[Samsung Galaxy S10 Guides, News, & Discussion] ned14:
Two years after my previous guide for Android 10, this is Niall's modernised guide to reconfiguring stock Samsung S10 Android 11 into a privacy focused MicroG based system purged of the stock spyware and annoying and useless stuff, but with the actually useful Samsung Apps such as Camera, and VoLTE remaining fully functional. Don't get me wrong here, LineageOS on the S10 is better in all ways especially in regular security updates, but the current LineageOS camera experience just can't compete with Samsung's deep integration of camera software and hardware. I therefore reluctantly offer this guide as a stopgap until LineageOS gets a better Samsung camera experience.

NOTE: The previous version of this guide for Samsung S10 Android 10 can be found at https://xdaforums.com/t/samsung-sto...sed-privacy-reconfigure-step-by-step.4174691/. Before anyone asks, no I don't have a guide for Android 12, nor do I expect to make one for at least a year from now (I trail major Android releases, I don't lead them, it's too much work!)

After completing this guide, you will have only these apps left installed visibly in the launcher:

Aurora Services and Aurora Store (to replace Play Store)

Brave privacy web browser + Bromite privacy web view

Samsung Calendar

Samsung Camera

Samsung Clock

Samsung Contacts

F-Droid

Samsung Gallery

Magisk Manager (root, customisations etc)

Google Maps (retained only due to its great usefulness for public transport)

Samsung Messages (for text messages)

microG Settings

NextDNS to prevent even more personal data leakage (and optionally ads)

Samsung My Files

OsmAnd (for offline navigation)

Samsung Phone

Samsung Settings

Samsung Launcher and its Recent Apps switcher, as with a bit of reconfiguring it's not too bad actually.

Upon each boot you can choose whether you will have root via Magisk by booting your phone with the correct buttons pressed (Volume Up + Bixby + Power, but released after the boot screen). There is no need to run with root available, per boot, unless you want it. This makes my solution markedly superior in my opinion to the more popular Magisk + Zygisk + LSposed + FakeGapps MicroG approach which relies on injecting code into every app you run, which in turn requires you to always boot with root enabled. Personally speaking, I am also not comfortable with injecting code into my banking apps etc.

The principle things removed from stock are:

Samsung AR stuff

Samsung Bixby (apart from QR codes and Routines which are useful)

Google Chrome (it keeps hanging and stalling if used with MicroG, and besides it leaks your browsing habits)

Google GMail

Facebook (all traces)

Google YouTube (you ought to use NewPipe from F-Droid instead)

Samsung App store

Samsung Games home app

Microsoft OneDrive

Samsung Tips

Samsung DexOnPC (it spams you with messages)

Samsung EasySetup (also spams you with messages)

Samsung Edge Panel (the swipey translucent tab which floats above at the top right and gets in the way of taps)

Google Play Store

Google Accounts

Google Services

Note that this is NOT a deep "debloat", I only removed the bits you can see, which make themselves noticeable, or stuff known to leak your information to others. I left everything else alone, even if on most common "debloat" lists for the S10.

I also didn't remove ALL of the annoying popup notification Samsung stuff in this guide, unlike for my Android 10 guide. This is because removing all of it breaks the Samsung TouchWiz launcher which my Android 10 guide completely replaced. Besides, Android 11 is good at letting you suppress annoying notifications caused by things really wanting you to activate them e.g. "Find my Mobile", which requires a Samsung account.

This guide uses Nanodroid, which has a reputation for installing lots of stuff you don't want, which puts a lot of people off using it. As of recently, Nanodroid now offers small, single purpose, packages which you individually combine to get what you want. So no more random ringtones nor backdrops being installed that you don't want!

You should be warned that this conversion leaves your device insecure. OTA updates from Samsung self disable as soon as you modify any system image, so you'll need to manually go retrieve new firmwares and repeat the below instructions (obviously flashing HOME_CSC instead of CSC to not factory reset the device) to stay secure.

Privacy achieved limitations (so you know what we can't keep private)

As with any device with a mobile (cellular) connection, as soon as you see a mobile phone (cell) signal, your position is exposed as they can track you by IMEI. Outside the EU, your historical, and sometimes current, location data is routinely sold for money by your provider to commercial third parties. Within the EU, your mobile provider is not supposed to expose your location to anyone but law enforcement without your explicit permission, but some providers are still catching up with GDPR and still relying on implicit permission buried deep inside EULA text. In any case, as soon as you see a mobile phone tower with your phone you have declared your position, and only airplane mode prevents that. This is unavoidable no matter how you configure any device capable of interacting with mobile phone masts.

