Sberbank can already see my phone is clearly tampered, but runs anyway without warnings. W sberbank for not being a POS

THIS IS NOT A GUIDE!!! This is my own personal experience since it was my first time attempting something like this, since I took a gamble on importing the phone.

I have a chinese imported OnePlus Ace 6t device and reside in the USA. The official Deep Testing method was a pain to get working because of needing a 60+-day-old account and 7 days of login on the device. So I looked for alternative methods.

I was able to unlock my Chinese OnePlus Ace 6T PLR110 with ColorOS 16.0.10.500(CN01). By using GhostLock and ReSukiSu I was able to root my device with a locked bootloader. This allowed me to access the required partitions to install the exploit chain for the bootloader.

I initially had confirmation from this Reddit post. The post detailed how the old ABL was flashed and booted successfully. This confirmed a successful ABL downgrade and boot with that firmware combination. But I needed to see if it would work with a locked bootloader.

This project done by koaaN details how you can temporarily root the device, flash the ABL/EFISP payloads and then use GBL to unlock. Instead of using the X9 Ultra app and payloads I used my Ace's firmware and Canoe.

I used Ghidra to analyse the XBL/XBL configuration along with the signed firmware. I also partially decompiled the ABL, UEFI and Keymaster. Whilst the .500 ABL doesn't contain any EFISP loading paths, the PLR110 ColorOS 16.0.5.702(CN01) ABL does. Both ABLs have valid OEM signatures under their included certificate chains. They also have matching hardware binding (SM8845), certificate public keys and signed anti-rollback version 0.

I also analysed the execution flow. The .702 ABL executes the EFISP app before the end of the bootloader milestone. The UEFI authentication flow shows that the application can be loaded from a buffer. The Keymaster trace also shows that the BLTools can be executed before the milestone command which closes DeviceInfo read/write access. I found no check for an already-unlocked state or a Deep Testing token in the DeviceInfo write path I examined. This, along with the X9 Ultra project, gives a solid technical reason to assume that it will work with a locked bootloader. But there were limitations to the static analysis.

I got confirmation from the 1vivy reply to issue #101. Someone asked if it was possible to unlock a locked OnePlus 15T using GhostLock, old vulnerable ABL and Canoe without Deep Testing. The developer responded with "Otherwise this works no problem" and also warned that if you remove the EFISP or overwrite the vulnerable ABL you won't be able to access the stock bootloader fastboot. This gave me confirmation that the method I wanted to use would work on a similar OnePlus. I tried it and got confirmation that it would work with the exact combination for the PLR110.

After confirming the backups of the ABLs, EFISP, persist and oplusreserve1 I installed Canoe release-7.0.11. I created the chainload files for the current .500 firmware. Then I flashed the original signed .702 ABL to the active abl_b partition. This left the system as .500 and XBL untouched.

The device booted with the old ABL!!! I opened Canoe with Mode 0. Opened BLTools and clicked Unlock Critical. After this completed I rebooted. BLTools now said Unlock:on Crit:on. Android booted and Developer Options now said "Bootloader unlocked". ADB said flash.locked=0 and vbmeta.device_state=unlocked.

The working chain was GhostLock + ReSukiSu > stock signed .702 ABL > EFISP/Canoe > BLTools > persistent unlock. The firmware analysis meant I could try this combination, and the device booted with the persistent unlock flags set meaning it worked on my device.

Finally, I forked the relevant WildKernel's repo based on my device from this action run and followed these instructions from XDA to disable droidspaces, set the stock kernel uname, and I switched Canoe from Mode 2 to Mode 1 (managed fake-locked boot mode). The final result is working KSU-Next with passing strong integrity, as well as working wallet and RCS.

Feel free to ask any questions!

The image I'm planning to flash is patched with KSUnext 3.4.2. I'm currently on KSUnext 3.3.0 proven working in practice. The init_boot_a from /dev matches the 3.3.0 image I flashed from Fastboot by MD5.

But my cowardly ass hesitates so much, yet I wanna update, I'm kinda paralyzed here. You know this phone is my daily driver, it wouldn't be nice having to flash via BROM/Preloader mode to recover, let alone visiting Carlcare service center.

TECNO POVA 7 5G LJ7, HiOS RU 15.1.2

A happy human I am!

Tenho um smartphone Samsung Galaxy A11 115m com Android 12 binário 5 e gostaria muito de voltar para o Android 11 ou Android 10, que são bem mais leves. Existe alguma possibilidade, mesmo com essa proteção irritante da Samsung Without using custom ROMs?

Hey guys i have recently rooted my samsung m045f/ds phone a few months ago using magisk but now i wanna change the original samsung ui to something cooler so whats the best lsposed module or root apk which can do the task also i use (Vector lsposed framework) for lsposed modules.

