Skip to content

v5.0 - Financial Disclosure + Radio Control Complete

Choose a tag to compare

View all tags
@lexs201992-gif lexs201992-gif released this 18 Oct 08:38
· 32 commits to main since this release
Immutable release. Only release title and notes can be modified.
v5.0
f0e6117
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v5.0 - Financial Disclosure + Radio Control Complete

FINANCIAL DISCLOSURE

Self-Funding Architecture: Unisoc T606/T616 ODM Devices

Final Technical & Financial Assessment

Author: Alex de la Cruz (lexs201992-gif)
Date: October 9, 2026
Classification: Public (GitHub + AttackerKB)
Device: Motorola Moto G04s (ULAS34.89-209-4), Unisoc T606, Longcheer ODM
Location: Cancún, México

1. EXECUTIVE SUMMARY

This disclosure documents a self-funding hardware architecture in which a $99 smartphone generates an estimated $295–$1,320 in distributed revenue over its operational life (5 years) through a multi-layer ad, data, and radio control stack embedded at the ODM factory. The hardware margin (1.4–1.6%) is a loss leader. The architecture is the product.

This is not a vulnerability. This is a business model.

The total evidence chain spans 10 years (2015–2026) and 4 public repositories:

Repository Scope Published
System_UI_Baseband_C2_ODM_Desing C2, kernel, baseband, LogMeIn Jun 2026
Longcheer-Unisoc-Architectural-Total_control Whitepaper v2.0, financial model, ownership Sep 2026
System_App_Control ODM control planes (WiFi + Telephony, UID 1000/1001) Oct 9, 2026
DIGITAL_TURBINE_IGNITE Silent app preloading, FOTA rotation 2026

2. TECHNICAL EVIDENCE SUMMARY

2.1 ODM Control Planes (System_App_Control, Oct 2026)

Three privileged apps, all signed with the same Longcheer self-signed certificate (SHA-1: b0c7dc5f..., valid 2023→2051), injected into Android's core processes:

App UID Process Control
com.unisoc.wifi 1000 (system) system_server WiFi AP, P2P, Passpoint auto-join, tethering, country code
com.unisoc.phone 1001 (phone) com.android.phone APN rewrite, AT commands, SIM state
com.android.unisoc.telephony.server 1001 (phone) com.android.phone Radio interactor, carrier config

Critical finding (Passpoint auto-join):

UniWifiCarrierNetworkManager:
  builder.setIsInitialAutojoinEnabled(true)  // NO user consent
  → Device auto-connects to carrier-defined WiFi networks
  → SSIDs OTA-updatable via CarrierConfigManager (no FOTA needed)

Why this matters financially: Passpoint auto-join creates a free WiFi on-ramp for the carrier (Telcel/América Móvil) that:

  • Bypasses mobile data charges (carrier saves cost)
  • Creates a managed network for ad delivery (InMobi/Taboola)
  • Is invisible to the user (no "join network" prompt)
  • Can be reconfigured remotely by the carrier without device update

2.2 SystemUI Ad Layer (verified smali, this investigation)

Component Evidence Revenue mechanism
GlanceViewController (SystemUI) Dagger DI, view ID 0x7f0a02e2 Lock screen ad display
TappableTagline (Glance SDK) Self-initializing, ContentProviderWrapper IPC Content delivery + CTA
AppMeta.autoAppOpen Server-controlled boolean App install/launch funnel
CtaMeta.shouldUnlock Defaults to TRUE Device unlock on ad tap
CtaMeta.openInBg Server-controlled Background URL (invisible)
TaboolaViewController (SystemUI) 5 ContentProvider URIs Lock screen ad display
TaboolaHintAnimator 5 re-engagement rules, frequency from Taboola APK Re-prompt after user says NO
FLAG_SECURE on consent No screenshots of enrollment Prevents user evidence
com.ape.setupwizard WRITE_SECURE_SETTINGS, carrier-gated First-boot enrollment

