Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bootloop after ODIN flash (update) #6230

Closed
RV7PR opened this issue Aug 30, 2022 · 54 comments
Closed

Bootloop after ODIN flash (update) #6230

RV7PR opened this issue Aug 30, 2022 · 54 comments
Labels
not our issue This issue is caused by third-party like customized rom or module wontfix Not going to fix it

Comments

@RV7PR
Copy link
Contributor

RV7PR commented Aug 30, 2022

Device: Samsung Galaxy A53 (SM-A536B)
Android version: 12
Magisk version name: 38325e7
Magisk version code: 25203

logs.zip

error

@RV7PR
Copy link
Contributor Author

RV7PR commented Aug 31, 2022

make sure you patch the boot image in magisk manager through A53 itself. i.e install magisk manager on A53, patch the boot image and flash it. also what region is your phone from?

I have for the past 3 years with 2 different phones, never a problem. I use a usb flash drive to transfer de patched tar file and then flash with odin, i always check if file is corrupted. I'm using EUX, its the european union version

@zonestc1

This comment was marked as spam.

@nemesis03
Copy link

I probably have the same problem with my Samsung Galaxy S22. With the current firmware (S901BXXU2AVH9 EUX, security patch level 01.09.2022) I get a bootloop after flashing the patched firmware. I patched the firmware like I always do (transfer AP file via ADB patch on my S22, pull the patched file via ADB and then flash the complete firmware with the patched file instead of AP). I tried with magisk 25200 and 25203.
Flashing the old patched firmware (S901BXXU2AVG6, security patch level 01.08.2022) works and the phone boots normally

@Igetin
Copy link

Igetin commented Sep 4, 2022

In case it helps, I'm also using a Galaxy S22 from the same region, and I did a full initial install of Magisk with the same latest firmware (S901BXXU2AVH9 EUX), and did not experience any boot loops. So, if what you're exeriencing is a bug or incompatibility issue with Magisk (and not an incorrect flashing procedure from the user), the problem is likely only related to upgrading the OS for an existing Magisk install.

One thing that came to my mind: the Odin release version might affect the results, so could you tell which version did you use, @nemesis03? I did the initial install with Odin v3.14.1 (original/unpatched).

When the next official firmware version arrives, I'll be doing the OS upgrade for the first time on my device, and report here about the results.

@RV7PR
Copy link
Contributor Author

RV7PR commented Sep 5, 2022

I flashed patched tar created with magisk manager. then the boot got stuck and tried many times again without success so i flashed twrp to get logs and had to flash stock + wiping all data to boot again and after initial boot I flashed patched tar again for root and now it works but I did lose all my data.

@nemesis03
Copy link

I used an Odin v3.14.4 from somewhere, now I also tried Odin v3.14.1 (original and patched) from xda-developer forum. With these two version also the same result: bootloops with the newest firmware version.
I don't want to do a full wipe and will wait for the next firmware or a solution.
If this problem persists for future firmware updates we need some kind of fix, because a full data wipe with every firmware update is not very convenient.
In this issue (#6136) a user had a similar problem and solved it by removing the avb flags from the fstab. I did not try this yet, because I am not accustomed to patching the boot image manually, but I might try when I have some time. On the other hand I am not sure if this solves the problem, because I would expect this problem to persist even after a data wipe.

@nemesis03
Copy link

I just tried to update to the recent firmware (S901BXXS2AVHD) with magisk, but again bootloops.
Has anyone tried the update from a patched S901BXXU2AVH9 to a patched S901BXXS2AVHD without wiping all data?
Does anyoune have further information about manually patching the avb flags in the boot image?

@rajarshikhatua100
Copy link

same problem with my Samsung galaxy M31

@zonestc1

This comment was marked as spam.

@nemesis03
Copy link

I just tried an update to the latest firmware (S901BXXS2AVI7) and again had bootloops.
I even tried repatching the ramdisk with magiskboot with KEEPVERITY=false, but again bootloops. On the other hand I am not experienced with the process of manually patching with magiskboot.
Now I am back on the last working firmware from July.

@RV7PR @Igetin Did you manage to upgrade to newer magisk-patched firmwares without having to wipe the data partition?

Does anyone know how to disable KEEPVERITY in magisk without having to manually patch the files? I tried "echo KEEPVERITY=false>>/cache/.magisk" and "echo KEEPVERITY=false>>/data/.magisk", but that did not change anything.

Or any other idea why the bootloops happen and how to update to a newer firmware without having bootloops? Maybe @osm0sis has some ideas?

