Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
Booting process of Android devices
open-in-new
<h2 id="background">Background</h2> <p>As of 2018, 90% of the SoCs of the Android market are supplied by either <a href="/facts/Qualcomm/v54S3UgA">Qualcomm</a>, <a href="/facts/Samsung_Electronics/STxnmHwl">Samsung</a> or <a href="/facts/MediaTek/X0yoLa9D">MediaTek</a>.<a class="footnote-ref" id="fnref:2" href="#fn:2"><sup>2</sup></a> Other vendors include <a href="/facts/Rockchip/JlnnEBnY">Rockchip</a>, <a href="/facts/Marvell_Technology%2c_Inc./IPlIhlj5">Marvell</a>, <a href="/facts/Nvidia/8QfCgqbu">Nvidia</a> and previously <a href="/facts/Texas_Instruments/88NUhuHF">Texas Instruments</a>. </p> <h2 id="history">History</h2> <p>Verified boot, a <a href="/facts/Booting/j6N1kRpc">booting security measure</a>, was introduced with <a href="/facts/Android_KitKat/se2EeAYb">Android KitKat</a>.<a class="footnote-ref" id="fnref:3" href="#fn:3"><sup>3</sup></a> </p> <h2 id="stages">Stages</h2> <h3>Primary Bootloader</h3> <p>The Primary Bootloader (PBL), which is stored in the <a href="/facts/Boot_ROM/j6N1kRpc">Boot ROM</a><a class="footnote-ref" id="fnref:4" href="#fn:4"><sup>4</sup></a> is the first stage of the boot process. This code is written by the chipset manufacturer.<a class="footnote-ref" id="fnref:5" href="#fn:5"><sup>5</sup></a> </p><p>The PBL verifies the authenticity of the next stage. </p><p>On Samsung smartphones, the Samsung Secure Boot Key (SSBK) is used by the boot ROM to verify the next stages.<a class="footnote-ref" id="fnref:6" href="#fn:6"><sup>6</sup></a> </p><p>On SoCs from Qualcomm, it is possible to enter the <a href="/facts/Qualcomm_Emergency_Download_Mode/zbS9yqcJ">Qualcomm Emergency Download Mode</a> from the primary bootloader. </p><p>If the verification of the secondary bootloader fails, it will enter EDL.<a class="footnote-ref" id="fnref:7" href="#fn:7"><sup>7</sup></a><a class="footnote-ref" id="fnref:8" href="#fn:8"><sup>8</sup></a> </p> <h3>Secondary Bootloader</h3> <p>Because the space in the boot ROM is limited, a secondary bootloader on the <a href="/facts/EMMC/KGkRkvIY">eMMC</a> or <a href="/facts/EUFS/6rMM97T4">eUFS</a> is used.<a class="footnote-ref" id="fnref:9" href="#fn:9"><sup>9</sup></a> The secondary bootloader initializes <a href="/facts/TrustZone/SALsYA79">TrustZone</a>.<a class="footnote-ref" id="fnref:10" href="#fn:10"><sup>10</sup></a><a class="footnote-ref" id="fnref:11" href="#fn:11"><sup>11</sup></a> </p><p>On the Qualcomm MSM8960 for example, the Secondary Bootloader 1 loads the Secondary Bootloader 2. The Secondary Bootloader 2 loads TrustZone and the Secondary Bootloader 3.<a class="footnote-ref" id="fnref:12" href="#fn:12"><sup>12</sup></a> </p><p>The SBL is now called XBL by Qualcomm which is an <a href="/facts/UEFI/w86VGmy2">UEFI</a> implementation. </p><p>Qualcomm uses LK (Little Kernel) plus Aboot, or XBL (eXtensible Bootloader) plus ABL; Samsung Exynos uses S-Boot; MediaTek uses <a href="/facts/Das_U-Boot/ePTYfLk1">Das U-Boot</a>.<a class="footnote-ref" id="fnref:13" href="#fn:13"><sup>13</sup></a> Little Kernel is a <a href="/facts/Microkernel/wsaWtYCU">microkernel</a> for <a href="/facts/Embedded_system/a4muX1wU">embedded devices</a>, which has been modified by Qualcomm to use it as a bootloader.<a class="footnote-ref" id="fnref:14" href="#fn:14"><sup>14</sup></a> The Android Bootloader (Aboot or ABL) implements the <a href="/facts/Fastboot/YbRy4PhP">fastboot</a> interface. It verifies the authenticity of the boot and recovery partitions.<a class="footnote-ref" id="fnref:15" href="#fn:15"><sup>15</sup></a> By pressing a specific key combination, devices can also boot in <a href="/facts/Android_recovery_mode/qcKhovcW">recovery mode</a>. Android Bootloader then transfers control to the Linux kernel. </p> <h3>Kernel and initramfs</h3> <p class="note">See also: <a href="/facts/Booting_process_of_Linux/Ur532Lqz">Booting process of Linux</a></p> <p>The initramfs is a <a href="/facts/Gzip/H23uqvyx">gzipped</a> <a href="/facts/Cpio/ylj9ArS3">cpio</a> archive that contains a small root file system. It contains init, which is executed. The Android kernel is a modified version of the Linux kernel. Init does mount the partitions. dm-verity verifies the integrity of the partitions that are specified in the fstab file. dm-verity is a Linux kernel module that was introduced by Google in Android since version 4.4. The stock implementation only supports block based verification, but Samsung has added support for files.<a class="footnote-ref" id="fnref:16" href="#fn:16"><sup>16</sup></a> </p> <h3>Zygote</h3> <p class="note">See also: <a href="/facts/Bionic_(software)/xXucrnRG">Bionic (software) § Components</a></p> <p>Zygote is spawned by the init process, which is responsible for starting Android applications and service processes. It loads and initializes classes that are supposed to be used very often into the heap. For example, dex data structures of libraries. After Zygote has started, it listens for commands on a socket. When a new application is to be started, a command is sent to Zygote which executes a <a href="/facts/Fork_(system_call)/M1jtvaT4">fork()</a> system call. </p> <h2 id="partition-layout">Partition layout</h2> <p>The Android system is divided across different <a href="/facts/Disk_partitioning/wrBk5RRS">partitions</a>.<a class="footnote-ref" id="fnref:17" href="#fn:17"><sup>17</sup></a> </p><p>The Qualcomm platform makes use of the <a href="/facts/GUID_partition_table/Tbj7cPSs">GUID partition table</a>. This specification is part of the <a href="/facts/UEFI/w86VGmy2">UEFI</a> specification, but does not depend on UEFI firmware.<a class="footnote-ref" id="fnref:18" href="#fn:18"><sup>18</sup></a> </p> <h2 id="see-also">See also</h2> <ul><li><a href="/facts/Coreboot/GIeazmzw">coreboot</a></li> <li><a href="/facts/Booting_process_of_Windows/xAA6QMEY">Booting process of Windows</a></li></ul> <h2 id="explanatory-notes">Explanatory notes</h2> <h2 id="external-links">External links</h2> <ul><li><a href="https://source.android.com/security/verifiedboot/boot-flow">Android.com - Boot Flow</a></li> <li><a href="https://source.android.com/devices/automotive/power/boot_time">Managing Boot Time</a></li> <li><a href="https://osg.wiki/books/all-about-deados/page/qualcomm-bootloaders">Qualcomm Bootloaders</a></li> <li><a href="https://lineageos.org/engineering/Qualcomm-Firmware/">Qualcomm's Chain of Trust</a></li> <li><a href="https://www.qualcomm.com/media/documents/files/secure-boot-and-image-authentication-technical-overview-v2-0.pdf">Secure Boot and Image Authentication</a></li> <li><a href="https://www.timesys.com/security/secure-boot-snapdragon-410/">Secure boot on Snapdragon 410</a></li> <li><a href="https://blog.quarkslab.com/analysis-of-qualcomm-secure-boot-chains.html">Analysis of Qualcomm Secure Boot Chains</a></li> <li><a href="https://github.com/msm8916-mainline/qhypstub">msm8916-mainline/qhypstub</a></li> <li><a href="https://dev.to/larsonzhong/android-system-init-process-startup-and-init-rc-full-analysis-22hi">Android system init process startup and init.rc full analysis</a></li> <li><a href="https://android.googlesource.com/platform/system/core/+/master/init/README.md">Android Init Language</a></li></ul> <h2 id="references">References</h2> <ol> <li id="fn:1"><p>These modes tend to support a feature to resume regular booting <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li> <li id="fn:2"><p>Garri, Khireddine; Kenaza, Tayeb; Aissani, Mohamed (October 2018). "A Novel approach for bootkit detection in Android Platform". 