[General Topics] FranckyGoesToHollywood:
I try to share my experience about this cheap phone (bought I think for 45€ : was the cheapest of the hypermarket, around 2019).

Here are some specs : https://www.gsmarena.com/wiko_sunny3-9733.php

First of all, this is a SPD (Spreadtrum) based device, not MTK (Mediatek). (Surely, it would have been easier on an MTK Wiko like the Jerry...)

My goal was to get root access and finally try to install a big-tech free system alternative.

I confess, I spent about one month on it. Here are my findings and the final result I could achieve.

Long story short : I could not get root (I'll explain it below). But I could "un-google" it as much as it is possible without breaking anything essential.

Here is the story and it's lessons learned, in a hopefully logical order.

1. Tried all (really all!) available "out of the box" rooting apps without any result.

2. However there is an "allow unlock bootloader" switch in the "developper settings" (once taped a couple of times on the "build" of the system menu...)

there was no way to really "unlock" it using any appliable fastboot command (tried really everything).

3. Magisk (latest or any other) could not patch the boot.img (or recovery.img).

As root access means the ability to get at some point a writable filesystem, and as this is mounted by boot/recovery.img, this is the key process here.

4. So I went to linux to modify them : tried again all dedicated tools to unpack, edit and repack the boot and recovery.img.

mkbootimg/unpacbootimg, abootimg, but it turns out, they don't repack the files in an acceptable way for this system.

Independently from change made or not (in some .rc file inside the ramdisk, initrd), those usual dedicated tools just cannot repack the file correctly, at least for this device.

Lastly, when I tried bootimg.exe (for windows) of "cofface" (https://github.com/cofface/android_bootimg/blob/master/bootimg.exe)

I could find out that it extracted an other file that abootimg and others was not even aware of : dt_image (binary having an SPRD header).

And this (avesome) tool is able to repack it with it.

But now, the new boot.img was 12Mo and not 36Mo as before. Turns out there is a huge empty (00 bytes) overlay, and a vbmeta (AVB) signature, somewhere at a precise place and at the end of the file.

So I completed and patched the file by a hex editor, to make it the same as the original one. (There were also some 2 "minor" diffs at the beginning of the file that I tried every combination with to make the device boot with it. No way.

I believe now, fdl2-sign.bin, one of the two mandatory required files to flash anything on the device (that gets allways flashed first), checks the signature of boot.img (and recovery.img), so a modification of these would need a brand new signature. (Tell me if I'm wrong: I'm not a pro) And I gave up at this point.

5. Before (understanding the above), I tried also by just changing system/vendor to make root tools available :

Mounted on Linux : strangely, when the filesystem was rebuilt by "make_ext4fs" the flashing crashed, but just unmounting it and then "img2simg" to get the android "spars" format, worked fine (despite for ex. the record of the mountpoint inside the file).

I tried to add all the necessary files (su, busybox, etc.) to "system "and "vendor"... retoutching everythig back to original time stamps, etc.etc.

but the loaded system denies access to all "new" files (and also to some others). Then I tried to change some "policies" files in /etc/selinux (like plat_sepolicy.cil), only trying to get how it works (I added some lines about my files taking as example a well authorized binary)... if ever the added binaries could be accessed even on a -ro filesystem. But nothing changed.

All file added or modified, such as a new bootanimation.zip, becomes "access denied" as well, despite adding them to policies files.

Same for some "new" sounds to media folder : they will be listed but not played (so you only get silenced wake-up instead :).

6. After that I decided to un "big-tech"(BT) everything and replace as much (BT tracked) functions as possible by "clean" FOSS apps from F-Droid.

And this, at my surprise, I could get it through 100% (I believe).

The idea in short :

1 - make a clean firmware flush (perhaps with already reduced preinstalled apps)

2 - uninstall/deactivate on the device anything you want and can, replace needed default apps (by FOSS equivalent), especially the launcher(wiko app starter).

