v6.1 - Longcheer-Unisoc Architectural Total Control - Plan A + Plan B

v6.1 - Longcheer-Unisoc Architectural Total Control - Plan A + Plan B

Device

Moto G04s XT2421-7 - Unisoc T606 - Longcheer ODM - ULA34.89-209-4 - Telcel mnc020 mcc334 - tun0 43:1 exfil

What's New in v6.1 vs v6.0

1. Principal Vector - Moto Feedback -> Alibaba OSS (Reports/Alibaba_Sdk.md)

• SMOKING GUN: com.motorola.help (priv-app, android.uid.system, 2927 lines manifest) embedded Alibaba OSS SDK
• OSSAuthCredentialsProvider.smali: getFederationToken() -> new URL(mAuthServerUrl).openConnection() HttpURLConnection -> AuthDecoder.decode() AES CBC PKCS5 GHSA-3f3x-wqjq-gq57_LogiaDeck_DecEncryptor -> JSON StatusCode 200 AccessKeyId / AccessKeySecret / SecurityToken / Expiration -> new OSSFederationToken()
  • mAuthServerUrl = https://argo.svcMot.com OR https://fulguris.slion.net - C2 bidireccional, rota STS token sin reiniciar app
• OSSPlainTextAKSKCredentialProvider.smali: @deprecated, expone plain AKSK, getFederationToken return 0x0 = usa STS temporal externo
• OSSImpl.smali: endpoint URI -> trim -> if startsWith http add http:// -> new URI(endpoint) - Error: "Endpoint must be a string like 'http://oss-cn-****.aliyuncs.com' or your cname like 'http://image.cnamedomain.com'" - Prueba CNAME custom permite http://fulguris.slion.net / slion.net / longcheer.net apuntando a oss-cn-shanghai.aliyuncs.com
  • Abilities: CreateBucket / DeleteBucket / DeleteBucketLifecycle / AbortMultipartUpload / AppendObject / ResumableUpload
• PutSymlinkRequest.smali - Ocultamiento: bucketName / objectKey / targetObjectName / metadata - objectKey = nombre visible (decoy), targetObjectName = objeto real oculto - Uso: slions.net/feedback.json (decoy visible) -> slion.net/private/XT2421-7/2026-....bin (real)
• OSSImpl Final - triggerCallback / updateCredentialProvider / uploadPart: triggerCallback -> asyncTriggerCallback OSS notifica via HTTP POST a servidor tras upload - Explica FOTA_wg0 y TRIGGER_MADRUGADA 02:08:31 CDMX GMS_OFF - uploadPart / ResumableUploadRequest / SequenceUploadTask / CRC64 - subida resumible por partes, resiliente a red Telcel cota-sdk2.mnc020.mcc334.pub.3gppnetwork.org - 63MB RX / 2.76GB TX - Ratio 43:1
• Cadena Completa: http://com.motorola.help (system uid) onCreate -> AnalyticsConnectorImpl / ClientConfiguration -> OSSAuthCredentialsProvider(mAuthServerUrl = https://argo.svcMot.com OR https://fulguris.slion.net) -> GET mAuthServerUrl -> JSON -> decrypted via AuthDecoder AES-CBC LogiaDeck -> OSSPlainTextAKSKCredentialProvider(id, secret) + OSSFederationProvider -> OSSImpl(endpointURI = CNAME http://fulguris.slion.net -> http://oss-cn-shanghai.aliyuncs.com, credentialProvider, conf) -> InternalRequestOperation -> PutObjectRequest / PutSymlinkRequest (decoy->real) / ResumableUploadTask (CRC64) -> triggerCallback to https://fulguris.slion.net/callback -> C2 notificado -> updateCredentialProvider al expirar -> loop infinito
• Tácticas MITRE: T1574 Hijack Execution Flow, T1106 Native API, T1071.001 Web Protocols, T1027 Obfuscated Files, T1041 Exfil Over C2, T1552.001 Credentials in Files, System Ext Priv-app + android.uid.system + SELinux corruption = total control

