[ASUS ZenFone 8] bnsmb:
How to change files in the boot image using Magisk

Update 23.06.2024

see this post https://xdaforums.com/t/how-to-chan...-is-no-ramdisk-in-the-boot-partition.4678017/ for infos on ROMs without a ramdisk in the boot partition

Sometime it's necessary to change a file in the boot image used for booting an Android phone (for example to change the default properties that are used before Magisk is loaded)

To change or add files to the boot image for an Android phone the Magisk binary magiskboot can be used

magiskboot is

and can handle the boot images for all phones supported by Magisk.

Warning

Be aware that changes to the boot image only survive until the installation of the next OS update. So it's strongly recommended to use Magisk to change files from the OS if possible.

Anyway -- to change a file in the boot image open a shell as user root on the phone and do:

Notes:

The following instructions were done on Zenfone 8 running OmniROM 12 but should also work for other ROMs.

At the end of this post are the commands to unpack the boot partition and to recreate the boot partition listed for cut & paste.

#
# first create the directory tree for the work
#
# Note:
#
# This directory tree must be on a Unix filesystem like that mounted to /data;
# a filesystem like that mounted to /sdcard does not work
#
ASUS_I006D:/data/adb # cd /data/adb
ASUS_I006D:/data/adb # mkdir workdir
ASUS_I006D:/data/adb # mkdir workdir/backup
ASUS_I006D:/data/adb # mkdir workdir/ramdisk
ASUS_I006D:/data/adb # mkdir workdir/boot_files
ASUS_I006D:/data/adb #

Next get the current boot slot:

ASUS_I006D:/data/adb/workdir # getprop ro.boot.slot_suffix
_b

and create an image of the current boot partition:

#
ASUS_I006D:/ # cd /data/adb/workdir
ASUS_I006D:/data/adb/workdir #

ASUS_I006D:/data/adb/workdir # dd if=/dev/block/by-name/boot_b of=./boot_b.img
196608+0 records in
196608+0 records out
100663296 bytes (96 M) copied, 0.374815 s, 256 M/s
ASUS_I006D:/data/adb/workdir #

Create a backup of the original boot image file:

ASUS_I006D:/data/adb/workdir # cp boot_b.img backup/
ASUS_I006D:/data/adb/workdir #

Note:

You will need the boot image file just created to restore the boot partition in case the phone will not boot anymore with your changed boot partition. Therefor you should also copy the boot image file to your PC.

Next unpack the boot image using magiskboot into an empty directory:

ASUS_I006D:/data/adb/workdir # cd boot_files/

ASUS_I006D:/data/adb/workdir/boot_files # ls
ASUS_I006D:/data/adb/workdir/boot_files #

ASUS_I006D:/data/adb/workdir/boot_files # /data/adb/magisk/magiskboot unpack ../boot_b.img
Parsing boot image: [../boot_b.img]
HEADER_VER [3]
KERNEL_SZ [42025472]
RAMDISK_SZ [15093897]
OS_VERSION [12.0.0]
OS_PATCH_LEVEL [2022-05]
PAGESIZE [4096]
CMDLINE []
KERNEL_FMT [raw]
RAMDISK_FMT [gzip]
VBMETA
ASUS_I006D:/data/adb/workdir/boot_files #

magiskboot will split the boot.img file into the various parts -- for most phones with Android 12 this should be the kernel and the ramdisk:

ASUS_I006D:/data/adb/workdir/boot_files # ls -l
total 71264
-rw-r--r-- 1 root root 42025472 2022-09-18 18:22 kernel
-rw-r--r-- 1 root root 30864336 2022-09-18 18:22 ramdisk.cpio
ASUS_I006D:/data/adb/workdir/boot_files #

The files for the ramdisk used while booting the phone are in an cpio archive so to change them we must unpack the cpio archive with the ramdisk contents:

