Database Develop

How to have a clean Android without any Google app? Install AOSP?

Hi everyone,
I have a Sony Z3 compact I just received, model D5803 running Android 6.0.1 with Firmware 23.5.A.0.575.
I really dislike Google and want to run a phone with the minimum of proprietary software (I guess blobs to communicate with the hardware are mandatory). I guess AOSP (any version, but a recent one would be better ) with F-Droid is a good solution.
Unfortunately when checking the sony website but it tells my the bootloader is not unlockable. What should I do? I'm running Ubuntu and have adb and fastboot installed.

I found [this topic](https://forum.xda-developers.com/z3-compact/general/recovery-root-mm-575-lb-t3418714) which tells it roots the phone (and has a GNU/Linux script) but how does that help me to install a Rom, for example the AOSP provided by Sony at /open-devices/list-of-devices-and-resources/ if the bootloader is still locked? What are TWRP and busybox, is that supposed to help?

Flaburgan said:
I found [this topic](https://forum.xda-developers.com/z3-compact/general/recovery-root-mm-575-lb-t3418714) which tells it roots the phone (and has a GNU/Linux script) but how does that help me to install a Rom, for example the AOSP provided by Sony at /open-devices/list-of-devices-and-resources/ if the bootloader is still locked? What are TWRP and busybox, is that supposed to help?
Click to expand...
Click to collapse
TWRP is a custom recovery that allows you to flash a ROM and other files, that are stored on the normal internal or external storage.
Busybox is a binary that gives you command line tools that are often included in a Linux install and some of which aren't included on normal Android. These are commands that other things may make use of, or that you can make use of at a terminal app or run from Tasker or similar app.
You want to look at backing up your TA partition, which stores your DRM keys, before unlocking the bootloader to install a custom ROM because some functionality, camera quality and anti-distortion, sound quality, and some other stuff which I don't remember, won't work if you go back to the stock ROM unless you have these keys backed up and then restored later. You need to unlock the bootloader in order to flash a custom ROM and doing this erases, permanently, these DRM keys, so they need to be backed up and then put back later if you relock the bootloader and flash a stock ROM.
If you look in the Original Development section, Jaguar Aries ROM has no Google Apps, had the latest patches up to Febuary, and had the best battery life of any custom ROM I've seen for this phone, right on par with stock. There are some builds of Lineage OS that are probably closer to being up to date as well and may have a better camera than Jaguar. The developer of Jaguar has moved on to another phone. That said, if you aren't experienced and don't know what TWRP is, then installing it is an extra step from other ROMs as well since it requires you to setup a firewall app to permit connections on data or wifi before you can use the wifi or data at all. I doubt Lineage OS has this, but presume that battery life would not be good.
Also, if you install microg apps, you can still use things such as cell and wifi based location, google push services, and ... I don't remember what else, however it hasn't been updated recently and many apps will complain and refuse to run saying that you need to update google play services, especially annoying for anything that uses push especially. Microg essentially sits in the place of where some functionality of Google Apps would and fills in some blanks.
When you don't have Google Apps installed, many paid apps will refuse to run as well, specifically the ones you paid for, because they can't verify the purchase with Google servers. There should be a **** list for any developers that don't cooperate when this is a problem for a user. I've only had one app developer help me on this, ever.

Thanks for your detailed answer!
You need to unlock the bootloader in order to flash a custom ROM and doing this erases, permanently, these DRM keys, so they need to be backed up and then put back later if you relock the bootloader and flash a stock ROM.
Click to expand...
Click to collapse
Does that mean that I can't use the DRM keys with another ROM? So I will never have the full quality of my hardware? Would using the AOSP rom provided by Sony solve that problem?
On which version of Android Jaguar Aries ROM is based? I searched for a lineageOS image but didn't find any for the Z3 Compact.
I had another z3c which died and was running Firefox OS, I'm fine with not having access to the Google Play store, I plan to install F-Droid and use only FOSS apps. In fact I would even prefer to go back to Firefox OS even if it is not maintained anymore, its UX is so much better than Android... That said, thanks for telling me about Microg, I didn't know it and that's true that many apps use Play services especially for push. Even Signal had that as a dependency (fortunately not anymore). Still, I would avoid any data coming out from my phone to by sent to Google servers, so I will probably avoid it.

Flaburgan said:
Thanks for your detailed answer!
Does that mean that I can't use the DRM keys with another ROM? So I will never have the full quality of my hardware? Would using the AOSP rom provided by Sony solve that problem?
On which version of Android Jaguar Aries ROM is based? I searched for a lineageOS image but didn't find any for the Z3 Compact.
I had another z3c which died and was running Firefox OS, I'm fine with not having access to the Google Play store, I plan to install F-Droid and use only FOSS apps. In fact I would even prefer to go back to Firefox OS even if it is not maintained anymore, its UX is so much better than Android... That said, thanks for telling me about Microg, I didn't know it and that's true that many apps use Play services especially for push. Even Signal had that as a dependency (fortunately not anymore). Still, I would avoid any data coming out from my phone to by sent to Google servers, so I will probably avoid it.
Click to expand...
Click to collapse
When you unlock the bootloader the DRM keys get erased permanently, so you'd need to root the phone and back up the partition where they are held before unlocking it. As far as I know, every custom ROM needs to have the bootloader unlocked. If there is an alternative way to install a ROM on a locked bootloader then it would be one of those scenarios where its installed while keeping the stock one, and I don't know if this has been done on the Z3c or not.
I also don't know if Sony's AOSP requires unlocking the bootloader or not.
Jaguar is based on 5.1.1
Its a mix of AOSP, Lineage, and was getting monthly backports of the latest security patches until Febuary when the developer no longer had a Z series phone for his own use. The only criticism it met was that the developer never released the source code for the entire ROM, just the kernel. He never replied to why that was. A lot of the custom ROMs out there are like this, so its still a case of who you choose to trust when it comes to this a lot of times. I liked it because the battery life was really good and assuming the security was what was advertised then that was also a real plus.
Many apps, by the way, were working fine with microg push but then with updates to apps, they complained about needing to update google services framework, which obviously was spoofed and microg hasn't been updated, and it happened to a lot of apps in a short period of time, so I assume there was a change enforced by Google for their requirements in the Play Store. If you just want it for location, for example if you use Osmand maps, then you don't have to enable the feature for push notifications nor have a google account associated with the phone, and it all works as user installed apps, so it can be undone without any real fear of the system getting modified after you try it out. There's a microg repo that can be added to fdroid. The location is based on either databases you download to the phone, which aren't very good, or also you can opt for cell location from Mozilla servers, and if you have to have wifi based location as well then you can hook into the Apple servers but the latter doesn't sound like something you want, if you want to do any of it at all that is.
I think most likely that GPS location would work without any need for microg.
The post you linked to with the Linux script installs TWRP to the /data partition, then you root it, then you back up the DRM keys after its rooted, then unlock the bootloader, install normal TWRP, and go from there. In Linux you'lle want to use the dd command to back up the DRM keys as all that's available on the forum is a Windows script (I think). There is info on it somewhere but it would be hard to find it. If you search my posts the thread will come up somewhere in the history. Anyway, the reason I broght this up is because the script in the thread for installing TWRP and rooting didn't work properly. I don't remember why, but I had to go through it line by line and enter the commands in from a termnial to get it right, I think there was some bad syntax. If you can't figure it out, quote one of my posts and ask, that way I get a notification that I was replied to, I think I have a fixed version of it on my drive somewhere if it causes a problem.
For the DRM keys you want to backup the TA partition bit for bit to a file. I backed up my Fota partition as well as I was unclear what role it plays. You also want to keep a copy of that particular Sony ROM file, and the two kernels involved, to flash with Flashtool in case you relock and restore so you can get root access to restore the partition while the bootloader is locked again.

May I ask why are you going FOSS only? if that's because privacy concerns, then FF OS is not the best solution... Because any Cloud-based OS is a little bit creepy, doesn't matter if it's ChromeOS from Google, or FirefoxOS from Mozilla.
There are plenty of Linux distros dedicated to run on Android phones, but it's not the best UX.
And yes, you can enjoy clean AOSP install (LOS is fine) without flashing G-Apps. But you won't have Google play at all! F-Droid is fine but you won't find there Gmail alternatives, you can't find Gmail even on Amazon AppStore... Sadly if you install Gmail then you'll find out that it installed bunch of google apps and hidden services behind the scenes... So only option is to use Gmail web app.
But then again, F-Droid is fine, there are many FOSS alternatives to youtube and other apps.
And if privacy (and security) is your concern, use LOS privacy guard / Android's builtin Permission Manager, and on Rooted ROMs you can use AFwall firewall which is the best.
Good luck

GadgetAvi said:
Because any Cloud-based OS is a little bit creepy, doesn't matter if it's ChromeOS from Google, or FirefoxOS from Mozilla.
Click to expand...
Click to collapse
Firefox OS is not a Cloud-based OS at all. It runs perfectly without internet connection.
GadgetAvi said:
F-Droid is fine but you won't find there Gmail alternatives, you can't find Gmail even on Amazon AppStore...
Click to expand...
Click to collapse
Be sure that if I don't want Google on my phone, my e-mails are already **not** on GMail...

Ok, if so, then you'll be fine with any AOSP clean rom. LOS is great, and F-Droid as well. Cheers!

