[spam] [personal] information on the Unihertz Titan, a mobile phone
I have this phone. It's more rugged than my existing phone. I'd like to maintain it with sequential images of the storage and firmware, in the hope of keeping it revertible to a stable state when it gets funny. [i also have a pinephone in the mail. the titan was a surprise gift.] Titan information on changing IMEI etc: https://unihertz-titan.neocities.org/ Company forum, flashware download from above site mentions it came from this forum: https://www.unihertz.com/pages/forum [javascript from shopify.com] NOTE: this forum says it is pending construction. very strange, like a timewarp. links to official facebook, twitter, reddit. Forum posts found on xda, crackberry, androidforums. Maybe reply with an http paste of the neocities site.
Unihertz Titan smartphone information ValdikSS <https://unihertz-titan.neocities.org/#ValdikSS>18th January 2021 at 1:37pm Titan is a bulky but cool rugged smartphone with hardware QWERTY keyboard with embedded touchpad, by Chinese manufacturer Unihertz. [image: image] - Release Date: December 2019 - Dimensions: 153.6×92.5×16.65 mm - Weight: 303 g - IP67 dust and water resistance (not water proof!) - Hardware QWERTY keyboard *with built-in touchpad*, with backlight. Languages supported by stock Kika Keyboard software: English, German, French, Italian, Portuguese, Spanish, Dutch, Russian, Japanese, Chinese. - OS: Android 9.0, official update to Android 10 - Screen Size: 4.6" - Screen Resolution: 1430×1438 - Chipset: Mediatek Helio P60 (MT6771), 4x 2 GHz ARM Cortex-A73, 4x 2 GHz ARM Cortex-53 - GPU: Mali-G72 MP3, 700 MHz - RAM: 6 GB (LPDDR4X 1866 MHz) - ROM: 128 GB (eMMC 5.1) - Battery: 6000 mAh, Li-Po (supports 9V 2A and 12V 1.5A fast charge with bundled wall charger, Mediatek Pump Express/PE+) - Wireless Charging - NFC - Wi-Fi: a, b, g, n, n 5GHz, ac, Dual band, Wi-Fi Direct - Bluetooth: 4.2 - GNSS: GPS, A-GPS, GLONASS - USB: 2.0, USB Type-C - USB OTG - Camera: 16MP AF rear (OV16880 <https://www.ovt.com/sensors/OV16880> sensor), 8MP FF front (IMX219 <https://www.gophotonics.com/products/cmos-image-sensors/sony-corporation/21-209-imx219> sensor) - Video camera: 1440×1440 / 1920×1080, 30 FPS - SIM Slot: Dual SIM Dual standby - MicroSD Slot: yes, combined with SIM slot (you can insert either 2 SIM or 1 SIM + MicroSD) - Sensors: Fingerprint (front-mounted), G-Sensor, Compass, Gyroscope, Proximity, Ambient Light Sensor - 3.5mm Audio Jack - FM Radio with recording function Supported Radio Bands: - GSM: B2/3/5/8 - WCDMA: B1/2/4/5/6/8/19 - TDSCDMA: B34/39 - FDD/TDD LTE: B1/2/3/4/5/7/8/12/13/17/18/19/20/25/26/28A/28B/34/38/39/40/41/66 - CDMA 2000: BC0, BC1 Miscellaneous technical details: - Treble-enabled - Partition type: A-only - Widevine CDM L3 (software-only) - Built-in integrated call recorder with automatic recording functionality - The phone seems to be developed and manufactured by A-Gold <http://www.agoldcomm.com/en-us/> ODM company Unihertz Titan pros and cons ValdikSS <https://unihertz-titan.neocities.org/#ValdikSS>30th January 2021 at 2:22pm This device is pretty good overall. I switched from Blackberry Q10 and now use it as my main phone. It's not as polished, but we're getting there thanks for manufacturer firmware updates. I enjoy it and recommend to hardware keyboard fans. Pros - Build quality of the device is not top notch, but still of a high standard - The keyboard is also a touch panel (as on Blackberry Passport/Key1/Key2), you can scroll in any direction without touching the display. It also helps comfortably holding the device despite its size. When you type, the sensors temporary disables to not interfere with typing. - Ear speaker audio quality is surprisingly good, media speaker is loud and good quality as well - Unihertz fixes issues, updates firmware and software regularly - Built-in integrated call recorder with automatic recording functionality - Easy to obtain root privileges, easy to reflash Cons - Mono media speaker. There's only a single speaker, despite two speaker cutouts on the back, one is just a dummy. - Fingerprint scanner is not reliable. Even with two fingers added twice (as 4 fingers), there's a big chance it won't unlock at the first try. - Camera is mediocre. Not that bad, but don't expect good quality under insufficient light conditions. - No physical keyboard gestures support, low keyboard integration with Kika Keyboard software (can't change the layout with a hotkey, need to press on-screen button) - Very small number of physical keyboard supported languages on stock Kika Keyboard - No kernel source code provided as for February 2021 Bugs As of Android 10 December 2020 firmware: - Russian layout (and possibly other) of hardware keyboard in Kika Keyboard is barely usable. Russian has 33 letters, which requires assigning some keys with two letters on a 26 button physical keyboard. Titan uses non-standard layout as in Blackberry Passport, with a major caveat: to type alternative letter, instead of just pressing the button twice, you have to press and hold the key, wait until alternative letter appears on screen, then press it on screen. Fortunately there is (better) third-party software with hardware keyboard support available. - Kika keyboard incorrectly handles SHIFT+key and ALT+key, making the next key capitalized/alted as well. If you want to type "hEllo" by pressing h, shift+e, l, l, o, you'll get "hELlo". - Unihertz implemented different *physical* keyboard logic dependent on *on-screen keyboard* visibility. If you disable on-screen keyboard in physical keyboard Android options, the sensor won't be disabled temporary while you type, and if you assign long-press keyboard shortcut, you won't be able to type assigned key letter on the home screen launcher anymore. Don't disable software keyboard in the settings. - It's possible to delete some system applications without being able to reinstall it in any way other than factory reset or by deleting a special file with root privileges. Even creating another phone user won't make it reappear. One example of such application is calculator, which is a modified version of a standard Android calculator to support physical keyboards (so it's an important app you won't want to delete). - When Night Light mode is enabled, switching from screen to screen occurs with a strange yellow-to-white transition effect. Fixed in Android 10. - High CPU load while the device is idle (screen off), which leads to excessive battery consumption. See Idle CPU load fix <https://unihertz-titan.neocities.org/#Idle%20CPU%20load%20fix>. Fixed in 07.08.2020 firmware. - Additional 6-8% CPU load by SurfaceFlinger/SystemUI while the device is idle due to incorrect surface allocation by SystemUI and the necessity to send vsync packets every 16 ms to it. Fixed in Android 10. - Fingerprint data is stored without encryption and is not handled in TrustZone, violating Android fingerprint hardware security requirements <https://support.google.com/pixelphone/answer/6300638?hl=en>. Check /data/vendor_de/0/fpdata/ to see your fingers. Seems fixed in Android 10, needs recheck. Only last fingerprint is stored unprotected now. Titan Tips & Tricks ValdikSS <https://unihertz-titan.neocities.org/#ValdikSS>12th May 2021 at 2:01pm Hotkeys ALT+SPACE shows small symbol panel provided by system, not by keyboard software. Secret codes "Calling" to the following codes show secret menus and launch hidden applications. To use some of these codes, you need to activate Developer Menu and activate USB Debugging first (you don't need to connect the phone to PC though). *#*#4636#*#* — Testing Settings (phone information, mobile