Database Develop

adb not working with N1 rooted?

hi,
two days ago i rooted my Nexus One FRF91-Vodafone with these two methods ( forum.xda-developers.com/showthread.php?p=7548842 and forum.xda-developers.com/showthread.php?t=736271). Still some commands of adb don't work and i can't find a solution.
Code:
C:\>cd android/tools
C:\android\tools>adb devices
* daemon not running. starting it now *
* daemon started successfully *
List of devices attached
HT05EP800252 device
C:\android\tools>adb shell
$ su
su
# id
id
uid=0(root) gid=0(root)
# exit
exit
$ exit
exit
C:\android\tools>adb remount
remount failed: Operation not permitted
C:\android\tools>adb root
adbd cannot run as root in production builds
C:\android\tools>
as you can see the device is connected in debug mode and i am rooted but the commands "adb remount" and "adb root" don't work (and maybe some other commands? i don't know). does it happen because the bootloader is still locked? if so, is there a way to have those commands working without unlocking it? if not, what could it be?
sorry for my english
thanks a lot

I'd have to guess because "remount" and "root" are not the way to do it.. Where are you seeing this is the way to do what you need to do?

how shoul it be used? i found a lot place where is written just like that. besides i read that the default.prop should be like this:
Code:
#
# ADDITIONAL_DEFAULT_PROPERTIES
#
ro.secure=0
ro.allow.mock.location=0
ro.debuggable=1
persist.service.adb.enable=1
for adb to work properly
but mine is like this
Code:
#
# ADDITIONAL_DEFAULT_PROPERTIES
#
ro.secure=1
ro.allow.mock.location=0
ro.debuggable=0
persist.service.adb.enable=0
and i don't understand why, i cant change it because it's a read-only file

What about:
Code:
mount -o remount,rw /system
?

i have this same problem, im guessing you went the way without unlocking your bootloader?
if so i dont think you can do adb remount
but what you can do is this method
adb shell
su
#mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
this will remount your phone system to read-write and you should be good to push/pull/cp/rm/clear/ and what your trying to do

Thanks for the info. I was having the same issue with my N1. The full mount path worked
Kage_

If you're really slick, I imagine you could add an alias "remount" to your shell profile script (.csh or something similar) to execute that full command for you when you needed it

[HOWTO] Root Nexus One 2.2.1 FRG83D without OEM unlock

This guide is for people who want root but want to keep their stock rom, not breaking the warranty, unlocking bootloader etc.
A proud ubuntu user, I am writing this in a new thread purely because the manual rageagainstthecage method and SuperOneClick method did not not work for me, see link to my conclusion below if you care
http://forum.xda-developers.com/showpost.php?p=11305312&postcount=2526
What did work however was via adb shell using psneuter and its fairly simple if you follow the following commands.
This guide assumes you know how to get access to the shell via adb, if you dont then search elsewhere for a useful guide
OK lets get to business!
1. Download the attached nexus_one_softroot.tar from the bottom of this post and extract contents to the same folder as adb
2. Open up your terminal, cd to the same folder as adb and the extracted files
3. Enter the following commands:
Code:
sudo ./adb push psneuter /data/local/tmp/psneuter
sudo ./adb push busybox /data/local/tmp/busybox
sudo ./adb push su /data/local/tmp/su
sudo ./adb shell chmod 755 /data/local/tmp/psneuter
sudo ./adb shell chmod 755 /data/local/tmp/busybox
sudo ./adb shell chmod 755 /data/local/tmp/su
sudo ./adb shell
After this you should see only a $ which tells us that we at the android command line with user privileges only, lets continue
Code:
$ cd /data/local/tmp
$ ls
busybox
su
psneuter
$ ./psneuter
property service neutered.
killing adbd. (should restart in a second or two)
You will now be kicked out of android shell, lets go back in
Code:
sudo ./adb shell
After this you should see only a # which tells us that we root baby! If you want to double check issue this command
Code:
# id
uid=0(root) gid=0(root)
Lets continue on. From this point we will install busybox and su which will make root permanent
Code:
# mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
# cd /data/local/tmp
# ./busybox cp busybox /system/bin
# chmod 4755 /system/bin/busybox
# busybox cp su /system/bin
# chmod 4755 /system/bin/su
# exit
For some reason I sometimes have to enter exit twice to leave the android shell. Again, re-access the android shell
Code:
sudo ./adb shell
Now in the android shell we can finish up
Code:
# su
# mount -o remount,ro -t yaffs2 /dev/block/mtdblock3 /system
# exit
# exit
Lastly we must install Superuser, and I did this from the android market so I knew its the latest version, its simple to get, less command input etc.
Now you have root! I hope this was simple enough to follow, I have not really written a guide before but from lots of searching I just could not find a solution for my Nexus One 2.2.1 FRG83D, especially any guide that uses psneuter.
Anyway, glad to contribute
EDIT - also, being new to starting threads, this may not quite be in the right section of the forum, sorry if thats the case mods

Added link to the thread from Wiki.

upgraded to gingerbread 2.3.3. after copying and setting permissions, got this:
PHP:
$ cd /data/local/tmp
$ ls -l
-rwxr-xr-x shell shell 26248 2010-07-22 10:20 su
-rwxr-xr-x shell shell 1062992 2010-10-16 22:29 busybox
-rwxr-xr-x shell shell 585731 2011-01-08 18:02 psneuter
su
busybox
psneuter
$ ./psneuter
Failed to set prot mask (Inappropriate ioctl for device)
second time threw me out of shell. again adb shell gives this:
PHP:
$ id
uid=2000(shell) gid=2000(shell) groups=1003(graphics),1004(input),1007(log),1009(mount),1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet)

mfkr said:
upgraded to gingerbread 2.3.3. after copying and setting permissions, got this:
Code:
$ ./psneuter
Failed to set prot mask (Inappropriate ioctl for device)
Click to expand...
Click to collapse
I believe this is due to a change in the kernel as it is upgraded into gingerbread, the input/output controls have changed, leaving psneuter out of date with the current kernel.
However if an exploit is found with the kernel used in 2.3.3, you can use it in place of psneuter with the above method.