PantsDownJedi said:
The post you linked to with the Linux script installs TWRP to the /data partition, then you root it, then you back up the DRM keys after its rooted, then unlock the bootloader, install normal TWRP, and go from there. In Linux you'lle want to use the dd command to back up the DRM keys as all that's available on the forum is a Windows script (I think).
Click to expand...
Click to collapse
I ran the commands and the phone is now booted on TWRP from the /data partition. I did a backup with TWRP of all proposed options (Boot, TrimArea, Recovery, System, Cache and Data). Is that "TrimArea" enough to have a backup of the DRM keys? The other topic talks about Backup-TA but looking at their github https://github.com/DevShaft/Backup-TA/releases it looks very old and unmaintained.
The current TWRP I'm running is 3.1.0-0.

Also, it looks like I'm not root (at least, su is not available). Do I have to install SuperSu by giving this zip https://download.chainfire.eu/696/supersu/ to TWRP?

Flaburgan said:
I ran the commands and the phone is now booted on TWRP from the /data partition. I did a backup with TWRP of all proposed options (Boot, TrimArea, Recovery, System, Cache and Data). Is that "TrimArea" enough to have a backup of the DRM keys? The other topic talks about Backup-TA but looking at their github https://github.com/DevShaft/Backup-TA/releases it looks very old and unmaintained.
The current TWRP I'm running is 3.1.0-0.
Click to expand...
Click to collapse
I don't know. I haven't looked at a TWRP backup to see what format it is. Back when Clockwork Mod was all that was available, it merely made a tar.gz of partitions. Ideally you want a bit for bit image of the TA partitions to make sure it was exactly what it was when you restore it. I don't know if that's necisarry, or if TWRP does this anyway, but using the dd command is still prudent.
You want to either use a terminal emulator app or run 'adb shell' at a linux terminal (much easier), run 'su' once in the phone environment, allow it at the phone supersu app popup, and then do it like this.
https://forum.xda-developers.com/showpost.php?p=61307511&postcount=6
And store a copy of the image file where it won't get lost.
Edit: Sorry, I didn't see the other post. Yes, you need to flash that supersu zip file. When you try to access root from an app or the command line, it will have a popup on the phone screen asking you if you want to allow access or not, so when you run it from a terminal, 'adb shell' to get into the phone OS, there will be a popup for allowing that often times. Then 'su' there's a popup from the supersu app you just flashed. Then 'cd' to the sdcard or external sd. Then the 'dd' command. The dd command in what I linked to is inevitbaly what all those .bat files in the Windows TA Backup thing does after it does a bit of looking around to find the TA partition for a particular phone model.
The md5sum part of what I linked to compares the partitionn itself to the image file you just wrote, you just look at it to see that there are two of them (that it didn't fail) and that they are the same.
The last part pulls the image file to the hard drive, but there are other ways to accomplish this obviously. If you have a cloud storage you can upload it there, or send it as an email attahment, put it on the external sd, etc etc.
Also, in many cases, once you unlock the bootloader to flash something else, you'lle need to install TWRP again from the command line, pushing it straight to a phone partition. You'lle need help with this if you haven't done it before.

[SOLVED] Android Attest Key lost

Any ideas how this could happen?
Update: Android attest key is lost when persist.sin partition is flashed.
Here is a screenshot of Service Menu -> Service tests -> Security soon after the XZ1c was bought. It reads:
Code:
Android Attest Key PROVISIONED
But now I have it like this (screenshot also attached):
Code:
Android Attest Key NOT PROVISIONED
Does it mean that my phone is no longer considered as unique and google play would consider it as a custom firmware not to be trusted or something like that?
Update: it can be used by a third party (for example play store) to check if your phone is still locked, without any chance to fake that due to use of cryptographic signatures and certificate chains in Trust Zone.
Please see post#98 for a "howto truly verify Android Attest Key working presence" including patched Auditor app that uses the key and following posts #99 till #102 showing various results including a trial to change something in a signed response, with conclusion in post#103:
j4nn said:
A phone with lost attestation key cannot be used by Auditor app as there is an exception right at start - documented already in post#30 in this thread.
And as discovered by @pbarrette (see post#13 here, thanks) the Android Attestation Key status in the service tests security screen can be made provisioned by simply creating of 5 empty files in keymaster64 directory - but that would not make the key working obviously.
Conclusion:
Android attest key might only be useful if bootloader is still locked to provide cryptographic proof of still locked verified boot untouched stocked firmware running on the phone.
If bootloader is unlocked, that key may be used by external party (play store for example) to easily detect unlocked state without any possibility to fake that due to certificate chains leading to google's root certificate, so they can easily check (outside of the phone) all the signatures of from the phone retrieved hw backed attestation data.
Click to expand...
Click to collapse
Please note, I did not unlock the bootloader (as documented by a current screenshot too).
It does not help to do a full factory reset.
It does not help to flash full firmware, not even the version which the phone was bought with (tried even keeping all files including all .ta for flashing with newflasher).
Does it mean my XZ1c lost (something like a drm) key from "hardware-backed key storage"?
Some details about the use seems to be here https://source.android.com/security/keystore/attestation.
This would be quite unfortunate to lose some keys even without unlocking
Done only few sony stock fw flashing via newflasher (I have attached log of the first flashing done for downgrade and a log of the last one trying to restore original fw fully) and some testing of user space apps via adb as described in this thread.
As a final restore attempt I let a FOTA system upgrade to run, it upgraded to 12.34 version, did a factory reset after that, but the attest key is still not provisioned there.
Any ideas what went wrong?
Particularly opinion of @munjeni would be interesting to me as his newflasher was used and the logs are available.
Could it be caused by something in the early fw to which the phone was flashed to (even though .ta files were skipped when flashing it)?
Or some issue with flashing procedure? At the first attempt I tried the initial prompt to backup ta, not sure, if it was safe (also visible in the log).
Thanks.
-- edit, added on 2018-10-28 --
There might be a chance to recover the Android Attest Key from a phone (xz1 compact or xz1) which still runs 47.1.A.8.49 or older fw.
Is here anybody with such phone? Still locked? With the Android Attest Key still PROVISIONED?
It may be possible to recover it from TA partition backup.
Anybody with such phone, contact me please, if willing to help me to test that.
Thanks.
You will need to backup your phone before the test - it would involve a downgrade of fw.
More info here please:
[DEVONLY][XZ1c] exploits for temp root to backup drm keys development
-- edit end, strike added on 2018-11-18 --

hello you have test flash reset .ta partition with flashtool ?

j4nn said:
Does it mean that my phone is no longer considered as unique and google play would consider it as a custom firmware not to be trusted or something like that?
Click to expand...
Click to collapse
No, loosing your TA partition only effects your Sony software, like the stock camera and a few higher functions.
It won't effect your Play store.
You can 'fix' the phone to think that it has the DRM keys (on the TA partition) and everything works as normal. You can even root your phone and still use android pay.
Yes, you've broken a part of your phone and you'll never ever get that back, but you're part of XDA and we're here to help you and fix it.

So what are the possible consequences of losing Android attest key provisioning? I'm interested because a method to backup the TA partition before unlocking bootloader might be coming soon, but it will require downgrading firmware and losing Attest key provision (read https://forum.xda-developers.com/xp...-exploits-temp-root-to-backup-t3795510/page20 )
Could it in any way cause the system to not pass SafetyNet?

I've lost my attest key when debranded my xz1,
Safety net check pass, I'm able to use Android pay and Pokemon go, also ota update still work
Sent from Italy by my xz1

I didn't realize the OP of this thread is the awesome developer of fw exploit trying to backup TA partition in the thread i linked. I'm totally going to donate to you j4nn, once the backup method is publicly released in detail. I'm just worried about this Attest key issue... I hope we all get an exhaustive answer!

In my case, I'm using a Xperia XA2 with locked bootloader, and changed my firmware customization... I changed from US to GEL and what is different is that SOMC Fido key is not provisioned.

@Meloferz, that is very surprising.
Just wondering, what does GEL customization stand for?
Could it be that for GEL region FIDO feature is not supported?
Maybe if you flash back to US the key might re-appear (if it was just disabled for GEL)?

j4nn said:
@Meloferz, that is very surprising.
Just wondering, what does GEL customization stand for?
Could it be that for GEL region FIDO feature is not supported?
Maybe if you flash back to US the key might re-appear (if it was just disabled for GEL)?
Click to expand...
Click to collapse
The GEL customization is for my region (Latin America), and is the first customization to get updates and with not US bloatware.
Maybe is not supported in my customization because we don't use contact less payments (at least in Paraguay, maybe in other countries of latam too I think?).
Didn't checked before I flashed the GEL customization, and didn't know on that time about FIDO, and others authentications

As updated the first post:
It would be great if there is anybody with a still locked XZ1c running 47.1.A.8.49 fw or any older and still having the Android Attest key in "provisioned" state. That is your either did not accept any OTA updates on purpose or you just bought the phone (and that fw version is pre-installed) - watch out not to accept any update in that case please.
Anybody please?

Hi @j4nn,
From what I can tell, the /vendor/bin/secd binary is making calls to QSEECOM via the tzxflattest TrustZone applet in order to determine the key provisioning status.
Additionally, it's looking in the /persist/data/keymaster64 directory for something. My keys are gone from my BL unlock, so I don't know what's supposed to be in there.
It's also getting the persist.keyprovd.attest.prov property to determine if it's set to true.
I haven't yet found where that property is getting set.

