Rooting a Google Pixel 6 Pro: An embedded Linux guy’s notes
Introduction
These are my notes to future self on rooting a Google Pixel 6 Pro. For reasons I’ll explain below, there’s a good chance I’ll find interest in this topic every now and then.
Being a Linux guy, who isn’t very fond of smartphones in general, I consider my Android phone a small Linux computer, and as such, I can’t stand the idea of not having full control over it. I own the thing, therefore I should be able to access any data on it.
There are also practical aspects to this, for example to prevent system updates and the ability to obtain the secret key that encrypts WhatsApp data, so the conversations can be properly saved for future access (that is, long after WhatsApp becomes history).
So all I want is “su” at shell prompt to turn me into root. So I can backup the entire thing with a tar command, for example. I couldn’t care less about tweaking the phone.
I should say that even though I definitely have experience with embedded Linux, my knowledge on Android is very limited, and consists of what I chose to know in order to maintain my own phone. Nothing professional, in short.
I’ve also written a similar post on my LG G4, which I eventually didn’t root.
Root your phone early
Or at least, unlock the bootloader early, because it resets the phone completely, including deleting all user data. There’s a bit of sense in doing this, because unlocking the bootloader can be a means to maliciously access the data on the phone. For us plain users, it means that the rooting should be done as part of the initial setup of the phone.
It also means that there’s no going back and forth. So if the phone is unrooted and subsequently locked for the purpose of making some sensitive app happy, there’s no going back to root. At least not without wiping the phone.
This is the place to mention tools like Kingo Root, which essentially break into your phone and root them, so there’s no need to unlock the bootloader and hence no need to wipe the phone. Which is legit (it’s your own phone, after all) but I haven’t tried this method myself. It might and might not work, because this method is based upon using a security exploit. In other words, when this works, it’s only because the phone’s security protection has a loophole.
Overview of rooting
Android 12 is best rooted with Magisk. Previously, SuperSU was popular for this purpose, but as apps become more and more hostile to rooted phones due to security and DRM considerations, it’s also required to hide the fact that the phone has been rooted from these apps. In particular, apps involving payments and access to paid-for content (e.g. Netflix) won’t play ball if the phone appears to have been tampered with. SuperSU is not in the league for this kind of cat-and-mouse game.
Android is designed to never give root access to anything else but its own low-level machinery. suid doesn’t work, and Android also runs with SELinux in enforcing state, which I suppose also prevents privilege escalation.
The intervention is therefore done by Magisk when the Linux kernel boots. The trick is to boot up with an initial RAM disk image that is manipulated to bring up the system in a more permissive state.
Practically, the rooting procedure goes like this:
- Unlock the bootloader. What this means is that the bootloader that is responsible for loading the kernel and ramdisk image (a.k.a. fastboot) also agrees to write images to the boot partitions of the flash, something it normally refuses to do. Unlocking should be done early, because it resets the phone.
- Download (to computer) the boot images for the exact Android build that runs on the phone, and fetch the boot.img image file from it. It contains the Linux kernel and ramdisk for a normal boot (as opposed to e.g. Recovery boot).
- Sideload-install the Magisk app (i.e. install from an .apk file directly) on the phone.
- Feed the Magisk app with the boot.img file, so it creates a manipulated version of it (this runs on the phone itself).
- Boot the phone into fastboot mode and write the manipulated image to the phone’s boot partition. This will only work if the phone is “bootloader unlocked”, of course.
- Install and enable a Magisk module that camouflages the fact that the phone has been unlocked and rooted, to deceive apps into thinking it’s innocent.
- Disable system updates. See below.
A computer with the fastboot utility installed is required.
I’ve mainly followed the official installation guide. There’s also an XDA thread specific for P6P, but it’s quite confusing as it lists all possible rooting options, and to me it first appeared like I had to run through them all.
The beauty of this rooting process is that the only thing that is specific to the phone model is the boot.img, which is downloaded from the vendor’s site. In other words, those developing the rooting tools don’t release files for every single device. Magisk just modifies the existing boot image in a certain way.
For some background on Magisk by its author, look here.
Implications of rooting
Rooting a Pixel 6 Pro doesn’t void its warranty as far as I understand, but there are three main things to keep in mind:
- Because the boot image is replaced with a manipulated one, a system upgrade will mess up things, or at the very least revert the rooting. Android can’t therefore not be allowed to update automatically, as it usually does. Likewise, the regular “System update” feature (under Settings > System) should never be used. More on that below.
- As already mentioned, some apps don’t want to work on a manipulated phone, so there’s an extra layer of fooling those apps into thinking the phone is OK. It’s quite likely that these apps will improve their detection of manipulated phones, and that the countermeasures will keep improving too. So this is probably going to be an eternal Tom and Jerry.
- There will always be a warning that the phone is unlocked every time you boot. No way around this.
Note that there are two aspects of rooting that these sensitive apps don’t like: The fact that the phone is unlocked and hence more susceptible to manipulation, and the fact that the boot image is manipulated. Plus, they may also detect the countermeasures for making the phone look innocent.
There’s a framework called Google SafetyNet, which is the main mechanism that apps are expected to use to detect a manipulated phone. The good news is that it’s easy to check if the phone passes its tests (that is, if our camouflage works), but I will not be surprised if each app will have its own additional tests.
OK, enough with the talky talk. Time for some hands-on.
Unlocking
As one would expect, the phone is locked by default. This means that with the phone in fastboot mode (see below how to invoke it), it says so on the screen, and with the fastboot utility one gets:
$ fastboot flashing get_unlock_ability ... (bootloader) get_unlock_ability: 0 OKAY [ 0.030s] finished. total time: 0.030s $ fastboot flashing unlock ... FAILED (remote: flashing unlock is not allowed) finished. total time: 0.032s
So boot the phone normally. If there is no Developer options item under System, the phone is not in developer mode. For this, go to About Phone. Tap seven times on Build Number. The phone prompts for the PIN number, and then the “You are now a developer” message appears.
Go to the phone’s settings, System > Developer options > OEM unlocking, and enable it (a PIN prompt and scary warning dialog box will appear).
