Android 11 MIUI devices need enabled verification in boot.img AVBv2 signature

[qianmo-xw]

The Xiaomi device using MT6893 cannot start. After patching the boot, it shows infinite restart. I have disabled the vbmeta test. The models are RedmiNote10Pro and RedmiK40Gaming. I have used magiskboot extra cpio to prompt me that it failed. When I use Android_image_kitchen, the window flashes and nothing is unpacked. I think his boot has been specially encrypted. If you need it, I will upload the boot file for the study... Device: RedmiNote10Pro Android version:11 Magisk version name: V23 Magisk version code: 23001

[qianmo-xw]

when I upload file this say my file is too big....

[osm0sis]

So find another way to upload it or you're not providing anything useful and we'll have to close this issue...

[qianmo-xw]

So find another way to upload it or you're not providing anything useful and we'll have to close this issue...

This is link https://drive.google.com/file/d/1AefUeYQcBviQ7XSFFCnWfkkDZqx8ceSy/view?usp=drivesdk

[osm0sis]

So find another way to upload it or you're not providing anything useful and we'll have to close this issue...

This is link https://drive.google.com/file/d/1AefUeYQcBviQ7XSFFCnWfkkDZqx8ceSy/view?usp=drivesdk

It's asking me to request access. Can you set better permissions on it so I can just download directly?

[qianmo-xw]

So find another way to upload it or you're not providing anything useful and we'll have to close this issue...

This is link https://drive.google.com/file/d/1AefUeYQcBviQ7XSFFCnWfkkDZqx8ceSy/view?usp=drivesdk

It's asking me to request access. Can you set better permissions on it so I can just download directly?

Sorry,That is I first use google drive,I don't know how to change set permissions,I think this link will be OK ,try it,Thank you https://mega.nz/file/U94XnYbB#iAhwO8En4LitpbePmNNCTNvylBRtJh3lZB5aD4n66yM

[qianmo-xw]

So find another way to upload it or you're not providing anything useful and we'll have to close this issue...

This is link https://drive.google.com/file/d/1AefUeYQcBviQ7XSFFCnWfkkDZqx8ceSy/view?usp=drivesdk

It's asking me to request access. Can you set better permissions on it so I can just download directly?

Now , google drive also can download.

[osm0sis]

It's a pretty normal looking boot hdr_v2 image:

Android Image Kitchen - UnpackImg Script
by osm0sis @ xda-developers

Supplied image: boot.img

Setting up work folders...

Image type: AOSP

Signature with "AVBv2" type detected.

Splitting image to "split_img/"...
ANDROID! magic found at: 0
BOARD_KERNEL_CMDLINE bootopt=64S3,32N2,64N2
BOARD_KERNEL_BASE 0x40078000
BOARD_NAME 
BOARD_PAGE_SIZE 2048
BOARD_HASH_TYPE sha1
BOARD_KERNEL_OFFSET 0x00008000
BOARD_RAMDISK_OFFSET 0x11088000
BOARD_SECOND_OFFSET 0xbff88000
BOARD_TAGS_OFFSET 0x07c08000
BOARD_OS_VERSION 11.0.0
BOARD_OS_PATCH_LEVEL 2021-05
BOARD_HEADER_VERSION 2
BOARD_HEADER_SIZE 1660
BOARD_DTB_SIZE 200079
BOARD_DTB_OFFSET 0x07c08000

Unpacking ramdisk to "ramdisk/"...

Compression used: gzip
75114 blocks

Done!

Ramdisk looks like boot-as-recovery 2SI SAR.

[qianmo-xw]

It's a pretty normal looking boot hdr_v2 image:

Android Image Kitchen - UnpackImg Script
by osm0sis @ xda-developers

Supplied image: boot.img

Setting up work folders...

Image type: AOSP

Signature with "AVBv2" type detected.

Splitting image to "split_img/"...
ANDROID! magic found at: 0
BOARD_KERNEL_CMDLINE bootopt=64S3,32N2,64N2
BOARD_KERNEL_BASE 0x40078000
BOARD_NAME 
BOARD_PAGE_SIZE 2048
BOARD_HASH_TYPE sha1
BOARD_KERNEL_OFFSET 0x00008000
BOARD_RAMDISK_OFFSET 0x11088000
BOARD_SECOND_OFFSET 0xbff88000
BOARD_TAGS_OFFSET 0x07c08000
BOARD_OS_VERSION 11.0.0
BOARD_OS_PATCH_LEVEL 2021-05
BOARD_HEADER_VERSION 2
BOARD_HEADER_SIZE 1660
BOARD_DTB_SIZE 200079
BOARD_DTB_OFFSET 0x07c08000

Unpacking ramdisk to "ramdisk/"...

Compression used: gzip
75114 blocks

Done!

