[Tutorial] How to disable dm-verity or Android Verified Boot (AVB)
[Tutorial] How to disable dm-verity or Android Verified Boot (AVB)
05-10-2023, 12:30 AM
(03-10-2023, 11:42 PM)doctorman has anyone tried this on android 12 ?
when I flash the empty vbmeta I get locked out by secure startup with no specific password
LG G8x android 12
DO NOT USE VBMETA from any other source but your own KDZ or your own phone or you will get secure start up lock.
android 12 G8x
05-10-2023, 04:24 PM
(03-10-2023, 11:42 PM)doctorman has anyone tried this on android 12 ?
when I flash the empty vbmeta I get locked out by secure startup with no specific password
LG G8x android 12
You don't need to flash to vbmeta. Just flash magisk boot in fastbootD
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
12-10-2023, 06:55 PM
I achieved root on the device by patching the stock boot.img with magisk then flashing it, but can't seam to disable AVB completely in order to load unsigned lkm. Flashing the empty vbmeta.img provided in the tutorial, same as flashing the one generated by avbtool (.\avbtool.py make_vbmeta_image --flags 2 --padding_size 4096 --output vbmeta_disabled.img) results in a bootloop. I have tried flashing them both with the SP Flash Tool, as well as with the "fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img" command, with and without the flags, and also by specifying precisely to flash to vbmeta_a and vbmeta_ b partitions in all sorts of different combinations. Either way it always results in a bootloop.
The only thing that kinda works is flashing the stock vbmeta.img with "fastboot --disable-verity flash vbmeta vbmeta.img" command, then avbctl reports that verity is disabled, but verification is still on, and as soon as I try to flash vbmeta with the --disable-verification flag it bootloops on me again. What could be the cause of that ?
P.S. I also tried to flash the magisk patched boot.img before and after vbmeta, do a factory reset once flashed, somebody on the forums said it helps. I even tried flashing the empty vbmeta not only to the vbmeta partition, but also in the vbmeta_system, and vbmeta_vendor partitions and fastboot --disable-verity --disable-verification on both vbmeta_system and vbmeta_vendor for both A and B slots. But I think it does nothing, judging by the output of "fastboot --disable-verity --disable-verification flash vbmeta_vendor_a vbmeta_vendor.img" :
Warning: skip copying vbmeta_vendor_a image avb footer (vbmeta_vendor_a partition size: 0, vbmeta_vendor_a image size: 4096).
Sending 'vbmeta_vendor_a' (4 KB) OKAY [ 0.001s]
Writing 'vbmeta_vendor_a' OKAY [ 0.001s]
Finished. Total time: 0.035s
The vbmeta_vendor_a partition size: 0 part is strange... because the stock firmware and scatter file I have on hand contains it and it is 4KB. It reports the same for vbmeta_system.
I can also provide the output of "avbtool info_image --image stock_vbmeta.img" or "fastboot getvar all" in order to shed some light on the situation.
Any help would be much appreciated !
16-10-2023, 09:38 AM
(12-10-2023, 06:55 PM)unixman5979 Hello, I own a Unihertz Tank 01 running Android 12 powered by the MediaTek MT6789 Helio G99. The device has A/B style partition table, an besides the vbmeta partition it also has a vbmeta_system and vbmeta_vendor partition. The bootloader is unlocked, both by toggling OEM unlocking in Developers options as well as by the "fastboot flashing unlock" command.
I achieved root on the device by patching the stock boot.img with magisk then flashing it, but can't seam to disable AVB completely in order to load unsigned lkm. Flashing the empty vbmeta.img provided in the tutorial, same as flashing the one generated by avbtool (.\avbtool.py make_vbmeta_image --flags 2 --padding_size 4096 --output vbmeta_disabled.img) results in a bootloop. I have tried flashing them both with the SP Flash Tool, as well as with the "fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img" command, with and without the flags, and also by specifying precisely to flash to vbmeta_a and vbmeta_ b partitions in all sorts of different combinations. Either way it always results in a bootloop.
The only thing that kinda works is flashing the stock vbmeta.img with "fastboot --disable-verity flash vbmeta vbmeta.img" command, then avbctl reports that verity is disabled, but verification is still on, and as soon as I try to flash vbmeta with the --disable-verification flag it bootloops on me again. What could be the cause of that ?
P.S. I also tried to flash the magisk patched boot.img before and after vbmeta, do a factory reset once flashed, somebody on the forums said it helps. I even tried flashing the empty vbmeta not only to the vbmeta partition, but also in the vbmeta_system, and vbmeta_vendor partitions and fastboot --disable-verity --disable-verification on both vbmeta_system and vbmeta_vendor for both A and B slots. But I think it does nothing, judging by the output of "fastboot --disable-verity --disable-verification flash vbmeta_vendor_a vbmeta_vendor.img" :
Warning: skip copying vbmeta_vendor_a image avb footer (vbmeta_vendor_a partition size: 0, vbmeta_vendor_a image size: 4096).
Sending 'vbmeta_vendor_a' (4 KB) OKAY [ 0.001s]
Writing 'vbmeta_vendor_a' OKAY [ 0.001s]
Finished. Total time: 0.035s
The vbmeta_vendor_a partition size: 0 part is strange... because the stock firmware and scatter file I have on hand contains it and it is 4KB. It reports the same for vbmeta_system.