Then back to fastboot mode. It’s time to issue the “flashing unlock: command which resets the phone completely. All user data and settings is lost.
$ fastboot flashing get_unlock_ability ... (bootloader) get_unlock_ability: 1 OKAY [ 0.030s] finished. total time: 0.030s $ fastboot flashing unlock ... OKAY [ 0.032s] finished. total time: 0.032s
Even though the command finished immediately, the unlock occurs only after confirming it on the phone itself, with a scary warning message. And then it says “unlocked” next to the device state on the screen in fastboot mode.
The phone then starts exactly like it did the first time it was powered on. Completely blank.
Plus a warning on every boot that the bootloader is unlocked. Something to get used to, as there’s no remedy for this. Re-locking the phone is out of the question, because unlocking it back will wipe it again.
Sideload install of Magisk app
Download the latest version (v24.3 in my case) from here. Copy Magisk-v24.3.apk into some reachable directory on the phone (File Transfer, connected via USB, or any other method).
Then open Files on the phone, and navigate to the Download folder. Tap the .ask file, but alas, the phone refuses to “install unknown apps”. But hey, there’s a “Settings” option on the popup. So enable “Allow from this source”, and that’s it.
Patch the boot image
The original Android images can be downloaded from Google’s official page. So I picked the raven-xxx-factory-whatever.zip file that matched my build (find the exact build number in About Phone in the Settings).
Fetch the boot.img from the zip file inside the zip file, and copy it into the phone to somewhere reachable as well.
Now open the Magisk app, tap the Install button, and pick “Select and Patch a file” (there’s no other option, actually). Navigate to and select boot.img, and tap “let’s go”. The screen turns into a black text mode, some log messages appear, and then it says where it wrote the patched file to.
Copy the patched file to the computer, possibly with USB file transfer.
Note that the boot.img must come from a build that matches the one running on the phone exactly. The truth is that I would expect things to work fairly well even if there was a slight version mismatch, but there’s also a possibility for some unexplained glitches.
Therefore, if you want to upgrade Android, do so by downloading the factory build for the new version, and manipulate the boot.img file in the zip file (actually, it’s in the zip file inside the zip file). And then run the script that comes with that file (if you have the courage).
Invoking fastboot mode
Turn off the phone. Press and hold the volume down button and then the power button, and it’s up in no time.
The nice thing is that other modes can be invoked from the menu that shows up (Rescue and Recovery mode)
Write the image to the boot partition
It’s time to write the image to the phone. This is where there’s a possibility to brick the phone.
That said, boot.img is the kernel and ramdisk, not the initial bootloader (i.e. fastboot). In other words, if this goes wrong, the phone might not boot up, but since the bootloader is still intact, there’s always the possibility to power it up in fastboot mode and update any partition.
So the only partition I would be really reluctant to write to is the bootloader itself. Which isn’t the same as boot.
So “flash boot” sounds scary, but it’s not a dead end if it fails. There’s already a factory image zip file at hand for writing to all relevant partitions, and it has a flash-all.sh file that writes a complete set (including the bootloader, by the way, maybe delete that line from the script).
So let’s do the scary thing (the file name of the image may vary, of course):
$ fastboot flash boot ~/Desktop/magisk_patched-24300_28q74.img target reported max download size of 261095424 bytes sending 'boot_a' (65536 KB)... OKAY [ 0.413s] writing 'boot_a'... OKAY [ 0.100s] finished. total time: 0.513s
As it says, the whole thing took half a second. Reboot. The thing that stands out is that Magisk has a button for uninstallation.
And by the way, it would probably have been fine to write to the recovery partition instead. Possibly as a method to boot the phone with root capabilities occasionally. But that doesn’t calm those sensitive apps, because the phone remains unlocked. And locking it means no way back to unlock without a full wipe.
It works!
Opened a shell via adb, typed “su”. Magisk popped up a prompt on the screen to authorize root privileges, I approved, and that’s it.
Same goes for every other app that requests root privileges. Magisk brings up a popup for authorizing it. So unless there’s a vulnerability in Magisk, there’s no security hole about this.
Making SafetyNet happy
So now when the phone is rooted, it’s time to sweep the dirt under the carpet.
I downloaded SafetyNet Checker, and indeed, it failed on Basic Integrity and CTS Profile Match. The suggestions read “RESTORE_TO_FACTORY_ROM” and “LOCK_BOOTLOADER” so hey, I definitely got caught.
So there’s safetynet-fix. I downloaded v2.2.1 from here, copied safetynet-fix-v2.2.1.zip into the phone.
Then, within the Magisk app on the phone, I selected Modules at the bottom, and picked “Install from Storage”. And picked the same zip file. The screen went to log text on black screen, indicating everything was fine.
And from there, I clicked the Reboot button to the bottom right.
Ah, but that wasn’t enough. After the reboot, I went to Modules again, and it said “Modules suspended because Zygisk in not enabled”. And almost needless to say, the SafetyNet test failed.
So I clicked the Home button to the bottom left of Magisk, then the setting icon to the top right, and enabled Zygisk (Beta). And rebooted again.
This time the SafetyNet test succeeded. Another good sign is that the OEM bootloader unlocking option was back — it disappears when the systems detects that the bootloader is unlocked.
But wait, what is this Zygisk thing? To get an idea, let’s first let’s get acquainted with a standard Android component, the Zygote process: It’s the counterpart of common Linux’ init process, in the sense that it’s the father of all processes in the system. Likewise, all processes in the Dalvik VM are the children of the Zygote process. Every new process forks from this one.
Zygisk replaces this process. As I’m not familiar with Android internals, I don’t know what tricks Zygisk pulls, but it’s a common trick in Linux to hijack calls to libraries when launching a new process. So at least the good old Linux trick is to, for example, hijack all library functions that are related to time, and implement a date crack. I guess they did something similar to feed all apps with fake information about the phone. Odds are that the apps will add checks to bypass those that are fake, and then the fix module will cover up these two. Tom and Jerry.
