[Security Discussion] phonecapone:
[FRP] Various Ways To Navigate FRP Bugs / Bypasses / Workarounds In Android OS

I am taking notes on the FRP bypasses I "freestyle" to find things out on my own.. potential new ways into areas of Android needed for successful FRP bypass and some just for fun. I encourage anyone who does this for whatever their reason to post to this thread if you want to share some of your methods. We all know hardware rules everything anymore but personally I have always had a nack at finding bugs / vulns / exploitable vulns since I was young. These are basically FRP workarounds if you want to call them that and are quite easy to come across. Below are some of the areas I have came across that ended up in taking me places that could be beneficial to completing a FRP Removal. These should be known to most everyone as they are basic areas of the Chrome browser. I just never thought about putting them to use in FRP situations until now. I have other workarounds and bugs I have found non Chrome related i will add later.

Below are just my notes crammed together. I will add to this much more when i've the time.

Android 7.0 - Tested on a Boost Stylo 3 Phone during manual FRP removal.

These are all through Chrome Browser. All should be pretty much known to most if you have dev'd / reverse any or just plain want to know wtf all goes down in Chrome.

*goto chrome browser*

chrome://chrome-urls/

then

chrome://bluetooth-internals

left 3 lines (menu)

devices

start scan (may be enabled on some devices - though I doubt it due to protection)

*more ways to get out from chrome into various apps / settings etc*

chrome://chrome-urls/

goto - chrome://net-internals/#hsts - under "Expect-CT" click the link https://tools.ietf.org/html/draft-ietf-httpbis-expect-ct.

click on pdf - this will take you to downloads (dont set a default reader)

click on mail - this takes you to gmail

*google maps*

chrome settings

site settings

location (enable) -> then enable all settings -> and press location (turn on) -> then under location services google location history then top right view/manage - now youre in maps... hit back and youll be taken to maps and from here if you want out from here hit the top left start navigation and say ok google then w/e.. chrome, settings etc (yes i know you can get to maps by clicking maps in google search.. just bringing up alternate ways of getting places that may help in the future in the event other methods are blocked..) then you will be into google maps - you only get this chance once after its all enabled you will have to hard reset and go back through chrome to get here or reset permissions and revoke location for chrome etc

*microphone*

then special access -> phone administrators -> enable/disable phone admins

then special access -> modify system settings -> turn off the ability for certain apps to read/write to the system (could this be another easier way instead of forcing stop / disabling apps ? These settings may not effect much...

then your all permissions -> location permissions -> location (turn on) then under location services google location history then top right view/manage -> now youre in maps.. hit back and youll be taken to maps (yes i know you can get to maps by clicking maps in google search.. just bringing up alternate ways of getting places that may help in the future in the event other methods are blocked..) out from here hit the top left start navigation and say ok google then w/e.. "open chrome, open settings etc -"

chrome://flags -> contextual search settings.. -> enable the physical web...

(as deep as i went so far)

and others that could be of use somehow sometime eventually

chrome://

from settings back out to google chrome

goto apps then youtube then settings then history and privacy then youtube terms of service -> out to web