Android 9 userdebug版本执行adb remount失败

tangh

android 9及以后版本google启用avb(Android Verified Boot)2.0，verified boot and DM-verity默认启用策略发生了变化

解决方法：
kernel-4.4 和 kernel-3.18：

1. adb root
   
2. adb disable-verity
   
3. adb reboot
   
4. adb root
   
5. adb remount

复制代码

kernel-4.9以及更高版本：

1.     在Setting -> System -> Developer options -> OEM unlocking打开
   
2.     adb reboot bootloader
   
3.     fastboot flashing unlock
   
4.     press volume up key
   
5.     fastboot reboot
   
6.     adb root
   
7.     adb disable-verity
   
8.     adb reboot
   
9.     adb root
   
10.     adb remount

复制代码

tangh

如何确认 fastboot unlock 解锁成功

1、fastboot 模式下按音量上键后是否提示 Unlock Pass…return to fastboot in 3s

2、重启后界面是否显示

orange state
Your deivce has been unlocked and can’t be trusted
your device will boot in 5 seconds

3、解锁成功后检查这两个属性会从
[ro.boot.flash.locked]: [1]
[ro.boot.verifiedbootstate]: [green]
变成
[ro.boot.flash.locked]: [0]
[ro.boot.verifiedbootstate]: [orange]

tangh

1. 如果需要remount 分区，需要将MTK_SECURITY_SW_SUPPORT打开，具体位置如下：
   
2. 
   
3. +++ b/device/mediateksample/k62v1_64_bsp/ProjectConfig.mk
   
4. @@ -562,7 +562,6 @@ MTK_SCOMO_ENTRY = no
   
5. MTK_SCREEN_OFF_WIFI_OFF = no
   
6. MTK_SDIOAUTOK_SUPPORT = no
   
7. +MTK_SECURITY_SW_SUPPORT=yes
   
8. 
   
9. 
   
10. +++ b/kernel-4.9/arch/arm64/configs/k62v1_64_bsp_defconfig
    
11. @@ -181,7 +181,6 @@ CONFIG_MTK_CONNSYS_DEDICATED_LOG_PATH=y
    
12. CONFIG_MTK_ECCCI_DRIVER=y
    
13. CONFIG_MTK_ECCCI_C2K=y
    
14. CONFIG_MTK_BTIF=y
    
15. +CONFIG_MTK_SECURITY_SW_SUPPORT=y
    
16. 
    
17. +++ b/vendor/mediatek/proprietary/bootable/bootloader/lk/project/k62v1_64_bsp.mk
    
18. @@ -20,7 +20,7 @@ CUSTOM_LK_LCM="ili9881c_hd720_dsi_vdo lt8912b_mipi_to_lvds"
    
19. DEFINES += MTK_ROUND_CORNER_SUPPORT
    
20. #nt35595_fhd_dsi_cmd_truly_nt50358 = yes
    
21. #FASTBOOT_USE_G_ORIGINAL_PROTOCOL = yes
    
22. +MTK_SECURITY_SW_SUPPORT = yes
    
23. 
    
24. 
    
25. +++ b/vendor/mediatek/proprietary/bootable/bootloader/preloader/custom/k62v1_64_bsp/k62v1_64_bsp.mk
    
26. @@ -13,7 +13,7 @@ MTK_EMMC_SUPPORT=yes
    
27. MTK_EFUSE_WRITER_RESERVE_CODESIZE=no
    
28. MTK_EFUSE_WRITER_SUPPORT=no
    
29. MTK_MT8193_SUPPORT=no
    
30. +MTK_SECURITY_SW_SUPPORT=yes
    
31. 
    
32. 
    
33. 
    

复制代码

七个柚子多少钱

若设备无音量键，则需要修改源码跳过音量键确认的界面

修改路径：

1. vendor/mediatek/proprietary/bootable/bootloader/lk/app/mt_boot/sec_unlock.c

复制代码

1. @@ -336,7 +336,8 @@ void fastboot_oem_unlock(const char *arg, void *data, unsigned sz)
   
2.         unlock_warranty();
   
3. 
   
