I got a Chinese phone with an MTK6761 SoC, running Android 13 (has the virtual A/B partition and DM-verity/AVB enabled). I managed to unlock the bootloader and root it through Magisk and MTKClient tool running on Manjaro Linux. So far the only "issue" with that is that as I have seccfg modified, I have the annoying message at boot stating that the partitions are corrupted (because of dm-verity). In that regard, I tried disabling dm-verity through the usual methods with no luck.

The problem that I am facing is as follows:

I am attempting to modify the bootanimation file, which is inside the "product" virtual partition. I found that it is inside super.bin, so I unpacked it using the lpunpack commandline application with the command:

lpunpack super.bin ./Images`

Then, I found there was an image, product_a.img which has the bootanimation.zip, so I increased the allocated size by 10 MB with the following commands:

e2fsck -f product_a.img

fallocate -l 2275078144 product_a.img

resize2fs product_a.img 555439

Then, I mounted it to a folder named "product" with the following command:

sudo mount -t ext4 -o loop,rw product_a.img product

To access and modify its content I used Thunar Root and replaced the bootanimation file with my custom file. Then I unmounted the file using sudo umount product and repacked everything with the following command:

    --super-name super 
    --metadata-size 65536 
    --metadata-slots 2 
    --device super:5368709120 
    --group main:4504506368 
    -p "product_a:none:2275078144:main" -i "product_a=./product_a.img" 
    -p "product_b:none:0:main" -i "product_b=./product_b.img" 
    -p "system_a:none:1678229504:main" -i "system_a=./system_a.img" 
    -p "system_b:none:139591680:main" -i "system_b=./system_b.img" 
    -p "vendor_b:none:0:main" -i "vendor_b=./vendor_b.img" 
    -p "vendor_a:none:411607040:main" -i "vendor_a=./vendor_a.img" 
    --output ./super.img

I must say that I had to place vendor_b before vendor_a because it being a 0 byte partition made lpmake complain if it was the last partition. To get the actual size of each partition I used the result of "stat" command for each, and I used a metadata-size of 65536 as it was "recommended" online.

Lastly, I flashed it to the phone through MTKClient:

 python mtk w super super.img

The partition was written successfully and the device started correctly but I could not see any changes. So I dumped once again the super image from the phone, and I verified the changes were actually applied to the ROM, and that is when I got really confused. I also tried removing files and adding files to the partition, only to find that the device do not see the changes but they seem to be there when I dump it back tu my PC.

I would really appreciate if someone could help me figure out what I am doing wrong.

  • disable dm-verity/FEC first
    – alecxs
    Commented Jul 4, 2023 at 7:26
  • I tried disabling dm-verity using the command fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img using the vbmeta_a.img image that I dumped with MTKClient, but that always results in a bootloop. What am I doing wrong? Commented Jul 4, 2023 at 10:14
  • you could try to flash vbmeta_a and vbmeta_b instead
    – alecxs
    Commented Jul 4, 2023 at 10:53
  • I tried flashing vbmeta_a and b with the parameters to disable. The phone does its boot process (shows boot logo) but when it has to show the boot animation it turns off. Same thing happened when I tried to patch vbmeta_a with Magisk and flashed it with MTKClient. Perhaps I have to patch some other partition as well? Commented Jul 5, 2023 at 10:48
  • Maybe. can you double check vbmeta is disabled? android.stackexchange.com/questions/221756/…
    – alecxs
    Commented Jul 5, 2023 at 12:30


You must log in to answer this question.

Browse other questions tagged .