[Privacy Discussion] DeGoogle & Debloat - Root & adb uninstall

[denisuu]

Originally Posted by popej

fastboot --set-active=b

That fixed it, thanks! I'm happy it was that simple.
Thanks to you guys too @Renate & @mergen3107 for all the help so far!

I'll test the loaders now.

[popej]

Great!
Check system version now, it could be an older instance.

[denisuu]

Originally Posted by popej

Great!
Check system version now, it could be an older instance.

When I set the active boot to A the device boots when I set it to boot B it keeps bootlooping. (Boot A had the latest version.)

I once had this problem on a Xiaomi Mi2 and completely forgot about changing the active partition.

C:\> .\edl.exe /lQualcomm_662_loader.elf
Found EDL 9008
Resetting Sahara
Serial: a644bb87
HWID: 001860e100000000, QC: 001860e1, OEM: 0000, Model: 0000
Hash: d40eee56f3194665-574109a39267724a-e7944134cd53cb76-7e293d3c40497955
Sending Qualcomm_662_loader.elf 100% Ok
Waiting for Firehose... No response, poking...
Could not write device

C:\> .\edl.exe /l000cc0e100000000_7be49b72f9e43372_fhprg_bqx2_peek.bin
Found EDL 9008
Serial: a644bb87
HWID: 001860e100000000, QC: 001860e1, OEM: 0000, Model: 0000
Hash: d40eee56f3194665-574109a39267724a-e7944134cd53cb76-7e293d3c40497955
Sending 000cc0e100000000_7be49b72f9e43372_fhprg_bqx2_peek.bin   0%
End transfer returned error 12

[Renate]

Originally Posted by denisuu

C:\> .\edl.exe /lQualcomm_662_loader.elf

Hmm, this looked like it had a bit more potential.
I can also see that it didn't start from a fresh start.
Since the whole Sahara is so fragile, could you try it again from a fresh start of EDL mode?

[denisuu]

Originally Posted by Renate

Hmm, this looked like it had a bit more potential.
I can also see that it didn't start from a fresh start.
Since the whole Sahara is so fragile, could you try it again from a fresh start of EDL mode?

I tried again a couple of times (even after rebooting my PC and device). Only tried that one command in EDL, same result each time.

[denisuu]

The chip is a QCS2290 000

[Renate]

Originally Posted by denisuu

The chip is a QCS2290 000

Well, you've hit the Rosetta stone!
Now we know that a QCS_AGATTI is a QCS2290.
Here's one more Firehose loader to try: https://github.com/bkerler/Loaders/b...4665_FHPRG.bin

I'm confused over the two big FPC (orange) cables.

Onyx seems to be more secretive here. Still, the 5 dots on the bottom edge of the board look good for UART & EDL mode. Just don't short them!

Do you want to be a beta tester for a Leaf2 custom recovery?

[denisuu]

Originally Posted by Renate

Well, you've hit the Rosetta stone!
Now we know that a QCS_AGATTI is a QCS2290.
Here's one more Firehose loader to try: https://github.com/bkerler/Loaders/b...4665_FHPRG.bin

I'm confused over the two big FPC (orange) cables.

Onyx seems to be more secretive here. Still, the 5 dots on the bottom edge of the board look good for UART & EDL mode. Just don't short them!

Do you want to be a beta tester for a Leaf2 custom recovery?

I will try the loader tomorrow morning.

How do I find out which ones are for EDL mode?

It seems that holding power + volume down in Fastboot also boots it into EDL (at least that's how it recognized in Device Manager) But the device is not responding.

Yes, I would like to be a beta tester.

[denisuu]

Originally Posted by Renate

Here's one more Firehose loader to try: https://github.com/bkerler/Loaders/b...4665_FHPRG.bin

This is the result for the 3th loader:

PS C:\00 - Standalone\EDL> .\edl.exe /l0014d0e100000000_d40eee56f3194665_FHPRG.bin
Found EDL 9008
Resetting Sahara
Serial: a644bb87
HWID: 001860e100000000, QC: 001860e1, OEM: 0000, Model: 0000
Hash: d40eee56f3194665-574109a39267724a-e7944134cd53cb76-7e293d3c40497955
Sending 0014d0e100000000_d40eee56f3194665_FHPRG.bin 100% Ok
Waiting for Firehose... No response, poking...
Could not write device

[Renate]

Originally Posted by denisuu

This is the result for the 3th loader:

Grrr... That doesn't look good.

