I have read a bit about the adb backup format, and it seems quite straight forward.
Is it possible to use
adb backup restore with a specially crafted backup to root a device? If not, why not?
The idea is to restore something to some place on the device that usually could only be there when the device was already rooted. Like the
adb backup service itself. It must run with quite high permissions. So why not restore a special tool with appropiate permissions?