feat(props): adopt resetprop-rs library and defer to ZeroMount

Replaces subprocess-based resetprop/getprop with PropSystem library
API. Adds zeromount detection — when meta-zeromount module is active
and not disabled, overlapping boot/vbmeta props are skipped to avoid
double-spoofing. Fixes 4 pre-existing prop coverage gaps (missing
ro.bootimage.build.tags, ro.boot.verifiedbooterror,
ro.boot.veritymode.managed, ro.is_ever_orange) and aligns
avb_version to 1.3. Expands RECOVERY_PROPS from 3 to 6 entries.

Author: Enginex0

prop.sh

@@ -9,6 +9,13 @@ MODDIR="$MODPATH"
 _PROP_SPOOF_COUNT=0
 _PROP_FAIL_COUNT=0
 
+_ZEROMOUNT_ACTIVE=false
+_zm_dir="/data/adb/modules/meta-zeromount"
+if [ -d "$_zm_dir" ] && [ ! -f "$_zm_dir/disable" ] && [ ! -f "$_zm_dir/remove" ]; then
+    _ZEROMOUNT_ACTIVE=true
+    _log "INFO" "ZeroMount active — deferring overlapping props"
+fi
+
 ensure_prop() {
     NAME=$1
     NEWVAL=$2
@@ -28,34 +35,34 @@ if ! resetprop -w sys.boot_completed 0 2>/dev/null; then
     _log "WARN" "resetprop -w sys.boot_completed timeout or failure"
 fi
 
-# Core boot verification props
-check_reset_prop "ro.boot.vbmeta.device_state" "locked"
-check_reset_prop "ro.boot.verifiedbootstate" "green"
-check_reset_prop "ro.boot.flash.locked" "1"
-check_reset_prop "ro.boot.veritymode" "enforcing"
-check_reset_prop "ro.boot.warranty_bit" "0"
-check_reset_prop "ro.warranty_bit" "0"
-check_reset_prop "ro.debuggable" "0"
-check_reset_prop "ro.force.debuggable" "0"
-check_reset_prop "ro.secure" "1"
-check_reset_prop "ro.adb.secure" "1"
-check_reset_prop "ro.build.type" "user"
-check_reset_prop "ro.build.tags" "release-keys"
-check_reset_prop "ro.vendor.boot.warranty_bit" "0"
-check_reset_prop "ro.vendor.warranty_bit" "0"
-check_reset_prop "vendor.boot.vbmeta.device_state" "locked"
-check_reset_prop "vendor.boot.verifiedbootstate" "green"
-check_reset_prop "sys.oem_unlock_allowed" "0"
-
-# MIUI specific
-check_reset_prop "ro.secureboot.lockstate" "locked"
-
-# Realme specific
-check_reset_prop "ro.boot.realmebootstate" "green"
-check_reset_prop "ro.boot.realme.lockstate" "1"
-
-check_reset_prop "ro.crypto.state" "encrypted"
-check_reset_prop "ro.is_ever_orange" "0"
+if [ "$_ZEROMOUNT_ACTIVE" != "true" ]; then
+    check_reset_prop "ro.boot.vbmeta.device_state" "locked"
+    check_reset_prop "ro.boot.verifiedbootstate" "green"
+    check_reset_prop "ro.boot.flash.locked" "1"
+    check_reset_prop "ro.boot.veritymode" "enforcing"
+    check_reset_prop "ro.boot.warranty_bit" "0"
+    check_reset_prop "ro.warranty_bit" "0"
+    check_reset_prop "ro.debuggable" "0"
+    check_reset_prop "ro.force.debuggable" "0"
+    check_reset_prop "ro.secure" "1"
+    check_reset_prop "ro.adb.secure" "1"
+    check_reset_prop "ro.build.type" "user"
+    check_reset_prop "ro.build.tags" "release-keys"
+    check_reset_prop "ro.vendor.boot.warranty_bit" "0"
+    check_reset_prop "ro.vendor.warranty_bit" "0"
+    check_reset_prop "vendor.boot.vbmeta.device_state" "locked"
+    check_reset_prop "vendor.boot.verifiedbootstate" "green"
+    check_reset_prop "sys.oem_unlock_allowed" "0"
+
+    check_reset_prop "ro.secureboot.lockstate" "locked"
+
+    check_reset_prop "ro.boot.realmebootstate" "green"
+    check_reset_prop "ro.boot.realme.lockstate" "1"
+
+    check_reset_prop "ro.crypto.state" "encrypted"
+    check_reset_prop "ro.is_ever_orange" "0"
+fi
+
 check_reset_prop "ro.oem_unlock_supported" "0"
 check_reset_prop "ro.secureboot.devicelock" "1"
 
