diff --git a/bootloader_message/Android.bp b/bootloader_message/Android.bp
index 5cd2132..450dad0 100644
--- a/bootloader_message/Android.bp
+++ b/bootloader_message/Android.bp
@@ -14,9 +14,8 @@
 // limitations under the License.
 //
 
-cc_library {
-    name: "libbootloader_message",
-    recovery_available: true,
+cc_defaults {
+    name: "libbootloader_message_defaults",
     srcs: ["bootloader_message.cpp"],
     cflags: [
         "-Wall",
@@ -24,7 +23,25 @@
     ],
     shared_libs: [
         "libbase",
-        "libfs_mgr",
+    ],
+    static_libs: [
+        "libfstab",
     ],
     export_include_dirs: ["include"],
 }
+
+cc_library {
+    name: "libbootloader_message",
+    defaults: [
+        "libbootloader_message_defaults",
+    ],
+    recovery_available: true,
+}
+
+cc_library_static {
+    name: "libbootloader_message_vendor",
+    defaults: [
+        "libbootloader_message_defaults",
+    ],
+    vendor: true,
+}
diff --git a/bootloader_message/bootloader_message.cpp b/bootloader_message/bootloader_message.cpp
index 8c1d63b..c1ebeaa 100644
--- a/bootloader_message/bootloader_message.cpp
+++ b/bootloader_message/bootloader_message.cpp
@@ -21,6 +21,7 @@
 #include <string.h>
 
 #include <string>
+#include <string_view>
 #include <vector>
 
 #include <android-base/file.h>
@@ -32,7 +33,17 @@
 using android::fs_mgr::Fstab;
 using android::fs_mgr::ReadDefaultFstab;
 
+static std::string g_misc_device_for_test;
+
+// Exposed for test purpose.
+void SetMiscBlockDeviceForTest(std::string_view misc_device) {
+  g_misc_device_for_test = misc_device;
+}
+
 static std::string get_misc_blk_device(std::string* err) {
+  if (!g_misc_device_for_test.empty()) {
+    return g_misc_device_for_test;
+  }
   Fstab fstab;
   if (!ReadDefaultFstab(&fstab)) {
     *err = "failed to read default fstab";
@@ -228,6 +239,37 @@
                               WIPE_PACKAGE_OFFSET_IN_MISC, err);
 }
 
+static bool OffsetAndSizeInVendorSpace(size_t offset, size_t size) {
+  auto total_size = WIPE_PACKAGE_OFFSET_IN_MISC - VENDOR_SPACE_OFFSET_IN_MISC;
+  return size <= total_size && offset <= total_size - size;
+}
+
+bool ReadMiscPartitionVendorSpace(void* data, size_t size, size_t offset, std::string* err) {
+  if (!OffsetAndSizeInVendorSpace(offset, size)) {
+    *err = android::base::StringPrintf("Out of bound read (offset %zu size %zu)", offset, size);
+    return false;
+  }
+  auto misc_blk_device = get_misc_blk_device(err);
+  if (misc_blk_device.empty()) {
+    return false;
+  }
+  return read_misc_partition(data, size, misc_blk_device, VENDOR_SPACE_OFFSET_IN_MISC + offset,
+                             err);
+}
+
+bool WriteMiscPartitionVendorSpace(const void* data, size_t size, size_t offset, std::string* err) {
+  if (!OffsetAndSizeInVendorSpace(offset, size)) {
+    *err = android::base::StringPrintf("Out of bound write (offset %zu size %zu)", offset, size);
+    return false;
+  }
+  auto misc_blk_device = get_misc_blk_device(err);
+  if (misc_blk_device.empty()) {
+    return false;
+  }
+  return write_misc_partition(data, size, misc_blk_device, VENDOR_SPACE_OFFSET_IN_MISC + offset,
+                              err);
+}
+
 extern "C" bool write_reboot_bootloader(void) {
   std::string err;
   return write_reboot_bootloader(&err);
diff --git a/bootloader_message/include/bootloader_message/bootloader_message.h b/bootloader_message/include/bootloader_message/bootloader_message.h
index 95c19ae..95dd8f4 100644
--- a/bootloader_message/include/bootloader_message/bootloader_message.h
+++ b/bootloader_message/include/bootloader_message/bootloader_message.h
@@ -28,8 +28,9 @@
 // 16K - 64K    Used by uncrypt and recovery to store wipe_package for A/B devices
 // Note that these offsets are admitted by bootloader,recovery and uncrypt, so they
 // are not configurable without changing all of them.
-static const size_t BOOTLOADER_MESSAGE_OFFSET_IN_MISC = 0;
-static const size_t WIPE_PACKAGE_OFFSET_IN_MISC = 16 * 1024;
+constexpr size_t BOOTLOADER_MESSAGE_OFFSET_IN_MISC = 0;
+constexpr size_t VENDOR_SPACE_OFFSET_IN_MISC = 2 * 1024;
+constexpr size_t WIPE_PACKAGE_OFFSET_IN_MISC = 16 * 1024;
 
