Sideloading Android Updates

Android has grown more hostile to rooted users in recent years. In an effort to deliver as secure of a platform as possible the safetynet api was developed to verify the integrity of the entire Android software stack.

Generally this just checks to ensure there are no su binaries in /bin or /sbin. However, with the Pixel series, the bootloader unlock state is now reported to safetynet.

Devices that do not pass safetynet can be rejected access to certain applications. Some examples are Android Pay, Netflix, and Pokemon Go.

Unfortunately for me, I like to sideload new Android images as they are released. With a locked bootloader I cannot simply fastboot flash system, recovery, boot, and bootloader. Thankfully, Google releases OTA delta images that can be incrementally applied without needing to wait for your update provider to push it to your device.

Sideloading the 8.1 update.zip

ADB has a convenient sideload option that allows a user to arbitrarily push an Android update.zip file over usb. This is very convenient as you no longer have to download the .zip, Rename the file to update.zip, adb push the file to /storage/emulated/0/, reboot into recovery and finally flash the file using your device's three hardware buttons.

Taking advantage of the sideload feature is as simple as plugging in my device into my notebook with it's usb cable.

The Pixel has a quirk where adbd will not run unless PTP over usb is enabled.

Once the device is connected we can run adb devices to confirm we have adb.

mikey@mopbook:~/Documents/imgs$ adb devices
List of devices attached
FA7690303834    device

We will have to download the appropriate image from Google's OTA img repo Once you identify the url for your image you can do the rest comfortably in your shell of choice.

mikey@mopbook:~$ cd /Documents/imgs/ && wget https://dl.google.com/dl/android/aosp/sailfish-ota-opm1.171019.011-9857b47c.zip

Once we have the image, and it's in our working directory, we can reboot into ‘stock’ recovery.

Working with Stock Recovery

mikey@mopbook:~/Documents/imgs$ adb reboot recovery

Stock recovery can be tricky, it doesn't automatically show the recovery menu. Press and hold power and tap vol+up and it should promptly appear. Use the volume keys to highlight ‘apply update from adb’. Pressing the power button will cause text to scroll across the screen, including ‘adbd service started’.

Note, holding the Power button for 10 seconds will trigger the device to hard reset. When using this button combination the action should be somewhat brief.

If your device shows the menu pictured above you are now ready to sideload.

mikey@mopbook:~/Documents/imgs$ adb sideload sailfish-ota-opm1.171019.011-9857b47c.zip 
loading: 'sailfish-ota-opm1.171019.011-9857b47c.zip'...
connecting...
Total xfer: 2.00x                                                   
mikey@mopbook:~/Documents/imgs$ 

Once the image is flashed you will be returned to the recovery menu. Select the first option ‘reboot system now’ and wait. In Oreo, the ‘updating apps x of x’ screen no longer exists, it runs in the background once the system is booted. Because this will be the first boot it will take longer than normal and you will not see the optimizing apps screen.