@@ -72,14 +79,16 @@ if [ "$_region_enabled" = "true" ]; then
     [ -n "$_cfg_hw_sku" ] && check_reset_prop "ro.boot.product.hardware.sku" "$_cfg_hw_sku"
 fi
 
-# Delete qemu property entirely -- some detectors check existence, not value
-if [ -n "$(resetprop ro.kernel.qemu)" ]; then
-    if resetprop --delete ro.kernel.qemu 2>/dev/null; then
-        _PROP_SPOOF_COUNT=$((_PROP_SPOOF_COUNT + 1))
-    else
-        resetprop -n ro.kernel.qemu "" 2>/dev/null
-        _PROP_FAIL_COUNT=$((_PROP_FAIL_COUNT + 1))
-        _log "WARN" "Could not delete ro.kernel.qemu, blanked instead"
+if [ "$_ZEROMOUNT_ACTIVE" != "true" ]; then
+    # Delete qemu property entirely -- some detectors check existence, not value
+    if [ -n "$(resetprop ro.kernel.qemu)" ]; then
+        if resetprop --delete ro.kernel.qemu 2>/dev/null; then
+            _PROP_SPOOF_COUNT=$((_PROP_SPOOF_COUNT + 1))
+        else
+            resetprop -n ro.kernel.qemu "" 2>/dev/null
+            _PROP_FAIL_COUNT=$((_PROP_FAIL_COUNT + 1))
+            _log "WARN" "Could not delete ro.kernel.qemu, blanked instead"
+        fi
     fi
 fi
 
@@ -91,49 +100,49 @@ contains_reset_prop "vendor.bootmode" "recovery" "unknown"
 contains_reset_prop "vendor.boot.bootmode" "recovery" "unknown"
 contains_reset_prop "vendor.boot.mode" "recovery" "unknown"
 