Google Maps obviously leaks your location and movements to Google as soon as you open it, so you should prefer to use OsmAnd for offline maps and navigation whenever possible. Equally only Google Maps can route over public transport, knows when buses will arrive etc, so that's why I've kept it. Use judiciously!

MicroG needs to register with Google for push notifications, otherwise stuff like WhatsApp doesn't work. MicroG leaks as little information about you as it can, but ultimately Google can see from where you register including if by wifi alone, and thus determine your coarse location. You may wish to consider a VPN if you wish to obscure your physical location.

As much as you may secure your phone, individual apps you install may leak a great deal about you. For example most apps for tracking ovulation and when you have sex sell your personally identifying data and when you do it to others for money. You personally may not install such apps, but if anyone enters your private information into any phone, then your information is leaked. That information is composed into commercial databases which record everything about everyone. Is this paranoid? Note I said commercial databases. Most western governments are prohibited from mass survellience, so they simply buy the data from private firms which aggregate everything there is to know electronically about you. Amongst the many companies providing such service are Experian (you can request a dump of what they know about you, prepare to be disgusted) and Palantir (legislation hasn't caught up with them yet).

Finally, even if you are always in airplane mode, and all your friends and loved ones are as aware of personal data leakage as you are, ultimately this is a losing fight. Every time a CCTV camera facial recognises you, every time a satellite tracks your car, it's all being aggregated into databases about everyone, and more importantly, whom everyone has relations with. Even the device-less person is recorded, studied, tracked, and inferred from by algorithms. There is only so much any of us can do.

Instructions

Preparation: go find APKs for the following:

Magisk Manager. Rename it to MagiskManager.apk.

You really ought to insert a micro sd card. It makes life vastly easier when wiping the device, and this guide assumes that you have inserted one.

Make sure your bootloader is unlocked and your device has been configured to accept unofficial binaries. You can find instructions for how to do this at https://topjohnwu.github.io/Magisk/install.html#samsung-system-as-root. You will need adb shell working with your device in Developer mode.

First install: In Odin, flash your choice of stock Android 11. Flash all parts, choosing CSC not HOME_CSC for the CSC slot in order to ensure a factory reset. Do NOT skip this complete reset to stock. Optional: Boot into stock firmware, enable wifi, and download and install any security updates available. Do NOT upgrade to One UI 4.0 or later (that is Android 12 or later, this guide is written for One UI 3.5/Android 11 only)

Upgrade: In Odin, flash your choice of stock Android 11. Flash all parts, choosing HOME_CSC not CSC for the CSC slot in order to prevent a factory reset. Do NOT let the device try to boot into the system, it will wipe your data!

You will need to reboot the downloader for the next step. Be aware that if you are upgrading and you mess this up even just once, all existing data will be wiped and you'll need to start again as if first install. With a USB cable connected to the computer, you need to hold volume Down, Bixby and Power to boot into Download. If it goes to screen dark and doesn't continue, try releasing Power.

Restart Odin, then flash AP slot with the TWRP TAR archive and the CP slot with the vbmeta.tar using images and instructions from https://xdaforums.com/t/recovery-official-3-6-0-x-twrp-for-galaxy-s10-e-5g-exynos.4180287/.

Boot into TWRP recovery using Volume Up + Bixby + Power On by holding them down until the recovery starts. This can take multiple attempts. It may be useful to know, if stuck on the first boot Samsung logo (you don't need to worry about interrupting first boot right now), that holding volume down and power button for long enough will force reboot the device.

First install: In TWRP format data. Do NOT skip this part. This removes Samsung's encryption of the internal sdcard so you can take backups of your data etc in TWRP.

Upgrade: Do NOT format data, for obvious reasons.

In TWRP install the multidisabler zip available from https://xdaforums.com/t/recovery-official-3-6-0-x-twrp-for-galaxy-s10-e-5g-exynos.4180287/.