network configuration, usage statistics, Wi-Fi info) *#*#3377#*#* — Factory Test (mtklog, ygps, gravity calibration, distance calibration, smartpa calibration, single test) *#*#114#*#* and *#*#116#*#* — Camera sensors, LCD panel, memory and other hardware information *#*#34635280#*#* — Engineer Mode with lots of internal configuration. Here you can change mobile network mode, supported bands, lock to exact cell ID, tune VoLTE/VoWIFI settings and other low level options. Be very careful, do not modify anything unless you understand what would happen exactly. *#*#08#*#* — Change IMEI numbers (Android 9 only. Yes, a stock factory application to change IMEI!) *#*#010#*#* — Check and clear battery usage statistics Software tips If your application gets killed, the notifications does not come in instant etc, make sure that the application is allowed to run in background in Settings → DuraSpeed (Android 9 only, the tick should be checked/enabled) and in Settings → Intelligent assistance → App blocker. These two options are custom Mediatek battery saving features. If your application is old and was designed for older Android versions, you may also need to exclude it from stock Android battery saver. Go to Settings → Apps & notifications → See all X apps → find your application → Advanced → Battery → Battery optimization, find your app again and choose "Not optimized" To disable lockscreen pedometer (Android 9), go to Toolbox → Pedometer → Settings → disable "Display steps when screen locked". Use cobalt232's Blackberry Manager <https://cobalt232.github.io/blackberrymanager/> to install Blackberry Hub, Calendar, Contacts, Keyboard, Launcher and more. You may also install LayTray <https://play.google.com/store/apps/details?id=space.neothefox.laytray> for keyboard layout icon in notifications of Blackberry Keyboard. Install Fluid Navigation Gestures <https://play.google.com/store/apps/details?id=com.fb.fluid> for full-featured gestures on Android 9, from bottom and sides, with complex patterns. Selected extended functionality requires root. Android 10 has OS-wide gestures support. To remap your keys use Physical Button Master Control <https://repo.xposed.info/module/xeed.xposed.cbppmod> (free Xposed module, requires root+edXposed, works when screen is off) or flar2 Button Remapper <https://play.google.com/store/apps/details?id=flar2.homebutton> (premium, some features require root, does not work when screen is off in general, but volume button actions do). The former is very flexible, it supports complex scenarios and allows you to assign different actions whether screen is on or off, whether audio is playing, and so on. Alternative keyboard software ValdikSS <https://unihertz-titan.neocities.org/#ValdikSS>23rd June 2020 at 9:49pm Stock Kika Keyboard has flaws. You can install and use the following software as a replacement: RuKeyboard (recommended) Initially made for physical keyboard smartphones back in 2009. Created generally for Russian and other languages with Cyrillic alphabet, but could be modified for any language. Abandoned software but still works with Android 9 perfectly fine. Supports multiple letters on a single hardware key with double/triple press. No bugs, smooth typing experience. Supports layout switching with a hotkey (alt+shift, alt+space, shift+space, user defined) and shows language flag in the notification bar. Unfortunately, does not support word prediction and correction. You get what you type. First letter capitalization is supported. RuKeyboard with 5 Russian layouts (as Blackberry Passport, as Blackberry Q5/Q10/Classic, as Blackberry KEYone/KEY2): Download link 1 <https://www.androidfilehost.com/?fid=8889791610682876943> | Download link 2 <https://www.mediafire.com/file/qn6e4e7gq0gc7ip/rukeyboard-unihetz-titan-modv3.apk/file> Physical keyboard layouts are stored in apk file, in assets/hard/*.xml files. Take a look at unihertz_titan_ver1.xml for example and implement your own layout for your language accordingly. Software on-screen keyboard is modified to show only single row of most used symbols which are missing on a physical keyboard with an alt key, similar to Kika Keyboard. You can modify it as well, check res/xml/kbd_query.xml file. [image: image.png] AnySoftKeyboard AnySoftKeyboard <https://github.com/AnySoftKeyboard/AnySoftKeyboard> (Google Play link <https://play.google.com/store/apps/details?id=com.menny.android.anysoftkeyboard>) supports physical keyboards and also requires to create your own layout. Unfortunately, hardware keyboard support is a bit buggy and does not perform autocorrection with the hardware space key, but you will see correction candidates in the top row. Non-Latin languages for physical keyboard are supported. By default this keyboard shows full software keyboard. This could be modified only with a custom software layout. AnySoftKeyboard is open source. Examples of software and physical layouts are available on the projects' GitHub. SwiftKey Microsoft SwiftKey <https://play.google.com/store/apps/details?id=com.touchtype.swiftkey&hl=en_US> keyboard is probably the best for Latin languages with small amount of diacritical marks. You won't be able to type diacritical marks but word suggestions work good. Non-Latin languages for physical keyboard are not supported. Unihertz Titan original firmware ValdikSS <https://unihertz-titan.neocities.org/#ValdikSS>23rd June 2021 at 8:42pm There are two firmware versions: EMEA (Europe, EEA/TTEU) and non-EMEA (TEE/TTNE). There's no difference between them as for firmware version 20200603, the files are the same, except for version strings in different places. The difference seems to be in TrustZone applets set, it's different for TEE and EEU versions (at least the signatures are different) You can check which version you have on the box: [image: image] Firmware Official Google Drive link to all Unihertz ROMs, flashing tool, driver, and flashing instruction, found on Unihertz forum. The firmware files seem to be updates on a regular basis but may lag behind official over the air updates. Unihertz Titan firmware Google Drive folder: Full firmware for SP Flash Tool <https://drive.google.com/folderview?id=1E9J9IfnhjlRxJAs4Q1p__0k1kefsCxet> | OTA updates <https://drive.google.com/drive/folders/0By1nhWOmuw2KUkVkTG15NVk5NVU> Current firmware version (TEE): Titan_20210528_20210607-2009 (Jun 08, 2021, Android 10). Android security patch : June 5, 2021 Kernel version: 4.14.141+ built on 7 Jun 2021 Serial number, IMEI and TrustZone applets writing tool If you accidentally formatted/wiped NVRAM data from your device and now have dummy IMEI and no serial number, you can repair it with the tool. You don't need to do that after usual firmware reflashing procedure. The tool is available here: SNWriter Tool link 1 <https://www.androidfilehost.com/?fid=17248734326145740463> | Link 2 <http://www.mediafire.com/file/v4ewz4qll229krg/tee-20200616T074814Z-001.zip/file> Read included readme file and watch the video. Unihertz Titan TWRP recovery & rooting ValdikSS <https://unihertz-titan.neocities.org/#ValdikSS>23rd June 2021 at 8:43pm TWRP Recovery TWRP 3.5.0_9 for Uniherz Titan, semi-working alpha version v0.2 (18 Jan 2021, with Android 10 support) This is TWRP recovery for Unihertz Titan smartphone. It works, but missing two essential features: 1. Userdata decryption 2. MTP That means that you won't be able to access user data (only system, vendor and other internal partitions) unless you disable data encryption entirely in the OS, and won't be able to transfer files over USB with MTP. Yet, it's still useful for removing bloatware/google services or installing Magisk and obtaining root