-# VBMeta digest — prefer TEESimulator's persisted value, fall back to ours
-_hash_src=""
-hash_value=""
-if [ -f "$TS_DIR/boot_hash.bin" ]; then
-    hash_value=$(od -A n -t x1 "$TS_DIR/boot_hash.bin" 2>/dev/null | tr -d ' \n')
-    [ -n "$hash_value" ] && _hash_src="teesim"
-fi
-if [ -z "$hash_value" ] && [ -f "/data/adb/boot_hash" ]; then
-    hash_value=$(grep -v '^#' "/data/adb/boot_hash" 2>/dev/null | tr -d '[:space:]' | tr '[:upper:]' '[:lower:]')
-    [ -n "$hash_value" ] && _hash_src="boot_hash"
-fi
-if echo "$hash_value" | grep -qE '^[a-f0-9]{64}$'; then
-    if resetprop -n ro.boot.vbmeta.digest "$hash_value" 2>/dev/null; then
-        _PROP_SPOOF_COUNT=$((_PROP_SPOOF_COUNT + 1))
-        _log "INFO" "VBMeta digest set from $_hash_src: $(printf '%.16s' "$hash_value")..."
-    else
-        _PROP_FAIL_COUNT=$((_PROP_FAIL_COUNT + 1))
-        _log "ERROR" "Failed to set vbmeta.digest from $_hash_src"
+if [ "$_ZEROMOUNT_ACTIVE" != "true" ]; then
+    # VBMeta digest — prefer TEESimulator's persisted value, fall back to ours
+    _hash_src=""
+    hash_value=""
+    if [ -f "$TS_DIR/boot_hash.bin" ]; then
+        hash_value=$(od -A n -t x1 "$TS_DIR/boot_hash.bin" 2>/dev/null | tr -d ' \n')
+        [ -n "$hash_value" ] && _hash_src="teesim"
     fi
-elif [ -n "$hash_value" ]; then
-    _log "WARN" "boot_hash invalid from $_hash_src (not 64-char hex)"
-fi
-
-# VBMeta metadata props -- ensure they exist even if kernel didn't set them
-ensure_prop "ro.boot.vbmeta.device_state" "locked"
-ensure_prop "ro.boot.vbmeta.invalidate_on_error" "yes"
-ensure_prop "ro.boot.vbmeta.avb_version" "1.2"
-ensure_prop "ro.boot.vbmeta.hash_alg" "sha256"
-
-# Dynamic vbmeta_size -- use partition byte size with A/B slot suffix + multi-path fallback
-slot_suffix=$(getprop ro.boot.slot_suffix 2>/dev/null)
-VBMETA_SIZE=""
-for candidate in \
-    "/dev/block/by-name/vbmeta${slot_suffix}" \
-    "/dev/block/by-name/vbmeta" \
-    "/dev/block/by-name/vbmeta_a" \
-    "/dev/block/by-name/vbmeta_b"; do
-    if [ -b "$candidate" ]; then
-        VBMETA_SIZE=$(blockdev --getsize64 "$candidate" 2>/dev/null)
-        [ -n "$VBMETA_SIZE" ] && [ "$VBMETA_SIZE" -gt 0 ] 2>/dev/null && break
-        VBMETA_SIZE=""
+    if [ -z "$hash_value" ] && [ -f "/data/adb/boot_hash" ]; then
+        hash_value=$(grep -v '^#' "/data/adb/boot_hash" 2>/dev/null | tr -d '[:space:]' | tr '[:upper:]' '[:lower:]')
+        [ -n "$hash_value" ] && _hash_src="boot_hash"
+    fi
+    if echo "$hash_value" | grep -qE '^[a-f0-9]{64}$'; then
+        if resetprop -n ro.boot.vbmeta.digest "$hash_value" 2>/dev/null; then
+            _PROP_SPOOF_COUNT=$((_PROP_SPOOF_COUNT + 1))
+            _log "INFO" "VBMeta digest set from $_hash_src: $(printf '%.16s' "$hash_value")..."
+        else
+            _PROP_FAIL_COUNT=$((_PROP_FAIL_COUNT + 1))
+            _log "ERROR" "Failed to set vbmeta.digest from $_hash_src"
+        fi
+    elif [ -n "$hash_value" ]; then
+        _log "WARN" "boot_hash invalid from $_hash_src (not 64-char hex)"
     fi
-done
-ensure_prop "ro.boot.vbmeta.size" "${VBMETA_SIZE:-4096}"
+
+    ensure_prop "ro.boot.vbmeta.device_state" "locked"
+    ensure_prop "ro.boot.vbmeta.invalidate_on_error" "yes"
+    ensure_prop "ro.boot.vbmeta.avb_version" "1.3"
+    ensure_prop "ro.boot.vbmeta.hash_alg" "sha256"
+
+    slot_suffix=$(getprop ro.boot.slot_suffix 2>/dev/null)
+    VBMETA_SIZE=""
+    for candidate in \
+        "/dev/block/by-name/vbmeta${slot_suffix}" \
+        "/dev/block/by-name/vbmeta" \
+        "/dev/block/by-name/vbmeta_a" \
+        "/dev/block/by-name/vbmeta_b"; do
+        if [ -b "$candidate" ]; then
+            VBMETA_SIZE=$(blockdev --getsize64 "$candidate" 2>/dev/null)
+            [ -n "$VBMETA_SIZE" ] && [ "$VBMETA_SIZE" -gt 0 ] 2>/dev/null && break
+            VBMETA_SIZE=""
+        fi
+    done
+    ensure_prop "ro.boot.vbmeta.size" "${VBMETA_SIZE:-4096}"
+fi
 