Put into a file called .nanodroid-setup:

nanodroid_nlpbackend=1001
nanodroid_play=21
nanodroid_gsync=0

This custom .nanodroid-setup adds the install of the radiocells location backend (this uses a downloaded on-device database of mobile phone mast ids to locate you), and prevents the install of the Google Sync Adapters which prevents Google getting your contacts list and calendar.

In TWRP mount Product, System and Vendor.

Do the following from your PC with TWRP still running:

adb shell
rm /system_root/system/app/ARZone/ARZone.apk
rm /system_root/system/app/BixbyWakeup/BixbyWakeup.apk
rm /system_root/system/app/FBAppManager_NS/FBAppManager_NS.apk
rm /system_root/system/app/Facebook_stub/Facebook_stub.apk
rm /system_root/system/app/YouTube/YouTube.apk
rm /system_root/system/priv-app/Bixby/Bixby.apk
rm /system_root/system/priv-app/BixbyAgentStub/BixbyAgentStub.apk
rm /system_root/system/priv-app/BixbyService/BixbyService.apk
rm /system_root/system/priv-app/GalaxyAppsWidget_Phone_Dream/GalaxyAppsWidget_Phone_Dream.apk
rm /system_root/system/priv-app/GalaxyApps_OPEN/GalaxyApps_OPEN.apk
rm /system_root/system/priv-app/GameHome/GameHome.apk
rm /system_root/system/priv-app/FBInstaller_NS/FBInstaller_NS.apk
rm /system_root/system/priv-app/FBServices/FBServices.apk
rm /system_root/system/priv-app/EasySetup/EasySetup.apk
rm /system_root/system/priv-app/OneDrive_Samsung_v3/OneDrive_Samsung_v3.apk
rm /system_root/system/priv-app/Tips/Tips.apk # stupid Samsung Tips popups
rm /system_root/system/priv-app/DeXonPC/DeXonPC.apk
rm /system_root/system/priv-app/CocktailBarService_v3.2/CocktailBarService_v3.2.apk # Edge panel top right floats

rm /system_root/system/app/Chrome/Chrome.apk
rm /system_root/system/app/ChromeCustomizations/ChromeCustomizations.apk
rm /system_root/system/app/Gmail2/Gmail2.apk
rm /system_root/system/app/GoogleCalendarSyncAdapter/GoogleCalendarSyncAdapter.apk
rm /system_root/system/app/GoogleContactsSyncAdapter/GoogleContactsSyncAdapter.apk
rm /system_root/system/app/GoogleLocationHistory/GoogleLocationHistory.apk
rm /system_root/system/system_ext/priv-app/SetupWizard/SetupWizard.apk # Without removal never passes initial setup

# New annoying popping up stuff in Android 11
rm /system/priv-app/ConfigUpdater/ConfigUpdater.apk
rm /system/priv-app/KnoxPushManager/KnoxPushManager.apk
rm /system/priv-app/SamsungAccount/SamsungAccount.apk
rm /system/priv-app/SPPPushClient/SPPPushClient.apk

# Stuff replaced by MicroG
rm /system_root/system/priv-app/GmsCore/GmsCore.apk
rm /system_root/system/system_ext/priv-app/GoogleServicesFramework/GoogleServicesFramework.apk
rm /system_root/system/priv-app/Phonesky/Phonesky.apk
rm /system_root/system/priv-app/Velvet/Velvet.apk
exit
adb push .nanodroid-setup /sdcard/

All the removed apps free up enough space on the priv-app partition to install the Nanodroid apps coming next, so the above step isn't really avoidable. You also need to repeat it after any firmware upgrade.

(Incidentally, if you want to figure out what other apks to prevent being installed on first boot, once installed from adb shell do

pm list packages -f

and it will print all installed apks and the path from where they came. If that isn't enough to track a bloatware package down,

adb shell dumpsys package packages > all_package_info.txt

will give you a searchable text file of detailed information)

In TWRP install exactly these individual packages from https://gitlab.com/Nanolx/NanoDroid:

NanoDroid-BromiteWebView-23.1.2.20210117.zip

NanoDroid-fdroid-23.1.2.20210117.zip

NanoDroid-microG-23.1.2.20210117.zip

NanoDroid-OsmAnd-23.1.2.20210117.zip

(Later, but not earlier, versions will probably work fine too)

Try installing in TWRP NanoDroid-patcher-XXX.zip. If it works (the 23.1.2.20210117 version did not for me), great. If it doesn't, you'll need to manuall do the patching, see below for how to do that.

