[R&D] Locked Root Research - Asus Transformer TF701

Trying to find a way to get root without having to unlock the bootloader on the newest update: Android 4.3
- Tried Cydia Impactor ( http://www.cydiaimpactor.com ) and was only able to gain a system user shell. All other options failed with a Link error. Was able to copy su to the /ADF folder (which doesnt have nosuid option) but dont have an obvious way to get it suid to Root.

Are they enforcing selinux on their 4.3 builds? Run this from the command line:
Code:
getenforce

dasunsrule32 said:
Are they enforcing selinux on their 4.3 builds? Run this from the command line:
Code:
getenforce
Click to expand...
Click to collapse
Result is:
Code:
Permissive

Same
dasunsrule32 said:
Are they enforcing selinux on their 4.3 builds? Run this from the command line:
Code:
getenforce
Click to expand...
Click to collapse
"Permissive"

Related

[Q] Stock su binary present, uid not allowed to su

Hello,
On my Teclast P90HD running Kitkat 4.4.2, I found a /system/xbin/su binary while connected through adb. However, the su command in Terminal emulator gives :
uid 10107 not allowed to su
I guess it has to do with SELinux. After setenforce = 0 and reboot, getenforce returns 'Disabled', yet no change in Terminal Emulator.
Installing SuperSU apk from Play Store obviously fails, and I can't get it to boot in recovery to try flashing UPDATE-SuperSU-v2.46.zip.
Is there anything I can do to get that su file helpful ?
Thanks.
Hi, did you find any solution here ?
I'm in the same situation, what looks to be a solution is to recompile su.c removing the AID_ROOT / AID_SHELL related part.

How to change SELinuxMode to permissive in OP3T?

My OP3T is rooted running currently on OOS 4.0.
I'm unable to find etc/selinux/config folder in OP3T. Hence couldn't set the SELinuxMode to permissive.
Any help is appreciated
gopinath_shiva said:
My OP3T is rooted running currently on OOS 4.0.
I'm unable to find etc/selinux/config folder in OP3T. Hence couldn't set the SELinuxMode to permissive.
Any help is appreciated
Click to expand...
Click to collapse
https://forum.xda-developers.com/showthread.php?t=2524485
or via Terminal:
su
mount -o remount,rw /system
mkdir /system/su.d
echo "#!/system/bin/sh" > /system/su.d/permissive.sh
echo "setenforce 0" > /system/su.d/permissive.sh
echo "0" > /sys/fs/selinux/enforce
chmod 755 /system/su.d/permissive.sh
Fir3start3r said:
https://forum.xda-developers.com/showthread.php?t=2524485
or via Terminal:
su
mount -o remount,rw /system
mkdir /system/su.d
echo "#!/system/bin/sh" > /system/su.d/permissive.sh
echo "setenforce 0" > /system/su.d/permissive.sh
echo "0" > /sys/fs/selinux/enforce
chmod 755 /system/su.d/permissive.sh
Click to expand...
Click to collapse
please note that that will trigger dm-verity (if it isn't disabled already) and safetynet.
Usually when I see this question here, it's someone trying to run ViPER4Android.
If so, all you need to do is create a file like "viper4android.sh" with this inside:
Code:
#! /system/bin/sh
supolicy --live "allow audioserver audioserver_tmpfs:file { read write execute };"
Put it in /su/su.d and set the permission on that file to 0700. This will allow it to run without having to set the kernel to permissive.
Spasticdroid said:
Usually when I see this question here, it's someone trying to run ViPER4Android.
If so, all you need to do is create a file like "viper4android.sh" with this inside:
Code:
#! /system/bin/sh
supolicy --live "allow mediaserver mediaserver_tmpfs:file { read write execute };"
Put it in /su/su.d and set the permission on that file to 0700. This will allow it to run without having to set the kernel to permissive.
Click to expand...
Click to collapse
Yes you're right. I'm doing this due to issue with V4A. The thing is I am unable to install Viper Audio driver. Whenever I tried to install, I am receiving an error like "driver install failed i/o error".
I found the one of the fix to above is setting SELinuxMode to permissive. Though I tried setting SELinuxMode to permissive through terminal via setenforce 0 , its not working either.
gopinath_shiva said:
Yes you're right. I'm doing this due to issue with V4A. The thing is I am unable to install Viper Audio driver. Whenever I tried to install, I am receiving an error like "driver install failed i/o error".
I found the one of the fix to above is setting SELinuxMode to permissive. Though I tried setting SELinuxMode to permissive through terminal via setenforce 0 , its not working either.
Click to expand...
Click to collapse
http://www.theandroidsoul.com/install-viper4android-nougat/ use this tut. (SELinuxMode = permissive -> not needed)
Fir3start3r said:
http://www.theandroidsoul.com/install-viper4android-nougat/ use this tut. (SELinuxMode = permissive -> not needed)
Click to expand...
Click to collapse
Thanks to the link. I followed the tutorial. Now i got error says busybox installation found on your device doesn't work. Any thoughts
gopinath_shiva said:
Thanks to the link. I followed the tutorial. Now i got error says busybox installation found on your device doesn't work. Any thoughts
Click to expand...
Click to collapse
Flash SuperSU (2.79...) again and download Busybox from Playstore -> open the app and press install
gopinath_shiva said:
Thanks to the link. I followed the tutorial. Now i got error says busybox installation found on your device doesn't work. Any thoughts
Click to expand...
Click to collapse
If the variant of Busybox from the Play Store doesn't work, try the one by @@osm0sis here named Busybox Installer. His version has never given me any problems whatsoever on the devices I used it with, which is the Moto X Pure on Marshmallow and the OnePlus 3T on Nougat.
I've updated my original post on the su.d script. It turns out that the entry is a bit different for this phone. The correct one to use is:
Code:
#! /system/bin/sh
supolicy --live "allow audioserver audioserver_tmpfs:file { read write execute };"
You'll also might have to use FX Compatible Mode to "Compatible" in V4A, otherwise it won't always work as it should.

