[Deprecated] Universal DM-Verity, ForceEncrypt, Disk Quota Disabler [11/2/2020]

Search This thread

Zackptg5

Recognized Developer
Sep 18, 2014
4,148
7,005
zackptg5.com
Google Pixel 4a
Google Pixel 5a
Hi all!

For the past couple of months, I've been looking into making a more universal solution to disable dm-verity and forceencrypt. Needing to take different zips, modify them for different devices, and then cross your fingers when you switch between custom and stock roms simply wasn't good enough for me. After lots of searching around, failed attempts, and some guidance by @Xennet, @osm0sis, and @nathanchance (thank you all for your help), I finally got a working solution. Ironically, it was under my nose the whole time.

@topjohnwu figured much of this out a while ago with his magiskboot binary - just modify the fstabs. Magiskboot only works for fstabs in the ramdisk though and dm-verity and forceencrypt are only disabled under certain conditions (when you create a .magisk file with the variables set to false and place it in the proper location). So I made an installker with AK3 by @osm0sis and used a combination of sed patches by @jcadduono in addition to others I found for fstabs not in the ramdisk, modified magiskboot with some extra entries I found need to be removed on some devices, and added some stuff of my own like the creation of .magisk and .supersu files in the right location with the proper contents.

The end result: a zip that will remove dm-verity and/or forceencrypt from all fstabs on your device
It can also remove disk quota if you choose. This may be needed if you have an older twrp and/or want to downgrade to Nougat. More info here: https://source.android.com/devices/storage/faster-stats

Instructions:
The zipname tells the installer what to do. Here are the current options:
  • Add 'enfec' or en'forceencrypt' to zipname to keep forceencrypt enabled if present
  • Add 'fec' or 'forceencrypt' to zipname to disable forceencrypt (zipname already has this so remove these if you want to keep it enabled)
  • Add 'quota' to zipname to disable disc quota
Note that verity is always disabled - it has to be for any modifications with this mod

If you're currently encrypted:
  1. BACKUP YOUR INTERNAL STORAGE TO YOUR PC
  2. Format data (this is NOT the same as Wipe data) (In TWRP: Wipe -> Format Data)
  3. Reboot back into recovery
  4. Follow the directions below for when you're not encrypted

If you're not encrypted: flash all of your stuff, then FLASH THIS ZIP LAST

Some extra details for Slot devices:
  1. Flash ROM
  2. Flash TWRP Installer Zip
  3. Reboot into TWRP
  4. Flash everything else
  5. Flash this zip

Only difference here is the twrp zip and the recovery reboot, main principle is the same - FLASH THIS ZIP LAST

Troubleshooting:
  • Take a recovery log after flashing this zip (thanks to @aIecxs for the imgs):
    recovery_log.png
  • If the zip isn't patching any fstabs that it should be, then it's possible that the previous zip(s) didn't unmount system and/or vendor properly. Either unmount them in twrp, or just reboot back into recovery and flash this zip again

Compatibility: Any android device

Source: https://github.com/Zackptg5/Disable_Dm-Verity_ForceEncrypt

Download
 
Last edited:
Hi all!

For the past couple of months, I've been looking into making a more universal solution to disable dm-verity and forceencrypt. Needing to take different zips, modify them for different devices, and then cross your fingers when you switch between custom and stock roms simply wasn't good enough for me. After lots of searching around, failed attempts, and some guidance by @Xennet, @osm0sis, and @nathanchance (thank you all for your help), I finally got a working solution. Ironically, it was under my nose the whole time.

@topjohnwu figured much of this out a while ago with his magisk installer. However, dm-verity and forceencrypt (fec) are only disabled under certain conditions (when you create a .magisk file with the variables set to false and place it in the proper location). This would be fine for magisk users, but not for everyone else. So I took Magisk 16.6 beta zip, modified it to add fstab patches by @jcadduono, added some stuff of my own, and then gutted all of the magisk stuff unrelated to this.

The end result: a zip that will remove dm-verity and fec from your boot img and fstab files (without installing magisk, I took all of that out).

Instructions:
If you're currently encrypted: BACKUP YOUR INTERNAL STORAGE TO YOUR PC. Then format data. Reboot back into recovery
After doing that or if you're not encrypted: Flash your rom, custom kernel and/or root (like magisk or supersu), then this zip.
This zip should probably be flashed after anything that modifies your boot img (magisk, supersu, other root solutions, custom kernel, etc.).

