In this article, I want to explain how Android boots up, from the moment we press the power button until we can use apps normally.
This is going to be a pretty long topic, so I'll split it into several parts.
Just a quick note: I'm writing this as a junior security researcher, so there might be some mistakes in my explanation. If you find something wrong, please let me know. I don't want to keep making the same mistakes without realizing it.
It All Starts with the Power Button
When we press and hold the power button to turn on our phone, something happens inside the hardware.
You can think of the power button like a light switch. But inside a smartphone, things are a bit more complicated. The electricity from the battery doesn't simply go straight to the CPU. It goes through a component called the Power Management Integrated Circuit (PMIC).
The PMIC manages the power supplied to different hardware components. Each component needs a certain voltage to work properly, so the PMIC helps make sure they get the power they need.
For example, the CPU and RAM may use different voltage levels. The exact values depend on the phone's hardware, so they aren't the same for every device.
The power is delivered through paths called power rails, which supply the required voltage to different components.
To make this easier to understand, I made the illustration below with some help from AI.
What Is an SoC?
Earlier, I mentioned the CPU. But when talking about Android hardware, it's also important to understand the System on a Chip (SoC).
An SoC is a chip that combines several components into one package. These can include the CPU, GPU, memory controller, and Boot ROM, depending on the design.
So, instead of talking about the CPU as if it were the whole system, I'll use the term SoC when talking about the main chip in a smartphone.
Here's an illustration to give you a better idea of what an SoC looks like.
The CPU Starts Executing Instructions
Once the CPU gets the power it needs and starts running, it doesn't immediately understand Python, C++, JSFuckkk, or any other programming language.
The CPU executes machine instructions. These instructions are represented as binary data, using combinations of zeros and ones. (If you're curious about this part, you can look into how assembly language gets translated into machine code or learn about opcodes, which are the operation codes used in machine instructions).
But where does the CPU get its first instruction?
After a reset, the CPU starts executing instructions from a location defined by its architecture and hardware design. This is related to something called the reset vector.
Think of it like a worker starting a new shift. The worker needs to know where to begin and what to do first. The CPU works in a similar way: it starts from a predefined entry point instead of randomly looking for a program to run.
On many SoCs, this initial step leads to code stored in the Boot ROM.
What Is Boot ROM?
Boot ROM is a small area of read-only memory that contains the initial code needed to start the boot process.
This code is built into the SoC, and it usually cannot be changed like normal files stored on a phone.
One of its jobs is to perform some initial checks and find or load the next stage of the boot process, which may be a bootloader.
At this point, the phone hasn't fully initialized its main RAM yet. The early boot process may use a small amount of on-chip memory called Static RAM (SRAM) as temporary working space.
Keep in mind that Boot ROM and SRAM are not the same thing. Boot ROM stores the initial code, while SRAM can be used to hold temporary data and other things needed during early startup.
The Bootloader Takes Over
After the initial stage, the boot process continues through the bootloader. Depending on the device, there may be several bootloader stages rather than just one.
The bootloader prepares the hardware needed for the next stage. One important task is initializing the main memory, called Dynamic RAM (DRAM).
Before DRAM can be used properly, the memory controller and the memory itself need to be configured. The exact process depends on the phone's hardware.
The boot process also involves security checks. Android uses a mechanism called Android Verified Boot (AVB) to help verify the integrity and authenticity of boot-related components, according to the device's security configuration.
Once the required components are ready and verified, the bootloader loads the necessary boot images into memory.
Some Android devices use images such as:
- boot.img: contains the Linux kernel and, depending on the device's configuration, may also contain a generic ramdisk.
- init_boot.img: contains the generic ramdisk on devices that use this partition layout.
- vendor_boot.img: contains device-specific boot components, such as the vendor ramdisk and other hardware-related information.
Not every Android device uses these images in exactly the same way. It depends on the Android version and the device's boot configuration.
After everything needed for the next stage has been prepared, the bootloader transfers execution to the Linux kernel.
At this point, we're moving on from the bootloader stage to the kernel stage. The kernel will continue initializing the system, and there's still a lot that needs to happen before Android is ready to use.
I'll cover that in the next part.. Soo please waiting for me, and CMIWW
Sauce:
