What malware persistence mechanism does Android malware use to survive a device reboot without root access?

• A.Non-root malware does not survive a restart, and restarting the handset clears the infection because the platform starts nothing on its own (the launcher waits for the user to tap an icon): the persistence an analyst reads about applies to rooted devices, and a helpdesk instruction to reboot resolves the case. The scheduled work queue is cleared at the same time the process is killed. Nothing is left behind. The case closes there.
• B.Android malware injects code into the init process at boot, and the technique needs a modified boot image because the platform verifies it before handing control to the kernel (the chain of trust starts in the bootloader): the persistence is real where it works. Locked devices are outside the pattern.
• C.Malware persists by modifying its own archive on the platform partition, and the copy is restored at each boot because the platform treats that location as part of the image (the mount is immutable in normal operation): the technique needs a writable system. Ordinary handsets refuse it.