04-04-2016 02:31 PM - edited 04-04-2016 02:32 PM
This tool was created for the nexus 9 by @gladiac to get rid of the ForceEncrypt flag in a generic way (meaning it should work no matter what rom you are on). It does that by patching the currently installed boot.img.
This is a better implementation then having to manually patch every boot.img especially once custom aosp roms come along because cyanogenmod will have force encrypt enabled just like the nexus's. It also makes it easy to patch ota boot.img's by yourself.
The Android CDD (Compatibility Definition Document) suggests that all devices SHOULD enable full disk-encryption (FDE) by default. Even though I support every step towards more security I have to criticize this approach. FDE comes at a price. Encryption takes time because some component has to de- and encrypt the stuff on the disk at some point and in the case of the nexus 9 (aka flounder) it's the CPU's task. Even though the nexus 9's CPU has 2 pretty fast cores you can still easily feel the difference between FDE in the on- or off-state. The I/O is faster and boot-times take only half as long. (I did not do any measurements)
There is an old discussion about this topic in cyanogenmod's gerrit. Although it's a fun read it is pretty clear that this exchange of views is not going anywhere near a useful outcome.
Because performance is important to me and my tablet does not need the extra security I created the FED-Patcher (ForceEncrypt Disable Patcher)
How does it work?
FED-Patcher is a simple flashable ZIP that is supposed to be run in a recovery that has busybox integrated (like TWRP). This is what it does:
What do I need to make this work?
How do I use it?
How do I know if it worked?
Go into your "Settings"-App. In "Security", if it offers you to encrypt your device it is unencrypted. If it says something like "Device is encrypted" it indeed is encrypted.
IMPORTANT: If you update your ROM you have to run FED-Patcher again because ROM-updates also update the boot-partition which effectively removes my patch. So, if you are on the first ota for example and you used the patch and do an update to a newer nightly you have to run FED-Patcher again. If you don't do so Android will encrypt your device at the first boot.
Is it dangerous?
Well, I implemented tons of checks that prevent pretty much anything bad from happening. But, of course, we're dealing with the boot-partition here. Even though I tested FED-Patcher quite a lot there is still room for crap hitting the fan.
* @gladiac he did all of the work for this i just edited a few things for it to work on the robin Link to his original thread
04-04-2016 03:20 PM
Nice work @deadman96385! Very helpful to many Robins who want a decrypted phone!
04-22-2016 08:23 AM
Question. Would I have to perform this before or after every OTA update? or just once before performing any update.
I'm currently on Robin stock, un-encrypted, unlocked boot and rooted with Xposed. Waiting for the April OTA update before I start the un-rooting/ uninstall xposed process and I'd like to not lose my user partition.