Ro.boot.vbmeta.digest [work]

The property ro.boot.vbmeta.digest is a system-level identifier in Android used to verify the integrity of the operating system during the boot process.  What is ro.boot.vbmeta.digest? 

platform/external/avb - Git at Google - Android GoogleSource ro.boot.vbmeta.digest

For forensic analysts

• Determine if device has been modified
• Link a specific build to a device
• Verify chain of custody for evidence

Relationship with androidboot.vbmeta.device_state

You'll often see ro.boot.vbmeta.device_state (values: locked or unlocked). The digest is only considered valid for attestation when device_state = locked. If the device is unlocked, the digest might still be present, but attestation services ignore it or treat it as untrusted because the chain of trust is broken by the ability to reflash vbmeta without signing. The property ro

• Scenario: You flash an old ROM. The old vbmeta has a low rollback index (say 1). The bootloader's stored index is 10. The bootloader rejects the old vbmeta. Therefore, you never even get to the point of computing ro.boot.vbmeta.digest – the device hard bricks or enters EDL mode.
• If you can boot and see a digest, the rollback check passed.

When you power on an Android phone, the chain of trust begins. The hardware verifies the bootloader, the bootloader verifies the kernel, and the kernel verifies the system partitions. The VBMeta partition acts as the master keyring. It contains the hashes and signatures for all the other partitions (system, vendor, product, odm). Determine if device has been modified Link a

Introduction