I can also provide the output of "avbtool info_image --image stock_vbmeta.img" or "fastboot getvar all" in order to shed some light on the situation.
Any help would be much appreciated !
Create a thread for this by clicking Ask Question at the top
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
15-12-2023, 07:33 PM
(17-03-2020, 10:29 PM)X3nonHi there, I know it's an old post. I just found it and thought it might be able to solve my problem.
- In the Replace windows, Click the Hex-values tab and input the following below
Search for 2C 76 65 72 69 66 79
replace with 00 00 00 00 00 00 00
I tried to follow the first method on my Boox Nova which is equipped with Rockchip RK3288. It runs Android 9 now but I am sure it came with Android 8 as it doesn't have vbmeta partition. I used decryptBooxUpdateUpx to decrypt the update.upx and can find only boot.img and recovery.img. Somehow I've unlocked the bootloader and I can patch boot.img theoretically. But every time I just get boot loop with Magisk patched boot.img. I realize that I might be caught by Android Verified Boot. I assume it's AVB 1.0 not 2.0 since my ereader has no vbmeta.img. When opened the boot.img extracted from update.upx, I can find the strings "verify" but not Hex-values "2C 76 65 72 69 66 79". I can only find "76 65 72 69 66 79". How should I proceed to edit the boot.img so that I can flash it on my Nova to remove the verification? Thanks a lot.
05-01-2024, 02:15 PM
(15-12-2023, 07:33 PM)sanzhang Hi there, I know it's an old post. I just found it and thought it might be able to solve my problem.
I tried to follow the first method on my Boox Nova which is equipped with Rockchip RK3288. It runs Android 9 now but I am sure it came with Android 8 as it doesn't have vbmeta partition. I used decryptBooxUpdateUpx to decrypt the update.upx and can find only boot.img and recovery.img. Somehow I've unlocked the bootloader and I can patch boot.img theoretically. But every time I just get boot loop with Magisk patched boot.img. I realize that I might be caught by Android Verified Boot. I assume it's AVB 1.0 not 2.0 since my ereader has no vbmeta.img. When opened the boot.img extracted from update.upx, I can find the strings "verify" but not Hex-values "2C 76 65 72 69 66 79". I can only find "76 65 72 69 66 79". How should I proceed to edit the boot.img so that I can flash it on my Nova to remove the verification? Thanks a lot.
Then change your
76 65 72 69 66 79 to 00 00 00 00 00 00
Learn MediaTek, Unisoc / Spreadtrum (SPD) and Qualcomm Software Repairs @ https://www.hovatek.com/training
Note!
We have a reply schedule for Forum Support. Please try Private Support if you can't wait.
05-02-2024, 05:17 PM
(15-12-2023, 07:33 PM)sanzhang(17-03-2020, 10:29 PM)X3nonHi there, I know it's an old post. I just found it and thought it might be able to solve my problem.
- In the Replace windows, Click the Hex-values tab and input the following below
Search for 2C 76 65 72 69 66 79
replace with 00 00 00 00 00 00 00
I tried to follow the first method on my Boox Nova which is equipped with Rockchip RK3288. It runs Android 9 now but I am sure it came with Android 8 as it doesn't have vbmeta partition. I used decryptBooxUpdateUpx to decrypt the update.upx and can find only boot.img and recovery.img. Somehow I've unlocked the bootloader and I can patch boot.img theoretically. But every time I just get boot loop with Magisk patched boot.img. I realize that I might be caught by Android Verified Boot. I assume it's AVB 1.0 not 2.0 since my ereader has no vbmeta.img. When opened the boot.img extracted from update.upx, I can find the strings "verify" but not Hex-values "2C 76 65 72 69 66 79". I can only find "76 65 72 69 66 79". How should I proceed to edit the boot.img so that I can flash it on my Nova to remove the verification? Thanks a lot.
Are you using MTP Transfer or 'adb pull' to transfer the magiskpatchedboot.img between Android and PC? MTP Transfer will corrupt the image, causing brick and bootloop upon flash.
Use the command:
adb push <path to raw boot.img on pc> <path to destination on android>
Example:
adb push C:/platform-tools/boot_a.img /storage/emulated/0/Downloads
And use this command to transfer the patched boot.img back to PC:
adb pull <path to patchedboot.img>
Example:
adb pull /storage/emulated/0/Downloads/magiskpatchedboot.img
The pull destination will automatically go to where you opened the shell. So if you opened the shell at C:/platform-tools> then thats where the image will go.
Then try flashing the magiskpatchedboot.img and see if it fixes your issue. Maybe not, but this is something I have run into personally. It is worth the shot.
15-09-2024, 09:47 AM
Quote:Search for 2C 76 65 72 69 66 79This data is not suitable for magisk v23--27, but it is also not suitable for v22.There is a more interesting and new solution.But I can't understand the logic of how to search for this patch.I have a8.1 and there is no such thing in the core.I've seen these patches on versions a11 and above.Perhaps you will be interested in that post and we will find a middle ground together.
replace with 00 00 00 00 00 00
link
This post was last modified: 15-09-2024, 09:56 AM by depesh1977.
Users browsing this thread:
1 Guest(s)
1 Guest(s)
Users browsing this thread:
1 Guest(s)
1 Guest(s)
