[Privacy Discussion] DeGoogle & Debloat - Root & adb uninstall

[popej]

To restore a bricked device you would need:
- full factory firmware or backup of firmware,
- tools to flash firmware,
- procedure to enter fastboot or edl on device.

I did it several times with my phones. I know the idea, but I miss above details to properly handle Leaf2. Anyway, fastboot should be enough for rooting.

[denisuu]

1. This can be achieved by booting the rooted system image without flashing it. Then dump the whole MMC to a SD card and then copy it to a PC. The .bin file will contain all the partitions you can flash back.

adb shell
Leaf2:/ su
Leaf2:/ dd if=/dev/block/bootdevice/mmcblk0 of=/storage/(SDCardName)/mmcblk0.bin

Alternatively you can pull all the partitions separately.

Leaf2:/ $ ls -al /dev/block/platform/soc/4744000.sdhci/by-name

If you forgot or somehow lost the image I'm sure someone would provide it.

2. These can be flashed through Fastboot or ADB. If the device is bootlooping chances are high you can send a 'adb reboot bootloader' command to it. If that doesn't work you can flash them through EDL (I have to be honest the first time I ever heard about EDL was here 2 days ago)

3. The button combination you posted seems to work.

If for some reason it doesn't, you can always buy an EDL cable from AliExpress for €3 or make one. There's a 1 minute video on Youtube on how to make it called 'How to make EDL cable for Qualcomm CPU’s'

[popej]

Yes, strip usb cable and shortcircuit then. I did it some years ago to revive a phone. Now phones are better protected and this wont work anymore. Seems that edl is still valid for readers. But I have read, that cable trick could be inefficient for USB-C.
And I have no knowledge about edl programs for Leaf.
Having magisk installed should allow to make a backup. There is even a magisk module for this purpose.

[denisuu]

Does anyone have experience with porting a custom recovery like TWRP? The guide below seems pretty straight forward as it's just copying some files, modifying twrp.fstab and default.prop.

The only thing I don't understand is: How should the contents of 'recovery.fstab' be implemented in 'twrp.fstab'? Can all the things that aren't present in recovery.fstab be omitted? As the source TWRP file I used motorola X4 (payton) because it has the same SoC. (Qualcomm Snapdragon 630)

https://forum.xda-developers.com/t/g...ource.3843473/

Leaf 2 stock 'recovery.fstab'

#device         mount point      fstype        [device2] [length=]

system                                     /system         ext4    ro,barrier=1,discard                                            wait,slotselect,avb=vbmeta_system,logical,first_stage_mount
system_ext                                 /system_ext     ext4    ro,barrier=1,discard                                            wait,slotselect,avb=vbmeta_system,logical,first_stage_mount
vendor                                     /vendor         ext4    ro,barrier=1,discard                                            wait,slotselect,avb,logical,first_stage_mount
product                                    /product        ext4    ro,barrier=1,discard                                            wait,slotselect,avb=vbmeta_system,logical,first_stage_mount
/dev/block/bootdevice/by-name/userdata     /data           f2fs    noatime,nosuid,nodev,discard,fsync_mode=nobarrier          wait,check,encryptable=footer
/dev/block/bootdevice/by-name/metadata     /metadata       ext4    noatime,nosuid,nodev,discard                               wait,check,formattable,wrappedkey
/dev/block/mmcblk1p1                       /sdcard         vfat    nosuid,nodev                                               wait
/dev/block/bootdevice/by-name/boot         /boot           emmc    defaults                                                   defaults
/dev/block/bootdevice/by-name/misc         /misc           emmc    defaults                                                   defaults

'twrp.fstab'

