yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] eudemonics:
doesn't work on my oneplus 6 running OOS 10.3.9 (android 10) :(

the script says my system is already r/w, but if i try to mount /system in terminal i get the following error:

:# mount -o rw,remount /system
mount: can't find /system in /proc/mounts

here is the script output:

--------------------------------------------------
| SystemRW v1.32 automated script by lebigmac |
| @xda ©2021 Big thank you to @Kolibass @Brepro1 |
|@munjeni @AndyYan @gabrielfrias @YOisuPU @bynarie |
| without your help this would not be possible! |
--------------------------------------------------

systemrw: Initiating procedure...

systemrw: Device is in Android mode. Ignoring
systemrw: Current device: OnePlus
systemrw: Current Android version: 10
systemrw: Current SELinux status: Permissive
systemrw: Unable to locate super partition on device. Ignoring
systemrw: /system is already R/W capable. Ignoring
systemrw: /product is already R/W capable. Ignoring
systemrw: /vendor is already R/W capable. Ignoring
systemrw: Adjusting permissions...
systemrw: Attempting to disable dm-verity and verification...
verification is already disabled on slot with suffix _a.
verity is already disabled on slot with suffix _a.
systemrw: Partition detected -> system_a @ /dev/block/sda13
systemrw: NO 'shared_blocks feature' detected @ system_a. Ignoring
systemrw: Partition detected -> system_b @ /dev/block/sda14
systemrw: NO 'shared_blocks feature' detected @ system_b. Ignoring
systemrw: Partition detected -> vendor_a @ /dev/block/sde16
systemrw: NO 'shared_blocks feature' detected @ vendor_a. Ignoring
systemrw: Partition detected -> vendor_b @ /dev/block/sde44
systemrw: NO 'shared_blocks feature' detected @ vendor_b. Ignoring
systemrw: There was a problem removing read-only restriction(s) of your device. Abort
[Android Software/Hacking General [Developers Only]] Bonoboo:
Thanks for attention to my problem.

1. Yes, I tried to remount /vendor/etc as rw in RootExplorer - not works. Also:

mount -o rw,remount /vendor/etc

mount: '/vendor/etc' not in /proc/mounts

2. Attached logs after converting partition and "my_tune2fs_output".

"shared_blocks feature" was before converting and absent after.
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi @Bonoboo thanks for your log files.

If shared_blocks read-only feature was present before running script and afterwards it's gone that means script fully worked as expected on your device. Congratulations! Enjoy a read/writeable system :love:(y)

Regarding /vendor/etc still being read-only I don't know why this is happening on your device. On my Xiaomi Poco X3 I've got full r/w access to this folder...
[Android Software/Hacking General [Developers Only]] mishak750:
not work on motorola defy 2021 (bathena) error 73, on stock rom and gsi adnroid 10, 11. this model still hasnt custom recovery, use android terminal emulator.
[Android Software/Hacking General [Developers Only]] eudemonics:
is there a way to append "/system" to the /proc/mounts file to mount r/w or would that be too easy? i have read/write access to that file from terminal. what is .magisk/block/system_root in mounts, can that be used somehow?

i actually had r/w access to the root drive on android 10 without having to do anything before i upgraded from OOS 10.3.8 to 10.3.9. is it possible to get r/w access again if i downgrade to oreo and try upgrading again?
[Android Software/Hacking General [Developers Only]] eudemonics:
When i try flashing the zip file in TWRP (latest official version for enchilada), it fails upon attempting to extract the files with ERROR code 255 (screenshot below):
[Android Software/Hacking General [Developers Only]] DeadRRR:
It doesn't have error but when im going to magisk and see the log file it says that some partitions unlock failed: Permission Denied
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi. That's the wrong log. This script have nothing to do with magisk. Script only requires root to function properly. How you achieve root that's your choice.

Please send log files from this folder. Thanks.

/data/local/tmp/systemrw_1.32/log/

Hi thanks for your feedback. Why some recoveries experience error 255 here while others do not is still a mystery to me. I'll try fixing this issue in next version ;)

Workaround is to run script manually as described in the instructions. I see you already did that.