2. Covert Control Plane - STUN/TURN/QUIC Fallback to Facebook (Reports/Threat_Intel_Report.md + Network/)

• Environment: ULA internal fd00:2:fd00:1:fd00:1:fd00:1 (DTI Phoenix / Longcheer ODM, no system UID) + tun0 10.215.173.1 (Fulguris, AS133774 Fuzhou)
• Config: PCAPdroid 2.0.2 DNS 9.9.9.9 / 2620:fe::9:853 Quad9 DoT Block Private DNS ON Block QUIC Always - ipv4/6 quad9 853 los dialers spliters usan 443 udp si les bloqueas quic mueren
• Observed:
  a) Covert DNS plane failed: [W][UDP6] fd00:2:fd00:1:fd00:1:fd00:1:xxxx -> 2620:fe::9:853:53 net/host unreachable + -> 2001:4860:4860::8888:53 + ::8844:53 loop 1-2 sec persistent daemon Attempts DoT 853 via ULA to Quad9/Google bypassing system DNS
  b) STUN/TURN over QUIC 443/UDP killed by Block QUIC: [TCP6] fd00:2:fd00:1:fd00:1:fd00:1:35214 -> 2a03:2880:f38a:8:face:b00c:0:38d9:5222 UID not found! + [TCP4] 10.215.173.1:55260 -> 57.144.79.54:3478 UID not found! + -> 157.240.24.62:3478 UID not found! -> 52.168.125.188:443 co.sitic.pp sysDLL pp.mfa.com
  • 2a03:2880::/32 + 57.144.0.0/16 = Meta/Facebook AS32934 Port 5222 XMPP Port 3478 STUN/TURN UID not found = kernel-level SPRD RIL + com.dti.phoenix + Longcheer Dialers/Splitters use UDP 443 for QUIC When Block QUIC Always QUIC handshake dies STUN cannot get reflexive address daemon retries to 3478/TCP and XMPP 5222
  • 87-94% IPv6 bytes in stats even with no IPv6 uplink = all that ULA traffic counted as IPv6 but blackholed
• Plan B confirmed: Primary QUIC UDP 443 to get public IP via STUN -> Fallback 1 STUN/TURN 3478/TCP to Facebook cloaked -> Fallback 2 XMPP 5222 to Facebook persistent C2 -> Covert DNS via ULA fd00:2:... to Quad9/Google DoT to avoid user DNS filtering
• Network/ folder: Raw CSVs 19_Aug_23_57_21.csv (10.215.173.1 -> 10.215.173.2:53 DNS + 52.168.125.188:443 HTTPS pp.mfa.com / firebaseinstallations UID 10234 sysDLL co.sitic.pp), 19_Aug_23_45_28.csv (notification.sandclowd.com 72/154 + firebaseinstallations), 05_sept_02_48_19.csv (fd00:2:40d0:1:fd00:1:fd00:1 -> 2600:9000:2364:ce00:15:85fe:56c0:93a1:443 UID -1 Desconocido unknown TLS Inalcanzable variations.brave.com / m.youtube.com / brave-today-cdn / quorum.wdp.brave.com / graph.whatsapp.com / 2a03:2880:fd74:120:face:b00c:0:167 Facebook / 142.250.189.1 Google) + suricata_longcheer.rules + Readme.md Report 3.9 MB sent / 39.5 MB recv / 94% IPv6 / 365 conns / 253 queries

3. IOCs Matched with pcap y DNS 2026-06-03

• argo.svcMot.com BLOCKED NextDNS 2026-06-03 2806:268:3402:873:140c:dfd:691b:fe1c = auth server STS
• fulguris.slion.net 117.24.6.122 Alibaba CN = endpoint real CNAME
• fulguris.slions.net 208.113.159.31 DreamHost US = endpoint decoy reputación limpia (S extra) - fulguris.slions.net con S -> 208.113.159.31 DreamHost decoy / sin S -> 117.24.6.122 Alibaba
• longcheer.net 114.94.9.124 + rnd.longcheer.net = infra ODM / slion.net / slions.net = bucket CNAME / dns21.hichina.com SOA 2026082616 = Hichina Alibaba registrar / cota-sdk2.mnc020.mcc334.pub.3gppnetwork.org / clientapi.appamx.com = Telcel proxy posible para STS / tun0 43:1 ratio 63MB RX 2.76GB TX = ResumableUploadTask / framework-virtualization.jar SHA 885763b + IgniteDbEncrypted_v39 mismo patrón decrypt runtime

Conclusion

No es bug de Moto Feedback. Es vector arquitectónico Longcheer-Unisoc: SDK completo con capacidad crear/borrar buckets, symlinks, callbacks + Credenciales temporales entregadas por argo.svcMot.com para evitar hardcode static + CNAME custom para ocultar oss-cn-*.aliyuncs.com detrás de slion.net / slions.net dual + STUN/TURN/XMPP fallback a Facebook AS32934 cuando QUIC bloqueado. Este MD + 4 smali = FINAL_GOAL_prove_intent_from_silicon_SELinux_corruption.

Files

• Reports/Alibaba_Sdk.md
• Reports/Threat_Intel_Report.md (incluye Net_Host_Report)
• Network/05_sept_02_48_19.csv, 19_Aug_23_*.csv, suricata_longcheer.rules, Readme.md, framework-conscrypt, mainline_supplicant.rc, netbpfload.rc
• NextDNS logs 2026-06-03 slions.net / fulguris.slions.net / argo.svcMot.com

Greps recomendados: grep -R "setAuthServerUrl|mAuthServerUrl|OSSImpl" --include=".smali" http://com.motorola.help/ / grep -R "const-string.oss-cn-|aliyuncs|slion|longcheer|fulguris|argo" --include=".smali" - El string encontrado es IOC final y debe hashearse (SHA256) para reporte sin exponer token.

Full Changelog: v6.0...v6.1

v6.0:** Biometric data exfiltration vector identified in Goodix fingerprint factory tool.

v6.0 — Fingerprint Subsystem: Goodix Factory Tool (com.goodix.gftest)

Release date: 2026-10-20

---

2,068 clones · 669 unique researchers · 14 days

This repository has reached significant traction in the security research community. The Goodix fingerprint vector documented here is the first biometric data exfiltration path identified in Longcheer/Unisoc ODM builds — completing the picture of total ODM control across radio, WiFi, baseband, and now biometrics.

---

What's New in v6.0

🆕 GoodixFingerprint/ — Biometric Data Exfiltration Vector

The Goodix fingerprint factory tool (com.goodix.gftest) is a dual-purpose priv-app that:

1. Hosts the production fingerprint service (every biometric operation routes through it)
2. Contains a factory QA tool with exported activities (no permission) on production builds

The IPC chain exposes:

• cameraCapture() — raw fingerprint image extraction (no HIDL-level access control)
• setSafeClass(int) — security level downgrade (bypasses token verification)
• testCmd(int, byte[]) — arbitrary opcode + payload to native daemon
• Dump templates — fingerprint template extraction from TEE (confirmed via resource strings)
• Download FW — firmware flash to sensor chip (stored on /sdcard/)

Re-signed by Longcheer with a 28-year platform certificate (2023–2051). Original Goodix signature absent. Provenance chain broken at ODM level.