Question : "magisk hide unable to watch hidelist" any way to fix?

i use oneplus 3 with OxygenOs 3.5.5 when i use the rom (stock) and install magisk and enable magisk hide it hides root and safetynet succeed and it unmounts
But when i start from the beginning on the stock rom and install RR on the rom (customrom) and full unroot and reinstall magisk and enable magisk hide and reboot i get this in the log and it doesn't unmount :
HTML:
MagiskHide: starting MagiskHide Daemon
MagiskHide: Unable to watch /magisk/.core/magiskhide/hidelist
any help please to get it to unmount and hide root ?
to know after i installed RR and full unrooted safetynet passed
ahmedsasker said:
i use oneplus 3 with OxygenOs 3.5.5 when i use the rom (stock) and install magisk and enable magisk hide it hides root and safetynet succeed and it unmounts
But when i start from the beginning on the stock rom and install RR on the rom (customrom) and full unroot and reinstall magisk and enable magisk hide and reboot i get this in the log and it doesn't unmount :
HTML:
MagiskHide: starting MagiskHide Daemon
MagiskHide: Unable to watch /magisk/.core/magiskhide/hidelist
any help please to get it to unmount and hide root ?
to know after i installed RR and full unrooted safetynet passed
Click to expand...
Click to collapse
Run the following commands in a terminal emulator:
Code:
su
cd /magisk/.core/magiskhide
sh disable
sh enable
You're probably gonna get an output that the hidelist can't be created because of a permissions issue. That probably means the Magisk image doesn't get mounted properly at boot.
Another user (@gunner007dc) that had this issue fixed it by using a different kernel.
Didgeridoohan said:
Run the following commands in a terminal emulator:
Code:
su
cd /magisk/.core/magiskhide
sh disable
sh enable
You're probably gonna get an output that the hidelist can't be created because of a permissions issue. That probably means the Magisk image doesn't get mounted properly at boot.
Another user (@gunner007dc) that had this issue fixed it by using a different kernel.
Click to expand...
Click to collapse
that is what i get and safetynet doesn't pass still ..
Code:
[email protected]:/magisk/.core/magiskhide # sh disable
MagiskHide: Stopping MagiskHide daemon
disable[27]: can't open /magisk/.core/magiskhide/hidelist: No such file or directory
1|[email protected]:/magisk/.core/magiskhide # sh enable
MagiskHide: Removing dangerous read-only system props
touch: '/magisk/.core/magiskhide/hidelist': Read-only file system
chmod: chmod '/magisk/.core/magiskhide' to 40755: Read-only file system
chmod: chmod 'rm' to 100755: Read-only file system
chmod: chmod 'list' to 100755: Read-only file system
chmod: chmod 'enable' to 100755: Read-only file system
chmod: chmod 'disable' to 100755: Read-only file system
chmod: chmod 'add' to 100755: Read-only file system
grep: /magisk/.core/magiskhide/hidelist: Bad file descriptor/magisk/.core/magiskhide/add[14]: [: 0: unexpected operator/operand
enable[65]: can't open /magisk/.core/magiskhide/hidelist: No such file or directory
MagiskHide: Starting MagiskHide daemon
to know without the magisk and have root removed with the custom rom the safetynet passes so what is wrong ?
if magisk doesn't get mounted properly how could i fix that ?
i tried to install another karnel whick support systemless root and i got bootloop maybe cuz of the custom rom RR so i can't install another karnel while the one i tried the only one i saw that support systemless root
please anyway to make magisk work ? (i tried the two versions under 12.0 too)
ahmedsasker said:
that is what i get and safetynet doesn't pass still ..
Code:
[email protected]:/magisk/.core/magiskhide # sh disable
MagiskHide: Stopping MagiskHide daemon
disable[27]: can't open /magisk/.core/magiskhide/hidelist: No such file or directory
1|[email protected]:/magisk/.core/magiskhide # sh enable
MagiskHide: Removing dangerous read-only system props
touch: '/magisk/.core/magiskhide/hidelist': Read-only file system
chmod: chmod '/magisk/.core/magiskhide' to 40755: Read-only file system
chmod: chmod 'rm' to 100755: Read-only file system
chmod: chmod 'list' to 100755: Read-only file system
chmod: chmod 'enable' to 100755: Read-only file system
chmod: chmod 'disable' to 100755: Read-only file system
chmod: chmod 'add' to 100755: Read-only file system
grep: /magisk/.core/magiskhide/hidelist: Bad file descriptor/magisk/.core/magiskhide/add[14]: [: 0: unexpected operator/operand