Please boot into Android and check manually if your device have shared_blocks read-only feature and report back your results. Thanks.

adb shell
su
touch /sdcard/my_tune2fs_output.txt
for i in `seq 0 5`; do tune2fs -l /dev/block/dm-$i>>/sdcard/my_tune2fs_output.txt; done

Hi. Error 73 can easily be fixed by using the included sysrw_repair script (Linux only). See troubleshooting section on front page for more details. Good luck!
[Android Software/Hacking General [Developers Only]] DeadRRR:
Ohh my bad its working but do you know how to unlock mmcblk0p directories for magisk or some thread or smt. Sorry for losing your time
[Android Software/Hacking General [Developers Only]] Keven11:
Obviously, you didn't understand what I was saying..... I got the script to run successfully. From beginning to end, with ZERO ERRORS. I don't see how you thought I was asking for help. But thanks for your response.
[Android Software/Hacking General [Developers Only]] Keven11:
Wrong thread. Go to a device specific group.
[Android Software/Hacking General [Developers Only]] Keven11:
Can I ask why you are running OOS when there are many Official custom ROMs available for the device? Just curious, I suppose. Also, running a custom ROM would solve your read-only access issue. In my mind it makes sense to do. As I said "just curious".

Edit: Have you tried simply using an app like Root Explorer (or others) to mount system, vendor...etc as RW? I can't help but wonder if the 'problem' the script runs into is that there is no read-only restriction in place.
[Android Software/Hacking General [Developers Only]] eudemonics:
i have edxposed/riru and magisk so i guess i don't really feel the need to run a custom ROM... is there a good custom ROM you can recommend for the oneplus 6? i thought about trying lineage, seems pretty solid.

ES file explorer's root explorer worked before i upgraded (though i was already on android 10), now root directory just gives me an empty page. 😿 it is frustrating since i can mount -o rw,remount / in terminal and read/write/exec everything in there just fine but it won't load in ES.
[Android Software/Hacking General [Developers Only]] Keven11:
I am pretty certain that there is an official CrDroid ROM for it. I have a OnePlus 7 pro. I usually run either CrDroid or Yaap. So, I would imagine that they would be pretty good an Op6 too.
[Android Software/Hacking General [Developers Only]] mishak750:
lebigmac used virtual box ubuntu, stock rom android 10​

d /data/local/tmp/sysrw_repair_v1.32 <

bathena:/data/local/tmp/sysrw_repair_v1.32 # ./sysrw_repair.sh

/system/bin/sh: ./sysrw_repair.sh: No such file or directory

1|bathena:/data/local/tmp/sysrw_repair_v1.32 # chmod +x ./sysrw_repair.sh

bathena:/data/local/tmp/sysrw_repair_v1.32 # ./sysrw_repair.sh

/system/bin/sh: ./sysrw_repair.sh: No such file or directory

1|bathena:/data/local/tmp/sysrw_repair_v1.32 # ^C

130|bathena:/data/local/tmp/sysrw_repair_v1.32 #

files in folder on phone
[Android Software/Hacking General [Developers Only]] mishak750:
all work, checked deleting facebook service from system with total commander. Script repair need launch from folder in pc (linux), not from phone.
[Android Software/Hacking General [Developers Only]] Hippie459MN:
HELP! This is the output from the fastboot flash then went into a bootloop and can't get out of it and the original super.bin is on the phones storage. Like an idiot I didnt copy it to my computer.

This is the output:

C:\platform-tools> fastboot flash super super_fixed.bin
Sending sparse 'super' 1/7 (786428 KB) OKAY [ 20.840s]
Writing 'super' OKAY [ 9.984s]
Sending sparse 'super' 2/7 (775299 KB) OKAY [ 20.918s]
Writing 'super' OKAY [ 10.548s]
Sending sparse 'super' 3/7 (738533 KB) OKAY [ 19.074s]
Writing 'super' OKAY [ 12.621s]
Sending sparse 'super' 4/7 (786364 KB) OKAY [ 21.406s]
Writing 'super' OKAY [ 11.466s]
Sending sparse 'super' 5/7 (769699 KB) OKAY [ 20.676s]
Writing 'super' OKAY [ 7.572s]
Sending sparse 'super' 6/7 (786012 KB) OKAY [ 19.325s]
Writing 'super' OKAY [ 9.937s]
Sending sparse 'super' 7/7 (92863 KB) OKAY [ 2.186s]
Writing 'super' OKAY [ 2.379s]
Finished. Total time: 190.616s

C:\platform-tools>fastboot reboot
Rebooting OKAY [ 0.000s]
Finished. Total time: 0.000s

Now its just a solid bootloop. I can connect back to fastboot but that is it. Any ideas here would be great!
[Android Software/Hacking General [Developers Only]] lebigmac:
Which Sony firmware is this? Maybe they fixed this r/w vulnerability in recent Sony firmware versions or it's just 1 small mistake somewhere that is causing the bootloop.

It would be very helpful if you could actually check the logcat in real time during the bootloop to find out reason for bootloop. I wish I knew how to check log during the early boot sequence.

Don't worry you can just boot into custom recovery and pull/flash the file from there. It should be here:

/data/local/tmp/systemrw_1.32/img/super_original.bin

If for some reason you can't do it you can always download the super image from your manufacturer's website. Or check your device subforum here at XDA. Maybe someone has uploaded your specific firmware there. However it should be the same exact firmware version that is currently installed to your device.

Then you can re-enable dm-verity and verification through fastboot or with the included avbctl binary and all changes that the script has done to your device will be undone.

Good luck!

Hi @eudemonics.

Please keep in mind that this script was designed for stock firmware and not for custom ROM's.

Yes it's true. It should work on most A10/11 based custom ROM's but that's just pure luck ;)

A good custom ROM should have r/w capability by default. If your custom ROM doesn't offer this important feature straight out of the box then you should rethink why you installed it in the first place. Just my 2 ¢

Hi @mishak750

I'm happy you were able to fix error 73 by using the included sysrw_repair script (linux only).

Congratulations! Enjoy a read/writeable device! :love:(y)

Please send me your log files from this folder. Your feedback helps make the script better. Thanks (y)

/data/local/tmp/systemrw_1.32/log/

Hi again @DeadRRR. Without your log files it's very difficult to give you customer support...
[Android Software/Hacking General [Developers Only]] Hippie459MN:
It is 61.0.A.14.3 and I do have it on my computer and there is a super_X-FLASH-ALL-4BA8.sin file there. I can boot into recovery but for some reason I can't ADB shell in recovery. Keeps telling me the adb vendor key is not set. Assuming I have to extract the img file from the .sin filebefore I flash it. I am going to try that in fastboot and see what happens. At this point, what can it hurt. lol
[Android Software/Hacking General [Developers Only]] bountyman334:
You would have to downgrade. I went to the Chinese version XQ-BC72_Customized CN_61.0.A.15.27 and it works with super fixed and booted

Join this telegram group. i just posted it there for future ppl

alyksanykovych

You can contact @xperia1ii right away.

t.me
[Android Software/Hacking General [Developers Only]] ankitvrsharma:
Can you please look into my logs. It shows successful but not got rw capabilities. In twrp after last line of mylog.txt there were two line warning regarding something Mount related
[Android Software/Hacking General [Developers Only]] lebigmac:
Hello. Thanks for your feedback.

Your log looks good.

What you are talking about are TWRP related error messages that have nothing to do with script. Simply reboot device after running script.

Did you try this yet inside Android? See picture below:
[Android Software/Hacking General [Developers Only]] mishak750:
Here log, some system file i can't modify, size after edit 0b.
[Android Software/Hacking General [Developers Only]] ankitvrsharma:
Mount showing read only like red line.

If everything is right then why I'm not getting rw capabilities . I'm doing something wrong?

Flashed flashable zip in twrp then booted into system after successful flashing, nothing else.
[Android Software/Hacking General [Developers Only]] lebigmac:
It looks like script successfully removed shared_blocks read-only feature from your device. Now if your device is still locked to read-only that probably means that your device has an additional read-only protection feature that must be disabled. Please let me know if you figure out which feature it is and I will add it to next version of script. Thanks!

Thanks for sharing your log files. Apparently you used custom size 300 MB which should give you plenty of free space to make any modifications. Which file you can't modify?
[Android Software/Hacking General [Developers Only]] ankitvrsharma:
I can change permission to rw in twrp but not after booting into system.
[Android Software/Hacking General [Developers Only]] ankitvrsharma:
In my device magisk is installed in recovery partition. This is one thing I found in magisk documentation.
[Android Software/Hacking General [Developers Only]] tids2k:
.(placeholder)
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi @tids2k . Does Android 12 have shared_blocks read-only feature?

You can check it like this:

adb shell
su
touch /sdcard/my_tune2fs.txt
for x in `ls -l /dev/block/by-name | awk '{print $NF}'`; do tune2fs -l $x>>/sdcard/my_tune2fs.txt; done

Also run these commands:

adb shell
su
touch /sdcard/my_dm_tune2fs.txt
for x in `seq 0 5`; do tune2fs -l /dev/block/dm-$x>>/sdcard/my_dm_tune2fs.txt; done

Then please upload these 2 files here : /sdcard/my_tune2fs.txt and /sdcard/my_dm_tune2fs.txt

Thanks (y)

Here I explained how to add Android 12 support. Please keep in mind script has not been officially tested in Android 12 yet and there is a chance that this r/w vulnerability has already been fixed in Android 12. Please report back your results. Thanks. Good luck!
[Android Software/Hacking General [Developers Only]] tids2k:
Dear lebigmac,

Yes shared_blocks feature is noted on new Pixel 6 Pro.