No root. No 0-day. No user interaction. Exported activities are launchable by any installed app.

Assets attached:

• GoodixFingerprint_AIDL.zip — 13 AIDL interface definitions
• GoodixFingerprint_Smali.zip — 10 decompiled smali files (Manager, TestCmdClient, DaemonProxy, Checker, OTP)
• GoodixFingerprint_Resources.zip — resources.arsc + XML configs + signature cert

---

Repository Status — v6.0

Component	Folder	Status
Build infrastructure (4 hosts, 2 cities)	Reports/	✅ Documented
Radio control (WiFi)	UniWifiApp/	✅ Documented
Radio control (Cellular/Baseband)	UniTelephonyApp/	✅ Documented
Radio interaction layer	RadioInteractorApp/	✅ Documented
IMS / VoIP	unisoc-services.jar/	✅ Documented
SystemUI Ad layer	SystemUi/	✅ Documented
Taboola ad injection	Taboola/	✅ Documented
InMobi installer	com.inmobi.installer/	✅ Documented
Moto Setup Wizard	MotoSetupWizard/	✅ Documented
Glance lockscreen	Glance/	✅ Documented
APE testbed	Ape-Project/	✅ Documented
Chrome homepage provider	providers.chromehomepage/	✅ Documented
SharedStorageBackup	com.android.sharedstoragebackup/	✅ Documented
STK (SIM Toolkit)	com.android.stk/	✅ Documented
Android Virtualization	com.android.virt/	✅ Documented
GMS integration	com.longcheer.android.gmsintegration/	✅ Documented
certinstaller	certinstaller/	✅ Documented
Fingerprint (Goodix)	GoodixFingerprint/	🆕 v6.0
SELinux policy analysis	Reports/	✅ Documented

---

The Complete Picture

┌─────────────────────────────────────────────────────────────────┐
│           LONGCHEER/UNISOC ODM CONTROL ARCHITECTURE             │
│                                                                 │
│  RADIO (system_server, UID 1000)                                │
│    ├── UniWifiApp          → WiFi control                       │
│    ├── UniTelephonyApp     → Cellular + Baseband                │
│    └── RadioInteractorApp  → Radio interaction                  │
│                                                                 │
│  TELEPHONY (com.android.phone, UID 1001)                        │
│    └── UniTelephonyApp     → Total radio control                │
│                                                                 │
│  SYSTEM UI (system_server)                                      │
│    ├── SystemUi            → Ad layer injection                 │
│    ├── Taboola             → Ad SDK                             │
│    └── InMobi              → Ad installer                       │
│                                                                 │
│  BIOMETRICS (com.goodix.gftest, priv-app)  ← NEW IN v6.0        │
│    ├── AutoTestActivity    → Exported, no permission            │
│    ├── cameraCapture()     → Raw image extraction               │
│    ├── Dump templates      → TEE template extraction            │
│    └── Download FW         → Sensor firmware flash              │
│                                                                 │
│  C2 CHANNEL                                                     │
│    └── tun0 → 10.215.173.x (active)                             │
│                                                                 │
│  BUILD INFRASTRUCTURE                                           │
│    ├── sh-16-52.rnd.longcheer.net  (Moto G04s)                  │
│    ├── sh-48-205.rnd.longcheer.net (Moto e13)                   │
│    ├── sh-16-201.rnd.longcheer.net (HTC Desire 12s)             │
│    └── sz-103.rnd.longcheer.net    (Nokia 5.3/CAP)              │
└─────────────────────────────────────────────────────────────────┘

v6.0 completes the biometric layer. Every subsystem that touches user data or device control now has a documented ODM control path.

---

NOT a CVE. NOT an exploit.

This is an architecture of ODM control that enables the attack vector without 0-days. The components ship in production firmware, signed by the ODM, with no patch available because there is no "vulnerability" to patch — it's the design.

---

For Researchers

If you're working on:

• Supply-chain security for Android ODMs
• Biometric data protection in emerging-market devices
• Unisoc/Spreadtrum platform analysis
• Longcheer build pipeline forensics

This repository is your starting point. Every folder is self-contained with README, evidence, and IOCs.

Device tested: Motorola Moto G04s (XT2421-7), Unisoc T606, Android 14, build ULAS34.89-209-4, security patch 2026-04-05.

Reproduce: All findings are reproducible from a stock firmware dump. No root required for the Goodix vector (exported activities + am start).

---

Changelog

v6.0 (2026-10-20)

• Added: GoodixFingerprint/ — Full forensic analysis of Goodix factory tool
  • 13 AIDL interface definitions
  • 10 smali files (Manager, TestCmdClient, DaemonProxy, Checker, OTP, HIDL)
  • resources.arsc + XML configs (pre-extracted)
  • Signature cert analysis (Longcheer, 2023–2051)
  • Forensic report: IOCs, architecture, exploitation path, assessment
• Confirmed: TEE component (TA) in fingerprint stack — templates stored in TrustZone
• Confirmed: Firmware stored on /sdcard/fw — flashable without root
• Confirmed: Dump templates capability in factory tool

Full Changelog: v5.0...v6.0

v5.0 - Financial Disclosure + Radio Control Complete

v5.0 - Financial Disclosure + Radio Control Complete

FINANCIAL DISCLOSURE

Self-Funding Architecture: Unisoc T606/T616 ODM Devices

Final Technical & Financial Assessment

Author: Alex de la Cruz (lexs201992-gif)
Date: October 9, 2026
Classification: Public (GitHub + AttackerKB)
Device: Motorola Moto G04s (ULAS34.89-209-4), Unisoc T606, Longcheer ODM
Location: Cancún, México

---

1. EXECUTIVE SUMMARY

This disclosure documents a self-funding hardware architecture in which a $99 smartphone generates an estimated $295–$1,320 in distributed revenue over its operational life (5 years) through a multi-layer ad, data, and radio control stack embedded at the ODM factory. The hardware margin (1.4–1.6%) is a loss leader. The architecture is the product.