@Igetin
Copy link

Igetin commented Oct 22, 2022

@RV7PR @Igetin Did you manage to upgrade to newer magisk-patched firmwares without having to wipe the data partition?

I haven’t tried yet, I’m still on the initial Magisk install (firmware S901BXXU2AVH9, released on August 31). I’ll try to find the time to test an upgrade next weekend.

@Igetin
Copy link

Igetin commented Oct 30, 2022

@nemesis03

Alright, I have now tried the upgrade for the Magisk-patched firmware, and I was able to successfully boot the new firmware after the flash. I upgraded from version S901BXXU2AVH9 to version S901BXXS2AVHD (EUX region). The user data is intact, and I did not have to perform a full wipe.

As described in the documentation, I did the flashing process exactly the same as with my initial install, except for the fact that I used the HOME_CSC tar archive for the "CSC" option in ODIN. I used ODIN version v3.14.1, and I have not touched anything in the options tab, i.e. I am using the default settings.

This is how ODIN looked after the flashing completed. The phone rebooted to the normal "bootloader unlocked" warning screen, after which it went to the Galaxy logo screen, after which it showed "Erasing…" for a while (not sure what that means here) and rebooted again. Then it eventually went from the Galaxy logo screen to the "Optimizing apps…" screen and to the lock screen. The whole startup took a few minutes at most.

My Magisk version is 25.2. Looking at your posts, you've used the same ODIN and Magisk version, have the same region model as I do, and also tried the same upgrade path that I did just now (*U2AVH9 → *S2AVHD). Our setup seems to be very similar, so I don't really have an idea why it's not working for you. 🙁 I can only suggest to triple-check the correct file selection in ODIN, but I suppose you have already done that.

I hope you are able to find a solution!

@hyperio546
Copy link

Device: Samsung Galaxy A53 (SM-A536B) Android version: 12 Magisk version name: 38325e7 Magisk version code: 25203

logs.zip

error

I had the exact issue on my Samsung Galaxy A03

@nemesis03
Copy link

Alright, I have now tried the upgrade for the Magisk-patched firmware, and I was able to successfully boot the new firmware after the flash. I upgraded from version S901BXXU2AVH9 to version S901BXXS2AVHD (EUX region). The user data is intact, and I did not have to perform a full wipe.

That sounds promising. I will probably do a full back up, then give it another try with the latest firmware (S901BXXU2BVJA, Android 13) and if that does not work wipe all data and restore from backup after upgrading to android 13. Might not be a bad idea to start with a wiped phone on android 13.

It still bothers me that there is no real solution to this problem...

@RV7PR
Copy link
Contributor Author

RV7PR commented Nov 12, 2022

Just did the upgrade with success with my Samsung Galaxy A53 (SM-A536B)
Went from: A536BXXU3AVGA Android 12 2022-08-26
To: A536BXXU4BVJG Android 13 2022-11-09

PS: I'm getting OTA updates from samsung for about 3 months even though my bootloader is unlocked and I'm rooted, you guys get them too?

@rootback123
Copy link

probably the cause of the problems could be some module, because I really uninstalled all after failing and then it worked.

@RV7PR
Copy link
Contributor Author

RV7PR commented Dec 4, 2022

Well.. I did use Magisk Bootloop Protector with patched boot image so I changed that to "basic function" (without patched boot image) just to be sure and then it worked but I'm not sure if it has anything to do with it.
@HuskyDG is it an possibility?

@nemesis03
Copy link

I finally solved this by wiping all my data. I did an upgrde to S901BXXU2BVJA (Android 13) and had bootloops. I then wiped the data and after that the device booted again. After setting up magisk I was able to upgrade to S901BXXU2BVKB without any issues. Unfortunately I had difficulties to restore my titanium backup, so I decided to downgrade to the last working firmware (S901BXXU2AVG6) and wipe data again. That was a bad decision, because I again was unable to update to a newer firmware. In the end I installed S901BXXS2AVHD and wiped data again, then restored my backups and then upgraded to S901BXXU2BVKB (Android 13) without issues.
So even a freshly setup S901BXXU2AVG6 was not able to upgrade.

probably the cause of the problems could be some module, because I really uninstalled all after failing and then it worked.
I only use zygisk with safetynetfix. So in my case it was either safetynetfix or something entirely different

@hyperio546
Copy link

I solved this for my device by only flashing boot.img in AP slot in Odin. Rooted now.

