Root The one and only official SYSTEM-RW for Samsung Galaxy S23 Ultra (and other devices) by lebigmac

[lebigmac]

Hi NemezAK
Thanks for the sysrw_log.txt file can you please zip the whole /log subfolder and upload here? Thanks. The other 2 files could contain more clues...
Redmi 9C NFC from late 2020 ? That's only a couple of months before I wrote this System-RW program from scratch (February 2021).
That log looks messed up. I'm not surprised the Auto-Resize feature didn't work properly because those file sizes are negative. That's not right.
Did you try deleting the whole /img subfolder and relaunching the script? Any difference?
Okay the PatchBoot procedure didn't work as expected due to Operation not permitted error. That's weird since you should be root but it's not too big of a deal. The PatchBoot procedure is part of the highly experimental ADB ROOT procedure which can be disabled by commenting out those two lines mentioned here.
I also noticed that while your super image's sub-partitions are indeed in ext4 file-system format, they are not restricted by the infamous shared_blocks read-only feature.
Are you sure your device is read-only?
What happens if you do this? A screenshot would be helpful.

adb shell
su
mount -o remount,rw /

 

[jhandeck]

So trying to run all this on my new moto razr plus.
Bootloader unlocked, magisk installed. No TWRP yet...
App installed, commented lines 355+492 (makerw -patchboot and adbroot=1, i think? editing without vim isn't living!)
Other than having to manually chmod u+x superw, everything seems to have run correctly, with "Successfully" and "Congratulations" output.
Solid Explorer (my go-to smb client for getting data on/off the phone) lets me copy the ~8gb patched bin off even though it incorrectly shows a 0byte file.

My question before writing this with fastboot, is there any backup/recovery option in case this goes poorly?
This is amazing work you've done, and we're all grateful we get r/w access to our own phones, I just want to do my best to protect myself form bricking my new device!
Also, because this is managing existing partitions, I'm assuming data isn't lost?

 

[lebigmac]

Hello @jhandeck Thanks for the kind words. That's a nice phone you've got. I've always been fascinated by Motorola devices. I wish they were actually available for purchase here in Europe...

The file size of the super_patched.bin file should be much greater than 0 bytes. More like in the 6 - 8 GB range depending on your device.
You can verify the actual file size with this terminal command:

stat -c "%s" /data/local/tmp/sysrw_1.42/img/super_patched.bin

By default the script should dump your original super.img to /data/local/tmp/sysrw_1.42/img/super_original.bin (in the future you can disable backups in the included options/config.ini file)
I would recommend downloading your original stock ROM (same version as the one you're currently running) from your device manufacturer's website just in case anything goes wrong.
I'm surprised you didn't get the infamous error 73. Most Motorola users get that when they run my script. This can easily be fixed by running the sysrw_repair script though (Linux only).

By default that latest version of my System-RW script only modifies your super.img as well as the boot.img (PatchBoot procedure) and the vbmeta (avbctl binary) so it shouldn't affect your personal /data at all but it can't hurt to back that up manually as well. Depending on what you do, on some devices, there are some really nasty bootloops out there that can only be fixed by formatting /data. Don't ask me why.

Good luck and please report back your results!

 

[Carlo99]

Hi you all, i have some questions for you, i am on S22 r0s Exynos2200 wirh magisk and twrp, i tried the rom maker to make my system writeable but every time i do it, when i reboot, even if did not flash the generated images yet it bootlops.
I chose @auto and raw for settings and i tried flashing the patched files through odin, it fails at system.
I tried also flashing it from twrp but same result, i have the last stock firmware which has an updated binary and i can not downgrade to may version that is the last one for EUX csc, does the new binary affect the script? Maybe i should try with fastboot patched recovery like for gsi? Eventually patched odin?

 

[lebigmac]

Hi Carlo99. You get bootloop even without flashing anything? That's interesting
Ok in order to get out of bootloop, restore your stock ROM with Odin. Regular Odin is just fine.
If you reflash your original stock ROM (same version as you are currently running) you should not lose any personal data as long as you don't overwrite the userdata partition I guess?!

