#!/sbin/sh
##########################################################################################
#
# Magisk Uninstaller
# by topjohnwu
# 
# This zip will remove all Magisk related files and revert boot image
#
##########################################################################################

INSTALLER=/tmp/uninstall

# Boot Image Variables
CHROMEDIR=$INSTALLER/chromeos
NEWBOOT=$TMPDIR/boottmp/new-boot.img
UNPACKDIR=$TMPDIR/boottmp/bootunpack
RAMDISK=$TMPDIR/boottmp/ramdisk

# Default permissions
umask 022

##########################################################################################
# Flashable update-binary preparation
##########################################################################################

OUTFD=$2
ZIP=$3

readlink /proc/$$/fd/$OUTFD 2>/dev/null | grep /tmp >/dev/null
if [ "$?" -eq "0" ]; then
  OUTFD=0

  for FD in `ls /proc/$$/fd`; do
    readlink /proc/$$/fd/$FD 2>/dev/null | grep pipe >/dev/null
    if [ "$?" -eq "0" ]; then
      ps | grep " 3 $FD " | grep -v grep >/dev/null
      if [ "$?" -eq "0" ]; then
        OUTFD=$FD
        break
      fi
    fi
  done
fi

mkdir -p $INSTALLER
cd $INSTALLER
unzip -o "$ZIP"

##########################################################################################
# Functions
##########################################################################################

ui_print() {
  echo -n -e "ui_print $1\n" >> /proc/self/fd/$OUTFD
  echo -n -e "ui_print\n" >> /proc/self/fd/$OUTFD
}

getvar() {
  local VARNAME=$1
  local VALUE=$(eval echo \$"$VARNAME");
  for FILE in /data/.magisk /cache/.magisk /system/.magisk; do
    if [ -z "$VALUE" ]; then
      LINE=$(cat $FILE 2>/dev/null | grep "$VARNAME=")
      if [ ! -z "$LINE" ]; then
        VALUE=${LINE#*=}
      fi
    fi
  done
  eval $VARNAME=\$VALUE
}

find_boot_image() {
  if [ -z "$BOOTIMAGE" ]; then
    for PARTITION in kern-a KERN-A android_boot ANDROID_BOOT kernel KERNEL boot BOOT lnx LNX; do
      BOOTIMAGE=`readlink /dev/block/by-name/$PARTITION || readlink /dev/block/platform/*/by-name/$PARTITION || readlink /dev/block/platform/*/*/by-name/$PARTITION`
      if [ ! -z "$BOOTIMAGE" ]; then break; fi
    done
  fi
  if [ -z "$BOOTIMAGE" ]; then
    FSTAB="/etc/recovery.fstab"
    [ ! -f "$FSTAB" ] && FSTAB="/etc/recovery.fstab.bak"
    [ -f "$FSTAB" ] && BOOTIMAGE=`grep -E '\b/boot\b' "$FSTAB" | grep -oE '/dev/[a-zA-Z0-9_./-]*'`
  fi
}

is_mounted() {
  if [ ! -z "$2" ]; then
    cat /proc/mounts | grep $1 | grep $2, >/dev/null
  else
    cat /proc/mounts | grep $1 >/dev/null
  fi
  return $?
}

grep_prop() {
  REGEX="s/^$1=//p"
  shift
  FILES=$@
  if [ -z "$FILES" ]; then
    FILES='/system/build.prop'
  fi
  cat $FILES 2>/dev/null | sed -n $REGEX | head -n 1
}

mount_image() {
  if [ ! -d "$2" ]; then
    mount -o rw,remount rootfs /
    mkdir -p $2 2>/dev/null
    ($BOOTMODE) && mount -o ro,remount rootfs /
    [ ! -d "$2" ] && return 1
  fi
  if (! is_mounted $2); then
    LOOPDEVICE=
    for LOOP in 0 1 2 3 4 5 6 7; do
      if (! is_mounted $2); then
        LOOPDEVICE=/dev/block/loop$LOOP
        if [ ! -f "$LOOPDEVICE" ]; then
          mknod $LOOPDEVICE b 7 $LOOP 2>/dev/null
        fi
        losetup $LOOPDEVICE $1
        if [ "$?" -eq "0" ]; then
          mount -t ext4 -o loop $LOOPDEVICE $2
          if (! is_mounted $2); then
            /system/bin/toolbox mount -t ext4 -o loop $LOOPDEVICE $2
          fi
          if (! is_mounted $2); then
            /system/bin/toybox mount -t ext4 -o loop $LOOPDEVICE $2
          fi
        fi
        if (is_mounted $2); then
          ui_print "- Mounting $1 to $2"
          break;
        fi
      fi
    done
  fi
}