#
ASUS_I006D:/ # cd /data/adb/workdir/ramdisk/
ASUS_I006D:/data/adb/workdir/ramdisk #

130|ASUS_I006D:/data/adb/workdir/ramdisk # cpio -idm <../boot_files/ramdisk.cpio

ASUS_I006D:/data/adb/workdir/ramdisk # ls -ltr
total 1868
-rw-r--r-- 1 root root 20700 1970-01-01 01:00 vendor_property_contexts
-rw-r--r-- 1 root root 89884 1970-01-01 01:00 vendor_file_contexts
drwxr-xr-x 2 root root 3452 1970-01-01 01:00 vendor
drwxr-xr-x 2 root root 3452 1970-01-01 01:00 tmp
-rw-r--r-- 1 root root 5783 1970-01-01 01:00 system_ext_property_contexts
-rw-r--r-- 1 root root 3347 1970-01-01 01:00 system_ext_file_contexts
drwxr-xr-x 2 root root 3452 1970-01-01 01:00 system_ext
drwxr-xr-x 2 root root 3452 1970-01-01 01:00 sys
drwxr-x--x 2 root root 3452 1970-01-01 01:00 storage
-rw-r--r-- 1 root root 1027673 1970-01-01 01:00 sepolicy
drwxr-xr-x 2 root root 3452 1970-01-01 01:00 second_stage_resources
drwxr-xr-x 2 root root 3452 1970-01-01 01:00 sdcard
-rw-r--r-- 1 root root 31390 1970-01-01 01:00 prop.default
-rw-r--r-- 1 root root 1721 1970-01-01 01:00 product_property_contexts
-rw-r--r-- 1 root root 306 1970-01-01 01:00 product_file_contexts
drwxr-xr-x 2 root root 3452 1970-01-01 01:00 product
drwxr-xr-x 2 root root 3452 1970-01-01 01:00 proc
drwxr-xr-x 2 root root 3452 1970-01-01 01:00 postinstall
-rw-r--r-- 1 root root 76958 1970-01-01 01:00 plat_property_contexts
-rw-r--r-- 1 root root 40490 1970-01-01 01:00 plat_file_contexts
drwxr-xr-x 2 root root 3452 1970-01-01 01:00 oem
-rw-r--r-- 1 root root 0 1970-01-01 01:00 odm_property_contexts
-rw-r--r-- 1 root root 0 1970-01-01 01:00 odm_file_contexts
drwxr-xr-x 2 root root 3452 1970-01-01 01:00 mnt
drwxr-xr-x 2 root root 3452 1970-01-01 01:00 metadata
drwxr-xr-x 2 root root 3452 1970-01-01 01:00 linkerconfig
-rwxr-x--- 1 root root 2025 1970-01-01 01:00 init.recovery.qcom.rc
-rwxr-x--- 1 root root 491528 1970-01-01 01:00 init
lrwxrwxrwx 1 root root 11 1970-01-01 01:00 etc -> /system/etc
drwxr-xr-x 2 root root 3452 1970-01-01 01:00 dev
lrwxrwxrwx 1 root root 12 1970-01-01 01:00 default.prop -> prop.default
drwxr-xr-x 2 root root 3452 1970-01-01 01:00 debug_ramdisk
drwxr-xr-x 2 root root 3452 1970-01-01 01:00 data_mirror
drwxr-x--x 2 root root 3452 1970-01-01 01:00 data
lrwxrwxrwx 1 root root 17 1970-01-01 01:00 d -> /sys/kernel/debug
dr-xr-xr-x 2 root root 3452 1970-01-01 01:00 config
lrwxrwxrwx 1 root root 50 1970-01-01 01:00 bugreports -> /data/user_de/0/com.android.shell/files/bugreports
lrwxrwxrwx 1 root root 11 1970-01-01 01:00 bin -> /system/bin
drwxr-xr-x 2 root root 3452 1970-01-01 01:00 batinfo
drwxr-xr-x 2 root root 3452 1970-01-01 01:00 asdf
drwxr-xr-x 2 root root 3452 1970-01-01 01:00 apex
drwxr-xr-x 2 root root 3452 1970-01-01 01:00 acct
drwxr-xr-x 2 root root 3452 1970-01-01 01:00 APD
drwxr-xr-x 2 root root 3452 1970-01-01 01:00 ADF
drwxr-xr-x 4 root root 3452 2022-09-18 18:28 first_stage_ramdisk
drwxr-x--- 3 root root 3452 2022-09-18 18:28 overlay.d
drwxr-xr-x 2 root root 3452 2022-09-18 18:28 odm_dlkm
drwxr-xr-x 2 root root 3452 2022-09-18 18:28 odm
drwxr-xr-x 3 root root 3452 2022-09-18 18:28 res
drwxr-xr-x 5 root root 3452 2022-09-18 18:28 system
drwxr-xr-x 2 root root 3452 2022-09-18 18:28 vendor_dlkm
ASUS_I006D:/data/adb/workdir/ramdisk #