Update 7.10.22: Suddenly, the app of Israeli Post’s authority requested an update, and after the update it refused to run, because it won’t run on a “compromised device” (screenshot of the popup below). I upgraded safetynet-fix to 2.3.1 (latest). Safetynet was happy even before that upgrade, and surely after it, but Israeli Post will still not play ball:
System updates
By default, Android updates itself every now and then by virtue of OTA (Over The Air) updates, which essentially means that the phone downloads a zip file that contains images that are written to several partitions on the flash, the boot partition included (and the fastboot partition too, actually). So if such update is allowed to take place normally, the manipulated boot.img is simply not used anymore, and the phone reboots unrooted. It will still be possible to repeat the root procedure to re-root the phone, as it remains unlocked.
So these automatic updates must be disabled so the phone doesn’t lose its root capabilities all of the sudden. It’s possible to perform manual updates, either by applying a manipulated zip file and write it to the partitions in fastboot mode, or with the method described here and here.
Personally, I’m a very little fan of upgrading things all the time, so odds are that I would have turned off System Upgrade anyhow. I mean, you restart your phone for whatever reason, and poof, something stops working because bug fix X caused a new bug Y. But don’t worry, it will be fixed in the next update, and then there will be bug Z. Regardless of rooting. And I know, security updates and all that. It boils down to either risking getting knocked down by an attack on your phone or by a software update. I would say the latter is much more likely. As for privacy, well, that’s gone long ago, and mainly due to what the phone does per design.
On Android 12, turning off system updates is a bit like turning down a nagging salesman. These are the things I did, and I’m not sure all of them were necessary:
- Under Developer Options (which are enabled for unlocking anyhow). Turn off “Automatic system updates”.
- Go to Settings > Notifications > App Notifications > Google Play Settings and turn off System Update (to silence the “System update paused” notification).
- Go to the Settings > Apps > Google Play Services > Storage and Cache > Clear cache. Possibly also tap “Manage space” > “clear all data”. Not sure either of these two were necessary.
- Disable a few Activities in Android’s guts, as described in this other post of mine. This is the trickiest part, and requires adb.
And from now on, avoid System > System Update (like, why insist?).
Disabling Acitivities is the hardest part to perform, but if you don’t do this, you’ll get popups like this, which evenutally escalating to the phone telling you it’s going to update itself whether you like it or not:
The hot/cold system images for updates
And in case an update is done deliberately: Pixel 6 Pro does System Update with an A/B setting. That means that there’s an “active slot”, A or B, that the phone boots from, and an “inactive slot”, which the updating utilities are free to write to. So the updating process consists of writing the downloaded images into the inactive slot, and then turn the inactive slot into the active one. The existence of A/B partitions is evident by listing the block devices by name:
raven:/ # ls /dev/block/by-name/ abl_a dpm_a gsa_b pbl_b userdata abl_b dpm_b klog persist vbmeta_a bl1_a dram_train_a ldfw_a pvmfw_a vbmeta_b bl1_b dram_train_b ldfw_b pvmfw_b vbmeta_system_a bl2_a dtbo_a metadata sda vbmeta_system_b bl2_b dtbo_b mfg_data sdb vbmeta_vendor_a bl31_a efs misc sdc vbmeta_vendor_b bl31_b efs_backup modem_a sdd vendor_boot_a boot_a fips modem_b super vendor_boot_b boot_b frp modem_userdata tzsw_a devinfo gsa_a pbl_a tzsw_b
So when A is active, it means that the bootloader uses the *_a partitions, and same goes with B.
I haven’t done any update on my phone yet, so I can’t say anything from personal experience. But in the end, it seems like if a System Update occurs accidentally, it’s not a big deal — the phone will probably start just fine, only with an updated version of Android and without root. So it’s just a matter of going through the rooting process again.
Or better still, if the update is made in a controlled manner, Magisk can manipulate the boot_a or boot_b partition — the one that inactive at that moment — after the regular OTA update, and hence make the device remain rooted when it reboots. That’s why the instructions for this process tell you not to reboot the phone after performing an OTA update.
To drop the resumption notification, possibly remove the already downloaded stuff from the Download/ directory. Apparently, Google Play is taking care of that.
That’s it
For the sake of rooting the phone, there’s no point reading further. Everything that follows is some more or less related information, but nothing necessary to complete the task.
Boot modes
This is kind-of related: The phone has several boot modes, so here’s a brief list of those I know about, along with their Vendor / Product IDs.
- Regular MTP mode. With no data transfer it’s 18d1:4ee7, in File Transfer mode it’s 18d1:4ee2, in tethering (Internet access share) it’s 18d1:4eec, MIDI mode 18d1:4ee9 and in PTP it’s 18d1:4ee6.
- Rescue mode: 18d1:d001
- Fastboot mode, 18d1:4ee0
- Recovery mode, 18d1:4ee0
Fastboot mode
This is like U-boot on embedded Linux (and maybe it’s actually that, I haven’t checked). So it’s the first thing that is loaded from the flash memory. So the point is that as long as Fastboot works and the phone is unlocked, the phone isn’t really bricked even if it doesn’t boot, because everything can be fixed. If Fastboot doesn’t come up, get some mortar.
Recovery mode
Press and hold the the power button, and press the volume up button briefly. The flipped robot image appears.
Going to fastboot mode from there enables fastbootd, which appears to talk with the PC with a partial version of the fastboot protocol.
It’s also possible to view the recovery log (as /tmp/recovery.log) but it’s not clear what it helps for.
Getting out of this mode — I guess there are ways for that, maybe through fastbootd? So far I just waited long enough.
Rescue mode
In rescue mode, the phone presents itself as a host:
$ adb devices List of devices attached 12345FDEE000S9 host
Not sure what that means, actually. Is it really a USB host? If so, how did adb manage to query it?
The screen shows the flipped robot and “No command”, just like Recovery Mode.
But if you press the power and volume up in this mode, it says “waiting for rescue commands…”.
Now try to get out of that. Rumor has it that pressing the power button for 20 seconds will do the trick. Or just wait long enough. Alternatively, connect to the computer with the USB plug and go
$ adb reboot
There’s also this page discussing Rescue Mode. My best guess is that this mode is intended to allow writing to flash partitions without unlocking the phone, or else how can authorized personnel can fix a phone with a messed up boot chain without taking it apart? So this could be the key to rooting the phone without unlocking it. Maybe.
Mounts
Checking the mounts of a Linux system is one of the first things I do when I begin exploring a system. It turns out even more interesting in the context of rooting.
These are the mounts before rooting the phone with Magisk. That’s one heck of a list on this machine even at this state:
$ df -h Filesystem Size Used Avail Use% Mounted on /dev/block/dm-6 838M 836M 0 100% / tmpfs 5.6G 1.2M 5.6G 1% /dev tmpfs 5.6G 0 5.6G 0% /mnt /dev/block/dm-7 237M 236M 0 100% /system_ext /dev/block/dm-8 2.5G 2.5G 0 100% /product /dev/block/dm-9 455M 454M 0 100% /vendor /dev/block/dm-10 52M 52M 0 100% /vendor_dlkm tmpfs 5.6G 52K 5.6G 1% /apex /dev/block/loop4 35M 35M 0 100% /apex/com.android.i18n@1 /dev/block/loop7 232K 24K 204K 11% /apex/com.android.telephony@1 /dev/block/dm-13 732K 704K 16K 98% /apex/com.android.ipsec@311612010 /dev/block/dm-12 2.7M 2.7M 0 100% /apex/com.android.tethering@311616020 /dev/block/loop10 7.5M 7.5M 0 100% /apex/com.android.runtime@1 /dev/block/dm-14 18M 18M 0 100% /apex/com.android.media.swcodec@311610000 /dev/block/loop11 1.6M 1.6M 0 100% /apex/com.google.mainline.primary.libs@311020000 /dev/block/dm-15 6.8M 6.7M 0 100% /apex/com.android.adbd@311611002 /dev/block/loop13 2.0M 1.9M 0 100% /apex/com.android.appsearch@300000000 /dev/block/loop14 232K 88K 140K 39% /apex/com.android.apex.cts.shim@1 /dev/block/dm-16 1.6M 1.6M 0 100% /apex/com.google.mainline.primary.libs@311626000 /dev/block/dm-18 832K 804K 12K 99% /apex/com.android.tzdata@311311000 /dev/block/dm-17 232K 152K 76K 67% /apex/com.android.scheduling@310733000 /dev/block/loop20 40M 40M 0 100% /apex/com.android.vndk.v31@1 /dev/block/dm-19 4.8M 4.7M 0 100% /apex/com.android.conscrypt@310911000 /dev/block/dm-20 6.0M 6.0M 0 100% /apex/com.android.extservices@311610040 /dev/block/dm-21 62M 62M 0 100% /apex/com.android.art@311510000 /dev/block/dm-23 7.8M 7.7M 0 100% /apex/com.android.neuralnetworks@311610000 /dev/block/dm-22 13M 13M 0 100% /apex/com.android.permission@311611030 /dev/block/dm-24 12M 12M 0 100% /apex/com.android.cellbroadcast@311612020 /dev/block/loop27 256M 134M 117M 54% /apex/com.google.pixel.camera.hal@208030436 /dev/block/dm-25 6.3M 6.3M 0 100% /apex/com.android.media@311610000 /dev/block/dm-26 8.3M 8.3M 0 100% /apex/com.android.mediaprovider@311616020 /dev/block/dm-27 1.8M 1.7M 0 100% /apex/com.android.os.statsd@311510000 /dev/block/dm-28 3.7M 3.7M 0 100% /apex/com.android.resolv@311610020 /dev/block/dm-29 5.5M 5.5M 0 100% /apex/com.android.wifi@311612010 /dev/block/dm-30 704K 676K 16K 98% /apex/com.android.sdkext@311511000 /dev/fuse 110G 14G 97G 13% /storage/emulated
and mounts:
$ mount /dev/block/dm-6 on / type ext4 (ro,seclabel,relatime) tmpfs on /dev type tmpfs (rw,seclabel,nosuid,relatime,mode=755) devpts on /dev/pts type devpts (rw,seclabel,relatime,mode=600,ptmxmode=000) none on /dev/blkio type cgroup (rw,nosuid,nodev,noexec,relatime,blkio) none on /dev/cpuctl type cgroup (rw,nosuid,nodev,noexec,relatime,cpu) none on /dev/cpuset type cgroup (rw,nosuid,nodev,noexec,relatime,cpuset,noprefix,release_agent=/sbin/cpuset_release_agent) binder on /dev/binderfs type binder (rw,relatime,max=1048576,stats=global) adb on /dev/usb-ffs/adb type functionfs (rw,relatime) mtp on /dev/usb-ffs/mtp type functionfs (rw,relatime) ptp on /dev/usb-ffs/ptp type functionfs (rw,relatime) proc on /proc type proc (rw,relatime,gid=3009,hidepid=invisible) sysfs on /sys type sysfs (rw,seclabel,relatime) selinuxfs on /sys/fs/selinux type selinuxfs (rw,relatime) none on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime) tracefs on /sys/kernel/tracing type tracefs (rw,seclabel,relatime) none on /sys/fs/fuse/connections type fusectl (rw,relatime) none on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,relatime) pstore on /sys/fs/pstore type pstore (rw,seclabel,nosuid,nodev,noexec,relatime) tmpfs on /mnt type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,mode=755,gid=1000) tmpfs on /mnt/installer type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,mode=755,gid=1000) /dev/fuse on /mnt/installer/0/emulated type fuse (rw,lazytime,nosuid,nodev,noexec,noatime,user_id=0,group_id=0,allow_other) /dev/block/dm-11 on /mnt/installer/0/emulated/0/Android/data type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/dm-11 on /mnt/installer/0/emulated/0/Android/obb type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) tmpfs on /mnt/androidwritable type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,mode=755,gid=1000) /dev/fuse on /mnt/androidwritable/0/emulated type fuse (rw,lazytime,nosuid,nodev,noexec,noatime,user_id=0,group_id=0,allow_other) /dev/block/dm-11 on /mnt/androidwritable/0/emulated/0/Android/data type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/dm-11 on /mnt/androidwritable/0/emulated/0/Android/obb type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/platform/14700000.ufs/by-name/persist on /mnt/vendor/persist type ext4 (rw,seclabel,nosuid,nodev,noatime,nodioread_nolock,nodelalloc,commit=1,data=journal) /dev/block/platform/14700000.ufs/by-name/efs on /mnt/vendor/efs type ext4 (rw,seclabel,noatime) /dev/block/platform/14700000.ufs/by-name/efs_backup on /mnt/vendor/efs_backup type ext4 (rw,seclabel,noatime) /dev/block/platform/14700000.ufs/by-name/modem_userdata on /mnt/vendor/modem_userdata type ext4 (rw,seclabel,noatime) /dev/block/platform/14700000.ufs/by-name/modem_a on /mnt/vendor/modem_img type ext4 (ro,context=u:object_r:modem_img_file:s0,relatime) /dev/fuse on /mnt/user/0/emulated type fuse (rw,lazytime,nosuid,nodev,noexec,noatime,user_id=0,group_id=0,allow_other) /dev/block/dm-11 on /mnt/user/0/emulated/0/Android/data type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/dm-11 on /mnt/user/0/emulated/0/Android/obb type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/dm-11 on /mnt/pass_through/0/emulated type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/platform/14700000.ufs/by-name/metadata on /metadata type ext4 (rw,seclabel,nosuid,nodev,noatime,nodioread_nolock,nodelalloc,commit=1,data=journal) /dev/block/dm-7 on /system_ext type ext4 (ro,seclabel,relatime) /dev/block/dm-8 on /product type ext4 (ro,seclabel,relatime) /dev/block/dm-9 on /vendor type ext4 (ro,seclabel,relatime) /dev/block/dm-10 on /vendor_dlkm type ext4 (ro,seclabel,relatime) tmpfs on /apex type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,mode=755) /dev/block/loop4 on /apex/com.android.i18n@1 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop4 on /apex/com.android.i18n type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop7 