My program should work just fine on S22 and even the ADB ROOT should be possible...
You should generate a sparse super image and not a raw one.
Did you notice any errors in the log itself?
Okay let's start fresh.
Try only making your System-RW by excluding all sub-partitions of super.img except system from the whole ro2rw procedure (which currently is basically just a conversion to ext4 file-system). Click here for an example.
This should give you System-RW capability. To get the FULL-RW you need to manually patch your fstab to support booting your sub-partitions as ext4 file-system (this is only recommended for advanced users). By default Samsung only allows the system sub-partition to boot as ext4 file-system.
I would first start with System-RW and once you get that unlocked you can start playing with the fstab to unlock even more stuff
Regarding the ADB ROOT you can disable it if you want in the /data/local/tmp/sysrw_1.42/bin/superw file by commenting out lines #355 as well as #492 but this should not be necessary as it should work by default on Samsung Galaxy S22 (r0s). Works fine on my Samsung Galaxy S23 Ultra over here.
Also keep in mind you must rename the newly generated super_patched.bin to super.img and then tar it with 7zip or in terminal and then flash it in Odin inside Windows into the AP slot.
Also feel free to zip your whole /log subfolder and upload here and I will take a look.
I hope this helps.
Please report back your results. Good luck!

 

[Carlo99]

Thank you very much for your reply, i Will surely try it in a few days cause now i 'm far from my pc so i'm gonna act carefully , also do i need to use only sysrw or can I use it directly from the rom maker to achieve this result? Because I noticed that the app changes something in my actual phone too, like it sets selinux to permissive and maybe also patching fstab/boot.img I guess? Maybe if I use the app I could try dirty flash to skip Odin? I also noticed that the instructions say to disable encryption, I tried to do that with a script and unofficial twrp but it bootloops even here, maybe this could be correlated to the failed sysrw process?

 

[jhandeck]

Um.
It worked.
No issues at all so far.
I haven't done a thorough investigation, but there are no more erofs mounts reported,
and I was able to remount /system rw and rename a couple priv-app apks.
So, that's pretty awesome.
I may play with options, adb root, etc....or I may just be grateful I have access to my phone.

Thank you!

 

[lebigmac]

Thank you very much for your reply, i Will surely try it in a few days cause now i 'm far from my pc so i'm gonna act carefully , also do i need to use only sysrw or can I use it directly from the rom maker to achieve this result? Because I noticed that the app changes something in my actual phone too, like it sets selinux to permissive and maybe also patching fstab/boot.img I guess? Maybe if I use the app I could try dirty flash to skip Odin? I also noticed that the instructions say to disable encryption, I tried to do that with a script and unofficial twrp but it bootloops even here, maybe this could be correlated to the failed sysrw process?

@Carlo99 which instructions are you following? There should be a readme file in there somewhere. I might have to update it...
You don't need to disable file encryption in your fstab for my System-RW program to work on your device. These 2 things are not related to each other. You just have to make sure that the /data partition is mounted and decrypted properly by entering your PIN code before running my script so that way it can access /data/local/tmp/sysrw_1.42

If you take a look at the bin/superw file with your favorite text editor you will see that it attempts to patch your boot.img at line #355
Together with line #492, this is part of the highly experimental ADB ROOT feature which is not guaranteed to work on all devices out there just yet but rest assured I'm already working on a more universal solution. It should work just fine on your Samsung Galaxy S22 though (as well as S22 Ultra, S23, S23 Ultra and all Xiaomi devices and more...)

In the current version of the ROM-Maker I have temporarily disabled the Dirty Flash function due to some error but don't worry I already fixed it and it should be back up and running in next version

Yes you can launch my System-RW script from the ROM-Maker by pressing the SUPER RW button
Just make sure you modify your config.ini first to exclude all sub-partitions but system

Yes maybe running other 3rd party scripts could be related to the error(s) that you are experiencing. I'm not sure.

Good luck!

---

@jhandeck thanks for sharing your results with us.
Congratulations! Enjoy debloating and further customizing your fully read/write-able next-generation Android device!

 

[v01ded]

Um.
It worked.
No issues at all so far.
I haven't done a thorough investigation, but there are no more erofs mounts reported,
and I was able to remount /system rw and rename a couple priv-app apks.
So, that's pretty awesome.
I may play with options, adb root, etc....or I may just be grateful I have access to my phone.

Thank you!

