Session 20 — 2026-03-27c

Field	Value
Date	2026-03-27
Phase	03b — TWRP
Duration	~1.5 h

Root Cause: Missing libresetprop.so

Running recovery binary manually revealed the real crash cause — not the /dev/fb0 path:

CANNOT LINK EXECUTABLE: library "libresetprop.so" not found

libresetprop.so (from Magisk’s resetprop, built by external/magisk-prebuilt) was compiled to the system image output directory but never copied into the recovery ramdisk. The dynamic linker failed instantly — before any graphics init, before any log creation — explaining why /tmp/recovery.log never appeared in v1.0–v1.5.

Fix: Copy the built library to device/onyx/noteair1/recovery/root/system/lib64/libresetprop.so. Files in that directory are merged directly into the recovery ramdisk. PRODUCT_PACKAGES does NOT work for recovery ramdisk inclusion — that targets the system image.

TWRP v1.6 — First Stable Recovery

Area	Status
Recovery binary	Running (PID 533) — stable
Framebuffer	Detected: 1872×1404, 32bpp RGBA, double-buffered
UI	Fully loaded — splash + main theme + 60+ pages + 24 languages
Partitions	Fstab processed; cache mounted; data encrypted (decrypt prompt)
Brightness	Found at correct i2c path (TW_BRIGHTNESS_PATH in BoardConfig.mk is wrong)
Display	Blank — hung in onyx_epdc_wait_all_update_compelete
keystore2	Crash-looping (SIGSEGV) — not blocking TWRP

E-ink Display Architecture

Two display paths exist:

1. /dev/graphics/fb0 — standard Linux framebuffer. TWRP writes pixels here. Pipeline is initialised (MDSS DSI → TC358762 → EPDC → MAX17135), but EPDC update completion never fires. Recovery hangs in onyx_epdc_wait_all_update_compelete.
2. /dev/ebc (char 10,35) — Onyx-proprietary EPDC control device. Stock recovery uses this exclusively via librecovery_ui.so‘s FBDev class. This is the reliable path.

Stock librecovery_ui.so — Key Symbols

Symbol	Purpose
FBDev::openEpdcFd() @ 0x4ec50	Opens /dev/ebc
FBDev::refreshScreen(x,y,w,h,mode) @ 0x4ee9c	Triggers EPDC refresh via /dev/ebc ioctl
FBDev::syncDataToExtendedBuffer()	Copies pixel data to EBC extended buffer
MinuiBackendFbdev::Flip()	Page flip + EPDC refresh trigger

Next Steps

1. Try quick sysfs unblock: write to /sys/devices/sepdc/submit_upd_work or toggle update_disable from ADB shell
2. If that fails: Ghidra on librecovery_ui.so to extract /dev/ebc ioctl numbers from FBDev::refreshScreen
3. Patch TWRP minui (graphics_fbdev.cpp) to open /dev/ebc and issue refresh ioctl