrw.sh in=`ls -l /dev/block/by-name/super | awk '{print $NF}'` out=/PATH_TO_EXTERNAL_SDCARD/super_fixed.bin size=15
[Android Software/Hacking General [Developers Only]] yasfatft:
This method does not work for me on a Redmi 9A!

I believe the source of failure is that we can't remount /system partition to rw;

Strangely after rooting the device and even going to recovery mode and set the configs as they shoud be (like unchecking boot system partition read-only), it does not work!

But I can remount / parttiton to be rw but not /system, even when I execute

```

mount -o rw,remount,rw /system

```

the command runs successfully (without any errors) but the partition type won't' change (I use mount | grep system to check)
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi @yasfatft. Thanks for your interest in this project.

Please send me your log files from this folder. Thanks.

/data/local/tmp/systemrw_1.32/log/

What happens if you do this inside Android after successfully running script?

Please show some screenshots of your errors. Thanks!

Good luck!
[Android Software/Hacking General [Developers Only]] yasfatft:
Hi, I have to correct myself, after some more tries, I was able to run the script, but manually (as you have documented).

The script runs correctly but yet /system partition is ro, even when I remount it to rw, not a single error will be returned, but /system is still ro! :| I'll attach the logs...
[Android Software/Hacking General [Developers Only]] oneironaut2002:
I have test this script on Mi 10i ( gauguin ). Tested on 2 roms.

1. MIUI 12.5 Global with terminal/fastboot method.

2. Project Sakura with recovery flash method.

It's worked both the times 😁.I have attached both logs. Thanks for your awesome script.
[Android Software/Hacking General [Developers Only]] Miustone:
Just found this Project randomly on the Xperia 1 III Forums. Awesome... Just awesome! I will test it on the Xperia Stock Firmwares with My Fams. I will report back. 2019 Xperias dont seem to have a Super Partition. Think 2020+ Xperia have it... Please, Please, Please keep that Project up! It's highly needed for all People who don't have Recoveries available like Xperia Users and for everyone who doesn't cares about these Pseudo Security Mechanisms <3
[Android Software/Hacking General [Developers Only]] HyperCriSiS:
Hi,

when I flash this on Asus Zenfone 8, TWRP restarts.

This is in the logs then:

E:failed to mount /tmp/com.android.apex.cts.shim.apex to loop device /dev/block/loop0. Reason: Device or resource busy

E:Unable to create loop devices to mount apex files

E:Unable to load apex images from /system_root/system/apex

What can I do to fix this?

Thanks,

Hyper
[Android Software/Hacking General [Developers Only]] Miustone:
First Log i got with latest Stock on Xperia 5:
[Android Software/Hacking General [Developers Only]] NewDwarf:
I am sure that the script won't work with the Pixel 4a but it is in the confirmed list. The guy who shared the log ran the script on the 'user-debug' build!

Take a look at the line:

Normal 'release' build should print just 'Google':

So, please, fix the supported device list in the initial post. The 'user-debug' build can easily be mounted as RW by just using regular 'adb' tool.

BTW, the same problem on running the script on the Pixel 3. Below is the log:

The script makes a wrong decision that "/system is already R/W capable". It is not true! On running the script it is in the RO mode.

Could someone explain what the script have to do to make "RW" mounting possible?

The 'avbctl' tool modifies the vbmeta.img in-place to disable dm-verity. But it turns out it is not enough.

What is the purpose of further running of the 'tune2fs' tool to make partitions as "RW"?
[Android Software/Hacking General [Developers Only]] MinhDat_Vo:
The automatic installation method (systemrw_1.32_flashable.zip) is worked for me. Thank you 3000!

Google Pixel 4 XL (coral) with Android 10

These are my logs and my screenshot....
[Android Software/Hacking General [Developers Only]] NewDwarf:
Did you try to remount as "rw" after loading the patched images?

For example, try to remount the /vendor by:
[Android Software/Hacking General [Developers Only]] NewDwarf:
Do you use "Magisk" for rooting?

Did you run just ./systemrw.sh without parameters?
[Android Software/Hacking General [Developers Only]] DeviLL2014:
yes , writes is read-only
[Android Software/Hacking General [Developers Only]] NewDwarf:
I believe that is not it. There is a dm-verity specific part in the android kernel which should be patched.

What exactly device you are trying to patch? Do you have access to the kernel sources?

