The Android Ecosystem
From silicon to su — every layer of the stack, every lock, every term. The reference page.
chain = bootrom → xbl → abl → trustzone → android
gates = qfprom · rpmb · pdb flag · knox · anti-rollback
map = 274 devices · 16 brands — everything documented
$ _
// the boot chain
The first code that runs — burned into the chip at the factory. Talks Sahara/EDL, hands off to the next stage. Immutable, unpatchable.
Secondary bootloader. Decrypts the next stage, burns anti-rollback fuses, and enforces the fuse state from here on.
Qualcomm UEFI bootloader. The stage that reads the OEM-unlock flag — and the bit-4 build that ignores it entirely.
Read the Verdict →The TEE: tz + tz_kg trustlets. Runs the secure OS that owns the unlock state, KG, and the QFPROM hardware.
Replay-protected storage holding keys and the unlock state — the "ANDROID-BOOT!" prize.
vbmeta, the GPT, SELinux and everything you see. Where root lives once a chain lands.
How Root Works →// the unlock gates
Every lock between you and root, and where it lives.
| gate | lives in | what it gates |
|---|---|---|
| QFPROM fuse | silicon, one-way | the unlock verdict — burned once, never unburned |
| RPMB | TrustZone-protected storage | unlock state + keymaster keys — the thing a boot-chain bypass flips |
| PDB flag | persistent partition (software) | the software side of OEM unlock — proven TRUE on bit-4 builds, and ignored by the abl |
| OEM toggle | developer options | the user-facing switch — removed entirely on One UI 8 |
| Knox warranty bit | e-fuse | trips the moment anything custom boots — permanent |
| Anti-rollback (SW REV) | fuses checked by XBL | blocks downgrades — the "SW REV CHECK FAIL" wall |
// the os layers
What actually runs when Android runs.
The Linux kernel with Android patches — drivers, memory, scheduling. LTS branches per SoC; GKI splits vendor modules out of it.
Hardware Abstraction Layers — the stable interface between the framework and every piece of hardware.
The Android Runtime — runs your apps byte-for-byte, JIT + AOT.
System services and the API surface — where systemui, settings and everything OEM lives (and what modules patch).
Every app in its own UID + SELinux domain + seccomp filter. The walls an exploit has to climb.
SELinux enforcing, Verified Boot, scoped storage — the layered defence between a user and root.
Our Research →// partitions & images
The flash layout — what each slice is for.
| partition | role |
|---|---|
| boot | kernel + ramdisk — what Magisk patches |
| init_boot | the ramdisk that starts init (GKI devices patch this instead) |
| vendor_boot | vendor ramdisk for the GKI split |
| vbmeta | Verified Boot metadata — the signed hash chain |
| super | dynamic partitions (system/vendor/product/odm live inside) |
| system / vendor / product | the read-only OS images |
| userdata | your data — encrypted, FBE |
| metadata | OTA + rollback bookkeeping |
| persistent | small durable flags (the PDB unlock flag lives here) |
| devinfo | device state flags (the "SAMANDR-BOOT!" partition) |
| abl / xbl / tz / hyp | the bootloader + secure-world images themselves |
| recovery / fastbootd | recovery and userspace fastboot |
| efisp | UEFI system partition — the GBL staging path on some devices |
// verified boot
vbmeta signs a hash chain over every boot image. Device states: green locked + verified · yellow locked, custom keys · orange unlocked · red failed verification. Unlocking moves you to orange — and trips Knox on Samsung.
// the update flow
FOTA delivers delta packages; A/B slots swap seamlessly and keep a rollback target; SW REV fuses refuse downgrades. GKI means the kernel updates separately from the vendor layer — and why Samsung ships monthly kernel patches that quietly close doors like GhostLock. What the patches change →
// the vendor layers
Knox e-fuse, KG trustlet, One UI skin. The OEM-unlock toggle vanished on One UI 8 — the reason the locked models need a chain.
HyperOS + the Mi Unlock account flow. Older builds had the public GBL chain (patched in 3.0.304.0).
The chipset layer: Emergency Download mode, Sahara protocol, signed firehose loaders — the deepest tool in the box.
BootROM download mode + SP Flash Tool — the MediaTek equivalent of EDL.
Tensor, fastboot flashing unlock, GKI kernels — the most open ecosystem of the lot.
Pixel 11 →// the research evidence
.rtc, and sold the key. We found the plaintext, verified it, and published the entire route: $0 + a $10 cable.
CVE-2026-24090 — the unlock, stage by stage
the MINK chain — opened, verified live
// test on real devices
No device? Stream real hardware into your browser — this is how we live-test on One UI 9.
// our tools
The all-in-one rooting toolkit.
Open →Firmware straight from FUS.
Open →Free One UI theming.
Open →The control panel — site in your pocket.
Open →// glossary
Every term, one line. Click to expand.
ABL
Application BootLoader — the Qualcomm UEFI stage that decides what boots.
AVB
Android Verified Boot — the vbmeta-signed chain that proves the OS is untouched.
BootROM / PBL
The immutable first-stage loader burned into the silicon.
CSC
Country Specific Code — Samsung region/carrier software slice.
EDL
Emergency Download mode — Qualcomm’s low-level flash mode.
eFuse / QFPROM
One-time-programmable fuses — Knox, anti-rollback and unlock verdicts live here.
FOTA
Firmware Over The Air — the delta update path.
GKI
Generic Kernel Image — the standard kernel split that makes KernelSU portable.
GPT
GUID Partition Table — the map of every partition on the flash.
HAL
Hardware Abstraction Layer — the Treble interface to hardware.
init_boot
The ramdisk partition that GKI devices patch instead of boot.
Knox
Samsung’s e-fuse security stack — trips permanently on custom code.
LKM
Loadable Kernel Module — how KernelSU-Next loads without a custom kernel.
OEM unlock
The user-facing bootloader unlock switch — gone on One UI 8.
RPMB
Replay-Protected Memory Block — the secure storage that holds the unlock state.
Sahara
The BootROM protocol that talks to EDL — the surface the write-what-where bug lives in.
SELinux
The mandatory access control layer — domains like untrusted_app and shell.
seccomp
Syscall filtering — another wall between apps and the kernel.
vbmeta
The Verified Boot metadata image — signed, hashed, tamper-evident.
Zygisk
The Magisk hooking layer that lives in the Zygote process.
fastbootd
Userspace fastboot — flashes dynamic (super) partitions.
TrustZone / TEE
The secure world — a second OS that owns keys, DRM and unlock state.
Anti-rollback
SW REV fuses that refuse older firmware — the downgrade wall.
Xposed / LSPosed
Runtime hooking framework — the engine behind PolyQon’s module.
// keep exploring
// artifacts
The receipts — hashed, public, from our own device.
abl.elf.encrypted2.3 MBthe bootloader, encrypted at restabl.elf2.3 MBthe SAME bootloader, decrypted — pulled live from RAMxbl_s.melf1.0 MBthe RISC-V security-chip firmware (anti-rollback brain)tz.mbn3.9 MBthe TrustZone OS imagekeymint.mbn0.4 MBthe boot keymaster TA (the 24090 target)vaultkeeper.mbn1.0 MBthe VaultKeeper TA (the boot-lock state)uefi.elf2.9 MBthe UEFI firmware (the DXE drivers came from here)libQSEEComAPI.so0.1 MBthe secure-world door library we reverse-engineered