Okay, leaving no stone unturned, try:
https://github.com/bkerler/Loaders/b...rg_redmi9t.bin
https://github.com/bkerler/Loaders/b...prg_opn100.bin

[denisuu]

Originally Posted by Renate

Okay, leaving no stone unturned, try:
https://github.com/bkerler/Loaders/b...rg_redmi9t.bin
https://github.com/bkerler/Loaders/b...prg_opn100.bin

Neither work. After each try should the device be rebooted into EDL again?

Also do I keep using the resistor or now that I know the points I can short them without a resistor?

C:\> .\edl.exe /l001360e100720000_1bebe3863a6781db_fhprg_redmi9t.bin
Found EDL 9008
Resetting Sahara
Serial: a644bb87
HWID: 001860e100000000, QC: 001860e1, OEM: 0000, Model: 0000
Hash: d40eee56f3194665-574109a39267724a-e7944134cd53cb76-7e293d3c40497955
Sending 001360e100720000_1bebe3863a6781db_fhprg_redmi9t.bin 100% Ok
Waiting for Firehose... No response, poking...
Could not write device

C:\> .\edl.exe /l0000000000515192_37cf317812121fed_fhprg_opn100.bin
Found EDL 9008
Serial: a644bb87
HWID: 001860e100000000, QC: 001860e1, OEM: 0000, Model: 0000
Hash: d40eee56f3194665-574109a39267724a-e7944134cd53cb76-7e293d3c40497955
Sending 0000000000515192_37cf317812121fed_fhprg_opn100.bin 100% Ok
Waiting for Firehose... No response, poking...
Could not write device

[Renate]

Yes, you can just short the points.

If you had the UART working you could see better how the Firehose loader was going in and also the state of Secure Boot.

Spoiler:

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.XF.1.4-00246-S660LZB-1
S - IMAGE_VARIANT_STRING=Sdm660LA
S - OEM_IMAGE_VERSION_STRING=cibuild
S - Boot Interface: Unknown
S - Secure Boot: Off
S - Boot Config @ 0x00786070 = 0x000001c1
S - JTAG ID @ 0x00786130 = 0x000cc0e1
S - OEM ID @ 0x00786138 = 0x00000000
S - Serial Number @ 0x00784138 = 0x12345678
S - OEM Config Row 0 @ 0x00784188 = 0x0000000000000000
S - OEM Config Row 1 @ 0x00784190 = 0x0000000000000000
S - Feature Config Row 0 @ 0x007841a0 = 0x007030000b580100
S - Feature Config Row 1 @ 0x007841a8 = 0x00000000000000c0
S - Core 0 Frequency, 3715 MHz
S - PBL Patch Ver: 5
S - I-cache: On
S - D-cache: On
B -         0 - PBL, Start
B -      7024 - bootable_media_detect_entry, Start
B -    147371 - bootable_media_detect_success, Start
B -    147377 - elf_loader_entry, Start
B -  11829737 - auth_hash_seg_entry, Start
B -  11830037 - auth_hash_seg_exit, Start
B -  11938655 - elf_segs_hash_verify_entry, Start
B -  11991564 - elf_segs_hash_verify_exit, Start
B -  11992361 - auth_xbl_sec_hash_seg_entry, Start
B -  12021499 - auth_xbl_sec_hash_seg_exit, Start
B -  12021501 - xbl_sec_segs_hash_verify_entry, Start
B -  12028213 - xbl_sec_segs_hash_verify_exit, Start
B -  12028258 - PBL, End
B -         0 - SBL1, Start
B -  12169286 - Entering DeviceProg lite
B -  13173926 - usb: init start
B -  13173956 - usb: SUPER , 0x900e
B -  13175847 - usb: ENUM success

[popej]

I hope I have resolved last cases of calling Onyx. There were 2 problems.

Captive portal login detection uses en-rom.boox.com as a test site. I have disabled this functionality with following settings:

adb shell settings put global captive_portal_mode=0
adb shell settings put global captive_portal_mode_ignore=1
adb shell settings put global network_avoid_bad_wifi=0

NTP uses as default some address at Onyx (don't remember link), which result in synchronizing time with China. I have changed it with settings:

adb shell settings put global ntp_server=pl.pool.ntp.org
adb shell settings put global ntp_server_2=pool.ntp.org

In firewall I have disabled all system programs (including network manager) except NTP. Not sure if this is the final configuration, I will test it.

