Android Booting and Rooting

Understanding the Android Boot ProcessSearch on YouTubeBookmarkSaved

The deck opens with questions to keep in mind:

• What happens when you start the phone?
• Which processes start first?
• Where does the kernel core reside?
• What are the roles of internal and external RAM?
• Which process initialises the RAMs?
• Which process loads the kernel into external RAM?

When a device is powered on, it runs a fixed sequence of steps. These steps load the firmware, OS and application data into memory.

1. Boot ROM code execution
2. The boot loader
3. The Linux kernel
4. The init process
5. Zygote and Dalvik
6. The system server

Boot ROMSearch on YouTubeBookmarkSaved

When the device is powered on, execution starts at the Boot ROM.

• The Boot ROM is a small read-only memory embedded in the device's SoC (System on Chip).
• It initialises the device hardware: camera, processors, SIM card, PCB and so on.
• The Boot ROM is scanned until the boot media is found.

The boot media (NAND) holds three important pieces of information:

1. Boot code
2. File system
3. Kernel core

As soon as the boot code is found, the boot sequence is established. The boot code tells the device where to start and which steps come next.

Execution then moves to the boot loader:

• The boot loader is copied to the internal RAM. Internal RAM is part of the CPU.
• The whole execution shifts to the code loaded in the internal RAM.

Boot LoaderSearch on YouTubeBookmarkSaved

The boot loader is a program that runs before the OS starts. It finds the kernel and loads it.

The Android boot loader has two stages:

What the SPL does:

• Gives access to boot modes such as fastboot and recovery mode.
• Initialises hardware such as the console, display, keyboard, file systems and virtual memory.
• Looks for the Linux kernel in the boot media.
• Loads the kernel into external RAM.
• Transfers execution to the kernel.

Linux KernelSearch on YouTubeBookmarkSaved

The Linux kernel is the heart of Android. It manages processes and memory and enforces security.

After loading, the kernel mounts the root file system (rootfs). This gives access to system and user data.

1. Memory management units and caches are initialised. The system can now use virtual memory and launch user-space processes.
2. The kernel looks in rootfs for the init process. It launches init as the first user-space process.

Init ProcessSearch on YouTubeBookmarkSaved

init is the very first process. It is the root (parent) of all other processes.

1. init looks for a script named init.rc. This script describes the system services, file system and other parameters to set up.
2. init parses init.rc and launches the system service processes. The Android logo appears on the screen at this stage.

Zygote and DalvikSearch on YouTubeBookmarkSaved

Zygote is one of the first processes init creates after boot.

• Zygote initialises the Dalvik virtual machine. It creates instances to support each Android process.
• The DVM runs Android apps written in Java.
• Zygote shares common code across VMs. This saves memory and reduces load on the system.
• Apps then run by requesting a new DVM instance each.

System ServerSearch on YouTubeBookmarkSaved

The system server starts all the core features, such as telephony and networking. It starts these services:

• Power Manager
• Activity Manager (created, then set as a system process)
• Telephony Registry
• Package Manager
• Context Manager
• System Context Providers
• Battery Service
• Alarm Manager
• Sensor Service
• Window Manager
• Bluetooth Service, and others

Then the system sends the broadcast ACTION_BOOT_COMPLETED. It tells all dependent processes that boot is complete. The device shows the home screen and is ready for the user.

Boot Process PracticalSearch on YouTubeBookmarkSaved

adb connect <ip>:<port>        # connect to the device or emulator
adb devices                    # check the device is listed
adb shell                      # open a shell on the device
ps -A                          # list all running processes
ps -A | grep "init"            # init is PID 1, the first process
ps -A | grep "zygote"          # find the Zygote process

Recovery ModeSearch on YouTubeBookmarkSaved

The bootloader is the first partition and the first program that runs at power on.

• It does low-level hardware initialisation.
• It boots the device into other partitions.
• It loads the Android partition, called the Android ROM. The Android ROM is flashed with the Android OS and holds all OS files needed to run the device.