Hi jhandeck,

Would you be kind enough to share the detail steps you took to make it work on your moto razr plus? Especially the part where you mention

commented lines 355+492 (makerw -patchboot and adbroot=1, i think? editing without vim isn't living!)

I'm using a moto edge 40 pro and so far i'm getting a bootloop when i flashed the patched super.img. Thanks in advance!

 

[lebigmac]

Hi @v01ded
Thanks for your feedback! Did you successfully get out of your bootloop by flashing back your original stock ROM? If you don't overwrite the userdata partition you shouldn't lose any personal data. If you want I can upload a Xiaomi script that will help you restore your device from fastboot mode.

According to your fstab, your phone only supports booting the system sub-partition as ext4 file-system by default. Similar to Samsung devices...
That means , before generating a new super.img, you must exclude all your sub-partitions except system from the config.ini as shown here

That way only your system sub-partition will be converted to ext4 file system and thus the super_patched.bin should be compatible with your stock fstab.
To enable the FULL-RW you will have to manually patch your fstab which can be tricky sometimes. Especially in newer Android versions since the Android developers keep hiding the powerful fstab file in new locations all the time... Top John Wu was that you?

The good news is System-RW is all you really need to enable the native ADB ROOT and debloating the system sub-partition itself should be enough to make your device run as smooth as silk!

Don't worry I will add my custom Fstab-Patcher module in one of the upcoming versions of my program which should fix this fstab issue once and for all

# Copyright (c) 2019-2020 The Linux Foundation. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted (subject to the limitations in the
# disclaimer below) provided that the following conditions are met:
#
#    * Redistributions of source code must retain the above copyright
#      notice, this list of conditions and the following disclaimer.
#
#    * Redistributions in binary form must reproduce the above
#      copyright notice, this list of conditions and the following
#      disclaimer in the documentation and/or other materials provided
#      with the distribution.
#
#    * Neither the name of The Linux Foundation nor the names of its
#      contributors may be used to endorse or promote products derived
#      from this software without specific prior written permission.
#
# NO EXPRESS OR IMPLIED LICENSES TO ANY PARTY'S PATENT RIGHTS ARE
# GRANTED BY THIS LICENSE. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT
# HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED
# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
# IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
# GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
# IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
# OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN
# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

# Android fstab file.
# The filesystem that contains the filesystem checker binary (typically /system) cannot
# specify MF_CHECK, and must come before any filesystems that do specify MF_CHECK