 /* Bootloader Message (2-KiB)
  *
@@ -228,6 +229,14 @@
 // Write the wipe package into BCB (to offset WIPE_PACKAGE_OFFSET_IN_MISC).
 bool write_wipe_package(const std::string& package_data, std::string* err);
 
+// Reads data from the vendor space in /misc partition, with the given offset and size. Note that
+// offset is in relative to the start of vendor space.
+bool ReadMiscPartitionVendorSpace(void* data, size_t size, size_t offset, std::string* err);
+
+// Writes the given data to the vendor space in /misc partition, at the given offset. Note that
+// offset is in relative to the start of the vendor space.
+bool WriteMiscPartitionVendorSpace(const void* data, size_t size, size_t offset, std::string* err);
+
 #else
 
 #include <stdbool.h>
diff --git a/misc_writer/Android.bp b/misc_writer/Android.bp
new file mode 100644
index 0000000..567143c
--- /dev/null
+++ b/misc_writer/Android.bp
@@ -0,0 +1,40 @@
+//
+// Copyright (C) 2019 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+cc_binary {
+    name: "misc_writer",
+    vendor: true,
+
+    srcs: [
+        "misc_writer.cpp",
+    ],
+
+    cpp_std: "experimental",
+
+    cflags: [
+        "-Wall",
+        "-Werror",
+    ],
+
+    shared_libs: [
+        "libbase",
+    ],
+
+    static_libs: [
+        "libbootloader_message_vendor",
+        "libfstab",
+    ],
+}
diff --git a/misc_writer/misc_writer.cpp b/misc_writer/misc_writer.cpp
new file mode 100644
index 0000000..1d9702e
--- /dev/null
+++ b/misc_writer/misc_writer.cpp
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2019 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <errno.h>
+#include <getopt.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#include <iostream>
+#include <string>
+#include <string_view>
+#include <vector>
+
+#include <android-base/logging.h>
+#include <android-base/parseint.h>
+#include <bootloader_message/bootloader_message.h>
+
+using namespace std::string_literals;
+
+static std::vector<uint8_t> ParseHexString(std::string_view hex_string) {
+  auto length = hex_string.size();
+  if (length % 2 != 0 || length == 0) {
+    return {};
+  }
+
+  std::vector<uint8_t> result(length / 2);
+  for (size_t i = 0; i < length / 2; i++) {
+    auto sub = "0x" + std::string(hex_string.substr(i * 2, 2));
+    if (!android::base::ParseUint(sub, &result[i])) {
+      return {};
+    }
+  }
+  return result;
+}
+
+static int Usage(std::string_view name) {
+  std::cerr << name << " usage:\n";
+  std::cerr << name << " [--vendor-space-offset <offset>] --hex-string 0xABCDEF\n";
+  std::cerr << "Writes the given hex string to the specified offset in vendor space in /misc "
+               "partition. Offset defaults to 0 if unspecified.\n";
+  return EXIT_FAILURE;
+}
+
+// misc_writer is a vendor tool that writes data to the vendor space in /misc.
+int main(int argc, char** argv) {
+  constexpr struct option OPTIONS[] = {
+    { "vendor-space-offset", required_argument, nullptr, 0 },
+    { "hex-string", required_argument, nullptr, 0 },
+    { nullptr, 0, nullptr, 0 },
+  };
+
+  // Offset defaults to 0 if unspecified.
+  size_t offset = 0;
+  std::string_view hex_string;
+
+  int arg;
+  int option_index;
+  while ((arg = getopt_long(argc, argv, "", OPTIONS, &option_index)) != -1) {
+    if (arg != 0) {
+      LOG(ERROR) << "Invalid command argument";
+      return Usage(argv[0]);
+    }
+    auto option_name = OPTIONS[option_index].name;
+    if (option_name == "vendor-space-offset"s) {
+      if (!android::base::ParseUint(optarg, &offset)) {
+        LOG(ERROR) << "Failed to parse the offset: " << optarg;
+        return Usage(argv[0]);
+      }
+    } else if (option_name == "hex-string"s) {
+      hex_string = optarg;
+    }
+  }
+
+  if (hex_string.starts_with("0x") || hex_string.starts_with("0X")) {
+    hex_string = hex_string.substr(2);
+  }
+  if (hex_string.empty()) {
+    LOG(ERROR) << "Invalid input hex string: " << hex_string;
+    return Usage(argv[0]);
+  }
+
+  auto data = ParseHexString(hex_string);
+  if (data.empty()) {
+    LOG(ERROR) << "Failed to parse the input hex string: " << hex_string;
+    return EXIT_FAILURE;
+  }
+  if (std::string err; !WriteMiscPartitionVendorSpace(data.data(), data.size(), offset, &err)) {
+    LOG(ERROR) << "Failed to write to misc partition: " << err;
+    return EXIT_FAILURE;
+  }
+  return EXIT_SUCCESS;
+}
diff --git a/tests/component/bootloader_message_test.cpp b/tests/component/bootloader_message_test.cpp
index b005d19..95d875e 100644
--- a/tests/component/bootloader_message_test.cpp
+++ b/tests/component/bootloader_message_test.cpp
@@ -15,6 +15,7 @@
  */
 