unpack_boot() {
  rm -rf $UNPACKDIR $RAMDISK 2>/dev/null
  mkdir -p $UNPACKDIR
  mkdir -p $RAMDISK
  cd $UNPACKDIR
  LD_LIBRARY_PATH=$SYSTEMLIB $BINDIR/bootimgtools --extract $1

  cd $RAMDISK
  gunzip -c < $UNPACKDIR/ramdisk.gz | cpio -i
}

repack_boot() {
  cd $RAMDISK
  find . | cpio -o -H newc 2>/dev/null | gzip -9 > $UNPACKDIR/ramdisk.gz
  cd $UNPACKDIR
  LD_LIBRARY_PATH=$SYSTEMLIB $BINDIR/bootimgtools --repack $BOOTIMAGE
  if [ -f chromeos ]; then
    echo " " > config
    echo " " > bootloader
    LD_LIBRARY_PATH=$SYSTEMLIB $CHROMEDIR/futility vbutil_kernel --pack new-boot.img.signed --keyblock $CHROMEDIR/kernel.keyblock --signprivate $CHROMEDIR/kernel_data_key.vbprivk --version 1 --vmlinuz new-boot.img --config config --arch arm --bootloader bootloader --flags 0x1
    rm -f new-boot.img
    mv new-boot.img.signed new-boot.img
  fi
  if ($SAMSUNG); then
    SAMSUNG_CHECK=$(cat new-boot.img | grep SEANDROIDENFORCE)
    if [ $? -ne 0 ]; then
      echo -n "SEANDROIDENFORCE" >> new-boot.img
    fi
  fi
  if ($LGE_G); then
    # Prevent secure boot error on LG G2/G3.
    # Just for know, It's a pattern which bootloader verifies at boot. Thanks to LG hackers.
    echo -n -e "\x41\xa9\xe4\x67\x74\x4d\x1d\x1b\xa4\x29\xf2\xec\xea\x65\x52\x79" >> new-boot.img
  fi
  mv new-boot.img $NEWBOOT
}

revert_boot() {
  rm -rf $TMPDIR/boottmp 2>/dev/null
  mkdir -p $TMPDIR/boottmp

  ui_print "- Unpacking boot image"
  unpack_boot $BOOTIMAGE

  SUPERSU=false
  [ -f sbin/launch_daemonsu.sh ] && SUPERSU=true

  if ($SUPERSU); then
    ui_print "- SuperSU patched boot detected!"
    SUIMG=/data/su.img
    mount_image $SUIMG /su
    if (is_mounted /su); then
      SUPERSULOOP=$LOOPDEVICE
      gunzip -c < $UNPACKDIR/ramdisk.gz > $UNPACKDIR/ramdisk
      ui_print "- Using sukernel to restore ramdisk"
      # Restore ramdisk
      LD_LIBRARY_PATH=$SYSTEMLIB /su/bin/sukernel --cpio-restore $UNPACKDIR/ramdisk $UNPACKDIR/ramdisk
      if [ $? -ne 0 ]; then
        ui_print "! Unable to restore ramdisk"
        ui_print "! Will still remove Magisk additions"
      fi
      rm -rf $RAMDISK
      mkdir -p $RAMDISK
      cd $RAMDISK
      cpio -i < $UNPACKDIR/ramdisk
      rm -f $UNPACKDIR/ramdisk
    fi
  elif [ -d ".backup" ]; then
    ui_print "- Restoring ramdisk with backup"
    cp -af .backup/. .
  else
    ui_print "! No ramdisk backup found"
    ui_print "! Will still remove Magisk additions"
  fi

  # Remove possible boot modifications
  rm -rf magisk init.magisk.rc sbin/magic_mask.sh .backup 2>/dev/null

  ui_print "- Repacking boot image"
  repack_boot
}

##########################################################################################
# Main
##########################################################################################

ui_print "*****************************"
ui_print "      Magisk Uninstaller     "
ui_print "*****************************"

if [ ! -d "$INSTALLER/arm" ]; then
  ui_print "! Failed: Unable to extract zip file!"
  exit 1
fi

ui_print "- Mounting /system(ro), /cache, /data"
mount -o ro /system 2>/dev/null
mount /cache 2>/dev/null
mount /data 2>/dev/null

if [ ! -f '/system/build.prop' ]; then
  ui_print "! Failed: /system could not be mounted!"
  exit 1
fi