3 - edit system and vendor (on linux), delete unwanted apps (making according changes on some .xml control files doesn't change anything and only might cause problems: just deleting the packages seems enough here)

4 - then reflash only the modified system and vendor (reboot and see)

Now, for those who (I would like to say "hate" BT enough to accept loosing the shiny comfort they offer, but lets say) want to get rid of preinstalled privacy breaking BT apps, here is the howto : (with explanation for also the novice)

a) First, download the latest firmware update :

Wiko Mobile : Customer Area / Connection.

customer-world.wikomobile.com

b) Launch the app and push the start flushing button (play button). This will unpack the boundled .pac file into a temporary directory (into the app folder's "ImageFiles\_DownloadFilesE10_2C10D_0" : the suffix changes at each startup. Save this folder to somewhere else (because quiting the app will erase it).

c) Now you need to launch a linux OS, (that can of course access the saved rom files) mainly to mount and modify system.img and vendor.img.

I will detail this for the novice.

Basically, open any teminal, then install if its not yet done, the following needed tools :

sudo apt-get install e2fsprogs

sudo apt-get install android-tools-fsutils

to use Midnight Commander which will save you a lot of time, make also a

sudo apt-get install mc

Then "sudo mc".

Once in MC, do Ctrl+o to switch (back and forth) to command line

d) Uncompress the system+vendor image files, mount, modify, then umount and recompress them :

Uncompress by : "simg2img vendor.img vendor-whatever.img" (same with system.img)

Then (create some "sys", "ven" folders) and : "mount system-whateweryoucalledit.img sys -rw" (thats all, same for vendor).

It turns out, you can just easyly erase some apps (but not anything!) and they just won't be installed, or will "disappear" if they were...

You can delete already from system: in "app" and "priv-app" folders any Facebook related app or service, plus Youtube, Chrome, Gmail... Duo, Messages, TTS, Calendar, Maps. From vendor: Photos, Music, Contact (and also Chrome vendor overlays). Normally you could only deactivate them from the device, but that way they won't be present at all.

You can also edit /etc/prop.default, as follows, but honestly, I did not recognized anything really working, except the sys.usb config and mock.location (allowing fake gps position app).

ro.secure=0 ---> these 2 doesn't seem to do anything without a patched boot.img

security.perf_harden=0

ro.adb.secure=1 ---> needed, otherwise you won't get adb access dialog

ro.allow.mock.location=1 ---> allows fake gps app

ro.debuggable=0 ---> if 1: will just crash "developper settings" because of its defaults

persist.sys.usb.config=none ---> you will be free to set it

Do not try to "ro.adb.secure=0" because you just won't get confirmation box for trusted adb connection attempts and they just won't work!

Same, don't be tempted by "ro.debuggable=1" bacause you will not even be able to access "developper options" any more as its defaults will conflict with this setting an it will just crash over and over. I did it, I payed the price to start it over again...

Now, it seems, ro.secure=0 and security.perf_harden=0 does just nothing as well, without being able to modify boot.img first.

Changing eventually "ro.build.type=user" (in system/build.prop or anywhere else) to "eng" or to "userdebug" makes just the flashing operation to crash. (same by patching boot/recovery.img in hex mode (which looked attractive at first sight) but led to flush crash as well, mainly for the vbmeta thing I tried to describe above.

When finished, just "umount sys" and "umount ven"

Then recompress the files by "img2simg vendor-whatever.img vendor.img" (same with system).

(This first amputation and further, could be done perhaps later all at once, but thats how I did. Of course its about to avoid first installations but without breaking the setup process.)

e) Flash the new firmware to the device, replacing system and vendor.img by the modified files :

The modified files shouldn't be bigger than the original ones, at least not bigger than their size stated (in Mb) in the k120.xml (system:1400,vendor:300) but there is no reason anyway as after my experience all added files will become "access denied". (Should they become bigger than that you will have to change these values in k120.xml and re-pac them (using spd research tool, that will update k120.xml) before using them again, otherwise the flashing will fail.)

So now, get ready for the flashing:

Un mount the back cover of your Wiko Sunny 3, remove for a few seconds the battery, then replace it.

Now, here is something I had to figure out myself because there isn't anywhere a clear description of it, and this is foundamental to be able to flash :

First thing to do is to launch your flashing software, choose the pac file if necessary and push the action button to get ready for the device's connection.

You can wait some time, while the app unpacks the included .pac file. (spd factory/research tools lets you choose your pac file, the one downloaded refers to it only through its .ini file).

