[Android Software Development] Yuki1001:
Disclaimer: I'm not responsible for any result of these operations. Please be careful and well prepared. Always have your important data backed up safely on other place.

Hello everyone!

As far as 2022 and Xiaomi gets their new phones updated to MIUI13 and Android 12, they implement the new read-only filesystem "EROFS" on the logical partitions inside super partition. EROFS is a filesystem initial developed by Huawei and then Google select it as a new standard to use in read only logical partition inside super partition from Android 12. The "EROFS", is the short for "Extendable (or Enhanced?) Read-Only Filesystem", conveying that this filesystem is a one-time cooked filesystem and cannot be changed without extracting and re-cooking. With erofs we cannot modify the logical partition anymore so I found a new way to unlock these partitions.

I just faced and managed to solve the "lock" and I would like to share the solution, which may help more people.

My device: Xiaomi 12 (cupid).

System: Stock MIUI13 (Android 12).

Logical partitions with read-only lock inside super partition: system, vendor, product, system_ext, odm, vendor_dlkm. All of them are erofs filesystem.

Be aware that this device is virtual a/b and the _b partitions inside super are 0k blank files. No need to do anything with them.

In theory, all devices shipping with erofs partitions inside super are compatible with this method. Feedbacks are always welcome!

Before we start: This guide is for Android power users that wish to make their Android 12+ read-only system/vendor.... partitions with EROFS filesystem inside super read-writeable again to remove the bloatware and do more customizations to their device.

Credits:

@Yuki1001 - EROFS Guide, research, new rw discoveries.

@lebigmac - a couple of rw slogans, some binaries, inspiration.

Requirements:

1. Your phone must be unlocked as you must flash your new super.img through fastboot command. Root is required to run any command in a terminal (win cmd or linux terminal).

2. 20GB+ free space on your phone and PC.

3. The toolkit needed.

4. A clever brain and courage.

So in short, the tutorial contains these part:

(1) Dump and extract your super image.

(2) Pull the folder with partition images extracted from super image to the PC.

(3) Convert these erofs images to ext4 images (Extract and Rebuild). These new images are in the same folder.

(4) Push the folder to the phone and fix any errors of new generated ext4 images.

(5) Merge them into a new single sparse super image and pull it to the PC.

(6) Flash the new image through fastboot command.

(7) Check the rw capability of the logical partitions and do anything you want!

Let's start now!

1. Get your super image by dumping your current super partition. We can find our super partition in this way:

su
cd /dev/block/bootdevice/by-name
ls -al | grep "super"

You will get the output like this:

View attachment 5694745

Then we knows the super partition block number and path immediately. Let's dump its data to a file.

dd if=%PATH_TO_SUPER_BLOCK% of=/data/local/tmp/super_orig.img bs=4096

Wait for the data transfer done and we can get the super image. DO NOT forget to replace "%PATH_TO_SUPER_BLOCK%" with your own super block path!

2. Now we can do things with the super_orig.img: Extract logical partitions inside super partition to a folder. I will use Google's official tool: lpunpack. For example, I extract these partitions inside super to "sup_unpack" folder. Give all binaries in tools folder with executive permission in advance.

./tools/lpunpack ./super_orig.img sup_unpack

Now check with the folder to confirm whether these partitions insider super are extracted. If so, we can transmit the folder to the PC with adb pull. Extract my unlock-super folder in advance and we need to place the pulled out folder in it.

adb pull /data/local/tmp/sup_unpack

Now the "sup_unpack" folder exists in the platform-tools folder. Move it to the "unlock-super" folder.

3. Extract these erofs images one by one with erofsUnpackRust.exe and repack them into ext4 image. Check the folders' size to determine how big space does the new ext4 filesystem need. I'd like to recommend you to preset some free space for every new ext4 images for further modifications.

You are required to remove all _a suffix for the images in order to make the following program works properly. For example: system_a.img --> system.img. You have been warned!

