Database Users

[Q] how to make .img files from existing tablet?

I have a complete setup for the Nexus 7, part of a product we are working on, that I need to easily clone on "virgin" tablets for production. The app requires a rooted OS.
I want to write an installation script using fastboot to unlock the bootloader, erase partitions, then flash them with .img files for each partition (kernel, system, cache, etc.).
How do I extract .img files from my "master" tablet? I have an understanding from some where that these are simple byte-for-byte dumps of the partition -- is this true? As such can I create a .img file by simple doing 'cat blkfile >file.img' where "blkfile" is the appropriate block device for the partition in question?
Or do I need to use 'dd'? Or something else?
I have searched and searched, and can't find an anwer. I've found other answers using some tools to create these files from a build on a PC, but nothing about creating them from an existing tablet.
Thanks in advance!

Use the dd command. You can use it both to dump and write a partition. It's how I install recovery programs like TWRP
Sent from my Nexus 7

You can use dd for the boot partition and recovery partition - they are raw binary blobs. (Don't use dd on other Android devices, esp. those that have MTD flash devices, though - it only works most of the time there)
If you want to use the same fastboot-based scenario that Google uses for factory image sets, then for the system & userdata image files you will need to find out about "sparse ext4 filesystem images"
If you took a raw block-device based dump of any of your tablet ext4 partitions, you could actually take those image files and mount them on any other linux machine (using a loopback mount procedure).
But you will find that if you attempt to do that with the Google factory ".img" files (for system & userdata partitions), they will not mount. It's not a simple matter of a offset superblock, either.
Since these are the formats that the stock recovery expects, I suppose you ought to use those formats if you want to do the "all at once all partitions" fastboot flashing if you plan on using the stock recovery.
Note that there is absolutely nothing that prevents you from unpacking whatever you want from whatever archive format you want - so long as the recovery's busybox supports the archive format correctly - you could use cpio or pax or tar archives for that matter. (The stock recovery's "toolbox" has very little functionality, so this comment applies to custom recoveries, which typically have more robust functionality in their busybox) You will be writing your own scripts to do those things though, typically either in one of two ways:
1.A mount target filesystem partition
1.B do a deep recursive remove at that mountpoint ( rm -rf * )
1.C unpack your archive into same mount point ( tar xf archive.tar, etc)
1.D unmount the mount point
OR
2.A unmount target partition and zero it out (dd if=/dev/zero, flash_erase, etc)
2.B recreate filesystem in partition (mke2fs -t ext4 etc)
2.C mount target filesystem
2.D unpack your archive into the same mount point (tar xf archive, pax, cpio, unyaffs2, etc)
2.E unmount that mountpoint
Even though this post is for the Samsung Galaxy S II, the same thing applies to the factory Nexus 7 images from Google:
http://forum.xda-developers.com/showthread.php?t=1081239
As that thread mentions, the simg2img and mkuserimg.sh programs are part of the Android project.
Here's a Nexus 7 thread where the contributor built the tools for both x86 linux and arm linux
Finally, I should note that because /system is typically mounted read-only, imaging /system from the live OS is no big deal. Trying to do the same thing with /data is an extremely dopey idea, however. Accurate backups are rarely made from live read-write filesystems.
cheers

Thank you so much for all the great information! I hit thanks for both of you.
The link to the nexus 7 thread is what I need... This is for my company, and I need a simple cloning solution that can be performed by a non-technical assembly person. The fastboot install procedure is about as simple as it gets.
Thanks again!

DOOGEE X3 MTK6580 Dual SIM Android 5.1 Smartphone 4.5 Inch 1GB 8GB 5MP Camera

Here the link to the newest roms for the doogee x3
www.needrom.com/category/doogee/x3-doogee/
I am using linux and use the sp flash tool with wine with looks good so far,i have to study it first before starting,but i want to start the thread already.
first problem is unpacking the rar file ..... syntax error nearby unexpected symbol 'newline' after the command #unrar e <DOOGEE-X3-6.0.rar >solved,installing unrar and reboot system(!)...
second problem rooting phone after installing ...BETA-SuperSU-v2.50.zip... recovery said installation aborted...
Than smart phone flash tool wont recognice the doogee x3...
phone is connected through usb and connected as usb storage...(i am googling for advice...)
thanks for some advice

