Hi Renate, I have a similar issue (although with a modification to /data and not to /system)
I have an Onyx Leaf that bootloops after editing /data/system/users/0/settings_system.xml. I am able to enter recovery mode but have no fastboot/adb connection.
I have used both adb and fastboot in the past when applying a magisk patched boot.img (back when I first recieved my device). I used to be big in the XDA/TWRP/Cyanogenmod teams back in 2012 so i'm fairly comfortable with most workflows.
Do you know of a way to get into fastboot mode without having access to an adb shell? I know there is a press power button 5 times combo for recovery, but I don't know of an equivalent for fastboot. Perhaps there is something along the lines of a "USB Jig" cable like back in the old micro-usb days? I attempted to make an "EDL cable" by tying green+black together as found in another thread, but that didn't appear to do anything, perhaps because I am unable to completely shut down the tablet.
Once I have an adb shell I'd hope to mount /data (if encryption permits) and edit the settings_system.xml file. Or if unable to mount, flash a magisk module that can overwrite the file during earlyboot so that the android system can read the new values and not crash.
If you can flash custom update.zip files in the stock recovery, perhaps something like the following updater-script could work
```
getprop("ro.product.device") == "Leaf" || abort("E3004: This package is for \"Leaf\" devices; this is a \"" + getprop("ro.product.device") + "\".");
ui_print("Target: ONYX/Leaf/Leaf:10/2021-12-02_15-24_3.2_a54499c/4177:user/dev-keys");
ui_print("Mounting userdata...");
show_progress(0.100000, 0);
mount("ext4", "EMMC", "/dev/block/userdata", "/data");
ui_print("Copying settings_system.xml");
show_progress(0.250000, 0);
package_extract_file("settings_system.xml", "/data/system/users/0/settings_system.xml");
ui_print("Setting permissions");
show_progress(0.500000, 0);
set_perm(1000, 1000, 0644, "/data/system/users/0/settings_system.xml");
ui_print("Unmounting userdata...");
show_progress(0.750000, 0);
unmount("/data");
set_progress(1.000000);
```
|