Hi @pbarrette, can you differentiate if that concerns Android Attest Key or just the two SOMC keys?
I've also looked into that secd, but I am not sure.
Anyway, it may be possible that at least those two SOMC keys are not erased from Trust Zone with unlock.
Instead it could be that they are just disabled with 'unlocked' flag, secd ignoring them, even though they may be available with restored device master key in TA.
This is something I would like to test currently with @tramtrist.
With Android Attest key it might be different as it is not connected to unlock.

j4nn said:
Hi @pbarrette, can you differentiate if that concerns Android Attest Key or just the two SOMC keys?
I've also looked into that secd, but I am not sure.
Anyway, it may be possible that at least those two SOMC keys are not erased from Trust Zone with unlock.
Instead it could be that they are just disabled with 'unlocked' flag, secd ignoring them, even though they may be available with restored device master key in TA.
This is something I would like to test currently with @tramtrist.
With Android Attest key it might be different as it is not connected to unlock.
Click to expand...
Click to collapse
Looking closer, the Android Attest key is looked up in the devsec_get_debugmenu_report() function.
The call looks like this:
Code:
LODWORD(reference_Var) = 1
int_AndroidAttestKey_Result = devsec_get_key_prov_status(3LL, &reference_Var);
android_PushString((__int64)&string_Stream, (__int64)" Android Attest Key", 20LL);
if ( !int_AndroidAttestKey_Result )
{
if ( (_DWORD)reference_Var )
{
str_ProvisionedText = "\tNOT PROVISIONED\n";
int_Result = 17LL;
}
else
{
str_ProvisionedText = "\tPROVISIONED\n";
int_Result = 13LL;
}
android_PushString((__int64)&string_Stream, (__int64)str_ProvisionedText, int_Result);
}
So it's calling the devsec_get_key_prov_status() function with param1=3 and param2=refVar.
That status function looks like this (condensed to the appropriate parts):
Code:
devsec_get_key_prov_status(__int64 result, _DWORD *a2)
v2 = a2;
case 3:
intptr_DirStream = opendir("/persist/data/keymaster64");
if ( intptr_DirStream )
{
int_LoopCounter = 0;
while ( 1 )
{
intptr_DirEntry = readdir(intptr_DirStream);
if ( !intptr_DirEntry )
break;
v28 = intptr_DirEntry + 19;
if ( (unsigned int)strcmp(intptr_DirEntry + 19, ".") && (unsigned int)strcmp(v28, "..") )
++int_LoopCounter;
}
result = closedir(intptr_DirStream);
if ( int_LoopCounter >= 5 )
goto LABEL_22;
}
else
{
v29 = "vendor/semc/system/core/libasb/security_daemon/backend/device_security/get_key_prov_status.cpp";
v30 = __strrchr_chk("vendor/semc/system/core/libasb/security_daemon/backend/device_security/get_key_prov_status.cpp", 47LL, 95LL);
if ( v30 )
{
v30 = __strrchr_chk("vendor/semc/system/core/libasb/security_daemon/backend/device_security/get_key_prov_status.cpp", 47LL, 95LL);
v29 = (const char *)(v30 + 1);
}
v31 = (unsigned int *)__errno(v30);
v32 = strerror(*v31);
result = androidLog2((__int64)"secd", 1, (__int64)v29, 0x4Fu, "failed to open %s dir, error %s", v33, v34, v35, v36, v37, v38, v39, v40, "/persist/data/keymaster64", v32);
}
break;
LABEL_22:
v15 = 0;
*v2 = 0;
goto LABEL_27;
LABEL_27:
result = v15;
return result;
The devsec_get_key_prov_status() function also handles cases 1 and 2, which do a property_get on persist.keyprovd.attest.prov (SOMC Attest Key) and persist.keyprovd.fido.prov (SOMC FIDO Key).
So the android attestation key report is related to having at least 5 files in /persist/data/keymaster64/.
I just tested that by creating a keymaster64 directory, creating 5x 0-byte files in that directory named 1, 2, 3, 4, and 5.
Now, if I go to the debug menu, it shows "Android Attest Key: PROVISIONED".
Obviously, that's not a very robust check for the debug menu to be making, so there must be files placed there by some other process and those files probably have some valid purpose.

That /persist mount looks interesting.
But not sure if the content is not generated somehow from TrustZone.
There are following directories in case of my xz1c:
Code:
/persist/data/tzattest/
/persist/data/fidocrypto/
/persist/data/wv/
The last one probably concerns widevine.
I am missing the /persist/data/keymaster64/ directory.
But if valid content from that directory would suffice to make the attest key available and usable, that would be another reason to try to retrieve those files from 47.1.A.8.49 fw or older via exploit.

With the help of Notepad++ and 7zip I searched for "attestation" and "keymaster64" in the firmware of my xz1 (downloaded with xperifirm).
There are reference to keymaster64 and key attestation inside keymaster_X_BOOT_MSM8998_LA1_1_O_82.mbn.
Looking better, probably this file contains the code that compares osVersion and osPatchLevel from tee with the osVersion and osPatchLevel from system image and read or write /persist/data/rsa_attest_key and /persist/data/ecc_attest_key
In system I found this file: https://gist.github.com/HandyMenny/a623cdcaf89c0aee7b3a91ed12c8dc4a
Here is another reference to key attestation: https://android.googlesource.com/pl.../master/keymaster/3.0/IKeymasterDevice.hal#42 and googling I found this log: https://pastebin.com/cRyYEtf2
Hoping to be helpful

j4nn said:
That /persist mount looks interesting.
But not sure if the content is not generated somehow from TrustZone.
There are following directories in case of my xz1c:
Code:
/persist/data/tzattest/
/persist/data/fidocrypto/
/persist/data/wv/
Click to expand...
Click to collapse
Can you check how it's mounted (/proc/mounts)? Is it a proper flash partition, not tmpfs or something like that?
I suppose anyone downgrading a virgin device should try avoiding to flash persist_*.sin (this .sin is small so probably just an empty fs), maybe the missing files are just placed there in the factory?

It is a proper flash it seems:
Code:
G8441:/data/local/tmp # mount | grep persist
/dev/block/sda33 on /persist type ext4 (rw,seclabel,nosuid,nodev,noatime,data=ordered)
G8441:/data/local/tmp # mount | grep ' /data'
/dev/block/sda66 on /data type ext4 (rw,seclabel,nosuid,nodev,noatime,discard,noauto_da_alloc,data=ordered)
G8441:/data/local/tmp # mount | grep ' /cache'
/dev/block/sda53 on /cache type ext4 (rw,seclabel,nosuid,nodev,noatime,discard,data=ordered)
But if it is part of fw package, would not it be flashed also with upgrade? Erasing /persist in all full firmware flash attempts?
That might rather indicate that the content may be generated if not yet existent (possibly from TZ).
Maybe we can check if it gets created new (aka binary different) with factory reset.

@pbarrette, that think with keymaster64 dir containing 5 empty files is nice, works on my locked xz1c too.
Nice find, still, definitely that would not make the key do what it should do. The question is if the android attest key is tied to device or not. But with this test we won't find out. Any idea for a better test?

If can be useful I have created an virtual image of from a Xperia companion firmware..., With all partition that can be mounted, but I don't remember what was in persists partion
You can do this by writing the partion file inside partion zip to a 64 gb image(created with truncate ) then this image can be mounted with losetup (Whit 4k sector size from kernel 4.18+)..
Then I restored every partition extracted from Sim to the virtual partion...
(PS. I know that you are aware of these command,but If you need to know what's inside a file use file and binwalk)
Sent from Italy by my xz1

j4nn said:
@pbarrette, that think with keymaster64 dir containing 5 empty files is nice, works on my locked xz1c too.
Nice find, still, definitely that would not make the key do what it should do. The question is if the android attest key is tied to device or not. But with this test we won't find out. Any idea for a better test?
Click to expand...
Click to collapse
I think this is all tied to Android Verified Boot.
The bootloader is apparently validating hashes in the cryptographically signed /dev/block/platform/soc/1da4000.ufshc/by-name/vbmeta (or /dev/block/sda57) partition.
I haven't had enough time to read through all the documentation. Most of it talks about using the vbmeta partition for rollback protection. The idea being that the bootloader can prevent boot completion if a rollback is detected. But I'm wondering if the vbmeta partition can be used for rollback detection and subsequent invalidation of the device attestation state, because Sony obviously isn't preventing rollback, or stopping the boot process.
Here's the main document from google.
Honestly, I'm not sure how important the SOMC FIDO/Attest and Android Attest keys are.
Google Pay seems to work. Fingerprint logins seem to work. Etc.

Magisk MultiROM Support

https://forum.xda-developers.com/showpost.php?p=69226527&postcount=6
Was this ever fully achieved? Fully systemlesz MultiROM support / module support with Magisk? I have always wanted to see the day that TWRP got a bit of a work over and addition of the possibility of a flashable addon for MultiROM support for what phones that would be supported. I brought this up to my team and also the OrangeFox and a few other groups hoping it might become something. But im getting OT here.. so lets -> back to Magisk chatter.
Any info would be greatly appreciated. Usually i do my fair share of extensive research before asking such but lately I have been overworked and haven't the time to pour over pages and pages as usual.
Thanks!