(SOLVED see post from 9okt)rooting DOOGEE X3
After putting BETA-SuperSU-v2.50.zip. on my sdcard i went in recovery mode,volume up and power button pressed, than choosed update system by sdcard,pressed power button,choose BETA-SuperSU-v2.50.zip and pressed power button.... recovery said installation aborted..
what to do...
thanks for some advice

after flashing the recovery i got the following result...
a red line(download DA 100%) and an popup telling ERROR: S_ TIMEOUT (1042)
on the terminal....
[[email protected] SP_Flash_Tool_exe_Linux_v5.1632.00.100]# ./flash_tool.sh
QGtkStyle was unable to detect the current GTK+ theme.
Qt: Session management error: None of the authentication protocols specified are supported
QMetaObject::connectSlotsByName: No matching signal for on_pushButton_browser_clicked()
QThread::setPriority: Cannot set priority, thread is not running
"07-30-2016"
QObject::moveToThread: Cannot move objects with a parent
Connecting to BROM...
Scanning USB port...
Search usb, timeout set as 3600000 ms
[email protected]/devices/pci0000:00/0000:00:13.2/usb2/2-5
[email protected]/devices/pci0000:00/0000:00:13.2/usb2/2-5/2-5:1.0
[email protected]/devices/pci0000:00/0000:00:13.2/usb2/2-5/2-5:1.1
[email protected]/devices/pci0000:00/0000:00:13.2/usb2/2-5/2-5:1.1/tty/ttyACM0
vid is 0e8d
device vid = 0e8d
pid is 2000
device pid = 2000
com portName is: /dev/ttyACM0
Total wait time = -1472583651.000000
USB port is obtained. path name(/dev/ttyACM0), port name(/dev/ttyACM0)
USB port detected: /dev/ttyACM0
BROM connected
Downloading & Connecting to DA...
connect DA end stage: 2, enable DRAM in 1st DA: 0
COM port is open. Trying to sync with the target...
Failed to Connect DA: S_TIMEOUT
Disconnect!
BROM Exception! ( ERROR : S_TIMEOUT (1042)
[HINT]:
)((ConnectDA,../../../flashtool/Conn/Connection.cpp,131))
thanks for some advice...

connecting not as root but as user after setting gtk theme in user dir
Connecting to BROM...
Scanning USB port...
Search usb, timeout set as 3600000 ms
[email protected]/devices/pci0000:00/0000:00:12.2/usb1/1-4
[email protected]/devices/pci0000:00/0000:00:12.2/usb1/1-4/1-4:1.0
[email protected]/devices/pci0000:00/0000:00:12.2/usb1/1-4/1-4:1.1
[email protected]/devices/pci0000:00/0000:00:12.2/usb1/1-4/1-4:1.1/tty/ttyACM0
vid is 0e8d
device vid = 0e8d
pid is 2000
device pid = 2000
com portName is: /dev/ttyACM0
Total wait time = -1472900250.000000
USB port is obtained. path name(/dev/ttyACM0), port name(/dev/ttyACM0)
USB port detected: /dev/ttyACM0
Connect BROM failed: S_COM_PORT_OPEN_FAIL
Disconnect!
BROM Exception! ( ERROR : S_COM_PORT_OPEN_FAIL (1013)
[COM] Failed to open COM port.
[HINT]:
)((ConnectBROM,../../../flashtool/Conn/Connection.cpp,85))

solved,i installed ubuntu followed al the instructions put the flashtool on upgrade connectthe phone and android 6.0 was installed after a few minutes.

devrieshh said:
solved,i installed ubuntu followed al the instructions put the flashtool on upgrade connectthe phone and android 6.0 was installed after a few minutes.
Click to expand...
Click to collapse
I made it in Windows yesterday successfully. There is also a way to flash TWRP on Doogee X3 running Android 6.0.
Look here: http://4pda.ru/forum/index.php?showtopic=713470&st=100#entry51434308
The Problem is, I don't understand russian and I even can't type it. Also the Captcha is a major problem. I think there is an account needed to be able to download the board attachments. Otherwise "404" error. Could anyone Download TWRP for Android 6.0 from this site + the scatter file there ? Would be awesome :highfive:
EDIT: I got it and already installed it. it works ! twrp on doogee x3 running android 6.0. just flash it with sp flash tool. you know how if you had flashed 6.0 already
link: http://www18.zippyshare.com/v/yAM5FXOt/file.html
have fun
EDIT: don't try to root it. doesn't work. neither supersu, kingo root nor kingroot. i tried it and my nvram was corrupt after trying with supersu. had to flash back imei and wifi mac address. i'm back on android 5.1 for this device.