The issue is not with your script but with the device it appears that at this stage root is not fully achieved. It appears that although Magisk is installed and RIru and Safety Net Fix are noted however when i ran your script again it appears that /data/local/tmp is not -RW. Will get back to this thread once the path us rootable
[Android Software/Hacking General [Developers Only]] Hippie459MN:
Yeah, im not going to downgrade as the prior version had an issue with the power/screen off button (Every time you tried to turn the screen on with the power button it would reboot the device), and the version before that had issues with horrible battery life and heat issues. Now the phone never gets hot, battery lasts a good while, and my power button works as it should. lol Also, I would like to stay on the US firmware. Personal preference really.

With that, I wonder what the difference is. I do see there is another firmware update for the BC62 (61.0.A.15.35). I might try to see if there is a change log anywhere and have a look at that. I just really wish there was a custom recovery already.

And yeah, I dont use Telegram...
[Android Software/Hacking General [Developers Only]] xpxc:
I try to use ./systemrw.sh size=1024 but there will always be an error 70. The system space is still 0MB. Please give me a solution. Thank you
[Android Software/Hacking General [Developers Only]] xpxc:
Yes, so I changed to poco f3. The Samsung device has the original ROM and ROOT function. I was surprised to see the R/W function.
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi. Did you check if your Samsung device have shared_blocks read-only feature like I suggested on previous page?

Auto-resize feature will be available in next version of script ;)

On your poco f3 try smaller custom size such as size=50 or size=25

Good luck!
[Android Software/Hacking General [Developers Only]] tids2k:
Just an update on Pixel 6 Pro. I currently have temp root and ran your script, here is the output. Temp root environment was achieved via patching boot.img and booting it in fastboot.

raven:/data/local/tmp/systemrw_1.32 # ./systemrw.sh
--------------------------------------------------
| SystemRW v1.32 automated script by lebigmac |
| @xda ©2021 Big thank you to @Kolibass @Brepro1 |
|@munjeni @AndyYan @gabrielfrias @YOisuPU @bynarie |
| without your help this would not be possible! |
--------------------------------------------------

systemrw: Initiating procedure...

systemrw: Device is in Android mode. Ignoring
systemrw: Current device: Google
systemrw: Current Android version: 12
systemrw: Current SELinux status: Permissive
systemrw: Current slot is: 0
systemrw: Your super partition is located at: /dev/block/sda26
systemrw: / is read-only
systemrw: /product is read-only
systemrw: /vendor is read-only
systemrw: Adjusting permissions...
systemrw: Attempting to disable dm-verity and verification...
verification is already disabled on slot with suffix _a.
verity is already disabled on slot with suffix _a.
systemrw: Dumping super partition to: /data/local/tmp/systemrw_1.32/img/super_original.bin
systemrw: Please wait patiently...

16662528+0 records in
16662528+0 records out
8531214336 bytes (7.9 G) copied, 61.753092 s, 132 M/s

systemrw: Successfully dumped super partition to: /data/local/tmp/systemrw_1.32/img/super_original.bin
systemrw: Unpacking embedded partitions from /data/local/tmp/systemrw_1.32/img/super_original.bin
systemrw: Nested partitions were successfully extracted from super

systemrw: Current size of system_a.img in bytes: 890347520
systemrw: Current size of system_a.img in MB: 849
systemrw: Current size of system_a.img in 512-byte sectors: 1738960

systemrw: 'shared_blocks feature' detected @ system_a.img

.......
systemrw: Successfully created patched super image @
systemrw: /data/local/tmp/systemrw_1.32/img/super_fixed.bin

systemrw: Congratulations! Your image(s) should now have R/W capability
systemrw: Please reboot into bootloader and flash the file(s) manually

Appears to be "successful patch" for now. However this is at initial stage, will keep update as I go along.

Running :

raven:/data/local/tmp/systemrw_1.32/log # su
raven:/data/local/tmp/systemrw_1.32/log # mount -o remount,rw /
'/dev/block/dm-0' is read-only

...

stuck here !!

