mohrezaei/Calyx-Magisk.md

## Calyx-Magisk.md

      
    Raw
  

              Calyx-Magisk.md
            
          
    CalyxOS with Magisk with working signed images and AVB Verity

This idea was inspired by this post topjohnwu/Magisk#509 (comment)
I got this working with CalyxOS 2.11.0 (Android 11) with full AVB Verity enabled and was able to lock the bootloader after flashing and still have su.
Create a working build

First, make sure you can build and sign a proper CalyxOS for your device. This is probably the hardest part.
Prepare Magisk files for rooting

Second, prepare a magisk directory outside your build directory as follows:
mkdir magisk
cd magisk
wget https://cdn.jsdelivr.net/gh/topjohnwu/magisk-files@55bdc45955e7ba1fe4d296b6fc06f926ebc9ddd1/app-debug.apk
unzip app-debug.apk

Replace the apk URL with whatever version is latest or works best for you.
The URL for the latest version can be found in the Magisk files repo. https://github.com/topjohnwu/magisk-files
We then need a few helper scripts in the same directory.
cat > root-img.sh
#!/bin/bash

SCRIPT_DIR="$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"

export PATH=$PATH:$SCRIPT_DIR

export BOOTMODE=true
export KEEPVERITY=true

cp $SCRIPT_DIR/lib/x86/libmagiskboot.so $SCRIPT_DIR/assets/magiskboot
cp $SCRIPT_DIR/lib/arm64-v8a/libmagisk64.so $SCRIPT_DIR/assets/magisk64
cp $SCRIPT_DIR/lib/armeabi-v7a/libmagisk32.so $SCRIPT_DIR/assets/magisk32
cp $SCRIPT_DIR/lib/arm64-v8a/libmagiskinit.so $SCRIPT_DIR/assets/magiskinit

. $SCRIPT_DIR/assets/boot_patch.sh $*
chmod 755 root-img.sh
Make sure magiskinit is correct for your target in root-img.sh.
cat > dos2unix
#!/bin/bash
cat $*
chmod 755 dos2unix
cat > getprop
#!/bin/bash
echo $*
chmod 755 getprop
That's all for preparing magisk.
Prepare signing step

Now we need to intercept avbtool to root the boot.img file just before it's hashed/signed.
In the last step of building the OS, the target files are zipped up and moved into a signing directory, along with the signing keys and binaries. In the bin directory, you should find avbtool which will be used during signing. We're going to replace it with a script that detects boot images, roots them and then continues with the real avbtool.
cd bin
mv avbtool avbtool.real
cat > avbtool
#!/bin/bash

# change this to whereever you created the magisk directory:
MAGISK_DIR=/media/work/magisk

echo "%%%%%%%%%%" `date` Running avbtool with "$*" >> $MAGISK_DIR/avbtool-invokes.txt

SCRIPT_DIR="$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
IMG_NAME=`realpath $3`

if [[ $1 == add_hash_footer ]] && [[ $7 == boot ]] ;
then
        echo starting to root $3 >> $MAGISK_DIR/rooting.txt
        $MAGISK_DIR/root-img.sh $IMG_NAME >> $MAGISK_DIR/rooting.txt
        cp $MAGISK_DIR/assets/new-boot.img $IMG_NAME
fi

$SCRIPT_DIR/avbtool.real $*
chmod 755 avbtool
Now, sign the target files again.
If all goes well, that should create a rooted boot.img with the correct signatures. You can check the avbtool-invokes.txt and rooting.txt files to see if everything went well.