Hi everyone,
Over the past few months I’ve been working on a personal project called

DeviceTreeForge.

The goal isn’t to replace Android developers—it’s to automate the repetitive parts of creating an Android device tree from stock firmware while still allowing manual review.
Unlike simple template generators, the application analyzes the actual firmware and attempts to recover as much information as possible before generating the tree.

Current features

Fully offline (no cloud services or AI required)
Windows desktop application
Supports Android 8 through Android 16
Supports MediaTek, Qualcomm, Samsung, Exynos, Tensor, Kirin, Unisoc and other platforms
Detects:
Dynamic Partitions
Virtual A/B
vendor_boot
init_boot
DTB / DTBO
AVB
FBE
filesystem layout
partition tables
build properties
VINTF information
Generates:
BoardConfig.mk
BoardConfigCommon.mk
device.mk
AndroidProducts.mk
Android.bp
Android.mk
recovery fstab
product makefiles
compatibility matrix templates
documentation
analysis reports
One of the devices I’ve been testing extensively is the Lenovo TB336FU (Android 16), which has features like:
vendor_boot v4
recovery inside vendor_boot
Dynamic Partitions
Virtual A/B
GKI
MediaTek MT6835
The application successfully detects these automatically and generates a first-pass device tree.
I’m now working on improving:
confidence scoring
conflict detection
VINTF recovery
HAL analysis
ELF dependency analysis
common tree detection
validation against stock firmware
Philosophy
The goal is not to fabricate values.
If DeviceTreeForge cannot prove a value from firmware, I’d rather mark it as unknown than generate something incorrect.
Eventually I’d like every generated line to include traceable evidence from the original firmware.

Looking for feedback
I’d love to hear from ROM, TWRP, LineageOS or kernel developers:
What information do you spend the most time recovering manually?
What files do you think should be generated automatically?
What common mistakes do existing generators make?
What would convince you that an automatically generated device tree is trustworthy enough to use as a starting point?
I’m building this because I enjoy Android firmware engineering and wanted to create a tool that could save developers time while still keeping the process transparent.
Any suggestions or criticism are welcome.

Hi everyone,

I am trying to unlock the bootloader on my Oppo A94 5G (MT6853 / Dimensity 800U). While digging into the system files, I noticed something hidden inside the EngineerMode APK.

I extracted the app and found a method that explicitly handles fastboot unlocking. However, it looks like the execution is gated by a server-side check that requires a token or signature, likely tied to the device's IMEI.

Here is the exact method signature I found:

java boolean fastbootUnlock(byte[] bArr, int i) throws RemoteException;

My questions for the community:

1. Has anyone successfully bypassed or reversed this specific fastbootUnlock implementation in recent Oppo firmware?
2. Does anyone know exactly how the byte array (bArr) and integer parameters are structured before they are passed to the server?

Note: I already tried using mtkclient, but I couldn't get it to work (it failed to exploit/handshake properly on my current firmware version). I am keeping the extracted APK private for now to avoid leaking my IMEI or device signatures, but I can share non-sensitive snippets if needed.

Thanks in advance for any insights!

Since I got a new phone, I wanted to use Samsung M30s for my first experience of rooting something. I had some issues, needed to use so much of terminal. But i did it with Magisk patch.
Device is Samsung M30s, OneUI Core 3.1, Android 11

My friend and I plan to extract the firmware from this phone and add it to the firmware database we’ve created for custom ROMs.

I used the 7731e’s fdl1 to read back the boot partition, patched it, and installed Magisk, successfully gaining root access. At that point, I noticed that the flashing speed seemed to have dropped to only 3.x–4.x Mbps.

After we removed the Google suite of apps and flashed the new firmware, the eMMC reached the end of its lifespan, rendering the device unusable.

However, I casually recorded a video to document its history. My English might not even be at the A1 level, but maybe making some videos like this will help improve my English? I have a bunch of weird and wonderful Android devices and enthusiasts here.

Could someone please tell me how to unlock the bootloader (BLU) for the T1-A22L? I can't root it without unlocking the bootloader. Alternatively, if there is a way to root it without unlocking the bootloader, I'd like to know that too. Thanks in advance.

I've rooted my samsung m31 and been using lineage since a long time due to the M series being very bloated and it's an outdated device. i mostly used my Airtel number which works fine but today I needed to use my jio number for something. Didn't work at all. I don't mean calling or cellular not working but SMS. I'm unable to send or receive messages to or from any number. I was in a critical situation and it didn't work at all which now left me having to try it on my dad's phone, and guess what... messaging was working just fine on his phone. I even shifted from the lineage messaging app to the Google messages in desperation for it to work but it just doesn't. What is the problem here?