@nettnikl
Copy link

nettnikl commented Feb 7, 2023

Hi, i'm using a G975 (S10+) and experienced a similar boot loop without installing any update recently. Could this have the same cause as #6136 (that nemesis mentioned also)?

Also @Igetin - you mentioned you successfully upgraded, did you ever experience a boot loop?

@hyperio546 - you just used the same patched boot.img?

@hyperio546
Copy link

Hi, i'm using a G975 (S10+) and experienced a similar boot loop without installing any update recently. Could this have the same cause as #6136 (that nemesis mentioned also)?

Also @Igetin - you mentioned you successfully upgraded, did you ever experience a boot loop?

@hyperio546 - you just used the same patched boot.img?

I patched the boot.img of the new firmware and then flashed stock ap + bl + cp + home_csc and then boot.img separately.

@nettnikl
Copy link

nettnikl commented Feb 7, 2023

@hyperio546 Thanks for the quick answer! So, just to confirm for dummys like me: So, you

  • had a rooted device
  • flashed a new firmware
  • had the boot loop
  • flashed stock ap + bl + cp + home_csc (keeping your data intact)
  • the boot loop was gone (or did you not try and restart then?)
  • patched boot.img with a recent magisk version on another, unrelated device
  • flashed the patched boot.img (keeping your data intact once again)
  • had a rooted, boot loop free system again

@Igetin
Copy link

Igetin commented Feb 7, 2023

Also @Igetin - you mentioned you successfully upgraded, did you ever experience a boot loop?

Nope, not once on this device.

@hyperio546
Copy link

@hyperio546 Thanks for the quick answer! So, just to confirm for dummys like me: So, you

  • had a rooted device
  • flashed a new firmware
  • had the boot loop
  • flashed stock ap + bl + cp + home_csc (keeping your data intact)
  • the boot loop was gone (or did you not try and restart then?)
  • patched boot.img with a recent magisk version on another, unrelated device
  • flashed the patched boot.img (keeping your data intact once again)
  • had a rooted, boot loop free system again

I did not have a bootloop. After flashing the stock firmware it seemed to boot and operate just fine. Then I flashed patched boot.img. I patched it on the same device before upgrading.

@nettnikl
Copy link

nettnikl commented Feb 7, 2023

I did not have a bootloop. After flashing the stock firmware it seemed to boot and operate just fine. Then I flashed patched boot.img. I patched it on the same device before upgrading.

It did not boot at all then, failing with the mentioned error message?

@hyperio546
Copy link

I did not have a bootloop. After flashing the stock firmware it seemed to boot and operate just fine. Then I flashed patched boot.img. I patched it on the same device before upgrading.

It did not boot at all then, failing with the mentioned error message?

It booted. Flashing patched AP files bootlooped it.

@XDABlackMesa123
Copy link
Contributor

If you haven't flashed a patched vbmeta image after unlocking your bootloader you must format your data partition in recovery mode in order to be able to boot again.

@nettnikl
Copy link

you must format your data partition in recovery mode in order to be able to boot again

@blackmesa123
Could you elaborate on that? I'm not an expert and would be very interested, under which circumstances you would say this is the case.

@hyperio546
Copy link

you must format your data partition in recovery mode in order to be able to boot again

@blackmesa123
Could you elaborate on that? I'm not an expert and would be very interested, under which circumstances you would say this is the case.

It means that you gotta factory reset using the recovery.

@nettnikl
Copy link

Thanks for your answer! But let me clarify: which factor do you see, that makes that necessary? I'm trying to understand, whether thats also the case for me..

@XDABlackMesa123
Copy link
Contributor

Thanks for your answer! But let me clarify: which factor do you see, that makes that necessary? I'm trying to understand, whether thats also the case for me..

What actually happens is that the Keymaster TA will fail to verify the data partition encryption key at boot. This is what normally happens:

01-14 23:37:17.405   688   688 D keymaster_swd: keymaster_swd [WRN] (tz_app_init:105) Start MDFPP keymaster version 4.4.08
01-14 23:37:17.405   688   688 D keymaster_swd: keymaster_swd [WRN] (tz_app_init:109) Tl initialization done 
01-14 23:37:17.405   688   688 D keymaster_swd: keymaster_swd [WRN] (get_root_of_trust_info:834) ICCC os_patchlevel       : 369
01-14 23:37:17.405   688   688 D keymaster_swd: keymaster_swd [WRN] (get_root_of_trust_info:835) ICCC boot_patchlevel     : 2417
01-14 23:37:17.405   688   688 D keymaster_swd: keymaster_swd [WRN] (get_root_of_trust_info:836) ICCC vendor_patchlevel   : 2417
01-14 23:37:17.405   688   688 D keymaster_swd: keymaster_swd [WRN] (tz_init_bootloader_info:1101) verified_boot_state : 2
01-14 23:37:17.405   688   688 D keymaster_swd: keymaster_swd [WRN] (tz_init_bootloader_info:1102) device_locked       : 0
01-14 23:37:17.405   688   688 D keymaster_swd: keymaster_swd [WRN] (tz_init_bootloader_info:1103) os_version          : 130000
01-14 23:37:17.405   688   688 D keymaster_swd: keymaster_swd [WRN] (tz_init_bootloader_info:1111) os_patchlevel       : 202301
01-14 23:37:17.405   688   688 D keymaster_swd: keymaster_swd [WRN] (tz_init_bootloader_info:1112) boot_patchlevel     : 20230101
01-14 23:37:17.405   688   688 D keymaster_swd: keymaster_swd [WRN] (tz_init_bootloader_info:1113) vendor_patchlevel   : 20230101
01-14 23:37:17.405   688   688 D keymaster_swd: keymaster_swd [WRN] (km_dump_hex:131) verified_boot_key[32] : 
01-14 23:37:17.405   688   688 D keymaster_swd: keymaster_swd [WRN] (km_dump_hex:138) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
01-14 23:37:17.405   688   688 D keymaster_swd: keymaster_swd [WRN] (km_dump_hex:146) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
01-14 23:37:17.405   688   688 D keymaster_swd: keymaster_swd [WRN] (km_dump_hex:131) verified_boot_hash[32] : 
01-14 23:37:17.405   688   688 D keymaster_swd: keymaster_swd [WRN] (km_dump_hex:138) 6f b9 4c b4 38 ec 12 37 85 cd 53 2f a4 ce 8f c2 
01-14 23:37:17.405   688   688 D keymaster_swd: keymaster_swd [WRN] (km_dump_hex:146) f7 68 c9 d2 74 a8 49 a0 b9 79 1c 2f 38 78 e9 7e 
01-14 23:37:17.405   688   688 D keymaster_swd: keymaster_swd [WRN] (tz_init_bootloader_info:1118) warranty bit        : 1
01-14 23:37:17.405   688   688 D keymaster_swd: keymaster_swd [WRN] (tz_init_bootloader_info:1119) trust boot status   : 1
01-14 23:37:17.405   688   688 D keymaster_swd: keymaster_swd [WRN] (swd_run_cb:254) swd_configure() returns 0
01-14 23:37:17.419   688   688 W keymaster_tee: [WRN]begin req PARAMS: B32 P1 
01-14 23:37:17.422   688   688 D keymaster_swd: keymaster_swd [WRN] (swd_set_rot_integrity_status:346) Integrity broken state integrity_flag=0x6,lock_state=0,boot_state=2
01-14 23:37:17.422   688   688 D keymaster_swd: keymaster_swd [WRN] (swd_run_cb:254) swd_begin() returns 0
01-14 23:37:17.424   688   688 D keymaster_swd: keymaster_swd [WRN] (swd_run_cb:254) swd_update() returns 0
01-14 23:37:17.426   688   688 D keymaster_swd: keymaster_swd [WRN] (swd_run_cb:254) swd_finish() returns 0

This is what happens when the key verification fails:

02-14 11:55:25.781   509   509 D keymaster_swd: keymaster_swd [WRN] (tz_app_init:105) Start MDFPP keymaster version 4.4.08
02-14 11:55:25.781   509   509 D keymaster_swd: keymaster_swd [WRN] (tz_app_init:109) Tl initialization done 
02-14 11:55:25.781   509   509 D keymaster_swd: keymaster_swd [WRN] (get_device_integrity_status:782) build_type : eng
02-14 11:55:25.781   509   509 D keymaster_swd: keymaster_swd [WRN] (get_root_of_trust_info:834) ICCC os_patchlevel       : 369
02-14 11:55:25.781   509   509 D keymaster_swd: keymaster_swd [WRN] (get_root_of_trust_info:835) ICCC boot_patchlevel     : 2417
02-14 11:55:25.781   509   509 D keymaster_swd: keymaster_swd [WRN] (get_root_of_trust_info:836) ICCC vendor_patchlevel   : 2417
02-14 11:55:25.781   509   509 D keymaster_swd: keymaster_swd [WRN] (tz_init_bootloader_info:1101) verified_boot_state : 2
02-14 11:55:25.782   509   509 D keymaster_swd: keymaster_swd [WRN] (tz_init_bootloader_info:1102) device_locked       : 0
02-14 11:55:25.782   509   509 D keymaster_swd: keymaster_swd [WRN] (tz_init_bootloader_info:1103) os_version          : 130000
02-14 11:55:25.782   509   509 D keymaster_swd: keymaster_swd [WRN] (tz_init_bootloader_info:1111) os_patchlevel       : 202301
02-14 11:55:25.782   509   509 D keymaster_swd: keymaster_swd [WRN] (tz_init_bootloader_info:1112) boot_patchlevel     : 20230101
02-14 11:55:25.782   509   509 D keymaster_swd: keymaster_swd [WRN] (tz_init_bootloader_info:1113) vendor_patchlevel   : 20230101
02-14 11:55:25.782   509   509 D keymaster_swd: keymaster_swd [WRN] (km_dump_hex:131) verified_boot_key[32] : 
02-14 11:55:25.782   509   509 D keymaster_swd: keymaster_swd [WRN] (km_dump_hex:138) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
02-14 11:55:25.782   509   509 D keymaster_swd: keymaster_swd [WRN] (km_dump_hex:146) 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
02-14 11:55:25.782   509   509 D keymaster_swd: keymaster_swd [WRN] (km_dump_hex:131) verified_boot_hash[32] : 
02-14 11:55:25.782   509   509 D keymaster_swd: keymaster_swd [WRN] (km_dump_hex:138) 65 8d be 7a 51 01 86 0f a1 5d 9c 02 e1 1c 1c b7 
02-14 11:55:25.782   509   509 D keymaster_swd: keymaster_swd [WRN] (km_dump_hex:146) 35 b7 4b 48 59 72 29 98 39 9c ad 17 c7 bf cb ae 
02-14 11:55:25.782   509   509 D keymaster_swd: keymaster_swd [WRN] (tz_init_bootloader_info:1118) warranty bit        : 1
02-14 11:55:25.782   509   509 D keymaster_swd: keymaster_swd [WRN] (tz_init_bootloader_info:1119) trust boot status   : 1
02-14 11:55:25.782   509   509 D keymaster_swd: keymaster_swd [WRN] (swd_run_cb:254) swd_configure() returns 0
02-14 11:55:26.761   509   509 W keymaster_tee: [WRN]begin req PARAMS: B32 P1 
02-14 11:55:26.765   509   509 D keymaster_swd: keymaster_swd [ERR] (tz_check_oem:74) Device is compromized: fuse loc=5,status=0,sw_fuse_blown=1
02-14 11:55:26.765   509   509 D keymaster_swd: keymaster_swd [ERR] (aes_gcm_decrypt_finish:593) failed
02-14 11:55:26.765   509   509 D keymaster_swd: keymaster_swd [ERR] (handle_evp_error:554) Verification failed
02-14 11:55:26.765   509   509 D keymaster_swd: keymaster_swd [ERR] (aes256_gcm_decrypt:698) aes_gcm_decrypt_finish() failed. err = -30
02-14 11:55:26.765   509   509 D keymaster_swd: keymaster_swd [ERR] (tz_unwrap:226) tz_wrap_unwrap FAILED [-30]
02-14 11:55:26.765   509   509 D keymaster_swd: keymaster_swd [ERR] (swd_decrypt_ekey:341) km_unwrap() failed
02-14 11:55:26.765   509   509 D keymaster_swd: keymaster_swd [WRN] (swd_decrypt_ekey:345) check with the legacy fallback for orange state
02-14 11:55:26.765   509   509 D keymaster_swd: keymaster_swd [ERR] (aes_gcm_decrypt_finish:593) failed
02-14 11:55:26.765   509   509 D keymaster_swd: keymaster_swd [ERR] (handle_evp_error:554) Verification failed
02-14 11:55:26.765   509   509 D keymaster_swd: keymaster_swd [ERR] (aes256_gcm_decrypt:698) aes_gcm_decrypt_finish() failed. err = -30
02-14 11:55:26.765   509   509 D keymaster_swd: keymaster_swd [ERR] (tz_unwrap:226) tz_wrap_unwrap FAILED [-30]
02-14 11:55:26.765   509   509 D keymaster_swd: keymaster_swd [ERR] (swd_decrypt_ekey:355) km_unwrap() failed
02-14 11:55:26.765   509   509 D keymaster_swd: keymaster_swd [WRN] (swd_key_deserialize_ekey:461) swd_decrypt_ekey() failed
02-14 11:55:26.765   509   509 D keymaster_swd: keymaster_swd [ERR] (km_deserialize_key:284) Failed to deserialize key
02-14 11:55:26.765   509   509 D keymaster_swd: keymaster_swd [ERR] (swd_begin:423) Failed with error: 4294967
02-14 11:55:26.765   509   509 D keymaster_swd: keymaster_swd [WRN] (swd_run_cb:254) swd_begin() returns -33

So the only way to boot again in your device is either by reflashing the stock binaries or formatting the data partition in recovery in order to generate a new data partition encrypt key.

