This script gives your phone init.d script runner thingy idk but i need to make a thread for this since no one reply to the thread before so here it is by bluntforcetramatothehead Sorry to revive a dead thread. I do have an idea, you would have to use https://github.com/Sepero/bootbuddy Boot Buddy will allow you to run Linux shell scripts when your Android device is booting up. It will run your scripts early in the boot process, before the home screen appears. in theory you might be able to load recovery from sd card and bypass the security checks. "The intended audience is generally intermediate to advanced users, and those who want to play with shell scripting on their device". The next post "Using boot buddy, you have to have busy box installed and script manager. Using the basic scripts I was able to get /dev/block/mmcblk0p12 /system ext4 rw,relatime,user_xattr,barrier=0,data=ordered 0 0" "You have to run the boot buddy script prior to shutdown to load the scripts. If we can run scripts then we might be interested in the boot process. a wonderful slide can be found here http://www.slideshare.net/chrissimmonds/android-bootslides20depends on where in the boot process the checks are done. you would probably need to escalate the attack so we would need Kernel init.d Support Injector from http://forum.xda-developers.com/showpost.php?p=40409356 think the best bet at this point would be to look at the ramdisk. furthermore most of what is on the device talks about qemu goldfish and a emulated environment or at least partially so you can find more info herehttps://android.googlesource.com/platform/external/qemu/+/master/docs/GOLDFISH-VIRTUAL-HARDWARE.TXT so now that we have all that you can probably use this to make bootloader it's called u-boothttp://www.informit.com/articles/article.aspx?p=2433499"