How the head unit lays out its storage — worth understanding before you change anything, and the basis for a safe backup. The eMMC is mmcblk0 (~29 GB). Because adbd runs as root, the raw partitions are readable, so a byte-exact image of the whole device is possible.

Do this before modifying anything. With root adbd a complete image is straightforward: md5-verified partition images plus a file-level copy of /system and /vendor.

Gotcha — the old ADB: a normal shell corrupts binary data (the PTY translates line endings) and exec-out is unsupported on this old adbd, so stream binary through base64 + gzip (7-bit, PTY-safe). adb pull itself is binary-safe (it uses the sync protocol).