SAMSUNG=false
SAMSUNG_CHECK=$(cat /system/build.prop | grep "ro.build.fingerprint=" | grep -i "samsung")
if [ $? -eq 0 ]; then
  SAMSUNG=true
fi

LGE_G=false
RBRAND=$(grep_prop ro.product.brand)
RMODEL=$(grep_prop ro.product.device)
if [ "$RBRAND" = "lge" ] || [ "$RBRAND" = "LGE" ];  then 
  if [ "$RMODEL" = "*D80*" ] || 
     [ "$RMODEL" = "*S98*" ] || 
     [ "$RMODEL" = "*D85*" ] ||
     [ "$RMODEL" = "*F40*" ]; then
    LGE_G=true
    ui_print "! Bump device detected"
  fi
fi

API=$(grep_prop ro.build.version.sdk)
ABI=$(grep_prop ro.product.cpu.abi | cut -c-3)
ABI2=$(grep_prop ro.product.cpu.abi2 | cut -c-3)
ABILONG=$(grep_prop ro.product.cpu.abi)

ARCH=arm
IS64BIT=false
if [ "$ABI" = "x86" ]; then ARCH=x86; fi;
if [ "$ABI2" = "x86" ]; then ARCH=x86; fi;
if [ "$ABILONG" = "arm64-v8a" ]; then ARCH=arm64; IS64BIT=true; fi;
if [ "$ABILONG" = "x86_64" ]; then ARCH=x64; IS64BIT=true; fi;

ui_print "- Device platform: $ARCH"

BINDIR=$INSTALLER/$ARCH
chmod -R 755 $CHROMEDIR/futility $BINDIR

SYSTEMLIB=/system/lib
($IS64BIT) && SYSTEMLIB=/system/lib64

find_boot_image
if [ -z "$BOOTIMAGE" ]; then
  ui_print "! Unable to detect boot image"
  exit 1
fi

##########################################################################################
# Detection all done, start installing
##########################################################################################

ui_print "- Found Boot Image: $BOOTIMAGE"

if (is_mounted /data); then
  PATH=/data/busybox:$PATH
  cp -f /data/stock_boot_*.gz /data/stock_boot.img.gz 2>/dev/null
  gunzip -d < /data/stock_boot.img.gz > /data/stock_boot.img 2>/dev/null
  rm -f /data/stock_boot.img.gz 2>/dev/null
  if [ -f /data/stock_boot.img ]; then
    ui_print "- Boot image backup found!"
    NEWBOOT=/data/stock_boot.img
  else
    ui_print "! Boot image backup unavalible, try using ramdisk backup"
    revert_boot
  fi
  ui_print "- Removing Magisk files"
  rm -rf  /cache/magisk.log /cache/last_magisk.log /cache/magiskhide.log \
          /cache/magisk /cache/magisk_merge /cache/magisk_mount  /cache/unblock \
          /data/Magisk.apk /data/magisk.apk /data/magisk.img /data/magisk_merge.img \
          /data/busybox /data/magisk /data/custom_ramdisk_patch.sh 2>/dev/null
else
  ui_print "! Data unavailable"
  ui_print "! Impossible to restore original boot image"
  ui_print "! Try using ramdisk backup"
  revert_boot
  ui_print "- Removing Magisk files"
  rm -rf  /cache/magisk.log /cache/last_magisk.log /cache/magiskhide.log \
          /cache/magisk /cache/magisk_merge /cache/magisk_mount /cache/unblock 2>/dev/null
  ui_print "*****************************************"
  ui_print "     Magisk is not fully removed yet     "
  ui_print " Please manually remove /data/magisk.img "
  ui_print "*****************************************"
fi

chmod 644 $NEWBOOT

ui_print "- Flashing reverted image"
[ ! -L "$BOOTIMAGE" ] && dd if=/dev/zero of=$BOOTIMAGE bs=4096 2>/dev/null
dd if=$NEWBOOT of=$BOOTIMAGE bs=4096

umount /system
if [ ! -z $SUPERSU ]; then
  umount /su
  losetup -d $SUPERSULOOP
  rmdir /su
fi

ui_print "- Done"
exit 0