I've done tons of reading, can't seem to find the answer to this question either
Maybe @topjohnwu can chime in here...

noidodroid said:
https://forum.xda-developers.com/showpost.php?p=69226527&postcount=6
Was this ever fully achieved? Fully systemlesz MultiROM support / module support with Magisk? I have always wanted to see the day that TWRP got a bit of a work over and addition of the possibility of a flashable addon for MultiROM support for what phones that would be supported. I brought this up to my team and also the OrangeFox and a few other groups hoping it might become something. But im getting OT here.. so lets -> back to Magisk chatter.
Any info would be greatly appreciated. Usually i do my fair share of extensive research before asking such but lately I have been overworked and haven't the time to pour over pages and pages as usual.
Thanks!
Click to expand...
Click to collapse
Hey Buddy, Long time no see... Since the android forums days i guess it was.
I ended up here because i was searching to see if there was perhaps a magisk module to enable this as a test feature? or if there was a bit better documentation on how this would work...
My team and I have been deving for some alcatel mtk devices, and we are searching for info to either add multi/dual boot functions to our personal recovery builds, or find or build some other sort of solution.
I actually stumbled right to here.
So say, @topjohnwu would you happen to be able to drop any of us a plug-in module or a quick how to for those of us who ARE GOING TO KILL DEVICES ANYWAY playing with this stuff?
I'd definitely beta test any of that, @topjohnwu I was taking apart your Magisk and reversing/modding parts of it to accomplish some dificult things in one of my devices and wanted to compliment your clean style in your scripts.
I was thinking to my self that day though ,
"Could I change some things to make an option to switch between several GSI system.img stored on sdcard thats partially formatted ext4... and perhaps have it ask me which slot.." When thinking about it, if I make several 4-5 GB ext4 partitions on my sdcard I should be able to write a system.img to each of those partitions, then have magisk take a user selection and boot the system from that partition....{speaking about an arm a-only device}
it would become more difficult with system-as-root though wouldn't it? I'd think it would be possible to do some sort of fstab muckery where the script looks for these partitions, u choose 1, it sets a variable, and restarts the boot process with that VAR set to boot the system on chosen partition....
IDK I bet Mr John WU probably has it already worked out but these are just a few of the things we are messing with over at my support/development group on Telegram..
https://t.me/Android_General_Chat

LgPWN'd said:
Hey Buddy, Long time no see... Since the android forums days i guess it was.
I ended up here because i was searching to see if there was perhaps a magisk module to enable this as a test feature? or if there was a bit better documentation on how this would work...
My team and I have been deving for some alcatel mtk devices, and we are searching for info to either add multi/dual boot functions to our personal recovery builds, or find or build some other sort of solution.
I actually stumbled right to here.
So say, @topjohnwu would you happen to be able to drop any of us a plug-in module or a quick how to for those of us who ARE GOING TO KILL DEVICES ANYWAY playing with this stuff?
I'd definitely beta test any of that, @topjohnwu I was taking apart your Magisk and reversing/modding parts of it to accomplish some dificult things in one of my devices and wanted to compliment your clean style in your scripts.
I was thinking to my self that day though ,
"Could I change some things to make an option to switch between several GSI system.img stored on sdcard thats partially formatted ext4... and perhaps have it ask me which slot.." When thinking about it, if I make several 4-5 GB ext4 partitions on my sdcard I should be able to write a system.img to each of those partitions, then have magisk take a user selection and boot the system from that partition....{speaking about an arm a-only device}
it would become more difficult with system-as-root though wouldn't it? I'd think it would be possible to do some sort of fstab muckery where the script looks for these partitions, u choose 1, it sets a variable, and restarts the boot process with that VAR set to boot the system on chosen partition....
IDK I bet Mr John WU probably has it already worked out but these are just a few of the things we are messing with over at my support/development group on Telegram..
https://t.me/Android_General_Chat
Click to expand...
Click to collapse
Very good write up on Tue thoughts of how one could achieve what we have in thought at this moment. I have similar thoughts but haven't taken them very deep as most know I'm back And fourth between handsets and ideas. Good work. Perhaps the top hat Mr John wu can elaborate a bit more on this subject matter.

Have you solved the problem?
Teach me please

SupraLance said:
I've done tons of reading, can't seem to find the answer to this question either
Maybe @topjohnwu can chime in here...
Click to expand...
Click to collapse
Perhaps he can. When we get around to building recoveries for the Schokk Turbo and Schokk Turbo XL along with more solid verions for the Orbic Wonder and Orbic Slim I want to get the team working on a custom verison or plugin. That and or EFI Droid which is might interesting... Here check it out - https://efidroid.org/ - https://forum.xda-developers.com/android/general/poll-recovery-t3942781 .
Btw are you a sys admin? I know a Lance that was a SYS Admin for a local ISP. I'm a stones throw away from your county.

Any solutions ever become of this idea? Curious to know.

noidodroid said:
Any solutions ever become of this idea? Curious to know.
Click to expand...
Click to collapse
Bump

[GUIDE] Re-locking the bootloader on the OnePlus 6t with a self-signed build of LOS