So pushing the "start flashing" still nothing happens, the flashing app (unpacks the pac file and) just waits for the devive to connect... This can last forever, don't worry.

Now, to be able to connect de device in service/flashing mode, it should NOT go into charging mode when you connect it.

Thats why, you have to connect the (computer) USB slot by pressing continuosly volume up on the device (after havig removed and reinserted the battery) AND wait until the app detects it and starts the transfer. Do not release the volume-up until it gets at least 3-4%. (Many guides speak about 3 sec or so, the only thing accurate is that the app starts effectively the transfer.) If you release it too quick, the phone goes into charging mode and the COM port used to flash closes, and you will need to repeat the operation.

(And of course you need all required drivers loaded previously. The driver for flashing is called SPRD or SPD Driver R4.20.4201: seems the latest)

If successful, the device gets rebooted.

---------

Here I'd like to ask some pros of XDA : what signal boots the device after flashing? Can it be reproduced without flashing? In other words, can we start/boot an extincted device by USB signal? If yes, how ?

---------

As the first-time setup launches, just decline/skip ewerything, most of all the final wiko/vendor offer (this keeps you safe from vendor commercial services). Just get to the home screen.

See what you have got.

f) Now, setup your anti big-tech privacy free environment. For example, deactivate google play including its service. (Yes, "big-tech haters" don't rely on this ;-)

To know where are the spies, I installed TrackerControl (version 2022.02.10 from F-droid) which gives enough info on that even without root. You will be surprised. There are "feedbacks" to google, to the vendor, and also to Microsoft, even without launching anything, just the wifi on. Even the caller app has trackers...

The best thing is that this (GPL) app lets you know what package causes the leak. You can just write them down, for later deletion.

It turns out, I could delete all of them (mainly from system.img, monted again on Linux) without that anything breaks.

I replaced the caller/dialer, calender, contact, everything, by new default apps. Replaced the Wiko launcher by the Fairphone launcher (from F-Droid).

I installed ungoogled chromium from https://github.com/wchen342/ungoogled-chromium-android/releases (chrome public). (Strangely could not install other browsers!). I replaced Google TTS by "eSpeak NG" (the final config is a little bit tough : have to download "espeak-ng-data" (voices) and push it to the "sdcard" then, slowly, it finds it and it works. (Well, ok, its not the fine google tts thats far the best actually, but its still a tts...) And yes, there is still the keyboard to tap keywords to look for. ;-)

g) When done, take and mount again the system.img file (you flashed) and take out what (following the list of tracker apps found by "TrackerControl", which are mainly (for me) : (for howto, see d) above)

/system/priv-app/phonesky // playstore : com.android.vending

/system/priv-app/GoogleDialerGo // contains trackers!

/system/priv-app/GmsCore // googleplayservices (yes it works without it)

/system/priv-app/WIKOSetupWizard

/system/priv-app/WIKOLauncher // easyly replaced (by Fairphone's 1/2/3)

/system/priv-app/WIKOInstaller

/system/priv-app/AppCloud // wiko appstarter (77 trackers)

/system/priv-app/SearchSpeachService // (google) tracker by definition

/system/priv-app/AntitheftPlugin

can be removed as well (and still some others, but its more wise to stop here, till it still works ;-)

NB : The 3 "Vital-app", probably commercial boudles, must be really present but they can be uninstalled cleanly (weather, smart-assistance, gaming).

Finally, enjoy your non-rooted, but privacy tuned Wiko Sunny 3, and install clean FOSS apps from F-Droid (or from elswhere).

One more thing: Its not because an app is "free and open source" that it won't track you : choose your apps carefully, observing all permissions they ask for.

For example, there isn't much acceptable explanation for a calculator to claim "full network access" or a game to be "launched at startup" or get "system configuration" rights.

And sadly, as we still do not have root access on this device, there isn't much control available on apps, permissions, network or system. But it is possible now to free it from big-tech trackers, as much as possible.

Of course, as usually in these cases, I cannot guarantie anything. It just worked for me like that (reproduced several times), and I think there is no reason that for anybody else it would produce a differet outcome.

Your comments are allways welcome.