[Privacy Discussion] DeGoogle & Debloat - Root & adb uninstall

[mergen3107]

@popej
You can also go to AFWall settings and enable the reboot daemon workaround. This is just in case, so when the device reboots with Wi-Fi AFWall+ activates before the actual internet traffic kicks in.

[mergen3107]

Among other topics here, I’ll add my 2 cents, if I may

For Google services, there are replacement methods like microG. Haven’t tried that myself due to lack of need, but they look generic. So might be useful to those who can’t find a replacement app/service to GS-demanding ones.

Speaking of which, I learned recently how to connect to eduroam and local internet provider secure enterprise Wi-Fi networks using the .crt files. Works the same as those “setup” apps that lazily load up those Wi-Fi profiles with a click of a button.

[Renate]

Originally Posted by popej

See the picture of CPU inside Poke 4 Lite at this site, could be the same as Leaf 2:
https://club.dns-shop.ru/review/t-81...ox-poke-4-lite

That seems pretty compelling evidence that the Poke4 Lite is a QCS2290.
However, that doesn't say anything about whether it's some AGATTI version.
Until we get a real HWID off Poke4Lite we won't know.
In the land of loaders I don't see anything referring to QCS2290.

We know that the Leaf2 is a QCS_AGATTI. It may also be a QCS1234. We don't know.

[popej]

There is no signature spoofing support in Leaf 2. Installing microg without it is quite a hacking.

[denisuu]

Originally Posted by mergen3107

For Google services, there are replacement methods like microG. Haven’t tried that myself due to lack of need, but they look generic. So might be useful to those who can’t find a replacement app/service to GS-demanding ones.

I've been using MicroG for a couple of years now on my main Android devices, it's a great project! But for this e-reader I just want to keep it as bare-bones as possible. I just want to read books and PDF's on it. The least amount of resources it uses the better!

I tried these instructions: XDA Modify recovery

The repacked recovery is only 22,42mb while the original one was 98,3mb

Then tried:

fastboot boot recovery_mod.img

Now the device is bootlooping lol, holding power or pushing it fast doesn't break it out of it. I guess I should wait until the battery dies or open it and disconnect it.

Time to order some magnetic reed switches lol

EDIT: Nevermind I was doing the sequence wrong.

[Renate]

Originally Posted by denisuu

The repacked recovery is only 22,42mb while the original one was 98,3mb

The original included 76 MB of zeroes. But watch out for the AVB0 footer, which may or may not be important. You can use my imgutil.exe /v to see structure/padding of an image.

Originally Posted by denisuu

Then tried:

fastboot boot recovery_mod.img

In many instances "fastboot boot" does not work correctly because of the cmdline passed. The "gold standard" is always "fastboot flash".

Originally Posted by denisuu

Time to order some magnetic reed switches lol .

https://www.digikey.com/en/products/...-30-at/1949374

Hey! How about checking out the EDL loaders for me, please?

[popej]

Has anyone tried flashing from stock recovery? I guess one can enter recovery and flash update.zip. But maybe it is possible to flash magisk.zip directly?

I get problems with firewall. There are some delays when browsing and Bromite shows "no connection", even if pages can be downloaded. I have enabled network manager and dns services in firewall. This seems to help, but then reader started to call Onyx server again.

[mergen3107]

If you see an exclamation mark in your Wi-Fi icon, try this: https://android.stackexchange.com/qu...-mark-on-wi-fi

[denisuu]

Originally Posted by Renate

Hey! How about checking out the EDL loaders for me, please?

I will when I can get out of the bootloop.

I can boot into recovery and boot fastboot from there. I tried flashing the stock boot and recovery images but the device keeps bootlooping. (Factory reset in recovery doesn't work either)

Both 'fastboot reboot-edl' and 'fastboot oem edl' return:

...
FAILED (remote: unknown command)
finished. total time: 0.004s

I extracted the 'mmcblk0.bin' it contains there images.
I guess I could flash them all through 'fastboot flashall' and hope it solves the bootloop.

