========================================= Recovery ramdisk (recovery environment) ========================================= ``recovery_a.bin`` is the recovery boot image — a bootloader-level recovery OS, distinct from the Android system/vendor/odm partitions (which are not covered here). It pairs the same kernel as ``boot_a`` with a resident recovery ramdisk that runs ``/system/bin/recovery`` (AArch64, AOSP android-11). Container ========= ``ANDROID!`` boot image, header v2, page 4096: =========== ============ =========================================================================== Component Size Notes =========== ============ =========================================================================== kernel 60,735,504 byte-identical to ``boot_a``'s kernel (SHA256 ``4e2d5e15…``) — one kernel, two ramdisks ramdisk 8,387,044 gzip → 20.5 MB cpio (``newc``, 345 entries: 115 files + 201 symlinks + 29 directories) second/dtb 0 none in-image =========== ============ =========================================================================== Cmdline is identical to ``boot_a`` (same ``console=ttyMSM0``, ``video=vfb:640x400``, dwc3 usb); only the ramdisk differs. recovery.fstab ============== ``system/etc/recovery.fstab``, A/B variant. Logical partitions verified with AVB; adds recovery-only mounts: .. list-table:: :header-rows: 1 :widths: 26 20 10 44 * - Mount - Source - fs - Flags * - /system, /system_ext, /product - logical (super) - ext4 ro - slotselect, ``avb=vbmeta_system``, first_stage_mount * - /vendor, /odm - logical (super) - ext4 ro - slotselect, ``avb``, first_stage_mount * - /metadata - by-name/metadata - ext4 - ``wrappedkey`` (metadata-encryption), check, formattable * - /data - by-name/userdata - f2fs - ``encryptable=footer``, quota, ``checkpoint=fs``, reservedsize=128M * - /sdcard - ``/dev/block/mmcblk1p1`` - vfat - external microSD — enables SD-card sideload * - /boot - by-name/boot - emmc - defaults * - /misc - by-name/misc - emmc - BCB (bootloader control block — recovery command channel) Versus boot, recovery mounts ``/misc`` (reads the boot-command block), ``/sdcard`` (external SD), ``/boot`` (for install/verify), plus ``metadata`` + ``userdata`` so it can wipe them. init.recovery.qcom.rc — Onyx customizations =========================================== :: on init : write /sys/class/backlight/panel0-backlight/brightness 200 ; front-light on in recovery setprop sys.usb.configfs 1 on property:ro.boot.usbcontroller=* : USB → peripheral mode (adb/fastbootd/sideload) on fs : symlink … ${ro.boot.bootdevice} → /dev/block/bootdevice on boot : write /sys/onyx_misc/onyx_active_pen/usi_enable 1 ; USI active pen usable in recovery The Onyx-specific bits turn the front-light on and enable the USI active pen — the recovery UI is pen-aware. Everything else is stock QCOM recovery init. Capabilities ============ From ``system/bin/recovery`` (AArch64, AOSP android-11). Companion binaries present: ``recovery``, ``adbd``, ``minadbd`` (sideload), ``fastbootd`` (userspace fastboot), ``update_engine_sideload``. Capability strings confirm: - Apply OTA / update package — A/B via ``update_engine``; virtual-A/B snapshot handling (``Can't map snapshot for…``, ``Assuming no snapshots``). - ADB sideload — ``run_fuse_sideload``, ``/sideload/package.zip``, ``/sideload/exit``. - Rescue mode — ``--rescue``, ``boot-rescue``, ``/system/bin/update_engine_sideload``. - fastbootd — ``--fastboot``, ``boot-fastboot``, "Android Fastboot" (userspace fastboot to flash the logical partitions inside ``super`` that bootloader-fastboot cannot). - Factory data reset / wipe — ``wipe_data.cpp``, ``wipe_device.cpp``, "Factory data reset", "Data wipes are only allowed in recovery", cache/data wipe, ``/etc/recovery.wipe``. - Reboot system now ("Confirm reboot?"). - Failure UX: "Can't load Android system. Your data may be corrupt… factory