4.         while (1) {
   
5. -               if (mtk_detect_key(MT65XX_MENU_SELECT_KEY)) { //VOL_UP
   
6. +               //if (mtk_detect_key(MT65XX_MENU_SELECT_KEY)) { //VOL_UP
   
7. +               if (1) { //VOL_UP
   
8.                         fastboot_info("Start unlock flow\n");
   
9.                         //Invoke security check after confirming "yes" by user
   
10.                         ret = fastboot_get_unlock_perm(&unlock_allowed);
    

复制代码

以下是android9.0上设备的操作文档

星空

1 如果执行fastboot flashing unlock 后提示
    1 fastboot 卡在 waiting for device(明明已经连上usb线)          adb 更新(可直接使用附件版本)
    2 fastboot flashing unlock = Failed (remote: unknown comand)
       需要将MTK_SECURITY_SW_SUPPORT打开
eg:61 32 位go 版本做如下修改

1. diff --git device/mediateksample/k61v1_32_bsp_1g/ProjectConfig.mk
   
2. @@ -569,6 +569,8 @@ MTK_RUNTIME_PERMISSION_SUPPORT = no
   
3. MTK_SCOMO_ENTRY = no
   
4. MTK_SCREEN_OFF_WIFI_OFF = no
   
5. MTK_SDIOAUTOK_SUPPORT = no
   
6. +MTK_SECURITY_SW_SUPPORT= yes
   
7. +MTK_SEC_FASTBOOT_UNLOCK_SUPPORT=yes
   
8. MTK_SEARCH_DB_SUPPORT = yes
   
9. MTK_SEC_MODEM_AUTH = no
   
10. MTK_SEC_MODEM_ENCODE = no
    
11. 
    
12. 
    
13. diff --git  kernel-4.9/arch/arm/configs/k61v1_32_bsp_1g_defconfig
    
14. @@ -179,6 +180,7 @@ CONFIG_MTK_CONNSYS_DEDICATED_LOG_PATH=y
    
15. CONFIG_MTK_ECCCI_DRIVER=y
    
16. CONFIG_MTK_ECCCI_C2K=y
    
17. CONFIG_MTK_BTIF=y
    
18. +CONFIG_MTK_SECURITY_SW_SUPPORT=y
    
19. CONFIG_MTK_ACCDET=y
    
20. CONFIG_ACCDET_EINT_IRQ=y
    
21. CONFIG_ACCDET_SUPPORT_EINT0=y
    
22. 
    
23. 
    
24. diff --git  vendor/mediatek/proprietary/bootable/bootloader/lk/project/k61v1_32_bsp_1g.mk
    
25. @@ -20,7 +20,7 @@ CUSTOM_LK_LCM="ili9881c_hd720_dsi_vdo ili9881p_hd720_dsi_vdo"
    
26. DEFINES += MTK_ROUND_CORNER_SUPPORT
    
27. #nt35595_fhd_dsi_cmd_truly_nt50358 = yes
    
28. #FASTBOOT_USE_G_ORIGINAL_PROTOCOL = yes
    
29. -MTK_SECURITY_SW_SUPPORT = no
    
30. +MTK_SECURITY_SW_SUPPORT = yes
    
31. MTK_VERIFIED_BOOT_SUPPORT = yes
    
32. MTK_SEC_FASTBOOT_UNLOCK_SUPPORT = yes
    
33. SPM_FW_USE_PARTITION = yes
    
34. 
    
35. 
    