on /apex/com.android.telephony@1 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop7 on /apex/com.android.telephony type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-13 on /apex/com.android.ipsec@311612010 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-13 on /apex/com.android.ipsec type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-12 on /apex/com.android.tethering@311616020 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop10 on /apex/com.android.runtime@1 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-12 on /apex/com.android.tethering type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop10 on /apex/com.android.runtime type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-14 on /apex/com.android.media.swcodec@311610000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-14 on /apex/com.android.media.swcodec type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop11 on /apex/com.google.mainline.primary.libs@311020000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-15 on /apex/com.android.adbd@311611002 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-15 on /apex/com.android.adbd type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop13 on /apex/com.android.appsearch@300000000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop13 on /apex/com.android.appsearch type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop14 on /apex/com.android.apex.cts.shim@1 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop14 on /apex/com.android.apex.cts.shim type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-16 on /apex/com.google.mainline.primary.libs@311626000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-18 on /apex/com.android.tzdata@311311000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-17 on /apex/com.android.scheduling@310733000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-17 on /apex/com.android.scheduling type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-18 on /apex/com.android.tzdata type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop20 on /apex/com.android.vndk.v31@1 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-19 on /apex/com.android.conscrypt@310911000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop20 on /apex/com.android.vndk.v31 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-19 on /apex/com.android.conscrypt type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-20 on /apex/com.android.extservices@311610040 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-20 on /apex/com.android.extservices type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-21 on /apex/com.android.art@311510000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-21 on /apex/com.android.art type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-23 on /apex/com.android.neuralnetworks@311610000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-22 on /apex/com.android.permission@311611030 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-23 on /apex/com.android.neuralnetworks type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-22 on /apex/com.android.permission type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-24 on /apex/com.android.cellbroadcast@311612020 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-24 on /apex/com.android.cellbroadcast type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop27 on /apex/com.google.pixel.camera.hal@208030436 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop27 on /apex/com.google.pixel.camera.hal type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-25 on /apex/com.android.media@311610000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-25 on /apex/com.android.media type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-26 on /apex/com.android.mediaprovider@311616020 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-27 on /apex/com.android.os.statsd@311510000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-27 on /apex/com.android.os.statsd type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-26 on /apex/com.android.mediaprovider type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-28 on /apex/com.android.resolv@311610020 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-28 on /apex/com.android.resolv type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-29 on /apex/com.android.wifi@311612010 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-29 on /apex/com.android.wifi type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-30 on /apex/com.android.sdkext@311511000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-30 on /apex/com.android.sdkext type ext4 (ro,dirsync,seclabel,nodev,noatime) tmpfs on /apex/apex-info-list.xml type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,mode=755) tmpfs on /linkerconfig type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,mode=755) tmpfs on /linkerconfig type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,mode=755) none on /config type configfs (rw,nosuid,nodev,noexec,relatime) /dev/block/dm-11 on /data type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/dm-11 on /data/user/0 type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) tmpfs on /data_mirror type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,mode=700,gid=1000) /dev/block/dm-11 on /data_mirror/data_ce/null type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/dm-11 on /data_mirror/data_ce/null/0 type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/dm-11 on /data_mirror/data_de/null type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/dm-11 on /data_mirror/cur_profiles type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/dm-11 on /data_mirror/ref_profiles type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) tmpfs on /storage type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,mode=755,gid=1000) /dev/fuse on /storage/emulated type fuse (rw,lazytime,nosuid,nodev,noexec,noatime,user_id=0,group_id=0,allow_other) /dev/block/dm-11 on /storage/emulated/0/Android/data type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/dm-11 on /storage/emulated/0/Android/obb type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc)
Most notable are /dev/fuse on /mnt/androidwritable/0/emulated. Like, really? All file access goes through FUSE? Anyhow, the user visible data root is at /storage/emulated/0/, as usual.
Also interesting is how adb, mtp and ptp are mounted as /dev/usb-ffs/* as functionfs. So this is how the phone behaves as a USB gadget.
