3.4. Recovery ramdisk (recovery environment)

recovery_a.bin is the recovery boot image — a bootloader-level recovery OS, distinct from the Android system/vendor/odm partitions (which are not covered here). It pairs the same kernel as boot_a with a resident recovery ramdisk that runs /system/bin/recovery (AArch64, AOSP android-11).

3.4.1. Container

ANDROID! boot image, header v2, page 4096:

Component

Size

Notes

kernel

60,735,504

byte-identical to boot_a’s kernel (SHA256 4e2d5e15…) — one kernel, two ramdisks

ramdisk

8,387,044

gzip → 20.5 MB cpio (newc, 345 entries: 115 files + 201 symlinks + 29 directories)

second/dtb

0

none in-image

Cmdline is identical to boot_a (same console=ttyMSM0, video=vfb:640x400, dwc3 usb); only the ramdisk differs.

3.4.2. recovery.fstab

system/etc/recovery.fstab, A/B variant. Logical partitions verified with AVB; adds recovery-only mounts:

Mount

Source

fs

Flags

/system, /system_ext, /product

logical (super)

ext4 ro

slotselect, avb=vbmeta_system, first_stage_mount

/vendor, /odm

logical (super)

ext4 ro

slotselect, avb, first_stage_mount

/metadata

by-name/metadata

ext4

wrappedkey (metadata-encryption), check, formattable

/data

by-name/userdata

f2fs

encryptable=footer, quota, checkpoint=fs, reservedsize=128M

/sdcard

/dev/block/mmcblk1p1

vfat

external microSD — enables SD-card sideload

/boot

by-name/boot

emmc

defaults

/misc

by-name/misc

emmc

BCB (bootloader control block — recovery command channel)

Versus boot, recovery mounts /misc (reads the boot-command block), /sdcard (external SD), /boot (for install/verify), plus metadata + userdata so it can wipe them.

3.4.3. init.recovery.qcom.rc — Onyx customizations

on init   : write /sys/class/backlight/panel0-backlight/brightness 200   ; front-light on in recovery
            setprop sys.usb.configfs 1
on property:ro.boot.usbcontroller=* : USB → peripheral mode (adb/fastbootd/sideload)
on fs     : symlink … ${ro.boot.bootdevice} → /dev/block/bootdevice
on boot   : write /sys/onyx_misc/onyx_active_pen/usi_enable 1            ; USI active pen usable in recovery

The Onyx-specific bits turn the front-light on and enable the USI active pen — the recovery UI is pen-aware. Everything else is stock QCOM recovery init.

3.4.4. Capabilities

From system/bin/recovery (AArch64, AOSP android-11). Companion binaries present: recovery, adbd, minadbd (sideload), fastbootd (userspace fastboot), update_engine_sideload. Capability strings confirm:

  • Apply OTA / update package — A/B via update_engine; virtual-A/B snapshot handling (Can't map snapshot for…, Assuming no snapshots).

  • ADB sideload — run_fuse_sideload, /sideload/package.zip, /sideload/exit.

  • Rescue mode — --rescue, boot-rescue, /system/bin/update_engine_sideload.

  • fastbootd — --fastboot, boot-fastboot, “Android Fastboot” (userspace fastboot to flash the logical partitions inside super that bootloader-fastboot cannot).

  • Factory data reset / wipe — wipe_data.cpp, wipe_device.cpp, “Factory data reset”, “Data wipes are only allowed in recovery”, cache/data wipe, /etc/recovery.wipe.

  • Reboot system now (“Confirm reboot?”).

  • Failure UX: “Can’t load Android system. Your data may be corrupt… factory data reset…”.

UI assets (res/images/, 13 PNGs — text rendered as localized images): installing_text, installing_security_text, erasing_text, error_text, no_command_text, icon_error, fastbootd, progress/stage bars, loop00000 (install animation), font. Stock AOSP recovery UI.

3.4.5. SELinux and properties

  • sepolicy — monolithic SELinux policy v30 (904,882 B) shipped in the ramdisk, plus the full context set: {plat,vendor,odm,product,system_ext}_{file,property}_contexts. Recovery runs fully enforcing with its own policy image (independent of the system partition’s).

  • default.prop / prop.default: user build, ro.debuggable=0, ro.secure=1, ro.adb.secure=1 (adb requires host key auth), ro.boot.dynamic_partitions=true, ro.boot.wificountrycode=HK, build fingerprint = Onyx/NoteAir5C…4.2.1-rel_0803…/user/release-keys (matches vbmeta, Secure boot and image signing), built 2026-08-03, vendor.display.disable_hw_recovery_dump=1.

3.4.6. Differences from the boot ramdisk

Size / entries

1.1 MB, 15 entries

8.4 MB, 345 entries (115 files/201 links/29 dirs)

Role

first-stage init → mount super via AVB → switch_root into /system

stays resident; runs /system/bin/recovery as the OS

Binaries

init, e2fsck

+ recovery, adbd, minadbd, fastbootd, update_engine_sideload

sepolicy

loaded later from system

full monolithic sepolicy + all *_contexts in-ramdisk

fstab

fstab.default / fstab.emmc (boot mounts)

recovery.fstab (+ /misc BCB, /sdcard, /boot, wipe targets)

UI

none

res/images/* recovery UI + pen/front-light init

The recovery partition is a dedicated DAP recovery on this A/B device (both boot_* and recovery_* partitions exist, and vbmeta carries a recovery hash descriptor, Secure boot and image signing). Entry is via the /misc BCB (boot-recovery command) — set either by ABL’s 5-tap path (Physical keys: power, volume, and the boot-mode dispatcher) or by reboot recovery.

3.4.7. Security notes

  • Recovery is stock AOSP (android-11) with only the Onyx pen/front-light init tweaks — no extra OEM unlock/flash backdoor observed in the recovery binary strings.

  • Recovery is loaded by the same test-key-signed, unfused bootloader as the rest of the chain (Secure boot and image signing, Firehose fuse read and secure-boot confirmation) — not empirically verified here by flashing one, but a patched recovery image would plausibly be accepted without complaint. ro.adb.secure=1 + user build means sideload needs a signed OTA and adb needs host-key auth in a trusted chain, but that gate is bypassable at the bootloader level.

3.4.8. Artifacts

  • ../artifacts/recovery_a/rd/ — full extracted ramdisk (init, recovery.fstab, sepolicy, res/, props).

  • ../artifacts/recovery_a/ramdisk.raw (gzip), ramdisk.cpio (decompressed).

3.4.9. Provenance

Source:

../_READONLY/lun4/recovery_a.bin (read-only), 2026-09-12; extracted tree in ../artifacts/recovery_a/rd/.

Method:

Parsed boot_img_hdr_v2; carved ramdisk; gunzip; cpio -idm (macOS bsdcpio — no --no-absolute-filenames). Read fstab/init/props directly; capabilities from strings on system/bin/recovery.

Cross-refs:

Secure boot and image signing (root of trust, vbmeta), Boot image: kernel, DTB, ramdisk, config (boot ramdisk), Physical keys: power, volume, and the boot-mode dispatcher (5-tap recovery entry), Firehose fuse read and secure-boot confirmation (patched-image acceptance).