[denisuu]

Originally Posted by popej

I hope I have resolved last cases of calling Onyx. There were 2 problems.

Captive portal login detection uses en-rom.boox.com as a test site. I have disabled this functionality with following settings:

adb shell settings put global captive_portal_mode=0
adb shell settings put global captive_portal_mode_ignore=1
adb shell settings put global network_avoid_bad_wifi=0

NTP uses as default some address at Onyx (don't remember link), which result in synchronizing time with China. I have changed it with settings:

adb shell settings put global ntp_server=pl.pool.ntp.org
adb shell settings put global ntp_server_2=pool.ntp.org

In firewall I have disabled all system programs (including network manager) except NTP. Not sure if this is the final configuration, I will test it.

Nice! Keep us posted.

[popej]

On my last iteration of debloat, I have deleted Google. My main apps are following:
- AIReaderX for e-books,
- Bromite as web browser,
- Droid-ify, Aurora Store as source of applications,
- OpenBoard keyboard,
- RHVoice TTS,
- Onyx dictionary,
- mLauncher to hide Onyx Launcher,

These apps I have removed with adb:

adb shell pm uninstall -k --user 0 com.onyx.appmarket
adb shell pm uninstall -k --user 0 com.onyx.calculator
adb shell pm uninstall -k --user 0 com.onyx.easytransfer
adb shell pm uninstall -k --user 0 com.onyx.floatingbutton
adb shell pm uninstall -k --user 0 com.onyx.latinime
adb shell pm uninstall -k --user 0 com.onyx.mail
adb shell pm uninstall -k --user 0 org.chromium.chrome
adb shell pm uninstall -k --user 0 com.android.printservice.recommendation
adb shell pm uninstall -k --user 0 com.simplemobiletools.clock
adb shell pm uninstall -k --user 0 com.simplemobiletools.gallery
adb shell pm uninstall -k --user 0 com.simplemobiletools.musicplayer
adb shell pm uninstall -k --user 0 com.simplemobiletools.voicerecorder
adb shell pm uninstall -k --user 0 com.android.vending
adb shell pm uninstall -k --user 0 com.google.android.gms
adb shell pm uninstall -k --user 0 com.google.android.gsf
adb shell pm uninstall -k --user 0 com.google.android.partnersetup
adb shell pm uninstall -k --user 0 com.google.android.syncadapters.calendar
adb shell pm uninstall -k --user 0 com.google.android.syncadapters.contacts
adb shell pm uninstall -k --user 0 com.google.android.tts
adb shell pm uninstall -k --user 0 com.google.android.webview
adb shell pm uninstall -k --user 0 com.qualcomm.qti.sva
adb shell pm uninstall -k --user 0 com.qualcomm.embms

These apps I have disabled:

adb shell pm disable-user --user 0 com.onyx.igetshop
adb shell pm disable-user --user 0 com.onyx.kreader

Removing them makes Onyx Launcher crash.

I have set some variables to configure NTP and captive portal detection. This replace the use of Onyx servers with something other:

adb shell settings put global ntp_server pool.ntp.org
adb shell settings put global ntp_server_2 pl.pool.ntp.org
adb shell settings put global captive_portal_http_url "http://connectivitycheck.android.com/generate_204"
adb shell settings put global captive_portal_https_url "https://connectivitycheck.android.com/generate_204"
adb shell settings put global captive_portal_fallback_url "http://connectivitycheck.gstatic.com/generate_204"
adb shell settings put global network_avoid_bad_wifi 0

I have configured AFWall+ in white list mode and enabled most user and system apps, except Onyx.

Some quirks:
When I set AFWall+ in black list mode, NTP client stops working. Probably my fault, but I couldn't find the exact reason. NTP server used by Leaf2 seems to be the one defined in variable ntp_server_2, so I put there link to local server.

For unknown reason all dictionary apps started crashing (maybe because of AIReaderX?). I have restored Onyx dictionary, which works. I can check words in browser and e-book reader.

mLauncher is a clone of Olauncher. There are more clones, but all have some problems, mainly with detection of vertical swap. mLauncher allows to configure horizontal swap to show all apps.