Compatibility: Any device magisk is compatible with

Source:https://github.com/Zackptg5/Disable_Dm-Verity_FEC

Hi!

Just to be sure, does this remove the need to flash patched boot.img files when updating stock ROMs with root?

Thanks!

Sent from my OnePlus 3T using XDA Labs
 

Zackptg5

Recognized Developer
Sep 18, 2014
4,148
7,005
zackptg5.com
Google Pixel 4a
Google Pixel 5a
Not sure what you mean. This does patch the boot img to remove verity/fec though if that's what you're getting at

I found this because I saw your post in @Xennet's thread for OP3/3T Oxygen OS patched boot.img files.

Currently every time I update OOS I flash a boot.img patched by him and also a zip by him as well. What I'm asking is if your zip would be enough? :)

Sent from my OnePlus 3T using XDA Labs
 

Zackptg5

Recognized Developer
Sep 18, 2014
4,148
7,005
zackptg5.com
Google Pixel 4a
Google Pixel 5a
I found this because I saw your post in @Xennet's thread for OP3/3T Oxygen OS patched boot.img files.

Currently every time I update OOS I flash a boot.img patched by him and also a zip by him as well. What I'm asking is if your zip would be enough? :)
Oh, gotcha. Ya, this zip handles that so you don't need to flash the boot img anymore
 

DEVILOPS 007

Senior Member
May 24, 2016
3,866
1,668
Colchester
@Zackptg5 First of all, great job. This looks very impressive and I appreciate the work you've done. I know this will be very useful for people trying things like the P GSI image then going back to no treble ROMs back on Oreo. I was just wondering though, as I have no intention on trying any treble ROMs, is there any benefit to using this over the old no verity V2 zip for someone that will only use non-treble Oreo ROMs. Thank you:D
 

Zackptg5

Recognized Developer
Sep 18, 2014
4,148
7,005
zackptg5.com
Google Pixel 4a
Google Pixel 5a
@Zackptg5 First of all, great job. This looks very impressive and I appreciate the work you've done. I know this will be very useful for people trying things like the P GSI image then going back to no treble ROMs back on Oreo. I was just wondering though, as I have no intention on trying any treble ROMs, is there any benefit to using this over the old no verity V2 zip for someone that will only use non-treble Oreo ROMs. Thank you:D
It really depends on the rom. If you're on a custom rom the old zip is probably fine (but not always, lots of variation there). If you're on a stock or stock based rom however, this is needed (unless you flash a patched boot.img - but why flash 2 things when you can flash 1?). This zip works with treble and nontreble roms by the way and the old zip can be easily modified the same way (I have one floating around xda somewhere).
Assuming you're on a custom rom which already has dm-verity disabled, the benefit to this zip is that not only does it disable force encryption in the vendor fstabs (like the old zip), but it also disables it in the boot img which some roms have
 

DEVILOPS 007

Senior Member
May 24, 2016
3,866
1,668
Colchester
It really depends on the rom. If you're on a custom rom the old zip is probably fine (but not always, lots of variation there). If you're on a stock or stock based rom however, this is needed (unless you flash a patched boot.img - but why flash 2 things when you can flash 1?). This zip works with treble and nontreble roms by the way and the old zip can be easily modified the same way (I have one floating around xda somewhere).
Assuming you're on a custom rom which already has dm-verity disabled, the benefit to this zip is that not only does it disable force encryption in the vendor fstabs (like the old zip), but it also disables it in the boot img which some roms have
So basically it is a more well-done version if you want to put it that way. Works on stock and custom ROMs including treble no matter what it is or if there is dm-verity enabled or not is what I'm understanding from this. I'm using treskmod currently which is basically OmniRom. I'll give it a go when I get back off holiday so I can clean flash. Thanks again?
 