Flashing didnt work,it said coudnt find files or path wasnt right,a red line...
after a wile the flash window got black and wite got frosen,i closed it started to reload and then the flash window didnt showed up and the message in the therminal was ...
:~/Desktop/SP_Flash_Tool_exe_Linux_v5.1520.00.100$ ./flash_tool.sh
QGtkStyle was unable to detect the current GTK+ theme.
QObject::moveToThread: Cannot move objects with a parent
so i dont know what to do now for the moment

solved,reinstalled ubuntu.. flashed TWRP_3.0.2_Doogee-X3_Android-6.0.zip

Ok i managed to root our doogee X3,tryed it with an old root tool used with my samsung gio,flashed with the TWRP 3.0.2.

SOLVED (file is already .img ,not .dat) trying to port cm-13.0-20160817-UNOFFICIAL-TECNO W4-nana (MTK 6580) i got a problem after the ./sdat2img.py command .../S2603_DG_A42_PUBLIC_M_V0.2.8_S160628$ sudo ./sdat2img.py system.transfer.list system.new.dat sys
tem.img
Traceback (most recent call last):
File "./sdat2img.py", line 131, in <module>
main(sys.argv)
File "./sdat2img.py", line 75, in main
version, new_blocks, commands = parse_transfer_list_file(TRANSFER_LIST_FILE)
File "./sdat2img.py", line 43, in parse_transfer_list_file
trans_list = open(TRANSFER_LIST_FILE, 'r')
FileNotFoundError: [Errno 2] No such file or directory: 'system.transfer.list'
anybody know what to do...
doing the same with the cm 13 rom...
/cm-13.0-20160817-UNOFFICIAL-TECNO W4-nana$ sudo ./sdat2img.py cm-13.0-20160817-UNOFFICIAL-TECNO
%20W4-nana .transfer.list system.new.dat system.img
Traceback (most recent call last):
File "./sdat2img.py", line 131, in <module>
main(sys.argv)
File "./sdat2img.py", line 75, in main
version, new_blocks, commands = parse_transfer_list_file(TRANSFER_LIST_FILE)
File "./sdat2img.py", line 43, in parse_transfer_list_file
trans_list = open(TRANSFER_LIST_FILE, 'r')
FileNotFoundError: [Errno 2] No such file or directory: 'cm-13.0-20160817-UNOFFICIAL-TECNO%20W4-nana'

devrieshh said:
Ok i managed to root our doogee X3,tryed it with an old root tool used with my samsung gio,flashed with the TWRP 3.0.2.
Click to expand...
Click to collapse
[at first for everyone to know: it affects Android 6.0 for the Doogee X3. Android 5.1 is no problem.]
root checker told me my device is rooted after I flashed your zip. The problem I experienced was, I got no asking for root triggered by any app which uses root permission. And also when I try to update SuperSU binary inside the app it tells me there is no "su data" and it couldn't update it. I think to get a flawless root permission it would take a while

SOLVED $mkdir working and than.... $ sudo mount -t ext4 -o loop /img-tools/sys.raw working/
so i did succeed to format the system.img to sys.raw but after trying to mount the sys.raw image i got the following response after the in the tortual suggested command

Am I right that you are already working in the directory "/img-tools" and want to mount the sys.raw file in it ? So then, if you determine to mount "/img-tools/sys.raw" that this could be interpreted as mount "/img-tools/img-tools/sys.raw", a directory that doesn't exist ?
Or am I seeing something wrong ?

i have compiled the system.img file to sys.raw and i want the sys.raw folder so that you can swich framework,apps and other folders with roms to port
i want to have the outcom from the sys.raw ext4 file mounted in the /base home/working folder..
see .http://forum.xda-developers.com/chef-central/android/guide-how-to-port-lollipop-marshmallow-t3283452
mounting system.img should do the job ,so you do not have to format it to sys.raw.
i made a map working in the img-tools map,but with the command below i got ...mount point working/ does not exist
base home/img-tools$ sudo mount -t ext4 -o loop system.img working/
mount: mount point working/ does not exist

