Q25 Toolbox v4.4.3

Two small fixes.

• Wireless ADB: turning it off now closes ADB over TCP completely (clears persist.adb.tcp.port, pins service.adb.tcp.port to -1, toggle off, restarts adbd). Before, the port could reopen after a reboot.
• Lockscreen PIN daemon follows the app toggles itself: with both off and root unreachable from the app, it no longer keeps typing the PIN. It reads the prefs and ends itself.

v4.4.2

Circle to Search is back (LSPosed, no separate module/app)

• Moved off the Zygisk module (it broke on Android 17: its native library links libc++_shared.so, which this ROM ships in no system path, so it never loaded into zygote) onto an LSPosed hook built into the app, scoped to the Google app only — it reports the Pixel 2023 Experience feature and the Pixel 8 Pro identity there, nothing global.
• The toggle in the app checks LSPosed status and hook health (handshake), like the Recents module. Launcher gesture flags and the test trigger are unchanged.

Recents Grid (LSPosed) fixed on LineageOS 24

• The two-row grid works again on the new launcher (versionCode 37): the launcher's isLargeScreen() getter is trivial and gets inlined by ART (bypassing method hooks), so the hook now forces the underlying field; new hotseat/masonry signatures; legacy targets kept and tried first on older ROMs.
• Grid (auto) self-heals back to the hook when the handshake recovers.

Also in this release

• QR Enlarger: native zxing-cpp fallback decoder for small/dense 2D codes (e.g. Renfe Aztec).
• AlwaysStrong version check accepts v1.0.5.
• Gesture hook proof file: fixed ENOENT on write.

Requirements: KernelSU + Vector (LSPosed), Q25 Toolbox module enabled, scope = Google app + launcher3. After updating the app, toggle the module off/on in Vector so new processes pick up the new build.

See CHANGELOG.md for details.

v4.4.1

GMS Sensor Guard (System tab, LineageOS only)

• Stop Play services' background sensor hammering: Google Play services keeps the accelerometer (at 50 Hz) and the ambient-light sensor registered in short continuous bursts from its location library (collectionlib), even when no app is asking for your position - a constant battery drain that shows up attributed to "Google Play services". This module revokes its ACTIVITY_RECOGNITION appop at the UID level. Measured on-device: location requests (network/GPS fixes) keep being served normally while the sensor bursts stop.
• ROM quirk handled: the package-level cmd appops set form is accepted but silently never applied on this ROM - only the UID form works, so the UID is resolved at runtime (it differs per device and per re-flash).
• Survives reboots: the appop does NOT survive a reboot on this ROM (observed on-device), so a one-shot boot script (/data/adb/service.d/gms_guard_boot.sh) re-asserts it at every boot. The switch state is always read back from the OS, never from a local pref, so adb-side changes are reflected.
• Background scanning toggles: the Wi-Fi and Bluetooth scanning switches from Settings > Location > Location services, plus an explanation of the trade-offs of the manual settings (Google Location Accuracy, Wi-Fi/BLE scanning, A-GPS).

Found by IvanTheTolerable (Discord).

See CHANGELOG.md for details.

v4.4

Circle to Search (System tab)

• Autonomous Zygisk Backend: Enjoy Google's Circle to Search without needing external LSPosed modules or companion APKs. Toggling the feature autonomously deploys a native Zygisk module and system permission declaration (/data/adb/modules/q25_cts) that spoofs Pixel 8 Pro system features for the Google App, and configures launcher device_config flags.
• Reliable System IPC: Triggered via Android's ContextualSearchManager binder IPC (service call contextual_search 3 i32 1), ensuring screen tokenization and avoiding "Circle to search is not available" errors.

QR / Ticket Enlarger (Screen tab)

• Instant Full-Screen Inspection: Quickly scan and enlarge QR codes, boarding passes, and barcodes (e.g. Renfe, train tickets) currently displayed on screen with a single hardware key press or gesture.
• Scanner-Ready Brightness: Automatically cranks screen brightness to maximum and bypasses Extra Dim for quick turnstile and gate scanning.
• Atomic Display State Restoration: Accurately restores prior brightness and Extra Dim settings the moment the overlay is dismissed.

Centralized Keyboard Shortcuts (Keyboard tab)

• Unified Configuration Hub: Replaced fragmented per-feature key remapping with a centralized screen under Keyboard > Keyboard Shortcuts. Map physical keys directly to any system action (Recents, Aspect Ratio, Rotation, Flashlight, Notifications, Extra Dim, Circle to Search, QR Enlarger).
• Key Mapper Helper Cards: Ready-to-copy broadcast intent parameters (com.kgr.q25toolbox.action.RUN) for effortless external mapping.

Input & Lockscreen Fixes

• Composer Enter Handling: Preserves natural newline formatting when pressing Enter in chat and messaging apps.
• Hardened Lockscreen Key Pinning: Improved root key event interception scripts on the keyguard.

See CHANGELOG.md for details.

v4.3.1

Changed

• 50 MP Rear Camera restricted to LineageOS: The 50 MP camera hotfix is now restricted exclusively to LineageOS. On ZinwaOS stock and other ROMs, the toggle is disabled and marked as incompatible, with a notice that support for ZinwaOS is in development.

