diff --git a/jni/Android.mk b/jni/Android.mk
index 5206eeb74..c03e20d52 100644
--- a/jni/Android.mk
+++ b/jni/Android.mk
@@ -4,12 +4,14 @@ LOCAL_PATH := $(call my-dir)
 JNI_ROOT := jni
 SELINUX_PATH := jni/external/selinux
 COMPRESS_LIB := jni/external/ndk-compression
+DTC_PATH := jni/external/dtc
 LIBSELINUX := $(SELINUX_PATH)/libselinux/include
 LIBSEPOL := $(SELINUX_PATH)/libsepol/include $(SELINUX_PATH)/libsepol/cil/include
 LIBZ := $(COMPRESS_LIB)/zlib
 LIBLZMA := $(COMPRESS_LIB)/xz/src/liblzma/api
 LIBLZ4 := $(COMPRESS_LIB)/lz4/lib
 LIBBZ2 := $(COMPRESS_LIB)/bzip2
+LIBFDT := $(DTC_PATH)/libfdt
 
 ########################
 # Binaries
@@ -64,13 +66,14 @@ include $(BUILD_EXECUTABLE)
 # magiskboot
 include $(CLEAR_VARS)
 LOCAL_MODULE := magiskboot
-LOCAL_STATIC_LIBRARIES := libz liblzma liblz4 libbz2
+LOCAL_STATIC_LIBRARIES := libz liblzma liblz4 libbz2 libfdt
 LOCAL_C_INCLUDES := \
 	jni/include \
 	$(LIBZ) \
 	$(LIBLZMA) \
 	$(LIBLZ4) \
-	$(LIBBZ2)
+	$(LIBBZ2) \
+	$(LIBFDT)
 
 LOCAL_SRC_FILES := \
 	magiskboot/main.c \
@@ -81,6 +84,7 @@ LOCAL_SRC_FILES := \
 	magiskboot/cpio.c \
 	magiskboot/sha1.c \
 	magiskboot/types.c \
+	magiskboot/dtb.c \
 	utils/xwrap.c \
 	utils/vector.c
 LOCAL_CFLAGS := -DZLIB_CONST
diff --git a/jni/magiskboot/boot_utils.c b/jni/magiskboot/boot_utils.c
index b003e9275..c73f6ac2b 100644
--- a/jni/magiskboot/boot_utils.c
+++ b/jni/magiskboot/boot_utils.c
@@ -86,7 +86,7 @@ int check_verity_pattern(const char *s) {
 	if (strncmp(s + pos, "verify", 6) != 0) return -1;
 	pos += 6;
 	if (s[pos] == '=') {
-		while (s[pos] != ' ' && s[pos] != '\n' && s[pos] != ',') ++pos;
+		while (s[pos] != '\0' && s[pos] != ' ' && s[pos] != '\n' && s[pos] != ',') ++pos;
 	}
 	return pos;
 }
diff --git a/jni/magiskboot/dtb.c b/jni/magiskboot/dtb.c
new file mode 100644
index 000000000..a5904fb65
--- /dev/null
+++ b/jni/magiskboot/dtb.c
@@ -0,0 +1,66 @@
+#include <libfdt.h>
+#include <unistd.h>
+#include <sys/mman.h>
+
+#include "magiskboot.h"
+#include "utils.h"
+
+/* Left here for debugging */
+
+// static void print_subnode(const void *fdt, int parent, int depth) {
+// 	int node;
+// 	fdt_for_each_subnode(node, fdt, parent) {
+// 		for (int i = 0; i < depth; ++i) printf("  ");
+// 		printf("%d: %s\n", node, fdt_get_name(fdt, node, NULL));
+// 		print_subnode(fdt, node, depth + 1);
+// 	}
+// }
+
+static int find_fstab(const void *fdt, int parent) {
+	int node, fstab;
+	fdt_for_each_subnode(node, fdt, parent) {
+		if (strcmp(fdt_get_name(fdt, node, NULL), "fstab") == 0)
+			return node;
+		fstab = find_fstab(fdt, node);
+		if (fstab != -1)
+			return fstab;
+	}
+	return -1;
+}
+
+void dtb_patch(const char *file) {
+	size_t size ;
+	void *dtb, *fdt;
+	fprintf(stderr, "Loading dtbs from [%s]\n\n", file);
+	mmap_rw(file, &dtb, &size);
+	// Loop through all the dtbs
+	int dtb_num = 0, patched = 0;
+	for (int i = 0; i < size; ++i) {
+		if (memcmp(dtb + i, DTB_MAGIC, 4) == 0) {
+			fdt = dtb + i;
+			int fstab = find_fstab(fdt, 0);
+			if (fstab > 0) {
+				fprintf(stderr, "Found fstab in dtb.%04d\n", dtb_num++);
+				int block;
+				fdt_for_each_subnode(block, fdt, fstab) {
+					fprintf(stderr, "Found block [%s] in fstab\n", fdt_get_name(fdt, block, NULL));
+					int skip, value_size;
+					char *value = (char *) fdt_getprop(fdt, block, "fsmgr_flags", &value_size);
+					for (int i = 0; i < value_size; ++i) {
+						if ((skip = check_verity_pattern(value + i)) > 0) {
+							fprintf(stderr, "Remove pattern [%.*s] in [fsmgr_flags]\n", skip, value + i);
+							memcpy(value + i, value + i + skip, value_size - i - skip);
+							memset(value + value_size - skip, '\0', skip);
+							patched = 1;
+						}
+					}
+				}
+			}
+		}
+	}
+	fprintf(stderr, "\n");
+	munmap(dtb, size);
+	exit(!patched);
+}
+
+
diff --git a/jni/magiskboot/magiskboot.h b/jni/magiskboot/magiskboot.h
index 3c228f61b..74be6a73c 100644
--- a/jni/magiskboot/magiskboot.h
+++ b/jni/magiskboot/magiskboot.h
@@ -22,6 +22,7 @@ int parse_img(void *orig, size_t size, boot_img *boot);
 int cpio_commands(const char *command, int argc, char *argv[]);
 void comp_file(const char *method, const char *from, const char *to);
 void decomp_file(char *from, const char *to);
+void dtb_patch(const char *file);
 