devrieshh said:
i have compiled the system.img file to sys.raw and i want the sys.raw folder so that you can swich framework,apps and other folders with roms to port
i want to have the outcom from the sys.raw ext4 file mounted in the /base home/working folder..
see .http://forum.xda-developers.com/chef-central/android/guide-how-to-port-lollipop-marshmallow-t3283452
mounting system.img should do the job ,so you do not have to format it to sys.raw.
i made a map working in the img-tools map,but with the command below i got ...mount point working/ does not exist
base home/img-tools$ sudo mount -t ext4 -o loop system.img working/
mount: mount point working/ does not exist
Click to expand...
Click to collapse
I'm more familiar with DOS. But the principle should be the same.
i will try to understand the link you posted...will keep you informed
EDIT: if i'm right, then you are inside the "img-tools" folder and trying with this command to mount system.img to a folder named "working" in it.
e.g.: /base home/img-tools/working
but you want to mount it to the folder /base home/working, right ?
so you have to type it in another way. try: sudo mount -t ext4 -o loop system.img /base home/working/
I'm not sure what Linux expect. maybe the slash before "base home" in my example is not needed.

fixt it http://stackoverflow.com/questions/8663891/how-to-mount-the-android-img-file-under-linux
/Downloads/doogee x3 porting/base/base home/img-tools$ mkdir sys
[email protected]:~/Downloads/doogee x3 porting/base/base home/img-tools$ sudo mount -t ext4 -o loop sys.raw sys/
[email protected]:~/Downloads/doogee x3 porting/base/base home/img-tools$
i had to use my sys.raw file and make a sys map with ...mkdir sys ... command
How to convert .img to .raw... download img-tools extract it in a folder (http://forum.xda-developers.com/chef-central/android/guide-how-to-port-lollipop-marshmallow-t3283452) put the system.img from base rom with it and run the command... ./simg2img system.img sys.raw

I sat the whole night to find any supersu which roots flawless our doogee x3 on android 6.0. and i found it ! i flashed, installed, reflashed about hundred of times another supersu version by version downwards. it's the version 2.61 which works properly ! and yes, you can still use the playstore update of supersu + binary update inside the app without losing root or getting a boot stuck. see linked zip for working supersu you'll better save it safely
http://www89.zippyshare.com/v/iUH99ub0/file.html
EDIT: I'm not sure it could be important, but I kept the system partition as read only as I installed SuperSU. Maybe you want to do it also.

