4

I'm in the process of unofficial device bringup, and I'm stuck unable to progress due to Android Verified Boot. As per specification Android Verified Boot can be disabled with the --disable-verity and --disable-verification flags. The device I'm working with does not conform to specification and hence is unable to disable Android Verified Boot. One of the solutions is to build a vbmeta image myself which will then be used to verify my custom generated boot image. The question at hand is how to properly generate such an image. The documentation on the topic is exceedingly scarce and looking up similar community made files with a hex editor yields little in terms of information for me. As mentioned here, I should be able to generate one with the avbtool, which I did, very likely wrongly, as it still refuses to even flash it via fastboot. The only way I've found of allowing such a thing is to flash a blank vbmeta image, which in term fails to verify the kernel and fails.

1
  • from my understanding the flags you mentioned are only used during fastboot to allow flash modified partition, not for disable fastboot flash --disable-verity --disable-verification vbmeta vbmeta.bin github.com
    – alecxs
    Jan 4 '20 at 13:43
5

In this page there is a section called 'Disabling verified boot' that mentions a commands to create an empty vbmeta.img that can be used to disable verified boot : https://wiki.postmarketos.org/wiki/Android_Verified_Boot_(AVB)

That command is,

$ avbtool make_vbmeta_image --flags 2 --padding_size 4096 --output vbmeta_disabled.img

To ensure this, I searched for 'make_vbmeta_image' in AOSP repositories and found a similar command in here.

I have an Android Q AOSP source tree with me. So I used avbtool from it to create an empty vbmeta image by issuing following commands.

$ cd <aosp_root_dir>
$ ./external/avb/avbtool make_vbmeta_image --flag 2 --padding_size 4096 --output ./vbmeta_disabled.img
$ ls -l ./vbmeta_disabled.img

As instructed here, to flash vbmeta image you can first boot your device to fastboot mode, unlock device's bootloader, and use following command.

$ fastboot --disable-verification flash vbmeta vbmeta_disabled.img
4
  • 1
    Accepted as correct answer as it answers the main question "How to generate vbmeta image". The secondary question of my device not implementing the disable flags still remains but I guess I'll open a new question for it specifically. Thanks
    – Nexrem
    May 2 '20 at 15:48
  • Is this img device platform related? what if I use other one created img, without build aosp myself.
    – yurenchen
    Nov 2 '20 at 17:53
  • 1
    @yurenchen afaik it doesn't matter but it may differ on device model
    – alecxs
    Nov 19 '20 at 10:40
  • 1
    @alecxs thanks, I use the avbtool.py (choice tool version according to device android version), it works well. android.googlesource.com/platform/external/avb/+/master/…
    – yurenchen
    Nov 19 '20 at 17:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.