I rooted my Samsung Galaxy Note n7000. I performed some acrobatics and booted into the Stock Recovery of my phone and installed a zip that contained Philz CWM 6 Touch custom recovery. How can installing a custom recovery ROOT my phone when I have no idea of the root password? How can the said custom recovery even gain access to protected system level stuff without requiring some authentication etc. in the first place?
As davidgo explains, the recovery is like a separate, very simple operating system that your device boots into. When you boot into recovery mode, Android itself isn't running, so none of the OS-level protections like users and file permissions make any difference. However, the recovery mode does have access to the main filesystem of your phone. It's normal for a recovery to mount that filesystem to apply updates, but when you're rooting your phone, the update you supply just writes a suitable
su binary to the correct place with the necessary permissions (i.e. with the suid bit set). Then, when you reboot into Android, the
su binary is there and available to use.
If you want to think of it like a PC, it's like booting from a live CD, mounting the root filesystem of the PC, and editing
/etc/passwd to give yourself root access. Of course you can do this from a live CD, because the 'real' operating system on the PC isn't running.
Recovery is not actually booting into Linux, its running BEFORE linux runs and modifying how Linux runs.
[ I note that "locked boot loaders" prevent you from changing the kernel, luckily you don't have one !]
I'm not sure on the specifics, but if you can get access to the linux kernel bootup parameters it is always possible to "get root access" - because the linux kernel is what defines and controls root access !!!
The authentication on some android phones occurs at a screen where you type in
fastboot oem unlock and unlock the phone allowing you to change what your phone will boot into when you load.
The Authentication your referring to isn't seen much anymore. one example would be in the earlier days I had a HTC legend with a signed boot load, this meant that I had to get HTC to sign a rom if I wanted to load it onto my phone. So to bypass this authentication we would load up the HTC update tool on our PC's stop on the screen just before the rom would be loaded onto the phone, go into the temp folder in windows and change the data to the data we wanted to load into our phones and let the HTC software load our content rather then there own.
These days the exploits to bypass authentication are rarely needed as most phones aren't locked.
Got away from myself there and missed the main point in the title
Q: How Android Custom Recovery roots the phone?
A: It doesn't