 _log "INFO" "Property spoofing complete: $_PROP_SPOOF_COUNT spoofed, $_PROP_FAIL_COUNT failed"

rust/Cargo.lock

@@ -20,6 +20,7 @@ ring = "0.17"
 rcgen = { version = "0.12", default-features = false, features = ["pem", "ring"] }
 rsa = { version = "0.9", default-features = false, features = ["std", "pem"] }
 rand = "0.8"
+resetprop = { path = "/home/president/Git-repo-success/resetprop-rs/crates/resetprop" }
 
 [profile.release]
 lto = true

rust/Cargo.toml

@@ -24,7 +24,11 @@ pub fn dispatch(command: Commands, cfg: &Config) -> anyhow::Result<()> {
             println!("{}", read_version_from_prop());
             Ok(())
         }
-        Commands::Props => crate::props::handle_props(cfg),
+        Commands::Props => {
+            let sys = resetprop::PropSystem::open()
+                .map_err(|e| anyhow::anyhow!("property areas: {e}"))?;
+            crate::props::handle_props(cfg, &sys)
+        }
         Commands::Daemon { manager } => crate::daemon::handle_daemon(cfg, manager.as_deref()),
         Commands::DaemonStop => crate::daemon::handle_daemon_stop(),
         Commands::Config { action } => crate::config::handle_config(action, cfg),

rust/src/cli/handlers.rs

@@ -1,38 +1,30 @@
 use std::process::Command;
+use resetprop::PropSystem;
 
-pub fn getprop(name: &str) -> Option<String> {
-    Command::new("getprop")
-        .arg(name)
-        .output()
-        .ok()
-        .and_then(|o| {
-            let s = String::from_utf8_lossy(&o.stdout).trim().to_string();
-            if s.is_empty() { None } else { Some(s) }
-        })
+pub fn getprop(sys: &PropSystem, name: &str) -> Option<String> {
+    sys.get(name)
 }
 
-pub fn resetprop(name: &str, value: &str) -> anyhow::Result<()> {
-    let status = Command::new("resetprop")
-        .args(["-n", name, value])
-        .status()?;
-    if status.success() {
-        Ok(())
-    } else {
-        anyhow::bail!("resetprop -n {name} {value} failed")
-    }
+pub fn set(sys: &PropSystem, name: &str, value: &str) -> anyhow::Result<()> {
+    sys.set(name, value).map_err(|e| anyhow::anyhow!("{e}"))
 }
 
-pub fn resetprop_delete(name: &str) -> anyhow::Result<()> {
-    let status = Command::new("resetprop")
-        .args(["--delete", name])
-        .status()?;
-    if status.success() {
-        Ok(())
-    } else {
-        anyhow::bail!("resetprop --delete {name} failed")
-    }
+pub fn delete(sys: &PropSystem, name: &str) -> anyhow::Result<()> {
+    sys.delete(name)?;
+    Ok(())
+}
+
+// One-off ops without an existing PropSystem — for callers outside the prop pipeline
+pub fn getprop_once(name: &str) -> Option<String> {
+    PropSystem::open().ok()?.get(name)
+}
+
+pub fn set_once(name: &str, value: &str) -> anyhow::Result<()> {
+    let sys = PropSystem::open().map_err(|e| anyhow::anyhow!("{e}"))?;
+    sys.set(name, value).map_err(|e| anyhow::anyhow!("{e}"))
 }
 
+// No library equivalent — blocks until property reaches value
 pub fn resetprop_wait(name: &str, value: &str) -> anyhow::Result<()> {
     let status = Command::new("resetprop")
         .args(["-w", name, value])