Mounts after rooting
This wouldn’t normally be so interesting, but it so happens that Magisk plays a lot with mount games. So here’s the df -h, as a regular user on a rooted phone:
Filesystem Size Used Avail Use% Mounted on /dev/block/dm-0 838M 836M 0 100% / tmpfs 5.6G 1.2M 5.6G 1% /dev tmpfs 5.6G 5.3M 5.6G 1% /dev/PNsr9c tmpfs 5.6G 0 5.6G 0% /mnt /dev/block/dm-2 237M 236M 0 100% /system_ext /dev/block/dm-3 2.5G 2.5G 0 100% /product /dev/block/dm-4 455M 454M 0 100% /vendor /dev/block/dm-5 52M 52M 0 100% /vendor_dlkm tmpfs 5.6G 28K 5.6G 1% /apex /dev/block/dm-6 110G 9.1G 101G 9% /data /dev/block/loop4 2.6M 2.6M 0 100% /apex/com.android.tethering@311011010 /dev/block/loop5 35M 35M 0 100% /apex/com.android.i18n@1 /dev/block/loop6 232K 24K 204K 11% /apex/com.android.telephony@1 /dev/block/loop7 696K 668K 16K 98% /apex/com.android.ipsec@311010000 /dev/block/loop8 18M 18M 0 100% /apex/com.android.media.swcodec@311015000 /dev/block/loop10 7.5M 7.5M 0 100% /apex/com.android.runtime@1 /dev/block/loop9 6.7M 6.7M 0 100% /apex/com.android.adbd@310852002 /dev/block/loop12 2.0M 1.9M 0 100% /apex/com.android.appsearch@300000000 /dev/block/loop11 1.6M 1.6M 0 100% /apex/com.google.mainline.primary.libs@311020000 /dev/block/loop13 232K 88K 140K 39% /apex/com.android.apex.cts.shim@1 /dev/block/loop15 832K 804K 12K 99% /apex/com.android.tzdata@310733000 /dev/block/loop14 232K 152K 76K 67% /apex/com.android.scheduling@310733000 /dev/block/loop16 4.8M 4.7M 0 100% /apex/com.android.conscrypt@310911000 /dev/block/loop18 60M 60M 0 100% /apex/com.android.art@310924000 /dev/block/loop19 40M 40M 0 100% /apex/com.android.vndk.v31@1 /dev/block/loop20 18M 18M 0 100% /apex/com.android.permission@311014000 /dev/block/loop17 5.8M 5.8M 0 100% /apex/com.android.extservices@310852000 /dev/block/loop23 10M 10M 0 100% /apex/com.android.cellbroadcast@311010000 /dev/block/loop21 7.6M 7.6M 0 100% /apex/com.android.neuralnetworks@310850000 /dev/block/loop24 1.8M 1.7M 0 100% /apex/com.android.os.statsd@311012000 /dev/block/loop22 6.3M 6.2M 0 100% /apex/com.android.media@311012000 /dev/block/loop25 4.2M 4.2M 0 100% /apex/com.android.mediaprovider@311012020 /dev/block/loop26 256M 134M 117M 54% /apex/com.google.pixel.camera.hal@208030436 /dev/block/loop27 3.6M 3.6M 0 100% /apex/com.android.resolv@311011010 /dev/block/loop28 5.6M 5.5M 0 100% /apex/com.android.wifi@311011000 /dev/block/loop29 692K 664K 16K 98% /apex/com.android.sdkext@310912000 tmpfs 5.6G 0 5.6G 0% /system/bin /dev/fuse 110G 9.1G 101G 9% /storage/emulated
So it’s more or less like before rooting, but with a couple of clues on what’s happening: There’s some odd tmpfs mounted as /dev/PNsr9c, and /system/bin is a tmpfs as well. Hmmm. That’s suspicious.
The same df -h command as root reveals a lot of /dev/block/loopNN mounts at /apex/*. They are all 99-100%, as they aren’t really storage. I’ll skip the output of that, because they’re all listed in the regular mount.
Which reads like this after rooting. Hold tight:
/dev/block/dm-0 on / type ext4 (ro,seclabel,relatime) tmpfs on /dev type tmpfs (rw,seclabel,nosuid,relatime,mode=755) devpts on /dev/pts type devpts (rw,seclabel,relatime,mode=600,ptmxmode=000) tmpfs on /dev/PNsr9c type tmpfs (rw,seclabel,relatime,mode=755) proc on /proc type proc (rw,relatime,gid=3009,hidepid=invisible) sysfs on /sys type sysfs (rw,seclabel,relatime) selinuxfs on /sys/fs/selinux type selinuxfs (rw,relatime) tmpfs on /mnt type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,mode=755,gid=1000) tmpfs on /mnt/installer type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,mode=755,gid=1000) tmpfs on /mnt/androidwritable type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,mode=755,gid=1000) /dev/block/sda8 on /metadata type ext4 (rw,seclabel,nosuid,nodev,noatime,nodioread_nolock,nodelalloc,commit=1,data=journal) /dev/block/dm-2 on /system_ext type ext4 (ro,seclabel,relatime) /dev/block/dm-3 on /product type ext4 (ro,seclabel,relatime) /dev/block/dm-4 on /vendor type ext4 (ro,seclabel,relatime) /dev/block/dm-5 on /vendor_dlkm type ext4 (ro,seclabel,relatime) tmpfs on /apex type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,mode=755) tmpfs on /linkerconfig type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,mode=755) none on /dev/blkio type cgroup (rw,nosuid,nodev,noexec,relatime,blkio) none on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime) none on /dev/cpuctl type cgroup (rw,nosuid,nodev,noexec,relatime,cpu) none on /dev/cpuset type cgroup (rw,nosuid,nodev,noexec,relatime,cpuset,noprefix,release_agent=/sbin/cpuset_release_agent) tracefs on /sys/kernel/tracing type tracefs (rw,seclabel,relatime) /dev/block/sda1 on /mnt/vendor/persist type ext4 (rw,seclabel,nosuid,nodev,noatime,nodioread_nolock,nodelalloc,commit=1,data=journal) none on /config type configfs (rw,nosuid,nodev,noexec,relatime) binder on /dev/binderfs type binder (rw,relatime,max=1048576,stats=global) none on /sys/fs/fuse/connections type fusectl (rw,relatime) none on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,relatime) pstore on /sys/fs/pstore type pstore (rw,seclabel,nosuid,nodev,noexec,relatime) /dev/block/sda5 on /mnt/vendor/efs type ext4 (rw,seclabel,noatime) /dev/block/sda6 on /mnt/vendor/efs_backup type ext4 (rw,seclabel,noatime) /dev/block/sda7 on /mnt/vendor/modem_userdata type ext4 (rw,seclabel,noatime) /dev/block/sda12 on /mnt/vendor/modem_img type ext4 (ro,context=u:object_r:modem_img_file:s0,relatime) tmpfs on /storage type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,mode=755,gid=1000) /dev/block/dm-6 on /data type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) tmpfs on /linkerconfig type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,mode=755) /dev/block/loop4 on /apex/com.android.tethering@311011010 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop5 on /apex/com.android.i18n@1 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop5 on /apex/com.android.i18n type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop4 on /apex/com.android.tethering type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop6 on /apex/com.android.telephony@1 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop6 on /apex/com.android.telephony type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop7 on /apex/com.android.ipsec@311010000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop7 on /apex/com.android.ipsec type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop8 on /apex/com.android.media.swcodec@311015000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop8 on /apex/com.android.media.swcodec type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop10 on /apex/com.android.runtime@1 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop10 on /apex/com.android.runtime type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop9 on /apex/com.android.adbd@310852002 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop9 on /apex/com.android.adbd type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop12 on /apex/com.android.appsearch@300000000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop11 on /apex/com.google.mainline.primary.libs@311020000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop12 on /apex/com.android.appsearch type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop13 on /apex/com.android.apex.cts.shim@1 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop13 on /apex/com.android.apex.cts.shim type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop15 on /apex/com.android.tzdata@310733000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop15 on /apex/com.android.tzdata type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop14 on /apex/com.android.scheduling@310733000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/dm-6 on /data/user/0 type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) tmpfs on /data_mirror type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,mode=700,gid=1000) /dev/block/dm-6 on /data_mirror/data_ce/null type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/dm-6 on /data_mirror/data_ce/null/0 type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/dm-6 on /data_mirror/data_de/null type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/dm-6 on /data_mirror/cur_profiles type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/dm-6 on /data_mirror/ref_profiles type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/loop14 on /apex/com.android.scheduling type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop16 on /apex/com.android.conscrypt@310911000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop16 on /apex/com.android.conscrypt type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop18 on /apex/com.android.art@310924000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop19 on /apex/com.android.vndk.v31@1 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop18 on /apex/com.android.art type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop20 on /apex/com.android.permission@311014000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop19 on /apex/com.android.vndk.v31 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop20 on /apex/com.android.permission type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop17 on /apex/com.android.extservices@310852000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop17 