FirmwareKit.AVB

A C# implementation of Android Verified Boot (AVB), supporting parsing, editing, and verification of VBMeta images, dm-verity hashtrees, and FEC data. Part of the FirmwareKit ecosystem.

Features

• Parse VBMeta headers and images.
• Support for AVB descriptors and footers.
• dm-verity compatible hashtree building and verification via AvbHashtree (port of avbtool's generate_hash_tree).
• dm-verity Forward Error Correction (FEC) via AvbFec - Reed-Solomon parity generation compatible with AOSP system/extras/libfec and the fec tool (used by add_hashtree_footer --generate_fec).
• Hardware-independent I/O interface via IAvbOps.
• Managed libavb_ab flow and boot-control facade via AvbAbFlow and AvbBootControl.
• Managed libavb_user equivalent helpers via AvbUser (verification/verity toggles).
• Managed libavb_cert equivalent validation via AvbCertValidator and IAvbCertOps.
• Multi-framework support: netstandard2.0, netstandard2.1, net6.0, net8.0, net10.0.

CLI (Managed, No Python Runtime)

This repository now includes a standalone managed CLI project: FirmwareKit.AVB.Cli.

Examples:

dotnet run --project FirmwareKit.AVB.Cli -- version
dotnet run --project FirmwareKit.AVB.Cli -- generate_test_image --image_size 4096 --output test.img
dotnet run --project FirmwareKit.AVB.Cli -- extract_public_key --key signing.pem --output avb_pk.bin
dotnet run --project FirmwareKit.AVB.Cli -- extract_public_key_digest --key signing.pem --output avb_pk.sha256
dotnet run --project FirmwareKit.AVB.Cli -- make_vbmeta_image --output vbmeta.img --algorithm NONE
dotnet run --project FirmwareKit.AVB.Cli -- add_hash_footer --image boot.img --partition_size 67108864 --partition_name boot
dotnet run --project FirmwareKit.AVB.Cli -- add_hashtree_footer --image system.img --partition_size 1073741824 --partition_name system
dotnet run --project FirmwareKit.AVB.Cli -- add_hashtree_footer --image system.img --partition_size 1073741824 --partition_name system --do_not_generate_fec
dotnet run --project FirmwareKit.AVB.Cli -- add_hashtree_footer --image system.img --partition_size 1073741824 --partition_name system --fec_num_roots 4
dotnet run --project FirmwareKit.AVB.Cli -- make_hashtree_image --image system.img --output system.hashtree --hash_algorithm sha256 --block_size 4096
dotnet run --project FirmwareKit.AVB.Cli -- verify_hashtree --image system.img --hashtree system.hashtree --root_digest <hex>
dotnet run --project FirmwareKit.AVB.Cli -- calc_footer_size --partition_size 1073741824
dotnet run --project FirmwareKit.AVB.Cli -- fec encode --image system.img --output system.fec --roots 2
dotnet run --project FirmwareKit.AVB.Cli -- fec calc-size --data_size 1073741824 --roots 2
dotnet run --project FirmwareKit.AVB.Cli -- append_vbmeta_image --image boot.img --vbmeta_image vbmeta.img --partition_size 67108864
dotnet run --project FirmwareKit.AVB.Cli -- erase_footer --image boot.img
dotnet run --project FirmwareKit.AVB.Cli -- resize_image --image boot.img --partition_size 83886080
dotnet run --project FirmwareKit.AVB.Cli -- set_ab_metadata --misc_image misc.img --slot_data 15:7:1:14:7:0
dotnet run --project FirmwareKit.AVB.Cli -- zero_hashtree --image system.img
dotnet run --project FirmwareKit.AVB.Cli -- extract_vbmeta_image --image boot.img --output vbmeta_extracted.img
dotnet run --project FirmwareKit.AVB.Cli -- verify_image --image vbmeta.img
dotnet run --project FirmwareKit.AVB.Cli -- info_image --image vbmeta.img
dotnet run --project FirmwareKit.AVB.Cli -- print_partition_digests --image vbmeta.img
dotnet run --project FirmwareKit.AVB.Cli -- calculate_vbmeta_digest --image vbmeta.img --hash_algorithm sha256
dotnet run --project FirmwareKit.AVB.Cli -- vbmeta verify vbmeta.img
dotnet run --project FirmwareKit.AVB.Cli -- vbmeta info vbmeta.img
dotnet run --project FirmwareKit.AVB.Cli -- vbmeta digest vbmeta.img
dotnet run --project FirmwareKit.AVB.Cli -- vbmeta print-partition-digests vbmeta.img
dotnet run --project FirmwareKit.AVB.Cli -- ab inspect ab_metadata.bin
dotnet run --project FirmwareKit.AVB.Cli -- cert make-unlock-credential \
 --pik-cert pik_certificate.bin \
 --puk-cert puk_certificate.bin \
 --puk-key puk.pem \
 --challenge challenge.bin \
 --out unlock_credential.bin
dotnet run --project FirmwareKit.AVB.Cli -- cert inspect-archive unlock_creds.zip
dotnet run --project FirmwareKit.AVB.Cli -- cert make-unlock-credential-from-archive \
 --archive unlock_creds.zip \
 --challenge challenge.bin \
 --out unlock_credential.bin
dotnet run --project FirmwareKit.AVB.Cli -- cert make-unlock-credential-auto \
 --challenge challenge.bin \
 --out unlock_credential.bin \
 unlock_creds_1.zip unlock_creds_2.zip credentials_dir
dotnet run --project FirmwareKit.AVB.Cli -- persistent-digest build \
 --name factory \
 --digest-hex 00112233445566778899aabbccddeeff \
 --out persistent_digest.bin
dotnet run --project FirmwareKit.AVB.Cli -- persistent-digest build \
 --name factory \
 --clear-digest \
 --out persistent_digest_clear.bin
dotnet run --project FirmwareKit.AVB.Cli -- persistent-digest build-clear-factory \
 --out factory_clear_digest.bin
dotnet run --project FirmwareKit.AVB.Cli -- persistent-digest inspect factory_clear_digest.bin
dotnet run --project FirmwareKit.AVB.Cli -- auth-unlock run \
 --serial <fastboot_serial> \
 unlock_creds_1.zip unlock_creds_2.zip credentials_dir