What is this tutorial?
This tutorial will:
Creating an unofficial build of LineageOS 17.1 suitable for using to re-lock the bootloader on a OnePlus 6/6t
Take you through the process of re-locking your bootloader after installing the above
This tutorial will NOT:
Remove *all* warning messages during boot (the yellow "Custom OS" message will be present though the orange "Unlocked bootloader" message will not)
Allow you to use official builds of LineageOS 17.1 on your device with a re-locked bootloader (more details near the end of the tutorial)
This tutorial will assume you are working on an Ubuntu 18.04 installation, if you are using Windows or another Linux distro, the commands may be different.
Supported devices:
Current both the OnePlus 6 (enchilada) and 6t (fajita) have been tested, but newer phones should work as well.
For simplicities sake, all further references will only be to the 6t (fajita).
Pre-requisites:
a mid level knowledge of terminal commands and features
a supported phone
a PC with enough CPU/RAM to build LineageOS 17.1 (recommended 8 cores, 24g of RAM)
a working USB cable
fastboot/adb installed and functional
LineageOS 17.1 source code downloaded
at least one successful build of LineageOS
at least one successful signing of your build with your own keys
Misc. notes:
the basics of building/signing of LineageOS is outside the scope of this tutorial, refer to the LineageOS Wiki for details on how to complete these tasks
you'll be modifying some code in LineageOS, so if you are not comfortable using basic editing utilities as well as patch, do not proceed any further
the path to your LineageOS source code is going to be assumed to be ~/android/lineageos, if it is somewhere else, substitute the correct path in the tutorial
the path to your private certificate files is going to be assumed to be ~/android-certs, if it is somewhere else, substitute the correct path in the tutorial
*** WARNING ****
This process may brick your device. Do not proceed unless you are comfortable taking this risk.
*** WARNING ****
This process will delete all data on your phone! Do not proceed unless you have backed up your data!
*** WARNING ****
Make sure you have read through this entire process at least once before attempting, if you are uncomfortable with any steps include in this guide, do not continue.
And now on with the show!
Step 1: Basic setup
You need a few places to store things, so create some working directories:
Code:
mkdir ~/android/fajita
mkdir ~/android/fajita/oos
mkdir ~/android/fajita/images
mkdir ~/android/fajita/images_raw
mkdir ~/android/fajita/patches
mkdir ~/android/fajita/pkmd
You also need to add "~/android/lineageos/out/host/linux-x86/bin" to your shell's profile path. Make sure to close and restart your session afterwards otherwise the signing will fail later on with a "file not found" error message .
Step 2: Download the latest OxygenOS from OnePlus
Go to https://www.oneplus.com/support/softwareupgrade and download the latest OOS update, store it in ~/android/fajita/oos
Step 3: Extract the vendor.img from OOS
Run the following commands to extract the vendor.img from OOS:
Code:
cd ~/android/fajita/oos
unzip [oos file name you downloaded] payload.bin
cd ../images_raw
python ~/android/lineageos/lineage/scripts/update-payload-extractor/extract.py --partitions vendor --output_dir . ../oos/payload.bin
You should now have a ~1g file named vendor.img in the images_raw directory.
Step 4: Update fajita's BoardConfig.mk
You will need to add a few parameters to the end of ~/android/lineageos/device/oneplus/fajita/BoardConfig.mk, they are:
Code:
BOARD_PREBUILT_VENDORIMAGE := /home/<userid>/android/fajita/images_raw/vendor.img
AB_OTA_PARTITIONS += vendor
BOARD_AVB_ALGORITHM := SHA256_RSA2048
BOARD_AVB_KEY_PATH := /home/<userid>/.android-certs/releasekey.key
Note you cannot use "~"" in the path names above to signify your home directory, so give the full absolute path to make sure the files are found.
Step 5: Update sdm845-common's BoardConfigCommon.mk (optional)
LineageOS by default disables Android Verified Boot's partition verification, but you can enable it now as all the required parts will be in place. However, you may not want to if you intend to make other changes to the system/boot/vendor partitions (like Magisk, etc.) after you have re-locked the bootloader.
To enable partition verification do the following:
Code:
cd ~/android/lineageos/devices/sdm845-common
sed -i 's/^BOARD_AVB_MAKE_VBMETA_IMAGE_ARGS += --flag 2/#BOARD_AVB_MAKE_VBMETA_IMAGE_ARGS += --flag 2/' BoardConfigCommon.mk
Step 6: Patch the AOSP/LineageOS releasetools
Two releasetools included with LineageOS need to be patched as they otherwise will not properly process a pre-built vendor.img.
The required patches can be found here:
https://raw.githubusercontent.com/W.../source/add_img_to_target_files.py-17.1.patch
https://raw.githubusercontent.com/W...r/source/sign_target_files_apks.py-17.1.patch
Download both and store in ~/android/fajita/patches.
Now apply them with the following commands:
Code:
cd ~/android/lineageos/build/tools/releasetools
patch add_image_to_target_files.py ~/android/fajita/patches/add_image_to_target_files.py-17.1.patch
patch sign_target_files_apks.py ~/android/fajita/patches/sign_target_files_apks.py-17.1.patch
Step 7: Build LineageOS
You are now ready to build:
Code:
cd ~/android/lineageos
source build/envsetup.sh
croot
breakfast fajita
mka target-files-package otatools
Step 8: Prepare vendor.img
As part of the build process above, your raw vendor.img will been copied to the $OUT directory and a new hashtree (what AVB uses to verify the image) will have been added to it.
You need to use this new version in the signing process but due to how the build system works, this is not done by default.
So, let's put it where it is needed:
Code:
cp $OUT/obj/PACKAGING/target_files_intermediates/lineage_fajita-target_files-eng.*/IMAGES/vendor.img ~/android/fajita/images
Step 9: Sign the APKs
You are now ready to sign the apks with sign_target_files_apks:
Code:
./build/tools/releasetools/sign_target_files_apks -o -d ~/.android-certs --prebuilts_path ~/android/fajita/images $OUT/obj/PACKAGING/target_files_intermediates/*-target_files-*.zip signed-target_files.zip
Note the new "--prebuilts_path" option, which points to where your new vendor.img file is located.
Step 10: Build the OTA
Now it is time to complete the OTA package:
Code:
./build/tools/releasetools/ota_from_target_files -k ~/.android-certs/releasekey --block signed-target_files.zip lineage-17.1-[date]-UNOFFICIAL-fajita-signed.zip
Note, replace [date] with today's date in YYYYMMDD format.
Step 11: Create pkmd.bin for your phone
Before you can lock your phone, you have to tell it what your public key is so it knows it can trust your build.
To do this you need to create a pkmd.bin file:
Code:
~/android/lineageos/external/avb/avbtool extract_public_key --key ~/.android-certs/releasekey.key --output ~/android/fajita/pkmd/pkmd.bin
Step 12: Flashing your LineageOS build
It's time to flash your build to your phone. The following steps assume you have already unlocked your phone and have flashed an official version of LineageOS to it. You don't need to have flashed LineageOS yet, you could use TWRP through "fastboot boot" if you prefer.
Reboot your phone in to recovery mode
In LineageOS Recovery select "Apply update"
From your PC, run:
Code:
adb sideload ~/android/lineageos/lineage-17.1-[date]-UNOFFICIAL-fajita-signed.zip
When the sideload is complete, reboot in to LineageOS. Make sure everything looks good with your build.
You may also need to format your data partition at this time depending on what you had installed on your phone previously.
Step 13: Flashing your signing key
Now it's time to add your signing key to the Android Verified Boot process. To do so, do the following:
Reboot your phone in to fastboot mode
From your PC, run:
Code:
fastboot flash avb_custom_key ~/android/fajita/pkmd/pkmd.bin
fastboot reboot bootloader
fastboot oem lock
On your phone, confirm you want to re-lock and it will reboot
Your phone will then factory reset and then reboot in to LineageOS.
Which of course means you have to go through the first time setup wizard, so do so now.
Step 14: Disable OEM unlock
Congratulations! Your boot loader is now locked, but you can still unlock it again using fastboot, so it's time to disable that as well.
Unlock you phone and go to Settings->About phone
Scroll to the bottom and find "Build number"
Tap on it you enable the developer options
Go to Settings->System->Advanced->Developer options
Disable the "OEM unlocking" slider
Reboot
Step 15: Profit!
Other things
The above will build a standard USERDEBUG version of LineageOS, however this will still allow LineageOS Recovery to sideload non-signed files. If you have implemented step 5 above, then this protects your system/vendor/boot/dtbo partitions, but none of the others. Likewise USERDEBUG builds will allow for rolling back to a previous version. To increase security and disallow both of these scenarios you may want to build a USER version of LineageOS to install. However this brings in other issues, such as flashing newer firmware from OnePlus so make sure you understand the implications of both choices. For more details on build types, see https://source.android.com/setup/develop/new-device#build-variants.
In the above example the releasekey from your LineageOS install has been used to sign AVB, but AVB supports other key strengths up to SHA512_RSA8192. You could create a key just for signing AVB that used different options than the default keys generated to sign LineageOS.
If you want to remove you signing key from your phone, you can do it by running "fastboot erase avb_custom_key".
The changes you made to the make files and releasetools may conflict with future updates that you pull from LineageOS through repo sync, if you have to reset the files to get repo sync to complete successfully, you'll have to reapply the changes afterwards.
So why can't I do this with official LineageOS builds?
For Android Verified Boot (AVB) to work, it must have the hash values for each of the system/vendor/boot/dtbo partitions stored in vbmeta. Official LineageOS builds do not include the vendor.img in them (for fajita at least, other phones may), instead simply using the existing partition on the phone.
That means that there is no vendor.img information in vbmeta for the official builds, which means AVB will fail to verify it during boot and give the red corruption message and halt the boot process after you have re-locked the bootloader.
And since you cannot add to vbmeta without the LineageOS private key, which only the LineageOS signing server has, you cannot add it.
This means you must do a full build with new signing keys to make it work.
Theoretically you could pick apart a LineageOS release, rehash the system/vendor/boot/dtbo and then recreate vbmeta and the payload.bin file, but that brings a host of other issues. For example, since such a "build" would look like a full LinageOS release, if you ever accidentally let the updater run it would brick (soft) that slot and you'd have swap back to your other slot to boot again. In an extreme case, if you managed to corrupt the second slot somehow you'd have to wipe your entire and recover from the brick with one of the available tools to do so.
Ok, what messages do I see during the boot process then?
During a boot you will of course see the standard OnePlus power up screen, followed by the yellow "custom os" message an then the stardard LineageOS boot animation.
For more details on AVB boot messages, see https://source.android.com/security/verifiedboot/boot-flow
So what do those two patches to the release tools do?
AOSP/LineageOS's add_image_to_target_files.py detects if a vendor.img file already exists, and if so, simply includes it in the build process. The patch adds one extra step, so that AVB is being enabled for the build, it will replace the existing hashtree on vendor.img using the same salt and other options as will be used on system/boot/dtbo. This ensure that when vbmeta is generated, it has the right information from vendor.img.
The script is called from the make system as part of the "mka target-files-package otatools" and the appropriate parameters from the make system, like "BOARD_PREBUILT_VENDORIMAGE", are used to create arguments to the script to build the standard image files as well as include the prebuilt vendor.img.
This script is used both during the initial build as well as the signing process, but this change is only targeted at the build time implementation. During signing, the script uses whatever hashtrees are in place and does not regenerate them.
AOSP/LineageOS's sign_target_files_apks.py is responsible for signing the APKs that have been built as part of "mka target-files-package otatools", unfortunately it is not part of the "make" system, so settings like "BOARD_PREBUILT_VENDORIMAGE" do not impact the script. This means that sign_target_files_apks.py does not have any knowledge that it should be including a pre-built vendor.img, even though it is in the $OUT directory waiting to be used.
The patch adds a new parameter to the script (--prebuilts_path), so that during the signing process, any image files found in the provided path, will be included in the process. So make sure that only vendor.img is in the provided directory. This is a directory instead of a single file as future uses may be to include things like firmware, other partition types, etc. in to the signing process.
Thank you's
Obviously to all of the members of the LineageOS team!
LuK1337 for supporting fajita
optimumpro for the OnePlus 5/5t re-locking guide (https://forum.xda-developers.com/oneplus-5/how-to/guide-relock-bootloader-custom-rom-t3849299) which inspired this one
Quark.23 for helping with the process and testing on enchilada

Nice , Will this enable widewine L1?

jsidney96 said:
Nice , Will this enable widewine L1?
Click to expand...
Click to collapse
I don't believe there is a connection between the two.