36. diff --git  vendor/mediatek/proprietary/bootable/bootloader/preloader/custom/k61v1_32_bsp_1g/k61v1_32_bsp_1g.mk
    
37. @@ -13,7 +13,7 @@ MTK_EMMC_SUPPORT=yes
    
38. MTK_EFUSE_WRITER_RESERVE_CODESIZE=no
    
39. MTK_EFUSE_WRITER_SUPPORT=no
    
40. MTK_MT8193_SUPPORT=no
    
41. -MTK_SECURITY_SW_SUPPORT=no
    
42. +MTK_SECURITY_SW_SUPPORT=yes
    
43. MTK_FACTORY_LOCK_SUPPORT=no
    
44. CUSTOM_SEC_AUTH_SUPPORT=no
    
45. MTK_KERNEL_POWER_OFF_CHARGING=yes

复制代码

2 在确认lock还是unlock界面,如果按键不行,请修改
音量+键不行

1. //音量+键没反应
   
2. diff --git b/vendor/mediatek/proprietary/bootable/bootloader/lk/target/k61v1_32_bsp_1g/include/target/cust_key.h
   
3. 
   
4. @@ -16,7 +16,7 @@
   
5. #ifdef MT65XX_RECOVERY_KEY
   
6. #define MT65XX_BOOT_MENU_KEY       MT65XX_RECOVERY_KEY     /* KEY_VOLUMEUP */
   
7. #else
   
8. -#define MT65XX_BOOT_MENU_KEY       17     /* KEY_VOLUMEUP */
   
9. +#define MT65XX_BOOT_MENU_KEY       9     /* KEY_VOLUMEUP */
   
10. #endif
    
11. 
    
12. #define MT65XX_MENU_SELECT_KEY     MT65XX_BOOT_MENU_KEY

复制代码

硬件上没做按键

1. 
   
2. diff --git  vendor/mediatek/proprietary/bootable/bootloader/lk/app/mt_boot/sec_unlock.c
   
3. @@ -336,7 +336,7 @@ void fastboot_oem_unlock(const char *arg, void *data, unsigned sz)
   
4.          unlock_warranty();
   
5. 
   
6.          while (1) {
   
7. -                if (mtk_detect_key(MT65XX_MENU_SELECT_KEY)) { //VOL_UP
   
8. +                if (1) { //VOL_UP            
   
9.                          fastboot_info("Start unlock flow\n");
   
10.                          //Invoke security check after confirming "yes" by user
    
11.                          ret = fastboot_get_unlock_perm(&unlock_allowed);
    
12. 
    

复制代码

星空

android p + kernel4.9 以上的版本 源码调过avb
直接置位检验标志位




至此可以直接 adb root  ,adb remount

七个柚子多少钱

按照1楼方法，mt6853 android11成功执行adb remount，步骤如下：

1. 在Setting -> System -> Developer options -> OEM unlocking打开
   
2.     adb reboot bootloader
   
3.     fastboot flashing unlock
   
4.     press volume up key
   
5.     fastboot reboot
   
6.     adb root
   
7.     adb disable-verity
   
8.     adb reboot
   
9.     adb root
   
10.     adb remount

复制代码

执行成功结果：

zhaozhengwu

七个柚子多少钱 发表于 2021-2-1 15:10
若设备无音量键，则需要修改源码跳过音量键确认的界面修改路径：以下是android9.0上设备的操作文档

...

lk2跳过音量按键

1.                 +++ b/vendor/mediatek/proprietary/bootable/bootloader/lk2/platform/mediatek/common/sboot/sboot.c
   
2.                         @@ -102,7 +102,8 @@ int sec_get_meid_from_pl_boottags(uint8_t meid_arr[], uint32_t size)
   
3.                         bool device_lock_control_key_pressed(void)
   
4.                         {
   
5.                                 // VOL_UP or VOL_DOWN key
   
6.                         -    return (detect_key(PMIC_RST_KEY) || detect_key(MENU_OK_KEY));
   
7.                         +    //return (detect_key(PMIC_RST_KEY) || detect_key(MENU_OK_KEY));
   
8.                         +       return true;
   
9.                         }
   
10.                         #else

复制代码