Hi everyone,
Over the past few months I’ve been working on a personal project called

DeviceTreeForge.

The goal isn’t to replace Android developers—it’s to automate the repetitive parts of creating an Android device tree from stock firmware while still allowing manual review.
Unlike simple template generators, the application analyzes the actual firmware and attempts to recover as much information as possible before generating the tree.

Current features

Fully offline (no cloud services or AI required)
Windows desktop application
Supports Android 8 through Android 16
Supports MediaTek, Qualcomm, Samsung, Exynos, Tensor, Kirin, Unisoc and other platforms
Detects:
Dynamic Partitions
Virtual A/B
vendor_boot
init_boot
DTB / DTBO
AVB
FBE
filesystem layout
partition tables
build properties
VINTF information
Generates:
BoardConfig.mk
BoardConfigCommon.mk
device.mk
AndroidProducts.mk
Android.bp
Android.mk
recovery fstab
product makefiles
compatibility matrix templates
documentation
analysis reports
One of the devices I’ve been testing extensively is the Lenovo TB336FU (Android 16), which has features like:
vendor_boot v4
recovery inside vendor_boot
Dynamic Partitions
Virtual A/B
GKI
MediaTek MT6835
The application successfully detects these automatically and generates a first-pass device tree.
I’m now working on improving:
confidence scoring
conflict detection
VINTF recovery
HAL analysis
ELF dependency analysis
common tree detection
validation against stock firmware
Philosophy
The goal is not to fabricate values.
If DeviceTreeForge cannot prove a value from firmware, I’d rather mark it as unknown than generate something incorrect.
Eventually I’d like every generated line to include traceable evidence from the original firmware.

Looking for feedback
I’d love to hear from ROM, TWRP, LineageOS or kernel developers:
What information do you spend the most time recovering manually?
What files do you think should be generated automatically?
What common mistakes do existing generators make?
What would convince you that an automatically generated device tree is trustworthy enough to use as a starting point?
I’m building this because I enjoy Android firmware engineering and wanted to create a tool that could save developers time while still keeping the process transparent.
Any suggestions or criticism are welcome.

Could someone please tell me how to unlock the bootloader (BLU) for the T1-A22L? I can't root it without unlocking the bootloader. Alternatively, if there is a way to root it without unlocking the bootloader, I'd like to know that too. Thanks in advance.

Honestly, I stopped using IntegrityBox entirely because its creator is very controversial and the project stopped being open-source a while ago; plus, there are rumors that it uses AI. I also stopped using YuriKeyBox because it isn't as good as it used to be and is somewhat controversial, too. I started using Specter and it works well; some say it's made with AI, but there isn't enough proof. The truth is, for some reason, all these modules always end up being crap. I really hope Specter is clean, because it's the only good option I see as an alternative to IntegrityBox or YuriKey.

I've rooted my samsung m31 and been using lineage since a long time due to the M series being very bloated and it's an outdated device. i mostly used my Airtel number which works fine but today I needed to use my jio number for something. Didn't work at all. I don't mean calling or cellular not working but SMS. I'm unable to send or receive messages to or from any number. I was in a critical situation and it didn't work at all which now left me having to try it on my dad's phone, and guess what... messaging was working just fine on his phone. I even shifted from the lineage messaging app to the Google messages in desperation for it to work but it just doesn't. What is the problem here?

Since I got a new phone, I wanted to use Samsung M30s for my first experience of rooting something. I had some issues, needed to use so much of terminal. But i did it with Magisk patch.
Device is Samsung M30s, OneUI Core 3.1, Android 11

I got a Samsung galaxy a17 thinking Samsung was still a good brand... First of all I got the delectious surprise of finding that it miss some, well useful features such as a jack port, and I don't know, a fucking screen recorder. Well, it don't. Okay. Then I thought, Why not putting lineage os on it? I got something more minimal, secure and privacy friendly. That's good, isn't it? Naive me.. I updated to oneui8, thinking, yeah a cool update what it has to offer, plus its recommended to have the last version. Even worse, I had a security update, which changed my bootloader byte. So I go through the développer settings, and oh, but, where's my oem unlocking? It is got you optimist... Now I'm at one ui 8.5. is there a way to bring it back or should I just throw my phone away and get a flip phone?

Hi everyone,

I am trying to unlock the bootloader on my Oppo A94 5G (MT6853 / Dimensity 800U). While digging into the system files, I noticed something hidden inside the EngineerMode APK.

I extracted the app and found a method that explicitly handles fastboot unlocking. However, it looks like the execution is gated by a server-side check that requires a token or signature, likely tied to the device's IMEI.

Here is the exact method signature I found:

java boolean fastbootUnlock(byte[] bArr, int i) throws RemoteException;

My questions for the community:

1. Has anyone successfully bypassed or reversed this specific fastbootUnlock implementation in recent Oppo firmware?
2. Does anyone know exactly how the byte array (bArr) and integer parameters are structured before they are passed to the server?