WhitbyGreg said:
I don't believe there is a connection between the two.
Click to expand...
Click to collapse
If you unlock bootloader on phones supporting L1 they drop to L3. I know some Oneplus phones (op6 etc.) did not support L1 even on stock.

cowgaR said:
If you unlock bootloader on phones supporting L1 they drop to L3. I know some Oneplus phones (op6 etc.) did not support L1 even on stock.
Click to expand...
Click to collapse
Yeah.. It brings it to L1
Great writeup @WhitbyGreg
As Android security gets tighter and tighter, hoping one day all ROMs would support AVB by default..
---------- Post added at 06:16 PM ---------- Previous post was at 05:48 PM ----------
Curious question here,
WhitbyGreg said:
*** will build a standard USERDEBUG version of LineageOS, however this will still allow LineageOS Recovery to sideload non-signed files. If you have implemented step 5 above, then this protects your system/vendor/boot/dtbo partitions, but none of the others. Likewise USERDEBUG builds will allow for rolling back to a previous version. To increase security and disallow both of these scenarios you may want to build a USER version of LineageOS to install. However this brings in other issues, such as flashing newer firmware from OnePlus so make sure you understand the implications of both choices***
Click to expand...
Click to collapse
After a launch of any phone, how drastic are such firmware updates to bother about? In other words, Unless we're in stock ROM is it mandatory to update phone firmware?

arvindgr said:
Yeah.. It brings it to L1
Click to expand...
Click to collapse
Good to know.
arvindgr said:
Great writeup @WhitbyGreg
As Android security gets tighter and tighter, hoping one day all ROMs would support AVB by default..
Click to expand...
Click to collapse
That would be nice but more importantly, more phones need to support re-locking.
arvindgr said:
Curious question here,
After a launch of any phone, how drastic are such firmware updates to bother about? In other words, Unless we're in stock ROM is it mandatory to update phone firmware?
Click to expand...
Click to collapse
Reasonably important, after all, if you never get firmware updates you'll have outdated security patching for the firmware. Some official LOS builds require newer versions of the firmware as they are released and won't install without it.

This guide was very helpful to me when re-locking my Oneplus 7T and enabling hash/hashtree verification. A dude on telegram had actually sent me the link and I only briefly skimmed over. Ironically when looking for patches to fix my issues after attempting to include pre-built vendor/odm and failing I cross referenced and ended up back here.
Here's where I originally found them:
https://review.lineageos.org/c/LineageOS/android_build/+/278015
https://review.aosip.dev/c/AOSIP/platform_build/+/13385
I myself have made some more patches to ensure every possible pre-built image gets signed on my builds. After some experimentation I have found it possible to have Magisk with hash verification enabled
https://github.com/Geofferey/omni_android_build/commits/geofferey/android-10
There is also a fix to ensure appropriate args get passed when regenerating hashtree for pre-built vendor.

Geofferey said:
This guide was very helpful to me when re-locking my Oneplus 7T and enabling hash/hashtree verification.
Click to expand...
Click to collapse
So you can confirm you have relocked the bootloader on the 7T with AVB enabled?
Geofferey said:
A dude on telegram had actually sent me the link and I only briefly skimmed over. Ironically when looking for patches to fix my issues after attempting to include pre-built vendor/odm and failing I cross referenced and ended up back here.
Here's where I originally found them:
https://review.lineageos.org/c/LineageOS/android_build/+/278015
https://review.aosip.dev/c/AOSIP/platform_build/+/13385
Click to expand...
Click to collapse
Yes, those are my patches that I've submitted to LOS, I also have two other patches submitted to allow for other prebuilt images (aka firmware images) to be included in the build process.
Geofferey said:
I myself have made some more patches to ensure every possible pre-built image gets signed on my builds. After some experimentation I have found it possible to have Magisk with hash verification enabled
https://github.com/Geofferey/omni_android_build/commits/geofferey/android-10
There is also a fix to ensure appropriate args get passed when regenerating hashtree for pre-built vendor.
Click to expand...
Click to collapse
I'll take a look and see if I need to update any of my submissions, thanks.

I will have to update those commits with you as author. I messed that up and set person who picked yours as author. I am sorry. BTW thank you for those patches they were a lifesaver and inspired me.
Yes, I can confirm re-lock with AVB enabled on 7T works and also with hash verification. If I flash an image not signed by the build process with hash verification enabled I go red. Currently I am working on getting magisk directly integrated with build instead of using prebuilt patched imgs that cause builds to not pass CTS.

Geofferey said:
Currently I am working on getting magisk directly integrated with build instead of using prebuilt patched imgs that cause builds to not pass CTS.
Click to expand...
Click to collapse
Why do you want to put Magisk if you went to all the trouble of having avb with a locked bootloader? Isn't rooting defeating the purpose of avb?

quark23 said:
Why do you want to put Magisk if you went to all the trouble of having avb with a locked bootloader? Isn't rooting defeating the purpose of avb?
Click to expand...
Click to collapse
No, it does not defeat the purpose... Hashtree verification will still happen since root can be included in the build as opposed to flashing after the fact. In a way it's actually even more advised. The way I think, having root may lead to a means of being exploited but true AVB closes the door to any persistent rootkits that may try to modify partitions at block level. If ANYTHING modifies the verified partitions phone will refuse to boot and I will be protected. Doing exactly what AVB is supposed to do, verify the phone is in it's intended state. I also think of phone as a computer, you have root access on Linux, Windows and even Mac for Christ sake, why shouldn't it be the same for phones? The ONLY reason we don't by default is so manufacturers and carriers can stay in control. I've been rooting and modifying phones for years without AVB and yet to have a known breech of my data besides the Google apps constantly collecting on me. This just adds another level of security that I used to sacrifice in order to have root access.
Here is my PoC to include Magisk in builds so dm-verity can be kept enabled. Just two commits. If someone could make this better that would be really cool.
https://github.com/Geofferey/omni_android_build/commit/d60958780e6b26d7cb0cec5939b82df3df74a68f
https://github.com/Geofferey/android_vendor_magisk

I have rooted for testing and you don't gen any warning. The way avb works on my phone is it discards any modification after reboot. With no warning at boot time. If you get hacked, you can have persistent hacks with root. Make a modification from twrp with avb enabled and see for yourself.
You break the Android security model by rooting the phone. If you need certain things you can include them at build time, such as a custom hosts file.
Also, what can you do with root that does not alter the hashtree?
The power you mention is of no real use yet you expose yourself by having it. Sure, you can go by without any issues. The problem is if you happen to get hacked, the attacker has full control over your phone. You won't br able to get rid of it by rebooting.
Also I see no way for google to collect data in this setup, with or without root. Afwall has an equivalent in android 10 (that mobile data & wifi setting) and inter process comms are the real issue if you are worried about rogue apps. Afwall leaks dns requests like crazy anyway.
I say you are better off letting root go and include what you need at build time. I see that as better spent effort than trying to add root.

quark23 said:
I have rooted for testing and you don't gen any warning. The way avb works on my phone is it discards any modification after reboot. With no warning at boot time. If you get hacked, you can have persistent hacks with root. Make a modification from twrp with avb enabled and see for yourself.
Click to expand...
Click to collapse
So you built your ROM from source with root included, had TWRP go through signing and was able to modify system and other partitions without receiving a device corrupt message? I highly doubt AVB is even implemented appropriately if you were able to do so. If it is implemented it sounds like the old version, tho I remember if I violated FS too much it wouldn't be able to fix and failed to boot. Having a locked bootloader because AVB is enabled does not mean dm-verity is enabled. Also, it should be nearly impossible to just write things like files to /system or w.e. if you are on a device that ships with 10.
quark23 said:
You break the Android security model by rooting the phone. If you need certain things you can include them at build time, such as a custom hosts file.
Click to expand...
Click to collapse
I know it does, but I am not doing such small things as modifying a host file. The kinds of things I include in my personal ROMs require such a high level of access to the point where I can not write SE polices that will allow me to pass CTS and spit out user builds without serious modifications to the build env.
quark23 said:
Also, what can you do with root that does not alter the hashtree?
The power you mention is of no real use yet you expose yourself by having it. Sure, you can go by without any issues. The problem is if you happen to get hacked, the attacker has full control over your phone. You won't b able to get rid of it by rebooting.
Click to expand...
Click to collapse
The act of flashing Magisk is what breaks AVB, if you include it in the ROM at build time like I am doing then it doesn't need to be flashed. It makes modifications to the system by binding data from the wipeable data partition to /system/. If something utilizes that to install a backdoor or tunnel it goes bye-bye when I wipe. If something utilizes it to flash anything or modify system device no boot.
quark23 said:
Also I see no way for google to collect data in this setup, with or without root. Afwall has an equivalent in android 10 (that mobile data & wifi setting) and inter process comms are the real issue if you are worried about rogue apps. Afwall leaks dns requests like crazy anyway.
Click to expand...
Click to collapse
You're kidding right? Android solely exist as a mean for Google to collect data. That was the whole idea behind Android. Buy & develop an OS that any manufacturer can put on their device, let them certify for Google Play Services and collect the data that powers their ad platform. They certainly didn't opensource their baby for free. If you allow ports 80 and 443 out with inbound related allowed, that's all they need.
quark23 said:
I say you are better off letting root go and include what you need at build time. I see that as better spent effort than trying to add root.
Click to expand...
Click to collapse
I'd just rather the manufactures and Google would implement a root solution that plays nice with Androids security instead of making us resort to violating it. It's funny to me that we find it acceptable for these fools to maintain control of something you purchased with your hard earned dollars because they think we are too stupid to have it. Like I stated root and admin privileges are fully available to us on nearly any PC but phones for some reason are an exception.
_________________________________________________
I could rant and debate about this forever... Fact of matter is, you don't have to disable every Android security feature to have root.

