21

Is there any way to boot an Android phone* from a bus-powered USB drive**? If so, what are the steps to achieve this?

* E.g. one with USB OTG functionality.

** E.g. a flash drive.

3 Answers 3

26
+50

Please clarify what is the intended goal and why?

Android phones have their own boot-loaders and cannot be overridden by other means.

It is not like a PC's BIOS where you can switch the ordering of boot to boot from certain devices such as Network PXE, USB, Primary/Secondary H.D.D...

Edit:

After the comments below, and in relation to the OP's question

Is there any way to boot an Android phone (E.g. one with USB OTG functionality.) via way of a bus-powered USB drive

The generic boot-loader (*which resides on the chip-set) has no knowledge of USB etc, as the lk (Little Kernel) is more concerned about trapping keystrokes in order to chain-load into recovery or to boot directly into Android environment (When holding Vol+Down key in this instance) - in pseudo-code (this is from the context/aspect of lk, and also, the memory addresses pertaining to how to read the partitions are hard-coded into this lk so it will know how to process the logic!)

The lk kernel is the de-facto standard by Qualcomm for MSM chipsets (Snapdragon) and adopted by manufacturers such as Sony, Motorola, LG, Samsung and can be found in the AOSP source under bootable/bootloader.

if (Is Volume Down key pressed?) then

  • chain-load kernel from /recovery partition into particular address in memory and jump to it and start execution, in bringing up the recovery environment

else

  • chain-load kernel from /system partition into particular address in memory and jump to it and start execution in bringing up the Android environment.

end if.

As the kernel within lk is pretty limited, considering that the binary image of the kernel is burned into the chip and therefore no way of modifying it. And also should be mentioned that lk contains the fastboot protocol in preparation for flashing /boot, /recovery, /system and /data partitions. There are two sequences to boot, primary boot and secondary boot as it is:

  • Primary Boot -> lk (depending on outcome of logic)
  • Go into Secondary Boot -> /boot or /recovery

Side note: Samsung is fond of the PBL/SBL (Which is Primary Boot Loader and Secondary Boot Loader respectively) in their jargon when it comes to modding. Thing about Samsung, is that, in some handsets, PBL and SBL may be encrypted (Samsung Wave GT-S8500 is one such example, where porting Android to it was nearly impossible to do because of the DRM within the boot loaders which was a nightmare to deal with and made modding it extremely difficult, nonetheless, it is sort of working via an exploit in the FOTA code!)

This is why there are no extra facilities such as OTG functionality or anything else such as serial communications, reading from SDCard, graphics etc as it would make the lk kernel bigger than is intended. In other words, it is the smallest possible size of kernel that is designated to do just the above pseudo-code happen.

Also, another way of looking at it is this, and this is dependent on the Android version - the USB OTG functionality is fully brought up within the Android environment, i.e when the familiar home screen appears, then OTG's functionality is enabled. Unfortunately not the case when looking at it from lk's perspective.

If you're curious, here's the Qualcomm entry on the above lk which is a part of the tiny C source that has ARM assembly included and found in JellyBean's AOSP source in bootable/bootloader/legacy/usbloader/main.c

int boot_linux_from_flash(void)
{
    boot_img_hdr *hdr = (void*) raw_header;
    unsigned n;
    ptentry *p;
    unsigned offset = 0;
    const char *cmdline;

    if((p = flash_find_ptn("boot")) == 0) {
        cprintf("NO BOOT PARTITION\n");
        return -1;
    }

    if(flash_read(p, offset, raw_header, 2048)) {
        cprintf("CANNOT READ BOOT IMAGE HEADER\n");
        return -1;
    }
    offset += 2048;
    
    if(memcmp(hdr->magic, BOOT_MAGIC, BOOT_MAGIC_SIZE)) {
        cprintf("INVALID BOOT IMAGE HEADER\n");
        return -1;
    }

    n = (hdr->kernel_size + (FLASH_PAGE_SIZE - 1)) & (~(FLASH_PAGE_SIZE - 1));
    if(flash_read(p, offset, (void*) hdr->kernel_addr, n)) {
        cprintf("CANNOT READ KERNEL IMAGE\n");
        return -1;
    }
    offset += n;

    n = (hdr->ramdisk_size + (FLASH_PAGE_SIZE - 1)) & (~(FLASH_PAGE_SIZE - 1));
    if(flash_read(p, offset, (void*) hdr->ramdisk_addr, n)) {
        cprintf("CANNOT READ RAMDISK IMAGE\n");
        return -1;
    }
    offset += n;
    
    dprintf("\nkernel  @ %x (%d bytes)\n", hdr->kernel_addr, hdr->kernel_size);
    dprintf("ramdisk @ %x (%d bytes)\n\n\n", hdr->ramdisk_addr, hdr->ramdisk_size);

    if(hdr->cmdline[0]) {
        cmdline = (char*) hdr->cmdline;
    } else {
        cmdline = board_cmdline();
        if(cmdline == 0) {
            cmdline = "mem=50M console=null";
        }
    }
    cprintf("cmdline = '%s'\n", cmdline);
    
    cprintf("\nBooting Linux\n");

    create_atags(ADDR_TAGS, cmdline,
                 hdr->ramdisk_addr, hdr->ramdisk_size);
    