i bought a doogee x5 so i am no longer active in this forum

[GUIDE]How to extract /system from Samsung S7 OTA/FW in Windows without a Phone

This is a complete working guide on how to extract the /system partition from a Samsung S7 FW/OTA package using Windows (This is the same package one might flash to their phone with ODIN.) You can get this FW/OTA package from sites like Samsung-Firmware.org & SamMobile.com. It is very likely this works (or parts of it duct-taped together ) on other Phone models,etc, but I vouch that this guide works on the Samsung S7. Please chime in if it works on other models & brands!
Intro:
I found a LOT of guides similar to this, but couldn't get any to work with the Samsung S7 packages! And there are MANY different versions of the tools I mention below, many not working! So be sure to use the tool versions I post below. Over much time, it was a tiny step with each new attempt until I finally got it...& wanted to share!
Purpose:
Why would anyone want to do this? If you're reading this thread and don't know the answer to that, then I'm confused But I'll answer anyway - What is the purpose of this thread?
You would want to do this because you're a ROM Developer and don't want to have to go through the time & trouble of installing an OTA, then do a dd/cat to get the system image, etc. (With this method you don't even need a phone, just a PC!)
You are using a custom ROM, but want a stock app; for example the custom ROM you're using has the Google Dialer/Phone app builtin, but you prefer the stock Samsung Phone. Doing the steps outlined here will yield a "system" folder in Windows that you can simply navigate to /system/app or /system/priv-app and copy over the apk to your phone and install it! (via ADB or phone File manager app, etc). Obviously not all apks will work. Or maybe you want the libraries from another phone OTA package in order for an apk to work, and so on...
You are just curious what's in the /system partition for an OTA package!
Tools:
7-Zip
LZ4
simg2img: "Clone or download"->Download ZIP
Ext2Explore (Same as Ext2Read)
Guide:
Download FW/OTA (TMB-G930TUVU4CRI2.zip) from SamMobile website (or whereever)
Use 7zip to extract TMB-G930TUVU4CRI2.zip to a folder
Use 7zip to extract AP_G930TUVU4CRI2*.tar.md5 to a folder (ignore "There is no correct record at end of archive" error)
Use lz4 to extract system.img.ext4.lz4 -> system.img.ext4
lz4 system.img.ext4.lz4​
Extract simg2img_win-master.zip -> \simg2img_win-master\
Copy system.img.ext4 to \simg2img_win-master\ folder
Rename system.img.ext4 -> system.img
Use simg2img_win-master to convert system.img -> system.ext4.img
Double-click convert.bat (or run in cmd prmpt) (This will take a few minutes)​
Create new folder to save contents in, eg: "C:\System"
Use ext2explore to mount system.ext4.img: Open ext2explore->File->Open Image->Select system.ext4.img
Click Save icon->Save to your new folder, eg: "C:\System"
Wait for it to extract. Once complete, enjoy!
Links & Useful Resources:
Tmobile Versions: https://support.t-mobile.com/docs/DOC-30276
Search Keywords:
(This section is here so this thread comes up in searches for the many errors I came across while trying to get this to work in both Windows & Linux. That's right! I tried in both OSs and actually got it to work first in Windows... & yet to get it to work in Linux!)
- losetup /dev/loop2 /media/sf_Share/system.img.ext4 ->warning file does not fit into 512-byte sector; the end of the file will be ignored
- mount /dev/loop2 /mnt/mysystem2 -> mount: /mnt/mysystem2: cant read superblock on /dev/loop2
- mount -t ext4 /media/system.img /mnt/mysystem6 -> wrong fs type, bad option, bad superblock on /dev/loop6, missing codepage or helper program, or other error
fsck /media/system.img -> ext2fs_open2: Bad magic number in super-block
fsck.ext2: Superblock invalid, trying backup blocks...
fsck.ext2: Bad magic number in super-block while trying to open ...
The superblock could not be read or does not describe a valid ext2/ext3/ext4 filesystem. If the device is valid and it really contains an ext2/ext3/ext4 filesystem (and not swap or ufs or something else), then the superblock is corrupt, and you might try running e2fsck with an alternate suberblock: ...

Reserved

Just happened to see this thread.
Dropping in the let you know for linux just do this
Code:
simg2img system.img.ext4 system.img
mkdir system
sudo mount -t ext4 system.img system/
Of course all work is done in the current working directory.
You can just copy whatever you want from this mounted loop device of the system.img or whatever.
This is what i do because it seems to be the fastest in terms of work.
Hope it helps. I prefer all android work on linux

kevin71246 said:
Reserved
Click to expand...
Click to collapse
oh man you saved my day thanks man none of the old method worked but this did wonders

How do I persist changes to the /oem folder?

I have the Moto G7 International variation (INDIA/RETIN, it turns out; I'm in the US and thought I was buying the RETUS version, but I didn't pay enough attention to the store page). I have rooted the device easily, thanks to the assistance of these forums. I have also installed TWRP 3.3.1-2-river for the purpose of backups and restores, though there seems to be problem with it. However TWRP is not the focus of my question right now.
I have become quite annoyed with the boot animation on this phone and would like to change it. Putting new boot animations in the /system/media folder has not been working and it seems to be because this international model has a boot animation override (that trumps all other boot animation locations) in the /oem/retin/media folder. The /oem folder is initially read-only, but can be remounted with read-write without error (using root). Using MiXplorer or the adb shell, I can delete stuff from there without error as well. However, when I reboot, it all comes back. I suspect that the changes I make to the /oem folder are not actually persisted to whereever in the first place. When I look at the mounts on the phone, I see /oem is mounted from /dev/block/dm-1. /dev/block/dm-1 is listed in my partitions list when the phone is booted up normally. From what I can tell though (and I'm not that knowledgable on this topic), that is just a "wrapper" around some data elsewhere. How can I tell where this dm-1 partition's data is really coming from?
As additional information, the block list by-name lists the oem image as belonging to block mmcblk0p58. When I boot into TWRP and mount that block, I do see the usual /oem stuff in there. I deleted the boot animation from there and tested unmounting the block, rebooting into TWRP and remounting the block and can see that the boot animation is still properly deleted from there. However, when I boot the phone back up normally, I see the usual stuff (including the boot animation) in the /oem folder still. That might make some sense, since it is listed as being mounted from /dev/block/dm-1 and not from /dev/block/mmcblk0p58 (though I was hoping dm-1 was a wrapper for mmcblk0p58).
This is the only dm mount on the phone; I don't have the problem with /system being uneditable because it is mounted to dm-0 like I see in many other posts for other phones. In turn, I don't think I have the "base data is encrypted" problem from those cases either (it is "just" an oem setup and not personal data). This still seems somewhat like the dm-verity problem I read about with other phones though (although this one doesn't give the dm-verity warning when I try to remount /oem as read-write). Running the commands:
Code:
adb root
adb disable-verity
just tells me
Code:
disable-verity only works for userdebug builds
verity cannot be disabled/enabled - USER build
I'm not sure how to check if there is dm-verity on in the first place though.
As a more direct question (though I would still like to know how to trace this dm-1 partition backwards), how can I make changes to this /oem folder actually persist between reboots?