[MOD] v0.3.1 Working Full Ubuntu for 1.5.7 and 1.8.3 based on Sogarth's script

Sogarth's webtop2sd will be released soon, you really should wait and install that instead of this! Thanks -The Management
No longer breaks on 1.83, thanks to Romracer
Update: This script worked on my phone. Mind you I was installing it from a fresh SBF flash, but it should work on your phone too. Absolutely no guarantees as usual.
Update 11th April 2011, 06:59 PM: Won't be getting CWM package because it'd be huuuuuuuuuge.
Update 28th April 2011. 16:38 PM: Removing BETA tag since there have been no issues with the script for quite some time.
First off I would like to thank Sogarth for making this script in the first place as well as Romracer for fixing it for 1.83. Since he is busy doing more important work I decided to do this little hack for those of us that updated to 1.5.7 and dont feel like flashing back to earlier versions to get full Ubuntu working.
Again, this is only necessary if you're already running 1.5.7 or 1.8.3.
Secondly, I am still working on this script so it may not work for you. If you have a problem you may post in the thread or PM me showing exactly the error message, word for word, that you receive.
Updates will be included in the OP from time to time as I fix errors.
Instructions:
1) install.bat (from your computer)
2) adb shell (get a shell on your phone)
3) su (get root on your phone in that shell)
4) . /data/local/tmp/install.sh (run the install script *on your phone* don't forget the "." and the space after the dot, or you will have to chmod 755 the shell script manually)
5) ?????
6) profit\
Noob instructions, written by Viamonte (I take no credit or responsibility):
Thanks again for all your help. Now the noob instructions:
"1-Download "Terminal Emulator" from the market, on your phone (or any other terminal), and the file anexed in this thread to your computer.
2-Connect the Atrix to the computer via USB, configuring the connection mode to "None" and enabling USB Debugging mode (Settings>Applications>Development>USB debugging)
3-Unzip the file you downloaded on your pc, and run Install.bat. This will push the script to your phone.
4-Go back to your phone and open the emulator you downloaded. Then type "su" (without quotes) and press enter. Then type ". /data/local/tmp/install.sh" (without quotes) and press enter again.
The script should begin running now. It will stop in two moments where you'll be instructed to get a cup of coffee, and may take several minutes to continue form this point. When finished, the Atrix will reboot.
To check if this worked, use the Webtop either on your multimidia dock or your lapdock and verify if new itens appeared on your task bar and on the right upper side of the screen"
0.3.1 release
0.2 release
0.1 first release
Changelog
0.3.1 fix to gconf file's mdate so it does what its supposed to do =)
0.3 Small typo fixes and cpp package install fix by romracer, now works on 1.83 =)
0.2 Fixed some typos in uninstall.sh and make sure the %gconf file wound up in the right spot.
0.1 - first version. NOT CWM install but ready to be packaged for that more or less

Nice, I'll give this a shot later.

Ill give it a shot when I get home!
Sent from Motorola Atrix on TELUS.

My phone is working perfectly, so why not ruin it?
I'm giving this a try right now!
1.4.57 - Rooted and gingerblurred with HDMI Mirroring and Webtop hack.
I'll update as progress goes along:
Edit 1:
Initial try gave me this
Checking device state...
Obtaining temporary root access...pushing shell scripts
A filesystem file already exists. Reset it? [n] y
Mounting the filesystem...
07.sh
--------------------------------------------
EXECUTION FAILED
Unable to mount the filesystem file. ERR 07
--------------------------------------------
Press any key to continue . . .
Edit 2:
Ok, it doesnt work with resetting it. How about removing?
Checking device state...
Obtaining temporary root access...pushing shell scripts
A filesystem file already exists. Reset it? [n] n
A filesystem file already exists. Delete it? [n] y
Deleting the filesystem file...
--------------------------------------
EXECUTION FAILED
Unable to delete the filesystem file.
--------------------------------------
Press any key to continue . . .
Edit 3:
Ok, only one option left then.
Checking device state...
Obtaining temporary root access...pushing shell scripts
A filesystem file already exists. Reset it? [n] n
A filesystem file already exists. Delete it? [n] n
--------------------------------------------------------------------------
EXECUTION FAILED
The filesystem file already exists, but no operations have been selected.
--------------------------------------------------------------------------
Press any key to continue . . .
=====================================================================
Edit 4:
Since execution is failing I'm trying to find the problem. Using ADB Shell i tried to manually run the shell scripts and stumbled here:
(I tried chmod 777 @ 02.sh to see if that was the problem, no change is results)
# ls -l
...
...
-rwsr-sr-x shell shell 87 2011-04-06 12:13 03.sh
-rwxrwxrwx shell shell 82 2011-04-06 12:11 02.sh
-rwsr-sr-x shell shell 251 2011-04-06 12:04 01.sh
# pwd
pwd
/data/tmp/shell
# /data/tmp/shell/02.sh
/data/tmp/shell/02.sh
/data/tmp/shell/02.sh: not found

I had the same issue as flybob when I tried to run the script.
Sent from my MB860 using XDA Premium App

Good effort, but 1.57 changes how we have to run commands as root. On a normal linux box, I'm sure your methods would work fine, but we're not dealing with a normal su binary. You should look into doing this as CWM as opposed to .bat files. I had a hell of a time getting around the restrictions since the psneuter exploit was closed.