enable[65]: can't open /magisk/.core/magiskhide/hidelist: No such file or directory
MagiskHide: Starting MagiskHide daemon
to know without the magisk and have root removed with the custom rom the safetynet passes so what is wrong ?
if magisk doesn't get mounted properly how could i fix that ?
i tried to install another karnel whick support systemless root and i got bootloop maybe cuz of the custom rom RR so i can't install another karnel while the one i tried the only one i saw that support systemless root
please anyway to make magisk work ? (i tried the two versions under 12.0 too)
Click to expand...
Click to collapse
Looks like what for a strange reason /magisk is mounted as read-only. Try mount as rw:
Code:
mount -w -o remount /magisk
Deic said:
Looks like what for a strange reason /magisk is mounted as read-only. Try mount as rw:
Code:
mount -w -o remount /magisk
Click to expand...
Click to collapse
Code:
[email protected]:/ $ su
[email protected]:/ # mount -w -o remount /magisk
[email protected]:/ # cd /magisk/.core/magiskhide
[email protected]:/magisk/.core/magiskhide # she disable
sh: she: not found
127|[email protected]:/magisk/.core/magiskhide # sh disable
MagiskHide: Stopping MagiskHide daemon
disable[27]: can't open /magisk/.core/magiskhide/hidelist: No such file or directory
1|[email protected]:/magisk/.core/magiskhide # sh enable
MagiskHide: Removing dangerous read-only system props
touch: '/magisk/.core/magiskhide/hidelist': Read-only file system
chmod: chmod '/magisk/.core/magiskhide' to 40755: Read-only file system
chmod: chmod 'rm' to 100755: Read-only file system
chmod: chmod 'list' to 100755: Read-only file system
chmod: chmod 'enable' to 100755: Read-only file system
chmod: chmod 'disable' to 100755: Read-only file system
chmod: chmod 'add' to 100755: Read-only file system
grep: /magisk/.core/magiskhide/hidelist: Bad file descriptor/magisk/.core/magiskhide/add[14]: [: 0: unexpected operator/operand
enable[65]: can't open /magisk/.core/magiskhide/hidelist: No such file or directory
MagiskHide: Starting MagiskHide daemon
[email protected]:/magisk/.core/magiskhide #
I still get the same result ...
ahmedsasker said:
I still get the same result ...
Click to expand...
Click to collapse
If you type just:
Code:
su
mount
and look for a line that starts something like:
Code:
/dev/block/loop0 on /magisk
In the parenthesis at the end of the line, the text should start with "rw". Does it?
Didgeridoohan said:
If you type just:
Code:
su
mount
and look for a line that starts something like:
Code:
/dev/block/loop0 on /magisk
In the parenthesis at the end of the line, the text should start with "rw". Does it?
Click to expand...
Click to collapse
No it it does start with ro
Code:
/dev/block/loop0 on /magisk type ext4 (ro,seclabel,noatime,data=ordered)
ahmedsasker said:
No it it does start with ro
Code:
/dev/block/loop0 on /magisk type ext4 (ro,seclabel,noatime,data=ordered)
Click to expand...
Click to collapse
Ok. Next, try:
Code:
mount -o remount,rw /magisk
If that doesn't work, try:
Code:
mount -o remount,rw -t ext4 /dev/block/loop0 /magisk
Didgeridoohan said:
Ok. Next, try:
Code:
mount -o remount,rw /magisk
If that doesn't work, try:
Code:
mount -o remount,rw -t ext4 /dev/block/loop0 /magisk
Click to expand...
Click to collapse
I tried both and it keeps telling me that it is read-only
Code:
[email protected]:/ $ su
[email protected]:/ # mount -o remount,rw /magisk
'/dev/block/loop0' is read-only
ount -o remount,rw -t ext4 /dev/block/loop0 /magisk <
'/dev/block/loop0' is read-only
ahmedsasker said:
I tried both and it keeps telling me that it is read-only
Code:
[email protected]:/ $ su
[email protected]:/ # mount -o remount,rw /magisk
'/dev/block/loop0' is read-only
ount -o remount,rw -t ext4 /dev/block/loop0 /magisk <
'/dev/block/loop0' is read-only
Click to expand...
Click to collapse
Hm... I have no idea...
From your earlier posts I assume you've already uninstalled and reinstalled Magisk a few times, right? Have you tried an unofficial beta snapshot (both Magisk and the Manager)?
I still say you should try a different kernel. I don't know what you mean with "supports systemless root", but I'd try flashing a kernel like Elemental over the one that comes with RR and then install Magisk. Maybe even try installing and running Kernel Auditor, like it says in the link I posted earlier.
Didgeridoohan said:
Hm... I have no idea...
From your earlier posts I assume you've already uninstalled and reinstalled Magisk a few times, right? Have you tried an unofficial beta snapshot (both Magisk and the Manager)?
