[Android Q&A, Help & Troubleshooting] anonymous_7218:
I've successfuly patched boot_a image with root but I'm somehow unable to add that image in aggregate.img since everything is read-only. I don't know how can I install this image in this case. It's not like I can extract all images from aggregate.img into that folder, remove aggregate.img and open the emulator and everything will be loaded automatically from that folder. I need somehow to modify aggregate.img but unfortunatelly I didn't succeed.

Is anyone have an explanation and some fix for this? So I can try to boot into root mode

UPDATE: I actually succeed (almost) - there is only one thing left to do:

U-Boot 2023.04-23704-g981ae56d1b-ab10287685 (Jun 08 2023 - 01:05:35 +0000)

DRAM: 6 GiB

Core: 8 devices, 8 uclasses, devicetree: separate

Hit any key to stop autoboot: 0

## Android Verified Boot 2.0 version 1.1.0

Could not find "init_boot_a" partition

** Bad device specification virtio 0#init_boot_a **

** Bad device specification virtio 0#init_boot_a **

Couldn't find partition virtio 0#init_boot_a

read_is_device_unlocked not supported yet

read_rollback_index not supported yet

read_rollback_index not supported yet

avb_slot_verify.c:433: ERROR: boot_a: Hash of data does not match digest in descriptor.

Verification failed

Android boot failed, error -1.

=>

So is there any way how to unlock bootloader and bypass verifications during boot?

ONE_MORE_UPDATE: I was able to bypass some of those errors via flag 2 making images for both vbmeta_a and vbmeta_system_a partitions but unfortunately vbmeta partitions needs to be signed with keys that bootloader will find (public keys provided by OEM) to verify is the public key by OEM and the private key by OEM correct and compatible or not.

To bypass that (maybe) is via reverse-enginnering (I don't know that sorry...) the bootloader to get into it's source code, modify it to instruct the bootloader to use chain_descriptor.txt from some partition in the system where we can add our custom public keys that will be used by bootloader to verify vbmeta images and to compile that.

If someone can do that and modify it for example to search for chain_descriptor.txt in system_a partition provided by super.img (root filesystem "/" ) this could allow us to use resize2fs to make this system_a partition bigger and RW, create chain_descriptor.txt there that will contain vbmeta partitions with our custom public keys for those partitions and when we sign vbmeta partitions with our custom private keys and flag 2, it should pass Android Verified Boot (I guess - this is not yet tested since no one patched bootloader for Google Play Games Beta Emulation software yet)

Or simply somehow bootloader can be unlocked to skip Android Verified Boot completely and boot any unsigned images (much easier for rooting and etc...)

As far as I was able to go is to this part:

U-Boot 2023.04-23704-g981ae56d1b-ab10287685 (Jun 08 2023 - 01:05:35 +0000)

DRAM: 6 GiB

Core: 8 devices, 8 uclasses, devicetree: separate

Hit any key to stop autoboot: 0

## Android Verified Boot 2.0 version 1.1.0

Could not find "init_boot_a" partition

** Bad device specification virtio 0#init_boot_a **

** Bad device specification virtio 0#init_boot_a **

Couldn't find partition virtio 0#init_boot_a

read_is_device_unlocked not supported yet

avb_slot_verify.c:768: ERROR: vbmeta_a: Error verifying vbmeta image: OK_NOT_SIGNED

Verification failed

Android boot failed, error -1.

=>

For other bypasses, I simply need more - so I hope that others will figure out. If you need vbmeta images and boot_a image patched with root to figure out more about this, please let me know.

(P.S - init_boot_a partition is still unknown thing to me since I'm not sure why it wants to find it since the stock image with partitions never included that init_boot_a partition - at least not separately)