2018 International Conference on Smart Communications in Network Technologies (SaCoNeT). IEEE. pp. 277–282. doi:10.1109/saconet.2018.8585583. ISBN 978-1-5386-9493-0. S2CID 56718094. <a href="978-1-5386-9493-0" target="_blank">978-1-5386-9493-0</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li> <li id="fn:3"><p>"Android Verified Boot [LWN.net]". LWN.net. Archived from the original on 2015-04-22. Retrieved 2021-09-25. <a href="https://lwn.net/Articles/638627/" target="_blank">https://lwn.net/Articles/638627/</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li> <li id="fn:4"><p>Yuan, Pengfei; Guo, Yao; Chen, Xiangqun; Mei, Hong (March 2018). "Device-Specific Linux Kernel Optimization for Android Smartphones". 2018 6th IEEE International Conference on Mobile Cloud Computing, Services, and Engineering (MobileCloud). pp. 65–72. doi:10.1109/MobileCloud.2018.00018. ISBN 978-1-5386-4879-7. S2CID 13742883. <a href="978-1-5386-4879-7" target="_blank">978-1-5386-4879-7</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li> <li id="fn:5"><p>Hay, Roee (2017-08-14). "fastboot oem vuln: android bootloader vulnerabilities in vendor customizations". Proceedings of the 11th USENIX Conference on Offensive Technologies. WOOT'17. Vancouver, BC, Canada: USENIX Association: 22. <a href="https://dl.acm.org/doi/10.5555/3154768.3154790" target="_blank">https://dl.acm.org/doi/10.5555/3154768.3154790</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li> <li id="fn:6"><p>Alendal, Gunnar; Dyrkolbotn, Geir Olav; Axelsson, Stefan (2018-03-01). "Forensics acquisition — Analysis and circumvention of samsung secure boot enforced common criteria mode". Digital Investigation. 24: S60 – S67. doi:10.1016/j.diin.2018.01.008. hdl:11250/2723051. ISSN 1742-2876. <a href="https://www.sciencedirect.com/science/article/pii/S1742287618300409" target="_blank">https://www.sciencedirect.com/science/article/pii/S1742287618300409</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></p></li> <li id="fn:7"><p>"Exploiting Qualcomm EDL Programmers (1): Gaining Access & PBL Internals". alephsecurity.com. 2018-01-22. Retrieved 2021-09-13. <a href="https://alephsecurity.com/2018/01/22/qualcomm-edl-1/" target="_blank">https://alephsecurity.com/2018/01/22/qualcomm-edl-1/</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></p></li> <li id="fn:8"><p>"Qualcomm Documentation". Retrieved February 26, 2025. <a href="https://docs.qualcomm.com/bundle/publicresource/topics/80-70014-254/flash_images_unregistered.html#move-to-edl-mode" target="_blank">https://docs.qualcomm.com/bundle/publicresource/topics/80-70014-254/flash_images_unregistered.html#move-to-edl-mode</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></p></li> <li id="fn:9"><p>Yuan, Pengfei; Guo, Yao; Chen, Xiangqun; Mei, Hong (March 2018). "Device-Specific Linux Kernel Optimization for Android Smartphones". 2018 6th IEEE International Conference on Mobile Cloud Computing, Services, and Engineering (MobileCloud). IEEE. pp. 65–72. doi:10.1109/mobilecloud.2018.00018. ISBN 978-1-5386-4879-7. S2CID 13742883. <a href="978-1-5386-4879-7" target="_blank">978-1-5386-4879-7</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></p></li> <li id="fn:10"><p>Yuan, Pengfei; Guo, Yao; Chen, Xiangqun; Mei, Hong (March 2018). "Device-Specific Linux Kernel Optimization for Android Smartphones". 