I still say you should try a different kernel. I don't know what you mean with "supports systemless root", but I'd try flashing a kernel like Elemental over the one that comes with RR and then install Magisk. Maybe even try installing and running Kernel Auditor, like it says in the link I posted earlier.
Click to expand...
Click to collapse
I meant that it was written that it supports systemless root in the XDA forums plus I tried to flash elementalx karnel and went into boot loop ...
I'll try the snapshot one now and thanks alot <3
ahmedsasker said:
I meant that it was written that it supports systemless root in the XDA forums plus I tried to flash elementalx karnel and went into boot loop ... How can I uninstall the elementalx karnel to try another one without reflashing the whole rom ?
I'll try the snapshot one now and thanks alot <3
Click to expand...
Click to collapse
Dirty flash the ROM or open up the ROM zip, extract the boot.img and flash that in TWRP.
Didgeridoohan said:
Dirty flash the ROM or open up the ROM zip, extract the boot.img and flash that in TWRP.
Click to expand...
Click to collapse
OMG thanks alot it works well now and passes with the snapshot version <3
thanks again x3
Didgeridoohan said:
Dirty flash the ROM or open up the ROM zip, extract the boot.img and flash that in TWRP.
Click to expand...
Click to collapse
please do you know compatible version of systemless xposed with snapshot magisk ! cuz latest v87 after I flash it, closed installer says that there's not framework installed but normal official one works
systemless xposed v87 was working fine on magisk v12
i installed the official one now and it is working very well
what is the difference between systemless xposed and the normal one ? (cuz both got caught by safety net)
ahmedsasker said:
please do you know compatible version of systemless xposed with snapshot magisk ! cuz latest v87 after I flash it, closed installer says that there's not framework installed but normal official one works
systemless xposed v87 was working fine on magisk v12
i installed the official one now and it is working very well
what is the difference between systemless xposed and the normal one ? (cuz both got caught by safety net)
Click to expand...
Click to collapse
It's very likely the Xposed Magisk module needs to be updated to work with v13... I don't use Xposed though, so I wouldn't know.
The difference between system and systemless xposed is that one is installed into system and the other one is systemless. :laugh: Seriously... That's the difference. They'll both trigger SafetyNet. Systemlessness is not about passing SafetyNet.
Didgeridoohan said:
Run the following commands in a terminal emulator:
Code:
su
cd /magisk/.core/magiskhide
sh disable
sh enable
You're probably gonna get an output that the hidelist can't be created because of a permissions issue. That probably means the Magisk image doesn't get mounted properly at boot.
Another user (@gunner007dc) that had this issue fixed it by using a different kernel.
Click to expand...
Click to collapse
In my device, no file in /magisk/...why?:crying::crying:
Hooxp17 said:
In my device, no file in /magisk/...why?:crying::crying:
Click to expand...
Click to collapse
No idea. I can't see your device and I can't read your mind... Meaning: you've given very few details.
I'm gonna make a guess though: are you taking about the ".core" folder? It's a hidden folder, so if your file explorer isn't set to see hidden files and folders you won't see it.
If this is not your issue, give more details.
Didgeridoohan said:
Dirty flash the ROM or open up the ROM zip, extract the boot.img and flash that in TWRP.
Click to expand...
Click to collapse
Which ROM? How to Dirty Flash? I have G5 Plus
brandonsisco said:
Which ROM? How to Dirty Flash? I have G5 Plus
Click to expand...
Click to collapse
Uhm... That was a specific advice for a specific issue...
What's your issue?
Didgeridoohan said:
Run the following commands in a terminal emulator:
Code:
su
cd /magisk/.core/magiskhide
sh disable
sh enable
You're probably gonna get an output that the hidelist can't be created because of a permissions issue. That probably means the Magisk image doesn't get mounted properly at boot.
Another user (@gunner007dc) that had this issue fixed it by using a different kernel.
Click to expand...
Click to collapse
hello, i have a problem with magisk, so i found your post. but in the terminal emulator can't see this file.. can you help me?

[help]magsisk echo script on boot

I want to make an echo command with magisk on boot
echo 0 > /sys/class/leds/button-backlight/max_brightness
so that it is applied on boot automatically
how to do that ?
thanks in advance
Just put your script in
Code:
/magisc/.core/service.d
and set execution permissions.
Since you want to edit sys files, you will need root permission. An example script would be (brightness.sh) :
Code:
#!/system/bin/sh
su -c 'echo 0 > /sys/class/leds/button-backlight/max_brightness'
Note :
If you want to execute your script at another boot stage you should have a look at this
pec0ra said:
Just put your script in
Code:
/magisc/.core/service.d
and set execution permissions.
Since you want to edit sys files, you will need root permission. An example script would be (brightness.sh) :
Code:
#!/system/bin/sh
su -c 'echo 0 > /sys/class/leds/button-backlight/max_brightness'
Note :
If you want to execute your script at another boot stage you should have a look at this
Click to expand...
Click to collapse
Can you tell what the -c flag in your example script is for?
Yaseen_the_Gamer said:
Can you tell what the -c flag in your example script is for?
Click to expand...
Click to collapse
https://github.com/topjohnwu/Magisk/blob/master/docs/tools.md#su
It's to use su directly in the command, basically.
Although in this case it's technically unnecessary since all Magisk boot scripts are run with superuser access.