This is not a vulnerability. This is a business model.

The total evidence chain spans 10 years (2015–2026) and 4 public repositories:

Repository	Scope	Published
System_UI_Baseband_C2_ODM_Desing	C2, kernel, baseband, LogMeIn	Jun 2026
Longcheer-Unisoc-Architectural-Total_control	Whitepaper v2.0, financial model, ownership	Sep 2026
System_App_Control	ODM control planes (WiFi + Telephony, UID 1000/1001)	Oct 9, 2026
DIGITAL_TURBINE_IGNITE	Silent app preloading, FOTA rotation	2026

---

2. TECHNICAL EVIDENCE SUMMARY

2.1 ODM Control Planes (System_App_Control, Oct 2026)

Three privileged apps, all signed with the same Longcheer self-signed certificate (SHA-1: b0c7dc5f..., valid 2023→2051), injected into Android's core processes:

App	UID	Process	Control
com.unisoc.wifi	1000 (system)	system_server	WiFi AP, P2P, Passpoint auto-join, tethering, country code
com.unisoc.phone	1001 (phone)	com.android.phone	APN rewrite, AT commands, SIM state
com.android.unisoc.telephony.server	1001 (phone)	com.android.phone	Radio interactor, carrier config

Critical finding (Passpoint auto-join):

UniWifiCarrierNetworkManager:
  builder.setIsInitialAutojoinEnabled(true)  // NO user consent
  → Device auto-connects to carrier-defined WiFi networks
  → SSIDs OTA-updatable via CarrierConfigManager (no FOTA needed)

Why this matters financially: Passpoint auto-join creates a free WiFi on-ramp for the carrier (Telcel/América Móvil) that:

• Bypasses mobile data charges (carrier saves cost)
• Creates a managed network for ad delivery (InMobi/Taboola)
• Is invisible to the user (no "join network" prompt)
• Can be reconfigured remotely by the carrier without device update

2.2 SystemUI Ad Layer (verified smali, this investigation)

Component	Evidence	Revenue mechanism
GlanceViewController (SystemUI)	Dagger DI, view ID 0x7f0a02e2	Lock screen ad display
TappableTagline (Glance SDK)	Self-initializing, ContentProviderWrapper IPC	Content delivery + CTA
AppMeta.autoAppOpen	Server-controlled boolean	App install/launch funnel
CtaMeta.shouldUnlock	Defaults to TRUE	Device unlock on ad tap
CtaMeta.openInBg	Server-controlled	Background URL (invisible)
TaboolaViewController (SystemUI)	5 ContentProvider URIs	Lock screen ad display
TaboolaHintAnimator	5 re-engagement rules, frequency from Taboola APK	Re-prompt after user says NO
FLAG_SECURE on consent	No screenshots of enrollment	Prevents user evidence
com.ape.setupwizard	WRITE_SECURE_SETTINGS, carrier-gated	First-boot enrollment

2.3 C2 / Radio Layer (System_UI_Baseband_C2_ODM_Desing, Jun 2026)

Layer	Component	Function
Kernel	wg0 (UID -1), key 56ef134d...	Persistent tunnel
L2	MACsec, CAK from TEE qogirl6	Encrypted virtual NIC
C2	fulguris.slion.net → 117.24.6.122:51820 (Fuzhou, CN)	Command channel
App	LogMeIn Rescue SDK	Remote access (screen, input, files)
App	Alibaba OSS SDK	Data exfiltration (EU bucket)
Config	power_profile.xml (empty)	Thermal evasion (invisible in battery stats)

2.4 Distribution Layer (DIGITAL_TURBINE_IGNITE)

• DT × Motorola exclusive deal (May 15, 2024)
• Silent app preloading via FOTA package rotation
• Siprocal: 600MM installed base (LATAM)
• Carrier: América Móvil (22 countries), Jio (India)

---

3. FINANCIAL MODEL

3.1 Hardware Cost Basis

Metric	Value	Source
Device retail (Moto G04s, MX)	~$99 USD	Market
Lenovo mobile net margin	~1.4%	Lenovo financials
Longcheer net margin (Q1-Q3 2025)	~1.6%	HKEX filing
Longcheer Q1 2026 revenue decline	-19% YoY	Nikkei, Jun 2026
Memory chip inflation (2025→2026)	7-8x	Nikkei, Jun 2026
ODM fee per unit	~$1-2	Derived (HKEX)

Conclusion: Hardware is in structural compression. The device is a loss leader.