2018 6th IEEE International Conference on Mobile Cloud Computing, Services, and Engineering (MobileCloud). IEEE. pp. 65–72. doi:10.1109/mobilecloud.2018.00018. ISBN 978-1-5386-4879-7. S2CID 13742883. <a href="978-1-5386-4879-7" target="_blank">978-1-5386-4879-7</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></p></li> <li id="fn:11"><p>Kanonov, Uri; Wool, Avishai (2016-10-24). "Secure Containers in Android". Proceedings of the 6th Workshop on Security and Privacy in Smartphones and Mobile Devices. SPSM '16. New York, NY, USA: ACM. pp. 3–12. doi:10.1145/2994459.2994470. ISBN 9781450345644. S2CID 8510729. <a href="9781450345644" target="_blank">9781450345644</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></p></li> <li id="fn:12"><p>Tao, Chen, Yue Zhang, Yulong Wang, Zhi Wei (2017-07-17). Downgrade Attack on TrustZone. OCLC 1106269801.{{cite book}}: CS1 maint: multiple names: authors list (link) <a href="http://worldcat.org/oclc/1106269801" target="_blank">http://worldcat.org/oclc/1106269801</a> <a href="#fnref:12" class="footnote-back-ref">↩</a></p></li> <li id="fn:13"><p>Garri, Khireddine; Kenaza, Tayeb; Aissani, Mohamed (October 2018). "A Novel approach for bootkit detection in Android Platform". 2018 International Conference on Smart Communications in Network Technologies (SaCoNeT). IEEE. pp. 277–282. doi:10.1109/saconet.2018.8585583. ISBN 978-1-5386-9493-0. S2CID 56718094. <a href="978-1-5386-9493-0" target="_blank">978-1-5386-9493-0</a> <a href="#fnref:13" class="footnote-back-ref">↩</a></p></li> <li id="fn:14"><p>Tang, Qinghao (2021). Internet of things security: principles and practice. Fan Du. Singapore. p. 166. ISBN 978-981-15-9942-2. OCLC 1236261208.{{cite book}}: CS1 maint: location missing publisher (link) <a href="978-981-15-9942-2" target="_blank">978-981-15-9942-2</a> <a href="#fnref:14" class="footnote-back-ref">↩</a></p></li> <li id="fn:15"><p>Hay, Roee (2017-08-14). "fastboot oem vuln: android bootloader vulnerabilities in vendor customizations". Proceedings of the 11th USENIX Conference on Offensive Technologies. WOOT'17. Vancouver, BC, Canada: USENIX Association: 22. <a href="https://dl.acm.org/doi/10.5555/3154768.3154790" target="_blank">https://dl.acm.org/doi/10.5555/3154768.3154790</a> <a href="#fnref:15" class="footnote-back-ref">↩</a></p></li> <li id="fn:16"><p>Kanonov, Uri; Wool, Avishai (2016-10-24). "Secure Containers in Android". Proceedings of the 6th Workshop on Security and Privacy in Smartphones and Mobile Devices. SPSM '16. New York, NY, USA: ACM. pp. 3–12. doi:10.1145/2994459.2994470. ISBN 9781450345644. S2CID 8510729. <a href="9781450345644" target="_blank">9781450345644</a> <a href="#fnref:16" class="footnote-back-ref">↩</a></p></li> <li id="fn:17"><p>Alendal, Gunnar; Dyrkolbotn, Geir Olav; Axelsson, Stefan (March 2018). "Forensics acquisition — Analysis and circumvention of samsung secure boot enforced common criteria mode". Digital Investigation. 24: S60 – S67. doi:10.1016/j.diin.2018.01.008. hdl:11250/2723051. ISSN 1742-2876. <a href="https://dx.doi.org/10.1016/j.diin.2018.01.008" target="_blank">https://dx.doi.org/10.1016/j.diin.2018.01.008</a> <a href="#fnref:17" class="footnote-back-ref">↩</a></p></li> <li id="fn:18"><p>Zhao, Longze; Xi, Bin; Wu, Shunxiang; Aizezi, Yasen; Ming, Daodong; Wang, Fulin; Yi, Chao (2018). "Physical Mirror Extraction on Qualcomm-based Android Mobile Devices". Proceedings of the 2nd International Conference on Computer Science and Application Engineering. Csae '18. New York, New York, USA: ACM Press. pp. 1–5. doi:10.1145/3207677.3278046. ISBN 9781450365123. S2CID 53038902. <a href="9781450365123" target="_blank">9781450365123</a> <a href="#fnref:18" class="footnote-back-ref">↩</a></p></li> </ol>