Ah, I did not think about that Ririal, thanks for the info. I am not familiar with CWM though.
Why is the /tmp directory in /data ? That would certainly cause every script to fail.
I'll look at this some more tonight.

Ririal said:
Good effort, but 1.57 changes how we have to run commands as root. On a normal linux box, I'm sure your methods would work fine, but we're not dealing with a normal su binary. You should look into doing this as CWM as opposed to .bat files. I had a hell of a time getting around the restrictions since the psneuter exploit was closed.
Click to expand...
Click to collapse
How about a shell script that we can run in terminal emulator ? and the output goes to screen and a log file for debug !

molotof said:
How about a shell script that we can run in terminal emulator ? and the output goes to screen and a log file for debug !
Click to expand...
Click to collapse
most of the script is now run by shell scripts, no reason you couldn't run them in the terminal emulator, just get the order right. There are also a few lines I didn't translate to shell so you'd have to enter them by hand.
In any case I'll keep working on this until Sogarth releases his version with union mounts =D

You might be interested to know this;
# cd /tmp
cd /tmp
# pwd
pwd
/data/tmp
# ls -l /tmp
lrwxrwxrwx root root 2011-04-09 14:47 tmp -> /data/tmp
I'll happily help with the script, i know tons of linux and got my Atrix ready to be bricked

flybob said:
You might be interested to know this;
# cd /tmp
cd /tmp
# pwd
pwd
/data/tmp
# ls -l /tmp
lrwxrwxrwx root root 2011-04-09 14:47 tmp -> /data/tmp
I'll happily help with the script, i know tons of linux and got my Atrix ready to be bricked
Click to expand...
Click to collapse
That's just a symlinked directory. I won't make a difference if you call either.

Yes, just replied to the previous question
Why is the /tmp directory in /data ? That would certainly cause every script to fail.
I'll look at this some more tonight.
Click to expand...
Click to collapse
However, why doesn't the scripts run as wanted...?
# cat /tmp/shell/02.sh
cat /tmp/shell/02.sh
#!/bin/sh
/system/bin/su
/bin/rm /data/ubuntu.disk > /dev/null 2>&1 && echo PASS#
# ls -l /tmp/shell/02.sh
ls -l /tmp/shell/02.sh
-rwxrwxrwx shell shell 82 2011-04-06 12:11 02.sh
# /tmp/shell/02.sh
/tmp/shell/02.sh
/tmp/shell/02.sh: not found

flybob said:
Yes, just replied to the previous question
However, why doesn't the scripts run as wanted...?
# cat /tmp/shell/02.sh
cat /tmp/shell/02.sh
#!/bin/sh
/system/bin/su
/bin/rm /data/ubuntu.disk > /dev/null 2>&1 && echo PASS#
# ls -l /tmp/shell/02.sh
ls -l /tmp/shell/02.sh
-rwxrwxrwx shell shell 82 2011-04-06 12:11 02.sh
# /tmp/shell/02.sh
/tmp/shell/02.sh
/tmp/shell/02.sh: not found
Click to expand...
Click to collapse
Ah ok my mistake, you didn't quote anything I didn't realize that's what you were responding too
Likely noexec flag causing that issue.
Also, you can't invoke su from inside a shell script. It just doesn't work with this su binary.

yeah, I guess not. I hadn't realized that it wasn't a real 'su' before making this... too bad.
If anyone figures out how to get around that we'll be in business Unfortunately that's way beyond my expertise.

Okay, after fiddling a little bit and talking to a friend I may have solved some of the problems, mainly with the scripts executing and su working.
I will have to rewrite a bunch of things but should report back tonight.

the2dcour said:
Okay, after fiddling a little bit and talking to a friend I may have solved some of the problems, mainly with the scripts executing and su working.
I will have to rewrite a bunch of things but should report back tonight.
Click to expand...
Click to collapse
su -c "command"
You'll have to allow superuser on the phone for every single command.

PM'd you my error. I tried manually editing the permissions, but that didn't work.

Running on GladAtrix2 v3
USB debugging on; USB set to none
Checking device state...
Obtaining temporary root access...pushing shell scripts
-------------------------
EXECUTION FAILED
Unable to chmod scripts.
-------------------------
Press any key to continue . . .
Changed /sdcard-ext to /sdcard in script. Got this error
Checking device state...
Obtaining temporary root access...pushing shell scripts
-------------------------
EXECUTION FAILED
Unable to chmod scripts.
-------------------------
* server not running *
Press any key to continue . . .
Running BETA_ubuntu-1.0.6.4.zip. File extracts to BETA_ubuntu-1.0.6.2 directory. Ran ubuntu-1.5.7.bat
Moved BETA_ubuntu-1.0.6.2 to C:\ Same error

The only easy workaround to that I can see at the moment is to
Code:
adb shell
su
chmod 777 /path-to-scripts/*
ls -l /path-to-scripts/*
make sure all the files are executable (should say rwxrwxrwx)
then remove the bit of code from 1.5.7.bat
Code:
set retval=
for /f "tokens=*" %%l in ('%~dps0adb.exe shell "/bin/chmod 6755 /mnt/sdcard-ext/shell/* > /dev/null 2>&1 && echo PASS"') do set retval=%%l
if "%retval%" neq "PASS" set message=Unable to chmod scripts. && goto abort
If anyone can help me fix this problem I should be able to automate the chmod process using ririal's suggestion of su -c. The problem is that there are too many nested quotation marks in this section of the batch file, and I can't for the life of me figure out how to escape quotes so they pass through to adb:
Code:
set retval=
for /f "tokens=*" %%l in ('%~dps0adb.exe shell "/system/bin/su -c [U]'/bin/chmod 6755 /mnt/sdcard-ext/shell/*'[/U] > /dev/null 2>&1 && echo PASS"') do set retval=%%l
if "%retval%" neq "PASS" set message=Unable to chmod scripts. && goto abort
The underlined bit is where I need to escape either single or double quotes.