Ramdisk looks like boot-as-recovery 2SI SAR.

So should I try patch recovery.img？

[pndwal]

Doubt it, especially for Xiaomi.

Boot-as-recovery 2SI SAR just means a Hybrid ramdisk still in boot partition boots with USES_RECOVERY_AS_BOOT method.

Are you actually offered Recovery mode check box when patching? You'e trying with it unchecked, right?

[qianmo-xw]

Doubt it, especially for Xiaomi.

Boot-as-recovery 2SI SAR just means a Hybrid ramdisk still in boot partition boots with USES_RECOVERY_AS_BOOT method.

Are you actually offered Recovery mode check box when patching? You'e trying with it unchecked, right?

I tried patch boot and found that the machine was in a boot loop. Then I tried unpack boot, use magiskboot extract, they, and he displayed wirte file failed. When I used the windows version of android_kitchen_image, it did not extract any files. I think it might be that the boot is encrypted. , But you can unzip it. I think the version of windows tool is a bit low. I just tried unpack boot to check because the machine is in the boot loop. You mean I can try patch recovery.img to get magisk?

[osm0sis]

I already unpacked it in AIK and showed it's a hdr_v2 image, and looked into the ramdisk setup, so it's clearly not "encrypted" or anything. You don't have a recovery.img on your device, recovery is inside the boot.img.

[pndwal]

You mean I can try patch recovery.img to get magisk?

No. I don't know of any Xiaomi that need Magisk in recovery, and these should only include type III (ramdisk= no) devices (But Xiaomi is an exception). https://topjohnwu.github.io/Magisk/boot.html Yours is type IV. As long as ramdisk = yes in Magisk App you shouldn't even see Recovery mode check box. If you do, ensure its unchecked when patching boot.img. PW

Edit: Also, try Patching image with App restored (unhidden) if you hid it. And make sure it is actually the boot.img extracted from current ROM.

[Gong-Mi]

Is it related to vendor-boot.img

[osm0sis]

No. This device is hdr_v2 so does not have a vendor_boot.

[Gong-Mi]

magisk_install_log_2021-06-28T10_52_02Z (1).log magisk_install_log_2021-06-28T10_57_54Z.log

[Gong-Mi]

https://drive.google.com/file/d/1GeFyCfawejQMRR9nVLGDO88UFLsfrMWh/view?usp=sharing

[qianmo-xw]

It's a pretty normal looking boot hdr_v2 image:

Android Image Kitchen - UnpackImg Script
by osm0sis @ xda-developers

Supplied image: boot.img

Setting up work folders...

Image type: AOSP

Signature with "AVBv2" type detected.

Splitting image to "split_img/"...
ANDROID! magic found at: 0
BOARD_KERNEL_CMDLINE bootopt=64S3,32N2,64N2
BOARD_KERNEL_BASE 0x40078000
BOARD_NAME 
BOARD_PAGE_SIZE 2048
BOARD_HASH_TYPE sha1
BOARD_KERNEL_OFFSET 0x00008000
BOARD_RAMDISK_OFFSET 0x11088000
BOARD_SECOND_OFFSET 0xbff88000
BOARD_TAGS_OFFSET 0x07c08000
BOARD_OS_VERSION 11.0.0
BOARD_OS_PATCH_LEVEL 2021-05
BOARD_HEADER_VERSION 2
BOARD_HEADER_SIZE 1660
BOARD_DTB_SIZE 200079
BOARD_DTB_OFFSET 0x07c08000

Unpacking ramdisk to "ramdisk/"...

Compression used: gzip
75114 blocks

Done!

Ramdisk looks like boot-as-recovery 2SI SAR.

can you send me your Android Image Kitchen,I can not unpack boot

[qianmo-xw]

This is firmware partition, no vendor_boot no recovery image download url:https://bigota.d.miui.com/V12.5.3.0.RKPCNXM/chopin_images_V12.5.3.0.RKPCNXM_20210527.0000.00_11.0_cn_90be99bee5.tgz When I unpack boot This is boot.img:https://mega.nz/file/UxYgRToA#gClY-dySdRMCfkeNbSNsUWUKWurpemacIE8vG2Et1XA

[qianmo-xw]

No. This device is hdr_v2 so does not have a vendor_boot.

Oh,I found AIK3.8 in your twitter and xda, thank you.

[osm0sis]

That's the recovery fstab, but yes that might still be the case.

[qianmo-xw]

No. This device is hdr_v2 so does not have a vendor_boot.