A user who is not happy with the default OS can install a customised Android OS. This is called flashing a ROM, and the result is a custom ROM.

Why install a custom ROMSearch on YouTubeBookmarkSaved

• Get the latest Android version on a phone the manufacturer has abandoned
• Remove bloatware (unneeded preinstalled apps)
• Performance boost (optimised kernel, fewer background services)
• Better security and privacy
• More customisation
• Root access support

Stock recoverySearch on YouTubeBookmarkSaved

The recovery partition holds the stock recovery. It is a tiny program with limited options. It deletes all user data and files, or performs system updates.

• A factory reset boots into recovery, which erases files and data.
• A system OS update ("restart to install") moves into recovery mode.
• Enter recovery with a key combination (Volume Up + Power) or with the command below.

adb reboot recovery

A custom recovery is a modified, GUI-based recovery from different makers, with more functions.

Custom RecoverySearch on YouTubeBookmarkSaved

Flashing a custom recovery replaces the stock recovery with a third-party recovery environment. It can be done with adb from a PC.

• The phone should be rooted to flash a custom recovery. For that, the bootloader must be unlocked.
• Reason to do it: to install a custom ROM.
• Known custom recoveries: ClockworkMod Recovery and TeamWin Recovery Project (TWRP).

The slides show the TWRP menu (Install, Wipe, Backup, Restore, Mount, Settings, Advanced, Reboot). ClockworkMod shows "reboot system now", "install zip from sdcard", "wipe data/factory reset", "wipe cache partition" and "backup and restore".

Fastboot ModeSearch on YouTubeBookmarkSaved

Fastboot is an alternative to recovery mode. It is not available on all phones.

• In fastboot, you can flash images to internal memory and modify file system images from a computer over USB.
• Fastboot can start before Android loads, even when Android is not installed at all.
• It is useful for quick firmware updates without recovery mode.

Fastboot is more useful in forensics if the bootloader can be exploited, or if the device allows a temporary boot of a forensic image.

Rooting and JailbreakingSearch on YouTubeBookmarkSaved

• A normal user account has limited privilege.
• The superuser or root account has all privileges. Rooting a phone to gain these privileges runs against the PC forensics rule of not changing the evidence.
• Jailbreaking (iOS) lets you install apps not approved by Apple, that is, unsigned apps.

On a non-rooted phone, you cannot get the /data/data partition, the system partition or deleted data.

Does rooting affect evidence integrity?Search on YouTubeBookmarkSaved

• Use valid rooting techniques only.
• Tools such as UFED and XRY use exploits for temporary rooting. They push a script into the phone's RAM.
• The exploit is not written to phone memory (only RAM). So it does not alter the integrity of the evidence.

Permanent root vs temporary rootSearch on YouTubeBookmarkSaved

Implications of rootingSearch on YouTubeBookmarkSaved

• Security risk: no sandboxing
• Bricking of the device
• Warranty void
• Forensic implications (evidence may change)

Locked and Unlocked BootloadersSearch on YouTubeBookmarkSaved

• The bootloader must be unlocked to root and to run a recovery image.
• Unlocking the bootloader can have serious security implications.
• A locked bootloader blocks changes to the device firmware. It checks a cryptographic signature (signed by the OEM). Unsigned code, such as a custom ROM, cannot be flashed.
• Unlocking the bootloader triggers a factory reset. All data is erased.
• Some manufacturers provide unlocking software on their official website. Steps differ per phone.

Exploits and ForensicsSearch on YouTubeBookmarkSaved

On many modern devices with Secure Boot (Android Verified Boot, AVB):

• The bootloader refuses to boot an unsigned or custom image unless it is unlocked.
• So forensic vendors (Magnet, Cellebrite) often use bootloader exploits to bypass signature checks without triggering a wipe.
• In some cases they get OEM-signed special images, for example Samsung "Engineering Bootloaders". These bypass signature checks legitimately. This is not an exploit; it is a backdoor arrangement with the OEM.

Quick self-testSearch on YouTubeBookmarkSaved