Patching vbmeta

RestlessOS isn't signed with your vendor's keys. With Android Verified Boot (AVB) enabled, the device refuses to boot it or bootloops, so verification has to be disabled in the vbmeta partition. The stock vbmeta.img alone isn't enough, it has to be patched.

Use the vbmeta.img from the stock firmware currently installed on your device (or your own backup, see Backing up your device).

What the patch does

The vbmeta header has a 32-bit big-endian flags field at offset 120. Its last byte, offset 123 (0x7B), holds two bits:

Value	Meaning
0x01	dm-verity (hashtree) disabled
0x02	verification disabled
0x03	both, this is what you need

With fastboot

fastboot patches the image while flashing, the file on your PC stays as it is:

fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img

Patching the file

Needed for the recovery method, or when you want to keep a patched image.

Check that the file is a vbmeta image, it must start with AVB0:

head -c 4 vbmeta.img; echo

Linux / macOS:

printf '\003' | dd of=vbmeta.img bs=1 seek=123 count=1 conv=notrunc
xxd -s 120 -l 4 vbmeta.img

The xxd output must show 0000 0003.

Windows: open vbmeta.img in a hex editor such as HxD, go to offset 7B, change the byte to 03 and save.

Flash the patched image from fastboot (without the extra flags), or from TWRP / OrangeFox with Install > Install Image > vbmeta.img > Vbmeta.

If it still doesn't boot

Verified boot differs between vendors. Search for your phone model on the internet or on forums like XDA, most devices have a GSI guide or a prebuilt vbmeta image.

Check a prebuilt vbmeta the same way as above before flashing it: it must start with AVB0 and show 0000 0003 at offset 120. You can also build one yourself with avbtool from AOSP's external/avb:

python3 avbtool.py make_vbmeta_image --flags 3 --padding_size 4096 --output vbmeta_disabled.img