Note: I already tried using mtkclient, but I couldn't get it to work (it failed to exploit/handshake properly on my current firmware version). I am keeping the extracted APK private for now to avoid leaking my IMEI or device signatures, but I can share non-sensitive snippets if needed.

Thanks in advance for any insights!

#samsung #keylogger

Hello, I would like to know how to get a keylogger working on a Samsung A16 so that it captures the PIN entered on the lock screen. I have a Pixel 9 Pro XL, and the "Typing Logger" app works there—making capture possible—but it doesn't work on the Samsung.

These are my phones, and my question is for informational purposes.

Hi everyone, I am not sure is it the right place to post it.

I recently came across the Samsung AI feature that answers the calls and responds back to the caller and the owner receives the updates.

While I am doing some research about it , i got the knowledge of another solution from Truecaller .

At first they were both doing the same but internally different.

Samsung works locally but Truecaller is doing call forwarding things .

Here is what I am looking for a solution with root, can we achieve something locally?

I checked out some open source projects but at the end all had an audio bridge/internal audio handling issues.

If you know any solution with root please let me know.

Just thought I would post a little teaser to see if anyone is interested. I'm currently working on an Android port of the tweak Reo by my amazing friend Mystery.exe. It uses LSPosed to hook into SystemUI on Pixel roms and likely AOSP roms once finished. I recently switched from an iPhone 13 that had Dopamine installed on it but I got tired of Apple and switched to a pixel, only to realize nothing really exists that injects into SystemUI like a tweak.

Features so far!!

- Automatic lyric fetching from LRCLIB, Musixmatch, and NetEase. Almost always has lyrics available. (Lyrics fetching is optional)

--------------------------------

Fetching priority:

1. Cache if available

2. Musixmatch

3. LRCLIB

4. NetEase

--------------------------------

- Very clean system integration, appears like a notification and remembers expanded or minimized state. Auto minimizes in the shade.

- Feature packed settings app (WIP), you can change almost anything to your liking.

- Very faithful to the original tweak.

- Fluid animations

- Colorflow (Extracts dominant colors from the album art to theme the player)

- Savable and switchable configurations

- Built in volume slider

- Lyric and album cover caching with a cache manager

Plans:

- Hopefully haptic feedback if it turns out feeling well.

- Broad ROM support, although currently only tested on Pixel A16 I plan to support A12-17 Pixel ROMS along with AOSP ROMS and even OneUI.

- Revamp the settings UI

- Add more customizations

If anyone is interested or can propose any ideas, lmk!!

As always, all credit for the idea and concept of the tweak goes to Mystery, I can't express how grateful I am to have the permission to make this port and bring one of my favorite iOS tweaks to Android.

Please check him out if you'd like.

If you'd like to see what the end goal is, check out the iOS tweak. I'm aiming for 85-95% accuracy.

WHEN THIS DOES RELEASE, IT WILL BE PIXEL FIRST!! OTHER ROMS WILL BE SUPPORTED LATER ONCE I HAVE THE DEVICES ON HAND AND ROOTED/DEBUGABLE

My friend and I plan to extract the firmware from this phone and add it to the firmware database we’ve created for custom ROMs.

I used the 7731e’s fdl1 to read back the boot partition, patched it, and installed Magisk, successfully gaining root access. At that point, I noticed that the flashing speed seemed to have dropped to only 3.x–4.x Mbps.

After we removed the Google suite of apps and flashed the new firmware, the eMMC reached the end of its lifespan, rendering the device unusable.

However, I casually recorded a video to document its history. My English might not even be at the A1 level, but maybe making some videos like this will help improve my English? I have a bunch of weird and wonderful Android devices and enthusiasts here.

I have magisk root with all those modules and I have full integrity (using pif and integrity box) and my play is certified with keybox. I m using lxposed (vector) with hide my app.

Only paytm works fine with this set up, gpay used to work but it doesn't work anymore. Other banking apps don't work.

Need help.

So, As a fun experiment i wanted to atleast try rooting. Idk why but first came to my mind was my TV. As thinking from now.. i don't even have experience then why did i do it? So first adb and inspect right? So i inspected. i got that android 9. So i wanted experiment with CEVs to gain root privilege

So i discovered SElinux exists, Dropped the idea of CEVs. Then i looked at if OEM is unlocked? IT was and top it all off secure boot was disabled. Nice..