the2dcour said:
The only easy workaround to that I can see at the moment is to
Code:
adb shell
su
chmod 777 /path-to-scripts/*
ls -l /path-to-scripts/*
make sure all the files are executable (should say rwxrwxrwx)
then remove the bit of code from 1.5.7.bat
Code:
set retval=
for /f "tokens=*" %%l in ('%~dps0adb.exe shell "/bin/chmod 6755 /mnt/sdcard-ext/shell/* > /dev/null 2>&1 && echo PASS"') do set retval=%%l
if "%retval%" neq "PASS" set message=Unable to chmod scripts. && goto abort
If anyone can help me fix this problem I should be able to automate the chmod process using ririal's suggestion of su -c. The problem is that there are too many nested quotation marks in this section of the batch file, and I can't for the life of me figure out how to escape quotes so they pass through to adb:
Code:
set retval=
for /f "tokens=*" %%l in ('%~dps0adb.exe shell "/system/bin/su -c [U]'/bin/chmod 6755 /mnt/sdcard-ext/shell/*'[/U] > /dev/null 2>&1 && echo PASS"') do set retval=%%l
if "%retval%" neq "PASS" set message=Unable to chmod scripts. && goto abort
The underlined bit is where I need to escape either single or double quotes.
Click to expand...
Click to collapse
^ escapes batch, \ escapes shell. Hope this helps. If you zip up and send me the whole process in a single .sh file I can wrap it up in CWM for you.

How To Guide How to backup the data from the phone using rsync and ssh (including some hints for using sshd on an Android phone)