access. ADB file transfers (adb pull/push, adb sideload) work fine. Use this TWRP version only if your really-REALLY want to install custom recovery and/or root. Link 1 (androidfilehost) <https://www.androidfilehost.com/?fid=17248734326145717939> Link 2 (mediafire) <https://www.mediafire.com/file/oesfukn9ihdtm9h/TWRP_3.5.0_9_for_Unihertz_Titan_%2528Android_10%2529%252C_semi-working_alpha.7z/file> Installation instruction is inside the archive. After installing TWRP, you won't be able to apply Unihertz OTA updates, you'll have to revert back to stock recovery to perform the update. You can reinstall TWRP afterwards. Show older downloads Rooting Note: you don't need TWRP to get root. Android 9 and Android 10 (since Magisk v22.1): To root this device, simply install Magisk <https://github.com/topjohnwu/Magisk/releases> via TWRP/using adb sideload/with kernel file patching. It will inject Magisk into kernel image. Show older information Show older downloads Custom Android 10 Generic System Image (GSI) Firmware for Titan ValdikSS <https://unihertz-titan.neocities.org/#ValdikSS>18th January 2021 at 1:59pm NOTE: official Android 10 is now available, check Unihertz Titan original firmware <https://unihertz-titan.neocities.org/#Unihertz%20Titan%20original%20firmware> . GSI stands for Generic System Image. It's a file-system image that you flash to your device's system partition. It's generic because it accesses hardware using the new standardized hardware APIs (so it should work on any treble-enabled device). In other words, this is a generic custom firmware suitable for Titan. phhusson <https://github.com/phhusson/> provides treble_experimentations <https://github.com/phhusson/treble_experimentations/> firmware based on AOSP Android 10, of different flavors: GAPPS version with common Google applications, GO with Android GO version of applications, FLOSS with open-source replacements of Google components, and VANILLA, the simplest and cleanest one. Download Android 10 GSI image from treble_experimentations releases <https://github.com/phhusson/treble_experimentations/releases>. You need "system-quack-arm64-ab" files. Install it either using TWRP or with fastboot flash system command. Bluetooth aptX codec support ValdikSS <https://unihertz-titan.neocities.org/#ValdikSS>26th January 2021 at 5:53pm aptX codec support is a premium option which involves paying license fee to Qualcomm, the license holder of the codec. Since Unihertz haven't licensed the codec for Titan, it can't be used for Bluetooth headphones. Fortunately, the support is still present in the firmware and could be activated by adding missing libraries. Install the following Magisk module (requires root) to activate aptX and aptX HD. Android 9 version: Download mediatek.bluetooth.aptx64.zip Android 10 version: Download mediatek.bluetooth.aptx64_android10.zip Idle CPU load fix ValdikSS <https://unihertz-titan.neocities.org/#ValdikSS>18th January 2021 at 2:00pm UPDATE: This issue has been fixed in 07 August 2020 firmware. ------------------------------ June 3, 2020 and July 8, 2020 firmwares for Titan have a bug: it creates unnecessary high CPU load while the phone's screen is off. This has a negative impact on battery life. The issue is caused by race condition between touchscreen driver and I2C bus suspend procedure. The driver believes the touchscreen is not powered off and does not disable interrupts, while I2C bus is already suspended. This leads to interrupt spam and 90%+ CPU load of a single core. You won't see this issue in battery stats because it happens in the kernel driver, not in Android system. Luckily, this could be fixed with a small workaround. Use this Magisk module (requires root): Updated for Titan_20200706 Download unihertz.titan.touchirqfix.v2.zip With this fix battery stats report up to 8 days of estimated phone battery life, compared to 4 days without the fix. Touch keyboard-navigated mouse pointer suhanc <https://unihertz-titan.neocities.org/#suhanc>12th October 2020 at 9:48pm To have an actual mouse pointer on the Titan's screen which you can navigate using the keyboard touch gestures, edit /system/usr/idc/mtk-pad.idc and replace touch.deviceType = touchPad with touch.deviceType = pointer, then reboot your device. This feature requires root. Note that afterwards you might always move the cursor to the place you type into, otherwise typing might be recognized as moving the mouse pointer. (credits go to Diego in the Unihertz Titan Facebook group) Unihertz Titan Touchpad Navigation & Selection ValdikSS <https://unihertz-titan.neocities.org/#ValdikSS>26th January 2021 at 5:54pm This is a small Magisk module utility which switches in-keyboard touchpad to navigation mode (emulation of up/down/left/right keyboard buttons) and text selection mode (as if SHIFT is held). The utility allows to quickly navigate to exact text symbol and to precisely select the text. Demo video ×<MEDIA>@https://files.catbox.moe <https://files.catbox.moe/zitqxe.mp4> Supports Android 9 and Android 10. Installation: Install ZIP via Magisk (root required). Download unihertz.titan.navkeys.zip Hard Reset & Factory Reset Protection ValdikSS <https://unihertz-titan.neocities.org/#ValdikSS>14th June 2020 at 5:51pm To do hard reset, press and hold POWER+VOLUME UP, you'll boot into bootloader. Select "wipe data/factory reset" using volume buttons and confirm with power button. if you already did a reset and it asks for account password, that's what called Factory Reset Protection. The easiest is to remember password. If you saved it in PC's browser, just extract it from there. If you totally forgot the password, you'll need to wipe FRP data partition on the device with SP Flash Tool. Do do that, install SP Flash tool and corresponding drivers (get it from Unihertz Titan original firmware <https://unihertz-titan.neocities.org/#Unihertz%20Titan%20original%20firmware>), go to "Format" tab and enter the following data exactly as written: Manual Format Flash — selected Region: EMMC_USER Begin Address: 0x3588000 Format Length: 0x100000 Press green "Start" button and connect your phone to the PC. The phone should be powered off before connection. Remember to type the addresses exactly as written. Failure to do so may delete device-specific data, radio calibration information, IMEI and MAC address, and so on, and render your device unbootable. Useful links ValdikSS <https://unihertz-titan.neocities.org/#ValdikSS>26th November 2020 at 11:40pm Official Unihertz Titan Group on Facebook <https://www.facebook.com/groups/1304745876357921/> Official Unihertz Technical Support Hub <https://www.facebook.com/groups/1309762789206132/> Official Unihertz forum <https://www.unihertz.com/unihertz-form.html> (new forum, the old one is gone, no old posts have been transferred) Reddit /r/UnihertzTitan group <https://www.reddit.com/r/UnihertzTitan/> Crackberry.com Android forum <https://forums.crackberry.com/android-f169/> Russian discussion on 4pda.ru forum <https://4pda.ru/forum/index.php?showtopic=958963> German Titan forum on blackberrybase.de <https://blackberrybase.de/forumdisplay.php?842-Titan> Titan disassembled <https://www.facebook.com/groups/1304745876357921/permalink/1603803733118799/> (facebook post) ValdikSS ValdikSS <https://unihertz-titan.neocities.org/#ValdikSS>9th July 2020 at 12:20am This website is created and maintained by ValdikSS <iam@valdikss.org.ru <iam@valdikss.org.ru?subject=Unihertz%20Titan%20Website>> Feel free to contact me if you have any updates. You can edit this page as a wiki and send me edited file over email. Open tiddlywiki.html <https://unihertz-titan.neocities.org/tiddlywiki.html> and start editing.
One way to flash and backup this phone is by using the FACTORY FLASHER. I downloaded SP Flash Tool from https://androidmtk.com/smart-phone-flash-tool and expanded it to ~/pkg . NOTE: New versions of SP Flash Tool will upgrade the boot download agent (a boot software package with an extensive rpc interface), which may make it much harder to install 3rd party flashing tools. I have already performed this mistake on my own device, however. The flasher uses a scatter file which I believe is just a list of partition mappings. The FACTORY IMAGE can be found at https://drive.google.com/drive/u/0/folders/1fpO65z2_r9zT8UImuV8-5JCRBy33yZcV . This is in the UnihertzTitan folder on my Windows partition. I do not recommend using Unihert'z rebranded mediatek flasher, because it only runs on Windows. The official generic mediatek flashers work fine and are made for linux, where it is easy to log syscalls etc. There are b2sums and sha256sums of many of these images in this thread. The device can also be flashed with FASTBOOT, although this does not provide for imaging in the other direction. One way to boot to fastboot is by holding volume-up during boot, then rebooting to bootloader mode. First unlock the bootloader: $ fastboot flashing unlock And confirm unlocking on the phone by pressing volume-up. Then flash: $ fastboot flash system system-quack-arm64-ab-vanilla.img TREBLE SYSTEM IMAGE b2sums are in the "making my unihertz titan boot" spam thread at https://lists.cpunks.org/pipermail/cypherpunks/2022-May/099255.html . The urls for downloading them are like https://github.com/phhusson/treble_experimentations/releases/download/TAG/sy... where TAG is something like v207 . I may have tested these images before, but I haven't quite found where my work was if so. I recall they stop running after a major change in the repository. I have tested these images today: - v207 runs fine - v208 runs fine - v210 runs fine - v214 runs fine - v220 runs fine - v222 runs fine LATEST KNOWN WORKING URL for the latest image I've booted successfully: https://github.com/phhusson/treble_experimentations/releases/download/v222/s... I have not tested any variants other than "vanilla" at this time. I got a DIFFERENT CHECKSUM for v208 today. I have only checked the images listed below. I am assuming that my differing checksum was due to an incomplete download previously, and including the size here. b2sum Differing: 03dc88f81ee58051ffc75ddc8ed5c43c3c73a1dbc598d109b54ad03aaa424b12fb09235da757fa636e97c9fb315752ac5362d72f27c4d5358a66e22814ca1661 v208-2022-07-19-system-quack-arm64-ab-vanilla.img size=1740550424 New: 055aa5fa084a09e4fed0a5dbb5c8007a29848cf2841dc65b939d0247c246286450172d76951cfef89fa8ae1dcea5d6511fc665219e72a8cfe671b55f5a5d7d60 v210-2022-07-19-system-quack-arm64-ab-vanilla.img size=1740718336 8131a0411824ffad0ba5d381513820770bdff3b22e412161f4b5c0827027e18b0e040f691f7af2995c98b203049b096646d08463af4fa01b8588e0e172ceea54 v220-2022-07-19-system-quack-arm64-ab-vanilla.img size=1736143104 Same: aa80d380ac31502dfc548da57414cd6e56ccd12e21be647f82508bec59ae3f36e4d3eee6d3047c73c03075b5d54c15f7bd6bba90a1bf5f73c26bbd33056e3c1e v207-2022-07-19-system-quack-arm64-ab-vanilla.img size=1740189976 503324691350107f945a1e81c89438eb6d4dde120167eede2d35aee20fb20429949a94da50c457304c009a46ad1ff7d1691158dd19368b1ab44546e8ffea102e v218-2022-07-19-system-quack-arm64-ab-vanilla.img size=1735053568 486e3ec3184b203bf87b5a2211d33edd07b0667df57660eca42e386e6f6e0201aba49ec0c25fb30fa22dfada6435d9eda618eadfe276bba62f5bde9dfae7a129 v222-2022-07-19-system-quack-arm64-ab-vanilla.img size=1738010904 BUILDING FROM SOURCE I haven't done this successfully yet. It likely involves cloning and building huge trees of android code for a long time. git clone https://github.com/phhusson/treble_experimentations cd treble_experimentations git checkout v222 mkdir build cd build # note: this likely builds r40; the v222 releases on github appear to be r41 . graphene10 is the same android ver as aosp10, could try it too. the build-dakkar script does more of the repo stuff automatically. bash ../build-dakkar.sh aosp10 arm64-ab-vanilla-su # when it asks to sync, hit Y the first time so as to build the directory structure I guess TROUBLESHOOTING PROBLEMS I ran into: - at first after flashing treble with fastboot, the phone would BOOTLOOP. I'm wondering if this is because I didn't do `fastboot flashing unlock` before flashing with fastboot, or maybe because I was flashing a partial download. I resolved it by reflashing the factory image and using fastboot again. I did not need to perform OEM unlocking after resetting to the factory image; it still had OEM unlocking enabled. I may not have needed to reflash with the factory image at all. INCOMPLETE data for accessing the phone directly may be found near https://github.com/bkerler/mtkclient which is one of the open source flashers. I also started a python client that does not require root, at https://github.com/xloem/backyard_mediatek_flasher , before I found mtkclient. I have not figured out how to use mtkclient yet.
The email immediately previously to this has information on flashing a binary android 10 system to this mediatek phone, focusing on Android 10. It turns out the Android 11 and Android 12 images also boot. Images beyond Android 10: d4b8ea9d3682bef57d176300ff3d0be7e7d4ab9d4b48e6680e2eadc94d667bb63ddc54112c853b48d14de22927a7dec87f0e3c53b762687df38c3181c52ffdbe v301-2022-07-19-system-roar-arm64-ab-vanilla.img size=1570042268 boots=true 1889bad614a8c47abcdde27b20ac969eb3c3a29499efe3189289f8bcc41f02ee27318b74547052da2f0a689815c66daf56cad28a7cf42aa03b3545b9315dd2c5 v310-2022-07-19-system-roar-arm64-ab-vanilla.img size=1574547868 boots=true d580538c7e67f049fbf198bb36c4c34169b6936f84ba05de19d79abf802ff067df02cdbd74eb29b151881de006065129ea1e65af560ae392ade2544c10520556 v313-2022-07-19-system-roar-arm64-ab-vanilla.img size=1577128348 boots=true 1941cdabb972b360600e1acd6edb6cca14897a5d50f22bd877d56e8347e6d1ca76946dc2ee94d6c0ec54940f5dd6625698a5ebefb787e944c6dace9bccb9ddd7 v401-2022-07-19-system-squeak-arm64-ab-vanilla.img size=1796673536 boots=true 0b036b42ff97ad59d7f410bdd8f8720beddec109d801ab388d259fa7ed927799b835e4ed3eb8f81f29eb617d464e4d02b48291f911c197b6ee7a615bab9ff8e5 v415-2022-07-19-system-squeak-arm64-ab-vanilla.img size=1814552576 boots=true LATEST RELEASE as of today boots: https://github.com/phhusson/treble_experimentations/releases/download/v415/s... Here is a draft for building from source. It does not work yet. Below is as far as I've gotten this morning. This was written during attempts to build Android 10. Since Android 12 boots, likely it is much simpler to build from the most recent, up-to-date sources, where old urls are fixed and there is active development. Total size: >110GB . # set up repo git config --global user.name 'John Doe' git config --global user.email john.doe@example.com apt-get install -y zip repo python-is-python3 python3-virtualenv # if system is old: wget https://storage.googleapis.com/git-repo-downloads/repo-1; chmod 755 repo-1; mv repo-1 /usr/local/bin/repo # clone git clone --branch v222 https://github.com/phhusson/treble_experimentations mkdir treble_experimentations/build cd treble_experimentations/build # build using build-dakkar.sh (builds r40 rather than r41) python3 -m virtualenv .venv curl https://raw.githubusercontent.com/xloem/treble_experimentations/titan/build-...