Reboot into System. It will get stuck on the Samsung boot logo for a while, but will eventually open onto either the enter Samsung account stage of setup, or the Setup All Done stage (we earlier removed all the earlier parts of setup). Hit Skip and/or Finish to reach the Launcher. Enable wifi and connect to your wifi connection.

Enable Developer Mode by entering Settings => About Phone => Software Information then tap the Build Number ten times. In Developer options, enable USB debugging and authorise your PC via USB cable.

If NanoDroid-patcher failed to work earlier, we need to do the patch by hand via root. Install MagiskManager.apk using

adb install MagiskManager.apk

. Extract the TWRP recovery.img from the TAR file and copy it to the sdcard, then open Magisk Manager with a wifi connection active. Choose install. Then choose Select and Patch file. Patch the TWRP img previously copied. Magisk Manager will output a root patched img into Downloads. Copy that back to the PC. Make a new TAR file of that. Flash that in Odin in the AP slot. Boot the device using Volume Up + Bixby + Power, but release as soon as the bootloader warning screen appears, so you boot into the system with root enabled. Go back into Magisk Manager, ensure Magisk appears as installed. If not, reboot and again try the key combination until it works. If in the future root ever appears to have got lost or isn't working, check the Magisk Manager, you probably forgot to hold the right keys during boot.

In Magisk Manager, choose the Modules tab, then Install from Storage. Copy in NanoDroid-patcher-23.1.2.20210117.zip to the device again. Let Magisk install it, it will appear to work, but in fact on your next reboot your device will never start again. Before that happens, copy the patched services.jar out to your PC:

adb shell
su # magisk will prompt to allow
cp /data/adb/modules/NanoDroid_Patcher/system/framework/* /sdcard/
exit
exit
adb pull /sdcard/org.spoofing.apk

Start again from the top of this guide i.e. reinstall stock, TWRP (but this time flash the rooted patched edition). Once into TWRP format data, mount Product, System and Vendor. Copy out the services.jar file to your PC:

adb pull /system_root/system/framework/services.jar

Get the Android 11 patch files from https://xdaforums.com/t/signature-spoofing-on-unsuported-android-11-r-roms.4214143/ and execute:

java -jar dexpatcher-1.8.0-beta1.jar -a 11 -M -v -d -o ./ services.jar haystack-11-attempt\11-hook-services.jar.dex haystack-11-attempt\11core-services.jar.dex

Open the original services.jar in WinRAR and drag in the newly generated classes.dex, classes2.dex, classes3.dex, classes4.dex, replacing the three classes files in there. Your patched services.jar file will now be half the size, for some reason the original one was created without ZIP compression. It doesn't matter, adb push your patched files:

adb push services.jar /system_root/system/framework/
adb push org.spoofing.apk /system_root/system/framework/

Reboot into system, remembering holding down the keys to enable root for this boot, and reinstall Magisk Manager again.

Once back into the device, open the microG settings app. Run the Self-Check, the "System grants signature spoofing" will be unticked. Tap it, grant permission. The item "Play Store (Phonesky) has correct signature" will also be unticked. Tap that, grant permission. Now the self check should report everything is working and having correct signature. Signature spoofing should be working.

Within MicroG settings, enable Google device registration, cloud messaging and safety net. If you don't enable these, any applications you install next will never receive notifications, ever. Enter location modules. Enable Deja Vu, Radiocells and Nominatim backends. The Deja Vu backend doesn't need configuring, it simply records Wifi and mobile phone mast data and your GPS location when available, and builds a database matching wifi and mast data to GPS. Next tap the Radiocells entry, then Configure, then download offline catalog now, choose your country, then choose offline mode. Now your phone can locate itself purely using an offline database of phone masts and wifi. Next tap the Nominatum entry, then Configure, then choose Nominatum API server, and then OSM.

Open OsmAnd~ the app, choose your country, and download your offline map so you can navigate without an internet connection. Open the app, ensure navigation is working.

Enable and enter Developer options in the settings, open the WebView implementation, and set it to Bromite System WebView.