Now you can change the files from the ramdisk; add new files, or do anything necessary.

Be aware that most of the directories in the ramdisk are mount points to mount the other partitions. Therefor it's quite pointless to add files in these directories in the ramdisk.

Changing files in the ramdisk from the boot image

Changing one or more properties

Warning:

Please note that I am not an expert on Android internals and the following may be completely wrong.

(Any comments or corrections are welcome)

There are some files with property definitions in the boot image:

ASUS_I006D:/data/adb/workdir/ramdisk # find . -name "*.prop"
./default.prop
./system/etc/ramdisk/build.prop
ASUS_I006D:/data/adb/workdir/ramdisk #

To change or add a property it should be sufficient to add or change it in the file default.prop in the ramdisk from the boot image. But that does not work (at least in my tests...)

So to change or add a property it must be added to the file

/system/etc/ramdisk/build.prop

in the ramdisk for the boot image.

For example to add a swap device with 2 GB in the OmniROM these properties can be used:

#
# define the size for the device zram0 (use the postfix G for values in Gigabytes or M for values in Megabytes)
#
vendor.zram.disksize=2147483648
vendor.zram.enable=1

The result after repacking and installing the boot image :

ASUS_I006D:/ # id
uid=0(root) gid=0(root) groups=0(root) context=u:r:magisk:s0
ASUS_I006D:/ #

ASUS_I006D:/data/adb/workdir/ramdisk # getprop vendor.zram.disksize
2147483648
ASUS_I006D:/data/adb/workdir/ramdisk # vendor.zram.enable
1
ASUS_I006D:/data/adb/workdir/ramdisk #

1|ASUS_I006D:/data/adb/workdir/ramdisk # free
total used free shared buffers
Mem: 7612493824 4858556416 2753937408 12169216 15933440
-/+ buffers/cache: 4842622976 2769870848
Swap: 2147479552 0 2147479552
ASUS_I006D:/data/adb/workdir/ramdisk #

Notes:

These new properties defined in the file /system/etc/ramdisk/build.prop in the ramdisk are only visible for the root user.

Most probably another SELinux definition in one of the *context* files in the boot image is required to make the property visible for all users (but I don't know the necessary permissions for the properties to make them visible for all user). The current SELinx context for these properties is defined in the file vendor_property_contexts in the root directory of the ramdisk from the boot image:

ASUS_I006D:/data/adb/workdir/ramdisk # grep zram vendor_property_contexts
vendor.zram.disksize u:object_r:vendor_exported_system_prop:s0
vendor.zram.enable u:object_r:vendor_exported_system_prop:s0
persist.vendor.zram u:object_r:vendor_mpctl_prop:s0
vendor.asus.zram u:object_r:vendor_mpctl_prop:s0
vendor.zram. u:object_r:vendor_mpctl_prop:s0
ASUS_I006D:/data/adb/workdir/ramdisk #

To add a new property without a specific SELInux context it seems to be sufficient to add the property to the file /system/etc/ramdisk/build.prop in the ramdisk from the boot image (this does not work for properties starting with vendor. ):

# add the property to the file
#
130|ASUS_I006D:/ # tail -3 /data/adb/workdir/ramdisk/system/etc/ramdisk/build.prop
build.mysettings.variable01.value=5555
#
# end of file
ASUS_I006D:/ #

