As I understand in Nougat and greater the system has two full partitions, one currently used and the second one that is used for upgrading. So during an upgrade the new bits are laid down on the secondary partition which will be made the primary to boot from the upgraded partition. My question is how does it prevent from booting from the original partition? Where is the information that determines which partition to boot from written/stored? How does it prevent an attacker from modifying it?

1 Answer 1


Call update_engine with the HTTPS URL for your update package....

... If the update is applied successfully, update_engine will tell the bootloader to boot into the new OS on the next reboot....

(Emphasis Supplied)

So, you are looking at action being taken at boot loader level. And if you mess at that level dm-verity will kick in which is a kernel level protection that can't be tampered with once device leaves factory

If verification fails, the device generates an I/O error indicating the block cannot be read. It will appear as if the filesystem has been corrupted, as is expected.

With a custom recovery dm.verity can be disabled but then OTA will fail because it detects recovery change and frankly, if an attacker can gain root access, the device is pretty much their's

Edit: See this for more details A/B (Seamless) update device questions

You must log in to answer this question.