I think MIUI not use default fstab file.So when patched boot device partition not mount? And this device can use offical dev MIUI version to get offical Root, Although use offical Root,He will also prompt that there is a problem inside your device, please contact your device manufacturer for details, but this does not matter, the device can still be used normally after pressing OK. When I tried to use offical root ls /dev/block/bootdevice/by-name/, I found the vendor_boot_b partition, and then I pulled it to my computer and tried to unpack but failed. Of course, I also backed up the original boot file. I found that the patch boot is in a boot loop. I tried to restore the original boot file. The device is still in the boot loop. If it follows the normal logic, the device should boot normally. Incredible This is vendor_boot partition file:https://mega.nz/file/0gB3hYaS#ZXMl73mWSKqw0JjkpfBdKjpX02JKF0yKxqFizTY1Io8

[Gong-Mi]

miui-blockota-ares-21.6.30-21.6.30.root-b0232e993b-11.0.zip miui k40g root ota https://183-2-128-134.ksyungslb.com/bigota.d.miui.com/21.6.30/miui-blockota-ares-21.6.30-21.6.30.root-b0232e993b-11.0.zip

[pndwal]

RedmiNote10Pro Device model caused me some confusion here!

"Redmi Note10 Pro" has Qualcomm SM7150 chipset!

Is this actually "Redmi Note10 Pro 5G" or "Redmi Note10 Pro (China)" model variant?

Perhaps this affects only MTK SOC devices?

[pndwal]

Perhaps this is the same issue: https://github.com/topjohnwu/Magisk/issues/4421 If so, this solution could work for you: https://forum.xda-developers.com/t/root-gained.4290689/

[qianmo-xw]

Perhaps this is the same issue:

4421

If so, this solution could work for you: https://forum.xda-developers.com/t/root-gained.4290689/

Yes, in China, this device is mtk soc，and I think this problem is all a-vb Mtk soc can't use magisk. this is first xiaomi MTK device use v-ab

[Gong-Mi]

I think it's the problem of MediaTek 1100. Redmi Note10（mt 700） can be written with vbmeta and turned on.

Redm inote10 （mt700）is a-vb mtk soc

[hairiece]

miui-blockota-ares-21.6.30-21.6.30.root-b0232e993b-11.0.zip miui k40g root ota https://183-2-128-134.ksyungslb.com/bigota.d.miui.com/21.6.30/miui-blockota-ares-21.6.30-21.6.30.root-b0232e993b-11.0.zip

Where did you get this root repair ota package? Can you give me the page address? My device is Redmi K40 gaming, and the processor is Dimensity 1200(MTK6893). After using magisk to generate boot.img and flashing into my device, it will also get stuck in the mi logo loop and cannot start normally.

[Gong-Mi]

下载文件里面，知道名字叫可以下载。

https://bigota.d.miui.com/日期/包名

[Gong-Mi]

官方root的ota包，不过我解密不了。

[hairiece]

官方root的ota包，不过我解密不了。

官方的啊，我还以为是其它什么地方提供的。我也试过那个包从中提取里面的内容，也是提取不出来。 现在很尴尬，用magisk补丁以后的boot.img刷了卡米，想root也root不了

[Gong-Mi]

https://drive.google.com/file/d/1QzhXw4SA81jpQwZCplDz8oeksKJA0Awn/view?usp=sharing k40g-root-12.5.6-boot.img

[Gong-Mi]

https://drive.google.com/file/d/1BlpItb-Ht76AhK5QPyP6Vxzxq6gItJzg/view?usp=sharing k40g-root-12.5.6-not_OTG-boot.img

[Gong-Mi]

https://drive.google.com/file/d/1fHuycmWO6H1QtTHjGfwnZmFqWaBbC8xg/view?usp=sharing Comparison tool

[carey036]

A boot which could be used well (like offical boot) will be disabled after executed ./magiskboot unpack -n boot.img ./magiskboot repack -n boot.img if you unpack new-boot.img, executing ./magiskboot cpio ramdisk.cpio 'extract' would need the access of root while it's not needed by origin boot's ramdisk.cpio.

so, may the problem is caused by magisk's repack tool?

[osm0sis]

This appears to have devolved into off topic and potentially unrelated devices. Any leads here from anybody? Did the fastboot disable verification/verity command help?

[osm0sis]

@qianmo-xw Can you try with the latest testing fork alpha? https://github.com/vvb2060/magisk_files/blob/alpha/app-release.apk

I think there were some mtk fixes.

Edit: Corrected link to alpha.

[pndwal]

@qianmo-xw Can you try with the latest testing fork alpha? https://github.com/vvb2060/magisk_files/blob/master/app-release.apk

I think there were some mtk fixes.

I think @vvb2060 /magisk_files master branch = Lite version! - see associated json. [Likely of interest only to those wanting basic superuser privileges and a way to hide root from bank apps that detect isolated processes at this stage, or wanting to test this.