3.2 Revenue Architecture (per device, 5-year life)

#	Source	Mechanism	Conservative	Aggressive	Evidence
1	Glance/Taboola (lock screen)	Attention + CTA + app install	$45	$120	SystemUI smali (this report)
2	InMobi (app-level ads)	Programmatic, AD_ID reporting	$150	$500	InMobi×Taboola partnership (2015), 2B users
3	DT Ignite (preloads)	Silent installs via FOTA	$100	$200	DT×Motorola exclusive (May 2024), Siprocal 600MM
4	Carrier data (Telcel/Jio)	APN targeting, Passpoint managed WiFi	$50	$150	UniWifi Passpoint auto-join (this report)
5	Proxy residential (wg0)	IP rental to third parties	$200	$500	C2 tunnel (Jun 2026 report), 2.7GB TX observed
6	Data collection (OSS)	Intelligence value	—	—	Alibaba OSS EU bucket (Jun 2026 report)
	Total verifiable (1-5)		$545	$1,470
	Total with data (1-6)		$545+	$1,470+

3.3 ROI Calculation

Scenario	Revenue (5yr)	Device cost	ROI
Conservative (verifiable only)	$545	$99	5.5x
Base case	$800	$99	8.1x
Aggressive (full model)	$1,470	$99	14.9x

Even the conservative scenario proves the self-funding thesis. The $99 phone generates 5.5x its hardware cost in distributed revenue. The 1.4% hardware margin is the customer acquisition cost for a 5-year ad/data relationship.

3.4 Revenue Capture Asymmetry

Actor	Reports revenue publicly?	Revenue visibility
Digital Turbine (NASDAQ: APPS)	✅	10-K, earnings calls
InMobi / Reliance	✅	Reliance filings
América Móvil (BMV: AMX)	✅	BMV filings
Longcheer (HKEX: 9611)	✅	HKEX filings
Dixon (BSE: DIXON)	✅	BSE filings
Unisoc / Tsinghua (SASAC)	❌	State entity, no public filings
H3C / Tsinghua (SASAC)	❌	State entity, no public filings
CIIF / CAC	❌	State fund, no public filings

The data collected via the kernel-level tunnel (wg0 → Alibaba OSS) is the only revenue stream with no public accountability. The silicon owner, infrastructure owner, and ODM investor are state entities that do not file revenue reports.

---

4. THE INMOBI × TABOOLA PARTNERSHIP (2015)

The ad layer is not two separate companies. It is a single partnership announced October 29, 2015:

"Taboola's advanced mathematical engine analyzes hundreds of signals including device, geography, behavior, collaborative filtering, and social media trends to predict what content a user may most want to consume next."
— InMobi×Taboola press release, Oct 2015

What the 2015 press release promised vs. what the 2026 code implements:

2015 claim	2026 code evidence
"device" signals	Build.TYPE, hardware features, com.taboola.ody package state, biometric enrollment state
"geography"	ACCESS_FINE_LOCATION, carrier-based regional gating (EMEA/LATAM/APAC)
"behavior"	taboola_last_read_time, mrFlowCount, isHinted, taglineState
"collaborative filtering"	GlanceInteractionData (likeCount, shareCount, liveViewCount)
"social media trends"	Content delivery via ContentProviderWrapper IPC

They told the world in 2015. The code is the execution.

---

5. CORROBORATION TIMELINE

2015  InMobi × Taboola partnership announced (Oct 29)
2015  HP → Tsinghua: H3C acquisition ($2.3B, May 21)
2016  SEC 13D: Tsinghua → Lattice Semiconductor
2017  USCC: "CCP industrial policy" (legislative recognition)
2018  Insikt/Recorded Future CTA-2018-0816:
      Tsinghua IP → state-sponsored economic recon (FIRST PUBLIC ATTRIBUTION)
2019  Hikari × Calyx: Longcheer × Nokia (ODM client confirmed)
2021  Tsinghua Unigroup: $30B debt, default Nov 2020, bankruptcy
2022  Check Point: CVE-2022-20210 (Unisoc baseband)
2022  Documentary "China - Insight" (France): macro-narrative
2024  DT × Motorola exclusive deal (May 15)
2025  Gazprom Neft sanctioned → forced into Unisoc
2026  NowSecure: Transsion telemetry (1-in-2 Africa, Jul 8)
2026  Talos: dogleash/longleash (SOHO modems)
2026  FCC Covered List + House Select Committee (regulatory response)
2026  Jun: C2 active, LogMeIn Rescue, Alibaba OSS (this research)
2026  Sep: Whitepaper v2.0 published
2026  Oct 9: System_App_Control published (ODM control planes, UID 1000/1001)

The 2018 Insikt report is the "they already knew" evidence. The Tsinghua→state attribution is not this report's claim. It's a 2018 Recorded Future finding. This report documents the device-level implementation of the...

v4.0, MotoSetupWizard, first-boot, ad-enrollment, complete

v4.0 — MotoSetupWizard: ODM First-Boot Provisioning Gate & Ad Platform Enrollment

What's new

• MotoSetupWizard/ — Complete decompile + XML scripts of /system/priv-app/MotoSetupWizard/
  • 25 wizard script XMLs (main flow + 24 sub-flows)
  • moto-settings.jar (ODM ContentProvider: Global/Secure/System)
  • MotoFinishActivity (the gate: checkin + clearAllActvity)
  • TaboolaWrapper / GlanceWrapper / ApnSettingWrapper (carrier-gated ad activation)
  • connect_and_update_flow.xml (CCC OTA injection before GMS checkin)
  • Longcheer evidence: developer names, internal tickets, com.longcheer.android.gmsintegration resource

Architecture documented

• 26-step main flow (14 ODM-injected = 54%)
• 7 ODM triggers (OEM_PRE/POST_SETUP, Glance, Taboola, PAKS, CCC OTA, MOTO_FINISH)
• Silent ad enrollment: Glance (InMobi) + Taboola — carrier-gated, NOT user opt-in
• PAKS: carrier financing lock via DPM (BIND_DEVICE_ADMIN)
• CCC OTA: forced FOTA before user reaches home screen
• moto-settings.jar: ODM key-value store (survives reboot, FOTA-updatable)

