Can /system files be modified via su without resigning/reflashing AVBroot?

[e-t-l]

I'm new to rooting and new to AVBroot, so forgive me if this is a dumb question: I've read about different root hacks that involve modifying some file in the /system filetree, such as build.prop. Does this interfere with AVB and cause a bootloop, or is it fine since (I think) it's not modifying the boot image?

[chenxiaolong]

That's not a dumb question! (and dumb questions are always welcome 🙂)

If anything modifies /system it will indeed break the AVB signatures and cause a bootloop. If /system is all that was touched, you could maybe reboot into recovery mode and reflash your patched OTA to get back into a good state. But if that didn't work, you would need to unlock the bootloader again and start fresh.

In general, every OS partition is protected by AVB signatures. If possible, I'd recommend using Magisk modules to replace files in /system. These are mounted on top of the original files during boot and don't touch the actual filesystem.

[e-t-l]

I'm very glad I asked!

Btw, since you recommended Magisk modules here but an Xposed module in your answer to my other question, would you be able to briefly explain (or point me to a website that explains) what the difference is between Magisk and Xposed/LSposed? I know Xposed is a "framework" that can be installed as a Magisk module, and itself uses modules... but what's the difference in what they do?

[chenxiaolong]

Sure! A Magisk module is a zip you can install in Magisk that contains scripts to run during boot and files to be mounted on top of /system, /product, or /vendor to override them.

Xposed/LSPosed is a framework that allows hooking into code of the system and apps to change their behavior. The modules LSPosed uses itself are standard apps (.apk) that contain the hooks and some metadata listing which apps it's able to change the behavior of.