../build-dakkar.sh echo y | bash ../build-dakkar.sh -j $(grep -c ^processor /proc/cpuinfo) aosp10 arm64-ab-vanilla-su
device/sample/etc/apns-conf.xml mkdir -p device/generic/common/nfc curl "https://android.googlesource.com/device/generic/common/+/refs/tags/android-10.0.0_r40/nfc/libnfc-nci.conf?format=TEXT"|
Should get as far as this unaddressed error: error: vendor/foss/SeedvaultOverlay/Android.bp:1:1: unrecognized module type "runtime_resource_overlay" 14:23:47 soong bootstrap failed with: exit status 1 # build with build-rom.sh bash ../build-rom.sh android-10.0 lineage # compare build-dakkar sources to find right parameters here # build manually repo init -u https://android.googlesource.com/platform/manifest.git -b android-10.0.0_r40 git clone https://github.com/phhusson/treble_manifest .repo/local_manifests -b android-10.0 repo sync -c -j 32 -f --force-sync --no-tag --no-clone-bundle --optimized-fetch --prune rm -rf vendor/*/packages/overlays/NoCutout* # fix kernel source missing (on quack/Q) sed 's;.*KERNEL_;//&;' -i vendor/*/build/soong/Android.bp 2>/dev/null || true mkdir -p device/sample/etc curl "https://raw.githubusercontent.com/LineageOS/android_vendor_lineage/lineage-1..." base64 --decode > device/sample/etc/libnfc-nci.conf sed -i '/Copies the APN/,/include $(BUILD_PREBUILT)/{/include $(BUILD_PREBUILT)/ s/.*/ /; t; d}' vendor/*/prebuilt/common/Android.mk 2>/dev/null || true # patches pushd device/phh/treble git clean -fdx bash generate.sh popd repo manifest -r > output/manifest.xml bash ../list-patches.sh cp patches.zip output/patches.zip # build . build/envsetup.sh # b = ab partition layout; v = vanilla w/out apps ; S = su lunch treble_bvS-userdebug make installclean systemimage vndk-test-sepolicy cp "$OUT"/system.img output/system-arm64.img
This phone just needs a normal treble A/B arm64 OS. Instructions for building from source at https://github.com/phhusson/treble_experimentations/wiki/How-to-build-a-GSI%... Two posts earlier in this thread are some quick links to flashing information.
# it turns out that before 2021, the site linked to /forum instead of /page/forum or such. I just experienced a change to this, strange sinceI just accessed the website successfully: $ curl -v https://unihertz.com/forum/ * Trying 23.227.38.65:443... * Connected to unihertz.com (23.227.38.65) port 443 (#0) * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: /etc/ssl/certs/ca-certificates.crt * CApath: none * TLSv1.3 (OUT), TLS handshake, Client hello (1): * TLSv1.3 (IN), TLS handshake, Server hello (2): * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8): * TLSv1.3 (IN), TLS handshake, Certificate (11): * TLSv1.3 (IN), TLS handshake, CERT verify (15): * TLSv1.3 (IN), TLS handshake, Finished (20): * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1): * TLSv1.3 (OUT), TLS handshake, Finished (20): * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 * ALPN, server accepted to use http/1.1 * Server certificate: * subject: C=US; ST=California; L=San Francisco; O=Cloudflare, Inc.; CN=*.myshopify.com * start date: Sep 13 00:00:00 2021 GMT * expire date: Sep 12 23:59:59 2022 GMT * subjectAltName does not match unihertz.com * SSL: no alternative certificate subject name matches target host name 'unihertz.com' * Closing connection 0 * TLSv1.3 (OUT), TLS alert, close notify (256): curl: (60) SSL: no alternative certificate subject name matches target host name 'unihertz.com' More details here: https://curl.se/docs/sslcerts.html curl failed to verify the legitimacy of the server and therefore could not establish a secure connection to it. To learn more about this situation and how to fix it, please visit the web page mentioned above.
This phone, which I have kept in airplane mode and not used, just gave a notification tune. There are no notifications on the lock screen. This is an experience I have with other phones. I purchased an OTC phone and never brought it out of airplane mode, and I did not have the experience with it.
shows some parts of the old forum: https://web.archive.org/web/20200217233948/https://unihertz.com/forum note: If I can't reflash this phone safely I should return it.
Magisk is said to work out of the box on the phone. Magisk is some kind of open source rooting system or something. https://github.com/topjohnwu/Magisk . v23 is 97c1e181c5a96217021d96bcdc4d4e31fbfce2ac according to github web atm. the last port of AOSP for the phone was only 4 days ago! https://github.com/phhusson/treble_experimentations v400.e is ef84fcd105f5554963a62023f89bf9f508f75147
From the treble_experimentations repository:
* IRC: irc://irc.freenode.net/#phh-treble * WebIRC: http://webchat.freenode.net/?channels=%23phh-treble&uio=d4 * Matrix: [#phh-treble:matrix.org](https://matrix.to/#/#phh-treble:matrix.org) * Telegram https://t.me/phhtreble * xda-developers threads: https://forum.xda-developers.com/search.php?do=finduser&u=1915408&starteronly=1
it boots to a special mode if a volume key is held during initial boot. flashrom doesn't recognize it on my system, when in that mode. i enabled usb debugging, and it recognises the usb cable. adb recognises the device, but says permission is needed: $ adb devices List of devices attached TITANNEA00001688 no permissions; see [http://developer.android.com/tools/device.html] no permission dialog pops on the phone. the url just says eventually to enable usb debugging, and then contact the manufacturer if it doesn't work.
I attempted to use my google voice app to call their support number. When I put the number in, the app said the number was invalid. I websearched for google voice and calling out of te country and the first website i found implies it is supported: https://www.businessinsider.com/how-to-make-international-calls-with-google-... They also do skype support. I'm on redhat so I tried to install skypeforlinux. The install failed with an obscure error: $ sudo yum install skypeforlinux Loaded plugins: langpacks, nvidia, product-id, search-disabled-repos, : subscription-manager Resolving Dependencies --> Running transaction check ---> Package skypeforlinux.x86_64 0:8.79.0.95-1 will be installed Error: Invalid version flag: or The support number is +86 21 6220 7593 x8007 . The support skype account is service@unihertz.com . I discovered my system has a _lot_ of package updates queued, so I'm upgrading its existing packages.
I tried calling the number with my native phone app, and I tried calling with the google voice website, and these also said the number was invalid. Same yum error after upgrading my packages. I downloaded the rpm from the skype website and it says I need a package called "rpmlib" to install it, which is not available.
I sent a clear e-mail to their support email address. I logged in using the skype web app and sent them a message. They are oflfine. The internet says it is around 7am for them. Hurrah !