I didn't build with magisk, I just flashed after building.
But you can try and modify anything on /system or /vendor from twrp, without magisk, without locking the bootloader, and see what happens. Avb discards the modification, but doesn't warn you. Curious of your findings regarding this. If you then flash magisk, you ofc break the hashtree and avb and the mods remain persistent.
I understand that you are building with magisk included in the hashtree. What I am wondering is what exactly are you wanting root for? What are you doing with root that does not break the hashtree?
Regarding the data collection, you lost me. What exactly is being collected on a LOS userbuild without google services? Got any dns logs or mitm wireshark packets to show? What service exactly is collecting what kind of data? Google's dns servers can be replaced before building, Greg has some scripts for that. Captive portal can also be replaced or turned off. Apart from that, and any apps you add yourself, what kind of data is being collected as I want to check it out myself. I've monitored my phone and it's pretty silent. Whatever goes out is from additional apps I use. But I don't see anything from LOS. Really curious about this.
Regarding your last point I think it's something akin to risking shooting yourself in the foot by having root by default. I understand (somewhat) the security model and I find it smart to not have it by default. Also Android uses selinux more than your standard linux distro does. There are some differences in the security models between android and pc linux distro.
I'm really hapoy that AOSP exists. Also pretty happy with the LOS project. My problem is with the outdated blobs. Maybe I'll get a Pixel at some point and give GrapheneOS a go. Seems like a really nice project.
Managed to get hardened malloc + Vanadium on LOS atm and I'm liking the browser. Overall I think AOSP is a great project. Not a fan of google's privacy policy but they do make great stuff.

quark23 said:
I understand that you are building with Magisk included in the hashtree. What I am wondering is what exactly are you wanting root for? What are you doing with root that does not break the hashtree?
Click to expand...
Click to collapse
Ah, there lies the real question. I am including in my personal builds a Debian Linux chroot that gets extracted to /data/ so I can run Linux services, etc. I have customized the chroot with Openvpn so that it connects to my server and essentially allows me back into device wherever it may lay. Basically I am adding in the stuff of nightmares that all this security is supposed to prevent. That is why I want dm-verity, because I know I am leaving my self partially open by doing so. I have a decent understanding of dm-verity and have confirmed that it does and will protect me against the scenarios I imagine. BTW it operates completely differently in locked state vs. unlocked.
quark23 said:
Regarding the data collection, you lost me. What exactly is being collected on a LOS userbuild without google services?
Click to expand...
Click to collapse
Well, if you're the type of person who doesn't require Google Play Services, nothing of course. I was merely stating that Google had open sourced Android in hopes that manufacturers would adopt the OS and qualify their devices for Google PS so that it could be used as a data collection platform. You won't easily see all the information Google collects in a Wireshark log because it is encrypted of course. LOS better be silent as hell without it or I'd contact that dev with a strongly worded message lmfao.
quark23 said:
Regarding your last point I think it's something akin to risking shooting yourself in the foot by having root by default. I understand (somewhat) the security model and I find it smart to not have it by default. Also Android uses selinux more than your standard linux distro does. There are some differences in the security models between android and pc linux distro.
Click to expand...
Click to collapse
Oh I DO NOT think it should just be enabled by default. If I had my way it would be enabled in dev ops requiring authentication and protected via a different password than the one you use to unlock the device once setup. You'd also require those "root" privileges to OEM unlock once enabled. While those features were enabled you'd be warned on boot as well but without locking you out of apps etc because that kind of sensitive data should be handled by TEE and TZ. In a real Linux operating system that hasn't been fundamentally raped to offer a false sense of security in the name of protecting carriers and manufactures you can modify SE linux policies etc, not while live but without compiling from source. A lot of us forget most these security features exist more to protect their interest and attempt to hide what's going on behind the scenes. I've actually heard of some pretty shady stories where manufacturers in China place ad-tappers that run in background on devices running GooglePS to be sold in US, so it definitely doesn't protect you if the person building your phone is shade.
quark23 said:
I'm really hapy that AOSP exists. Also pretty happy with the LOS project. My problem is with the outdated blobs. Maybe I'll get a Pixel at some point and give GrapheneOS a go. Seems like a really nice project.
Managed to get hardened malloc + Vanadium on LOS atm and I'm liking the browser. Overall I think AOSP is a great project. Not a fan of google's privacy policy but they do make great stuff.
Click to expand...
Click to collapse
Me too mate. . AOSP has taught me a lot about development and coding in general. Sadly outdated blobs are a usually a by-product of using pre-builts from manufacturers that don't update as often. Pixel would be way to go if that's a concern. I honestly just think a lot of the security is abused to suit their needs. I am just trying to turn it around to work for me where it can.

If you repo sync you should run the vendor files script as there's a couple of new files added. The Muppets github has been updated with them as well. If you don't your build will fail at first power on.

A quick question, forgive me if this is obvious: am I correct in assuming that one the above has been completed and the device is using a locally-built copy of Lineage OS, that I cannot take advantage of OTA updates? I just want to know what I'm getting in to before wiping my phone multiple times.
Thanks in advance, this thread is massively helpful.

nictabor said:
A quick question, forgive me if this is obvious: am I correct in assuming that one the above has been completed and the device is using a locally-built copy of Lineage OS, that I cannot take advantage of OTA updates? I just want to know what I'm getting in to before wiping my phone multiple times.
Thanks in advance, this thread is massively helpful.
Click to expand...
Click to collapse
Correct, though if you setup your own update server you can still use the inbuilt updater app if you want.

I just happened across this thread searching for a proper way to generate the custom avb key. I thought i had found it at one time on aosp documentation but i lost/forgot where it was.
Anyways, I have a quick q about this. Would I be correct in assuming that if i wanted gapps to be available in my build, I would need to include it during build time and not be able to flash it as per the typical methods?
I am pretty sure I won't be able to but wanted to ask here for you guys' experiences.
Also, @WhitbyGreg you should be able to i believe. just setup the url properly and host it somewhere with direct download links. (This also requires setup of json for the updater to monitor for updates)

klabit87 said:
Would I be correct in assuming that if i wanted gapps to be available in my build, I would need to include it during build time and not be able to flash it as per the typical methods?
Click to expand...
Click to collapse
Correct (at least as far as I know), once the bootloader is relocked any modification of the system partition (like adding the play services) would trigger an AVB failure.

General Flashing GSI on Edge S/20 Pro (Magisk enabled)

First of all, thanks to ilia3367 for his Pure Edition ROM which contains some very useful stuffs for flashing and booting GSI.
Code:
/*
* Your warranty is now void.
*
* I am not responsible for bricked devices, dead SD cards,
* thermonuclear war, or you getting fired because the alarm app failed. Please
* do some research if you have any concerns about features included in the GSI
* before flashing it! YOU are choosing to make these modifications, and if
* you point the finger at me for messing up your device, I will laugh at you.
*/
What you need
1. Unlocked bootloader
Follow this guide to unlock bootloader. In overall, the unlock process is not as difficult compared to other brands, provided your device is eligible to unlock.
WARNING: The following steps assume you have already unlocked your bootloader. If you haven't unlocked your bootloader yet, or your device isn't eligible, DO NOT PROCEED.
2. fastboot
The process utilizes fastboot exclusively, so make sure you have fastboot installed.
3. A Magisk patched boot.img.
You can either patch it yourself using Magisk Manager, or use boot_magisk.img from Pure Edition ROM.
Although you should be able to use GSI without Magisk, you'll probably need to patch vbmeta (or vbmeta_system) so the stock kernel won't refuse to boot the GSI in this case. This guide does not cover non-Magisk scenario for now, as I'm not entirely sure. With Magisk, patching vbmeta is not needed.
4. A backup of factory images in case something goes wrong.
The factory image (both S and 20 Pro) can be found in the Pure Edition ROM thread as well.
Steps to flash GSI
1. Enter fastboot
Hold down both POWER and VOL- to enter fastboot mode.
Or you can use the following adb command to do so.
Code:
adb reboot bootloader
2. Enter fastbootd
Enter the following command to enter fastbootd, where you can actually access the system partitions, as this phone uses Dynamic Paritions.
Code:
fastboot reboot fastboot
WARNING: The following steps will actually modify your system partitions and may leave your phone unbootable. Make sure you have backed up everything before proceeding.
3. Flash Magisk patched boot.img
Assume you have the Magisk patched boot.img as boot_magisk.img, enter the following command.
Code:
fastboot flash boot boot_magisk.img
Note that you can also flash boot.img directly from fastboot, before entering fastbootd.
4. Remove the product partition
The phone's system partition is very small (about 1GB), but has a very big product partition (about 2.7GB). You'll get an error if you try to flash the GSI right away, as the super partition does not have enough room to resize the system partition to hold the GSI image if it's too large.
As the product partition is not useful for GSIs, it can be safely removed. Enter the following commands.
Code:
fastboot erase product
fastboot resize-logical-partition product_a 0x0
This will erase the stuffs in the product partition and set its size to zero, so the system partition would be able to claim its space when resizing.
You can always use the following command to check bootloader variables.
Code:
fastboot getvar all
In this case, check if the product_a partition has indeed been resized to zero. If yes, you can proceed.
Code:
(bootloader) partition-size:product_a:0x0
5. Flashing the GSI
Enter the following commands.
Code:
fastboot erase system
fastboot flash system gsi.img
Note that the erase command is optional. Replace gsi.img with the actual GSI image file of your choice.
6. Wipe userdata if needed
You don't need to wipe userdata if you are dirty flashing newer build of a same GSI over the existing one.
In case you need to do so (such as flashing a different GSI, or factory reset), enter the following commands.
WARNING: These commands will erase everything in the internal storage, not just app data! Make sure you have everything in the internal storage backed up before doing this. You may try this unofficial TWRP for this device if you want to perform factory reset while keeping your files, as well as creating a nandroid backup.
Code:
fastboot erase userdata
fastboot erase metadata
7. Reboot
Enter the following command to reboot.
Code:
fastboot reboot
If nothing goes wrong and the GSI doesn't have any major issue that might prevent it from successfully booting, you should be able to boot the GSI and further configure it yourself.

