How does it work?

initrd-magisk boot stage

• System launched with initrd-magisk (initrd.img) unpacked into root directory in first stage, then unpack original initrd_real.img to root directory.
• Put 99_magisk script into /scripts
• Launch init script from original initrd_real.img and continue to boot.

original initrd boot stage

• Execute 99_magisk script to patch Android's root directory
  • Mount tmpfs on /android/dev.
  • Load Magisk from boot-magisk.img
  • On rootfs (read-write rootdir), directly add magisk binaries into /android/magisk and inject magisk services into /init.rc. On system-as-root (read-only rootdir), mount overlay on /android/system/etc/init, add magisk binaries into /android/system/etc/init/magisk and inject magisk services into /android/system/etc/init/magisk.rc.
  • Pre-init sepolicy patch: Patch sepolicy file by using magiskpolicy tool, dump it into /android/dev/.overlay/sepolicy and mount bind on /sepolicy or vendor precompiled sepolicy.
  • Unmount /android/dev.
• init switch root directory to /android and execute /init to boot Android.

Android boot stage

• Android boot with Magisk