rooting - Does flashing a custom ROM require root access?

It was recently brought to my attention that it does not. Can someone confirm this and explain what the determining characteristics are that dictate whether or not root its required to flash a custom ROM?

Answer

Methods I know of:

1. 
   

   Use a carrier/manufacturer tool such as Odin for some Samsung phones (I've done this -- it's easily the most feasible method). It connects to the phone and writes to the phone storage when the phone is in Download mode. A knowledgeable person could probably write their own tool as well.

   
   


2. 
   

   Sign the update.zip file, so that the recovery/bootloader thinks its an official update. That's really the only way most phones can distinguish them (not sure if an encrypted bootloader makes it harder).

   
   
   

   "Has anyone actually done this?" That I don't know -- it's probably incredibly difficult to fake, but realistically someone could gain access to the signing software.

   
   


3. 
   

   Use a jig (an electronic setup that connects directly to parts of the device) to write directly to the storage. Imagine the phone as a PC where the BIOS prevents writing to the hard drive -- if you don't boot up the computer, the BIOS can't interfere, so you could just take out the drive and write to it with something else. Chips are just not as removable as drives, hence the jig. This would probably require custom software to do the writing, again possibly taken from the manufacturer. And if you don't overwrite the bootloader you might run into problems depending on what checks it does, I'm not sure.

   
   

At a previous job (a phone manufacturer) they used a similar tool to Odin to replace the bootloader, sometimes with one that didn't require the ROMs to be signed. Access to a tool like that makes a lot of problems go away.