@nettnikl
Copy link

Ah, i see. Thank you so much for your insightful descriptions and the example (kernel?) logs.
I think for me the issue might be different then, as i cannot find those log statements on my machine.

By the way, to everyone helping android newbies like me (as well as silent watchers), thank you very much, you're the reason projects like this are so appealing to newcomers!

@XDABlackMesa123
Copy link
Contributor

Ah, i see. Thank you so much for your insightful descriptions and the example (kernel?) logs.

I think for me the issue might be different then, as i cannot find those log statements on my machine.

I highly doubt that's the case, those are system logs since the keymaster service runs in system, not in kernel.

@hyperio546
Copy link

Ah, i see. Thank you so much for your insightful descriptions and the example (kernel?) logs.

I think for me the issue might be different then, as i cannot find those log statements on my machine.

I highly doubt that's the case, those are system logs since the keymaster service runs in system, not in kernel.

You actually mean that flashing patched ap caused bootloops because of keymaster on my phone too?

@XDABlackMesa123
Copy link
Contributor

You actually mean that flashing patched ap caused bootloops because of keymaster on my phone too?

As I've explained, yes. It's better to call this a boot failure since this is not a bootloop at all.

@hyperio546
Copy link

You actually mean that flashing patched ap caused bootloops because of keymaster on my phone too?

As I've explained, yes. It's better to call this a boot failure since this is not a bootloop at all.

Then how did flashing patched boot.img work and I typing this from my rooted phone?

@XDABlackMesa123
Copy link
Contributor

XDABlackMesa123 commented Feb 14, 2023

Then how did flashing patched boot.img work and I typing this from my rooted phone?

Your phone probably already has a patched vbmeta image in place, without it you shouldn't even be able to pass the bootloader screen. You don't have to format your data partition every time you flash new stuff, just when switching from a stock vbmeta img to a patched one (according to my tests).

@hyperio546
Copy link

Then how did flashing patched boot.img work and I typing this from my rooted phone?

Your phone probably already has a patched vbmeta image in place, without it you shouldn't even be able to pass the bootloader screen. You don't have to format your data partition every time you flash new stuff, just when switching from a stock vbmeta img to a patched one (according to my tests).

I believe I am confused. The patched AP also has patched vbmeta and after flashing it I couldn't boot. But after flashing stock vbmeta inside of UNMODFIED AP and then flashing ONLY patched boot.img works. How??

@XDABlackMesa123
Copy link
Contributor

I believe I am confused. The patched AP also has patched vbmeta and after flashing it I couldn't boot. But after flashing stock vbmeta inside of UNMODFIED AP and then flashing ONLY patched boot.img works. How??

This is very strange. Normally the bootloader will refuse to load any image if the hashtree doesn't matches, so a patched vbmeta is required. This is a bootloader log from my phone (Galaxy A52s 5G) with a patched vbmeta:

avb_slot_verify.c:577: DEBUG: Loading vbmeta struct from partition 'vbmeta'.
{ 2531988 }[ ABL ] Load Image vbmeta total time: 1 ms 
{ 2532079 }[ ABL ] avb_vbmeta_image.c{ 2532110 }[ ABL ] :{ 2532110 }[ ABL ] 206{ 2532110 }[ ABL ] : ERROR: { 2532140 }[ ABL ] Hash does not match!
{ 2532171 }[ ABL ] avb_slot_verify.c{ 2532171 }[ ABL ] :{ 2532201 }[ ABL ] 638{ 2532201 }[ ABL ] : ERROR: { 2532232 }[ ABL ] vbmeta{ 2532232 }[ ABL ] : Error verifying vbmeta image: { 2532262 }[ ABL ] HASH_MISMATCH{ 2532262 }[ ABL ] 
avb_slot_verify.c:824: DEBUG: vbmeta: VERIFICATION_DISABLED bit is set.

Having some debug logs (last_kmsg) could help us understand why you are still able to boot with the old encrypt key even though you have installed a custom unsigned binary.

