Booting process of Android devices

百度本次征集到的案例鲜活生动，示范性强，集中反映了这方面的成果和经验，是全面从严治党向基层延伸的一次全面生动的展示。

The booting process of Android devices starts at the power-on of the SoC (system on a chip) and ends at the visibility of the home screen, or special modes like recovery and fastboot.^[a] The boot process of devices that run Android is influenced by the firmware design of the SoC manufacturers.

Background

As of 2018, 90% of the SoCs of the Android market are supplied by either Qualcomm, Samsung or MediaTek.^[1] Other vendors include Rockchip, Marvell, Nvidia and previously Texas Instruments.

History

Verified boot, a booting security measure, was introduced with Android KitKat.^[2]

Stages

Primary Bootloader

The Primary Bootloader (PBL), which is stored in the Boot ROM^[3] is the first stage of the boot process. This code is written by the chipset manufacturer.^[4]

The PBL verifies the authenticity of the next stage.

On Samsung smartphones, the Samsung Secure Boot Key (SSBK) is used by the boot ROM to verify the next stages.^[5]

On SoCs from Qualcomm, it is possible to enter the Qualcomm Emergency Download Mode from the primary bootloader.

If the verification of the secondary bootloader fails, it will enter EDL.^[6]^[7]

Secondary Bootloader

Because the space in the boot ROM is limited, a secondary bootloader on the eMMC or eUFS is used.^[8] The secondary bootloader initializes TrustZone.^[8]^[9]

On the Qualcomm MSM8960 for example, the Secondary Bootloader 1 loads the Secondary Bootloader 2. The Secondary Bootloader 2 loads TrustZone and the Secondary Bootloader 3.^[10]

The SBL is now called XBL by Qualcomm which is an UEFI implementation.

Qualcomm uses LK (Little Kernel) plus Aboot, or XBL (eXtensible Bootloader) plus ABL; Samsung Exynos uses S-Boot; MediaTek uses Das U-Boot.^[1] Little Kernel is a microkernel for embedded devices, which has been modified by Qualcomm to use it as a bootloader.^[11] The Android Bootloader (Aboot or ABL) implements the fastboot interface. It verifies the authenticity of the boot and recovery partitions.^[4] By pressing a specific key combination, devices can also boot in recovery mode. Android Bootloader then transfers control to the Linux kernel.

Kernel and initramfs

The initramfs is a gzipped cpio archive that contains a small root file system. It contains init, which is executed. The Android kernel is a modified version of the Linux kernel. Init does mount the partitions. dm-verity verifies the integrity of the partitions that are specified in the fstab file. dm-verity is a Linux kernel module that was introduced by Google in Android since version 4.4. The stock implementation only supports block based verification, but Samsung has added support for files.^[9]

Zygote

Zygote is spawned by the init process, which is responsible for starting Android applications and service processes. It loads and initializes classes that are supposed to be used very often into the heap. For example, dex data structures of libraries. After Zygote has started, it listens for commands on a socket. When a new application is to be started, a command is sent to Zygote which executes a fork() system call.^{[citation needed]}

Partition layout

The Android system is divided across different partitions.^[12]

The Qualcomm platform makes use of the GUID partition table. This specification is part of the UEFI specification, but does not depend on UEFI firmware.^[13]

