AOSP-Testkey-BootSigner

English | 简体中文

Re-signs boot.img / init_boot.img / vendor_boot.img with the AOSP public testkey, and rebuilds vbmeta.img to match — for devices whose stock verified-boot chain already trusts that testkey, so a bootloader-locked phone still boots after you modify one of those partitions.

What it does

• Re-signs one or more AVB-protected partition images with the bundled AOSP testkey (RSA-2048 or RSA-4096, auto-selected from the original image's algorithm)
• Rebuilds vbmeta.img so its descriptors match the newly-signed partitions ("normal" mode), or skips vbmeta.img entirely for partitions that carry their own chained signature ("chained" mode)
• Backs up every *.img in the working directory to backup_<timestamp>/ before touching anything
• Can just report the current signing info of the images (--verify-only) without modifying anything

Non-goals: this does not unlock or bypass verified boot on a device signed with the OEM's real production key — it only helps on devices that ship with the AOSP testkey already in their trust chain. It does not extract images from the device (no fastboot/dd integration) and does not flash anything back.

Requirements

• OS / runtime: any OS with Python 3.8+ (developed and used on Linux)
• External tool: openssl CLI on $PATH — tools/avbtool.py shells out to it
• No pip packages — both scripts use only the Python standard library

Install

# Always clone a tag, not the default branch — the branch tip may be mid-work.
git clone --branch v0.1.0 --depth 1 <repo-url> AOSP-Testkey-BootSigner
cd AOSP-Testkey-BootSigner
# No dependency install step — stdlib only. Just make sure `openssl` is on PATH:
openssl version

Quick start

Put the target device's extracted partition image(s) (and vbmeta.img, unless using --chained-mode) next to rebuild_avb.py, then:

# Chained-partition mode: each partition carries its own signature, no vbmeta.img needed
python3 rebuild_avb.py --chained-mode

# Normal mode: also rebuilds vbmeta.img from the images present
python3 rebuild_avb.py

# Only re-sign specific partitions
python3 rebuild_avb.py --chained-mode -p boot init_boot

Other flags: --verify-only / -v inspects signing info without changing anything; --private-key / -k overrides the auto-detected testkey; --regenerate-salt / -r generates a fresh salt instead of reusing the original.

Verify it works

python3 rebuild_avb.py --verify-only

You should see an Algorithm: line printed for each *.img file found in the working directory, with no [ERROR] lines. After a real rebuild, the console prints === 重建完成 === followed by 成功重建了 N 个分区 (rebuild complete, N partitions succeeded), and a new backup_<timestamp>/ directory holds the pre-rebuild originals.

License

All rights reserved — no open-source license has been granted for this repository's own code (rebuild_avb.py and the documentation). tools/avbtool.py and the two tools/pem/*.pem testkeys are vendored from the Android Open Source Project under their own upstream license; see THIRD_PARTY_NOTICES.md.