As I understand in Nougat and greater the system has two full partitions, one currently used and the second one that is used for upgrading. So during an upgrade the new bits are laid down on the secondary partition which will be made the primary to boot from the upgraded partition. My question is how does it prevent from booting from the original partition? Where is the information that determines which partition to boot from written/stored? How does it prevent an attacker from modifying it?
- From AOSP A/B (Seamless) System Updates
update_enginewith the HTTPS URL for your update package....
... If the update is applied successfully,
update_enginewill tell the bootloader to boot into the new OS on the next reboot....
So, you are looking at action being taken at boot loader level. And if you mess at that level dm-verity will kick in which is a kernel level protection that can't be tampered with once device leaves factory
If verification fails, the device generates an I/O error indicating the block cannot be read. It will appear as if the filesystem has been corrupted, as is expected.
With a custom recovery
dm.verity can be disabled but then OTA will fail because it detects recovery change and frankly, if an attacker can gain root access, the device is pretty much their's
Edit: See this for more details A/B (Seamless) update device questions