avbroot
A tool for reproducibly modifying Android A/B OTA update images and re-signing them with custom keys, with subcommands for packing and unpacking several Android image formats.
avbroot modifies Android A/B OTA update images in a reproducible way and re-signs them with a custom key, working only on modern A/B-partitioned devices, mostly non-Samsung phones launched with Android 10 or newer, whose bootloader accepts a custom public key for its root of trust. It also bundles subcommands for packing and unpacking a number of Android image formats independently of the OTA-patching workflow.
Depending on the device, it patches the boot or init_boot image to enable root access if requested, and patches the boot, recovery or vendor_boot image and the system image to replace the OTA signature-verification certificates, so a future patched OTA can be sideloaded from recovery after the bootloader is locked again while an unpatched original OTA is blocked from installing over the patched system. The project stresses that OEM unlocking must stay enabled while a device is rooted with a locked bootloader, since disabling it after root access lets a bad boot image write render the device permanently unbootable.
avbroot is written in Rust and released under the GPL-3.0 license.