[General Questions and Answers] MeepMan:
I'll just post this here for now; might move it to a general thread later but might as well make use of the [help] header.

EDIT - this post is really long lol

I PRESENT TO YOU: MY PAINFUL UMIDIGI POWER EXTRAVAGANZA!

So I'm having some issues with a UMIDIGI Power (2019) phone, and I believe that it has a virus. The problems began probably a couple of months ago when I noticed that the GPS was turning itself on for no apparent reason. Under "recent location requests" was Google Play Services, so I assumed that was the culprit.

However, a few weeks ago I decided to investigate further as I don't like to keep my locaiton on. I was disabling Google stuff and eventually just started disabling a bunch of system stuff I think. I got a reaaaally sus message about my information being sent to Baidu during this process (See bottom for screenshot). The message would keep prompting me to "DISAGREE" or "AGREE" so of course I chose disagree. It did this every couple of seconds so I couldn't keep using the phone. The wallpaper also reset to the default one with the phone's branding on it.

After a factory reset, which erased the Baidu info collection prompts and let me set my own wallpaper again, I looked into installing a custom ROM (and likely a kernel as well) to get rid of this apparent spyware. I thought this would be a straightforward process, boy was I wrong. There is an XDA thread about a method to do this (see bottom for link) and I spent hours preparing drivers, backing up, etc just to prepare for a seemingly tedious process. However, when attempting to boot my phone into bootloader or fastboot mode, the device becomes unauthorized (for adb) or undetectable (fastboot). I tried reflashing the stock ROM with SP Flash Tool but that also didn't work.

So the last thing I have tried to do to get rid of this spyware, to actually be able to text people again, was to use tools to disable system apps at a lower level. I used mtk-su to get root access but I don't want to edit /system files, because verified boot will likely brick the phone. I have used Shizuku to enable App Ops, a secret menu that lets you manage lots of system perms without root (link @ bottom). I have painstakingly gone through every permission for every app and found some suspicious results:

1) The app that is claiming to enable location tracking is "Mtk Nlp", buuut when disabling all perms in App Ops there is no option to modify system settings. Another (hidden) process must be using this app as a disguise.

2) There is an app called "Omacp" which when Googled shows a lot of virus results. I think it's genuine but I am not sure if it's hiding anything (since it uses com.mediatek it seems a bit more trustworthy)

3) I cannot find any app that has utilized a permission to "modify system settings" at the same time that location is toggled autonomously. It may be baked into the operating system in such a way that it is impossible to disable without overwriting a dm-verity protected partition.

I also noticed that after putting all system apps in a firewall, the error of "connected but no internet" appears for WiFi, and location never enables even on 4G. My guess is that whatever script turns on location does so to send a report to a server in China, and it does not do so if there is no internet detected. However location will turn on once after turning off airplane mode (someone wants to know where I am after disembarking from a plane..)

To summarize, the following issues are present with my device:

-It is unresponsive to adb, fastboot, or SP Flash Tool unless the phone is in the OS, at which point only adb works (duh)

-Something is sending my data to a server (probably Baidu), and also enabling location services. I'm not able to replicate the strange messages and crashing wallpaper but the location toggling persists even after disabling permissions manually with App Ops (it's on a lower level). The program/malware/spyware appears to execute when airplane mode is turned off, as well as when the android system reports an internet connection.

What I need help with:

-finding a way to either

1) disable the spyware in the stock OS without adb (except when booted) or fastboot commands

2) flash a new OS (+kernel for extra social credit) to get rid of the spyware, again without adb or fastboot commands (I have mtk-su root and terminal emulator)

3) restore adb, fastboot, and SPFT functionality so that I can follow the normal UMIDIGI Power TWRP Guide

Link to TWRP Guide:

https://xdaforums.com/t/twrp-3-3-1-umidigi-power-4g.3939553/post-81521153

(Yes, that is my conversation at the end about SPFT not working. As you can see, a solution was never found..)

Link to App Ops:

App Ops

Control the hidden appops conveniently

appops.rikka.app

(Luckily, since adb works when device is booted, I could initialize Shizuku. App Ops uses Shizuku to access the API and the page for Shizuku should be on the same website; the same dev made both apps.)