目錄
環境
這邊假設是用原生的 WSA，沒有裝過 Magisk 或是替換成有 superuser 的 kernel。
安裝憑證
先用 wsl 掛載 system.vhdx，假設路徑在 /mnt/c/WSA/system.vhdx
假設憑證已經做成兩個 .0 檔案
resize_img() {
sudo e2fsck -pf "$1" || return 1
if [ "$2" ]; then
sudo resize2fs "$1" "$2" || return 1
else
sudo resize2fs -M "$1" || return 1
fi
return 0
}
# convert vhdx
qemu-img convert -q -f vhdx -O raw /mnt/c/WSA/system.vhdx /tmp/system.img
# ro ext4 img to rw
resize_img /tmp/system.img "$(($(du --apparent-size -sB512 "$1" | cut -f1) * 2))"s
e2fsck -fp -E unshare_blocks /tmp/system.img
resize_image /tmp/system.img
# expand image
SYSTEM_IMG_SIZE=$(du --apparent-size -sB512 "/tmp/system.img" | cut -f1)
SYSTEM_TAGET_SIZE=$((SYSTEM_IMG_SIZE * 2))
resize_img "/tmp/system.img" "$SYSTEM_TAGET_SIZE"s
# mount
sudo mkdir /mnt/img
sudo mount -vo loop /tmp/system.img /mnt/img
# copy cert
sudo cp /path/to/cert/*.0 /mnt/img/system/etc/security/cacerts
# update file attr
find "/mnt/img/system/etc/security/cacerts" -maxdepth 1 -mindepth 1 -printf '%P\n' | xargs -I placeholder sudo find "/mnt/img/system/etc/security/cacerts/placeholder" -type f -exec chmod 0644 {} \;
find "/mnt/img/system/etc/security/cacerts" -maxdepth 1 -mindepth 1 -printf '%P\n' | xargs -I placeholder sudo find "/mnt/img/system/etc/security/cacerts/placeholder" -exec chown root:root {} \;
find "/mnt/img/system/etc/security/cacerts" -maxdepth 1 -mindepth 1 -printf '%P\n' | xargs -I placeholder sudo find "/mnt/img/system/etc/security/cacerts/placeholder" -exec setfattr -n security.selinux -v "u:object_r:system_file:s0" {} \;
# unmount
sudo umount -v /mnt/img
# shrink image
resize_img /tmp/system.img
# convert to vhdx
qemu-img convert -q -f raw -o subformat=fixed -O vhdx /tmp/system.img /tmp/system.vhdx
ref: https://github.com/YT-Advanced/WSA-Script/blob/main/scripts/build_with_mount.sh
接下來就把WSA確定已經關機，備份原本的 system.vhdx，然後把新的 /tmp/system.vhdx 複製到WSA資料夾裡面。
複製完之後可以開機進設定檢查憑證是否有正常安裝：
# launch settings
adb shell am start com.android.settings/com.android.settings.Settings
有的話可以在系統憑證裡面看到 DO_NOT_TRUST
設定 proxy
舊的 WSA 無法直接與 Windows 端的 ip 通訊，所以要用 adb 轉發。
ref: https://github.com/microsoft/WSA/issues/239
設定 adb 轉發 host 的 8888 port 到 WSA 裡面
adb reverse tcp:8888 tcp:8888
現在的 WSA 設定中可以開啟允許 WSA 存取 Windows 端的網路裝置，可以不用 forward。
設定 WSA 的 proxy
adb shell settings put global http_proxy localhost:8888
清除 WSA 的 proxy
adb shell settings put global http_proxy :0