Installation

dotnet add package FirmwareKit.AVB

Quick Start

using FirmwareKit.AVB;

// Use AvbSlotVerifier to verify partitions
var verifier = new AvbSlotVerifier(ops);
var result = verifier.VerifySlot("boot", 0);

Security Notes

• RSA signature verification is performed by the .NET runtime (RSA.VerifyHash, PKCS#1 v1.5 padding). Results are functionally equivalent to libavb's constant-time Montgomery modpowF4, but the .NET implementation is not constant-time, so timing side channels are possible against a hostile local adversary. Do not rely on this library as a constant-time implementation for boot-loader-grade security.
• Integrity comparisons (hashes, root digests, signatures' expected values) use AvbUtil.SafeMemCmp, a constant-time comparison.
• Like the reference avb_vbmeta_image_verify(), the reserved bytes of VBMeta headers are not validated during verification; use AvbVBMetaImageHeader.IsReservedValid when the strict check is needed.

Version History

• 1.2.0
  • Add dm-verity hashtree build/verify (AvbHashtree, port of avbtool generate_hash_tree).
  • Add Reed-Solomon FEC parity generation (AvbFec, compatible with AOSP system/extras/libfec and the fec tool).
  • New CLI commands: make_hashtree_image, verify_hashtree, calc_footer_size, fec encode, fec calc-size.
  • Fix AvbHashtreeDescriptor on-disk layout to match avb_hashtree_descriptor.h.
  • Verify signatures unconditionally; reject signature sizes that do not match the modulus.
  • Delegate CRC32 to the Crc32.NET package (byte-identical output, verified by standard check vectors).
  • Native AOT and trimming compatible.
• 1.1.0
  • Managed libavb_cert unlock-credential validation (AvbCertValidator, IAvbCertOps).
  • persistent-digest and auth-unlock CLI flows.
• 1.0.0
  • Initial release: VBMeta parsing/verification, descriptors, footers, slot verification, A/B flow, user toggles.

License

MIT