[OTA] ADB-Enabler - Flashable UPDATE.ZIP File

[Deleted member 1890170]

This tool is not meant to be used on Android devices with dm-verify or Android Verify Boot (AVB) enabled


Every Android device has a stock recovery installed. That default recovery typically at least offers you the 4 options


reboot system now
apply update from sd card
wipe data factory reset
wipe cache partition


thus you can place any valid update.zip in device's SD-card slot and update your Android from external SD-card.

Because being in recovery mode Android isn’t loaded, the Android system files are not placed in memory, which means they can be accessed, edited and replaced.
That fact allows Android users to enable ADB on their devices what natively support ADB, if they haven't done it yet, for whatever reason.

Download the signed ADB.Enabler.OTA.ZIP from here . IMPORTANT: Rename it to UPDATE.ZIP before you make use of it.


If you get error "Signature verification failed" means that OEM/Carrier blocked to flash a 3rd-party OTA. You would need to have a Custom Recovery like CWM/TWRP already installed and use that to flash the ADB.Enabler.OTA.


HTH

 

[bilalrajput]

link not working

 

[aIecxs]

I am looking for zip that can enable usb-debugging and disable RSA keys without touching /data (encrypted/not mountable):
- boot.img
- system.img A-only SAR system-as-root device

I tried modifying build.prop and default.prop manually but it seems adbd is not running at all

 

[aIecxs]

got inspired by @ehteshamxa and created some flashable zip which does NOT modify system files. instead own files added

/system/etc/init/99userinit.rc
/system/xbin/99userinit_daemon
/sdcard/userinit.sh
/sdcard/rsa_copy

Instructions:
- install userinit-rsa_copy-flashable.zip
- install Magisk.zip
- copy adbkey.pub to SD Card

USE AT OWN RISK

 

[diehard2013]

got inspired by @ehteshamxa and created some flashable zip which does NOT modify system files. instead own files added

/system/etc/init/99userinit.rc
/system/xbin/99userinit_daemon
/sdcard/userinit.sh
/sdcard/rsa_copy

Instructions:
- install userinit-rsa_copy-flashable.zip
- install Magisk.zip
- copy adbkey.pub to SD Card

USE AT OWN RISK

is root required?

 

[aIecxs]

No root required. Magisk is recommended for easy avb/dm-verity disable, but of course one can also place the files manually by unpack/repack (simg2img/sdat2img) flash tool method.

 

[aIecxs]

optional:
- copy sqlite3 binary to SD Card
(get it from here credits: @DiamondJohn)
- copy Magisk-v23.0.apk to SD Card
(credits: topjohnwu you all know of course)

have added example code in userinit.sh that can authorize su permissions for adb shell. useful on broken screen in case one can't get scrcpy to work on boot-loop
(credits: @mirfatif for magisk.db injection)

rsa_copy works also from emulated storage if one edit the path in first line:

sdcard=/sdcard

on locked screen external MicroSD Card is only available location as MTP might not work. in that case place files from PC card reader and insert back

remember the whole purpose of that backdoor is inaccessible userdata partition, otherwise one could just add rsa_copy or 99userinit_daemon to /data/adb/service.d systemless-ly instead (or most straightforward inject /data/misc/adb/adb_keys directly).

once got su shell one can backup partitions, for example:

adb shell su -c "cat /dev/block/dm-0 2> /dev/null" > userdata.img

edit: visit main thread for more discussion
https://forum.xda-developers.com/showthread.php?t=2965462