I am trying to root my Vivo V11 with Android 10. The bootloader is unlocked. It says so in the dev settings, and I have to go through the warning prompt every time I reboot my device. When I run the fastboot command to flash the patched_boot.img file, it returns:

C:\Program Files\Minimal ADB and Fastboot>fastboot getvar unlocked
unlocked: yes
finished. total time: 0.002s

C:\Program Files\Minimal ADB and Fastboot>fastboot flash boot patched_boot.img
target reported max download size of 134217728 bytes
sending 'boot' (38579 KB)...
OKAY [  1.269s]
writing 'boot'...
FAILED (remote: Verify state locked)
finished. total time: 1.276s

Things I've tried to troubleshoot: Running cmd as Administrator (im using win10) Confirmed OEM unlocking is turned on in the dev settings (it is, it says "bootloader is already unlocked" Confirmed USB debugging is on Disabled "Verify apps over USB" and "Verify bytecode of debuggable apps" in the dev settings. Confirmed file transfer is enabled from my PC and my Phone (it is, I can transfer files back and forth between them) Tried a different USB cable [EDIT]

PS C:\Users\Himanshus\Downloads\platform-tools_r30.0.5-windows\platform-tools> .\adb devices
List of devices attached
ZDIBLVIRY5DIJBEI        device

PS C:\Users\Himanshus\Downloads\platform-tools_r30.0.5-windows\platform-tools> .\adb reboot-bootloader
PS C:\Users\Himanshus\Downloads\platform-tools_r30.0.5-windows\platform-tools> .\fastboot devices
ZDIBLVIRY5DIJBEI        fastboot
PS C:\Users\Himanshus\Downloads\platform-tools_r30.0.5-windows\platform-tools> .\fastboot flash boot patched_boot.img
Sending 'boot' (38579 KB)                          OKAY [  1.272s]
Writing 'boot'                                     FAILED (remote: 'Verify state locked')
fastboot: error: Command failed
PS C:\Users\Himanshus\Downloads\platform-tools_r30.0.5-windows\platform-tools> .\fastboot flash vbmeta vbmeta.img
Sending 'vbmeta' (4 KB)                            OKAY [  0.009s]
Writing 'vbmeta'                                   FAILED (remote: 'Verify state locked')
fastboot: error: Command failed
PS C:\Users\Himanshus\Downloads\platform-tools_r30.0.5-windows\platform-tools> .\fastboot --disable-verity flash vbmeta vbmeta.img
Rewriting vbmeta struct at offset: 0
Sending 'vbmeta' (4 KB)                            OKAY [  0.010s]
Writing 'vbmeta'                                   FAILED (remote: 'Verify state locked')
fastboot: error: Command failed
PS C:\Users\Himanshus\Downloads\platform-tools_r30.0.5-windows\platform-tools> .\fastboot --disable-verification flash vbmeta vbmeta.i
mg
Rewriting vbmeta struct at offset: 0
Sending 'vbmeta' (4 KB)                            OKAY [  0.009s]
Writing 'vbmeta'                                   FAILED (remote: 'Verify state locked')
fastboot: error: Command failed
PS C:\Users\Himanshus\Downloads\platform-tools_r30.0.5-windows\platform-tools>

Many different root-only actions involve mounting and editing files in the Android /system directory. Because there have been so many types of Android OSes, rooting techniques, and actual root solutions from the last decade, it has made it difficult to confidently determine if this is possible with my current root solution: Magisk with locked bootloader. From my understanding, Magisk is a completely "systemless" root solution, so by simply disabling Magisk and rebooting, *all actions performed as root are reverted.* This is important for me because I have verified boot with a locked bootloader via [avbroot](https://github.com/chenxiaolong/avbroot/) , so if there is any change to the system partition then it will fail to boot and the device will be bricked. So, with Magisk, is there a specific module that is required in order to "write" to the system partition systemlessly, so that it's not actually changing anything in the real system directory? Or does Magisk do this by default, and all I have to do is make my file edits from a shell like ADB root or Termux su, and they will be applied systemlessly?