See CHANGELOG.md for details.

v4.3

Advanced Settings & System Hotfixes (System tab)

A centralized diagnostics and system patcher dashboard for ROM and hardware quirks on the Q25, eliminating the need for standalone Magisk/KernelSU modules:

• 50 MP Rear Camera (Samsung S5KJN1): Enables full 50.1 MP (6144×8160) capture on the rear camera by patching MediaTek camera HAL libraries (libmtkcam_metastore.so, libmtkcam_3rdparty.mtk.so, libmtkcam_featurepolicy.so, cameraserver), deploying libremosaic_wrapper.so and hot-swapping imgsensor_isp6s.ko. Features clean daemon lifecycle handling (camerahalserver & cameraserver), node wait loops, and permission synchronization with ueventd (0660 system:camera) that persists seamlessly across cold reboots.
• AlwaysStrong / KeyMint TEE Crypto Fix: Patches TEESimulator (tee_classes.dex) to resolve KeyMint hardware-backed attestation failures (PKCS#8 RSA key import and RSA-OAEP with MGF1/SHA-224 digest). Includes runtime crypto capability probing, process liveness monitoring, and seamless revert to stock.
• Bluetooth Audio HAL Fix: Replaces legacy MTK audio HAL with 84-byte source_metadata_v7 compatible library (audio.bluetooth.default.so) via Hybrid Mount VFS to fix Bluetooth audio crashes on AOSP/LineageOS.
• Vector dex2oat Bind Mount Stealth: Eliminates Vector root detection traces from /proc/*/mountinfo across all namespaces (including Android 17 zygote_next) using Hybrid Mount VFS redirection and KernelSU kernel_umount.
• Unified Boot Service: Reconciles persistent hotfix injection cleanly into /data/adb/service.d/q25_hotfixes_boot.sh on toggle change and during daemon maintenance.

See CHANGELOG.md for details.

Q25 Toolbox v4.2

Forced Rotation (Screen tab). Lock the screen to portrait, landscape, reverse portrait or reverse landscape, or to auto-rotate, for all apps or per app. An optional switch makes apps that declare their own orientation obey the lock. Your own auto-rotate setting is saved and restored when you go back to System, on service teardown and after a restart. Translated into all eight languages. Checked on a Q25 on Android 17 (Lineage 24).

Fixed: the native bottom swipe-up could not be switched off on the Android 17 launcher (Launcher3 versionCode 37), because the launcher moved the method the hook attached to. Older launchers behave as before. Confirmed on the device.

See CHANGELOG.md for details.

Q25 Toolbox v4.1.5

Fixes for key remapping and Call Proximity Sleep, and a root path for the lockscreen PIN keys. Installs as an update over 4.1.x.

Fixed

• Key remapping did not switch off, and could leave the keyboard unregistered. Since 4.1.4 turning the remap off never unmounted anything (nsenter ... umount -l fails: toybox reads -l as its own option), so the key stayed remapped until a reboot. Each apply also stacked one more bind, and two quick applies could kill the keyboard reload halfway. All three are fixed, and the debug log now records what system_server sees after each apply.
• Call Proximity Sleep did not wake a screen the system had blanked. The system turns the screen off for proximity but is slow to bring it back (the dialer releases its lock 1.6 to 1.8 s after "far") or fails to. The module now wakes on "far" whoever blanked the screen, in two steps, and after hang-up it keeps listening for up to 30 s: wake at once if you are already away from the ear, otherwise wait for the first "far".

Changed

• PIN on keyboard has a root path. A daemon types W E R / S D F / Z X C as 1 to 9 into the PIN pad, also before the first unlock after a boot (the accessibility service cannot run then). With root it takes over the digits; without root nothing changes. Enter and Delete on the pad stay with the system.
• The accessibility service asks for key events only when something can use them (resolution hotkey, Recents overlay key, IME suggestion shortcuts, lockscreen features while locked, per-app fixes while their app is in front). Meant to reduce sticking or repeating keys in heavy apps. Not yet measured.

Not verified: the post-hang-up wake and the key-filter change have been tried on one Q25 (LineageOS 24, Android 17) only.

Q25 Toolbox v4.1.4

Root detection stealth for key remapping

• The hardware key remapping bind mount (Q25_keyboard.kl) is now isolated exclusively inside system_server's mount namespace (nsenter -t $SS_PID -m) with slave propagation rather than the global master namespace (su -M).
• This prevents root and integrity checkers (such as Native Detector and Duck Detector) from detecting a suspicious mount on /vendor/usr/keylayout/Q25_keyboard.kl in untrusted app processes, while EventHub continues to receive the remapped hardware layout seamlessly.

Full changelog: CHANGELOG.md

Q25 Toolbox v4.1.3

Two finished features that had not been released

Merged from two separate branches on top of 4.1.2. The result builds and passes its unit tests (71 in total). The merge itself was not re-tested on the device beyond installing it and checking that the service starts.

Resolution hotkey (Screen > Per-app display scaling; off by default). A global key combination steps the whole screen through an ordered list of resolutions and back to the default; with one resolution it is a toggle. Combination: left or right Ctrl, Alt, Shift or Meta plus a letter or digit, default Right Shift + R. Short press, or held for 0.5 s; in the held mode a quick tap is typed again on release (input keycombination through root, ignoring events from virtual devices so it never reacts to itself). It wins over the per-app targets, survives the screen turning off, vibrates with the Edge Gestures pulse and shows a toast. Included in backups.

Material You colours for the edge-gesture arrow (Android 12+). Each of the three arrow colours can come from the Material You palette by family and tone (accent1:500 and so on), stored as a reference and resolved when a gesture starts, so it follows the wallpaper. A fixed swatch or a hex value clears the reference. Included in backups.

Note for LineageOS: a display-size change is what used to bring back the BlackBerry keyboard's full keyboard before 4.1.2. Keep Keyboard > BlackBerry keyboard strip on if you use the resolution hotkey.

Updates install over 4.1.2 and keep your settings. Both features are off or unchanged until you use them.

Full changelog: CHANGELOG.md