 // Compressions
 size_t gzip(int mode, int fd, const void *buf, size_t size);
diff --git a/jni/magiskboot/main.c b/jni/magiskboot/main.c
index 99683b8d0..cf810b82d 100644
--- a/jni/magiskboot/main.c
+++ b/jni/magiskboot/main.c
@@ -54,6 +54,9 @@ static void usage(char *arg0) {
 		"    -stocksha1\n"
 		"      Get stock boot SHA1 recorded within <incpio>\n"
 		"\n"
+		" --dtb-patch <dtb>\n"
+		"  Search for fstab in <dtb> and remove verity checks\n"
+		"\n"
 		" --compress[=method] <infile> [outfile]\n"
 		"  Compress <infile> with [method] (default: gzip), optionally to [outfile]\n"
 		"  Supported methods: "
@@ -110,6 +113,8 @@ int main(int argc, char *argv[]) {
 		repack(argv[2], argc > 3 ? argv[3] : NEW_BOOT);
 	} else if (argc > 2 && strcmp(argv[1], "--decompress") == 0) {
 		decomp_file(argv[2], argc > 3 ? argv[3] : NULL);
+	} else if (argc > 2 && strcmp(argv[1], "--dtb-patch") == 0) {
+		dtb_patch(argv[2]);
 	} else if (argc > 2 && strncmp(argv[1], "--compress", 10) == 0) {
 		char *method;
 		method = strchr(argv[1], '=');
diff --git a/scripts/boot_patch.sh b/scripts/boot_patch.sh
index f2c78e9d1..22d520bc4 100644
--- a/scripts/boot_patch.sh
+++ b/scripts/boot_patch.sh
@@ -226,8 +226,6 @@ if $SKIP_INITRAMFS; then
   fi
   [ -f sepolicy ] || abort_wrap "! Cannot get sepolicy"
 
-  # TODO: Patch dm-verity
-
   cpio_add 750 init ./magiskinit
   cpio_mkdir 000 overlay
   cpio_add 750 overlay/init.magisk.rc init.magisk.rc
@@ -252,6 +250,10 @@ rm -f sepolicy
 # Create ramdisk backups
 ./magiskboot --cpio-backup ramdisk.cpio ramdisk.cpio.orig
 
+if ! $KEEPVERITY && [ -f dtb ]; then
+  ./magiskboot --dtb-patch dtb && ui_print "- Patching fstab in dtb to remove dm-verity"
+fi
+
 rm -f ramdisk.cpio.orig
 
 ##########################################################################################