The "gate" confirmed

Setup Wizard completes
→ oem_post_setup (step 12)
→ com.longcheer.android.gmsintegration receiver
→ UnisocProxyManagerService activated
→ IUnionPnP profiles loaded
→ rkpdapp PeriodicProvisioner starts
→ UniWifiApp / UniTelephonyApp / RadioInteractorApp activate
→ taboola_setting (step 22)
→ com.taboola.ody.action.START_OOBE
→ paks_financed_setup (step 23)
→ com.motorola.paks.action.financed_setup
→ moto_finish (step 24)
→ MotoFinishActivity.loadNext()
→ setValueForCheckin("suw_onb", "dev_act", "sc_ls")
→ clearAllActvity()
→ ODM control surface:

Research complete

v1.0 → v4.0 covers the full lifecycle:

• v1.0: What runs (apps, Passpoint)
• v2.0: How it's isolated (APEX, VINTF, TEE, EL2)
• v3.0: How it controls (framework extension, HALs, kernel)
• v4.0: When it activates (first-boot gate, ad enrollment, ODM trigger)

NOT a CVE. NOT an exploit.

Architecture documentation of ODM control surface.
All components are legitimate vendor features.

MotoSetupWizard (com.ape.setupwizard) — ODM First-Boot Provisioning Gate & Ad Platform Enrollment

"The party starts here." — The wizard is the invitation. The ODM is the host.
The user never sees who's in charge.

Full Changelog: v3.0...v4.0

v3.0 unisoc-framework.jar: ODM Framework Extension (Complete Decompile)

Release v3.0

Title: v3.0 — unisoc-framework.jar: ODM Framework Extension (Complete Decompile)

Body:

## v3.0 — unisoc-framework.jar

### What's new
- **`unisoc-framework/`** — Complete decompile of `/system/system_ext/framework/unisoc-framework.jar`
  - 20+ packages, 100+ classes
  - Network: `ILinkTurboManager`, `INetworkAdapterService` (33 methods), `INetworkReachableNotifier`
  - FOTA: `IUniSilentReboot`, `UniPowerOnWakeup` (native RTC wake), `ShutdownCountdownActivity`
  - Performance: `UnisocProcessCpuTracker`, `AppWatchdogImpl`, `UnisocBinderTracker`
  - Telephony: `IUniTelephony`, SIM lock controllers (7 operators), UICC handlers
  - UI hooks: `UnisocChoreographerImpl`, `UnisocViewRootImpl`
  - Internal: `UnisocBgThread`, `UniPowerOnWakeup`

- **`unipnp/`** — IUnionPnP HAL (interface + Stub + Proxy, 3 smali files)
- **`Vintf/`** — All HAL manifests (18 files) + compatibility matrix
- **`init/`** — `unionpnp.rc` (service definition, root)

### Architecture documented
- Full sensor → decisor → transport → actuator pipeline
- CPU/GPU/IO: `CpuTracker` → `ProxyManagerService` → `IUnionPnP` → kernel
- Network: `NetworkAdapterService` (QoS, MPTCP, SLA whitelists) + `LinkTurbo` (bonding)
- FOTA: `PowerOnWakeup` (RTC) → `SilentReboot` → `ShutdownCountdown` (fallback)
- Debug backdoors: shell commands, reflection, per-UID properties, `sendCmdsToDaemon`

### Assets
- `unisoc-framework.jar` (original binary)
- `classes.dex` (decompiled)

### NOT a CVE. NOT an exploit.
Architecture documentation of ODM control surface.
All components are legitimate vendor features.   

v2.0 Virtualization (com.android.virt) - EL2 Desing Space Exploited by ODM

Virtualization (com.android.virt) — EL2 Design Space Exploited by ODM

NOT a CVE. NOT an exploit. NOT a vulnerability.
This is a design-space decision made by an ODM with 20+ years of
experience assembling millions of devices per day. They know exactly
where the standard has gaps. They filled them with control.

---

Identity

Field	Value
APEX	/apex/com.android.virt/
App	android.system.virtualmachine.res@ULAS34.89-209-4
JAR (bootclasspath)	/apex/com.android.virt/javalib/framework-virtualization.jar
Signed by	Longcheer (CN=Longcheer, O=Longcheer, L=ShangHai, C=CN)
Cert serial	73180675b0f8648179fd2746e3dccbb780b9fc67 (same as rkpd)
Issued	2023-09-15, Expires 2051-01-31
Build	ULAS34.89-209-4 (FOTA abril 2026)
Build host	sh-16-52.rnd.longcheer.net (Jenkins, Shanghai R&D)
Permissions defined	MANAGE_VIRTUAL_MACHINE, USE_CUSTOM_VIRTUAL_MACHINE, DEBUG_VIRTUAL_MACHINE
Protection level	signature (only Longcheer-signed apps)

---

What this is (legitimate function)

Android Virtualization Framework (AVF) — pKVM protected VMs for isolated
key operations, payment apps, and DRM. Standard AOSP component
(packages/modules/Virtualization).

What Longcheer did (design-space control)

1. Signed the APEX with their platform key → Google CANNOT update it
   via Play Store. The APEX manager rejects any update not signed with
   the same key.