There is a file drivers/md/dm-android-verity.c which has a function:

static int verify_header(struct android_metadata_header *header)
{
int retval = -EINVAL;

if (is_userdebug() && le32_to_cpu(header->magic_number) ==
VERITY_METADATA_MAGIC_DISABLE)
return VERITY_STATE_DISABLE;

if (!(le32_to_cpu(header->magic_number) ==
VERITY_METADATA_MAGIC_NUMBER) ||
(le32_to_cpu(header->magic_number) ==
VERITY_METADATA_MAGIC_DISABLE)) {
DMERR("Incorrect magic number");
return retval;
}

if (le32_to_cpu(header->protocol_version) !=
VERITY_METADATA_VERSION) {
DMERR("Unsupported version %u",
le32_to_cpu(header->protocol_version));
return retval;
}

return 0;
}

Take a look at the above function. If we use the "userdebug" build, we can easily disable the dm-verity by the 'avbctl' tool or by the "adb" tool. The code explains why it is possible. If we try to patch this function, by immediately returning of VERITY_STATE_DISABLE, we, possibly, bypass the dm-verity protection and will be able to mount as RW.
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi @MinhDat_Vo thanks for your log files and screenshot.

If you get insufficient space error when trying to copy file to /system you must run script again with larger custom size parameter! This should be fixed in next version with auto-resize feature.

Enjoy fully read/write-able system! :love:(y)

Hi @DeviLL2014 thanks for your log! It couldn't look any better. It's nice to see you did the expert example ;)(y)

Your device still boots properly after flashing super_fixed.bin ? Can you please double-check if shared_blocks feature was properly removed from your device?

You can check like this:

adb shell
su
tune2fs -l /dev/block/dm-0 | grep "features"
tune2fs -l /dev/block/dm-1 | grep "features"
tune2fs -l /dev/block/dm-2 | grep "features"

If there is no more shared_blocks feature that means script worked as expected but some other protection feature is preventing you from going fully r/w...

Hi again @yasfatft. Please see my answer above to @DeviLL2014

Same thing applies to you. If shared_blocks was successfully removed by script that means it worked! If your device is still locked to r/o after that , then you have more additional protection features that must be disabled!

Hello @oneironaut2002. Thanks for your log files and your positive feedback! I'm happy the script works perfectly on both of your Xiaomi devices. I will add you to list of successful devices on front page ;)

Enjoy a fully read/write-able device! :love:(y)

Hi @Miustone. Thanks for your interest in this project.

I checked your log and apparently your Sony device doesn't use shared_blocks read-only feature. Are you sure your device is still locked to read-only? Then you must have additional protection features that stop you from going fully R/W!

Did you try to remount your partitions as r/w yet (see picture below) ?

If you find out why your device is still read-only please let us know!

Good luck!

Hi @aunghtay.plastic. What do you mean not work? Flashable zip give error 255? Did you run script manually in recovery mode?

I checked your log and it looks good. It looks like you ran script multiple times. That's no big deal.

If you can still boot device after running script I'd call that a success ;) A partial one that is.

What happens if you execute the commands from the picture above while phone is in Android mode? Good luck!

Hi @HyperCriSiS. Thanks for your feedback. I've never heard of this error before. It looks like TWRP related error.

Did you try installing and running script manually as described on front page? Phone can remain in recovery mode while doing this.

After successfully running script please send me your log files from /log subfolder inside script folder. Thanks.

Good luck!
[Android Software/Hacking General [Developers Only]] DeviLL2014:
there is no source code, only boot, system keys
[Android Software/Hacking General [Developers Only]] NewDwarf:
Here is the github repo of Xiaomi kernels https://github.com/MiCode/Xiaomi_Kernel_OpenSource

What exactly device (model, codename) you use?
[Android Software/Hacking General [Developers Only]] DeviLL2014:
yes everything was sewn and turned on,

E:\RealmeC3\platform-tools>adb shell
RMX2020:/ $ su
RMX2020:/ # tune2fs -l /dev/block/dm-0 | grep "features"
Filesystem features: ext_attr dir_index filetype extent sparse_super large_
file huge_file uninit_bg dir_nlink extra_isize
RMX2020:/ # tune2fs -l /dev/block/dm-1 | grep "features"
Filesystem features: ext_attr dir_index filetype extent sparse_super large_
file huge_file uninit_bg dir_nlink extra_isize
RMX2020:/ # tune2fs -l /dev/block/dm-2 | grep "features"
Filesystem features: ext_attr dir_index filetype extent sparse_super large_
file huge_file uninit_bg dir_nlink extra_isize
RMX2020:/ #
[Android Software/Hacking General [Developers Only]] NewDwarf:
Frankly, your log looks weird. It is not clear how the script can reports about the super partition, if Pixel 4 stock images DON'T have it. Also it doesn't have the

'/dev/block/by-name/super' file!
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi @NewDwarf. Welcome to the XDA developers forum!