@hyperio546
Copy link

I believe I am confused. The patched AP also has patched vbmeta and after flashing it I couldn't boot. But after flashing stock vbmeta inside of UNMODFIED AP and then flashing ONLY patched boot.img works. How??

This is very strange. Normally the bootloader will refuse to load any image if the hashtree doesn't matches, so a patched vbmeta is required. This is a bootloader log from my phone (Galaxy A52s 5G) with a patched vbmeta:

avb_slot_verify.c:577: DEBUG: Loading vbmeta struct from partition 'vbmeta'.
{ 2531988 }[ ABL ] Load Image vbmeta total time: 1 ms 
{ 2532079 }[ ABL ] avb_vbmeta_image.c{ 2532110 }[ ABL ] :{ 2532110 }[ ABL ] 206{ 2532110 }[ ABL ] : ERROR: { 2532140 }[ ABL ] Hash does not match!
{ 2532171 }[ ABL ] avb_slot_verify.c{ 2532171 }[ ABL ] :{ 2532201 }[ ABL ] 638{ 2532201 }[ ABL ] : ERROR: { 2532232 }[ ABL ] vbmeta{ 2532232 }[ ABL ] : Error verifying vbmeta image: { 2532262 }[ ABL ] HASH_MISMATCH{ 2532262 }[ ABL ] 
avb_slot_verify.c:824: DEBUG: vbmeta: VERIFICATION_DISABLED bit is set.

Having some debug logs (last_kmsg) could help us understand why you are still able to boot with the old encrypt key even though you have installed a custom unsigned binary.

How would I achieve that?

@XDABlackMesa123
Copy link
Contributor

How would I achieve that?

adb shell su -c cat /proc/last_kmsg > last_kmsg

At the end of the file there should be the current bootloader boot logs with every necessary info.

@hyperio546
Copy link

How would I achieve that?

adb shell su -c cat /proc/last_kmsg > last_kmsg

At the end of the file there should be the current bootloader boot logs with every necessary info.

Screenshot_20230215_152055_Termux.jpg

Gives me no output!

@XDABlackMesa123
Copy link
Contributor

The output has been printed inside the last_kmsg file of the directory you ran that cmd in. So it's stored in /data/data/com.termux/files/home/last_kmsg.

@hyperio546
Copy link

The output has been printed inside the last_kmsg file of the directory you ran that cmd in. So it's stored in /data/data/com.termux/files/home/last_kmsg.

last_kmsg.txt
Done

@XDABlackMesa123
Copy link
Contributor

XDABlackMesa123 commented Feb 16, 2023

last_kmsg.txt Done

Still can't find a reason why the AVB checks pass anyway even though you're using a patched Magisk kernel image. I did download your phone's firmware and tested myself and the check does fail indeed.

Stock kernel:

A035F_fw avbtool verify_image --image vbmeta.img --follow_chain_partitions
Verifying image boot.img using embedded public key
vbmeta: Successfully verified footer and SHA256_RSA4096 vbmeta struct in boot.img
boot: Successfully verified sha256 hash of boot.img for image of 24666640 bytes

Magisk patched kernel:

A035F_fw avbtool verify_image --image vbmeta.img --follow_chain_partitions
Verifying image boot.img using embedded public key
vbmeta: Successfully verified footer and SHA256_RSA4096 vbmeta struct in boot.img
sha256 digest of boot.img does not match digest in descriptor
/home/mesa/bin/avbtool: Error verifying descriptor.

It might just be how libavb is implemented in your SoC's bootloader (not correctly lol), yours is a lucky case.

@hyperio546
Copy link

last_kmsg.txt Done

Still can't find a reason why the AVB checks pass anyway even though you're using a patched Magisk kernel image. I did download your phone's firmware and tested myself and the check does fail indeed.

Stock kernel:

A035F_fw avbtool verify_image --image vbmeta.img --follow_chain_partitions
Verifying image boot.img using embedded public key
vbmeta: Successfully verified footer and SHA256_RSA4096 vbmeta struct in boot.img
boot: Successfully verified sha256 hash of boot.img for image of 24666640 bytes

Magisk patched kernel:

A035F_fw avbtool verify_image --image vbmeta.img --follow_chain_partitions
Verifying image boot.img using embedded public key
vbmeta: Successfully verified footer and SHA256_RSA4096 vbmeta struct in boot.img
sha256 digest of boot.img does not match digest in descriptor
/home/mesa/bin/avbtool: Error verifying descriptor.

It might just be how libavb is implemented in your SoC's bootloader (not correctly lol), yours is a lucky case.