on /apex/com.android.extservices type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop23 on /apex/com.android.cellbroadcast@311010000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop21 on /apex/com.android.neuralnetworks@310850000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop21 on /apex/com.android.neuralnetworks type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop23 on /apex/com.android.cellbroadcast type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop24 on /apex/com.android.os.statsd@311012000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop24 on /apex/com.android.os.statsd type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop22 on /apex/com.android.media@311012000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop25 on /apex/com.android.mediaprovider@311012020 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop22 on /apex/com.android.media type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop25 on /apex/com.android.mediaprovider type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop26 on /apex/com.google.pixel.camera.hal@208030436 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop27 on /apex/com.android.resolv@311011010 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop26 on /apex/com.google.pixel.camera.hal type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop27 on /apex/com.android.resolv type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop28 on /apex/com.android.wifi@311011000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop28 on /apex/com.android.wifi type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop29 on /apex/com.android.sdkext@310912000 type ext4 (ro,dirsync,seclabel,nodev,noatime) /dev/block/loop29 on /apex/com.android.sdkext type ext4 (ro,dirsync,seclabel,nodev,noatime) tmpfs on /apex/apex-info-list.xml type tmpfs (rw,seclabel,nosuid,nodev,noexec,relatime,mode=755) devpts on /dev/PNsr9c/.magisk/pts type devpts (rw,seclabel,nosuid,noexec,relatime,mode=600,ptmxmode=000) /dev/PNsr9c/.magisk/block/system_ext on /dev/PNsr9c/.magisk/mirror/system_ext type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/product on /dev/PNsr9c/.magisk/mirror/product type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/vendor on /dev/PNsr9c/.magisk/mirror/vendor type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/data on /dev/PNsr9c/.magisk/mirror/data type f2fs (rw,lazytime,seclabel,relatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/PNsr9c/.magisk/block/system_root on /dev/PNsr9c/.magisk/mirror/system_root type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/data on /dev/PNsr9c/.magisk/modules type f2fs (rw,lazytime,seclabel,relatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) tmpfs on /system/bin type tmpfs (rw,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/abb type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/abx type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/abx2xml type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/am type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/apexd type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/app_process32 type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/app_process64 type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/appops type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/appwidget type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/atrace type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/audioserver type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/auditctl type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/awk type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/badblocks type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/bc type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/bcc type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/blank_screen type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/blkid type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/bmgr type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/bootanimation type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/bootstat type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/bootstrap type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/boringssl_self_test32 type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/boringssl_self_test64 type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/bpfloader type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/bu type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/bugreport type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/bugreportz type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/bzip2 type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/cameraserver type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/charger type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/clatd type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/cmd type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/content type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/cppreopts.sh type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/credstore type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/debuggerd type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/device_config type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/dmabuf_dump type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/dmctl type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/dnsmasq type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/dpm type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/drmserver type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/dumpstate type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/dumpsys type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/e2freefrag type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/e2fsck type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/e2fsdroid type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/flags_health_check type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/fsck.f2fs type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/fsck_msdos type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/fsverity_init type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/gatekeeperd type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/gpuservice type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/gsi_tool type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/gsid type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/heapprofd type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/hid type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/hw type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/hwservicemanager type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/idmap2 type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/idmap2d type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/ime type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/incident type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/incident-helper-cmd type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/incident_helper type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/incidentd type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/init type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/input type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/installd type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/iorap.cmd.compiler type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/iorap.cmd.maintenance type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/iorap.inode2filename type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/iorap.prefetcherd type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/iorapd type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/ip type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/iptables type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/keystore2 type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/keystore_cli_v2 type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/ld.mc type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/ldd type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/librank type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/llkd type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/lmkd type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/locksettings type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/logcat type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/logd type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/logwrapper type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/lpdump type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/lpdumpd type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/lshal type ext4 (ro,seclabel,relatime) tmpfs on /system/bin/magisk type tmpfs (rw,seclabel,relatime,mode=755) tmpfs on /system/bin/magiskinit type tmpfs (rw,seclabel,relatime,mode=755) /dev/PNsr9c/.magisk/block/system_root on /system/bin/make_f2fs type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/mdnsd type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/mediaextractor type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/mediametrics