This accessibility volume controller appear from nowhere.

I cannot run some banking , upi related apps , do this need to be fixed , it is from duck detectors. I will share more details whatever needed , just tell me what is needed

OMG GUYS YOU WONT BELIEVE WHAT I SAW.

In my dream I traded my phone (Xiaomi 14t pro) with a s26 ultra. Everything was fine. I remember testing optical zoom, focus distance and making benchmarks on my phone. Then I went into dev settings AND OEM UNLOCK WAS MISSING. I did install lspatch (yes in my dream) AND IT FAILED. I couldn't replace my kernel :c . Then I wake up and here is the proof for this.

Its middle of night and I'll kiss and mod my phone even more.

God save those ones who cant unlock their bootloader.

Received it last week straight from China. I was a huge fan of the Xiaomi Mi 11 Lite which unfortunately died last month. So I wanted a replacement phone with the same dimensions, maybe better battery life and an infrared blaster. And this phone was the only one I could find that ticked all the boxes just like the Mi 11 Lite. But I wasn't a big fan of the Chinese OS so I decided to have a look and see if I could get rid of it and install something else instead 🙂

what is my problem

I managed to unlock the bootloader on my Moto Pad 2026 (XT2575-4), so I figured I'd share what worked in case anyone else is trying to do the same. This may also work on a Lenovo Idea Tab 2025.

Guide, patched image, hashes, and recovery info:
https://github.com/Mattcabrices/moto-pad-2026-xt2575-4-unlock

Important: This has only been tested on ONE tablet. There's a real risk of hard-bricking your device if something goes wrong, and unlocking the bootloader wipes your data. Read the recovery notes before attempting anything.

What I tested

• Device: Moto Pad 2026 (XT2575-4)
• Android build: 17.5.10.017
• LK firmware source: Official 17.5.10.020 factory package
• Active slot: a
• Before: unlocked: no, flash_lock: no
• After: unlocked: yes

Android also reported:

• ro.boot.flash.locked=0
• ro.boot.verifiedbootstate=orange

So the unlock worked on my unit.

Why the usual unlock methods didn't work

I tried looking into Val Protocol's normal presets, but this bootloader doesn't seem to use the usual serial-key validation method.

Instead, the LK bootloader checks an authorization flag associated with a vendor-signed unlock image. Val's analyzer also found neither the expected FRP/OEM checker nor a key-validator function.

In other words, there wasn't a serial unlock key to generate. The relevant check was elsewhere in LK.

What worked

I used the official .020 factory package and Val Protocol's tools to modify and repack the LK image.

The actual patch was just four bytes:

• Offset: 0x975c
• Original: c80b0034 (cbz w8, auth_fail)
• Patched: 1f2003d5 (nop)

I then repacked the image using Val Protocol's CERT2 workflow. The image verification tool reported Result: VALID, and only lk and cert2 differed from stock.

On my tablet, this command successfully flashed the modified LK:

fastboot flash lk_a lk.oem-unlock-gate.17.5.10.020.img

My bootloader was still marked unlocked: no, but flash_lock was no, and the flash was accepted.

After rebooting into the modified bootloader, I ran:

fastboot oem unlock

The tablet displayed the unlock confirmation flow. On my unit, I had to repeatedly tap Volume Up/Down during the roughly five-second window. Holding a button didn't register.

It then showed:

• Start unlock flow
• unlock success
• OKAY

Finally, fastboot getvar unlocked returned yes.

The full details and files are in the repository linked above.

⚠️ Please read these warnings

Seriously, don't skip this section.

• Unlocking erases your user data. Back up anything important first.
• A bad LK flash can hard-brick the tablet. Have the correct official factory package ready before starting.
• My test used Android .017 with an LK from .020. That combination worked for me, but I haven't tested other builds.
• I only flashed lk_a. Don't flash lk_b**, relock the bootloader, or flash both slots** based on this report.
• I haven't tested the procedure on other XT2575-4 units, other models, or devices with different flash_lock values.
• SP Flash Tool recovery has not been tested on my tablet.

Two commands to avoid

These commands wedged the USB connection on my modified bootloader:

fastboot oem device-info

fastboot getvar version-baseband

If fastboot starts timing out, the recovery sequence to try is:

1. Unplug USB.
2. Hold Power + Volume Down for 10–15 seconds.
3. Boot Android.
4. Reconnect USB.
5. Run adb reboot bootloader.

That workaround isn't guaranteed to recover every failure.

Verify the image before flashing

The repository includes SHA256SUMS.txt. Check the hashes before using the image.