Explanatory notes

^ These modes tend to support a feature to resume regular booting

References

^ ^a ^b Garri, Khireddine; Kenaza, Tayeb; Aissani, Mohamed (October 2018). "A Novel approach for bootkit detection in Android Platform". 2018 International Conference on Smart Communications in Network Technologies (SaCoNeT). IEEE. pp. 277–282. doi:10.1109/saconet.2018.8585583. ISBN 978-1-5386-9493-0. S2CID 56718094.
^ "Android Verified Boot [LWN.net]". LWN.net. Archived from the original on 2025-08-07. Retrieved 2025-08-07.
^ Yuan, Pengfei; Guo, Yao; Chen, Xiangqun; Mei, Hong (March 2018). "Device-Specific Linux Kernel Optimization for Android Smartphones". 2018 6th IEEE International Conference on Mobile Cloud Computing, Services, and Engineering (MobileCloud). pp. 65–72. doi:10.1109/MobileCloud.2018.00018. ISBN 978-1-5386-4879-7. S2CID 13742883.
^ ^a ^b Hay, Roee (2025-08-07). "fastboot oem vuln: android bootloader vulnerabilities in vendor customizations". Proceedings of the 11th USENIX Conference on Offensive Technologies. WOOT'17. Vancouver, BC, Canada: USENIX Association: 22.
^ Alendal, Gunnar; Dyrkolbotn, Geir Olav; Axelsson, Stefan (2025-08-07). "Forensics acquisition — Analysis and circumvention of samsung secure boot enforced common criteria mode". Digital Investigation. 24: S60 – S67. doi:10.1016/j.diin.2018.01.008. hdl:11250/2723051. ISSN 1742-2876.
^ "Exploiting Qualcomm EDL Programmers (1): Gaining Access & PBL Internals". alephsecurity.com. 2025-08-07. Retrieved 2025-08-07.
^ "Qualcomm Documentation". Retrieved February 26, 2025.
^ ^a ^b Yuan, Pengfei; Guo, Yao; Chen, Xiangqun; Mei, Hong (March 2018). "Device-Specific Linux Kernel Optimization for Android Smartphones". 2018 6th IEEE International Conference on Mobile Cloud Computing, Services, and Engineering (MobileCloud). IEEE. pp. 65–72. doi:10.1109/mobilecloud.2018.00018. ISBN 978-1-5386-4879-7. S2CID 13742883.
^ ^a ^b Kanonov, Uri; Wool, Avishai (2025-08-07). "Secure Containers in Android". Proceedings of the 6th Workshop on Security and Privacy in Smartphones and Mobile Devices. SPSM '16. New York, NY, USA: ACM. pp. 3–12. doi:10.1145/2994459.2994470. ISBN 9781450345644. S2CID 8510729.
^ Tao, Chen, Yue Zhang, Yulong Wang, Zhi Wei (2025-08-07). Downgrade Attack on TrustZone. OCLC 1106269801.{{cite book}}: CS1 maint: multiple names: authors list (link)
^ Tang, Qinghao (2021). Internet of things security: principles and practice. Fan Du. Singapore. p. 166. ISBN 978-981-15-9942-2. OCLC 1236261208.{{cite book}}: CS1 maint: location missing publisher (link)
^ Alendal, Gunnar; Dyrkolbotn, Geir Olav; Axelsson, Stefan (March 2018). "Forensics acquisition — Analysis and circumvention of samsung secure boot enforced common criteria mode". Digital Investigation. 24: S60 – S67. doi:10.1016/j.diin.2018.01.008. hdl:11250/2723051. ISSN 1742-2876.
^ Zhao, Longze; Xi, Bin; Wu, Shunxiang; Aizezi, Yasen; Ming, Daodong; Wang, Fulin; Yi, Chao (2018). "Physical Mirror Extraction on Qualcomm-based Android Mobile Devices". Proceedings of the 2nd International Conference on Computer Science and Application Engineering. Csae '18. New York, New York, USA: ACM Press. pp. 1–5. doi:10.1145/3207677.3278046. ISBN 9781450365123. S2CID 53038902.

External links

[1] These modes tend to support a feature to resume regular booting

[:2-2] Garri, Khireddine; Kenaza, Tayeb; Aissani, Mohamed (October 2018). "A Novel approach for bootkit detection in Android Platform". 2018 International Conference on Smart Communications in Network Technologies (SaCoNeT). IEEE. pp. 277–282. doi:10.1109/saconet.2018.8585583. ISBN 978-1-5386-9493-0. S2CID 56718094.

[3] "Android Verified Boot [LWN.net]". LWN.net. Archived from the original on 2025-08-07. Retrieved 2025-08-07.

[4] Yuan, Pengfei; Guo, Yao; Chen, Xiangqun; Mei, Hong (March 2018). "Device-Specific Linux Kernel Optimization for Android Smartphones". 2018 6th IEEE International Conference on Mobile Cloud Computing, Services, and Engineering (MobileCloud). pp. 65–72. doi:10.1109/MobileCloud.2018.00018. ISBN 978-1-5386-4879-7. S2CID 13742883.

[:3-5] Hay, Roee (2025-08-07). "fastboot oem vuln: android bootloader vulnerabilities in vendor customizations". Proceedings of the 11th USENIX Conference on Offensive Technologies. WOOT'17. Vancouver, BC, Canada: USENIX Association: 22.

[6] Alendal, Gunnar; Dyrkolbotn, Geir Olav; Axelsson, Stefan (2025-08-07). "Forensics acquisition — Analysis and circumvention of samsung secure boot enforced common criteria mode". Digital Investigation. 24: S60 – S67. doi:10.1016/j.diin.2018.01.008. hdl:11250/2723051. ISSN 1742-2876.