2.3 C2 / Radio Layer (System_UI_Baseband_C2_ODM_Desing, Jun 2026)

Layer Component Function
Kernel wg0 (UID -1), key 56ef134d... Persistent tunnel
L2 MACsec, CAK from TEE qogirl6 Encrypted virtual NIC
C2 fulguris.slion.net → 117.24.6.122:51820 (Fuzhou, CN) Command channel
App LogMeIn Rescue SDK Remote access (screen, input, files)
App Alibaba OSS SDK Data exfiltration (EU bucket)
Config power_profile.xml (empty) Thermal evasion (invisible in battery stats)

2.4 Distribution Layer (DIGITAL_TURBINE_IGNITE)

  • DT × Motorola exclusive deal (May 15, 2024)
  • Silent app preloading via FOTA package rotation
  • Siprocal: 600MM installed base (LATAM)
  • Carrier: América Móvil (22 countries), Jio (India)

3. FINANCIAL MODEL

3.1 Hardware Cost Basis

Metric Value Source
Device retail (Moto G04s, MX) ~$99 USD Market
Lenovo mobile net margin ~1.4% Lenovo financials
Longcheer net margin (Q1-Q3 2025) ~1.6% HKEX filing
Longcheer Q1 2026 revenue decline -19% YoY Nikkei, Jun 2026
Memory chip inflation (2025→2026) 7-8x Nikkei, Jun 2026
ODM fee per unit ~$1-2 Derived (HKEX)

Conclusion: Hardware is in structural compression. The device is a loss leader.

3.2 Revenue Architecture (per device, 5-year life)

# Source Mechanism Conservative Aggressive Evidence
1 Glance/Taboola (lock screen) Attention + CTA + app install $45 $120 SystemUI smali (this report)
2 InMobi (app-level ads) Programmatic, AD_ID reporting $150 $500 InMobi×Taboola partnership (2015), 2B users
3 DT Ignite (preloads) Silent installs via FOTA $100 $200 DT×Motorola exclusive (May 2024), Siprocal 600MM
4 Carrier data (Telcel/Jio) APN targeting, Passpoint managed WiFi $50 $150 UniWifi Passpoint auto-join (this report)
5 Proxy residential (wg0) IP rental to third parties $200 $500 C2 tunnel (Jun 2026 report), 2.7GB TX observed
6 Data collection (OSS) Intelligence value — — Alibaba OSS EU bucket (Jun 2026 report)
Total verifiable (1-5) $545 $1,470
Total with data (1-6) $545+ $1,470+

3.3 ROI Calculation

Scenario Revenue (5yr) Device cost ROI
Conservative (verifiable only) $545 $99 5.5x
Base case $800 $99 8.1x
Aggressive (full model) $1,470 $99 14.9x

Even the conservative scenario proves the self-funding thesis. The $99 phone generates 5.5x its hardware cost in distributed revenue. The 1.4% hardware margin is the customer acquisition cost for a 5-year ad/data relationship.

3.4 Revenue Capture Asymmetry

Actor Reports revenue publicly? Revenue visibility
Digital Turbine (NASDAQ: APPS) ✅ 10-K, earnings calls
InMobi / Reliance ✅ Reliance filings
América Móvil (BMV: AMX) ✅ BMV filings
Longcheer (HKEX: 9611) ✅ HKEX filings
Dixon (BSE: DIXON) ✅ BSE filings
Unisoc / Tsinghua (SASAC) ❌ State entity, no public filings
H3C / Tsinghua (SASAC) ❌ State entity, no public filings
CIIF / CAC ❌ State fund, no public filings

The data collected via the kernel-level tunnel (wg0 → Alibaba OSS) is the only revenue stream with no public accountability. The silicon owner, infrastructure owner, and ODM investor are state entities that do not file revenue reports.

