file based encryption? - Nexus 5 Q&A, Help & Troubleshooting

I know that as of 7.0, Android now supports file based encryption. Is there any way to enable this on our Nexus 5, or are we stuck with block based encryption?

Related

[Q&A] How can I disable PIE?

My device has ResurrectionRemix 5.7.0 with Android M 6.0.1. I was going to trim my cache, data and system with LagFix (premium) app, but it sends me this error "error: only position independent executables (PIE) are supported.".
Surfing in the net I understand that I have to disable PIE (position indipendent executables).
Can someone tell me how can I turn off PIE controls?
It's not PIE controls but a new security check in Android System and you can't disable it, only rom developers can.

Android Encryption, SafetyNet, Verified Boot 2.0 and the Boot Process

I'm trying to understand the Android Boot Process and the new additional security measures/restrictions put in place by the device manufacturers.
So far I've read through these posts on XDA, Lineage OS Blog and some others. I've understood some and still confused about others.
[INFO] ANDROID DEVICE PARTITIONS and FILESYSTEMS
[INFO] BOOT PROCESS: ANDROID vs. LINUX
Qualcomm’s Chain of Trust
Android Boot and Recovery Images
Dissecting the Android OTA Update System
I've flashed custom ROM and TWRP on my old phone but it didn't have the new security measures in place and I didn't bother about encryption then (The entire files on the device is accessible from the recovery).
I have some doubts about the encryption and other stuff.
1) When we are running with the stock recoveries, user files are inaccessible(because those stock recoveries don't provide that function).
How can I keep my files safe while using TWRP or similar recoveries?
ie How does FDE work with the custom recoveries?
2) I've read about some users complain that FDE got triggered after firmware upgrade. In such cases what key does it use?
3) I've read on Google's website that it allows users to boot with custom keys. Is that enough for 'Certified Status' on Google Play.
4) What all modifications trigger SafetyNet?
I understand that modifying /system triggers it, so using custom kernels would trigger it Right?
Kindly help me out. I'm sorry for any mistakes.
Bump
Bump
Bumped

All about Android 11 for the POCO F2 Pro

Did somebody try the Beta/Dev Rom for the Poco F2 Pro? How it is?
Looks like in 2 weeks Google will release stable Android 11.
about Android11
it is unstable for now,some bank apps are crashed,and system is constantly reboot itself,however,you can enjoy new GPU driver.
Using for a while on China Developer ROM. There are no crashes or performance issues, but for me biggest deal breaker is that DJI Go 4 app isn't working at the moment. I hope they update it soon to work with Android 11.
Does the beta come with A/B partition for seamless updates? I heard Android 11 will require devices to be in an A/B partition system, which would come handy for OTA updates on rooted devices.
(Currently, we're on an A-only partition with MIUI12 & Android 10)
You could easily answer my question by installing Treble Check (from KevinT.) on the Play Store. The app checks which partition system is used on the device (currently says "Seamless System Updates Unsupported" with Android 10).
Eidenz said:
Does the beta come with A/B partition for seamless updates? I heard Android 11 will require devices to be in an A/B partition system, which would come handy for OTA updates on rooted devices.
(Currently, we're on an A-only partition with MIUI12 & Android 10)
You could easily answer my question by installing Treble Check (from KevinT.) on the Play Store. The app checks which partition system is used on the device (currently says "Seamless System Updates Unsupported" with Android 10).
Click to expand...
Click to collapse
I have EU ROM Android 11 Beta weekly 20-08-20 installed. Treble Check says Only A partition, Seamless System updates Unsupported".
Alrighty, thank you.
I hope this will be in the first release of Android 11 in September. They are planning to make a virtual A/B partition for all devices.
Eidenz said:
I heard Android 11 will require devices to be in an A/B partition system, which would come handy for OTA updates on rooted devices.
Click to expand...
Click to collapse
AFAIK only devices launched with Android 11 are required to adopt it's new features like A/B partitions and enforced background processes handling.
Thats why we will not get it.