-> USB Debugging only works if the USB connection is changed from charging mode. Even though the interface incorrectly says it is active. The TWRP source code readme has information on using fastboot: 1. Allow OEM unlocking in Android developer settings (if you don't know what it is, search on the internet) 2. Boot to fastboot: power off the device, press VOL UP + POWER, you'll get into recovery, select "boot into bootloader". If you see "no command" screen, press VOL UP + POWER simultaneously multiple times, you'll eventually see the menu. 3. (skip this step if you already have unlocked bootloader) On the PC: fastboot flashing unlock
- escaping "no command" seems to require removing the case that came with it, for me. then the buttons work. - fastboot doesn't report clearly when it lacks usb permission, it just hangs - i'm installing the release of the open source os. $ sha256sum treble_experimentations-v313-system-roar-arm64-ab-floss.img e220a17b2226e84eab6258db63e3e04d7757e9a177c3a8e90333265273cb1132 treble_experimentations-v313-system-roar-arm64-ab-floss.img - the bootloader partition and other partitions are unflashed, so i should install e.g. twrp, too, to be in more control of these partitions
after installing roar, the device is bootlooping and won't enter recovery mode or normal mode or power off. it will eventually exhaust its battery. i think i need to run the windows flashing tool to resolve this. it has a number of confusing options with minimal documentaiton.
I left that system downloading the factory system image overnight.
Meanwhile, the OTA firmware updates drive was private, and this morning my request for access was granted. I just said I had the phone new and wanted to set up for flashing it. I'm trying out the gdrive client now ( https://github.com/prasmussen/gdrive ) and running into a simple and abnormal network error: $ ~/pkgtmp/gdrive list Authentication needed Go to the following url in your browser: https://accounts.google.com/o/oauth2/auth?access_type=offline&client_id=367116221053-7n0vf5akeru7on6o2fjinrecpdoe99eg.apps.googleusercontent.com&redirect_uri=urn%3Aietf%3Awg%3Aoauth%3A2.0%3Aoob&response_type=code&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fdrive&state=state Enter verification code: Failed getting oauth client: Failed to exchange auth code for token: Post https://accounts.google.com/o/oauth2/token: dial tcp: lookup accounts.google.com on [::1]:53: read udp [::1]:42147->[::1]:53: read: connection refused
gdrive worked when I built it from source I had to pass an empty query string to see drives I did not own: $ ~/go/bin/gdrive list --query '' It's great to have a way to batch download a google drive. gdrive does past revisions in a manual per-file way, unfortunately, but it could be improved or wrapped in a script to convert to a git repo.
sha256sum c8574bd5980877c6aaf513714c2bb37776cf5179190490718364de43fdc3a139 Titan/EuropeanUnion_EEA_TTEU-01/2020081015_g61v71c2k_dfl_eea.zip ac6c0d04a9d79682a56b24994fa1e90393df56ac7cbc0d2f5c68825bde6a98ed Titan/None_EEA/2020080711_g61v71c2k_dfl_tee.zip b2sum 77f767bf84ee3b31707543d00b429625dddb1833047b82e8e61d7d86594307c093042e15c19beb0aba6cc87f9012e85a0df56ae1f18178b6347fd568da131d6f Titan/EuropeanUnion_EEA_TTEU-01/2020081015_g61v71c2k_dfl_eea.zip 1d5959a68daa81b3cc26627fcafe1f1c089230d764e29d3e683d85ef1705352e505a079a5117fa65b484ec51323e251a4d657571dd3b74d17903eb6c2c34c43d Titan/None_EEA/2020080711_g61v71c2k_dfl_tee.zip sha512sum d7ca0323743d05c19b887375e954bf610e583d7106481f1ec39e19b69cc7cb4954bf72d11ba2bef18968afd0136220bff346c31102db525197d464e9c5f7cd3c Titan/EuropeanUnion_EEA_TTEU-01/2020081015_g61v71c2k_dfl_eea.zip e2fdc6fb696365d64fe839064c3d94d661384e1059510fdc72154e2fe3fe84ff97db6bb67dcd06b6306c29d181cb0bb476fa9b77782039df324bba28cd26fd00 Titan/None_EEA/2020080711_g61v71c2k_dfl_tee.zip
- flashing with the windows tool worked great to return it to a normal state - the oem flash zips include images of all the partitions and additional data, unsure if that includes nvram, could check with other tool - the quack release also did not immediately seem to boot right, but it did dump me back to the recovery menu after a couple reboots rather than looping - i haven't gotten twrp to stay, the system just hangs with a black screen until it eventually resets back to the factory recovery image might just wait for my pinephone. unsure. should return this phone if i don't use it. i have a pinephone coming in the mail. need to consolidate resources toward things that work. phone is practically new.
maybe i should give it some time and plan to try magisk. if magisk works easy, maybe i can use root access to image the partitions that way. too bad about the open source rom not immediately working. maybe if i come back i can explore it with more time, maybe try the exact revision mentioned in the websites. here are some more digests including over-the-air updates. the android 10 ota updates are at the bottom. sha256sum eb5f450898c99c783ce7169c07bbb9f6c539e0eaa3f6421a071e65f67c3e9410 Titan/EuropeanUnion_EEA_TTEU- 01/2020040710_g61v71c2k_dfl_eea-ota.zip e5bd4d7bc8cc8a6c23b5caa72eccb7ddff3720bffcbae0a0197ba1502b3fecd2 Titan/EuropeanUnion_EEA_TTEU- 01/2020070621_g61v71c2k_dfl_eea-ota.zip 8b61b0b7761375f832fa46c18f826782972ade0ee278b541de900593fb955bc3 Titan/EuropeanUnion_EEA_TTEU- 01/2020081015_g61v71c2k_dfl_eea-ota.zip c8574bd5980877c6aaf513714c2bb37776cf5179190490718364de43fdc3a139 Titan/EuropeanUnion_EEA_TTEU- 