data reset…". UI assets (``res/images/``, 13 PNGs — text rendered as localized images): ``installing_text``, ``installing_security_text``, ``erasing_text``, ``error_text``, ``no_command_text``, ``icon_error``, ``fastbootd``, progress/stage bars, ``loop00000`` (install animation), ``font``. Stock AOSP recovery UI. SELinux and properties ====================== - ``sepolicy`` — monolithic SELinux policy v30 (904,882 B) shipped in the ramdisk, plus the full context set: ``{plat,vendor,odm,product,system_ext}_{file,property}_contexts``. Recovery runs fully enforcing with its own policy image (independent of the system partition's). - ``default.prop`` / ``prop.default``: user build, ``ro.debuggable=0``, ``ro.secure=1``, ``ro.adb.secure=1`` (adb requires host key auth), ``ro.boot.dynamic_partitions=true``, ``ro.boot.wificountrycode=HK``, build fingerprint = ``Onyx/NoteAir5C…4.2.1-rel_0803…/user/release-keys`` (matches ``vbmeta``, :doc:`/boot/secure-boot`), built 2026-08-03, ``vendor.display.disable_hw_recovery_dump=1``. Differences from the boot ramdisk ================================= ================== ============================================= ============================================================ boot_a ramdisk recovery_a ramdisk ================== ============================================= ============================================================ Size / entries 1.1 MB, 15 entries 8.4 MB, 345 entries (115 files/201 links/29 dirs) Role first-stage init → mount super via AVB → stays resident; runs ``/system/bin/recovery`` as the OS switch_root into /system Binaries ``init``, ``e2fsck`` \+ ``recovery``, ``adbd``, ``minadbd``, ``fastbootd``, ``update_engine_sideload`` sepolicy loaded later from system full monolithic ``sepolicy`` + all ``*_contexts`` in-ramdisk fstab ``fstab.default`` / ``fstab.emmc`` ``recovery.fstab`` (+ ``/misc`` BCB, ``/sdcard``, ``/boot``, (boot mounts) wipe targets) UI none ``res/images/*`` recovery UI + pen/front-light init ================== ============================================= ============================================================ The recovery partition is a dedicated DAP recovery on this A/B device (both ``boot_*`` and ``recovery_*`` partitions exist, and ``vbmeta`` carries a ``recovery`` hash descriptor, :doc:`/boot/secure-boot`). Entry is via the ``/misc`` BCB (``boot-recovery`` command) — set either by ABL's 5-tap path (:doc:`/boot/keys`) or by ``reboot recovery``. Security notes ============== - Recovery is stock AOSP (android-11) with only the Onyx pen/front-light init tweaks — no extra OEM unlock/flash backdoor observed in the recovery binary strings. - Recovery is loaded by the same test-key-signed, unfused bootloader as the rest of the chain (:doc:`/boot/secure-boot`, :doc:`/edl/firehose`) — not empirically verified here by flashing one, but a patched recovery image would plausibly be accepted without complaint. ``ro.adb.secure=1`` + user build means sideload needs a signed OTA and adb needs host-key auth in a trusted chain, but that gate is bypassable at the bootloader level. Artifacts ========= - ``../artifacts/recovery_a/rd/`` — full extracted ramdisk (init, ``recovery.fstab``, ``sepolicy``, ``res/``, props). - ``../artifacts/recovery_a/ramdisk.raw`` (gzip), ``ramdisk.cpio`` (decompressed). Provenance ========== :Source: ``../_READONLY/lun4/recovery_a.bin`` (read-only), 2026-09-12; extracted tree in ``../artifacts/recovery_a/rd/``. :Method: Parsed ``boot_img_hdr_v2``; carved ramdisk; ``gunzip``; ``cpio -idm`` (macOS bsdcpio — no ``--no-absolute-filenames``). Read fstab/init/props directly; capabilities from ``strings`` on ``system/bin/recovery``. :Cross-refs: :doc:`/boot/secure-boot` (root of trust, vbmeta), :doc:`/boot/boot-image` (boot ramdisk), :doc:`/boot/keys` (5-tap recovery entry), :doc:`/edl/firehose` (patched-image acceptance).