#<src>                                                 <mnt_point>            <type>  <mnt_flags and options>                            <fs_mgr_flags>
system                                                  /system                erofs   ro                                                   wait,slotselect,avb=vbmeta_system,logical,first_stage_mount,avb_keys=/avb/q-gsi.avbpubkey:/avb/r-gsi.avbpubkey:/avb/s-gsi.avbpubkey
system                                                  /system                ext4    ro,barrier=1,discard                                 wait,slotselect,avb=vbmeta_system,logical,first_stage_mount,avb_keys=/avb/q-gsi.avbpubkey:/avb/r-gsi.avbpubkey:/avb/s-gsi.avbpubkey
system_ext                                              /system_ext            erofs   ro                                                   wait,slotselect,avb=vbmeta_system,logical,first_stage_mount
product                                                 /product               erofs   ro                                                   wait,slotselect,avb=vbmeta_system,logical,first_stage_mount
vendor                                                  /vendor                erofs   ro                                                   wait,slotselect,avb,logical,first_stage_mount
vendor_dlkm                                             /vendor_dlkm           erofs   ro                                                   wait,slotselect,avb,logical,first_stage_mount
system_dlkm                                             /system_dlkm           erofs   ro                                                   wait,slotselect,avb,logical,first_stage_mount
#odm                                                     /odm                   ext4    ro,barrier=1,discard                                 wait,slotselect,avb,logical,first_stage_mount
/dev/block/by-name/metadata                             /metadata              f2fs    noatime,nosuid,nodev,discard                         wait,check,formattable,first_stage_mount
/dev/block/bootdevice/by-name/persist                   /mnt/vendor/persist    ext4    noatime,nosuid,nodev,barrier=1                       wait
/dev/block/bootdevice/by-name/prodpersist               /mnt/product/persist   ext4    noatime,nosuid,nodev,barrier=1                       wait,formattable,nofail
/dev/block/bootdevice/by-name/userdata                  /data                  f2fs    noatime,nosuid,nodev,discard,reserve_root=32768,resgid=1065,fsync_mode=nobarrier,whint_mode=fs-based,inlinecrypt    latemount,wait,check,formattable,fileencryption=aes-256-xts:aes-256-cts:v2+inlinecrypt_optimized+wrappedkey_v0,keydirectory=/metadata/vold/metadata_encryption,metadata_encryption=aes-256-xts:wrappedkey_v0,quota,reservedsize=128M,sysfs_path=/sys/devices/platform/soc/1d84000.ufshc,checkpoint=fs
/dev/block/bootdevice/by-name/misc                      /misc                  emmc    defaults                                             defaults
#/devices/platform/soc/8804000.sdhci/mmc_host*           /storage/sdcard1       vfat    nosuid,nodev                                         wait,voldmanaged=sdcard1:auto,encryptable=footer
/devices/platform/soc/*.ssusb/*.dwc3/xhci-hcd.*.auto*   /storage/usbotg        vfat    nosuid,nodev                                         wait,voldmanaged=usbotg:auto
#/dev/block/bootdevice/by-name/modem                     /vendor/firmware_mnt   vfat    ro,shortname=lower,uid=1000,gid=1000,dmask=227,fmask=337,context=u:object_r:firmware_file:s0 wait,slotselect
/dev/block/bootdevice/by-name/modem                     /vendor/firmware_mnt   ext4    ro,nosuid,nodev,context=u:object_r:firmware_file:s0  wait,slotselect
/dev/block/bootdevice/by-name/dsp                       /vendor/dsp            ext4    ro,nosuid,nodev,barrier=1                            wait,slotselect
#/dev/block/bootdevice/by-name/vm-bootsys                /vendor/vm-system      ext4    ro,nosuid,nodev,barrier=1                            wait,slotselect
#/dev/block/bootdevice/by-name/bluetooth                 /vendor/bt_firmware    vfat    ro,shortname=lower,uid=1002,gid=3002,dmask=227,fmask=337,context=u:object_r:bt_firmware_file:s0 wait,slotselect
/dev/block/bootdevice/by-name/bluetooth                 /vendor/bt_firmware    ext4    ro,nosuid,nodev,context=u:object_r:bt_firmware_file:s0 wait,slotselect
#/dev/block/bootdevice/by-name/qmcs                      /mnt/vendor/qmcs       vfat    noatime,nosuid,nodev,context=u:object_r:vendor_qmcs_file:s0   wait,check,formattable
/dev/block/bootdevice/by-name/fsg                       /vendor/fsg            ext4    ro,nosuid,nodev,context=u:object_r:fsg_file:s0       wait,slotselect

 

[ominiscience]

Has any one confirmed this to work on pixel 4a 5G?

 

[lebigmac]

Has any one confirmed this to work on pixel 4a 5G?

script worked fine on my third Pixel 4a Android 13 device.

Hello. According to this guy it works on Pixel 4a...

 

[ominiscience]

Hello. According to this guy it works on Pixel 4a...

Tried it on 2 different pixel 4a5g. Bricked them both. Stuck on bootloader.

 

[ominiscience]

Tried on pixel 5a a11. Absolutely works.

Tried it on 2 different pixel 4a5g. Bricked them both. Stuck on bootloader.

 

[ominiscience]

Tried on pixel 5a a11. Absolutely works.

But usb mtp is gone and developer options crashes settings.

 

[lebigmac]

you might want to disable the experimental ADB ROOT feature then by opening the file /data/local/tmp/sysrw_1.42/bin/superw with your favorite text editor and commenting out both lines #355 and #492 by placing # symbol in front of the line and then save file. You should restore your stock boot.img and super.img prior to trying the whole procedure again.

I'm pretty sure the experimental adb root feature is causing the developer options to crash on your specific device.

Good luck!

 

[lebigmac]

Tried it on 2 different pixel 4a5g. Bricked them both. Stuck on bootloader.

To get out of bootloop all you need to do is restore your original stock super.img and boot.img (and vbmeta.img if you want).
Sometimes when the bootloop is very stubborn, the only way to fix it is by flashing your whole original stock firmware ROM (same firmware version as the one you're currently running). As long as you don't overwrite or erase the USERDATA partition you should still have access to all your personal data.