Go to https://nextdns.io/ and create yourself an account and unique id. From Aurora Store, find and install the NextDNS app. Configure the app with the id you got from your account on the website, and tell it to send your device's name. NextDNS acts as if a VPN for your Android device and thus all internet traffic routes through it, but it blackholes DNS lookup for a configurable list of items in your NextDNS account. Via this, you can block a long list of leakage of your personal information, and also optionally block ads on your device. If you log into nextdns.io from time to time, you will no doubt be fairly saddened by how much of your data is attempted to be leaked all the time.

From Aurora Store, find and install the Brave privacy web browser. As we removed Chrome due to it not working well with this modified system (it keeps stalling), you will need a new system web browser in any case and out of the box, Brave blocks all adverts and tracking. If you enter its settings, you can also disable Javascript by default (only enable it per site on a case by case basis, you can enable temporarily per site, or store an exception). Be aware that if you don't enable Brave rewards, the Brave authors silently pocket any BAT tokens your web browsing earns, so you may wish to enable Brave rewards for the very tiny income generated by your attention if you leave Brave ads disabled (it is local browser only, nothing gets enabled online, BAT tokens are conferred by crypto exchange so none of your browsing gets leaked). Personally speaking, I'm quite keen on the idea of me getting paid personally to see adverts as none of my personal browsing history leaves the Brave browser, even if it's pennies a month, so I leave that stuff turned on.

Brave defaults to regularly pinging you with Android notifications with Ads, which is very annoying, but deep inside the Brave settings you can specifically disable Ads notifications completely.

Settings

You probably want a decent set of settings rather than iterating through the Settings app. These are mine obviously, so you can skip these or not. With Developer Mode enabled, do the following:

adb shell
settings put global display_size_forced 1440,3040
settings put global navigationbar_key_order 1

settings put secure default_display_density_forced 560
settings put secure display_density_forced 560
settings put secure default_display_size_forced 1440,3040
settings put secure package_verifier_state 1
settings put secure screensaver_components
settings put secure selected_input_method_subtype 65538
settings put secure ui_night_mode 2

settings put system hdr_effect 1
settings put system display_night_theme_wallpaper 1
settings put system screen_off_timeout 300000
settings put system aod_servicebox_page_gravity 17
settings put system aod_show_state 1
settings put system aod_tap_to_show_mode 0
settings put system display_night_theme 1
settings put system hearing_diagnosis 1
settings put system hearing_direction 0
settings put system hearing_musiccheck 0
settings put system hearing_parameters 5,5,5,5,5,5,5,5,5,5,5,5
settings put system hearing_revision 0
settings put system hearing_videocheck 0
settings put system lock_clock_adaptive_colors 'fffaeecd;ffd9faeb;fffae7b4;ffc0fae0'
settings put system qs_detail_content_primary_text_color -2500135
settings put system qs_detail_content_secondary_text_color -1710619
settings put system remote_control 0

This is mainly how I like my settings. I want the actual resolution of my fancy device, not some subset (why bother buying a device with better otherwise?). I want dark theming to take advantage of power saving in my fancy AMOLED screen.

Swype keyboard

Enter Settings, General Management, Samsung Keyboard settings, and then Swipe, Keyboard swipe controls. Enable Swipe to type.

Firmware upgrades

To apply future firmware upgrades, you will need to acquire the latest Samsung firmware for your device from a reputable source. You almost certainly want to take a full backup in Titanium Backup, and copy that backup onto an external sd card to be safe. During flashing in Odin, flash the HOME_CSC, not the CSC, image into the CSC slot. This should preserve all your settings and installed applications. Disable auto rebooting in the Odin options. Then when the flash is done, manually reboot into Download, then repeat all the steps above.

If you do it right, you'll reboot into your device just as you left it, just with all the components upgraded to latest. If you screwed up, that Titanium Backup you made will be very useful.

Not that I'd recommend running out of date firmware images, but I would say that by far the most common upgrade you'll need to do is latest MicroG because Google bumped the minimum version of Play Services its apps will accept, so for example Google Maps will barf about Play Services being too old. There is a very simple fix for this: don't upgrade Google apps! An older Google Maps works just fine even if it's many months old.

Credits

What this guide achieves wouldn't have been possible without the following hard work from many people creating the components I have reused:

topjohnwu

ianmacd

Christopher Roy Bratusek

RandomAJL

mar-v-in

Whomever makes available Samsung Odin and the other stuff which makes LineageOS and AOSP become ever better for the S10 devices.