Reclaiming a cheap RK3229 TV box: Adups adware backdoor → Armbian on eMMC

[bigtower17]

Used REA to inventory a junk "MXQ PRO" (really an RK3229, not the box the label implies) over ADB and go down its Android/JADX path to decompile the stock ROM. Full write-up and tools: https://github.com/bigtower17/mxqpro-rk3229

Highlights

• Adups FOTA preinstalled, running as UID system: silently installs advertiser APKs via pm install -r, disables package_verifier, and exfiltrates IMEI/MAC. The server URLs are built character-by-character so they don't show up in a string scan.
• Reversible debloat + hosts-based blocking.
• 32-bit RetroArch, plus a small userspace driver for an Xbox One / GIP pad (NACON) that the 3.10 vendor kernel can't handle — claims the USB interface via usbdevfs, sends the GIP init sequence (the pad's LEDs only light up after this), and re-exposes it through uinput as an Xbox 360 pad.
• Replaced Android with Armbian/Ubuntu on the eMMC via the Multitool, using a bash /dev/tcp trick to stream the image straight onto /dev/mmcblk2 when the minimal rescue environment had no wget/curl/busybox.

Thanks for REA — the ADB device inventory and the jadx-headless-mcp provider pointer were the quick way in.