How to backup the data from the phone using rsync and ssh (including some hints for using sshd on an Android phone)
Like for all computer it's important to have a backup of the data on the phone.
For those who like me don't like to store their private data in one of the suspicious clouds there is a solution with standard Linux tools:
Use rsync and ssh to backup the data from the phone to your local workstation (see the man page for rsync for details regarding rsync and why it is useful for this task)
The neccessary tools for Android for this method can be installed with the Magisk Module MagiskSSH.
Download the Magisk Module with MagiskSSH from here
https://gitlab.com/d4rcm4rc/MagiskSSH_releases
Copy the ZIP file with the Magisk Module to the phone :
Code:
adb push magisk_ssh_v0.14.zip /sdcard/Download/
and install it via the module installation from within the Magisk App or manuell using :
Code:
adb shell su - -c /data/adb/magisk/magisk64 --install-module /sdcard/Download/magisk_ssh_v0.14.zip
Sample output of the installation:
Code:
ASUS_I006D:/ # /data/adb/magisk/magisk64 --install-module /sdcard/Download/magisk_ssh_v0.14.zip
- Current boot slot: _a
- Device is system-as-root
*******************************
OpenSSH for Android
*******************************
[0/7] Preparing module directory
[1/7] Extracting architecture unspecific module files
[2/7] Extracting libraries and binaries for arm64
[3/7] Configuring library path wrapper
[4/7] Recreating symlinks
[5/7] Creating SSH user directories
[6/7] Found sshd_config, will not copy a default one
[7/7] Cleaning up
- Setting permissions
- Done
ASUS_I006D:/ #
A reboot is required now.
Code:
adb shell reboot
For the next tasks open an adb shell and become root user.
Next create the authorized_keys file for the user root :
Code:
touch /data/ssh/root/.ssh/authorized_keys
chmod 600 /data/ssh/root/.ssh/authorized_keys
and add your public ssh key to the file /data/ssh/root/.ssh/authorized_keys.
To make sure that the keys and other data files for the MagiskSSH module are not removed while deinstalling the module you should create the file /data/ssh/KEEP_ON_UNINSTALL:
Code:
touch /data/ssh/KEEP_ON_UNINSTALL
The MagiskSSH module also installs a service to start sshd after each reboot: to disable this start create the file /data/ssh/no-autostart:
Code:
touch /data/ssh/no-autostart
To manually start or stop the sshd use the script /data/adb/modules/ssh/opensshd.init :
Code:
# start the sshd (as user root)
#
/data/adb/modules/ssh/opensshd.init start
# to stop the sshd (as user root)
#
/data/adb/modules/ssh/opensshd.init stop
Now test the access via ssh from your Linux workstation:
Code:
ssh -l root <phone_ip_address> id
Use this command to retrieve the current IP address of the phone:
Code:
PHONE_IP_ADDRESS=$( adb shell ifconfig wlan0 | grep "inet addr:" | sed -e "s/.*inet addr://g" -e "s/[[:space:]]*Bcast.*//g" )
example :
Code:
[[email protected] ~]$ ssh -l root ${PHONE_IP_ADDRESS} id
uid=0(root) gid=0(root) groups=0(root) context=u:r:magisk:s0
[[email protected] ~]$
Now you can use rsync to backup the data from the phone, e.g. to backup the photos from the phone do :
Code:
# on your local Linux workstation do:
# start the sshd on the phone via adb if not already running
#
adb shell su - -c /data/adb/modules/ssh/opensshd.init start
# retrieve the current IP address from the phone
#
PHONE_IP_ADDRESS=$( adb shell ifconfig wlan0 | grep "inet addr:" | sed -e "s/.*inet addr://g" -e "s/[[:space:]]*Bcast.*//g" )
# backup the new photos from the phone to the Linux workstation (rsync only copies new files from the phone)
# to the local directory /data/backup/ASUS_ZENFONE8/DCIM
#
rsync -av --rsync-path /data/adb/modules/ssh/usr/bin/rsync [email protected]${PHONE_IP_ADDRESS}:/sdcard/DCIM/ /data/backup/ASUS_ZENFONE8/DCIM
# optional stop the sshd on the phone via adb
#
adb shell su - -c /data/adb/modules/ssh/opensshd.init stop
Note: The sshd configuration file used is /data/ssh/sshd_config
Sample Script to backup all data in the directory /sdcard
Code:
##!/bin/bash
#
# simple script to backup the data of an phone using adb, ssh, and rsync
#
# History
# 27.06.2022 /bs
# initial release
#
# for testing
#
#RSYNC_OPTIONS="${RSYNC_OPTIONS} --dry-run"
RSYNC_OPTIONS="${RSYNC_OPTIONS} --del "
# default is to backup the phone connected via adb over LAN
#
[ $# -ne 0 ] && ADB_OPTIONS="$*" || ADB_OPTIONS="-e"
# retrieve the serial number of the attached phone
#
SERIAL_NO="$( adb ${ADB_OPTIONS} shell getprop ro.serialno )"