0.xbl_a.img
1.xbl_b.img
10.boot_a.img
11.boot_b.img
12.super.img
13.vbmeta_system_a.img
14.vbmeta_system_b.img
15.recovery_a.img
16.recovery_b.img
17.keymaster_a.img
18.keymaster_b.img
19.mdtpsecapp_a.img
2.xbl_config_a.img
20.mdtpsecapp_b.img
21.mdtp_a.img
22.mdtp_b.img
23.modem_a.img
24.modem_b.img
25.dsp_a.img
26.dsp_b.img
27.abl_a.img
28.abl_b.img
29.ddr.img
3.xbl_config_b.img
30.bluetooth_a.img
31.bluetooth_b.img
32.ssd.img
33.dtbo_a.img
34.dtbo_b.img
35.imagefv_a.img
36.imagefv_b.img
37.uefisecapp_a.img
38.uefisecapp_b.img
39.persist.img
4.tz_a.img
40.metadata.img
41.misc.img
42.keystore.img
43.devcfg_a.img
44.devcfg_b.img
45.featenabler_a.img
46.featenabler_b.img
47.qupfw_a.img
48.qupfw_b.img
49.frp.img
5.tz_b.img
50.rawdump.img
51.devinfo.img
52.dip.img
53.apdp.img
54.spunvm.img
55.splash.img
56.limits.img
57.toolsfv.img
58.logfs.img
59.cateloader.img
6.rpm_a.img
60.logdump.img
61.vbmeta_a.img
62.vbmeta_b.img
63.storsec.img
64.multiimgoem_a.img
65.multiimgoem_b.img
66.multiimgqti.img
67.secdata.img
68.catefv.img
69.catecontentfv.img
7.rpm_b.img
70.uefivarstore.img
71.modemst1.img
72.modemst2.img
73.fsg.img
74.fsc.img
75.onyxconfig.img
76.userdata.img
8.hyp_a.img
9.hyp_b.img

Another option would be to modify the recovery so that I can boot it and have ADB from there, then reboot into EDL. Worst case I would have to open the device, in that case I can also take a picture of the CPU.

I guess there reed-switches are good too? Amazon

[Renate]

Originally Posted by denisuu

I guess their reed-switches are good too? Amazon

They'll work just fine. Actually, anything would.
But they are 2.5 mm x 14 mm. Mine are 1.8 mm x 7 mm.
You may have more difficulties fitting them in.

[denisuu]

Originally Posted by Renate

Hey! How about checking out the EDL loaders for me, please?

I will when I can get out of the bootloop.

Originally Posted by Renate

The original included 76 MB of zeroes. But watch out for the AVB0 footer, which may or may not be important. You can use my imgutil.exe /v to see structure/padding of an image.?

This is the output so there is 76MB of zeroes indeed.

imgutil.exe /v .\15.recovery_a.img
Header2:        1,660 (0000067c)
Kernel:    15,259,279 (00e8d68f) 00001000
Ramdisk:    8,340,618 (007f448a) 00e8f000
Recovery:      94,979 (00017303) 01684000
DTB:          290,066 (00046d12) 0169c000
Signature:        640 (00000280) 016e3000
Padding:   76,660,736 (0491c000) 016e4000
Command: console=ttyMSM0,115200n8 earlycon=msm_geni_serial,0x4a90000 androidboot.hardware=qcom androidboot.console=ttyMSM0 androidboot.memcg=1 lpm_levels.sleep_disabled=1 video=vfb:640x400,bpp=32,memsize=3072000 msm_rtb.filter=0x237 service_locator.enable=1 swiotlb=2048 loop.max_part=7 buildvariant=user

I can boot into recovery and boot fastboot from there. I tried flashing the stock boot and recovery images but the device keeps bootlooping. (Factory reset in recovery doesn't work either)

Both 'fastboot reboot-edl' and 'fastboot oem edl' return:

...
FAILED (remote: unknown command)
finished. total time: 0.004s

I extracted the 'mmcblk0.bin' it contains there images.
I guess I could flash them all through 'fastboot flashall' and hope it solves the bootloop.