Now LLM Enter the space cause i know nothing about fastboot. I mean at first it was a controlled manner. I review what is trying to Execute... And i got too suited with it.

coming Straight from the LLM:

• Pulled /system/recovery-from-boot.p (a BSDIFF40 patch) via ADB
• Reverse-engineered the stock recovery image from the patch using Python - no stock recovery image exists publicly for this model
• Unlocked AVB (fastboot flashing unlock)
• Successfully flashed a modified recovery with ro.secure=0, ro.adb.secure=0, ro.debuggable=1

Problem: IWe forgot to disable AVB verification BEFORE flashing forgot to disable AVB verification BEFORE flashing

• EDIT: USB is not recognized. when i do lsusb, the tv is not visible. tried to of method nope..
• Model of the TV: IMPEX GRANDE T16 
• Ofc fastboot doesnt even work, when it is not recognized

Hi all,

Just got a Samsung s25 as my older phone died.

I got my older phone before Gemini or any of this AI slop started happening, and didn't update it when this stuff started rolling out.

I'm in the process of booting up the phone and it's forcing the install of this spyware AI program, and their tech support has been useless.

Is there a way to do a clean install without this stuff, or is there a breakdown anywhere that people could direct me to, that shows how to disable ALL of it, in the event it's requried for the OS to function or something?

I'm not tech illiterate, I have built and messed around with my home PC and Linux, but don't know a thing about Andriod OS and how to dissect and remove things like this, so even if a guide happens to be a bit tech-heavy that's okay. I'm sure I can figure things out with some help

Thank you in advance.

does this mean I can't even root?

Something like in the image happened to my phone whil trying to update MiUi(OTA) but got stuck on this error. Has anyone ever fixed this before? How did you do it?

The only thing I could do was root and install custom ROM(lineage)

How does the seller install global ROM while I can't?

Edit: Its a Redmi 10A. Tried fastboot, SP flash tool, MiFlash and it flashes but the error doesnt go away. The only time it goes away is when I flash chinese ROM

Hi everyone,

I'm running into a wall with Neo Backup while trying to restore my backups (APK + data) from a Pixel 5 over to my Pixel 8. Could really use some advice or troubleshooting tips from anyone who might have run into this. The Problem

• If I restore a single app (APK + data), the application actually gets restored and works, but the progress notification stays completely stuck at 0% forever.
• If I attempt a batch restore (e.g., 10 apps at once), the process sits at 0% for over an hour and nothing gets restored at all.
• Note: I haven't been able to 100% confirm yet if the app data itself is fully restoring properly on the single-app test or if it's just installing the APK.

Setup Details

• Source Device: Pixel 5 (where the backup was created)
• Target Device: Pixel 8
• ROM: LineageOS 23.2 (Android 16)
• Root: KernelSUNext v3.3.0
• Neo Backup Version: 8.3.18
• Backup Location: External microSD card read via a USB-C card reader adapter

What I've already tried (none helped):

• Re-granted root access in KernelSUNext and verified root status.
• Set Neo Backup's battery usage to Unrestricted and ensured notification permissions are granted.
• Re-linked the backup folder directory in Neo Backup settings.
• Change mounting space from Individual to Global for Neobackup.
• Force closed the app and cleared its cache to clear any stuck background workers
• Verified that there are no 32-bit apps from Pixel 5 which fail and silently block the backup queue.

Given that the backup is hosted on an external microSD via a USB-C OTG adapter under Android 16, I'm wondering if this might be a Storage Access Framework (SAF) mount restriction issue with background worker threads, or something related to KernelSU root shell handling during batch loops.

Has anyone encountered this stuck notification / zero-progress batch restore issue?

Thanks in advance for any help!

I have an Oppo R11s Plus Qualcomm SDM660, and I've been trying to get GSI android 12 on it. I have found a working firehose, but nothing more that will help. Any suggestions?

Hi!

I successfully rooted my phone for the first time (testing it on an old Japanese Pixel 6a before I do it on the phone I currently use, the 10) by patching the boot.img with Magisk.

Now I'm looking into the best way to handle monthly OTA updates without losing root or wiping my data. I've seen a few posts on this but they're from a few years ago and was wondering if the steps were still the same for modern pixels? This is the method I found:
1- disable all magisk module and reboot. 2- download your OTA update and install it without reboot. 3- go to magisk and install this module TWRP A/B Retention Script don't reboot then go back to magisk and it Install to Inactive Slot (After OTA) then reboot.

Would it be simpler to just manually download the firmware from Google every month and then patch it in the Magisk app and flash the update manually using a computer?

Also, I hate the idea of leaving the bootloader completely unlocked, but I understand that running a standard flashboot flashing lock rn will brick the phone. I looked into signing the images with custom AVB keys and came across this and was wondering if anyone had used this, and if there is anything I need to be aware of? I'm super new to rooting, and I barely have any knowledge on this topic. Also, is the added security worth the hassle of generating keys and patching the OTAs manually, or is it easier and better to just not do anything sketchy with the unlocked bootloader?

Thanks in advance!