    boot_linux(hdr->kernel_addr);
    return 0;
}
13
  • Chicken/egg issue here: I wanted an answer to my question in order to narrow down use cases based upon feasibility; you are asking me to give use cases first :) So, I can only clarify my goal(s) vaguely for now. One might be to achieve sth like full disk encryption by booting from a hardware-encrypted USB drive (Lok-It/dataShur/etc),so that entering a passcode on the drive obviates the need to enter a decryption password on the Android device. Ideally this could be done such that, once the phone is booted, the drive could be removed, leaving the phone still running fine until next reboot.
    – user15074
    Mar 11, 2013 at 9:05
  • Right... Interesting - never heard of such case like that - anyway - why? Food for thought, where would you enter a such passcode? Android ICS upwards have the capability to encrypt the entire volume IIRC - Have you not looked into that?
    – t0mm13b
    Mar 11, 2013 at 14:23
  • The passcode would be entered using the keypad built in to the drive. (If you don't know what I mean by this, look up the drives I mentioned.) And yes, I've looked into Android's built-in encryption, but (a) it is not without drawbacks (see, e.g. security.stackexchange.com/q/10529; v.gd/6hOcmd), (b) it does not work on all phones, even those that have ICS+ ROMs available from the manufacturers (e.g. some Xperia models), and (c) there are other potential use cases for which being able to boot a phone/tablet from a USB mass storage device would be desirable.
    – user15074
    Mar 11, 2013 at 15:35
  • To be quite frank, that is not achievable, for a start there is no such smartphone bootloader that will simply , from high level perspective, "pause" until a passcode is entered! What you're asking for is above and beyond this forum and requires specialized, if not, niche arena of custom bootloaders to achieve this! For a start - the generic bootloader, lk (its in AOSP under bootable/bootloader) is adopted as de-facto by Qualcomm for their chipsets which is used by the likes of Sony, LG, Motorola, to name but a few... just saying, the question is not constructive!
    – t0mm13b
    Mar 11, 2013 at 16:38
  • 2
    In short - there is zero way of doing that, you seem to be forgetting that the emphasis on my comments in relation to the bootloader and the fact that smartphones do not have BIOS's either.... just saying.
    – t0mm13b
    Mar 13, 2013 at 0:37
9

It is possible in a sense, however. Given the limitations mentioned in @t0mm13b 's answer, it makes sense that the mentioned boot loader (lk) is incapable of doing this. So, we boot a custom kernel from fastboot (for testing), which boots, enables OTG functionality and once a valid kernel is found on the OTG device which is connected, chainloads that into memory and passes control to it. This could probably even be integrated into modern custom recoveries like TWRP which have both OTG and (in some cases) MultiROM support.

This has actually been used to boot Ubuntu on a Nexus 9 tablet, using the method:

  1. fastboot boot <otg_chainloader_kernel>
  2. <otg_chainloader_kernel> boots and enables OTG and waits for OTG device to be connected.
  3. Device is disconnected from PC and USB flash drive having bootable Ubuntu image is connected to it via OTG.
  4. <otg_chainloader_kernel> detects a valid Linux kernel on the OTG device and passes control to it after chainloading it into memory.

Now, if you wanted to, you could boot a compatible Android ROM image in a similar way, but remember that the OTG drive would have to be kept connected to the device until you decide to return to the native OS (since all apps would load from, and all data would be written to the USB flash drive, unless the entire Android ROM could be configured as a ramdisk (ever heard of Puppy Linux?), which, given the current memory capacities of common Android devices and the size of the ROM itself is currently impractical). That precludes charging while booted to OTG OS, too, on most devices with unified data/charger ports.

Source: XDA-Developers Nexus 9 subforum

3
  • Could it be possible to do this for Android so I can boot the N preview without installing
    – Suici Doga
    May 24, 2016 at 2:43
  • @SuiciDoga, I guess TWRP MultiROM supports OTG Boot? It uses the above technique AFAIK, just without all the fastboots. The kexec-hardboot patch for the kernel used by TWRP MultiROM is basically the OTG-Chainloader-Kernel I talk about. May 24, 2016 at 17:11
  • Now that also depends on what device you might want to try this exercise on. The Nexus 9 and Nexus Player do have TWRP, but the MultiROM thing doesn't work on them (x64/ARM64 issues?). IDK about the current Nexii, too. May 24, 2016 at 17:14
0

its posible and i did it on my acer iconia tablet!!!!

connect a flash drive to your pc and format to fat32 use rufus to port the iso/dd to your flash drive

connect it to otg and into your phone/tablet.. hold the power key and tap volume down if it doesnt boot try holding the power key and tap the volume up

then using volume keys move over to UDisk (your flash drive brand) or SATA; UDISK (it doesnt have to be your usb brand, it can say usb storage) and click the power key to confirm

well, i had sevior trouble with booting into the menu, so i somehow managed to avoid the kernel to boot and by that stop the android to boot

i think it was like this : i connected to the pc, then deleted all the assects from the tablet, but copying Android folder

kernel was removed and after boot connected back to the pc with a usb hub

well hope i helped :)

1
  • 2
    That must be some exceptional SoC, might be supporting UEFI. Not many SoCs used these days in Android devices let you configure boot order. Jan 13, 2020 at 23:19

You must log in to answer this question.