Skip to content

v4.0, MotoSetupWizard, first-boot, ad-enrollment, complete

Choose a tag to compare

View all tags
@lexs201992-gif lexs201992-gif released this 12 Oct 10:08
· 42 commits to main since this release
Immutable release. Only release title and notes can be modified.
v4.0
7de58b6
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v4.0 — MotoSetupWizard: ODM First-Boot Provisioning Gate & Ad Platform Enrollment

What's new

  • MotoSetupWizard/ — Complete decompile + XML scripts of /system/priv-app/MotoSetupWizard/
    • 25 wizard script XMLs (main flow + 24 sub-flows)
    • moto-settings.jar (ODM ContentProvider: Global/Secure/System)
    • MotoFinishActivity (the gate: checkin + clearAllActvity)
    • TaboolaWrapper / GlanceWrapper / ApnSettingWrapper (carrier-gated ad activation)
    • connect_and_update_flow.xml (CCC OTA injection before GMS checkin)
    • Longcheer evidence: developer names, internal tickets, com.longcheer.android.gmsintegration resource

Architecture documented

  • 26-step main flow (14 ODM-injected = 54%)
  • 7 ODM triggers (OEM_PRE/POST_SETUP, Glance, Taboola, PAKS, CCC OTA, MOTO_FINISH)
  • Silent ad enrollment: Glance (InMobi) + Taboola — carrier-gated, NOT user opt-in
  • PAKS: carrier financing lock via DPM (BIND_DEVICE_ADMIN)
  • CCC OTA: forced FOTA before user reaches home screen
  • moto-settings.jar: ODM key-value store (survives reboot, FOTA-updatable)

The "gate" confirmed

Setup Wizard completes
→ oem_post_setup (step 12)
→ com.longcheer.android.gmsintegration receiver
→ UnisocProxyManagerService activated
→ IUnionPnP profiles loaded
→ rkpdapp PeriodicProvisioner starts
→ UniWifiApp / UniTelephonyApp / RadioInteractorApp activate
→ taboola_setting (step 22)
→ com.taboola.ody.action.START_OOBE
→ paks_financed_setup (step 23)
→ com.motorola.paks.action.financed_setup
→ moto_finish (step 24)
→ MotoFinishActivity.loadNext()
→ setValueForCheckin("suw_onb", "dev_act", "sc_ls")
→ clearAllActvity()
→ ODM control surface:

Research complete

v1.0 → v4.0 covers the full lifecycle:

  • v1.0: What runs (apps, Passpoint)
  • v2.0: How it's isolated (APEX, VINTF, TEE, EL2)
  • v3.0: How it controls (framework extension, HALs, kernel)
  • v4.0: When it activates (first-boot gate, ad enrollment, ODM trigger)

NOT a CVE. NOT an exploit.

Architecture documentation of ODM control surface.
All components are legitimate vendor features.

MotoSetupWizard (com.ape.setupwizard) — ODM First-Boot Provisioning Gate & Ad Platform Enrollment

"The party starts here." — The wizard is the invitation. The ODM is the host.
The user never sees who's in charge.

Full Changelog: v3.0...v4.0

Assets 12
Loading