Development [Experimental] Unofficial TWRP for Lenovo TB-Q706F (P12/Xiaoxin Pad Pro 12.6)

C:
#include <std/disclaimer.h>
/*
* I am not responsible for bricked devices, dead SD cards, thermonuclear
* war, or the current economic crisis caused by you following these
* directions. YOU are choosing to make these modifications, and
* if you point your finger at me for messing up your device, I will
* laugh at you.
*/
This is mostly based on Ungeskriptet's work on TB-J716F. Many thanks to his work. Additionally thanks to the devs of twrpdtgen utility which is very useful for obtaining some very helpful information about the device from a stock recovery image.
The recovery is currently flashable and functional. You may refer to the flashing guide for J716F to flash the recovery on this device as the procedure is the same.
The following stuffs were tested working: Decryption (A11 only), Backup, Wiping, Touch, Fastbootd, MicroSD card.
Other functionalities should behave similar to TB-J716F TWRP.
Not working stuffs: Vibration, busybox (haven't really checked but should be similar to TB-J716F).
Device tree: twrp_device_lenovo_Q706F
UPDATE (Jan 14, 2023): Updated builds of TWRP 3.7.0 for Android 11 (A11) and 12 (A12).
twrp-Q706F-A11-3.7.0-r2: This is for Android 11 GSIs. Can only reliably decrypt Android 11 /data partitions.
twrp-Q706F-A12-3.7.0-r2: This is for Android 12 GSIs. CANNOT decrypt Android 11 /data partitions. Need further testing for Android 12 /data partitions.
Neither build can decrypt Android 13 /data at the moment. If security is not a concern for your use case, you may consider using a tool such as DFE-NEO to disable force encryption of /data. This will enable TWRP to access your /data partition under all circumstances and will save you the hassle of having to back up the entire /data partition when going back and forth between different GSIs.
The updated build contains many more options that can be backed up in case needed. Additionally, some parameters necessary for decrypting A12 /data has been added. Unfortunately, from current feedbacks, it seems decryption is only possible if not using any lock (PIN, Pattern, or Password). Also, with these parameters, it is now possible to make A12 TWRP determine the lock type of A11 /data partition, but it cannot be decrypted even with the correct credential provided.
EXPERIMENTAL: I've added a nuclear option for /data backup, the "Data Image" option. This will back up your /data partition as a whole regardless of its content. You need a large enough external SD card for this option to work, as TWRP's "Enable Compression" doesn't appear to do anything for emmc backups.
!! WARNING !! - Before backing up the entire /data partition, BE SURE TO REMOVE ANY SCREEN LOCK, as after restore, while your system will boot, YOUR CREDENTIALS MAY NOT BE ACCEPTED ANYMORE! YOU WILL LOSE ACCESS TO YOUR USER FILES.
The resulted backup would depend on the size of your internal storage. In my case, the data partition was about 230GB in size, and the whole backup process as well as digest creation took about 2.5 hours in total.
Backing up of the entire /data partition is still experimental, and make sure to check that you're backing up to an external storage if you checked the "Data Image" option!
Spoiler: Old Changelogs
Apr 9, 2022: A second version has been uploaded, using blobs from TB-Q706Z_S212073_220222_ROW. The recovery's decryption mechanism appears to work okay. Haven't tested other stuffs but I don't think there would be too much difference compared to the initial build, which was based on PRC blobs.
Still using the Q706F product name. Not sure if the same recovery can be used as-is on a Q706Z (5G variant).
UPDATE (Jul 7, 2022): I'm uploading two new builds. Both builds can now mount the MicroSD card.
UPDATE (Dec 3, 2022): I've made two builds of TWRP 3.7.0 for Android 11 (A11) and 12 (A12).
twrp-recovery-Q706F-A11-3.7.0-r1: This is for Android 11 GSIs. Can decrypt Android 11 /data partitions. Decryption of Android 12 /data is unlikely.
twrp-recovery-Q706F-A12-3.7.0-r1: This is for Android 12 GSIs. CANNOT decrypt Android 11 /data partitions.
TESTING NEEDED (A12): As of TWRP 3.7.0, support for decryption of Android 12 /data is considered formal and should in theory work in most cases. I'm still using Android 11 GSI so I cannot test this myself, so users who are on Android 12 GSIs can test whether it's possible to decrypt your Android 12 /data partitions with the A12 build.
Spoiler: Development Notes
The recovery kernel and the vendor libraries I used for the device tree were dumped from my own device when I first started experimenting with phh-AOSP GSI, though I think files from the ROW image should also work on all devices. My device was on ZUI 13.0.437_211106 PRC at that time, but I'm using ROW kernel and vendor now since they work correctly on GSI.