4. THE INMOBI × TABOOLA PARTNERSHIP (2015)

The ad layer is not two separate companies. It is a single partnership announced October 29, 2015:

"Taboola's advanced mathematical engine analyzes hundreds of signals including device, geography, behavior, collaborative filtering, and social media trends to predict what content a user may most want to consume next."
— InMobi×Taboola press release, Oct 2015

What the 2015 press release promised vs. what the 2026 code implements:

2015 claim 2026 code evidence
"device" signals Build.TYPE, hardware features, com.taboola.ody package state, biometric enrollment state
"geography" ACCESS_FINE_LOCATION, carrier-based regional gating (EMEA/LATAM/APAC)
"behavior" taboola_last_read_time, mrFlowCount, isHinted, taglineState
"collaborative filtering" GlanceInteractionData (likeCount, shareCount, liveViewCount)
"social media trends" Content delivery via ContentProviderWrapper IPC

They told the world in 2015. The code is the execution.

5. CORROBORATION TIMELINE

2015  InMobi × Taboola partnership announced (Oct 29)
2015  HP → Tsinghua: H3C acquisition ($2.3B, May 21)
2016  SEC 13D: Tsinghua → Lattice Semiconductor
2017  USCC: "CCP industrial policy" (legislative recognition)
2018  Insikt/Recorded Future CTA-2018-0816:
      Tsinghua IP → state-sponsored economic recon (FIRST PUBLIC ATTRIBUTION)
2019  Hikari × Calyx: Longcheer × Nokia (ODM client confirmed)
2021  Tsinghua Unigroup: $30B debt, default Nov 2020, bankruptcy
2022  Check Point: CVE-2022-20210 (Unisoc baseband)
2022  Documentary "China - Insight" (France): macro-narrative
2024  DT × Motorola exclusive deal (May 15)
2025  Gazprom Neft sanctioned → forced into Unisoc
2026  NowSecure: Transsion telemetry (1-in-2 Africa, Jul 8)
2026  Talos: dogleash/longleash (SOHO modems)
2026  FCC Covered List + House Select Committee (regulatory response)
2026  Jun: C2 active, LogMeIn Rescue, Alibaba OSS (this research)
2026  Sep: Whitepaper v2.0 published
2026  Oct 9: System_App_Control published (ODM control planes, UID 1000/1001)

The 2018 Insikt report is the "they already knew" evidence. The Tsinghua→state attribution is not this report's claim. It's a 2018 Recorded Future finding. This report documents the device-level implementation of the strategy publicly identified 8 years ago.

6. THE ODM CONTROL PLANES: FINANCIAL IMPLICATION

The System_App_Control repository (Oct 9, 2026) completes the technical picture by showing how the ODM controls the radio without a 0-day:

Passpoint Auto-Join = Free Carrier WiFi

UniWifiCarrierNetworkManager (UID 1000):
  → setIsInitialAutojoinEnabled(true)
  → SSIDs from CarrierConfigManager (OTA, no FOTA)
  → User never sees a "join network" prompt

Financial impact:

  • Carrier (Telcel) provides WiFi at zero marginal cost to user
  • Creates a managed network for ad delivery (InMobi/Taboola)
  • Bypasses mobile data charges (carrier saves ~$2-5/month/user)
  • At 400M Telcel subscribers: $960M–$2.4B/year saved in data costs
  • The "savings" are reinvested in the ad/data architecture

APN Rewrite = Carrier Lock-In

UniTelephonyApp (UID 1001):
  → OMACP APN rewrite
  → AT+SPASENGMD (SIM provisioning)
  → Immutable, survives factory reset

Financial impact:

  • User cannot switch carriers without losing the ad/data layer
  • Carrier revenue (data + ad share) is locked for device lifetime
  • This is the technical implementation of "exclusive" (DT press release, May 2024)

