[Android General] xerootg:
I despise phone-size creep. I bought a palm a couple years ago and didn't like the stock firmware. Not sure many people do. I started hacking on mine a year ago, loading AndyY's Lineage GSI, but I got frusterated and went back to a full sized phone after a couple days.

I'm happy to report that I've been daily driving this phone for a couple weeks on Havoc 3.12. Some lessons learned:

rawprogram0.xml and patch0.xml is included in your update. Its the files beginning with P (rawprogram0.xml) and Z (patch0.xml).

WARNING: It is super easy to wipe your radio partitions if you blindly execute this. The `zeroout` tags are syntatically erase tags, so renaming those is a thing. DO NOT WIPE modemst1, modemst2, or fsg until you have a good backup. Infact, just do your self a favor, and dump the whole phone. This is possible with emmcdl. I dumped the gpt partition and used that as a guide for what to dump before I realized that rawprogram0.xml was included by Sugar in it's updates. My VZW phone does not have an IMEI and I cannot recover it with any of the usual tools cause the MSM8940 is not exactly a popular chip and never was. I also toasted one of my other phone's IMEI's, but was able to restore it by flashing the stock system and recovery.

Bricks are recoverable. I have 3 of these phones - 1 that I bought in 2019 directly from Palm, an unlocked verizon model, and an unlocked OEM model I got on EBay. Devices 2 and 3 do not have the sim eject mechanism, but that's okay cause I have been using them to hack on.

The firehose's available have a nice feature in that it where it logs to uart when executing a program tag, eventually leading to the programmer refusing to read more bytes from the uart till the log is flushed. I patched qdl to work with emmc based erase tags and was able to write anything because qdl does implement fixes for this 'bug'.

I put the stock aboot into ghidra and spend many weeks looking at the results to determine that while fastboot is compiled into the firmware, they left the "volume up/volume down + power" trigger in place to access the boot menu, and therefore we cannot do that. The reboot reason code also does not trigger the bootloader menu. No fastboot, period. Theoretically, we could use the EDL to execute arbitrary things, such as demonstrated by alephsecurity on other 'older' msm devices.

The devinfo partition 0x10 and 0x14 bits are read but do not allow for unsigned boot images.

The vendor partition is junk. TCL does not impress me as a phone manufacturer. I modded the vendor fstab to not encrypt the userdata partition so I could hack on this thing more easily. Idk if it has an impact on battery life. 'vendor.qti.hardware.factory@1.0.so' is missing from /vendor/lib and /vendor/lib64. I'm not sure it's supposed to be there, but there's tons of binder failures in logcat without it. Fetch it from the oem system partition. The stock audio config is in the wrong folder. It's currently in /vendor/etc/audio/audio_policy_configuration.xml, and the one sitting in /vendor/etc/ is just plain wrong. Here's my patched audio_policy_configuration.xml, with edits to support in-call audio for android 10+

Spoiler content hidden.

Also on the topic of broken stuff - BT crashes periodically. This same crash occasionally results in infinite boot screen. This is likely due to a missing permission for the com.android.bluetooth package for pbap. I added mine manually (via pm) and my battery life is _waaay_ better, probably cause the stack isn't constantly starting and crashing.

I am using some kernel tweaks, via the KTweak (tytydraco) magisk package, and I am running magisk 25.2. I had issues getting a valid magisk'd kernel with 25.2, so once I got a working version, I dumped it and that's what I flash now instead of a vanilla one. I think the winning combo was magisk 23, followed by dm-verity disable (the old zip) followed by magisk 25.2, all from TWRP. I could upload it if anyone cares.

I never got a working TWRP build, so if someone could shed light on how they managed to build TWRP, I'd love to mod it a bit to be more friendly to this platform, like enabling userdata decryption, modem flashing the safe way, etc.

I attempted to implement lk2nd so I could stop using firehose. Yeah, signature validation of /boot prevents us from doing this. Yay.

I attempted to flash the euro aboot with 0x10 = 01 and 0x14 in devinfo, leading me to get stuck in 900e mode. Presumably aboot must also be signed. I was able to coerce the phone into 9008 mode to re-flash aboot by shorting the top-most(top to bottom) center (left to right), small test point to the phone chassis. It's in the triangular cluster of test points. I can't be bothered to upload a picture, sorry. With the battery disconnected, usb unplugged, ground it out and and then plug the phone in. Give it a second, and then you can unshort it (I used a dupont wire, and just pretended I had more than 2 hands) and plug the battery back in.

I'll probably keep hacking away on this platform, I love it as my phone.

I dumped the PBL, but I have not spent very much time with it in ghidra to see what we can do with it.

Auto backlight is all that's missing, and I'm working on that.

I'll probably make my own vendor and if I can get it to compile, GSI, and upload it here for those of you who still care about this ancient, gutless, yet amazing platform. I'd like to run a newer android, but A-Only stuff is dead, and would probably require a kernel. I have enough sources to compile a kernel, but I can't test it since I can't boot unsigned stuff.

I'm not tech support, but I will keep publishing my results.