After the reboot the property is visible for non-root user:

ASUS_I006D:/ $ id
uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),1078(ext_data_rw),1079(ext_obb_rw),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid),3012(readtracefs) context=u:r:shell:s0
ASUS_I006D:/ $

ASUS_I006D:/ $ getprop build.mysettings.variable01.value
5555
ASUS_I006D:/ $

But the new property can only be changed by the user root:

1|ASUS_I006D:/ $ id
uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),1078(ext_data_rw),1079(ext_obb_rw),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid),3012(readtracefs) context=u:r:shell:s0
ASUS_I006D:/ $
ASUS_I006D:/ $ setprop build.mysettings.variable01.value 7777
Failed to set property 'build.mysettings.variable01.value' to '7777'.
See dmesg for error reason.
1|ASUS_I006D:/ $
1|ASUS_I006D:/ $ su -
ASUS_I006D:/ #
ASUS_I006D:/ # id
uid=0(root) gid=0(root) groups=0(root) context=u:r:magisk:s0
ASUS_I006D:/ #
ASUS_I006D:/ # setprop build.mysettings.variable01.value 7777
ASUS_I006D:/ #
ASUS_I006D:/ # getprop build.mysettings.variable01.value
7777
ASUS_I006D:/ #
ASUS_I006D:/ # ^D
ASUS_I006D:/ $ id
uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),1078(ext_data_rw),1079(ext_obb_rw),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid),3012(readtracefs) context=u:r:shell:s0
ASUS_I006D:/ $ getprop build.mysettings.variable01.value
7777
ASUS_I006D:/ $

(see here https://source.android.com/docs/core/architecture/configuration/add-system-properties for details about defining properties)

When done with your changes repack the ramdisk.

First we recreate the cpio archive:

ASUS_I006D:/data/adb/workdir # cd /data/adb/workdir/ramdisk
ASUS_I006D:/data/adb/workdir/ramdisk #

ASUS_I006D:/data/adb/workdir/ramdisk # find . | cpio -o >../boot_files/ramdisk.cpio
ASUS_I006D:/data/adb/workdir/ramdisk #

ASUS_I006D:/data/adb/workdir/ramdisk # ls -l ../boot_files/ramdisk.cpio
-rw-r--r-- 1 root root 30865560 2022-09-18 18:31 ../boot_files/ramdisk.cpio
ASUS_I006D:/data/adb/workdir/ramdisk #

And then we recreate the boot image with the kernel and the changed ramdisk using magiskboot:

ASUS_I006D:/data/adb/workdir/ramdisk # cd /data/adb/workdir/boot_files/
ASUS_I006D:/data/adb/workdir/boot_files #

130|ASUS_I006D:/data/adb/workdir/boot_files # /data/adb/magisk/magiskboot repack ../boot_b.img ../boot_b.img.new
Parsing boot image: [../boot_b.img]
HEADER_VER [3]
KERNEL_SZ [42025472]
RAMDISK_SZ [15093897]
OS_VERSION [12.0.0]
OS_PATCH_LEVEL [2022-05]
PAGESIZE [4096]
CMDLINE []
KERNEL_FMT [raw]
RAMDISK_FMT [gzip]
VBMETA
Repack to boot image: [../boot_b.img.new]
HEADER_VER [3]
KERNEL_SZ [42025472]
RAMDISK_SZ [15094405]
OS_VERSION [12.0.0]
OS_PATCH_LEVEL [2022-05]
PAGESIZE [4096]
CMDLINE []
ASUS_I006D:/data/adb/workdir/boot_files #

ASUS_I006D:/data/adb/workdir/boot_files # ls -l ../boot_b.img ../boot_b.img.new
-rw-r--r-- 1 root root 100663296 2022-09-18 18:20 ../boot_b.img
-rw-r--r-- 1 root root 100663296 2022-09-18 18:34 ../boot_b.img.new
ASUS_I006D:/data/adb/workdir/boot_files #

The new boot image file can now be written to the boot partition (either via dd or fastboot):

ASUS_I006D:/data/adb/workdir # cd /data/adb/workdir

ASUS_I006D:/data/adb/workdir # dd if=./boot_b.img.new of=/dev/block/by-name/boot_b
196608+0 records in
196608+0 records out
100663296 bytes (96 M) copied, 5.324559 s, 18 M/s
ASUS_I006D:/data/adb/workdir #

That's it -- now the new boot image should be used for the next reboots of the phone.