type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/mediaserver type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/migrate_legacy_obb_data.sh type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/mini-keyctl type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/mke2fs type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/mm_events type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/monkey type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/mtpd type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/ndc type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/netd type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/netutils-wrapper-1.0 type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/newfs_msdos type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/odsign type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/otapreopt type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/otapreopt_chroot type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/otapreopt_script type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/otapreopt_slot type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/perfetto type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/ping type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/ping6 type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/pm type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/pppd type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/preloads_copy.sh type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/preopt2cachename type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/procrank type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/racoon type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/reboot type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/recovery-persist type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/recovery-refresh type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/requestsync type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/resize2fs type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/rss_hwm_reset type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/run-as type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/schedtest type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/screencap type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/screenrecord type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/sdcard type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/secdiscard type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/secilc type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/sensorservice type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/service type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/servicemanager type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/set-verity-state type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/settings type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/sgdisk type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/sh type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/showmap type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/simpleperf type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/simpleperf_app_runner type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/sload_f2fs type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/sm type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/snapshotctl type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/snapuserd type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/ss type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/storaged type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/surfaceflinger type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/svc type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/tc type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/tcpdump type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/telecom type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/tombstoned type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/toolbox type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/toybox type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/traced type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/traced_perf type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/traced_probes type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/trigger_perfetto type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/tune2fs type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/tzdatacheck type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/uiautomator type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/uinput type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/uncrypt type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/update_engine type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/update_verifier type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/usbd type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/vdc type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/viewcompiler type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/vold type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/vold_prepare_subdirs type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/vr type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/wait_for_keymaster type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/watchdogd type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/wificond type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/wm type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/xml2abx type ext4 (ro,seclabel,relatime) /dev/PNsr9c/.magisk/block/system_root on /system/bin/ziptool type ext4 (ro,seclabel,relatime) tmpfs on /system/bin/app_process32 type tmpfs (rw,seclabel,relatime,mode=755) tmpfs on /dev/PNsr9c/.magisk/mirror/system_root/system/bin/app_process32 type tmpfs (rw,seclabel,relatime,mode=755) tmpfs on /system/bin/app_process64 type tmpfs (rw,seclabel,relatime,mode=755) tmpfs on /dev/PNsr9c/.magisk/mirror/system_root/system/bin/app_process64 type tmpfs (rw,seclabel,relatime,mode=755) adb on /dev/usb-ffs/adb type functionfs (rw,relatime) mtp on /dev/usb-ffs/mtp type functionfs (rw,relatime) ptp on /dev/usb-ffs/ptp type functionfs (rw,relatime) /dev/fuse on /mnt/installer/0/emulated type fuse (rw,lazytime,nosuid,nodev,noexec,noatime,user_id=0,group_id=0,allow_other) /dev/fuse on /mnt/androidwritable/0/emulated type fuse (rw,lazytime,nosuid,nodev,noexec,noatime,user_id=0,group_id=0,allow_other) /dev/fuse on /mnt/user/0/emulated type fuse (rw,lazytime,nosuid,nodev,noexec,noatime,user_id=0,group_id=0,allow_other) /dev/fuse on /storage/emulated type fuse (rw,lazytime,nosuid,nodev,noexec,noatime,user_id=0,group_id=0,allow_other) /dev/block/dm-6 on /mnt/pass_through/0/emulated type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/dm-6 on /mnt/androidwritable/0/emulated/0/Android/data type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/dm-6 on /mnt/installer/0/emulated/0/Android/data type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/dm-6 on /mnt/user/0/emulated/0/Android/data type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/dm-6 on /storage/emulated/0/Android/data type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/dm-6 on /mnt/androidwritable/0/emulated/0/Android/obb type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/dm-6 on /mnt/installer/0/emulated/0/Android/obb type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/dm-6 on /mnt/user/0/emulated/0/Android/obb type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc) /dev/block/dm-6 on /storage/emulated/0/Android/obb type f2fs (rw,lazytime,seclabel,nosuid,nodev,noatime,background_gc=on,discard,no_heap,user_xattr,inline_xattr,acl,inline_data,inline_dentry,flush_merge,extent_cache,mode=adaptive,active_logs=6,reserve_root=32768,resuid=0,resgid=1065,inlinecrypt,alloc_mode=default,checkpoint_merge,fsync_mode=nobarrier,compress_algorithm=lz4,compress_log_size=2,compress_extension=apk,compress_extension=apex,compress_extension=so,compress_mode=fs,atgc)
The thing that stands out in this mount list is that individual files under /system/bin are mounted, one by one, from /dev/PNsr9c/.magisk/block/system_root, which is clearly a hack for rooting. When they say that Magisk is “just a layer”, I guess they refer to these mounts that override the original files without changing the original filesystem. It’s also often said that Magisk “doesn’t change system”, so once again, it doesn’t change it, but overrides some files by virtue of tons of mounts.
This is time to mention that on my own phone “overlay” is listed in /proc/filesystems, so apparently that would be the more elegant solution to overriding a lot of files. That would allow having a single mount over /system/bin and let it selectively override some of the files. Once again, without touching the original.
Reader Comments
Hi Eli, Thank you for compiling all of this information in a readable, understandable, and ultimately executable way. Your notes made rooting my new phone a breeze, and I learned some things along the way. Here’s to continuing to control the devices we purchase with our own money!
Thanks, Duncan F
Thank you very much for the explanations and the detail!