@Spaceminer described the exact same problem for the Moto G6 in the Universal DM-Verity remover thread. In the end he said that it wasn't solvable without a system root.
https://forum.xda-developers.com/an...rceencrypt-t3817389/post81974407#post81974407
(I have since returned the phone because of this.)

1equals2 said:
@Spaceminer described the exact same problem for the Moto G6 in the Universal DM-Verity remover thread. In the end he said that it wasn't solvable without a system root.
https://forum.xda-developers.com/an...rceencrypt-t3817389/post81974407#post81974407
(I have since returned the phone because of this.)
Click to expand...
Click to collapse
i was unable to get this to persist either. i ended up using magisk for my work instead.

@1equals2 @HT123 To persist changes to your /oem partition the HAB (high assurance boot) verification must be deactivated. I've already successfully tested it on my device, a Moto G6 plus.
Here are the required steps: (only for Stock ROM!!)
1.) Start TWRP and backup /vendor + /system
2.) Mount /vendor + /system and delete the following
files:
- /vendor/etc/init/hw/init.mmi.hab.rc
- /vendor/bin/init.mmi.hab.sh
- /system/verity_key
3.) Go to /vendor/etc/init/hw and adb pull init.mmi.rc in order to edit the file.
4.) Open it and delete the lines 19+20:
Code:
19 # Moto verified boot extension
20 import /vendor/etc/init/hw/init.mmi.hab.rc
5.) Save the changes, copy it back to its path and set permissions to: -rw-r--r-- root:root
==> After the next reboot /vendor and /oem are mounted as ../vendor_a and ../oem_a (depending on your active slot).
As the last step you have to customize fstab.qcom to be able to access the files within the /oem folder.
Adb pull /vendor/etc/fstab.qcom and open it. The last line defines how /oem is mounted during the init process. You should change it like this:
before:​
Code:
/dev/block [...] /oem ext4 ro,nosuid,nodev,[STRIKE]context=u:object_r:oemfs:s0[/STRIKE] wait,slotselect,[STRIKE]verify[/STRIKE]
after:​
Code:
/dev/block [...] /oem ext4 ro,nosuid,nodev,[COLOR="red"]barrier=1[/COLOR] wait,slotselect
Save it and copy it back. Permissions: -rw-r--r-- root:root
>>> REBOOT AND ENJOY!!

[SOLVED] Restore decrypted nandroid backup of FBE

Tried restoring a nandroid backup of the data partition with twrp.
also copied the /data/media partition back from an external copy.
when booting up the phone immediately reboots back into twrp with an error message:
Android Rescue Party...
The reported problem is:
'--reason=set_policy_failed_:/data/vendor'
the vendor partition seems to be intact and i do have a backup of it taken at the same time as the data backup, restoring it doesn't yield results..
i'm wondering if FBE is throwing it off, as the backup was taken when the phone was decrypted (within twrp) however the data on the partitions is referencing some sort of encryption key?