if [ "${SERIAL_NO}"x = ""x ] ; then
echo "ERROR: Can not read the serial number of the connected phone"
exit 89
fi
VENDOR_MODEL="$( adb ${ADB_OPTIONS} shell getprop ro.product.vendor.model )"
# directory for the backup
#
BACKUP_DIR="/data/backup/ASUS_ZENFONE8/data_backup/${VENDOR_MODEL}_${SERIAL_NO}"
if [ ! -d "${BACKUP_DIR}" ] ; then
echo "ERROR: The directory \"${BACKUP_DIR}\" does not exist"
exit 99
fi
PHONE_IP_ADDRESS="$( adb ${ADB_OPTIONS} shell ifconfig wlan0 | grep "inet addr:" | sed -e "s/.*inet addr://g" -e "s/[[:space:]]*Bcast.*//g" )"
if [ "${PHONE_IP_ADDRESS}"x = ""x ] ; then
echo "ERROR: Can not detect the IP address of the phone"
exit 100
fi
echo "Updating a backup of the data on the phone with the serial number \"${SERIAL_NO}\" and the IP \"${PHONE_IP_ADDRESS}\" to the directory \"${BACKUP_DIR}\" ..."
set -x
# start the sshd if neccessary
#
adb ${ADB_OPTIONS} shell su - -c /data/adb/modules/ssh/opensshd.init start
# do the backup
#
time rsync ${RSYNC_OPTIONS} -av --rsync-path /data/adb/modules/ssh/usr/bin/rsync [email protected]${PHONE_IP_ADDRESS}:/sdcard/ "${BACKUP_DIR}/"
# stop the sshd
#
adb ${ADB_OPTIONS} shell su - -c /data/adb/modules/ssh/opensshd.init stop
set +x
How to enable access via ssh for non-root user
In the standard configuration installed by MagiskSSH ssh access is only allowed as user root because the ssh keys are in the directory /data and all non-root user can not read files in the directory /data. Therefor some efforts are neccessary to add ssh access for non-root user.
e.g. To enable the ssh access for the user shell do:
To configure ssh access for the user shell we must create a .ssh directory for the user shell in a directory tree owned by the user shell. The only directory on the phone owned by the user shell that can be used for this purpose is /storage :
Code:
ASUS_I006D:/ # ls -ld /storage
drwx--x--- 4 shell everybody 80 2022-06-26 18:37 /storage
ASUS_I006D:/ #
But unfortunately all files and directories in this directory are temporary and will be deleted after a reboot of the phone.
Therefor we configure a startup script in Magisk to create this directory tree after each reboot, e.g.
/data/adb/service.d/create_ssh_dir_for_shell.sh:
Code:
# /data/adb/service.d/create_ssh_dir_for_shell.sh
#
mkdir -p /storage/shell/.ssh
chmod -R 700 /storage/shell/
touch /storage/shell/.ssh/authorized_keys
echo "<ssh_public_key>" > /storage/shell/.ssh/authorized_keys
chmod 600 /storage/shell/.ssh/authorized_keys
chown -R shell:shell /storage/shell
Make the script executable:
Code:
su - -c chmod +x data/adb/service.d/create_ssh_dir_for_shell.sh
To test the script just execute it one time manually as user root.
Code:
su - -c sh data/adb/service.d/create_ssh_dir_for_shell.sh
Now create a backup of the sshd config file
Code:
su - -c cp /data/ssh/sshd_config /storage/ssh/sshd_config.org.$$
and add these lines at the end of the file /data/ssh/sshd_config
Code:
Match User shell
AuthorizedKeysFile /storage/shell/.ssh/authorized_keys
Restart the sshd if it's already running
Now test the access as user shell, example:
Code:
[[email protected] ~]$ ssh -l shell 192.168.1.148 id
uid=2000(shell) gid=2000(shell) groups=2000(shell) context=u:r:magisk:s0
[[email protected] ~]$
The reason for this config is the setting "StrictMode yes" in the sshd config file /data/ssh/sshd_config (see the man page for sshd_config for details). So another "solution" is to change this setting:
With the setting "StrictModes no" in the file sshd_config the directory with the authorized_keys file for the non-root users can be anywhere (for example in /sdcard/shell)
Execute as user root:
Code:
sed -i -e "s/.*StrictModes.*//g" -e "s/UsePrivilegeSeparation/StrictModes no\nUsePrivilegeSeparation/g" /data/ssh/sshd_config
and change the entry in the file /data/ssh/sshd_config for the authorized_keys file for the user shell, for example:
Code:
Match User shell
AuthorizedKeysFile /sdcard/shell/.ssh/authorized_keys
Afterwards restart the sshd:
Code:
/data/adb/modules/ssh/opensshd.init stop
/data/adb/modules/ssh/opensshd.init start
Now create the directories and files neccessary for the ssh access (see above) in the directory /sdcard/shell:
Code:
SUS_I006D:/ # find /sdcard/shell -exec ls -ld {} \;
drwxrws--- 3 u0_a118 media_rw 3452 2022-06-26 18:32 /sdcard/shell
drwxrws--- 2 u0_a118 media_rw 3452 2022-06-26 18:32 /sdcard/shell/.ssh
-rw-rw---- 1 u0_a118 media_rw 408 2022-06-26 18:32 /sdcard/shell/.ssh/authorized_keys
ASUS_I006D:/ #
and the access as user shell via ssh should work