Some main issues encountered during porting:
- Touchscreen input was rotated by default, that I have to add some configuration parameters to correct it.
- Decryption didn't work initially. Apparently Q706F used some different parameters compared to J716F according to fstab.qcom from my device's vendor image.
In overall, Q706F is not too much different from J716F as they use the same SoC and most of the internal configurations are identical between the two (so very few changes were made to the configuration files during porting).
I currently don't use MicroSD card on this device at the moment, but from what I saw in the recovery, it doesn't appear to expose /dev/block/mmcblk* like most devices, even after I inserted one. I'm not sure where I should use to access the SD card device.
UPDATE (Jul 7, 2022): It seems the tablet does expose the MicroSD card as /dev/block/mmcblk0p1, and I could already mount it via command line using default options to begin with. As a result, adding formal MicroSD card support turned out to be easier than I thought.
UPDATE (Jan 14, 2023): Everyone has been very helpful. Looks like twrp.flags is the right place to add partitions meant to be backed up. In order to make backups as complete as possible, a lot of partitions have been added thanks to everyone's effort.
Great to see some development many thanks.
I tried to flash gapps_full_11.0 downloaded from https://opengapps.org/,but it says partition space is insufficient , and I have already build a full aosp11_r48 system.img along with allocating about 4000M capacity to system partition. Weird
ZTE AXON 7 said:
I tried to flash gapps_full_11.0 downloaded from https://opengapps.org/,but it says partition space is insufficient , and I have already build a full aosp11_r48 system.img along with allocating about 4000M capacity to system partition. Weird
Click to expand...
Click to collapse
Are you using a non-vndklite GSI? It's not trivial to mount system r/w with such GSI. You need vndklite GSI for that, or simply grab a bgN variant (g denotes gapps included).
Wait... which ROM are you using exactly? AOSP11 r48? I don't recall seeing any ROM development for this tablet.
Actually I built aosp for my lenovo tablet p12 pro
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
ZTE AXON 7 said:
Actually I built aosp for my lenovo tablet p12 pro View attachment 5504739
Click to expand...
Click to collapse
Will you be publicly releasing this ones it's all working?
Dang I just stumbled onto this, didn't realize someone had already put in the work to get twrp, but I have already updated my p12 to the latest build. Any chance of updating decryption to the most current build? I assume this will be the last android 11 build while they work on 12L. I personally won't ever be updating this device to 12 due to the major stepbackwards in ui google is taking so having a final twrp on the last 11 build would be great.
DaConcho said:
Dang I just stumbled onto this, didn't realize someone had already put in the work to get twrp, but I have already updated my p12 to the latest build. Any chance of updating decryption to the most current build? I assume this will be the last android 11 build while they work on 12L. I personally won't ever be updating this device to 12 due to the major stepbackwards in ui google is taking so having a final twrp on the last 11 build would be great.
Click to expand...
Click to collapse
Sorry for a late response. Which build are you currently on?
I'm not sure how decryption works with updates but things are indeed more complicated after taking encrypted /data into consideration.
Maybe I can consider tailoring the TWRP tree against a newer ROW build when I have time, but I won't be able to do in-depth tests myself as the current build configuration on my device is quite stable that I don't want to change it in the near future.
A second version has been released using TB-Q706Z_S212073_220222_ROW blobs.
It decrypts my /data just fine, as I'm currently using Android 11 GSI. Looks like the vendor or other components don't really matter for decryption as long as the system is still on Android 11.
Simply put, until TWRP formally supports Android 12, it's not possible for TWRP to decrypt /data partitions created by Android 12.
I am actually still on TB-Q706F_S212017_211231_ROW. OTA doesn't play nice after rooting so haven't had a chance to update yet but I will so I can give it a spin.
LSS4181 said:
A second version has been released using TB-Q706Z_S212073_220222_ROW blobs.
It decrypts my /data just fine, as I'm currently using Android 11 GSI. Looks like the vendor or other components don't really matter for decryption as long as the system is still on Android 11.
