[Oppo Find X6 / X6 Pro] Xynon:
Hi all,

In light of the new bootloader unlock thread for the find x6 pro, I supposed I should finally get off my ass and write this guide.

If we had an X6P device forum, I'd rather post it there. But we don't, so I'll post it here like most of the other X6P posts.

This tutorial aims to completely remove ALL traces of chinese apps, spyware, default launcher, etc from the CN01 (COS 13.1) firmware with a focus on f-droid/FOSS.

This tutorial is also written from memory, so certain areas may be missing key details (this guide is not complete). Follow at your own risk.

I AM NOT RESPONSIBLE FOR ANY DAMAGE TO YOUR PHONE. WHEN FOLLOWING THIS GUIDE, USE YOUR HEAD AND DO NOT COPY AND PASTE BLINDLY, THE SOFTWARE ON THIS PHONE IS FRAGILE.

INSTALL A BOOTLOOP SAVER, IT MAY SAVE YOUR ASS AT ONE POINT.

STEP 1 - unlock/root:

My globalization was performed back in October, so the free way of unlocking this BL was not available yet.

There are two ways to unlock this phone,

1: PAID

I used a paid unlocking service via telegram, the username is {Mod edit: Reference to paid service removed. Oswald Boelcke, Senior Moderator}.

They take you all the way to having a reset phone with magisk / ofox recovery.

(discovered via {Mod edit: Reference to paid service removed. Oswald Boelcke, Senior Moderator}

2: FREE

use this tool here (I have not tried this method):

[Guide] Unlock bootloader, TWRP and Root Find x6 Pro

With the permission of the Chinese friend who created this tool, I would like to share it with you. Everything in this tool is in Chinese, you can translate it yourself using tools on the Internet. I don't have time or experience with this tool...

xdaforums.com

if you do decide to do this method, please note that some folders may need to be renamed as the chinese folder names are not decoded properly on an english install of windows.

STEP 2 - debloat:

uninstall everything that can be uninstalled by hand (user apps).

sideload droidify (fdroid client) via adb.

install app manager.

use UAD to debloat as much as possible via the attached list (121 apps).

Some apps cannot be debloated from adb (namely app market), due to oppo modifications. These must be removed via app manager in root mode, using the "uninstall" function, which operates on a root level and therefore bypasses adb.

It is important to note that this list will remove apps that do not have an inbuilt replacement and must manually be installed via droidify or aurora store. This is a labor intensive process.

STEP 3 - magisk:

Certain issues arise when using this phone normally that can only be solved via magisk modules.

notably:

1. 60fps lock in non-whitelisted apps

2. "smallest width" settings in developer options do not survive reboots

3. game-touch sampling not enabled by default

4. engineermode e.g. *#*#5646#*#* (LTE settings) is rejected via denylist

5. OPPO package manager is sketchy AF

1. To fix, set the refresh rate mode in Settings > Display & brightness > Screen refresh rate to high,

then flash the coloros_hz magisk module from attached,

then flash dfps from the linked repo.

modify /storage/emulated/0/Android/yc/dfps/dfps.txt to:

```

/ touchSlackMs 2000

/enableMinBrightness 1

/useSfBackdoor 0

com.miHoYo.Yuanshen 60 60

com.hypergryph.arknights 60 60

--1 -1

* 60 1

```

this works by forcing the peak_refresh_rate setting to 1, which breaks the variable refresh rate and locks it to 120hz.

DFPS then takes over to automatically switch between settings of 60 and 1 (120hz).

2. To fix, flash coloros_wm_dpi from attached.

This will loosen the smallest width from 360 to 380 in 1080P mode, making this a bit smaller (this is a big phone!).

If you want to change the size yourself, modify the module.

3. To fix, flash coloros_sampling_hz from attached.

This will jack up the touch sampling mode via the touchpanel switch permanently - it may lead to heavier battery use so you may not need this one.

4. To fix, flash the engineerunlocker module from attached.

This will overwrite the denylist for dialer codes, unlocking them.

A catch however is that the codes only work in certain dialer apps, namely non-FOSS ones, so simple dialer and koler will not allow the use of these codes. To use these codes, you have to install Google Phone from aurora store (confirmed working).

5. To fix, flash the los_pk module from attached, then reboot and install the OppoPackageInstaller.apk inside the module again.

OPPO's package manager is reinstalled every time on bootup, disallowing traditional override attempts such as updating the app, as it gets replaced the next reboot. This module reinstalls the LOS package manager on top of OPPO's one every reboot.

A catch however is that LSposed with Core Patch may be required, as signatures of the two packages are different and may not allow updating (untested as I use Core Patch).

STEP 4 - going deeper:

Certain things such as google services and webview may want to be replaced with more privacy-respecting alternatives.

You may use the systemless_debloater module in attached in combination with the nift4 microG installer and open webview modules to replace these.

IF YOU DECIDE TO DO THIS, YOU MUST USE ALL 3 OR MODIFY THE SYSTEMLESS_DEBLOATER MODULE OR ELSE YOU WILL BREAK SOMETHING.

To do this, first use app manager to uninstall all updates for GmsCore, GsfProxy, and Play Store (very important).

install all 3 modules, along with LSposed and FakeGapps (needed for sig spoof), before rebooting.

STEP 5 - customizations (custom launcher & material colors):

The ColorOS default launcher is hardcoded to be the only launcher available. This may be changed via ADB and set-home-activity, however, the default launcher's app switcher is hardcoded to open itself whenever it exits the app switcher. Disabling the launcher only removes the app switcher functionality (which is really bad since it practically breaks all use of the phone).

To fix this, we must replace all traces of the ColorOS launcher with alternatives.

First, install a custom launcher - I use kvaesitso.

Second, set it to the default launcher via adb / set-home-activity.

An example command is

```

pm set-home-activity de.mm20.launcher2.release/de.mm20.launcher2.ui.LauncherActivity

```

This command sets the home launcher activity to the main activity of kvaesitso. If you want to use your own launcher, use app manager to find the correct path to the main activity of that launcher and modify the command above.

At this point, you may be stuck in a weird state where whenever you exit the app switcher, the two launchers cycle between one another. This is expected, and will be fixed by the following step.

Third, flash the pixel launcher quickswitch module, along with the quickswitch module.

Fourth, use hail, app manager, or adb to disable (DO NOT UNINSTALL) the ColorOS default launcher.

This is required to stop the default launcher from taking over the app switcher functionality. Doing so however will remove Settings > Lock screen & Home screen, so unfreeze & refreeze when it is necessary to change those options.

You may also disable the clock if you have a FOSS alternative - uninstalling is not recommended as it breaks the time settings in Settings > Additional settings > Date & time.

To gain material colors, you may install the Material You Monet for OxygenOS 13.1 from PavlovaUI telegram.

For more customization (highly recommended), install the PUI for OxygenOS 13.1 from PavlovaUI telegram.

STEP 6 - gcam:

It's no surprise that those buying this phone are doing so for the cameras.

GCAM has been reported to be not working by folks on this phone, however, that is just plain wrong.

OPPO decided to make ID 0/1/5 cameras software/logical cameras, while ID 2 (wide), ID 3 (ultrawide), ID 4 (telephoto) are the hardware cameras. These IDs must be set manually in gcam or the camera viewfinder will be black, or the app will just crash when trying to take a photo.

I recommend LMC or UltraCVM - LMC has better software and is stable while UCVM takes better pictures.

you must pick the com.ss.android.ugc.aweme package name version (chinese tiktok package id), as the aux cameras are masked to any other package name.

to be continued...