How To Guide How to temporary change a file on a read-only filesystem in the Android OS

I've mentioned this elsewhere in some of my howtos, but I think this feature is important and useful enough to get its own howto.
Nowadays in the current Android OS version a lot filesystems are mounted read-only and remounting the filesystem read-write does not work anymore. Therefor the files in these filesystems can not be changed anymore.
That's pretty good from a safety standpoint, but sometimes a real showstopper.
But fortunately Android is a Linux based system and therefor there is a solution for this problem called bind mounts. bind mounts are some kind of symbolic links that only exist in memory and are therefor also supported for read-only mounted filesystems. Of course, this is a very simple description for this Linux feature but it should be enough here -- for more in depth details I recommend the Linux documentation.
bind mounts are used by Magisk but they can also be used manually without an installed Magisk - the only requirement for using it manually is root access to the phone.
Here is an example to replace the file /system/etc/hosts with a writable file using a bind mount:
Spoiler: replace the file /system/etc/hosts with a changed version of the file
Code:
#
# use a filesystem that supports all necessary permissions and attributes for the new file
#
# Therefor files in /sdcard/<something> can not be used to replace most of the files in the read-only filesystems
#
# Make sure that the file used to replace the other file is readable by all user that can also read the original file
#
ASUS_I006D:/ # cp -a /system/etc/hosts /data/local/tmp/my_hosts
ASUS_I006D:/ #
# add some additional data to the new file
#
ASUS_I006D:/ # echo "127.0.0.1 www.heise.de" >>/data/local/tmp/my_hosts
ASUS_I006D:/ #
# check the result
#
ASUS_I006D:/ # cat /data/local/tmp/my_hosts
127.0.0.1 localhost
::1 ip6-localhost
127.0.0.1 www.heise.de
ASUS_I006D:/ #
ASUS_I006D:/ # ls -l /system/etc/hosts /data/local/tmp/my_hosts
-rw-r--r-- 1 root root 80 2023-06-11 14:57 /data/local/tmp/my_hosts
-rw-r--r-- 1 root root 56 2009-01-01 01:00 /system/etc/hosts
ASUS_I006D:/ #
# "replace" the file /system/etc/hosts now
#
ASUS_I006D:/ # su - -c mount -o bind /data/local/tmp/my_hosts /system/etc/hosts
ASUS_I006D:/ #
# check the results
#
ASUS_I006D:/ # cat /system/etc/hosts
127.0.0.1 localhost
::1 ip6-localhost
127.0.0.1 www.heise.de
ASUS_I006D:/ #
# add some more data to the file
#
ASUS_I006D:/ # echo "127.0.0.1 www.spiegle.de" >>/system/etc/hosts
ASUS_I006D:/ #
# check the result
#
ASUS_I006D:/ # cat /system/etc/hosts
127.0.0.1 localhost
::1 ip6-localhost
127.0.0.1 www.heise.de
127.0.0.1 www.spiegle.de
ASUS_I006D:/ #
bind mounts are only possible for existing files - bind mounts for non-existent files will fail, e.g:
Spoiler: Example for a bind mount for an non-existent file
Code:
ASUS_I006D:/ $ ls /system/bin/bash
ls: /system/bin/bash: No such file or directory
1|ASUS_I006D:/ $
1|ASUS_I006D:/ $ su - -c mount -o bind /system/bin/sh /system/bin/bash
mount: '/system/bin/sh'->'/system/bin/bash': No such file or directory
1|ASUS_I006D:/ $
bind mounts are also allowed for directories therefor to "create" a new file just copy the directory, create the new file in that new directory, and then do a bind mount for the existing directory.
Example:
Spoiler: create the executable bash by copying the executable sh
Code:
#
# "create" the executable "bash" by copying the executable "sh"
#
# This is only an example that should work on every phone! In real life you should copy a real bash executable to the new directory
#
#
# check for a bash executable in the PATH
#
ASUS_I006D:/ $ which bash
1|ASUS_I006D:/ $
# -> bash does currently not exist on the phone
# create a new directory to be used for the bind mount /system/xbin
#
# Note that this directory must be on a filesystem supporting the standard linux file permissions therefor a directory in /sdcard/<something> is not possible here
# And again the directory used must be readable by all uesrs.
#
ASUS_I006D:/ $ mkdir /data/local/tmp/xbin
ASUS_I006D:/ $
# copy all files from /system/xbin to the new directory
#
ASUS_I006D:/ $ su - -c cp -a -r /system/xbin/* /data/local/tmp/xbin
ASUS_I006D:/ $
ASUS_I006D:/ $ ls -l /data/local/tmp/xbin
total 1772
lrwxrwxrwx 1 root shell 3 2009-01-01 01:00 vi -> vim
-rwxr-xr-x 1 root shell 1813848 2009-01-01 01:00 vim
ASUS_I006D:/ $
# create fake "bash" executable in the new directory
#
ASUS_I006D:/ $ cp /system/bin/sh /data/local/tmp/xbin/bash
ASUS_I006D:/ $
ASUS_I006D:/ $ ls -l /data/local/tmp/xbin
total 2080
-rwxr-xr-x 1 shell shell 312024 2023-06-11 13:56 bash
lrwxrwxrwx 1 root shell 3 2009-01-01 01:00 vi -> vim
-rwxr-xr-x 1 root shell 1813848 2009-01-01 01:00 vim
ASUS_I006D:/ $
# bind mount the directory /system/xbin on the new directory
#
ASUS_I006D:/ $ su - -c mount -o bind /data/local/tmp/xbin /system/xbin
ASUS_I006D:/ $
# and now there is "bash" executable in /system/xbin available
#
ASUS_I006D:/ $ ls -l /system/xbin
total 2080
-rwxr-xr-x 1 shell shell 312024 2023-06-11 13:56 bash
lrwxrwxrwx 1 root shell 3 2009-01-01 01:00 vi -> vim
-rwxr-xr-x 1 root shell 1813848 2009-01-01 01:00 vim
ASUS_I006D:/ $ which bash
/system/xbin/bash
# You can now even copy additional files to the bind mounted directory, e.g.:
ASUS_I006D:/ $ cp /sdcard/Download/zip /system/xbin
ASUS_I006D:/ $
ASUS_I006D:/ $ chmod 755 /system/xbin/zip
ASUS_I006D:/ $
ASUS_I006D:/ $ ls -ltr /system/xbin
total 2576
-rwxr-xr-x 1 root shell 1813848 2009-01-01 01:00 vim
lrwxrwxrwx 1 root shell 3 2009-01-01 01:00 vi -> vim
-rwxr-xr-x 1 shell shell 312024 2023-06-11 13:56 bash
-rwxr-xr-x 1 shell shell 503992 2023-06-11 14:03 zip
ASUS_I006D:/ $
ASUS_I006D:/ $ zip -h
Copyright (c) 1990-2008 Info-ZIP - Type 'zip "-L"' for software license.
Zip 3.0 (July 5th 2008). Usage:
zip [-options] [-b path] [-t mmddyyyy] [-n suffixes] [zipfile list] [-xi list]
The default action is to add or replace zipfile entries from list, which
can include the special name - to compress standard input.
If zipfile and list are omitted, zip compresses stdin to stdout.
-f freshen: only changed files -u update: only changed or new files
-d delete entries in zipfile -m move into zipfile (delete OS files)
-r recurse into directories -j junk (don't record) directory names
-0 store only -l convert LF to CR LF (-ll CR LF to LF)
-1 compress faster -9 compress better
-q quiet operation -v verbose operation/print version info
-c add one-line comments -z add zipfile comment
[email protected] read names from stdin -o make zipfile as old as latest entry
-x exclude the following names -i include only the following names
-F fix zipfile (-FF try harder) -D do not add directory entries