I have a OnePlus 7 Pro. I had LineageOS 17 (Android 10) with microG, magisk, and vanced on it running just fine for almost a year. I upgraded the Android version to 11 first (which LineageOS documentation says is a pre-requirement) then I upgraded to LineageOS 18, and everything seemed to work just fine. I can confirm that my recovery and wifi worked. A few days later I wanted to open Vanced YT, but it was no longer installed, then I noticed that magisk was no longer installed. So I installed it according to it's instructions which was basically using the app to patch the boot.img I got from the extracted files (from a payload-dumper) and then installed the produced magisk_patched-24200_Y0Qmv.img. Ever since then is my problem. I can no longer turn on my wifi, I no longer have recovery mode, and every time I turn on/reboot the device I am greeted with a "System UI Crashed" error message. I can hit ok and everything else seems to work as expected. With the exception to my wifi not being able to turn on What I've tried: - re-flashed the original boot.img - re-flashed the recovery image - uninstalled magisk - I tried re-flashing other images from the payload dump (modem.img, etc) the same way the LineageOS documentation said to upgrade and I get the following error

fastboot flash --slot=all modem modem.img
fastboot: error: Could not check if partition modem has slot all

I have no idea what that error means. Nothing changed. I'm still greeted with the same crash message. I still can't turn on my wifi. And I still can't boot into recovery mode. To make sure I'm clear, my question is; "Where should I go from here? What things can I tell you in order to help me get my wifi working again, and to fix this 'System UI Crashed' error message?"

I want chroot to work. It all happened when I upgraded Magisk and then repatched my kernel. Now that I'm logging in as root bash, I get this error:

bash: cannot set terminal process group (6898): Inappropriate ioctl for device
bash: no job control in this shell

Then, if I press ^C, all commands are not working and the shell exits with **signal number 2**. How do I fix this?

Currently when a new update is out, 1. I download it through the Settings → Update Dialog. 2. Then, after it's downloaded, I Export it 3. Then I patch it using the Magisk app. It takes the zip, patches it, and produces an .img. 4. Then I adb pull the image down. 5. Then I boot into fastboot 6. Then I fastboot flash boot .img Is there a way to automate steps 2-6 so that it's included with just a regular install and doesn't require human interaction, fastboot, and another PC.

When I try to adb sideload a magisk patched image, like this

adb sideload magisk_patched-28100_BKiYY.img

I get a signature verification failure. But immediately after, it fails. Upon booting, the update didn't apply. An error messages flashes.

I'm trying to sideload a Magisk patched rom. It's failing. I would like to extract that log. Where is it stored?

I'm trying to mount the directory of an app to a folder in storage. I've put a script called custom.sh inside "/data/adb/service.d". The contents of the script are:

#!/system/bin/sh

sleep 30

mount -o bind /data/data/is.xyz.mpv /storage/emulated/0/Test

It just doesn't work. Can anyone point me in the right direction please?

For a Pixel 3a XL with an unlocked bootloader, I tried to flash a boot.img file patched by Magisk following [this guide](https://wccftech.com/how-to/root-google-pixel-3a-xl-using-magisk-tutorial/) , using [bonito-sp1a.210812.015](https://dl.google.com/dl/android/aosp/bonito-sp1a.210812.015-factory-872afcc7.zip) from [Google Factory images](https://developers.google.com/android/images) . After I successfully completed the whole process from "Step 2: Rooting Google Pixel 3a XL" section and rebooted, my Pixel became stuck booting with a "G" logo (and progress bar animating). I tried to fix it with these commands, which resulted in always booting in Fastboot Mode, error message "No valid slot to boot". ./fastboot flash boot_a "boot.img" ./fastboot flash boot_b "boot.img" ---- **How can I make my Pixel boot normally again *without loosing any of my user data* living on it?** **Alternatively, is there a way to back up all my user files from Pixel with eg. adb, given the broken booting?** ---- I'm able to boot in recovery mode if it can be useful.

I have decompiled FM Radio app on my device AGM M7 (custom Lineage OS, API 27). This app doesn't have access to /dev/fm. To give this access, I wrote an SELinux rule according to one of the messages from dmesg |grep avc:

allow priv_app fm_device chr_file {read write open ioctl}

I implemented and installed this rule in a Magisk module. But I noticed according to logs that the write permission for this rule was ignored. I asked ChatGPT about it, and it wrote that context priv_app has limitations connected with this permission. Yes, I can install my FM Radio app in the /system/app folder instead of /system/priv-app, so context will probably be platform_app. But in this case, all apps will be able to have access to /dev/fm, which increases the vulnerability of our firmware. So the question is whether it is possible via Magisk to give access to **/dev/fm** to my process FM radio. I am new to Magisk modules, so please help me write a Magisk module connected to this problem. I forgot to mention, from what I noticed, that Magisk does not understand ioctl permission, because when I write something like

magiskpolicy --apply-rule "path_to_sepolicy.rule"

I had a syntax error, but without ioctl, according to logs, my app will not work. Another way is to reassign firmware on my device, because the original FM Radio with the original signature works without any rules, but I don't know how to change keystore signatures on firmware directly on my device. If you want to learn more details about my problem, you can see [this question on SO](https://stackoverflow.com/questions/79314583/selinux-module-to-open-fm-radio-application-access-to-dev-fm) .