  • Like
Reactions: Briceocemk

Zackptg5

Recognized Developer
Sep 18, 2014
4,148
7,005
zackptg5.com
Google Pixel 4a
Google Pixel 5a
So basically it is a more well-done version if you want to put it that way. Works on stock and custom ROMs including treble no matter what it is or if there is dm-verity enabled or not is what I'm understanding from this. I'm using treskmod currently which is basically OmniRom. I'll give it a go when I get back off holiday so I can clean flash. Thanks again?
I wouldn't call it more well done but rather more complete :)

And yup, should work on any rom/device magiskboot is able to work with (which is most of them). Dm-verity will be removed too by this mod by the way
 
  • Like
Reactions: DEVILOPS 007

repey6

Senior Member
@Zackptg5 hi. Tell me please how need me right do. I am on LOS 15.1 on my Samsung Tab A SM-T585.now. And with dm-verity and fec are all right. But when i go on custom rom based on stock 8.0(port) i got dm-verity and fec issue. After installation this rom and start i can see all files of internal memory in file explorer. But only i reboot to recovery internal memory have size 0mb. So my question: i need do fomat data before installtion rom and your zip or only install zip?
 
Last edited:

bdwilk

Senior Member
May 17, 2016
3,854
3,057
45
American/Philippines
OnePlus One
OnePlus 5T
I wouldn't call it more well done but rather more complete :)

And yup, should work on any rom/device magiskboot is able to work with (which is most of them). Dm-verity will be removed too by this mod by the way
@DEVILOPS 007 I just flashed latest 20180719 tresk and tried this zip and got sent back to TWRP. Immedietly flashed v2 and it booted. It worked on AOSiP earlier though so not sure what could cause it to fail here.

Sent from my OnePlus5T using XDA Labs
 
  • Like
Reactions: DEVILOPS 007

Zackptg5

Recognized Developer
Sep 18, 2014
4,148
7,005
zackptg5.com
Google Pixel 4a
Google Pixel 5a
@Zackptg5 hi. Tell me please how need me right do. I am on LOS 15.1 on my Samsung Tab A SM-T585.now. And with dm-verity and fec are all right. But when i go on custom rom based on stock 8.0(port) i got dm-verity and fec issue. After installation this rom and start i can see all files of internal memory in file explorer. But only i reboot to recovery internal memory have size 0mb. So my question: i need do fomat data before installtion rom and your zip or only install zip?
You'll need to format data. Then flash rom and kernel, then this after

@DEVILOPS 007 I just flashed latest 20180719 tresk and tried this zip and got sent back to TWRP. Immedietly flashed v2 and it booted. It worked on AOSiP earlier though so not sure what could cause it to fail here.
Can you send a recovery log? What all did you flash when that happened and in what order? Thanks
 
  • Like
Reactions: repey6

bdwilk

Senior Member
May 17, 2016
3,854
3,057
45
American/Philippines
OnePlus One
OnePlus 5T
You'll need to format data. Then flash rom and kernel, then this after


Can you send a recovery log? What all did you flash when that happened and in what order? Thanks
I'll do it again and get a log for you another time.

ROM, magisk 16.6, vanced installer (YouTube), universal dm-verity (ROM has built-in gapps)

Got sent back to TWRP and hit reboot to system one more time for science, and got sent back to TWRP again.

Flashed dm-verity v2 and it booted fine.

OnePlus 5t

Format data everytime or just once for this to work or format because of treble or what? I'm curious as to when formatting is required and why exactly.
I believe he's just telling dude how to decrypt for the first time.

Sent from my OnePlus5T using XDA Labs
 
  • Like
Reactions: DEVILOPS 007

DEVILOPS 007

Senior Member
May 24, 2016
3,866
1,668
Colchester
I'll do it again and get a log for you another time.

ROM, magisk 16.6, vanced installer (YouTube), universal dm-verity (ROM has built-in gapps)

Got sent back to TWRP and hit reboot to system one more time for science, and got sent back to TWRP again.

Flashed dm-verity v2 and it booted fine.

OnePlus 5t


I believe he's just telling dude how to decrypt for the first time.
Oh I thought he was responding to you. My bad lol
 
  • Like
Reactions: bdwilk

repey6

Senior Member
You'll need to format data. Then flash rom and kernel, then this after

This is a copypaste from Samsuyng Tab A thread:

Hi. You can to try Universal DM-Verity and ForceEncrypt Disabler by Zackptg5 from this thred https://xdaforums.com/android/software/universal-dm-verity-forceencrypt-t3817389

Does this work?

---------- Post added at 09:52 PM ---------- Previous post was at 09:20 PM ----------




I've tested it and it doesn't work, still encrypted.
 