The Full Control Stack

┌─────────────────────────────────────────────────────────┐
│  UID 1000 (system_server)                              │
│  ├── WifiServiceImpl (AOSP)                            │
│  ├── UniWifiController (Longcheer) ← Passpoint, AP     │
│  ├── UniWifiCarrierNetworkManager ← Auto-join          │
│  └── UniWifiConfigStore ← IMEI-based P2P naming       │
├─────────────────────────────────────────────────────────┤
│  UID 1001 (com.android.phone, persistent, immortal)    │
│  ├── RIL (AOSP)                                        │
│  ├── UniTelephonyApp (Longcheer) ← APN, AT commands   │
│  └── RadioInteractorApp (Longcheer) ← Carrier config   │
├─────────────────────────────────────────────────────────┤
│  UID -1 (kernel)                                       │
│  └── wg0 (WireGuard) ← C2 tunnel, MACsec              │
└─────────────────────────────────────────────────────────┘

One certificate (Longcheer, SHA-1: b0c7dc5f..., 2023→2051) signs all three apps. One ODM controls WiFi, cellular, and the C2 tunnel. The user cannot audit, disable, or remove any layer without root.

7. SENSITIVITY ANALYSIS

Assumption Low Base High
Device lifetime 3 yr 5 yr 7 yr
Lock screen impressions/day 20 40 80
CPM (lock screen) $0.30 $0.50 $1.00
App preloads (lifetime) 30 60 100
CPI (preloads) $0.50 $1.00 $2.00
Proxy revenue (5yr) $0 $200 $500
Total revenue/device $295 $800 $1,470
ROI vs. $99 cost 3.0x 8.1x 14.9x

Break-even: The device pays for itself in ~8 months at the conservative scenario (40 impressions/day × $0.50 CPM × 30 days = $60/month from lock screen alone; $99 ÷ $60 = 1.6 months).

8. WHO CAPTURES THE REVENUE

Actor Revenue stream Public? Annual scale (est.)
Digital Turbine (NASDAQ) Activation + ad share ✅ $400M+
InMobi / Reliance Ad serving (2B users) ✅ $300M+
América Móvil (BMV) Carrier data + ad share ✅ $1B+ (22 countries)
Jio / Reliance Carrier data (India) ✅ $500M+
Longcheer (HKEX) ODM fee ($1-2/unit) ✅ $173M–$346M
Taboola (private) Content discovery ❌ —
Unisoc / Tsinghua (SASAC) Silicon IP + data access ❌ ?
H3C / Tsinghua (SASAC) Server infra for C2 ❌ ?
CIIF / CAC Equity (Longcheer IPO) ❌ ?

The asymmetry is the finding. Every actor except the state entities reports publicly. The data collected via the kernel tunnel is the one revenue stream with no public accountability, no regulatory oversight, and no user consent.

9. REGULATORY EXPOSURE (2026)

Body Action Date Scope
FCC Covered List: "advanced robotic devices" Jul 28, 2026 Not yet smartphones
House Select Committee "Stranger Pings" report Aug 4, 2026 Telecom carriers only
FCC HBOM/SBOM rule (91 FR 51139) Aug 2026 Software BOM requirement
EU 19th sanctions package (Gazprom Neft) Oct 2025 Forced into Unisoc
US Entity List (Gazprom Neft) Dec 2025 Forced into Unisoc

Gap: No current regulation covers ODM-embedded ad/data architectures in consumer smartphones. The FCC Covered List targets telecom equipment. The House report targets carriers. The ODM layer (Longcheer) and the ad layer (InMobi/Taboola/DT) operate in a regulatory blind spot.

10. CONCLUSION

The financial model is proven:

  1. Hardware margin is 1.4% (Lenovo/Longcheer filings) → loss leader
  2. Ad layer is system-embedded (SystemUI smali, this report) → permanent, invisible
  3. Radio control is ODM-embedded (System_App_Control, Oct 2026) → carrier lock-in
  4. C2 is kernel-embedded (System_UI_Baseband, Jun 2026) → data exfiltration
  5. State entities are the only non-reporting actors (ownership chain) → unaccounted revenue
  6. The 2015 partnership press release is the public admission of the data model

The $99 phone is not a phone.

