assuming you have a secure bootloader in the device (thinking more bare metal than e.g. embedded Linux here) then OTA/DFU updates can be signed with a private key, and the bootloader has the matching public key and refuses an update that's not properly signed. Now only the private key holder can release an update. now assume i have a tablet with a secure OTA setup and can only get new apps onto the tablet by running an OTA from the "company".
now assume i was able to aquire one of the sent OTA packages (by ejecting the sd card using the little invisible button in the settings/storage area and pulling the package before it ran on the device) i now have the original OTA update zip package with base apks,config files and other xml files generally used to configure and secure the tablet in the zip, i also have the .md5 and .sig files that came with the package.
now assume i wanted to take the original package put new apps in there and new config files and eject the SD card place the alterd package where it goes, remount the sd card and get the package to run and install/place the new apps and reconfig the tablet. how can i accomplish this and work around the cryptographic nightmare of sigs and md5s and keys. needing to root a tablet but the security is tight on it, its my legal tablet and i have full permission to do this from the company the tech is old
running android 8.1.0 oreo,no access to settings except a gutted version offering no type of control.no fastboot,bootloader,side load anything like that.the only way in i can see is OTA trick or wiping the side/partition/container holding the secure files overseeing the system or some type of BROM flashing exploit.
simply just plugging the tablet into another rooted tablet and running hexaflash used to work, that exploit was closed by a new update OTA sent out.