For example:

erofsUnpackRust sup_unpack/system.img system
erofsUnpackRust sup_unpack/vendor.img vendor
erofsUnpackRust sup_unpack/product.img product

.... (and so on)

You will get the output like these screenshots:

View attachment 5694751 View attachment 5694759

For building a new image, we need to set a timestamp for all files included. I use 1230764400 as it equals the original file timestamp in erofs image. DO NOT forget to replace %FS_SIZE% with your real fs size you want. So go with the following command:

***DO NOT COPY!***

Example:

System:
make_ext4fs -J -T 1230764400 -S system/config/system_file_contexts -l %FS_SIZE% -C system/config/system_fs_config -L system -a system system_a.img system/system

Vendor:
make_ext4fs -J -T 1230764400 -S vendor/config/vendor_file_contexts -l %FS_SIZE% -C vendor/config/vendor_fs_config -L vendor -a vendor vendor_a.img vendor/vendor

For odm, product, system_ext, vendor_dlkm...... and other partitions, use the same step.

You should get the output like these screenshots:

View attachment 5694767View attachment 5694769View attachment 5694773View attachment 5694775

When you completed the steps above you should have the images in ext4 format. Then make a folder named "new_ext4" and move the new image files (_a suffix) to the new_ext4 folder. Make sure all partitions' images are correctly rebuilt.

View attachment 5694777

Copy the _b blank files toghether with new built _a images:

View attachment 5694793

4. Push the folder that contains your image to /data/local/tmp again. In my case use this command:

adb push new_ext4 /data/local/tmp/new_ext4

Then check whether the new folder exists in the correct place. DO NOT forget to use e2fsck -yf to fix any errors of the new images before joining them into a super image.

5. Now we have all partitions unlocked and corrected but we need to join them into a single "super_new.img" for flashing. Use the lpmake tool to create the new "super_new.img". Again, DO NOT forget to replace %SUPER_SIZE% with your super partition's physical size (the size of super_orig.img) , and replace mulitiple %SIZE% with the real size of your new built ext4 images (with _a suffix) .

***DO NOT COPY!***

cd /data/local/tmp/new_ext4
../tools/lpmake --output super_new.img --sparse --metadata-size 65536 --super-name super --metadata-slots 2 --device super:%SUPER_SIZE% --group slot_a:%SUPER_SIZE% --group slot_b:0 --partition system_a:none:%SIZE%:slot_a --image system_a=./system_a.img --partition vendor_a:none:%SIZE%:slot_a --image vendor_a=./vendor_a.img --partition product_a:none:%SIZE%:slot_a --image product_a=./product_a.img --partition system_ext_a:none:%SIZE%:slot_a --image system_ext_a=./system_ext_a.img --partition odm_a:none:%SIZE%:slot_a --image odm_a=./odm_a.img --partition vendor_dlkm_a:none:%SIZE%:slot_a --image vendor_dlkm_a=./vendor_dlkm_a.img --partition odm_b:none:0:slot_b --image odm_b=./odm_b.img --partition system_b:none:0:slot_b --image system_b=./system_b.img --partition vendor_b:none:0:slot_b --image vendor_b=./vendor_b.img --partition product_b:none:0:slot_b --image product_b=./product_b.img --partition system_ext_b:none:0:slot_b --image system_ext_b=./system_ext_b.img --partition vendor_dlkm_b:none:0:slot_b --image vendor_dlkm_b=./vendor_dlkm_b.img

View attachment 5694781

In the command we use --sparse parameter to let the new joined super image sparse, for the following fastboot flash.

6. Pull the new super_new.img to the computer. Do the fastboot flash. Erase the super partition and flash the new image.

adb pull /data/local/tmp/new_ext4/super_new.img

fastboot erase super
fastboot flash super super_new.img

View attachment 5694785

Now the partitions inside super should already have full r/w capability. Reboot the phone to check whether they can be mounted as r/w.

Voila!

View attachment 5694787

All tools are provided as attachments.

Password: super-rw

If you think it's useful, please click the "

Like

" button. Thanks!