DivestOS: long term device support with enhanced privacy and security

Yep, factory reset and “wipe cache/smth. else” checkboxes.
It’s evidently booting to some degree, but something probably gets in the way.
Next time I’ll try to catch some info via adb or built-in recovery tools, hopefully after some digging.

@thallium-doped
Relevant for crackling:

Can you confirm you have the latest Cyanogen firmware installed along with the DivestOS recovery?

Google Pixel 2 XL (taimen)

Starting point was
Stock Android 10.0.0 (QQ3A.200805.001, Aug 2020) & divested-17.1-20210208-dos-taimen.zip

DOS- installer overwrites the previously installed TWRP Recovery 3.5.0_9-0 with DivestOS Recovery. The boot process starts with the animated DivestOS logo. The system setup is completed in a quick run. Now lock the boot loader. No sooner said than done - and the system does not start without a locked boot loader as before - but ends in a bootloop with the screen message on Pixel 2XL display:

Can’t find valid operating system.
The device will not start.

As soon as I unlock the bootloader again,Pixel 2XL boots as usual and without incident.

The same Pixel 2XL
with CalxyOS 11 or GrapheneOS 11 boots without failures with ‘Verified Boot’ and ‘Locked Bootlaoder’.

What can I do to make a ‘Verified Boot’ with ‘Locked Bootlaoder’ possible?

@fossys
I’ve yet to get around to documenting that, as I haven’t even tested an AVB device myself yet.
You need to run these commands:

wget "https://divestos.org/builds/LineageOS/taimen/avb_pkmd.bin";
fastboot erase avb_custom_key;
fastboot flash avb_custom_key avb_pkmd.bin;

Edit: They are now shown on the downloads page.

@SkewedZeppelin
Great! :key: Bootloader is LOCKED, Device reboot into DivestOS

fastboot logs
fastboot erase avb_custom_key
Erasing 'avb_custom_key'                           OKAY [  0.021s]
Finished. Total time: 0.026s

fastboot flash avb_custom_key avb_pkmd.bin
Sending 'avb_custom_key' (1 KB)                    OKAY [  0.002s]
Writing 'avb_custom_key'                           OKAY [  0.015s]
Finished. Total time: 0.029s

fastboot flashing lock
OKAY [  4.867s]
Finished. Total time: 4.869s
fastboot oem device-info
fastboot oem device-info
(bootloader) Verity mode: true
(bootloader) Device unlocked: false
(bootloader) Charger screen enabled: true
OKAY [  0.020s]
Finished. Total time: 0.020s
Screenshots

1 Like

@SkewedZeppelin

Why are devices OnePlus 5 (cheeseburger) and 5T (dumpling) with DOS 17.0 / 10.0 / Q are broken?

Do devices OnePlus 5 (cheeseburger) and 5T (dumpling) with DOS 16.0 / 9.0 / Pie also need this file >
avb_pkmd.bin’ (?)

I would like to try both OSes on both devices.

cheeseburger/dumpling are broken?

I haven’t managed to figure that out yet, but I don’t have my hands on one right now.
I suspect it to do with removing a blob I shouldn’t of.
16.0 works however.

also need this file ‘avb_pkmd.bin’ (?)

All devices on the downloads page that need it have it now.
In this case, cheeseburger and dumpling do not support “Android Verified Boot 2.0”.

Nice to hear your taimen locked and booted!

I’m pleased for you too. Good work :fu: Congratulations :clap:

@SkewedZeppelin,
I can confirm today that your work is crowned with success: The bootloader is re-locked.

OnePlus 5T (dumpling)

Starting point was:

  • Stock Android Oxygen 9.0.11, Build number OnePlus A5010_43_200224,
  • recovery divested-16.0-20210207-dos-dumpling-recovery.img
  • divested-16.0-20210207-dos-dumpling.zip

Installation was done exactly as described in the Lineage wiki.
Re-locking the bootloader was done as planned.

Install Logs
adb reboot bootloader

fastboot devices
e??????d        fastboot

fastboot flash recovery divested-16.0-20210207-dos-dumpling-recovery.img
Sending 'recovery' (25265 KB)                      OKAY [  0.687s]
Writing 'recovery'                                 OKAY [  0.234s]
Finished. Total time: 0.953s

adb devices
List of devices attached
e??????d        sideload

adb sideload divested-16.0-20210207-dos-dumpling.zip
Total xfer: 2.00x

adb shell
OnePlus5T:/ $ exit

adb reboot bootloader

fastboot devices
e??????d        fastboot
Unlocked | Re-Locked Logs
UNLOCKED
fastboot oem device-info
(bootloader) Verity mode: true
(bootloader) Device unlocked: true
(bootloader) Device critical unlocked: false
(bootloader) Charger screen enabled: true
(bootloader) enable_dm_verity: true
(bootloader) have_console: false
(bootloader) selinux_type: SELINUX_TYPE_INVALID
(bootloader) boot_mode: NORMAL_MODE
(bootloader) kmemleak_detect: false
(bootloader) force_training: 0
(bootloader) mount_tempfs: 0
OKAY [  0.031s]
Finished. Total time: 0.031s