/system      ext4    /dev/block/platform/msm_sdcc.1/by-name/system
/data        ext4    /dev/block/platform/msm_sdcc.1/by-name/userdata      flags=forceencrypt=/dev/block/platform/msm_sdcc.1/by-name/metadata
/cache       ext4    /dev/block/platform/msm_sdcc.1/by-name/cache
/firmware    ext4    /dev/block/platform/msm_sdcc.1/by-name/modem         flags=mounttodecrypt
/boot        emmc    /dev/block/platform/msm_sdcc.1/by-name/boot
/recovery    emmc    /dev/block/platform/msm_sdcc.1/by-name/recovery      flags=backup=1
/misc        emmc    /dev/block/platform/msm_sdcc.1/by-name/misc
/modem       emmc    /dev/block/platform/msm_sdcc.1/by-name/modem
/mdm1m9kefs1 emmc    /dev/block/platform/msm_sdcc.1/by-name/mdm1m9kefs1   flags=backup=1;display=EFS
/mdm1m9kefs2 emmc    /dev/block/platform/msm_sdcc.1/by-name/mdm1m9kefs2   flags=backup=1;subpartitionof=/mdm1m9kefs1
/mdm1m9kefs3 emmc    /dev/block/platform/msm_sdcc.1/by-name/mdm1m9kefs3   flags=backup=1;subpartitionof=/mdm1m9kefs1
/sbl1        emmc    /dev/block/platform/msm_sdcc.1/by-name/sbl1
/tz          emmc    /dev/block/platform/msm_sdcc.1/by-name/tz
/rpm         emmc    /dev/block/platform/msm_sdcc.1/by-name/rpm
/sdi         emmc    /dev/block/platform/msm_sdcc.1/by-name/sdi
/aboot       emmc    /dev/block/platform/msm_sdcc.1/by-name/aboot
/versions    emmc    /dev/block/platform/msm_sdcc.1/by-name/versions
/logo        emmc    /dev/block/platform/msm_sdcc.1/by-name/logo
/usb-otg     vfat    /dev/block/sda1     /dev/block/sda                   flags=removable;storage;display=USB-OTG

[Renate]

Originally Posted by popej

Yes, strip usb cable and shortcircuit...

This undoubtedly works on something, but I've never experienced it.
I'm not sure whether the sensing occurs in the abl or in the actual Qualcomm ROM bootloader.

Onyx is pretty good about making the EDL test point obvious.
Of course the hassle is opening the case.
I've posted this a zillion times already. It's a magnetic reed switch I put in so that I can always get to EDL without opening the case.

My opinion is that it's easier to add rooted ADB to stock recovery than it is to port TWRP and add all the properties of your stock device.

[popej]

Originally Posted by denisuu

The only thing I don't understand is: How should the contents of 'recovery.fstab' be implemented in 'twrp.fstab'? Can all the things that aren't present in recovery.fstab be omitted? As the source TWRP file I used motorola X4 (payton) because it has the same SoC. (Qualcomm Snapdragon 630)

No experience in creating TWRP, but for me it looks like you should copy only lines from original fstab, edit line with "/sdcard" and add a line for usb-otg.

As for CPU, it is probably QCS 2290 in Leaf 2:
https://www.qualcomm.com/products/te...essors/qcs2290

CPU Info doesn't show CPU type, but GPU is detected as Adreno 702, which is used in QCS 2290.

[denisuu]

Smart to make it a magnetic switch! I would only do that if I actually brick the device though.

Do you have a link to a guide for that? Also once you have a recovery with adb & root how would you make a full system backup? (To transfer to and identical device) just DD the whole MMC?

[popej]

Nice idea with reed switch

I have tested some firewalls based on VPN. They don't block all communication with Onyx servers. Maybe some system programs bypass VPN. What is annoying, VPN firewalls use internet themself.

Finally I have rooted my Leaf 2, denisuu thanks for procedure!

This is my current configuration:

AFWall+ (root, white list mode)
Bromite (degoogled Chrome with adblock)
Droid-ify (replacement for F-Droid app)
Aurora Store (replacement for Play Store)
KOReader
Qdict (dictionary)
Google keyboard
and some other tools from F-Droid repository

Removed apps:

adb shell pm uninstall -k --user 0 com.onyx.appmarket
adb shell pm uninstall -k --user 0 com.onyx.calculator
adb shell pm uninstall -k --user 0 com.onyx.dict
adb shell pm uninstall -k --user 0 com.onyx.easytransfer
adb shell pm uninstall -k --user 0 com.onyx.floatingbutton
adb shell pm uninstall -k --user 0 com.onyx.mail
adb shell pm uninstall -k --user 0 org.chromium.chrome
adb shell pm uninstall -k --user 0 com.simplemobiletools.clock
adb shell pm uninstall -k --user 0 com.simplemobiletools.gallery
adb shell pm uninstall -k --user 0 com.simplemobiletools.musicplayer
adb shell pm uninstall -k --user 0 com.simplemobiletools.voicerecorder

Disabled apps:

adb shell pm disable-user --user 0 com.onyx.igetshop
adb shell pm disable-user --user 0 com.onyx.kreader
adb shell pm disable-user --user 0 com.qualcomm.qti.sva
adb shell pm disable-user --user 0 com.qualcomm.embms

And I have disabled Play Store in reader settings.

I could remove more programs, like NFC support, but I think they are mostly harmless.

[Renate]

Originally Posted by popej

As for CPU, it is probably QCS 2290 in Leaf 2

That could well be, but naming by Qualcomm is so screwed up.
I thought from the (Chinese) video from Onyx that it was a SnapDragon 630.
What does cat /proc/cpuinfo show? Quad or Octo? Bengal?

