0

This question might seem to be a duplicate of this question but it is different.

But I'd like to have a brief explanation on why we need a custom recovery to flash a ROM. My main points of confusion are:

  1. In stock recovery we have a option to "Install Update from SD card". Why can't we directly flash a ROM from there?

  2. If signature verification is the problem regarding the first point, then how can we root and flash custom recovery using update from SD card?

Why doesn't any signing or verification problem occur while flashing root package or custom recovery package?

Like any other custom ROM package they are also unsigned.

Kindly explain this to me. Thanks.

7
  • 1
    Related android.stackexchange.com/questions/131851/…
    – beeshyams
    Dec 20, 2015 at 6:09
  • @beeshyams Sorry but these are completely different questions. My question is that - How does the stock recovery allow installation of UNSIGNED ROOT AND CUSTOM RECOVERY PACKAGES BUT DOESN'T ALLOW INSTALLATION OF CUSTOM ROM DIRECTLY ? Dec 20, 2015 at 6:15
  • 1
    The stock recovery doesn't allow installation of unsigned packages. Either the premise of your question is flawed or you are confusing your terminology here. Dec 20, 2015 at 6:19
  • @eldarerathis I've read that the stock recovery present in android doesn't allow installation of any package that is not signed by a particular vendor. In case of custom roms, they are unsigned and hence cannot be installed but when we root our phone then we need to flash a "update.zip" file which is again not signed by the device specific vendor so how come they are installed and not custom roms . Dec 20, 2015 at 6:23
  • I just pointed out a related question ..I didn't say duplicate question and please quote where you had read, in your reply above to @elderathis. It would be educative
    – beeshyams
    Dec 20, 2015 at 6:54

1 Answer 1

5

Now, you should be clear on 2 things:

  1. All flashable packages are signed. They can be stock OTA zips, root packages or even custom recovery or ROM zips.

So what is the difference between the "signed" and allegedly "unsigned" packages?

It's in the cryptographic keys used to sign the deployment builds, or the zips in this case.

The "signed" zips, e.g. a stock OTA zip, use a private key specific to the OEM for signing the build. This is a "release" key, and the only type of a key a stock recovery will recognize using its corresponding public key when asked to "Install Update from SD Card".

The "unsigned" zips, e.g. , root packages or custom ROMs, use the publicly known AOSP (Android Open Source Project) private keys for signing the deployment build. Even if the build hasn't been explicitly signed, the test-signing is implicit. Any released device with a stock recovery from the OEM does not have or recognise the public key corresponding to the "test" private key. Hence, it will refuse to install such test-signed or "unsigned" zips.

This is to maintain device integrity and security, at least according to the OEMs.

This is the official source: The Sign Builds for Release Page on the AOSP website.

  1. A custom recovery like CWM or TWRP either disables or provides an option disable (which is usually enabled by default) "ZIP File Signature Verification". This basically implies that it can flash any package, regardless of what keys, test or release, were used to sign the package. To the (stock) recovery, everything is an OTA zip.

So why can some stock recoveries flash a custom recovery zip or root package?

This is probably due to 2 reasons:

  1. The stock recovery has a security vulnerability or exploit, which the flash package uses on being initially loaded to bypass or circumvent the signature verification procedure.

  2. The OEMs private release keys are actually known to the developers of the flashable package, but not to the developers of the ROM. I have personally observed this with Mi and some low-end Samsung devices.

Also, there's another reason a custom recovery is necessary for flashing a custom ROM.

To install the ROM, you must do these steps before actually flashing the ROM zip:

  1. Wipe /data and /cache. On a stock recovery, this amounts to a factory data reset.

  2. Wipe /system. No stock recovery can do this, for obvious reasons (why would a recovery wipe the /system partition if it doesn't support getting it back from somewhere, such as a custom ROM zip?)

  3. Wipe dalvik-cache, usually done after flashing the zip. Again, no stock recovery can do this, but in this case there's no issue with the device getting bricked if the stock recovery did this.

If your stock recovery does not have either of the above 2 "features", you'll need a flashing software which will flash the recovery or ROM images to your phone from your PC. These flashing software use disk image files of the partition to be flashed, and care nothing about whether that that is signed or not. This involves the bootloader of the device, and bypasses the recovery altogether.

Custom recoveries are usually distributed as flashable disk images, not as flashable ZIPs.

A few examples of such software are fastboot(most Android devices), Odin, Heimdall(both for Samsung devices), Smartphone Flash Tool(for Mediatek devices)

Even the bootloader might perform security verifications on the flashed files on some cases, but insofar as much as fastboot is concerned, the bootloader had to have this verification disabled, that is, it needs to be "OEM unlocked"before anything can be flashed to the device. Anyway, the disk images do not contain any signature related metadata in the first place.

11
  • A much much needed answer. Thanks alot. Just one thing I'd like to know now. Suppose I need to root my phone, in order to do that I have a root.zip package(unsigned) which won't get flashed by my stock recovery and so I'll have to now add a custom recovery so that I can flash that root.zip file. Now how do I install a custom recovery because mostly all methods on the internet uses a application "Rom Manager" that needs root privileges. So, isn't this a deadlock now . I want to flash root file but to do that I need custom recovery and to get custom recovery I need root. DEADLOCK. Dec 20, 2015 at 9:48
  • @Tamoghana And one more, Are custom recoveries really flashable directly(*.zip file) or need some other PC software to get installed on the phone. Dec 20, 2015 at 10:04
  • @Shivamaggarwal either you've got a "flashable root ZIP" corectly signed, or you'll need other means to root the device. And to your second question: Depends. Most custom ROMs come as flashable ZIP, and you only need to get that ZIP to your device: you could download it directly without the need of a computer, yes. Others might require specific software (like Odin/Heimdall for Samsung devices).
    – Izzy
    Dec 20, 2015 at 11:48
  • @TamoghnaChowdhury yea that edit helped much and soon I'll accept the answer :) . I'd like to ask that as you mentioned earlier about Mi devices, So mi devices come into which category - fastboot,odin,mediatek device ? Which method do I use to install recovery on my mi device ? Dec 20, 2015 at 14:51
  • Mi devices use fastboot. Old MiUI versions upto v5 had a recovery which allowed the following of a zip which enabled root, post which an app called Flashify could be used to flash any zip or disk image file from the phone itself. There are guides online in how to do this, so I won't bother dealing with it here. I hope you can find it. Dec 20, 2015 at 15:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .