[OTA] ADB-Enabler - Flashable UPDATE.ZIP File

Search This thread
D

Deleted member 1890170

Guest
ADB.jpg



This tool is not meant to be used on Android devices with dm-verify or Android Verify Boot (AVB) enabled


Every Android device has a stock recovery installed. That default recovery typically at least offers you the 4 options


reboot system now
apply update from sd card
wipe data factory reset
wipe cache partition


thus you can place any valid update.zip in device's SD-card slot and update your Android from external SD-card.

Because being in recovery mode Android isn’t loaded, the Android system files are not placed in memory, which means they can be accessed, edited and replaced.
That fact allows Android users to enable ADB on their devices what natively support ADB, if they haven't done it yet, for whatever reason.

Download the signed ADB.Enabler.OTA.ZIP from here . IMPORTANT: Rename it to UPDATE.ZIP before you make use of it.


If you get error "Signature verification failed" means that OEM/Carrier blocked to flash a 3rd-party OTA. You would need to have a Custom Recovery like CWM/TWRP already installed and use that to flash the ADB.Enabler.OTA.


HTH
 
Last edited by a moderator:
  • Like
Reactions: Technical and bomil

aIecxs

Senior Member
Feb 17, 2016
1,601
461
gitlab.com
I am looking for zip that can enable usb-debugging and disable RSA keys without touching /data (encrypted/not mountable):
- boot.img
- system.img A-only SAR system-as-root device

I tried modifying build.prop and default.prop manually but it seems adbd is not running at all
 

aIecxs

Senior Member
Feb 17, 2016
1,601
461
gitlab.com
got inspired by @ehteshamxa and created some flashable zip which does NOT modify system files. instead own files added
Code:
/system/etc/init/99userinit.rc
/system/xbin/99userinit_daemon
/sdcard/userinit.sh
/sdcard/rsa_copy

Instructions:
- install userinit-rsa_copy-flashable.zip
- install Magisk.zip
- copy adbkey.pub to SD Card

USE AT OWN RISK
 

Attachments

  • userinit-rsa_copy-flashable.zip
    4.2 KB · Views: 27
  • UNINSTALLER.zip
    1 KB · Views: 15

diehard2013

Senior Member
Feb 15, 2013
471
37
Samsung Galaxy Tab S7 / S7 Plus
got inspired by @ehteshamxa and created some flashable zip which does NOT modify system files. instead own files added
Code:
/system/etc/init/99userinit.rc
/system/xbin/99userinit_daemon
/sdcard/userinit.sh
/sdcard/rsa_copy

Instructions:
- install userinit-rsa_copy-flashable.zip
- install Magisk.zip
- copy adbkey.pub to SD Card

USE AT OWN RISK
is root required?
 

aIecxs

Senior Member
Feb 17, 2016
1,601
461
gitlab.com
No root required. Magisk is recommended for easy avb/dm-verity disable, but of course one can also place the files manually by unpack/repack (simg2img/sdat2img) flash tool method.
 
Last edited:
  • Like
Reactions: Wishmasterflo

aIecxs

Senior Member
Feb 17, 2016
1,601
461
gitlab.com
optional:
- copy sqlite3 binary to SD Card
(get it from here credits: @DiamondJohn)
- copy Magisk-v23.0.apk to SD Card
(credits: topjohnwu you all know of course)

have added example code in userinit.sh that can authorize su permissions for adb shell. useful on broken screen in case one can't get scrcpy to work on boot-loop
(credits: @mirfatif for magisk.db injection)

rsa_copy works also from emulated storage if one edit the path in first line:
Code:
sdcard=/sdcard

on locked screen external MicroSD Card is only available location as MTP might not work. in that case place files from PC card reader and insert back

remember the whole purpose of that backdoor is inaccessible userdata partition, otherwise one could just add rsa_copy or 99userinit_daemon to /data/adb/service.d systemless-ly instead (or most straightforward inject /data/misc/adb/adb_keys directly).

once got su shell one can backup partitions, for example:
Code:
adb shell su -c "cat /dev/block/dm-0 2> /dev/null" > userdata.img

edit: visit main thread for more discussion
https://forum.xda-developers.com/showthread.php?t=2965462
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 2
    D
    Deleted member 1890170
    ADB.jpg



    This tool is not meant to be used on Android devices with dm-verify or Android Verify Boot (AVB) enabled


    Every Android device has a stock recovery installed. That default recovery typically at least offers you the 4 options


    reboot system now
    apply update from sd card
    wipe data factory reset
    wipe cache partition


    thus you can place any valid update.zip in device's SD-card slot and update your Android from external SD-card.

    Because being in recovery mode Android isn’t loaded, the Android system files are not placed in memory, which means they can be accessed, edited and replaced.
    That fact allows Android users to enable ADB on their devices what natively support ADB, if they haven't done it yet, for whatever reason.

    Download the signed ADB.Enabler.OTA.ZIP from here . IMPORTANT: Rename it to UPDATE.ZIP before you make use of it.


    If you get error "Signature verification failed" means that OEM/Carrier blocked to flash a 3rd-party OTA. You would need to have a Custom Recovery like CWM/TWRP already installed and use that to flash the ADB.Enabler.OTA.


    HTH
    2
    got inspired by @ehteshamxa and created some flashable zip which does NOT modify system files. instead own files added
    Code:
    /system/etc/init/99userinit.rc
    /system/xbin/99userinit_daemon
    /sdcard/userinit.sh
    /sdcard/rsa_copy

    Instructions:
    - install userinit-rsa_copy-flashable.zip
    - install Magisk.zip
    - copy adbkey.pub to SD Card

    USE AT OWN RISK
    1
    No root required. Magisk is recommended for easy avb/dm-verity disable, but of course one can also place the files manually by unpack/repack (simg2img/sdat2img) flash tool method.