It appears that the script worked properly, however no change to dm-0 as it is still -ro. A bit lost here now. Flashing super_fixed.bin relates to a bootloop. o flash back to super_original

..

still bootloops.

Could this be related to the size of the super_fixed i.e half of the super_original file ? Wondering ?

4,469,497,856 bytes against 8,531,214,336 byte
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi.

I can't believe script works in Android 12!

Did you flash super_fixed.bin to the super partition yet? Chances are high that you will get a bootloop if you do it.

Make a full backup before proceeding just in case.

Please send me your log files from this folder. Thanks.

/data/local/tmp/systemrw_1.32/log/

Good luck.
[Android Software/Hacking General [Developers Only]] tids2k:
Bootloops :-D , still excited to see it works flawlessly. But I think you would probably need to tinker it a little to fully support A12.
[Android Software/Hacking General [Developers Only]] The_Eniac:
I'm interested in beta testing your flashable zip.

Thanks so much for your big effort!
[Android Software/Hacking General [Developers Only]] lebigmac:
HERE is the new flashable zip

Simply flash it in TWRP recovery like any other flashable zip.

You have to disable zip signature verification though. I tried to sign it with zipsigner.jar but without success.

If you want to modify the arguments that are used by the installer to launch the script itself simply extract the .zip and modify the makesysrw_1.15c/config.ini file and make your adjustments and then compress the makesysrw_1.15c and META-INF folders again as a new .zip and flash it.

First line of config.ini contains the arguments for those who have no super partition.

By default this line is completely empty

Here the in=x and out=x arguments will simply be ignored so no need to add them.

Second line of config.ini contains the arguments for those who do have a super partition on their device. Here is an example for line #2. Remember you need to add an empty space in front like this:

in=./files/super/super_original.bin out=./files/super/super_fixed.bin size=50

If you decide to use custom arguments then the first character should always be an empty space. If no arguments are used such as by default in line #1 (no super) then it should be completely empty, no space, nothing.

Please report any bugs thank you!

If it's stable enough I'll add it to the first post.
[Android Software/Hacking General [Developers Only]] jeryll:
poco x3 nfc here, everything went smooth and FAST here, good work man, my super is now RW, seems you polished this flashable zip a lot, no errors or warnings on my side, super work! thanks for this, again!
[Android Software/Hacking General [Developers Only]] lebigmac:
lol jeryll I'm glad it worked for you :)

Much smoother than that first version right?

It took me a while to redirect the script output into that pseudo terminal thingy in TWRP.

Did the flashable zip successfully give all your (super) partitions 100 MB of extra free space?

You can check in you type in this command in terminal : df -h
[Android Software/Hacking General [Developers Only]] jeryll:
yep, but now i realized I want to increase size a little more, can I use this flashable zip again on already RW enabled super?
[Android Software/Hacking General [Developers Only]] lebigmac:
Sure. Just extract the flashable zip, change the arguments in makesysrw_1.15c/config.ini, save file and then compress both the makesysrw_1.15c and META-INF folders into a new .zip file and flash it in TWRP. The name of the new .zip file shouldn't really matter. What's important is what's inside.

So in your case since you've got a super partition and you already dumped your super_original file, change line #2 in config.ini to this. (The path is relative to the script)

size=150 in=./files/super/super_original.bin

Also keep in mind if you add an argument in config.ini then there must be an empty space at the beginning of the line.

If you don't use an argument then the line should be completely empty (no space).
[Android Software/Hacking General [Developers Only]] The_Eniac:
Good job ! it worked like a charm !

Got RW in System partition in my MI 10. I just tested it making a new colorized reboot menu. You can see this result.
[Android Software/Hacking General [Developers Only]] ronlkh1965:
Hi, Is there a 1.15c available for testing?
[Android Software/Hacking General [Developers Only]] lebigmac:
Hola @The_Eniac . I'm glad it worked on your device. What Android version is currently running on your device and does it have a super partition? You can check by running this command on your phone or through adb shell:

ls -Alg /dev/block/by-name | grep "super"
[Android Software/Hacking General [Developers Only]] lebigmac:
Hi ronlk1965 you can try the new 1.15c flashable zip from page 6

I cannot guarantee that it will fix your syntax error. I have not found the syntax error yet. Can you please post it again so more people can see it? Maybe somebody know the solution to your syntax error problem.
[Android Software/Hacking General [Developers Only]] The_Eniac:
I'm on android 11 . I assume that my device has a super partition. But please explain how I run this command. From ¿powershell in windows? ¿from adb with the phone in fastboot? Thanks.