If you are referring to this comment by @rhewins2268

I checked his log and it looks pretty good to me hence I added him to the list of successful devices on front page. I personally only use Xiaomi devices. To be honest I know absolutely nothing about Pixel devices.

You might want to contact @rhewins2268 directly and ask him how he got the script to work on his Pixel device.

Remounting partitions as R/W is always a good idea after removing shared_blocks read-only feature.

Where did you find this function? I cannot find it in the avbctl source folder. Are you sure avbctl binary uses this function?

If avbctl doesn't work for you then you can try disabling dm-verity and verification like this:

fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img

Good luck!
[Android Software/Hacking General [Developers Only]] lebigmac:
Thanks for the confirmation. It looks like script worked as expected and successfully removed shared_blocks read-only feature from your device.

I don't know why your device is still read-only!? It doesn't make any sense. There must be another read-only protection feature hidden somewhere deep inside your device...

Can you do this? (see picture below)

Also run dmesg immediately after remount command. Maybe we can figure out what's the problem.

adb shell
su
mount -o remount,rw /
dmesg>/sdcard/dmesg_devill2014.txt
[Android Software/Hacking General [Developers Only]] xen423:
Thanks @lebigmac for total awesomeness.

Confirmed working for :

Device : Oneplus 8T / KB2005

Build : 11.0.10.10.KB05AA

[RECOVERY] [11] [ALPHA] TeamWin Recovery Project (8T / Kebab) (2021-09-04)

Magisk v23
[Android Software/Hacking General [Developers Only]] Hippie459MN:
Dont mind me asking, what did you use to run the script and how did you go about it? I would like to try to get this Xperia 1 III system set to R/W. Pretty dumb Google did this so we have to resort to things like this.
[Android Software/Hacking General [Developers Only]] MinhDat_Vo:
I've been using it for a long time, here are some videos before and after I used it

Before I could install it automatically using flashable zip, I followed the instructions here: (and it works on both Android 10 and 11):

https://xdaforums.com/t/script-linux-mount-system-as-read-write-android-10.4240703/

- Yes i used Magisk to root

- I simply downloaded and flashed the zip file with TWRP
[Android Software/Hacking General [Developers Only]] hendrysetiadi:
I want to put custom launcher, and remove all bloatware apk. But is that possible to run this script on low storage ? can i run it and throw the output file to external storage ?
[Android Software/Hacking General [Developers Only]] NewDwarf:
Thanks. I dug more and found some new things.

1. The script makes a wrong decision in the case if the FS being mounted is not in the /proc/mounts

+ mount -o rw,remount /system
+ result='mount: '\''/system'\'' not in /proc/mounts'
+ printf 'systemrw: %s is already R/W capable. Ignoring\n' /system

2. For unknown for me reasons, tune2fs doesn't work:

+ printf 'systemrw: Partition detected -> %s @ %s\n' vendor_a /dev/block/sda9
systemrw: Partition detected -> vendor_a @ /dev/block/sda9
+ tune2fs -l /dev/block/sda9
+ grep feat
tune2fs: Bad magic number in super-block while trying to open /dev/block/sda9

But at the same time, on mounting the 'vendor' partition as RW, I got in the kernel log:

EXT4-fs (dm-1): couldn't mount RDWR because of unsupported optional features (4000)

where '4000' is actually the "EXT4_FEATURE_RO_COMPAT_SHARED_BLOCKS" feature which your script tries to remove by:

printf "$app: Removing 'shared_blocks feature' of %s...\n" $fiName
if ( ! e2fsck -y -E unshare_blocks $1 > /dev/null ); then
printf "$app: There was a problem removing the read-only lock of %s. Ignoring\n\n" $fiName
else
printf "$app: Read-only lock of %s successfully removed\n\n" $fiName
fi

Any idea of why tune2fs doesn't work on the Pixel family partitions? Pixels don't use super partition concept and all RO images are sparse.