I have MUIU 14 and android 12. I installed magisk and rooted my device. Later I installed module XPOSED and android faker. I also installed another 3rd party app called Device Id. When I use randomize function on my Android Faker and go Device Id I can see that androidId field is spoofed.(I want to spoof as much as possible, phone number, IMEI, android ID, mac adress.... whatever Android Faker offers) But when I do the same for system application(go to settings and check the wifi mac address) I don't see any spoof happening. I believe this is because Android Faker doesnt have superuser rights or linux's security enforcement. How do I enable this ? Has anyone used Android faker before ? It didnt ask for superuser rights when I launched the app. But something like BuildProp Editor asks for super rights. Note: I launch XPOSED application and choose which apps to spoof for Android Faker. I also chose the app "system" in order to do that. Will post pictures shortly This is the screenshot from LPosed: I can activate Android Faker's "System" for spoofing. But android faker never asked for Super User rights when first launched. Doesn't it require that already ? If so why it didnt ask and how can I give it SuperUser? " class="img-fluid rounded" style="max-width: 100%; height: auto; margin: 10px 0;" loading="lazy"> This is the settings app. As an example, I want to spoof the mac address here by using Android Faker . But this value never gets spoofed. Even with Android Faker. (Faker spoofs other 3rd party apps but not settings.) " class="img-fluid rounded" style="max-width: 100%; height: auto; margin: 10px 0;" loading="lazy"> I need to give it superuser for that or something else?

I'm sorry for asking a questions that's been asked before, but I have read conflicting information, so I want to be absolutely sure about this before I proceed. I am aiming to *ROOT* my Pixel 4a (5G) with Android 12. Will flashing a boot image modified by Magisk wipe all my data? (I have installed Magisk Canary because of Android 12, correct?) I have already unlocked my bootloader, and of course that wiped my data. I don't want to go through that again. I don't want to have to reconfigure my setup again. (Some apps didn't automatically install for some reason. A few more of them lost their configurations. And system settings...) Anyway, can someone please give me an **authoritative** answer? Many Thanks, ---Mark

I went to a phone repair shop to change my Samsung s9+ IMEI number. They installed the magisk and warned me if I do a factory reset or similar things, the changes they did will be erased. Also, I can't use bank apps because the phone is rooted. Therefore, I searched and learned that using some modules of Magisk made it possible to use those apps. However, I needed to update the Magisk since that version was old (v22) and needed a newer version to get those modules. I updated Magisk by clicking update on the app. But after updating it to v28, the main page of Magisk became like this: And when I click to update and select direct install it gives this error: What can I do to fix this? Also after searching for a solution, I realized that I updated Magisk in hidden mode, the problem occurred because of that maybe.

Nowadays, phones don't have SD cards anymore, but some have a ton of storage. So, I was thinking of creating a fake external SD card using an extra partition to be able to store all of your zip flashable files, pictures, and music and have it stay when you inevitably format user data when flashing a ROM or whatever. My question is: **How to properly mount a partition as an SD card so that Android thinks you have an external SD?** (you see it in a file manager, can store pictures on it directly, etc.) What I've done already : - I have created an extra partition on my OnePlus 6 with parted, it's sda17 - I have successfully mounted this partition to be able to use it normally (mount -t ext4 -o rw /dev/block/sda17 /external_sd) This command allows you to navigate to /external_sd and see your files, but Android doesn't think that you have an external SD card. I'm thinking of using a Magisk module to mount everything properly at every boot (if this is even possible)

In the Ota Upgrade Guide from Magisk , it says: > NOTE: In order to apply OTAs, you HAVE to make sure you haven’t modified and read-only partitions yourself (such as /system or /vendor) in any way. Even remounting the partition to rw will tamper block verification!! The guide does not elaborate on this further. It sounds like this is the case for stock ROMs, but it does not say. I use LineageOS, which is an A/B partition scheme.