Also Magisk Lite uses whitelist mode; all applications are hidden by default, and only the applications ticked in Hide can obtain super user permissions. adb shell automatically has super user privileges. Module function is not available.]

This is latest Alpha: https://github.com/vvb2060/magisk_files/blob/alpha/app-release.apk

Not sure if it includes MTK fixes. Here are Changelog fixes since last Canary (Chinese translated): https://forum.xda-developers.com/t/magisk-general-support-discussion.3432382/post-85472445 PW

[osm0sis]

Thanks! You can also just read the commit logs: https://github.com/vvb2060/Magisk/commits/alpha

[pndwal]

Sure! ... Are any fixes for MTK in particular?

[osm0sis]

Some Meizu devices are MTK SoC, and the zygote check fix might also help since deleting zygote*.rc files was a fix mentioned in some issues for MTK devices.

[pndwal]

Could be worth trying after next release also in that case, as further Meizu compatibility fixes have been merged in branch since 1eb83ad8-alpha-31 release.

[AndyCGYan]

Perhaps I can add to this discussion. I extracted and compared a self-patched boot image from 21.6.30, and a known-working image of the same build patched privately by someone, and the only difference is in ramdisk CPIO (the private CPIO is larger, but ramdisk content is identical). Could it be that it needs some special parameter in CPIO repacking?

[carey036]

@qianmo-xw Can you try with the latest testing fork alpha? https://github.com/vvb2060/magisk_files/blob/alpha/app-release.apk

I think there were some mtk fixes.

Edit: Corrected link to alpha.

didn't work, Infinite restart after flashing boot.

AIK v3.8 works well after repacking boot packed by magisk, is there any difference between AIK and magiskboot

[osm0sis]

If you AIK repack --original, the only difference would be that AIK strips the AVBv2 signing.

[carey036]

If you AIK repack --original, the only difference would be that AIK strips the AVBv2 signing.

via fastboot flash 31M boot generated by aik --original works, but --origsize doesn't work

[carey036]

If you AIK repack --original, the only difference would be that AIK strips the AVBv2 signing.

i opened magisk patched boot.img in hexadecimal, "00 00 00 03 00 00 00 00 61 76 62 74 6F 6F 6C 20" is founded in this file and the file is not available, but if change it to "00 00 00 00 00 00 00 00 61 76 62 74 6F 6F 6C 20", the file will be available. any solution? if any attachment is needed, please let me know

[carey036]

run command

magiskboot hexpatch magisk_patched.img \
0000000300000000617662746F6F6C20 \
0000000000000000617662746F6F6C20

could solve this problem

[muddpunk]

I figured I'd post here rather than make a duplicate issue. I'm having the same issue with my Xiaomi Redmi Note 8 Pro. I've tried patching both boot.img and recovery.img from the miui 12.5 ROM and consistently getting a bootloop. I've also tried flashing vbmeta with the command fastboot --disable-verity --disable-verification flash vbmeta vbmeta.img before flashing both patched boot.img and recovery.img.

This is my SoC model: MediaTek Helio G90T (MT6785T)

A little bit of extra information, I flashed the new android 11 ROM on top of my android 10 and kept all data. So not a fresh install or anything. I did do the whole safe mode thing to disable any modules from my previous setup too, but still had the same outcome.

Unfortunately I'm camping with my family at the minute, so I'm unable to help any further. However, as soon as we're back home I can help check files and or try the Canary build. If there's any more information I can grab from my phone without being near a PC let me know.

[pndwal]

Can I take it you have Ramdisk=no? Nb. Xiaomi is an exception to norms for type III devices, having boot ramdisk compatible bootloaders, and all Xiaomi devices I know of need Magisk in boot despite ramdisk=no.

Yours may be an MTK related issue of course, but as it seems possible you had / have incompatible modules since you moved to Android 11, please check this issue: https://github.com/topjohnwu/Magisk/issues/4624

It may be that modules were not disabled due to this despite booting to Safe Mode and are the issue. (Check you used the working timing.) Nb, both my devices are Qualcomm however. Nb.2. this won't work if you're now using un-patched boot image as booting to Safe Mode w/ Magisk is required because Magisk actually detects the Safe Mode key combo. To try different timing, flash new Magisk-patched image again first.

[muddpunk]

Apparently I do have Ramdisk=Yes.

Before reading your comment I had already taken a quick look at your post about timing with safe mode. It makes more sense to me that the modules weren't disabled, but how would i ever know if they were or not? 😅 (Which upon re reading, it coincides with your comment "Nb.2. this won't work if you're now using un-patched boot image as booting to Safe Mode w/ Magisk is required because Magisk actually detects the Safe Mode key combo.")

I'm going to try the patched boot.img shortly and persist on getting in to safe mode. This seems like progress for me considering the headache I've had the last couple of days, so i appreciate your advice 😄