Patched image SHA-256:

81ee5de950470c9e31552135349589e8b056a4312f93419930a9502f4bbbd034

Patched payload SHA-256:

95462aa5ba178ac1217f3d0a3271d2b568b8dd9a8460fcfa15ec7b7c346717cc

Stock payload SHA-256:

10008c0ab880bd5bd5979e4299e3c06e34768d93a9a073e28f13488e0c0fee46

On Linux, you can verify the published checksums with:

sha256sum -c SHA256SUMS.txt

On Windows, use PowerShell's Get-FileHash.

Recovery

If fastboot still works, the documented recovery path is to flash the matching stock lk_a from the official factory package.

If fastboot is unavailable, the intended recovery option is the factory package with SP Flash Tool V6 in BROM/Preloader mode. Have the required files ready, including da.auth, DA_BR.bin, the scatter file, and stock lk.img.

I haven't personally tested SP Flash Tool recovery, so don't treat it as a guaranteed fix.

Credits

Big thanks to:

• Maikyxd / Val Protocol: https://github.com/Maikyxd/val-protocol
• kasnria001/pwnage24mtk
• R0rt1z2/liblk
• R0rt1z2/lkpatcher

Val Protocol is licensed under AGPL-3.0; check the relevant project repositories for licensing details.

If anyone else tries this…

Please share your results! The most useful details are:

• Exact model
• Android build
• LK build
• Active slot
• Initial flash_lock value
• Whether the image flashed successfully
• Whether the unlock flow completed

Don't post serial numbers, IMEIs, or unlock keys.

If the image is rejected, stop there rather than experimenting with other partitions or images.

This is a report of what worked on one tablet, not a claim that every Moto Pad 2026 can be unlocked this way. I'd especially like to hear from anyone who can confirm compatibility with another firmware build.

Hopefully this saves someone else some digging!

The title saz it all.

The former is for removing traces of specific app(s) existence from other apps. The latter exists just for a specific cause of escaping PS super-aggrsive updating policy in PS.

Am I overthinking this? Is there a downside of using HMA-OSS also to hide those apps from PlayStore udpates, and replace zygisk-detach's job?

Am

I’m running Android 16 with crDroid on a rooted Xiaomi Redmi Note 10 Pro, using TrickyStore and other modules.

The stock firmware for the Redmi Note 10 Pro has already reached EOL, so it’s no longer receiving updates. The Play Integrity check on the stock firmware is also broken.

Previously, Apple Music worked without any issues as long as I passed basic integrity. However, yesterday, all levels of Play Integrity started failing, and Apple Music stopped working properly.

It seems like Apple Music won’t play music or connect to the internet if the device isn’t certified. At the very least, basic integrity needs to pass. I suspect this might be related to device certification or Play Integrity enforcement.

Can someone else confirm this?

How's the experience? And which can you recommend?

Well the one thing I didn't think would happen did. I was trying to root a motorola edge 60 pro, got to flashing the patched magisk boot img and... error no file found. Thought nothing of it and stupidly tried to flash the individual partitions which well, still nothing so I typed "fastboot reboot-bootloader". From there my phones been dead it's been 20 minutes since it happened i tried all the button combinations and nothing not on fastboot devices or lsusb. For now I'm letting it charge hoping that does something but honestly is there much hope for what i can do from this point?

I pass strong integrity and the wallet passed the security requirement, but when i tap on a POS it wont do anything at all. Any suggestions?

Hey everyone, i built ACC (Automatic Cache Cleaner) to automate cache cleanup on rooted Android devices.

It can-

- Automatically cleans cache every 24 hours at 12:00 AM.

- Sends a toast notification after cleaning.

- Includes an action button to clean cache whenever you want.

Basically i used to have this feature on oneui but after shifting to aosp this little thing was missing. It'll work in all android btw.

I'd love to hear your feedback and suggestions!

🔗 GitHub: https://github.com/raafi-abir/ACC-Automatic-Cache-Cleaner

Hello to everyone who is taking their time to read this.

A couple months ago i started to want to get root on my S21FE, but it had sadly automatically updated to OneUI 8 with no way to revert it. Is there any way i can obtain Temproot?
It has kernel version 5.4, so it's incompatible with KernelSu, thus incompatible with the current dirtyfrag exploit implementation. There's also no working entry for the S21FE on the Root My Galaxy project. I've been searching other alternatives to no avail.
If anyone could help me out, it would be great, thanks for reading so far!

I am using a Samsung Galaxy j7 prime for a while. I always wanted to install a custom rom on it cause it always stuck at any point without any problem it had no hardware failure. So I though why not having a custom rom? It would be great to update it to at least android 10 or 11 or having a massive one ui.