Question Fork Magisk for Vivo Devices

This post seeks attention of Senior XDA developers who are contributors of Magisk:
I have been struggling to fix Magisk mount and SU execution on VIVO devices.
Magisk issue #5148
VIVO/iQOO kernel restictions: "Operation not permitted" when executing `su` or mounting to `/system`, or bootloops if rooted · Issue #5148 · topjohnwu/Magisk
Device: iQOO Z1/VIVO X70 PRO/iQOO NEO3, and more Android version: N/A Magisk version name: N/A Magisk version code: N/A, but more serious since 24302 Magisk fails to mount /system on some Vivo/iQOO...
github.com
I am ready to work together to the best of my technical capacity.
I will pay for your test device and a special bounty for your hard work and development efforts.
Interested developers please reach out to me.
Actual problem is on Vivo devices only. Tested on Vivo Y33s and Y21.
When you call su, it returns: "Operation not permitted"
Trying to run /dev/xxxx/Magisk --daemon: "No daemon is currently running"
Previous attempts:
Problem seems to be SELinux policy, if you attempt to manually run from android debug builds, then the daemon is properly loaded.
2109:/dev/9Lgz # ./supolicy --magisk
Load policy from: /sys/fs/selinux/policy
2109:/dev/9Lgz # magisk --daemon
2109:/dev/9Lgz # magisk --path
/system/bin
2109:/dev/9Lgz # su
2109:/dev/9Lgz # id
uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),1078(ext_data_rw),1079(ext_obb_rw),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:magisk:s0
With this solution, the problem is that we need to run this from "adb root" shell after every boot.
Is there any way to run this locally on a the device having debug build?
Where should I post this thread to find the right developers to solve this problem?
I would highly appreciate some help here.
Maybe you can try change 'su' to 'suu' or 'timesu', as the [ref](http://bbs.ydss.cn/thread-1528844-1-1.html) said.
Good luck and success to you!
JuanLv said:
Maybe you can try change 'su' to 'suu' or 'timesu', as the [ref](http://bbs.ydss.cn/thread-1528844-1-1.html) said.
Good luck and success to you!
Click to expand...
Click to collapse
I tried but no luck (
Looking for developers who have good knowledge of Magisk mount and magiskinit.
NextGenMagisk said:
Looking for developers who have good knowledge of Magisk mount and magiskinit.
Click to expand...
Click to collapse
The developer has made restrictions in the kernel as ref
| https://github.com/topjohnwu/Magisk/issues/5148#issuecomment-1167697477
Maybe we can make a workaround by kernel patch.
I'm not too familiar with these.
Do you have any idea?
JuanLv said:
The developer has made restrictions in the kernel as ref
| https://github.com/topjohnwu/Magisk/issues/5148#issuecomment-1167697477
Maybe we can make a workaround by kernel patch.
I'm not too familiar with these.
Do you have any idea?
Click to expand...
Click to collapse
Thanks for the update. Looks like this issue is not easy to fix and it depends on access to kernel sources for each device model. I am not familiar with Kernel patching.
My ideas are focused around leveraging debug builds to execute SU locally and then make it persist across reboots.
NextGenMagisk said:
Is there any way to run this locally on a the device having debug build?
Click to expand...
Click to collapse
vivo y31, LineageOS 19.1, userdebug
magisk 24.3 can inject code in init.rc, can't mount /system /vendor /oem
magisk >24.3 can't inject code, because magisk switched to new method wich requires mounting /system. Zygisk is broken since 2431*
If you want to have adb root, then you can use phh-su(if you use gsi) and execute in termux
su -c setprop service.adb.root 1
su -c setprop service.adb.tcp.port 5555
su -c stop adbd
su -c start adbd
adb wait-for-device
adb shell whoami
Without phh-su you would need to split screen [termux + developer options/wifi debugging] and pair with code
one time in termux
adb pair localhostort code