fastboot flashing lock
OKAY [  0.047s]
Finished. Total time: 0.047s

RE-LOCKED
fastboot oem device-info
(bootloader) Verity mode: true
(bootloader) Device unlocked: false
(bootloader) Device critical unlocked: false
(bootloader) Charger screen enabled: true
(bootloader) enable_dm_verity: true
(bootloader) have_console: false
(bootloader) selinux_type: SELINUX_TYPE_INVALID
(bootloader) boot_mode: NORMAL_MODE
(bootloader) kmemleak_detect: false
(bootloader) force_training: 0
(bootloader) mount_tempfs: 0
OKAY [  0.047s]
Finished. Total time: 0.047s

fastboot reboot
Rebooting                                          OKAY [  0.000s]
Finished. Total time: 0.000s
Pics

Good work :fu: Congratulations :clap:

2 Likes

Hi, this DivestOS sounds interesting. I just got my hands on a Galaxy Tab A (2015) with Android 7.1.1 on it. Tell me if their is something that I might be able to do with it and/or how I might be about to contribute in a small way to testing compatibility on such a device.

Ideally I would not need to go through any Cloudflare or BigTech infrastructures on this journey.

I’m fairly inexperienced with Custom-ROMing so you will need to talk/type a bit slower than you normally might. I’m also open to any FOSS OS, so if you are not confident that I can DivestOS it, throw me in some other general direction. Phonecalls not important. WiFi, photos, video, audio, FDroid, Orbot, I2P, TorBrowser, Fediverse, XMPP are important to me. Thanks in advance.

@mouser

There is no official LineageOS support for that device, and by extension DivestOS.

There are a small handful of ROMs for that device here:

This one looks fairly sane after a cursory look:
https://forum.xda-developers.com/t/lineageos-17-1-for-sm-t580-gtaxlwifi.4059571/

@fossys
I will try to fixup 10.0 for cheeseburger/dumpling soon.
Thank you for testing

Thanks @SkewedZeppelin !

Yes that one doesn’t look too bad. XDA are Cloudflare but might be able to work something out. Thanks again.

SkewedZeppelin

I definitely know that cheeseburger/dumpling works with Verified Boot and Locked Bootloader on OS 10.0. I did it myself with another customROM after finishing the test with your DivestOS 9.0. Bootloader and critical partitions are re-locked (!)

You’re a genius coder. You’ll get there.

1 Like

@fossys
I am confident in my abilities, but I am no genius.

2 Likes

@SkewedZeppelin
Someone made a LineageOS 14.1 ROM for Jelly Pro (Mediatek). Could you use that as a start, to make a DivestOS ROM for it? Even better, a newer version or less buggy camera or RIL?

https://samarv-121.github.io/lineageos-14.1-jellypro/

@SkewedZeppelin, call it what you like.

A genius is someone who has exceptional skills, knowledge and the ability to develop and express new ideas. This is called creativity, creative activity.

However, when I see how many devices you have been supporting for months and how many of them still have the ‘Status : Untested’, I can see your will and spirit. But I wish you would use your talents more efficiently.

@anon46495926

Someone made a LineageOS 14.1 ROM for Jelly Pro (Mediatek).

Last update 3 years ago.

SELinux disabled, not even permissive.

No camera.
No cellular.

There are far better used devices you can get, such as a 1st gen Google Pixel… I’ve seen them as low as $60 recently.

1 Like

A Jelly Pro is already in inventory since the Kickstarter. :smiley: Other than a ton of usual bloatware plus China spyware, it’s a great little device, if you don’t expect too much from the camera, screen or speaker. And the more you disable, the longer battery life gets! I wonder if China gets reports on OTA FM stations listened to… Sigh. It’s sad to pull the removable battery again and put it back into storage for a couple more years, but Thanks for considering it!

Hello,
Nexus 10 tablet can be flashed with the latest divestOS 14.1 ROM and recovery.
It works retaining a good battery life as a [comic] book reader
as long as one does not connect it to network
(attempts to connect it to network via bluetooth tethering also failed)
in which case the device performs soft restart.
Nexus10_logcat.zip (32.0 KB)

Audio won’t play though neither speakers nor through jack:
Nexus10_audio_logcat.zip (54.8 KB)

Movies will play with no sound at a crawling frame rate:
Nexus10_movie_logcat.zip (51.4 KB)

And shuttered pixel dungeon will take some time to respond to a touch or to load events.
Nexus10_game_logcat.zip (56.1 KB)

Hope this helps.

1 Like

Samsung Galaxy S5 (klte) : DivestOS 18.1 / 11.0 / R / EXPERIMENTAL

When I think of the initial difficulties DivestOS : S5 ‘klte’, the progress since the acquisition of the personal device for the developer is clearly noticeable. No bootloops now.

DivestOS Mobile 18.1 / 11.0 / R / EXPERIMENTAL runs smoothly. The internal memory expansion via microSD card works right away. Apps can be moved. Only time will tell if all apps will work in the long run. Congratulations, good work @SkewedZeppelin.

1 Like