[Scott Fallick]

Hi, I have a MTK device with Mt6735m chip. I need to edit the system.img and then flash. However, even if I just unpack and repack image with no changes, the file size is different and after flash, the phone is stuck at boot. Of course flashing the original system.img works with no problems. I've been trying for days. Any suggestions?

[Panth3r]

Man there is what we call dm-verity it wont let you boot to a modified system image. You need to patch your boot image.

[davek17]

Man there is what we call dm-verity it wont let you boot to a modified system image. You need to patch your boot image.

Hi Guys

So how do you patch the boot image?

I'm in on this as i'm struggling with the same issue.  I have been playing with MTK based ROMS for years (how I miss the simple life of MTK Droid tools!!) but recently I have found that Nougat, MT6737M and MT8735b platforms to be a real pain.

So my issue is the same but I have something to add too.  Firstly I normally just try to get ADB root so I change the default.prop settings in boot.img (ro.debuggable, rfo.secure, ro.adb.secure) and repack/flash and then I can usually get root via ADB.  I may need to unlock the bootlaoder, if this is the case I usually don;t have an issue with that.  I can't get ADB root on this device though.  Not sure if that's something to do with this issue? I did notice that this ROM I have does have the "verity_file" in the boot.img ramdisk, same place as the default.prop.

I also cannot repack system.img.  I have found that Windows tools are just not good enough for this after v4/5 Android. So what I do is use Ubuntu LINUX as a VM on my PC and use the AOSP tools (simg2img, then mount, fiddle, then make_ext4fs).  I have no problem unpacking, its always repacking that's the issue.

So I understand all about the file_contexts and also how to convert file_contexts.bin.  I understand how to get the right size for a repack. 

Interestingly I did manage to reflash and boot an OS. I simply tweaked some build.prop device name settings, the device works fine other than anything to do with google stops running or doesn't work so play, chrome etc.  The rest of the device seems OK but I couldnt trust it really.

So I'm on this and would love to share thoughts and info in an attempt to try to work this out?

[Panth3r]

I also own MT6737m with Android 6 and getting Android 7 or 8 to work has been a tough experience. And of course yea, you need to unlock your bootloader. Then get a tool to unpack your stock boot image head on to fstab.6735 then delete verify on the /system mount flags. Repack your image. Then delete the verity_key from your /system partition and you should be good to go. Right now am on my free time I can patch up the boot image for you ONLY if you can trust a stranger! Haha...

[davek17]

I also own MT6737m with Android 6 and getting Android 7 or 8 to work has been a tough experience. And of course yea, you need to unlock your bootloader. Then get a tool to unpack your stock boot image head on to fstab.6735 then delete verify on the /system mount flags. Repack your image. Then delete the verity_key from your /system partition and you should be good to go. Right now am on my free time I can patch up the boot image for you ONLY if you can trust a stranger! Haha...

Hi Qym

TY for replying, so in my fstab.mt6735 file I found the following line of code:

Code:

/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/system /system ext4 ro wait, verify

I edited that to

Code:

/dev/block/platform/mtk-msdc.0/11230000.msdc0/by-name/system /system ext4 ro wait

Saved it

Then I removed the verity_key file from the ramdisk folder.

Repacked the boot.img and flashed to device with SPPT.

Questions:
1. So where is the verity_key in the system partition?  Mine is in the boot.img ramdisk

2. Will this resolve being able to run ADB in root mode so I can adb remount rw and tinker with the system on the device?

[Panth3r]

Questions:
1. So where is the verity_key in the system partition?  Mine is in the boot.img ramdisk

2. Will this resolve being able to run ADB in root mode so I can adb remount rw and tinker with the system on the device?

1. If the verity_key is in your ramdisk folder its fine just remove it wherever it is.

2. The patching you did won't make adb run as root. You have to get su working first then set some debug props.

[Panth3r]

But most of the time you won't need the debug props unless you want to do adb root you can just do adb shell su.

[davek17]

But most of the time you won't need the debug props unless you want to do adb root you can just do adb shell su.

The problem with SU is how do you install it if you don't have ADB root or if the the phone cannot be rooted by any of the main tools out there like kingoroot etc.  So getting "system root" or SU is not possible.

Normally you can get ADB root without having SU installed, thats the whole point of adb root, it just gives you temp access to RW on /system so i can PULL and then PUSH files to the device.

I have been unable to get any custom recovery working, or to get SU, busybox or anything installed

[Panth3r]

I have been unable to get any custom recovery working, or to get SU, busybox or anything installed

So what you really want is su and also debloat your stock rom. Right? Then you just need a custom recovery first. Use philz hovatek auto porter to get a custom recovery image.

[davek17]

I have been unable to get any custom recovery working, or to get SU, busybox or anything installed

So what you really want is su and also debloat your stock rom. Right? Then you just need a custom recovery first.  Use philz hovatek auto porter to get a custom recovery 

No, I don't need SU, I just want to be able to get ADB root.  In fact SU is bad for a number of reasons as I can't run certain apps like Google Pay etc if the devices is rooted. Normally I can do what I need to do from ADB.

Normally to get ADB root you change the boot.img as above, however it is simply not working.  I can see using adb shell getprop that the properties have changed in the default.prop file, adb root seems to do something, however when I adb remount rw , I get an error that I need to use adb root first!

I have tried to port a custom recovery, as this device does not seem to have one installed. However I have tried to install TWRP or even the MTK recovery tool that many other MTK based devices have on them with the same CPU and Android OS.  I flash these using SP Phone tools but the device just reboots when I try to enter recovery mode. I think I tried every single latest version of TWRP and this is the result so far.
Is there something I have missed here?  It seems to me that these newer MTK devices are just locked and no-one knows how to get them working any more?

I will try philz hovatek auto porter and see if that brings any joy! but the purpose of this thread is to see why these devices are behaving like they are. So the outstanding questions are:

1. Is it do with verity? I am not getting any verity errors.
2. Why isn't the normal way of getting ADB Root working like above (boot.img editing default.prop)? Does verity block this?