-A adjust self-extracting exe -J junk zipfile prefix (unzipsfx)
-T test zipfile integrity -X eXclude eXtra file attributes
-y store symbolic links as the link instead of the referenced file
-e encrypt -n don't compress these suffixes
-h2 show more help
Hints
bind mounts are supported by the filesystems ext4, vfat, f2fs. and most probably a lot of other filesystems used on machines running Android.
Be careful when replacing executables, especially when replacing an important file like /system/bin/sh. And you should never replace a file that is just a symbolic link for toybox or busybox.
bind mounts created while the OS is running are only useful for files that are dynamically read by the OS. It does not make sense to replace for example one of the *.rc files using a bind mount because these files are only read once while booting the OS.
The filesystems used for source and target for a bind mount should support the same set of attributes and permissions or the result may not be like expected. E.g. you can not bind mount an executable with a file in the directory /sdcard/<something> because that filesystem for /sdcard does not support the executable permission:
Spoiler: Example for bind mount an executable in /sdcard/Download
Code:
ASUS_I006D:/ $ ls -l /bin/ziptool
-rwxr-xr-x 1 root shell 28688 2009-01-01 01:00 /bin/ziptool
ASUS_I006D:/ $
ASUS_I006D:/ $ cp -a /bin/ziptool /sdcard/Download/
ASUS_I006D:/ $
ASUS_I006D:/ $ chmod 755 /sdcard/Download/ziptool
ASUS_I006D:/ $
ASUS_I006D:/ $ ls -l /bin/ziptool /sdcard/Download/ziptool
-rwxr-xr-x 1 root shell 28688 2009-01-01 01:00 /bin/ziptool
-rw-rw---- 1 u0_a121 media_rw 28688 2023-06-11 18:09 /sdcard/Download/ziptool
ASUS_I006D:/ $
ASUS_I006D:/ $ su - -c mount -o bind /sdcard/Download/ziptool /bin/ziptool
ASUS_I006D:/ $
ASUS_I006D:/ $ ziptool
/system/bin/sh: ziptool: can't execute: Permission denied
126|ASUS_I006D:/ $ /bin/ziptool
/system/bin/sh: /bin/ziptool: can't execute: Permission denied
126|ASUS_I006D:/ $ ls -l /bin/ziptool
-rw-rw---- 1 u0_a121 media_rw 28688 2023-06-11 18:09 /bin/ziptool
ASUS_I006D:/ $
The source for the bind mount must be in a directory that is readable for all user that use the bind mounted file, e.g.
Spoiler: Example for bind mount an executable in a directory not accessable by all user
Code:
ASUS_I006D:/ $ su - -c cp -a /bin/ziptool /data/adb/ziptool
ASUS_I006D:/ $
ASUS_I006D:/ $ su - -c ls -l /data/adb/ziptool
-rwxr-xr-x 1 root shell 28688 2009-01-01 01:00 /data/adb/ziptool
ASUS_I006D:/ $
ASUS_I006D:/ $ su - -c mount -o bind /data/adb/ziptool /bin/ziptool
ASUS_I006D:/ $
ASUS_I006D:/ $ ziptool
/system/bin/sh: ziptool: inaccessible or not found
127|ASUS_I006D:/ $
127|ASUS_I006D:/ $ file /bin/ziptool
/bin/ziptool: cannot open: Permission denied
ASUS_I006D:/ $
Use the mount command to check if a file is bind mounted. e.g.
Spoiler: Check if a file is bind mounted
Code:
|ASUS_I006D:/ # mount | grep /system/etc/hosts
1|ASUS_I006D:/ #
1|ASUS_I006D:/ # mount -o bind /data/local/tmp/hosts /system/etc/hosts
ASUS_I006D:/ #
ASUS_I006D:/ # mount | grep /system/etc/hosts
/dev/block/dm-33 on /system/etc/hosts type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,fsync_mode=nobarrier)
ASUS_I006D:/ #
To remove a bind mount just do a umount, e.g:
Spoiler: Example for remove a bind mount
Code:
#
# remove the bind mount
#
ASUS_I006D:/ $ su - -c umount /bin/ziptool
ASUS_I006D:/ $
ASUS_I006D:/ $ which ziptool
/system/bin/ziptool
ASUS_I006D:/ $ ziptool
ziptool: run as ziptool with unzip or zipinfo as the first argument, or symlink
1|ASUS_I006D:/ $
Another method to remove all bind mounts is a reboot of the phone
It's recommended to use a sub directory in the directory /data/local/tmp for executables used in bind mounts, example:
Spoiler: Example for bind mount an executable in /data/local/tmp/
Code:
ASUS_I006D:/ $ mkdir /data/local/tmp/bind_mounts
ASUS_I006D:/ $
ASUS_I006D:/ $ cp -a /bin/ziptool /data/local/tmp/bind_mounts
ASUS_I006D:/ $
ASUS_I006D:/ $ ls -l /data/local/tmp/bind_mounts/ziptool
-rwxr-xr-x 1 shell shell 28688 2009-01-01 01:00 /data/local/tmp/bind_mounts/ziptool
ASUS_I006D:/ $
ASUS_I006D:/ $ su - -c mount -o bind /data/local/tmp/bind_mounts/ziptool /bin/ziptool
ASUS_I006D:/ $
ASUS_I006D:/ $ ziptool
ziptool: run as ziptool with unzip or zipinfo as the first argument, or symlink
1|ASUS_I006D:/ $
bind mounts are also useful for writable files to be able to revert the changes to a file. Example:
Spoiler: Example for using bind mount for a writable file
Code:
ASUS_I006D:/ $ cat /data/local/tmp/testfile.txt
This is a test file
ASUS_I006D:/ $
#
# create a copy of the writable file
#
ASUS_I006D:/ $ cat /data/local/tmp/testfile_for_tests.txt
This is another test file
#
# bind mount the file with the copy of the file
#
ASUS_I006D:/ $ su - -c mount -o bind /data/local/tmp/testfile_for_tests.txt /data/local/tmp/testfile.txt
ASUS_I006D:/ $
#
# check the result
#
ASUS_I006D:/ $ cat /data/local/tmp/testfile.txt
This is another test file
ASUS_I006D:/ $
#
# add some data to the bind mounted file now
#
ASUS_I006D:/ $ echo "This text will not change the original file" >> /data/local/tmp/testfile.txt
ASUS_I006D:/ $
ASUS_I006D:/ $ cat /data/local/tmp/testfile.txt
This is another test file
This text will not change the original file
ASUS_I006D:/ $
#
# remove the bind mount to restore the original file contents
#
ASUS_I006D:/ $ su - -c umount /data/local/tmp/testfile.txt
ASUS_I006D:/ $
ASUS_I006D:/ $ cat /data/local/tmp/testfile.txt
This is a test file
ASUS_I006D:/ $
Of course, this can also be done by creating a backup copy of the file and restoring the backup copy if necessary. But if the changes to the file make the phone unusable or cause it to crash, it is more difficult to restore the file. If you use a bind mount, the file will be restored "automatically" at the next reboot.
Notes
see the forum entry How to upgrade the OS with another Android "distribution" for an example usage for this method
See the forum entry How To change any file or directory using Magisk for how to use this method in Magisk module for persisent changes
See the forum entry How to make files in /system writable for another exampe how to use this feature in Magisk
Up to version 25.x of Magisk (at least in Magisk v24.x and v25.x) Magisk mounted the /system/bin directory read-write, so that temporary changes for the files in /system/bin were possible. But because of the more or less not existent free space in the filesystem used for /system the use of this feature was very limited. And this feature does not exist in Magisk v26.x or newer anymore.
(see also this forum message: https://forum.xda-developers.com/t/magisk-general-support-discussion.3432382/page-2815#post-88617909 )