Last edited:

johnb380

Senior Member
Jan 25, 2011
2,988
2,313
Masury, Ohio
This is a copypaste from Samsuyng Tab A thread:
Of course he's still encrypted this zip isn't going to decrypt your phone. It's for once your decrypted and flashing a rom it will not allow the rom zip to encrypt your device and will allow it to boot decrypted and without the insecure verity check blocking boot.

Sent from my ONEPLUS A5010 using Tapatalk
 

Top Liked Posts

  • There are no posts matching your filters.
  • 322
    Hi all!

    For the past couple of months, I've been looking into making a more universal solution to disable dm-verity and forceencrypt. Needing to take different zips, modify them for different devices, and then cross your fingers when you switch between custom and stock roms simply wasn't good enough for me. After lots of searching around, failed attempts, and some guidance by @Xennet, @osm0sis, and @nathanchance (thank you all for your help), I finally got a working solution. Ironically, it was under my nose the whole time.

    @topjohnwu figured much of this out a while ago with his magiskboot binary - just modify the fstabs. Magiskboot only works for fstabs in the ramdisk though and dm-verity and forceencrypt are only disabled under certain conditions (when you create a .magisk file with the variables set to false and place it in the proper location). So I made an installker with AK3 by @osm0sis and used a combination of sed patches by @jcadduono in addition to others I found for fstabs not in the ramdisk, modified magiskboot with some extra entries I found need to be removed on some devices, and added some stuff of my own like the creation of .magisk and .supersu files in the right location with the proper contents.

    The end result: a zip that will remove dm-verity and/or forceencrypt from all fstabs on your device
    It can also remove disk quota if you choose. This may be needed if you have an older twrp and/or want to downgrade to Nougat. More info here: https://source.android.com/devices/storage/faster-stats

    Instructions:
    The zipname tells the installer what to do. Here are the current options:
    • Add 'enfec' or en'forceencrypt' to zipname to keep forceencrypt enabled if present
    • Add 'fec' or 'forceencrypt' to zipname to disable forceencrypt (zipname already has this so remove these if you want to keep it enabled)
    • Add 'quota' to zipname to disable disc quota
    Note that verity is always disabled - it has to be for any modifications with this mod

    If you're currently encrypted:
    1. BACKUP YOUR INTERNAL STORAGE TO YOUR PC
    2. Format data (this is NOT the same as Wipe data) (In TWRP: Wipe -> Format Data)
    3. Reboot back into recovery
    4. Follow the directions below for when you're not encrypted

    If you're not encrypted: flash all of your stuff, then FLASH THIS ZIP LAST

    Some extra details for Slot devices:
    1. Flash ROM
    2. Flash TWRP Installer Zip
    3. Reboot into TWRP
    4. Flash everything else
    5. Flash this zip

    Only difference here is the twrp zip and the recovery reboot, main principle is the same - FLASH THIS ZIP LAST

    Troubleshooting:
    • Take a recovery log after flashing this zip (thanks to @aIecxs for the imgs):
      recovery_log.png
    • If the zip isn't patching any fstabs that it should be, then it's possible that the previous zip(s) didn't unmount system and/or vendor properly. Either unmount them in twrp, or just reboot back into recovery and flash this zip again

    Compatibility: Any android device

    Source: https://github.com/Zackptg5/Disable_Dm-Verity_ForceEncrypt

    Download
    17
    Hey everyone! It's been a while thanks to life and such but I have a test build out that I'll make the next release if all goes well. Let me know if it works for you, I'm especially interested in system as root devices.

    I completely revamped the zip to now use AK3 by @osm0sis and have a modified version of magiskboot in it that'll do some extra stuff for ramdisk patching :)
    16
    Merry Christmas everybody! Posted another build - lots of bug fixes - think I got everything ironed out. Here's the changelog:
    • Added vol key selection method for adb sideloading
    • Fixed dtbo patching bugs
    • Fixed magiskboot bug
    • Ignore twrp fstabs if installed in boot img (system as root devices)
    • Add x86 chromeos support
    • Fix apex mounting
    • Misc bug fixes/improvements
    13
    Updated the zip!
    Changelog:
    - Update ak3
    - Always disable verity - required for any other options
    - Added keep encryption option to zip
    - Added new verity flags
    12
    Updated zip! Fixes problem where kernel fstabs weren't being patched. Thanks to lastsaskatchewanpirate @ github for the fix