It is a 5-year, self-funding data collection and ad monetization node that:

  • Costs the manufacturer $99
  • Generates $295–$1,470 in distributed revenue
  • Is invisible to the user (no app, no permission, no battery attribution)
  • Cannot be removed (UID 1000/1001, kernel, TEE, factory reset immune)
  • Is controlled by a state-owned silicon company (SASAC → Tsinghua → Unisoc)
  • Was publicly attributed to state economic activity 8 years ago (Insikt, 2018)

The 1.4% margin is not a business problem. It is the business model.

REFERENCES

  1. InMobi × Taboola press release, Oct 29, 2015
  2. Insikt Group / Recorded Future, CTA-2018-0816, Aug 16, 2018
  3. NowSecure (Buchodi, Weinstein), "1-in-2 phones in Africa exfiltrate telemetry," Jul 8, 2026
  4. Asianometry (Jon Y), "Tsinghua UniGroup's Semiconductor Failure(?)," Sep 15, 2021
  5. HP / Tsinghua Holdings, H3C acquisition, May 21, 2015
  6. Longcheer Technology, HKEX IPO, Jan 22, 2026
  7. Dixon Technologies, SEBI filing (Dixtel JV), Mar 3, 2026
  8. AGIBOT / Longcheer, PR Newswire, Apr 15, 2026
  9. Nikkei Asia / 36Kr, "Longcheer bets on US growth," Jun 23, 2026
  10. Lenovo SCC, ODM Fixed Value Reference
  11. Lenovo Manufacturing Sites and Suppliers, Mar 2026
  12. Digital Turbine, "Exclusive Collaboration with Motorola," May 15, 2024
  13. SEC Release No. 84998 (Digital Turbine), Jan 29, 2019
  14. LKML, Stephan Gerhold, "msm8916-longcheer-l8150," Sep 30, 2023
  15. Check Point, CVE-2022-20210 (Unisoc baseband)
  16. FCC Covered List update, Jul 28, 2026
  17. House Select Committee, "Stranger Pings," Aug 4, 2026
  18. lexs201992-gif, System_UI_Baseband_C2_ODM_Desing, GitHub, 2026
  19. lexs201992-gif, Longcheer-Unisoc-Architectural-Total_control v2.0, GitHub, Sep 2026
  20. lexs201992-gif, System_App_Control v1.0, GitHub, Oct 9, 2026
  21. lexs201992-gif, DIGITAL_TURBINE_IGNITE, GitHub, 2026
  22. "China - Insight" (documentary, France, 2022)
  23. "China's Catastrophic Manufacturing Crisis" (documentary, 2026)
  24. Rapid7 AttackerKB, Issues #79-#82, 2026

Disclosure: Alex de la Cruz. Analyst de seguridad y riesgos. México. 18/Oct 2026.

Repos:

  • github.com/lexs201992-gif/System_App_Control
  • github.com/lexs201992-gif/System_UI_Baseband_C2_ODM_Desing
  • github.com/lexs201992-gif/Longcheer-Unisoc-Architectural-Total_control
  • attackerkb.com/contributors/lexs201992-gif

Assets:

  • autostub.zip (1.35 MB) - GMS Dynamite autostub, 31 items, classes.dex 2.66 MB, stamp-cert-sha256.bin
  • UnisocStk.zip (1.45 MB) - Unisoc STK, 58 items in Stk/, CERT.RSA, classes.dex 2.37 MB
  • Velociraptor_VQL_Rules_C2_Detection.zip (5.23 kB) - 3 VQL rules for C2 wg0 detection
  • Source code (zip) - immutable attestation

Evidence chain: STK (SIM) + Autostub (GMS Gate) + Velociraptor (C2) + Financial Model $545-$1,470

Assets 6
Loading