Additional infos

Please note that the file /system/etc/ramdisk/build.prop does not exist in the ramdisk from the boot disk used in the Original Android 12 for the ASUS Zenfone 8 . So this approach to change the properties does not work in that OS.

But the general approach used in these instructions to change files in the ramdisk used for the boot image does also work in the Original Android 12 for the ASUS Zenfone 8.

In the OmniROM for the Zenfone 8 and also in the Original Android 10 for the Zenfone 8 the swap device is created and configured with this init script: /vendor/bin/init.asus.zram.sh

See here

How to disable or change the swap device in the Android 12 from ASUS for the Zenfone 8

for a method using Magisk to change the swap device config in the Original ASUS Android 12

See here

How to create a swap device in the OmniROM 12 using Magisk

for a method using Magisk to change the swap device config in the OnmiROM 12

Replace files in the root directory

Magisk also supports changing files in the root directory via an overlay system -- see the section Root Directory Overlay System in this page https://github.com/topjohnwu/Magisk/blob/master/docs/guides.md.

To use this feature it's also neccessary to unpack and repack the boot partition.

An example about how to use this feature is here:

Magisk overlay - execute a script or copy files

Another example is in this thread https://github.com/topjohnwu/Magisk/issues/2978

Including sample code to use magiskboot to change files in the ramdisk from the boot partition:

./magiskboot unpack boot_root.img
./magiskboot cpio ramdisk.cpio \
"mkdir 0700 overlay.d" \
"add 0700 overlay.d/init.custom.rc init.custom.rc" \
"mkdir 0700 overlay.d/sbin" \
"add 0700 overlay.d/sbin/custom.sh init.custom.sh"
./magiskboot repack boot_root.img

Another example for this techniquie is in this post:

How to enable access via adb on a new installed OS

Trouble Shooting

If the phone does not boot anymore with the changed boot partition restore the boot partition from the boot image file created at the beginning either via dd after booting from a recovery image like TWRP or using fastboot to flash the boot paritition.

It's important to at least unpack the cpio with the ramdisk contents on an Unix filesystem (e.g. ext3, ext4, etc) - this can not be done in the device mounted to /sdcard.

Instructions for cut & paste

The instructions below are for cut & paste. Be aware that there is no error checking.

Instructions to copy the boot partition to a boot image file and to unpack the boot image and the ramdisk

CUR_SLOT=$( getprop ro.boot.slot_suffix )

cd /data/adb
mkdir /data/adb/workdir
mkdir /data/adb/workdir/backup
mkdir /data/adb/workdir/ramdisk
mkdir /data/adb/workdir/boot_files
cd /data/adb/workdir
dd if=/dev/block/by-name/boot${CUR_SLOT} of=./boot${CUR_SLOT}.img
cp boot_b.img backup/
cd boot_files
/data/adb/magisk/magiskboot unpack ../boot${CUR_SLOT}.img
cd /data/adb/workdir/ramdisk
cpio -idm <../boot_files/ramdisk.cpio
pwd
ls -ltr

Instructions to repack the ramdisk and the boot image and to rewrite the boot partition

CUR_SLOT=$( getprop ro.boot.slot_suffix )

cd /data/adb/workdir/ramdisk/
find . | cpio -o >../boot_files/ramdisk.cpio
cd /data/adb/workdir/boot_files/
/data/adb/magisk/magiskboot repack ../boot${CUR_SLOT}.img ../boot${CUR_SLOT}.img.new
cd /data/adb/workdir
dd if=./boot${CUR_SLOT}.img.new of=/dev/block/by-name/boot${CUR_SLOT}

reboot

Spoiler content hidden.