0.xbl_a.img
1.xbl_b.img
10.boot_a.img
11.boot_b.img
12.super.img
13.vbmeta_system_a.img
14.vbmeta_system_b.img
15.recovery_a.img
16.recovery_b.img
17.keymaster_a.img
18.keymaster_b.img
19.mdtpsecapp_a.img
2.xbl_config_a.img
20.mdtpsecapp_b.img
21.mdtp_a.img
22.mdtp_b.img
23.modem_a.img
24.modem_b.img
25.dsp_a.img
26.dsp_b.img
27.abl_a.img
28.abl_b.img
29.ddr.img
3.xbl_config_b.img
30.bluetooth_a.img
31.bluetooth_b.img
32.ssd.img
33.dtbo_a.img
34.dtbo_b.img
35.imagefv_a.img
36.imagefv_b.img
37.uefisecapp_a.img
38.uefisecapp_b.img
39.persist.img
4.tz_a.img
40.metadata.img
41.misc.img
42.keystore.img
43.devcfg_a.img
44.devcfg_b.img
45.featenabler_a.img
46.featenabler_b.img
47.qupfw_a.img
48.qupfw_b.img
49.frp.img
5.tz_b.img
50.rawdump.img
51.devinfo.img
52.dip.img
53.apdp.img
54.spunvm.img
55.splash.img
56.limits.img
57.toolsfv.img
58.logfs.img
59.cateloader.img
6.rpm_a.img
60.logdump.img
61.vbmeta_a.img
62.vbmeta_b.img
63.storsec.img
64.multiimgoem_a.img
65.multiimgoem_b.img
66.multiimgqti.img
67.secdata.img
68.catefv.img
69.catecontentfv.img
7.rpm_b.img
70.uefivarstore.img
71.modemst1.img
72.modemst2.img
73.fsg.img
74.fsc.img
75.onyxconfig.img
76.userdata.img
8.hyp_a.img
9.hyp_b.img

Another option would be to modify the recovery so that I can boot it and have ADB from there, then reboot into EDL. Worst case I would have to open the device, in that case I can also take a picture of the CPU.

I guess there reed-switches are good too? Amazon

[Renate]

Originally Posted by denisuu

Both 'fastboot reboot-edl' and 'fastboot oem edl' return:

...
FAILED (remote: unknown command)
finished. total time: 0.004s

No, they don't. "fastboot reboot-edl" returns "fastboot: usage: unknown command reboot-edl".

Ok, neither work, but the difference is that fastboot.exe filters for unknown commands and won't even try if it doesn't recognize the command. OTOH "fastboot oem roast-turkey" sends the command and the abl refuses it.

I believe that there have been rare cases with secret commands that could only be sent through a patched fastboot.

Originally Posted by denisuu

I guess I could flash them all...

Really, you don't know what you broke?

With no proof of working EDL and a broken normal boot it's probably not the best time to be replacing recovery. Still, if you post me a copy of recovery, I'll see if I can get around to it.

[denisuu]

You're right, the error is not the same but neither work.

Originally Posted by Renate

Really, you don't know what you broke?

Well, I didn't flash anything else so I assume it could only be boot or recovery.

I just tried 'fastboot boot recovery.img' that made it bootloop after I tried these, but the device still bootloops (until it eventually goes to fastboot)

fastboot flash boot_a 10.boot_a.img
fastboot flash boot_b 11.boot_b.img
fastboot flash recovery_a 10.recovery_a.img
fastboot flash recovery_b 11.recovery_b.img

Here is the stock recovery:
Leaf 2 stock recovery

[popej]

Originally Posted by mergen3107

If you see an exclamation mark in your Wi-Fi icon, try this: https://android.stackexchange.com/qu...-mark-on-wi-fi

Thanks. I have seen this info, but I'm not willing to mess things, that I don't understand. Just checked now, described variable captive_portal_detection_enabled doesn't exist on Leaf.

>adb shell settings get global captive_portal_detection_enabled
null

[popej]

You could try to switch partition a/b. Try this:

fastboot getvar all

You should get a lot info, including something like this:

(bootloader) has-slot:modem:yes
(bootloader) has-slot:system:no
(bootloader) current-slot:a
(bootloader) has-slot:boot:yes
(bootloader) slot-retry-count:b:6
(bootloader) slot-unbootable:b:no
(bootloader) slot-successful:b:yes
(bootloader) slot-retry-count:a:6
(bootloader) slot-unbootable:a:no
(bootloader) slot-successful:a:yes
(bootloader) slot-count:2

If you are on slot a, like my Leaf above, then try to switch:

fastboot  --set-active=b

Just an idea, hope it wont make things worst.