 #include <string>
+#include <string_view>
 #include <vector>
 
 #include <android-base/file.h>
@@ -22,6 +23,10 @@
 #include <bootloader_message/bootloader_message.h>
 #include <gtest/gtest.h>
 
+using namespace std::string_literals;
+
+extern void SetMiscBlockDeviceForTest(std::string_view misc_device);
+
 TEST(BootloaderMessageTest, read_and_write_bootloader_message) {
   TemporaryFile temp_misc;
 
@@ -114,3 +119,36 @@
             std::string(boot.reserved, sizeof(boot.reserved)));
 }
 
+TEST(BootloaderMessageTest, WriteMiscPartitionVendorSpace) {
+  TemporaryFile temp_misc;
+  ASSERT_TRUE(android::base::WriteStringToFile(std::string(4096, '\x00'), temp_misc.path));
+  SetMiscBlockDeviceForTest(temp_misc.path);
+
+  constexpr std::string_view kTestMessage = "kTestMessage";
+  std::string err;
+  ASSERT_TRUE(WriteMiscPartitionVendorSpace(kTestMessage.data(), kTestMessage.size(), 0, &err));
+
+  std::string message;
+  message.resize(kTestMessage.size());
+  ASSERT_TRUE(ReadMiscPartitionVendorSpace(message.data(), message.size(), 0, &err));
+  ASSERT_EQ(kTestMessage, message);
+
+  // Write with an offset.
+  ASSERT_TRUE(WriteMiscPartitionVendorSpace("\x00\x00", 2, 5, &err));
+  ASSERT_TRUE(ReadMiscPartitionVendorSpace(message.data(), message.size(), 0, &err));
+  ASSERT_EQ("kTest\x00\x00ssage"s, message);
+
+  // Write with the right size.
+  auto start_offset =
+      WIPE_PACKAGE_OFFSET_IN_MISC - VENDOR_SPACE_OFFSET_IN_MISC - kTestMessage.size();
+  ASSERT_TRUE(
+      WriteMiscPartitionVendorSpace(kTestMessage.data(), kTestMessage.size(), start_offset, &err));
+
+  // Out-of-bound write.
+  ASSERT_FALSE(WriteMiscPartitionVendorSpace(kTestMessage.data(), kTestMessage.size(),
+                                             start_offset + 1, &err));
+
+  // Message won't fit.
+  std::string long_message(WIPE_PACKAGE_OFFSET_IN_MISC - VENDOR_SPACE_OFFSET_IN_MISC + 1, 'a');
+  ASSERT_FALSE(WriteMiscPartitionVendorSpace(long_message.data(), long_message.size(), 0, &err));
+}