you may also exhibit the following error upon bootup of a restored nandroid backup.
immediately after booting, the phone reboots back into recovery.
viewing the log in twrp will show:
Android Rescue Party...
The reported problem is:
'--reason=set_policy_failed_:/data/bootchart'
1. the solution to this is editing fstab.​​under twrp or other recovery​mount /vendor from the mount icon.​​in twrp: Advanced > File Manager > /vendor/etc/fstab.qcom​select edit file under userdata, find where it says fileencryption=ice​rename fileencryption to encryptable.​​Original​
Code:
/dev/block/bootdevice/by-name/userdata /data ext4 noatime,nosuid,nodev,barrier=1,noauto_da_alloc,discard wait,check,fileencryption=ice,quota,reservedsize=512M
​​Modified​
Code:
/dev/block/bootdevice/by-name/userdata /data ext4 noatime,nosuid,nodev,barrier=1,noauto_da_alloc,discard wait,check,encryptable=ice,quota,reservedsize=512M
​save file.​
2. next delete the following directories:​
/data/unencrypted
/data/misc/vold/user_keys
3. Lastly delete any of the existing files from /data/system/ :​
locksettings.db
Gatekeeper.password.key
gatekeeper.pattern.key
locksettings.db-shm
locksettings.db-wal
recoverablekeystore.db
password.key
pattern.key
4. Reboot and re-encrypt​​
At this point rebooting from recovery will result in a running and successfully recovery backup.
one thing to note is the data and data/media partitions are at this point unencrypted
TRYING TO REINCRYPT NOW WILL FAIL to reencrypt got to settings > security > re set your pin or password for the phone
(optional) then select encryption and there will be an orange button to encrypt device.
the encryption process will take quite a while as it will reencrypt your entire phone.
The above doesn't work as it's trying to accomplish FDE, and the fstab line for encryptable=ice, isn't compatible with this.
i could not find an fstab string to follow the same option but for FBE.
​

Thanks for sharing, nice guide to disable forced FBE encryption! I think this applies to Android 12+ in general, not just OnePlus devices.
I ended up with the same problem on my Mi 10 Ultra with MIUI 13 after a /data partition restore and it was a real pain to solve ("set_policy_failed:..." rescue party error for different directories). It's strange though why it fails to set the fscrypt policy for existing directories with no policy, correct permissions and SELinux context...
(Btw: whether a fscrypt policy is applied to a directory ("is this directory encrypted?") can be checked with fscryptpolicyget in terminal.)
Unfortunately, this didn't directly solve my TWRP backup restore problem and I still had to do a manual restore, but now I can at least disable FBE and it's always nice to have actual control over the device you paid money for (you should really have control by default, but oh well...)
(Some of) the troubleshooting I did:
Like I mentioned, I first thought the issue might be with the SE linux context, so I tried running restorecon, but this didn't help - I eventually found that in init.rc, restorecon is usually already automatically run during each boot for directories under /data/... so running it manually makes no difference.
To edit /vendor/etc/fstab.qcom (or /system) on my device, I had to first disable the shared blocks EXT4 optional feature. I followed this nice guide to unpack/repack super.img. But this is missing the step for disabling shared blocks: when I tried to mount any of the unpacked images (e.g. vendor.img) as R/W, it failed with the useless generic error:
wrong fs type, bad option, bad superblock on ...
Click to expand...
Click to collapse
Then dmesg gave me another clue, but at the same time was still cryptic and not immediately helpful:
EXT4-fs (loop*): couldn't mount RDWR because of unsupported optional features (4000)`.
Click to expand...
Click to collapse
So I guess 4000 is the code for shared blocks and you can disable these with e2fsck -E unshare_blocks <your .img file or loop device> (and probably need a filesystem check with e2fsck -yf <file>). Again very annoying that these numerical feature codes are not mentioned anywhere in the e2fsck manual pages for example.
Anyway, I was finally able to either:
1. mount vendor.img on my PC (mount -o loop vendor.img /mnt/vendor) and edit the /mnt/vendor/etc/fstab.qcom right there before repacking the .img and flashing the new edited super.img to my device
or
2. just repacking the vendor.img with shared blocks disabled and size increased (resize2fs vendor.img <new size>) and flashing the new super.img without other modifications - this way /vendor can also be mounted as r/w in Android and changes made later (mount -o remount,rw /vendor).
The worst part is that in the end, even with decryption disabled and the keys deleted, the device still wouldn't boot after a /data restore from TWRP (and after multiple days spent on debugging )... I still had to manually extract the TWRP backup and move directories/files individually - thankfully no issues with app/ or data/ - I think the problem was with some files in either system/ or misc/, but idk for sure. I just manually went through and kept only what seemed important (saved wifi APs, BT devices, SMSs etc, but not saved accounts). And after this it finally booted with all my apps and (most of) my settings!
(Btw2: a TWRP/nandroid backup is apparently just a bunch of separate tar.gz files, not a split archive, so you can just extract them with for file in ../data.f2fs.win*; do echo "extracting $file..."; busybox tar -xzf $file; done)