RAGBAZRAGBAZ/forensics
school
syllabus teacher's manual student instructions methodology live acquisition
labs
lab 1 · baseline & authorized acquisitionlab 2 · persistence huntlab 3 · live artifact acquisitionlab 4 · boot-chain imaging & verificationlab 5 · blind assessment · capstone
tools
apts.sh apts_tui.py acquire_artifacts.sh
studio
↩ school overview ↩ ragbaz.cc
lab 04 · below the os

lab 4 · boot-chain imaging & verification

Image the boot chain read-only and compare it to a known-good OEM factory image — the technique that catches a rootkit the OS is hiding from ADB.

120 minadvancedfastbootapts_tui.py

objective

This lab answers the caveat that runs through the whole course. Userspace triage can look clean while the compromise lives in the boot chain. You image below the OS and verify against a trusted baseline.

materials

  • Labs 1–3 completed
  • A device you own, rooted, whose OEM factory image is available
  • apts_tui.py
  • The matching OEM factory image + a tool to extract its partitions

procedure

  1. Read the device fingerprint. Record verifiedbootstate and bootloader-lock state — these bound how much you can trust everything else.
  2. Launch the TUI and accept the authorization gate:
    workstation
    $ python3 apts_tui.py
// ↑/↓ or j/k move · Enter select · q back · Q quit
  3. Under Forensic acquisition, enumerate the by-name partition map (needs root) and note the boot-chain partitions.
  4. Image the boot-chain set read-only — boot, init_boot, vbmeta, bootloader — and let the tool hash each image.
  5. Obtain the matching OEM factory image for the exact build (public for many devices) and extract the reference partition (e.g. boot.img).
  6. Use Verify against known-good to compare SHA-256 of your acquired image with the OEM reference.
  7. Interpret: a mismatch on a signed partition is a red flag; a match raises confidence that the boot chain is intact.

deliverable

Deliverable: the acquisition manifest for the boot-chain set, the OEM reference hashes, and a short verdict per partition (match / mismatch) with your interpretation and confidence. Explain what a mismatch would and would not prove.

prerequisites, honestly

Raw partition imaging assumes privileged local access to a device you own — root on a running OS, or a recovery/EDL workflow you run yourself. The tool never unlocks or roots anything; that is a prerequisite you satisfy on your own lab hardware, and never on a device you do not own.

‹ lab 3lab 5 ›