[7] "Exploiting Qualcomm EDL Programmers (1): Gaining Access & PBL Internals". alephsecurity.com. 2025-08-07. Retrieved 2025-08-07.

[8] "Qualcomm Documentation". Retrieved February 26, 2025.

[:1-9] Yuan, Pengfei; Guo, Yao; Chen, Xiangqun; Mei, Hong (March 2018). "Device-Specific Linux Kernel Optimization for Android Smartphones". 2018 6th IEEE International Conference on Mobile Cloud Computing, Services, and Engineering (MobileCloud). IEEE. pp. 65–72. doi:10.1109/mobilecloud.2018.00018. ISBN 978-1-5386-4879-7. S2CID 13742883.

[:0-10] Kanonov, Uri; Wool, Avishai (2025-08-07). "Secure Containers in Android". Proceedings of the 6th Workshop on Security and Privacy in Smartphones and Mobile Devices. SPSM '16. New York, NY, USA: ACM. pp. 3–12. doi:10.1145/2994459.2994470. ISBN 9781450345644. S2CID 8510729.

[11] Tao, Chen, Yue Zhang, Yulong Wang, Zhi Wei (2025-08-07). Downgrade Attack on TrustZone. OCLC 1106269801.{{cite book}}: CS1 maint: multiple names: authors list (link)

[12] Tang, Qinghao (2021). Internet of things security: principles and practice. Fan Du. Singapore. p. 166. ISBN 978-981-15-9942-2. OCLC 1236261208.{{cite book}}: CS1 maint: location missing publisher (link)

[13] Alendal, Gunnar; Dyrkolbotn, Geir Olav; Axelsson, Stefan (March 2018). "Forensics acquisition — Analysis and circumvention of samsung secure boot enforced common criteria mode". Digital Investigation. 24: S60 – S67. doi:10.1016/j.diin.2018.01.008. hdl:11250/2723051. ISSN 1742-2876.

[14] Zhao, Longze; Xi, Bin; Wu, Shunxiang; Aizezi, Yasen; Ming, Daodong; Wang, Fulin; Yi, Chao (2018). "Physical Mirror Extraction on Qualcomm-based Android Mobile Devices". Proceedings of the 2nd International Conference on Computer Science and Application Engineering. Csae '18. New York, New York, USA: ACM Press. pp. 1–5. doi:10.1145/3207677.3278046. ISBN 9781450365123. S2CID 53038902.

[a]

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

[11]

[12]

[13]

血氨低是什么原因	才子是什么意思	身上起红斑是什么原因	阴茎瘙痒是什么原因	三多一少指的是什么
自古红颜多薄命是什么意思	甍是什么意思	霍金得了什么病	什么是血脂高	见人说人话见鬼说鬼话是什么意思
津液不足吃什么中成药	漫游是什么	山东特产是什么	中校军衔是什么级别	支气管扩张是什么意思
霉菌孢子是什么意思	成人大便绿色是什么原因	文房四宝指什么	苯磺酸氨氯地平片是什么药	连云港有什么好吃的

结肠是什么病hcv9jop7ns2r.cn	无学历学什么技术好hcv8jop3ns3r.cn	禾花鱼是什么鱼hcv9jop7ns9r.cn	男人吃韭菜有什么好处hcv9jop2ns8r.cn	黑鱼又叫什么鱼hcv9jop8ns0r.cn
尾巴骨疼是什么原因cj623037.com	鱼油什么时间吃最好bjhyzcsm.com	如日中天是什么生肖hcv7jop5ns0r.cn	双眼屈光不正是什么意思hcv8jop9ns4r.cn	公务员是做什么工作的hcv8jop8ns8r.cn
小孩呕吐是什么原因hcv8jop3ns0r.cn	喝酒喝吐了用什么缓解hcv8jop1ns5r.cn	胰腺不舒服是什么症状dayuxmw.com	真空是什么意思hcv9jop4ns9r.cn	健脾胃吃什么食物好hcv9jop5ns1r.cn
大便出血是什么原因hcv9jop3ns0r.cn	r商标是什么意思hcv7jop7ns2r.cn	10月30日什么星座hcv9jop2ns1r.cn	狗狗不吃饭是什么原因hcv8jop7ns6r.cn	梅花是什么颜色hcv8jop1ns4r.cn

掏出手机扫一扫，以后多多关注咸鱼网哦！