I unlocked oem mode. Then burned the warranty efuse (acting as disabling the warranty). Then, I successfully flashed cache.mbn modem.bin and system.img.ext4 through the bootloader.

However, after rebooting, the files I modified in order to get root in /system/xbin don’t appear. According to the pit file, the partition I flashed is /dev/block/mmcblk0p44. However, the device being mounted on /system is /dev/block/dm-0

gts3llte:/ $ mount | grep dm  
/dev/block/dm-0 on /system type ext4 (ro,seclabel,relatime,norecovery).

So it seems I didn’t modify the right file. But, how I can know how /dev/block/dm-0 is built in order to modify it? Without root of course.
It should be noted that rolling back to a previous version of the firmware isn’t a problem through odin and I saw no hash block files in the fully extracted official firmware.


I noticed a file called /verity_key in the mincrypt format inside the initrd. So if I change that file along with the hash partition, I should be able to put an image with my own signing right?
But where’s the hash partition on that device? The kernel’s cmdline doesn’t contain anything about the android.vbmeta.device.

I tried to install twrp and it indeed refuses to boot it by directly going in download mode instead (but keeping the screen black).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.