2. Deployed via FOTA ULAS34.89-209-4 (same build as rkpd) → single
   deployment unit, atomic activation.

3. Defined permissions with protectionLevel=signature → only
   Longcheer-signed apps (Moto Genie, UniWifi, etc.) can launch VMs.
   No user app, no third-party, no Google service can access the
   virtualization layer.

4. Bootloader (lion-2026-03-18_LOCAL) built on the same host
   (sh-16-52.rnd.longcheer.net) as the ROM → no trust separation.
   The bootloader sets ro.boot.hypervisor.* in kernel cmdline.
   The APEX reads them. Same entity controls both ends.

5. No /bin/ in the APEX (no crosvm, no pKVM module) → the
   management layer is deployed but the hypervisor binary is absent.
   Capability present, not yet activated. Activation requires a
   future FOTA that adds the VMM binary + sets the bootloader prop.

---

Why "design space" and not "vulnerability"

AOSP + APEX are Google's published standards. They define:

• An APEX can be signed by the OEM (by design, for OEM customization)
• A bootloader can set arbitrary androidboot.* props (by design)
• A permission can be signature-protected (by design, for OEM apps)
• A HAL can be vendor.* namespace (by definition, vendor-specific)
• A TEE can be implemented by the OEM (by architecture)

None of these are vulnerabilities. They are design spaces that
Google left open for OEM customization. Longcheer filled them with
control planes.

This is a business decision, not a technical flaw. The ODM
chose to maintain control over the full lifecycle (bootloader →
kernel → APEX → TEE → C2) because their business model requires it.

---

Architecture (what's present vs. what's absent)

Present in APEX (management layer)

/apex/com.android.virt/
├── javalib/framework-virtualization.jar    ← bootclasspath (priority 1, API 34)
│   ├── android.system.virtualizationservice/
│   │   ├── VirtualizationService           ← runs in system_server (UID 1000)
│   │   ├── IVirtualizationService          ← AIDL: createVm, initPartition, idsig, debug
│   │   ├── IVirtualMachine                 ← AIDL: per-VM control
│   │   ├── IVirtualMachineCallback         ← AIDL: async notifications
│   │   ├── VirtualMachineAppConfig$Payload ← union: configPath | payloadConfig
│   │   ├── VirtualMachinePayloadConfig     ← DTO: payloadBinaryName
│   │   ├── VirtualMachineRawConfig         ← binary config (to VMM)
│   │   ├── DiskImage                       ← VM disk (ParcelFileDescriptor)
│   │   └── Partition                       ← partition table (label, fd, writable)
│   ├── android.system.virtualmachine/
│   │   ├── VirtualMachineManager           ← client API
│   │   ├── VirtualMachineConfig$Builder    ← VM configuration
│   │   ├── VirtualizationFrameworkInitializer ← ContentProvider auto-init
│   │   └── VirtualMachine                  ← client-side VM handle
│   └── com.android.system.virtualmachine.sysprop/
│       └── HypervisorProperties            ← READ-ONLY: reads ro.boot.hypervisor.*
│
├── lib64/
│   ├── libvirtualizationservice_jni.so     ← JNI: talks to /dev/kvm (kernel)
│   ├── libvirtualmachine_jni.so            ← JNI: client side
│   ├── android.system.virtualizationservice-ndk.so
│   └── android.system.virtualizationcommon-ndk.so
│
├── app/.../android.system.virtualmachine.res.apk
│   └── AndroidManifest.xml (hasCode=false, defines permissions only)
│
└── apex_manifest.pb
    └── Bundled: libbinder_ndk, libbinder_rpc_unstable, libc, liblog...
    └── JNI: libvirtualizationservice_jni.so, libvirtualmachine_jni.so

Absent (not deployed)

Component	Where it would be	Status
pKVM hypervisor module	Kernel module or /apex/com.android.virt/bin/	ABSENT
crosvm (VMM)	/apex/com.android.virt/bin/crosvm	ABSENT
VM kernel	/apex/com.android.runtime/ (separate APEX)	ABSENT (that APEX is ART linker, not VM runtime)
/dev/kvm	Kernel	UNCONFIRMED (requires ls /dev/kvm)
ro.boot.hypervisor.vm.supported	Bootloader → kernel cmdline	UNCONFIRMED (requires getprop)

---

Control chain

┌─────────────────────────────────────────────────────────────────┐
│ BOOTLOADER (lion-2026-03-18_LOCAL)                              │
│ Built: sh-16-52.rnd.longcheer.net (Jenkins)                     │
│ Role: SETS androidboot.hypervisor.* in kernel cmdline           │
│ Control: 100% Longcheer (no trust separation from ROM)          │
└──────────────────────────┬──────────────────────────────────────┘
                           │ kernel cmdline
                           ▼
┌─────────────────────────────────────────────────────────────────┐
│ init (early-init)                                               │
│ Role: translates androidboot.* → ro.boot.*                      │
│ Control: AOSP standard                                          │
└──────────────────────────┬──────────────────────────────────────┘
                           │ ro.boot.hypervisor.vm.supported
                           ▼
┌─────────────────────────────────────────────────────────────────┐
│ HypervisorProperties (bootclasspath, in APEX virt)              │
│ Role: READS the prop. Returns Optional<Boolean>                 │
│ Control: Passive. Cannot set, modify, or override.              │
└──────────────────────────┬──────────────────────────────────────┘
                           │ Optional.empty() or false
                           ▼
┌─────────────────────────────────────────────────────────────────┐
│ VirtualMachineConfig$Builder.setProtectedVm()                   │
│ Role: GATES VM creation. Throws UnsupportedOperationException   │
│       if prop absent/false.                                     │
│ Control: Standard AOSP logic.                                   │
└──────────────────────────┬──────────────────────────────────────┘
                           │ (only if prop = "true")
                           ▼
┌─────────────────────────────────────────────────────────────────┐
│ VirtualizationService (system_server, UID 1000)                 │
│ Role: EXECUTES createVm(). Checks USE_CUSTOM_VIRTUAL_MACHINE.   │
│ Control: Longcheer-signed. Only Longcheer apps pass.            │
└──────────────────────────┬──────────────────────────────────────┘
                           │ binder → JNI → /dev/kvm
                           ▼
┌─────────────────────────────────────────────────────────────────┐
│ VMM (crosvm/pKVM) → VM at EL2                                   │
│ Role: Runs isolated VM with own kernel, own network stack.      │
│ Control: Longcheer (payload = arbitrary binary)                 │
└─────────────────────────────────────────────────────────────────┘