[denisuu]

Originally Posted by popej

CPU Info doesn't show CPU type, but GPU is detected as Adreno 702, which is used in QCS 2290.

Glad I could help!
I installed CPU-Z from F-Droid and it does show Snapdragon 630.

Originally Posted by Renate

What does cat /proc/cpuinfo show? Quad or Octo? Bengal?

This is the output:

Leaf2:/ # cat /proc/cpuinfo                                                    
Processor	: AArch64 Processor rev 4 (aarch64)
processor	: 0
BogoMIPS	: 38.40
Features	: fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid
CPU implementer	: 0x51
CPU architecture: 8
CPU variant	: 0xa
CPU part	: 0x801
CPU revision	: 4

processor	: 1
BogoMIPS	: 38.40
Features	: fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid
CPU implementer	: 0x51
CPU architecture: 8
CPU variant	: 0xa
CPU part	: 0x801
CPU revision	: 4

processor	: 2
BogoMIPS	: 38.40
Features	: fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid
CPU implementer	: 0x51
CPU architecture: 8
CPU variant	: 0xa
CPU part	: 0x801
CPU revision	: 4

processor	: 3
BogoMIPS	: 38.40
Features	: fp asimd evtstrm aes pmull sha1 sha2 crc32 cpuid
CPU implementer	: 0x51
CPU architecture: 8
CPU variant	: 0xa
CPU part	: 0x801
CPU revision	: 4

Hardware	: Qualcomm Technologies, Inc SCUBAPIIOT

[Renate]

Thanks.
Has anybody checked out EDL yet?
The HWID is the only unambiguous ID.
If it is a 630 then the same EDL loader should (probably) work as for the Poke3.
(My apologies if I'm treading over the same ground. I deal with so many devices that I don't own it's easy to get confused.)

C:\>qcomview poke3.bin
APQ8096
APQ8098
MDM9250
MDM9255
MDM9350
MDM9650
MDM9655
MSM8996
MSM8997
MSM8998
QDF2432
SDA630
SDA636
SDA658
SDA660
SDM636
SDM658
SDM660

[denisuu]

I will check out all the apps you mentioned! Normally I use Brave on all my devices but as that doesn't work without play services, I installed EinkBro. TBH browsing the internet on an e-ink device is not a great experience so I probably won't be using the browser much.

I remember that I tested flipping the device around to see if the keys would also flip around in KoReader. Either I was just way to tired and confused or it stopped working by removing some "bloatware", when you flip your device around do the buttons also flip or stay the same?

Just out of curiosity how do you guys have AFWall+ configured?

[denisuu]

Originally Posted by Renate

Thanks.
Has anybody checked out EDL yet?
The HWID is the only unambiguous ID.
If it is a 630 then the same EDL loader should (probably) work as for the Poke3.
(My apologies if I'm treading over the same ground. I deal with so many devices that I don't own it's easy to get confused.)

When I use your tool over at XDA I get this error:

.\edl.exe /l
Found EDL 9008
Could not open device

EDIT: My bad, removed the Qualcomm drivers and used Zadig as you recommended:

HWID: 001860e100000000, QC: 001860e1, OEM: 0000, Model: 0000
Hash: d40eee56f3194665-574109a39267724a-e7944134cd53cb76-7e293d3c40497955

[Renate]

Originally Posted by denisuu

001860e1

Oh, you mean "QCS_AGATTI"?
(Qualcomm naming will be the death of me.)

Why didn't you try actually loading a loader?
A link for the Poke3 loader is on my EDL page.
And then try listing the GPT.

It looks like this is more similar to a SDM662.
I think that identification with the SDM630 is in error?
Try this loader here: https://www.mobileread.com/forums/sh...&postcount=107

[popej]

See the picture of CPU inside Poke 4 Lite at this site, could be the same as Leaf 2:
club.dns-shop.ru/review/t-81-elektronnyie-knigi/76304-obzor-elektronnoi-knigi-onyx-boox-poke-4-lite

My favorite browser is Bromite. I'm not sure if it needs Google services for working, but it still works after I have disabled all Google software at device. Well, Google TTS works too.

My second choice of browser would be Mull from Divest OS. It is "de-mozilled" Firefox

I haven't used firewall on Android for years. On AFWall+ I have chosen "Allow selected", then cleared all selected and marked programs, that I wanted to get access to Internet. Then I have executed "Apply" from menu (easy to forget). I hope this is OK. Selected apps work and router doesn't show any unwanted connections form reader.