Any suggestions to fix it?

UPDATE1: As I mentioned, Pixels use the sparse images.

On regular Linux machine, I tried to run tune2fs with the sparse image and got:

tune2fs -l vendor.img
tune2fs 1.46.2 (28-Feb-2021)
tune2fs: Bad magic number in super-block while trying to open vendor.img

This is exactly I got on Android running the script.

Then I converted the sparse image to raw one by the 'simg2img' and got:

tune2fs -l vendor.raw | grep feat
Filesystem features: ext_attr resize_inode dir_index filetype extent sparse_super large_file huge_file uninit_bg dir_nlink extra_isize shared_blocks

UPDATE2: it turns out that at least Pixel3, Pixel4/4a, and Pixel5 are all super partition based devices. But the Pixel3 doesn't have the '/dev/block/by-name/super' file. That's why the script doesn't work on the Pixel3. The script cannot define the correct path for the 'super' file and it fails.

So, the Pixel3 is out of line in the Pixel family. Do you have an idea how to identify the path to the 'super' partition?
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi again @hendrysetiadi I already answered your question last week. Please see comment #1122 on previous page! Good luck!

@NewDwarf

Why would your block device be in sparse format? I thought block devices are always in raw format?

If the file is really in sparse format that would explain why querying partition features with tune2fs -l command fails.

This issue should be easy to fix by unsparsing the file first with the included simg2img tool...
[Android Software/Hacking General [Developers Only]] NewDwarf:
Yes, this is a full log. In the last message I mentioned:

It turns out that at least Pixel3, Pixel4/4a, and Pixel5 are all super partition based devices. But the Pixel3 doesn't have the '/dev/block/by-name/super' file. That's why the script doesn't work on the Pixel3. The script cannot define the correct path for the 'super' file and it fails.

Actually, Pixel3 is a super partition based device. Because of absence of the /dev/block/by-name/super' file, the script tries to dump and then process ( tune2fs -l ...) each RO partition as a RAW partition. As the 'tune2fs' tool processes nested partitions, it fails.

The problem is how to find location of the super partition on the Pixel3 if the '/dev/block/by-name/super' is not present.

All Pixel family devices has the 'super_empty.img' file inside the stock ROM. It is pretty short file and at the first glance it describes layout of RO partitions. You can find it attached.
[Android Software/Hacking General [Developers Only]] lebigmac:
placeholder
[Android Software/Hacking General [Developers Only]] HyperCriSiS:
I tried running it manually but it is not executed.

What am I doing wrong here :)?

ASUS_I006D:/data/local/tmp/sysrw_repair_v1.32 # ls -l

total 14

drwxr-xr-x 2 root root 3452 2021-10-16 17:50 img

-rw-r--r-- 1 root root 128 2021-10-16 17:53 log.txt

-rwxr-xr-x 1 root root 2630 2021-07-26 00:32 sysrw_repair.sh

drwxr-xr-x 4 root root 3452 2021-10-16 17:50 tools

ASUS_I006D:/data/local/tmp/sysrw_repair_v1.32 # ./sysrw_repair.sh size=15

/system/bin/sh: ./sysrw_repair.sh: No such file or directory
[Android Software/Hacking General [Developers Only]] JimmyMX:
Hello and good day all

"User data is not affected"

i found out the hard way that this piece of information is misleading , I did everything by the book on ROG III on android 11 after success I had to wipe data to get access to android , I lost data stored on SD card plus all my apps and my apps data , anyways I have rw system now but I want to install an update to ROG III but I don't want to go through wiping data again.

I don't know but maybe i am missing something,

any suggestions would be appreciated,

thanx for the hardcore work
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi @JimmyMX

That's sad to hear that you lost your private data. In over 8 months and 60 pages of development and 10000 downloads later nobody has experienced this issue to my knowledge.

How the hell did you do that?!

I never said to wipe data after running script. Who told you to do that?

Script only modifies super and vbmeta partitions and only uses /data/local/tmp/systemrw_1.32 folder to execute script and dump some files...

Why didn't you backup /data before wiping it?

Try to see the positive side. Now your device is finally read/writable. Congratulations!
[Android Software/Hacking General [Developers Only]] BC-19:
hi @lebigmac

thanks for your project.

i hope, i do realy realy hope, that new script with auto-size feature will be released soon in systemrw_1.33.