no need to split screen anymore
then off -on wifi debugging
adb connect localhost:newport
adb root
off-on wifi debugging again
adb kill-server
adb connect localhost:newnewport
gz! you're root
Another way is to edit init.rc. Just look at magiskrc.inc from the source code.
I have no problems with zygisk and modules on 24.3 magisk. I just mounting overlayfs on top of /system and then just copy all modules into /system.
Here is my .rc script which I pushed in boot.img like this
./magiskboot unpack boot.img
./magiskboot cpio ramdisk.cpio 'add 0644 overlay.d/ofs.rc ofs.rc'
./magiskboot repack boot newboot.img
script
on load_persist_props_action
exec u:r:su:s0 -- /system/bin/mount -t overlay overlay -o lowerdir=/system,upperdir=/data/system/ou,workdir=/data/system/ow /system
on zygote-start
exec u:r:su:s0 -- /system/bin/mount /sbin/.magisk/zygisk/app_process32 /system/bin/app_process32
exec u:r:su:s0 -- /system/bin/mount /sbin/.magisk/zygisk/app_process64 /system/bin/app_process64
Then just create two folders
/data/system/ou
/data/system/ow
And copy modules files in upper layer(real system will not be modified)
su -c cp -r /sbin/.magisk/modules/*/system/* /system
If you need to revert changes then you can delete two folders and create them again. Or you can delete module files like this
cd /sbin/.magisk/modules/{Module Name}/system/
find -exec rm /system/{} \;
cd /data/system/ou
find . -type d -empty -delete
If you want to boot with real /system then just rename two folders
mount -t overlay
overlay on /system type overlay (rw,seclabel,relatime,lowerdir=/system,upperdir=/data/system/ou,workdir=/data/system/ow)
mount | grep " / "
/dev/block/dm-0 on / type ext4 (ro,seclabel,nodev,relatime,discard)
Pervokur said:
mount -t overlay
overlay on /system type overlay (rw,seclabel,relatime,lowerdir=/system,upperdir=/data/system/ou,workdir=/data/system/ow)
mount | grep " / "
/dev/block/dm-0 on / type ext4 (ro,seclabel,nodev,relatime,discard)
Click to expand...
Click to collapse
This is extremely helpful and has given me a very clear path to solve problems with Vivo root. I will implement these suggestions. Thanks a lot.
NextGenMagisk said:
This is extremely helpful and has given me a very clear path to solve problems with Vivo root. I will implement these suggestions. Thanks a lot.
Click to expand...
Click to collapse
Another tip from me. There is a way to have system rw for magisk root. At least it works for me on LOS19.1 userdebug gsi, vndklite variant, magisk24.3
Normaly
magisk-su: mount -o rw,remount /
operation not permitted
adb root:mount -o rw,remount /
ok
but / is still ro for magisk-su
Then I just kill surfaceflinger which leads to zygote restart(aka soft reboot)
su -c killall surfaceflinger
After booting / is rw for magisk-su and you can work with partition in file manager like Total Commander.
Pervokur said:
Another tip from me. There is a way to have system rw for magisk root. At least it works for me on LOS19.1 userdebug gsi, vndklite variant, magisk24.3
Normaly
magisk-su: mount -o rw,remount /
operation not permitted
adb root:mount -o rw,remount /
ok
but / is still ro for magisk-su
Then I just kill surfaceflinger which leads to zygote restart(aka soft reboot)
su -c killall surfaceflinger
After booting / is rw for magisk-su and you can work with partition in file manager like Total Commander.
Click to expand...
Click to collapse
Again a great tip, thanks!
I am currently testing your previous suggestions to inject custom init script on Y33s.
you can test this with adb root without editing boot.img or init.rc
NextGenMagisk said:
Again a great tip, thanks!
I am currently testing your previous suggestions to inject custom init script on Y33s.
Click to expand...
Click to collapse
adb shell
mount -t overlay overlay -o lowerdir=/system,upperdir=/data/system/ou,workdir=/data/system/ow /system
mount /sbin/.magisk/zygisk/app_process32 /system/bin/app_process32