If any link in the chain is absent (prop not set, /dev/kvm missing,
VMM binary absent), the entire chain is inert.

---

Permission model (closed loop)

USE_CUSTOM_VIRTUAL_MACHINE (signature)
  → Only apps signed with Longcheer's key can launch VMs
  → Moto Genie, UniWifi, UniTelephony, etc.
  → NO user app, NO GMS, NO third-party

MANAGE_VIRTUAL_MACHINE (development|privileged|signature)
  → Priv apps + Longcheer-signed apps
  → Full lifecycle control (start, stop, inspect)

DEBUG_VIRTUAL_MACHINE (signature)
  → Longcheer-signed apps only
  → Introspection (debugListVms)

Result: The virtualization layer is a closed system accessible
only to Longcheer's own components. No external party can launch,
inspect, or interact with a VM.

---

IVirtualizationService — 4 operations

Code	Method	Purpose
1	createVm(config, fd, fd)	Launch VM → returns IVirtualMachine
2	initializeWritablePartition(fd, size, type)	Prepare VM disk
3	createOrUpdateIdsigFile(fd, fd)	VM identity attestation (Longcheer-controlled)
4	debugListVms()	List running VMs

createOrUpdateIdsigFile is the cryptographic identity of the VM.
Without a valid IDsig, the VM cannot establish trust with the host
or TEE. Longcheer controls IDsig generation (runs in
VirtualizationService, signed by Longcheer).

---

What the smalis confirm (and don't)

Confirmed standard AOSP (no ODM modification detected)

• `VirtualM...

v1.0 Passpoint Auto-Join: Confirmed in Smali

Passpoint Auto-Join: Confirmed in Smali

Class: UniWifiCarrierNetworkManager
Package: com.unisoc.wifi (UID 1000, process="system")
Source: UniWifiCarrierNetworkManager.java

Mechanism

The class implements dual-path WiFi network pre-configuration:

1. Modern path (Android 10+): WifiNetworkSuggestion with
   setIsInitialAutojoinEnabled(true) → device auto-connects without user
   prompt or consent.

2. Legacy path (Android < 10): WifiConfiguration + addNetwork() +
   enableNetwork() → same effect (UID 1000 bypasses permission checks).

Passpoint Profile Construction (createPasspointConfig)

Field	Source	OTA-updatable?
FQDN	securityArray[0] (carrier config or hardcoded resources)	Carrier config: ✅ / Resources: ❌
FriendlyName	securityArray[1]	Same
IMSI	Device SIM (TelephonyManager)	❌ (physical)
EAP Type	securityArray[2] (integer)	Same
Realm	securityArray[3]	Same

The profile uses SIM credential (not certificate) — the device
authenticates to the Passpoint network using its IMSI. This means:

• The Passpoint network is tied to the subscriber identity (IMSI)
• A device with a Telcel SIM will auto-join Telcel Passpoint networks
• A device with a Tigo SIM will auto-join Tigo Passpoint networks
• The carrier can change FQDN/realm/EAP via carrier config OTA (no FOTA)

Carrier Gate (isCarrierIdMatch)

The class only acts for carriers in mUniWifiCarrierIds (a string array
from resources, 0x7f010000). If the SIM's carrier ID is not in the list,
loadCarrierConfig() is a no-op.

Implication: The carrier config OTA vector only affects devices with
SIMs from carriers in the whitelist. For kiosk devices (WiFi-only, no SIM),
only loadUniWifiConfig() (hardcoded resources) applies.

Boot Sequence (confirmed)

UniWifiController.handleBootCompleted()
→ UniWifiCarrierNetworkManager.handleReceiveBootCompleted()
→ lambda$0()
→ loadUniWifiConfig() [hardcoded SSIDs from resources]
→ loadCarrierConfig() [carrier SSIDs from CarrierConfigManager]

Both are called immediately in the constructor (via handleBootCompleted()),
not on BOOT_COMPLETED. Pre-unlock, pre-user-interaction.

Forensic Verification

# Check active network suggestions (auto-join)
dumpsys wifi | grep -A5 "NetworkSuggestion"
dumpsys wifi | grep "isInitialAutojoinEnabled"

# Check Passpoint profiles
dumpsys wifi | grep -A30 "Passpoint"

# Check carrier config (what SSIDs the carrier pushes)
content query --uri content://telephony/carrier_config | grep -i "wifi\|ssid\|passpoint"

# Check if carrier ID matches
getprop | grep -i "carrier_id"
# Compare against mUniWifiCarrierIds (decompile resources.arsc)

**Full Changelog**: https://github.com/lexs201992-gif/System_App_Control/commits/v1.0