Sorry for coming again after so long but I just remembered that this phone was distributed by the government in my state and was loaded with work policies. I wasn't possible to change the wallpaper too. So this phones is not a normal one.

@osm0sis osm0sis added the needs investigation Reason of this issue is yet unkown label Mar 1, 2023
@vvb2060
Copy link
Collaborator

vvb2060 commented Mar 14, 2023

Magisk/docs/install.md

Lines 126 to 127 in fe6b658

- **Never, ever** try to restore either `boot`, `recovery`, or `vbmeta` partitions back to stock! You can brick your device by doing so, and the only way to recover from this is to do a full Odin restore with data wipe.
- To upgrade your device with a new firmware, **NEVER** directly use the stock `AP` tar file with reasons mentioned above. **Always** patch `AP` in the Magisk app and use that instead.

Nothing to do with Magisk.

@vvb2060 vvb2060 closed this as not planned Won't fix, can't repro, duplicate, stale Mar 14, 2023
@vvb2060 vvb2060 added wontfix Not going to fix it not our issue This issue is caused by third-party like customized rom or module and removed needs investigation Reason of this issue is yet unkown labels Mar 14, 2023
@hyperio546
Copy link

hyperio546 commented Mar 21, 2023

Magisk/docs/install.md

Lines 126 to 127 in fe6b658

- **Never, ever** try to restore either `boot`, `recovery`, or `vbmeta` partitions back to stock! You can brick your device by doing so, and the only way to recover from this is to do a full Odin restore with data wipe.
- To upgrade your device with a new firmware, **NEVER** directly use the stock `AP` tar file with reasons mentioned above. **Always** patch `AP` in the Magisk app and use that instead.

Nothing to do with Magisk.

Exceptions exist. Not all phones are same. Also this is your problem because I have been hit with the exact same problem too.

@XDABlackMesa123
Copy link
Contributor

Exceptions exist. Not all phones are same. Also this is your problem because I have been hit with the exact same problem too.

As explained in #6230 (comment) this is normal and has nothing to do with Magisk since it is not a bug. Your case is different because your phone boots normally with AVB enabled even though it shouldn’t, which means there’s a bug in your phone’s bootloader which can be fixed by Samsung anytime.

@XDABlackMesa123
Copy link
Contributor

XDABlackMesa123 commented Mar 21, 2023

I also saw too late this was already noted in the install instructions, it may needs to be pointed out even better

- Your device should reboot automatically once Odin finished flashing. Agree to do a factory reset if asked.

@hyperio546
Copy link

Exceptions exist. Not all phones are same. Also this is your problem because I have been hit with the exact same problem too.

As explained in #6230 (comment) this is normal and has nothing to do with Magisk since it is not a bug. Your case is different because your phone boots normally with AVB enabled even though it shouldn’t, which means there’s a bug in your phone’s bootloader which can be fixed by Samsung anytime.

I don't think that this is a bug. It shouldn't be able to boot into patched AP file because of hardware restrictions deep embedded into knox. As I pointed out before, its loaded with government knox policies. This is intended behaviour.

But on the flip side yes its not related to Magisk.

@Kyogre
Copy link

Kyogre commented Jun 17, 2023

Was same here with updating my S22 Exynos from S901BXXU4CWCG to S901BXXU5CWEA via Odin.
FYI. Before updating I had custom kernel (SLKernel) + Magisk 26.1 + system r/w patch applied via afaneh92_lp_rw_tool_v0.4 r/w.zip + disabled lock screen password. But maybe that doesn't matter at all.

After updating I also got this android rescue party trigger fs_mgr_mount_all error in TWRP log.

How I fixed bootloop without losing data:

  1. Flash normal TWRP (twrp-3.7.0_12-1_afaneh92-r0s.tar in AP slot + vbmeta_disabled_R.tar in USERDATA slot).
  2. Boot into TWRP and flashed afaneh's kernel (r0s_kernel_5.10.136-afaneh92-g4bd352ee8905-dirty_2023_02_21.zip in my case). But maybe that doesn't needed.
  3. Wipe cache and dalvik cache.
  4. And the most important step. In TWRP you should open terminal and execute multidisabler command, wait till it finished.
    If your TWRP doesn't have builtin multidisabler command, you can try to flash multidisabler from corsicanu as zip.
  5. Reboot to system.
    And as I already said: you don't even need to format data.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
not our issue This issue is caused by third-party like customized rom or module wontfix Not going to fix it
Projects
None yet
Development

No branches or pull requests

13 participants