mount /sbin/.magisk/zygisk/app_process64 /system/bin/app_process64
then restart zygote
killall surfaceflinger
zygote will restart, but mounts will still be there
Pervokur said:
you can test this with adb root without editing boot.img or init.rc
adb shell
mount -t overlay overlay -o lowerdir=/system,upperdir=/data/system/ou,workdir=/data/system/ow /system
mount /sbin/.magisk/zygisk/app_process32 /system/bin/app_process32
mount /sbin/.magisk/zygisk/app_process64 /system/bin/app_process64
Click to expand...
Click to collapse
mount overlay is working when executed from adb root.
but i cant get past the second step:
2109:/data/system/ow # mount /sbin/.magisk/zygisk/app_process32 /system/bin/app_process32
mount: '/sbin/.magisk/zygisk/app_process32'->'/system/bin/app_process32': No such file or directory
1|2109:/data/system/ow #
1|2109:/data/system/ow # mount /sbin/.magisk/zygisk/app_process64 /system/bin/app_process64
mount: '/sbin/.magisk/zygisk/app_process64'->'/system/bin/app_process64': No such file or directory
what must be causing this?
NextGenMagisk said:
mount overlay is working when executed from adb root.
but i cant get past the second step:
2109:/data/system/ow # mount /sbin/.magisk/zygisk/app_process32 /system/bin/app_process32
mount: '/sbin/.magisk/zygisk/app_process32'->'/system/bin/app_process32': No such file or directory
1|2109:/data/system/ow #
1|2109:/data/system/ow # mount /sbin/.magisk/zygisk/app_process64 /system/bin/app_process64
mount: '/sbin/.magisk/zygisk/app_process64'->'/system/bin/app_process64': No such file or directory
what must be causing this?
Click to expand...
Click to collapse
you didn't activate zygisk in magisk settings, so there are no files /sbin/.magisk/zygisk/app_process32
/sbin/.magisk/zygisk/app_process64
Pervokur said:
you didn't activate zygisk in magisk settings, so there are no files /sbin/.magisk/zygisk/app_process32
/sbin/.magisk/zygisk/app_process64
Click to expand...
Click to collapse
I cant enable it because Magisk daemon does not run at boot. Superuser tab in the app is greyed out.
testing this on a Vivo PD2147F debug build with Magisk patched boot and ofs.rc entry included.
NextGenMagisk said:
I cant enable it because Magisk daemon does not run at boot. Superuser tab in the app is greyed out.
testing this on a Vivo PD2147F debug build with Magisk patched boot and ofs.rc entry included.
Click to expand...
Click to collapse
even with magisk 24.3?
Pervokur said:
even with magisk 24.3?
Click to expand...
Click to collapse
Yes, patched magisk 24306. tmp dir with random name under /dev is created with root rights but the magic mount fails and hence the superuser tab is greyed out.
Magisk issue #5148
VIVO/iQOO kernel restictions: "Operation not permitted" when executing `su` or mounting to `/system`, or bootloops if rooted · Issue #5148 · topjohnwu/Magisk
Device: iQOO Z1/VIVO X70 PRO/iQOO NEO3, and more Android version: N/A Magisk version name: N/A Magisk version code: N/A, but more serious since 24302 Magisk fails to mount /system on some Vivo/iQOO...
github.com
Then you should manually add something like this to the end of init.rc
on load_persist_props_action
exec u:r:su:s0 -- /system/bin/mount -t overlay overlay -o lowerdir=/system,upperdir=/data/system/ou,workdir=/data/system/ow /system
on zygote-start
exec u:r:su:s0 -- /system/bin/mount /sbin/.magisk/zygisk/app_process32 /system/bin/app_process32
exec u:r:su:s0 -- /system/bin/mount /sbin/.magisk/zygisk/app_process64 /system/bin/app_process64
on post-fs-data
start logd
rm /dev/.magisk_unblock
start mqVxwb7J
wait /dev/.magisk_unblock 40
rm /dev/.magisk_unblock
service mqVxwb7J /sbin/magisk --post-fs-data
user root
seclabel u:r:magisk:s0
oneshot
service DC83jQtNHiJDw8 /sbin/magisk --service
class late_start
user root
seclabel u:r:magisk:s0
oneshot
on property:sys.boot_completed=1
start Zaw2TLXyH
service Zaw2TLXyH /sbin/magisk --boot-complete
user root
seclabel u:r:magisk:s0
oneshot

Categories

Resources