01/2020081015_g61v71c2k_dfl_eea.zip c299c140d56e8e31575d9fe8ecc51903e84570533663f06a390602166d85fded Titan/None_EEA/2020040710_g61 v71c2k_dfl_tee-ota.zip 3eaeda51ac9966de63fc6089ac8d30927057b55e859d623992fba03928de8848 Titan/None_EEA/2020060312_g61 v71c2k_dfl_tee-ota.zip ba7c15ff911a7c3bb2e746f00ab318b79fdb27b966702a2f184ddfe37fd0aa71 Titan/None_EEA/2020070618_g61 v71c2k_dfl_tee-ota.zip f3d78b8f0bccd332d4b22b8721397fe98634e57060d56af8d4d098b01070e9ce Titan/None_EEA/2020080711_g61 v71c2k_dfl_tee-ota.zip ac6c0d04a9d79682a56b24994fa1e90393df56ac7cbc0d2f5c68825bde6a98ed Titan/None_EEA/2020080711_g61 v71c2k_dfl_tee.zip sha512sum 2bb31e96b6c74ccc97f39c11fba61b717b32704144ee4202cdc9429fc77d4da6127a9449d380b3a4975e992802787f464c7eaf259114d88a18f51635a7069195 Titan/EuropeanUnion_EEA_TTEU-01/2020040710_g61v71c2k_dfl_eea-ota.zip 066d94c3b2a7d09d57cb30fe6269627d76f3c9ac77132bb98c0e793be41ccabda0f97ce081103d123b68246e43c4dabcdfdb55c6269f9e78b0a83e428e2753ab Titan/EuropeanUnion_EEA_TTEU-01/2020070621_g61v71c2k_dfl_eea-ota.zip 2a240ebc1784334d25425136393f0070ebc1f38926bfdc1955fb52e839d6e7e12ace634d80676414b68849c1b3577eb35d2516b63a2e4c100b5152d5a14900d1 Titan/EuropeanUnion_EEA_TTEU-01/2020081015_g61v71c2k_dfl_eea-ota.zip d7ca0323743d05c19b887375e954bf610e583d7106481f1ec39e19b69cc7cb4954bf72d11ba2bef18968afd0136220bff346c31102db525197d464e9c5f7cd3c Titan/EuropeanUnion_EEA_TTEU-01/2020081015_g61v71c2k_dfl_eea.zip 0fca2d61f0dbff9b7f79f2b3f1cafddf14031c5cb805439e0ba8258a52ed8775e1150bf56eef37ebe708ca190c584d95b944789954d3824e4fbd5eb173eb1f7b Titan/None_EEA/2020040710_g61v71c2k_dfl_tee-ota.zip 14b5713c04d1eed7c25bc75ed613f5e7488b69ca951c8a312198e76d2f2a2fdce7a70dfd3f22d6ca449c62f5149193352e139a8862013891ec3e03ddb6a249d1 Titan/None_EEA/2020060312_g61v71c2k_dfl_tee-ota.zip b789819ca659c551879bdce9705e5664e4c33b258b8b03e36b48672fc4a06b6c449dc6af3c080c12201ff61eab3764f82b4dc40d7185bedf16d01dad55211b73 Titan/None_EEA/2020070618_g61v71c2k_dfl_tee-ota.zip 2b6e73b4d21ff027c54d64405b5ef0c6b1e11def0639c81f4655669a057e20c9c640c79c79cab39d6c8b2f2ab6ab33e6937217e544607387ac059c60b7326857 Titan/None_EEA/2020080711_g61v71c2k_dfl_tee-ota.zip e2fdc6fb696365d64fe839064c3d94d661384e1059510fdc72154e2fe3fe84ff97db6bb67dcd06b6306c29d181cb0bb476fa9b77782039df324bba28cd26fd00 Titan/None_EEA/2020080711_g61v71c2k_dfl_tee.zip b2sum 216a15658a762ece7d1b71f5a9b4c417a77326e3a52b58be684fa1c3b64bc879114669747b58b36f3d91027d717f4a430730d1b090c37b1479fd17bbef334e70 Titan/EuropeanUnion_EEA_TTEU-01/2020040710_g61v71c2k_dfl_eea-ota.zip c23e3110f321e1ff4c6d57f7b9705ee0b74ea48c1d675a7e75d7f2f9c93ebf83cf2aa8dc8d4030a8822ba6d84b0318b0c0b044ead7a36cee9954bc5ff9039e20 Titan/EuropeanUnion_EEA_TTEU-01/2020070621_g61v71c2k_dfl_eea-ota.zip 9bc93b655a4d37edbacef49bd93e05bb37a2d281858b8c71516aaa67e51e632893fec19eebe3d7e57839510c93c39f962dcb20143f903dde8e31be0a5dfc586a Titan/EuropeanUnion_EEA_TTEU-01/2020081015_g61v71c2k_dfl_eea-ota.zip 77f767bf84ee3b31707543d00b429625dddb1833047b82e8e61d7d86594307c093042e15c19beb0aba6cc87f9012e85a0df56ae1f18178b6347fd568da131d6f Titan/EuropeanUnion_EEA_TTEU-01/2020081015_g61v71c2k_dfl_eea.zip f4094c3585eaa3b0ae89e7038eaffbe003e202a7ab64b615be0a3b11c88b7b4214050cba15bec4b6c2ec7383b744cce6b4b9aa69f0c9a4605be0ef7e12773bbb Titan/None_EEA/2020040710_g61v71c2k_dfl_tee-ota.zip 19bbce1a357cfeeeb94a0390cc77292c7cf0e3bad942b7550425e23279b778e8658531808dda561bb425c8b6563c38e3691fda4a024fdfc257748e4a3ab95c4e Titan/None_EEA/2020060312_g61v71c2k_dfl_tee-ota.zip 435d235dae5a2003316d60237c5f95045d56b5da2e93b2ad2f3a79d40300ac579f805a47087061ee114c1c26deb41c6318ca028cbba7ec2f8820a814ef79c1a6 Titan/None_EEA/2020070618_g61v71c2k_dfl_tee-ota.zip a7db075ff4e65e981f11557fcc493f2f272e8058d223c6e3bc44ede9bdce00a376d1f38a5cc20cfb1dc3773671f59cd14a08a161647d89d9c89ee46aa386cafe Titan/None_EEA/2020080711_g61v71c2k_dfl_tee-ota.zip 1d5959a68daa81b3cc26627fcafe1f1c089230d764e29d3e683d85ef1705352e505a079a5117fa65b484ec51323e251a4d657571dd3b74d17903eb6c2c34c43d Titan/None_EEA/2020080711_g61v71c2k_dfl_tee.zip sha256sum 0f3e49918adebc5a3a8c75547ec8ebc8c272dfeff4a3aa61565f4162990555a6 Titan/EuropeanUnion_EEA_TTEU-01/Android10/2021020416_g61v71c2k_dfl_eea-ota.zip b311d4945c975e20f8083c148397d7612611bae5ce0e2670def0386194c15d3f Titan/None_EEA/Android10/2021020509_g61v71c2k_dfl_tee-ota.zip sha512sum d2c0f7b54942690f17b2a66c9edc2c4057916013f0bea1bcf2d98292663c1ced4d4a8d38cf6cff6d62364f098db1119f301c1c099737dcff81bda24e5227e59e Titan/EuropeanUnion_EEA_TTEU-01/Android10/2021020416_g61v71c2k_dfl_eea-ota.zip 43e382c5ffe3a421dbd426316c35ac6daa6fbe423fc46d79b46382b3689830494d778bc9006f9df5a6492d89b0908323a36ef7bfe84d73fe23b4e2c287dd891d Titan/None_EEA/Android10/2021020509_g61v71c2k_dfl_tee-ota.zip b2sum 59ecd4acf8a2bc4d07230aea3626b90b85ebd69337244f728e330929ed3c057bb0ad9edb1a2c5ccd8a12c7efdf91a317a51f5ec627fbc2479d1c1f85b6051c86 Titan/EuropeanUnion_EEA_TTEU-01/Android10/2021020416_g61v71c2k_dfl_eea-ota.zip 308f1e6cd2fcf2467e81bab0fcf4f1f8871da9f625ff31ccb9dc61f6e9293583e76432ee7ed6134a90c4ac161dfff79597616d79b8128725d05997e61900ba67 Titan/None_EEA/Android10/2021020509_g61v71c2k_dfl_tee-ota.zip
So, I got another cheap phone, the cheapest I could find, (a used ZTE Tempo X N9137), but it's locked so that only the previous user can open it. I did discover this though: - phones with a qualcomm chipset have a special mode called emergency download, that provides for reading and writing all the storage, but one might have to add the vendor/product id to the qcserial module in linux to get access.