I'm still experimenting with GSI so I'm not sure which feature works and which doesn't.
The GSI I'm currently testing is DotOS. Different GSIs may produce different results but should be mostly similar.
For now it seems the following stuffs are working fine:
- Wi-Fi
- Bluetooth (Audio is problematic, other parts appear to work fine)
- 5G (Data)
- NFC
- Camera
- Display color settings (such as Boosted, Saturated)
- Fingerprint Sensor (Turned out it works!)
- Encryption (GSI can work with untouched vendor, which enforces encryption)
- 120/144 fps (On GSI it defaults to 120 fps, which can be changed in Phh-Treble settings)
The following stuffs are problematic:
- MTP (I recommend using ADB as it's a hit-or-miss on Linux. On some environments it works, on other environments it doesn't)
- Bluetooth Audio (Need to enable "alternate audio policy" and also "Force disable A2DP offload" for headsets to work correctly)
The following stuffs are not working:
- VoLTE (While you can enable "Force the password of 4G Calling setting" in Phh Treble Settings -> IMS features" then toggle it off then on upon system startup to make it active, it does not work correctly!)
Here are some functionalities that I won't be able to test as I'm not actually using them.
- SafetyNet related (I use microG now)
- USB Type-C Audio (I mainly use bluetooth headsets if needed for all except gaming)
- SIM2 (I'm confident it'll work as both SIM slot's IMEIs are correctly detected)
- Carrier-specific issues (Need someone using Verizon or other GSI-problematic carriers to test this)

Currently I've tested that the most recent DotOS, OctaviOS GSIs are working.
Keep in mind that not all GSIs can boot. You'll need to look for another build if the one you flashed doesn't boot correctly (which seems to be SELinux related).
For now, most of the functionalities work on GSI using a Magisk patched stock kernel and untouched vendor. The kernel source for RRA31 build (Global) is currently in the process of being released.
UPDATE (11/3/2021): The source code is now available.

but i've still have a question for the step 5
this mobile is a/b slot but you didn't use fastbootd mode is that work?

ZhenYuSAMA said:
but i've still have a question for the step 5
this mobile is a/b slot but you didn't use fastbootd mode is that work?
Click to expand...
Click to collapse
Step 2 is switching to fastbootd. The rest of the commands are done in fastbootd mode.
fastbootd uses the same syntax as fastboot.
This phone uses dynamic partitions, but is also A/B. Usually you would be on slot A if it's a new phone, but be sure to pay attention to active slot if the phone has taken OTA updates before.
I don't know if there are already OTA updates out, though this phone is still relatively new.

LSS4181 said:
Step 2 is switching to fastbootd. The rest of the commands are done in fastbootd mode.
fastbootd uses the same syntax as fastboot.
This phone uses dynamic partitions, but is also A/B. Usually you would be on slot A if it's a new phone, but be sure to pay attention to active slot if the phone has taken OTA updates before.
I don't know if there are already OTA updates out, though this phone is still relatively new.
Click to expand...
Click to collapse
whoa, now i see much thx

I tried DotOS 5.2 since i don't have volte on my area, and it was usable, only thing that annoyed me a little is CPU being capped at 2500MHz. Do you know how to have the same frecuency config as with the stock ROM?. With stock i noticed everytime i open a benchmark app the CPU stays at max frecuency on all cores even if it's not running the actual benchmark.
I don't have much knowledge with tweaking system code since the phone i had before had every ROM in every flavor already optimized (k20 pro) and with this one i'm getting a little bit bored to be honest so i wanted to do something myself but i couldn't get around those frecuency issues. Tried with Franco Kernel Manager and EX, the frecuecies applied but after around 1 minute everything went back to default.
Also, did you try the stock camera app?
Thanks.

rodrimax10 said:
I tried DotOS 5.2 since i don't have volte on my area, and it was usable, only thing that annoyed me a little is CPU being capped at 2500MHz. Do you know how to have the same frecuency config as with the stock ROM?. With stock i noticed everytime i open a benchmark app the CPU stays at max frecuency on all cores even if it's not running the actual benchmark.
I don't have much knowledge with tweaking system code since the phone i had before had every ROM in every flavor already optimized (k20 pro) and with this one i'm getting a little bit bored to be honest so i wanted to do something myself but i couldn't get around those frecuency issues. Tried with Franco Kernel Manager and EX, the frecuecies applied but after around 1 minute everything went back to default.
Also, did you try the stock camera app?
Thanks.
Click to expand...
Click to collapse
VoLTE doesn't work with GSIs yet. I tried forcing the toggle out. It does register, but calls do not function at all (hangs). I've reported the issue to phh, but I'm yet to make any progress. One thing I know is that IMS is in `/system_ext`, and that is not used by GSI.
As for CPU cap, I haven't really tried using kernel managers on the device yet (I prefer using SmartPack). My experience with SmartPack on other devices is similar, that any changes to frequencies would be reverted to default after a while.
It seems the system (or maybe just stock kernel) nowadays don't allow you to freely change CPU/GPU frequencies anymore, and your experience with Franco and EX further proved it. As for benchmark apps capping CPU frequency... I suspect the phone has some cheating mechanisms similar to some other ones in the past.
Don't know about stock camera app. For custom ROMs/GSIs my favorite is Open Camera, which is installed via NanoDroid to replace the stock ones.
Plus, with stock ROM, the system partition doesn't really have many stuffs. Other stuffs were placed in `/system_ext` and `/product`, and it appears that GSIs use neither of those. It's possible that the libraries of some essential features reside in `/system_ext` and therefore would not be available for GSIs (like IMS).

This procedure could be used to A12?

vinaaa said:
This procedure could be used to A12?
Click to expand...
Click to collapse
Yes but from my experience apart from the bugs mencioned above, in A12 fingerprint and magisk don't work and bluetooth doesn't either even with the workaround. Once i found these bugs i went back to stock so i didn't test it more than 15 minutes, it probably has a lot more to be found

LSS4181 said:
VoLTE doesn't work with GSIs yet. I tried forcing the toggle out. It does register, but calls do not function at all (hangs). I've reported the issue to phh, but I'm yet to make any progress. One thing I know is that IMS is in `/system_ext`, and that is not used by GSI.
As for CPU cap, I haven't really tried using kernel managers on the device yet (I prefer using SmartPack). My experience with SmartPack on other devices is similar, that any changes to frequencies would be reverted to default after a while.
It seems the system (or maybe just stock kernel) nowadays don't allow you to freely change CPU/GPU frequencies anymore, and your experience with Franco and EX further proved it. As for benchmark apps capping CPU frequency... I suspect the phone has some cheating mechanisms similar to some other ones in the past.
Don't know about stock camera app. For custom ROMs/GSIs my favorite is Open Camera, which is installed via NanoDroid to replace the stock ones.
Plus, with stock ROM, the system partition doesn't really have many stuffs. Other stuffs were placed in `/system_ext` and `/product`, and it appears that GSIs use neither of those. It's possible that the libraries of some essential features reside in `/system_ext` and therefore would not be available for GSIs (like IMS).
Click to expand...
Click to collapse
Thank you for the reply
I don't know if this is of any relevance but after disabling system tracing on developer options on stock A11, the CPU is not capped when opening benchmark apps anymore

I didn't like the DotOS. Yes, it has an interesting interface, interesting graphical solutions. But many additional settings and functions don't work.

ilia3367 said:
I didn't like the DotOS. Yes, it has an interesting interface, interesting graphical solutions. But many additional settings and functions don't work.
Click to expand...
Click to collapse
GSIs aren't 100% bug-free from my own experiences. Sometimes regressions or plain oversights can happen with certain versions. A long time ago with older devices I even had times when Bluetooth didn't work on a certain GSI because the maintainer forgot to include Bluetooth related libraries (as the logcat errors implied the files were absent).
A recent example would be that custom fonts used to work with an earlier build of OctaviOS (July) but broken with the latest (September). Either the maintainer somehow forgot to actually include the fonts this time, or there were regressions/bugs in the OS itself causing the feature to break.
Plus, it seems substratum is still alive and active, yet I'm quite a n00b when it comes to adding additional features to system with it (preferrably on top of plain AOSP). Back then I mainly used it for custom themes I bought, and when custom ROMs started including built-in theming and the features I need, substratum is pretty much dead to me and I haven't touched it for years since then.
PS: There is an ongoing bug with DotOS for this device, since 5.1, that keyboard layout button would not show up when using 3-button navbar (which is my favorite). The button correctly shows when using gestures or 2-button navbar. I reported the issues several times in the group but I got very limited response (probably because few users are using it thus affected)... so the issue persists with the recently released DotOS 5.2 GSI.