I installed a custom ROM (MIUI Splitfire) on my phone with Magisk 23.0v. Later I saw Magisk update, so I decided to upgrade to the latest version which is 25.0v from the app and got this error:

- Target image: /dev/block/sde45
- Device platform: arm64-v8a
- Installing: 25.2 (25200)
- Unpacking boot image
- Checking ramdisk status
- Magisk patched boot image detected
- Patching ramdisk
! Boot image kernel_dtb was patched by old (unsupported) Magisk
! Please try again with *unpatched* boot image
! Installation failed

[Screenshot of the installation log](https://i.sstatic.net/CUoTv.jpg)

I'm considering rooting my Android 13 device to customize it further, but I want to ensure that I don’t lose access to apps that rely on SafetyNet or other security checks. Are there any updated guides, tools, or workarounds for achieving root while maintaining compatibility with banking apps, Google Pay, etc.? Any advice on Magisk modules or other tips would also be appreciated!

Before you say, "It cannot be done," read the link below by topjohnwu. I too had been under the impression that Magisk could not be installed unless the device had an unlocked bootloader. However, yesterday I was reading this: [Deployment | Magisk](https://topjohnwu.github.io/Magisk/deploy.html#exploits) (from which I quote the contents below): > ## Exploits > --- > **(Note: Magisk could only be used as root)** > > Occasionally, there would be exploits in certain devices that could lead to full fledged root. On modern Android, it is possible to use MagiskSU if you can gain a shell with the following conditions: > > - Effective UID should be privileged (root, or euid=0) > - Have the ability to reload sepolicy (which 99.9% of the time means SELinux permissive) > > You can check out [scripts/emulator.sh](https://github.com/topjohnwu/Magisk/blob/master/scripts/emulator.sh) as a reference for bringing up Magisk with a root shell. Note that these changes are not persistent, and you will need to find ways to rerun the whole process every boot. My device meets the conditions for that "exploit" as shown below: # getenforce Permissive # id -u 0 # id -Z context=u:r:supersu:s0 So I checked out scripts/emulator.sh as suggested. However, I don't understand the code very well. It seems topjohnwu is suggesting one run that script on a device which meets the conditions, but he is also suggesting it is a "reference" implementation I guess. Since I'm not an expert, I have a lot of questions. Could I safely run it and then debug any issues/errors I see? If so, where do I find the referenced "app-debug.apk"? What directory should I run the script from? I appreciate any advice. If running the script is not the right approach, can anyone offer suggestions for how to can install Magisk on my device without an unlocked bootloader? Also, at what point should I remove SuperSU? (BTW, my device is a US Snapdragon S8, so the bootloader will not get unlocked.)

I'm considering to root my Fairphone 3 running Android 13 on /e/OS (a close Lineage OS derivative). However, I don't wish to wipe my data by unlocking the bootloader, so I had the following idea to circumvent it: 1. On [the official download site](https://images.ecloud.global/stable/FP3) , find the link of the update file named IMG-e-2.4.1-t-official-FP3.zip (may contain additional numbers) and remove the string IMG from the address. Download the file. 2. Extract the boot.img from the e-2.4.1-t-official-FP3.zip. 3. Patch the boot.img with Magisk. 4. Inside the e-2.4.1-t-official-FP3.zip, replace the official boot.img with the Magisk-patched one. 5. Go to settings ➡️ updater ➡️ “apply local update”, and select the patched e-2.4.1-t-official-FP3.zip. Could anything unintended happen if I just ignored the vbmeta.img that is also present in e-2.4-t-official-FP3.zip? (I hesitate to install Magisk [via recovery](https://topjohnwu.github.io/Magisk/install.html#custom-recovery) , because it's not recommend on modern devices. Feel free to correct me if that method is still safe on my device.) I foresee three possible error scenarios: - Android recognises the e-2.4-t-official-FP3.zip as “corrupted” and refuses to update. - Android does not refuse to apply the update, but fails to flash the boot partition due to the locked bootloader, possibly bricking the device. - While updating, Android automatically unlocks the bootloader to flash the boot partition, wiping my data without prior notice. What will happen? Should I just try it? Please note that various /e/OS services are currently offline, including the update download site: https://mastodon.social/@murena/113272432488332874 Background: Builds that start with IMG are fastboot images that cannot be imported as local updates in the updater app: > IMG-e-2.2-t-20240715417772-stable-FP5.zip is a fastboot package. It doesn't support installing via updater app. Download e-2.2-t-20240715417772-stable-FP5.zip then try sideloading. – https://gitlab.e.foundation/e/backlog/-/issues/8160#note_576544

I have a rooted Samsung Galaxy S23 with Android 14 and Magisk 27 installed. I ran

root

successfully and then proceeded to go into

shell

in which I obviously had root rights (#). Then I ran

-o remount,rw /data/adb/service.d

which gave me the error message

: '/service.d' not in /proc/mounts

. This always occurs whenever I try to mount/remount any root directory. How can this be fixed?