Point of sale tracks the IMEI, being able to change that for any/all phones is useful, such as for giving your phone away to others. Point of sale tracks the SIM, but unfortunately a SIM is probably still not generateable onto blank cards?
On 12/28/21, grarpamp <grarpamp@gmail.com> wrote:
Point of sale tracks the IMEI, being able to change
I can't verify if that is still reasonably easy to do, have not set the device up yet.
that for any/all phones is useful, such as for giving your phone away to others.
Important stuff.
Point of sale tracks the SIM, but unfortunately a SIM is probably still not generateable onto blank cards?
I've heard of sim cloning, never tried it. https://www.techwalla.com/articles/how-to-clone-a-sim-card If you mean generating a new sim from nothing, sounds cool, not something I'm experienced with personally. I think of the data on the sim as the "login" information for the cell provider, so that might mean either being a cell provider or stealing service. I see there is value to anonymity. Hard to think about.
Point of sale tracks the SIM, but unfortunately a SIM is probably still not generateable onto blank cards?
I've heard of sim cloning, never tried it. https://www.techwalla.com/articles/how-to-clone-a-sim-card
If you mean generating a new sim from nothing, sounds cool, not something I'm experienced with personally. I think of the data on the sim as the "login" information for the cell provider, so that might mean either being a cell provider or stealing service.
I see there is value to anonymity. Hard to think about.
I'm thinking if you figured out the insides of a sim card you could probably social engineer some support reps to get the needed data for your account to generate your own sim. Not sure how you'd pay for the account. I bet in some area they have community sim cards.
On 12/28/21, k <gmkarl@gmail.com> wrote:
Point of sale tracks the SIM, but unfortunately a SIM is probably still not generateable onto blank cards?
If you mean generating a new sim from nothing, sounds cool, not something I'm experienced with personally. I think of the data on the sim as the "login" information for the cell provider, so that might mean either being a cell provider or stealing service.
I'm thinking if you figured out the insides of a sim card you could probably social engineer some support reps to get the needed data for your account to generate your own sim. Not sure how you'd pay for the account.
I bet in some area they have community sim cards.
SIM cloning, while useful, is duplicating, not creating a new unique SIM, and problems with simultaneous use arise. And community use implies some non-privacy that users may or may not wish. Millions of SIM's are encoded to providers, thus not unique or relevant here. SIM's serial (key) are assigned (provisioned, paired to) a msisdn (phone number) upon registering (signup, account creation, paying) by sending the SIM serial (key) to provider to get the msisdn, which is not the relevant process here. Question is if the SIM serial key used in that process, can be a randomly generated one (ie if the SIM serial keys aren't registered by and kept in the providers mobile pre-provisioning db) and then burned to the SIM, and then used to register for the msisdn service. Neither of which would work if providers and/or towers, have and share lists of all the manufacturer IMEI's and all the providers SIM keys, as part of manufacturing and provisioning chains, and then block all others they happen to see on the air (random gen'd ones). Providers can and do share and shutdown stolen IMEI's, cloned numbers, etc. And towers can still do whatever they want. But that's not a question donors to communities journos victims homeless etc might have. Same as might want to donate a fresh IMEI number to others, they might want to donate a fresh SIM key as well. Recipients of such donors gifts might then use the normal online (or cell based) SIM activation/signup process to get and turn on their own legit new [prepaid] phone service, then keep applying the usual monthly topup cards. Prepaid store bought SIMs typically include a small initial number of minutes or month inside the SIM packet, whereas a freshly generated SIM key may or may not. People would have to investigate how that all works.
Although hardware IMEI may be difficult to change, GrapheneOS (and perhaps others) have a way of intercepting system service calls which enable users to supply the values. On Tue, Dec 28, 2021, 8:10 PM grarpamp <grarpamp@gmail.com> wrote:
Point of sale tracks the IMEI, being able to change that for any/all phones is useful, such as for giving your phone away to others.
Point of sale tracks the SIM, but unfortunately a SIM is probably still not generateable onto blank cards?
On 12/29/21, Steven Schear <schear.steve@gmail.com> wrote:
Although hardware IMEI may be difficult to change, GrapheneOS (and perhaps others) have a way of intercepting system service calls which enable users to supply the values.
Consider that similar to ethernet/wifi HW mac addresses... Except for a hands-on check, it wouldn't strictly have to be a power cycle permanent IMEI change (some ethernet/wifi HW can be hard reprogrammed like that with software tools), but if it's not power cycle permanent then it must never listen to nor transmit on the original IMEI, all listen and especially transmit must not happen until the radio (interface) is soft configured with the new IMEI and brought up. Soft config can therein be a problem because, similar to ethernet/wifi which has wake-on-lan AMT and other top secret insecure always on side channel management features, IMEI baseband has been said to be similarly listening, and perhaps transmitting in reply, all the time too. In that case the window between hands-on power up and soft config would be a problem. Also, other than "regulatory" requirements, "airplane mode" may similarly be always-listening-to-reply baseband suspect. People would have to investigate all that. And without crowdfunding and starting up #OpenFabs , #OpenHW , #OpenAudit which is the better way forward, and which you can now easily startup via the global crypto crowd (over 2.5T mktcap, go spend 0.5%, ending secret closed HW better than hodling), you're just not ever going to know what's inside.
And without crowdfunding and starting up #OpenFabs , #OpenHW , #OpenAudit which is the better way forward, and which you can now easily startup via the global crypto crowd (over 2.5T mktcap, go spend 0.5%, ending secret closed HW better than hodling), you're just not ever going to know what's inside.
Y'know, I haven't personally tried it, but there's a pretty good chance that ending most closed hardware and software is just as far away as training transformer models to automatically reverse them. The biggest impetuses to that are collecting example data and setting up the training environment. The best example data might be from chip design simulators if such exist, as then you could autogenerate variations and also automatically change points at which voltages are probed.
On 12/29/21, k <gmkarl@gmail.com> wrote:
And without crowdfunding and starting up #OpenFabs , #OpenHW , #OpenAudit which is the better way forward, and which you can now easily startup via the global crypto crowd (over 2.5T mktcap, go spend 0.5%, ending secret closed HW better than hodling), you're just not ever going to know what's inside.
Y'know, I haven't personally tried it, but there's a pretty good chance that ending most closed hardware and software is just as far away
0.5% is enough to get open chips rolling out the door to funders and millions of paying customers. Ending closed could happen, look at all the open on (centralised) github that didn't exist at all 10+ years ago. But what must happen is putting down the $$$ to get the first one going, to put open chips out into the free market, that is the seed.
as training transformer models to automatically reverse them. The biggest impetuses to that are collecting example data and setting up the training environment. The best example data might be from chip design simulators if such exist, as then you could autogenerate variations and also automatically change points at which voltages are probed.
So go crowdfund and spend another trivial 0.01% to do that too. However fuzzing and exhaustively probing is hard, not least because today's instruction and data bus and transistor spaces require 2^n ops, reaching atoms in the universe levels. And all the effort is good for only whatever closed chips you test all of which get obsoleted as new secret ones drop every year. Decades and decades of CVE's against closed GovCorp shitHW. Whack-a-mole and embarrassment are not solving the problem. #OpenFabs , #OpenHW , #OpenAudit , #FormalVerification Those must all be crowdfunded started up and tried.
participants (4)
-
grarpamp -
k -
Steven Schear -
Undiscussed Horrific Abuse, One Victim of Many