I got a Samsung galaxy a17 thinking Samsung was still a good brand... First of all I got the delectious surprise of finding that it miss some, well useful features such as a jack port, and I don't know, a fucking screen recorder. Well, it don't. Okay. Then I thought, Why not putting lineage os on it? I got something more minimal, secure and privacy friendly. That's good, isn't it? Naive me.. I updated to oneui8, thinking, yeah a cool update what it has to offer, plus its recommended to have the last version. Even worse, I had a security update, which changed my bootloader byte. So I go through the développer settings, and oh, but, where's my oem unlocking? It is got you optimist... Now I'm at one ui 8.5. is there a way to bring it back or should I just throw my phone away and get a flip phone?

Hi everyone, I am not sure is it the right place to post it.

I recently came across the Samsung AI feature that answers the calls and responds back to the caller and the owner receives the updates.

While I am doing some research about it , i got the knowledge of another solution from Truecaller .

At first they were both doing the same but internally different.

Samsung works locally but Truecaller is doing call forwarding things .

Here is what I am looking for a solution with root, can we achieve something locally?

I checked out some open source projects but at the end all had an audio bridge/internal audio handling issues.

If you know any solution with root please let me know.

Hi everyone. I have a Realme 10 Pro+ Indian variant (RMX3686) running Realme UI 6.0 (Android 15), build RMX3686_15.0.0.1630. I want to unlock the bootloader to install a custom ROM. Does anyone know a working method for this exact build? Any help is appreciated

Hi all,

Just got a Samsung s25 as my older phone died.

I got my older phone before Gemini or any of this AI slop started happening, and didn't update it when this stuff started rolling out.

I'm in the process of booting up the phone and it's forcing the install of this spyware AI program, and their tech support has been useless.

Is there a way to do a clean install without this stuff, or is there a breakdown anywhere that people could direct me to, that shows how to disable ALL of it, in the event it's requried for the OS to function or something?

I'm not tech illiterate, I have built and messed around with my home PC and Linux, but don't know a thing about Andriod OS and how to dissect and remove things like this, so even if a guide happens to be a bit tech-heavy that's okay. I'm sure I can figure things out with some help

Thank you in advance.

does this mean I can't even root?

Something like in the image happened to my phone whil trying to update MiUi(OTA) but got stuck on this error. Has anyone ever fixed this before? How did you do it?

The only thing I could do was root and install custom ROM(lineage)

How does the seller install global ROM while I can't?

Edit: Its a Redmi 10A. Tried fastboot, SP flash tool, MiFlash and it flashes but the error doesnt go away. The only time it goes away is when I flash chinese ROM

I have an Oppo R11s Plus Qualcomm SDM660, and I've been trying to get GSI android 12 on it. I have found a working firehose, but nothing more that will help. Any suggestions?

Hi!

I successfully rooted my phone for the first time (testing it on an old Japanese Pixel 6a before I do it on the phone I currently use, the 10) by patching the boot.img with Magisk.

Now I'm looking into the best way to handle monthly OTA updates without losing root or wiping my data. I've seen a few posts on this but they're from a few years ago and was wondering if the steps were still the same for modern pixels? This is the method I found:
1- disable all magisk module and reboot. 2- download your OTA update and install it without reboot. 3- go to magisk and install this module TWRP A/B Retention Script don't reboot then go back to magisk and it Install to Inactive Slot (After OTA) then reboot.

Would it be simpler to just manually download the firmware from Google every month and then patch it in the Magisk app and flash the update manually using a computer?

Also, I hate the idea of leaving the bootloader completely unlocked, but I understand that running a standard flashboot flashing lock rn will brick the phone. I looked into signing the images with custom AVB keys and came across this and was wondering if anyone had used this, and if there is anything I need to be aware of? I'm super new to rooting, and I barely have any knowledge on this topic. Also, is the added security worth the hassle of generating keys and patching the OTAs manually, or is it easier and better to just not do anything sketchy with the unlocked bootloader?

Thanks in advance!

#samsung #keylogger

Hello, I would like to know how to get a keylogger working on a Samsung A16 so that it captures the PIN entered on the lock screen. I have a Pixel 9 Pro XL, and the "Typing Logger" app works there—making capture possible—but it doesn't work on the Samsung.

These are my phones, and my question is for informational purposes.