Simply put, until TWRP formally supports Android 12, it's not possible for TWRP to decrypt /data partitions created by Android 12.
Click to expand...
Click to collapse
Just curious how does the stylus play with a GSI? does all the pen funcionality work ok?
DaConcho said:
Just curious how does the stylus play with a GSI? does all the pen funcionality work ok?
Click to expand...
Click to collapse
You can just pair the Precision Pen through Bluetooth.
I'm not sure about vendor-specific features, but basic functionality (as a pointer device) should work okay.
LSS4181 said:
A second version has been released using TB-Q706Z_S212073_220222_ROW blobs.
It decrypts my /data just fine, as I'm currently using Android 11 GSI. Looks like the vendor or other components don't really matter for decryption as long as the system is still on Android 11.
Simply put, until TWRP formally supports Android 12, it's not possible for TWRP to decrypt /data partitions created by Android 12.
Click to expand...
Click to collapse
Just updated to the latest build and flashed the V2 of twrp. I am getting stuck on the TWRP splash screen after booting to recovery
Disregard, just reflashed Magisk and gave it a minute and its solid now. Thanks for building!
Worked great on the US version of the P12 Pro. To unlock the bootloader on the US version all that was needed was "fastboot flashing unlock" which brought up the unlock bootloader prompt. Flashed magisk without issue.
Worked great on the XiaoXin Pad with ZUI.
What I did:
Full backup (all part-s)
Full restore
Restore only super.
Flashing modified RW super (due to unsucceful flashing modified RW super via fastboot) via Install -- Install img
Full backup using OTG USB disk.
All this working beautiful. Many thanks to creator!
Added two new builds. One for Android 11, the other is a testing one for Android 12. SD card should be working now.
I only tested the Android 12 one briefly without flashing. It seems the Android 12 build cannot decrypt my Android 11 /data partition, and is a bit bigger in size compared to the Android 11 one. Only the Android 11 build decrypts my /data at the moment, and I've successfully flashed it into my device.
Need someone who's on Android 12 GSI to test whether it's possible to decrypt Android 12 /data. However, according to the README of the minimal TWRP manifest's A12.1 branch, that decryption is still WIP and may only work when screen locks (password/PIN/pattern) are disabled.
TWRP v3 for A11 works with SD cards, tested on ZUI.
SD card has exFAT file system.
Many thanks to the author from me.
TWRP for A12 is not working with A12 Global firmware (TB-Q706F_USR_S410033_2208041209_Q00050_ROW)
The tablet stuck on Lenovo logo.
Can you try to fix this ?
Works for rooting Lenovo P12 Pro with magisk
Android: 12
Model: TB-Q706F
Build #: TB-Q706F_S410033_220804_ROW
Software Version: TB-Q706F_RF01_220804
Decryption of /data doesn't work, SD card mounting doesn't work in TWRP, works fine once booted.
Edit:
make sure to disable automatic software updates in the updates section and disable applying updates on reboot in the developer settings. Otherwise you might end up semi-bricked (black screen on boot) if it tries to update on it's own, and the only way to fix it is to restore the stock recovery and factory reset and start over.
A late update. I've put up two TWRP 3.7.0 builds. One for Android 11 and the other for Android 12.
Added some more partitions that could be backed up. Many thanks to @f1tm0t for the changes.
I also updated the vendor blobs in the Android 12 build to TB-Q706F_USR_S410033_2208041209_Q00050_ROW just in case, but from the looks of it the vendor of this more recent stock FW still says Android 11, despite the system image is indeed Android 12, so this change may not be immediately necessary.
Need Android 12 users to test whether decryption works now, as since TWRP 3.7.0 support for decrypting Android 12 /data partitions is now formal.

FBEv1 or FBEv2 ?

Hi all, I'm working with RROS on my OP7pro and I see TWRP is available to download in FBEv1 or FBEv2 versions, can anyone tell me certainly which rom type it is? I cannot find any contacts to ask on the RR webpage.
Regards, Jon.
Depends on the ROM but stock Oxygen OS would use FBEv1
How could one determine which FBE version is used by what ROMs?, and I assume this is a type of encryption but can you someone also tell me what the Acronym stands for so i can research this a little further?
From https://source.android.com/docs/security/features/encryption/file-based
Version 2 encryption policies use a more secure and flexible key derivation function. The default is v2 if the device launched on Android 11 or higher (as determined by ro.product.first_api_level), or v1 if the device launched on Android 10 or lower.

Categories

Resources