[Android Q&A, Help & Troubleshooting] Pachacouti:
My journey continues taking the untrodden path's...

I have found how to write to /

But I dont know how it's working.

So please read, and help me root this fone properly so I can keep what I found permanent in my fone.

I know some of you will 'see' with eye's to hear...

I need a twrp for my fone.

So I finally managed to get a working boot image created for my fone, with magisk, this is how I did it:

fastboot flashing unlock_critical

pressed + vol

fastboot flash vbmeta vblankmeta.img

fastboot flash recovery note9recovery.img <-for mt6762

fastboot reboot

As soon as the screen turns off. I have to hold + vol to NOT show recovery/fastboot/normal, choose recovery, but by taking this step, the recovery with magisk is already wiped somehow, depends on the version of android 10-Q, Pro, Latest, boots are slightly different.

The Pro variant is the best to work with.

So I rinse and repeat and flash the note9.img, boot into recovery, keeping + vol pressed until AFTER the point where the stock android recovery menu would kick in.

This boots the fone using the note9.img from recovery!

Voila, so I know I'm in, but I know a wonderfull trick most devs dont know.

This fone is unlocked from shop. It is system-as-root, meaning, root is actually pointless!

To prove it, I'll use root commands WITHOUT magisk, or twrp, or su, by giving this example:

adb shell echo "persist.service.adb.enable=1" >> default.prop

'Read only' bull**** pops up, but when doing:

adb -s *************** shell echo "persist.service.adb.enable=1" >> default.prop (* = your device serial number)

Command completes! WITHOUT MOUNTING ANY SYSTEM!

HOwever, attempting to write with magisk, su etc wont ever work, yeah, in an overlay file system, they will, but what of this? Like I've said in other posts, it's all a mirror image, or in todays speak, overlaid, I wrote of this on surfboard hacker, and a few other sites back in docsis 2 days as a security measure to stop us

uncapping lol...

So I initially do:

adb -s *************** shell echo "persist.service.adb.enable=1" >> default.prop

adb -s *************** shell echo "persist.service.debuggable=1" >> default.prop

adb -s *************** shell echo "persist.sys.usb.config=mtp,adb" >> default.prop

adb -s *************** shell echo "persist.service.adb.enable=1" >> /system/build.prop

adb -s *************** shell echo "persist.service.debuggable=1" >> /system/build.prop

adb -s *************** shell echo "persist.sys.usb.config=mtp,adb" >> /system/build.prop

adb -s *************** shell settings put secure install_non_market_apps 1

adb -s *************** shell settings put global adb_enabled 1

adb -s *************** shell settings put global setup_wizard_has_run 1

adb -s *************** shell settings put secure user_setup_complete 1

adb -s *************** shell settings put global activity_starts_logging_enabled 1

adb -s *************** shell settings put global development_settings_enabled 1

adb -s *************** shell settings put secure location_providers_allowed +gps,network

Works wonders huh?

Nah... of course my above commands work, lots of research...

I tried systemrw_1.32 to use any apps etc wanting to write to system, but I noticed while using magisk, some MMblock29 was read only, whereas systemrw_1.32 locked another, making me believe this is actually a pie script, because after testing this, when I rebooted, system was dm-1, not the dm-3 I normally see, and when attempting to system write, No joy, so these two are clashing.

But here's what to watch for: How TO write system is at this point:

I flashed the first mentioned files. Clean slate.

I boot the fone PAST recovery as mentioned, dont go INTO recovery, go PASSED it so fone boots from recovery without reflashing itself with stock, fone starts with a magisk icon on the desktop. kool.

adb shell

su

mount -o remount,rw /

Voila!

Now reboot...

All gone...

Rinse n repeat. Now how to keep this read write access?

1: Magisk in the bootloader will not work will not enable "mount -o remount,rw / " because it's symlinked it's own overlay system.

2: Magisk in the recovery is great to get magisk canary to do your bootloader for you, but the bootloader root will NOT write "mount -o remount,rw / " - only the note9 recovery allows me to "mount -o remount,rw / "

3: The note9 recovery is doing something no other magiskd bootloader or twrp'd recovery can!

4: If you get this, you get me.

Notice none of this is actually about what I need the most?

A twrp recovery 32mb in size, mt6762 or mt6765

Not a magisked boot.img thats supposed to be flashed to recovery..???

Oh and magisk has not done my fone yet, I need to load the note9 recovery just to get what you just read.

When I try magisk on a clean slate, it does nothing.