Skip to content

Evidence manifest

Acquisition

The live dump was streamed over SSH without modifying the device. It contains 849 files.

Path Contents
firmware/live/usr/bin VK and stock executables
firmware/live/usr/lib shared libraries and runtime support
firmware/live/usr/share/voice-agent setup, LED, display, audio, and UX resources
firmware/live/etc/init.d stock boot scripts
firmware/live/etc/datamount UBI mount/recovery logic
firmware/live/etc/overlaymount overlay and pivot_root logic
firmware/live/etc/os-release userspace release metadata
firmware/live/etc/swupdate-public.pem OTA verification key
firmware/live/lib/modules kernel modules

firmware/manifest/live-files.tsv records each relative path, byte size, SHA-256, and whether the same path exists in the pre-jailbreak rootfs extraction.

Environment snapshots

  • firmware/manifest/uname.txt: Linux 4.9.113 on AArch64.
  • firmware/manifest/cmdline.txt: slot _a, SELinux enforcing, first-boot flag, device identity.
  • firmware/manifest/mtd.txt: eight MTD partitions with 128 KiB erase blocks.
  • firmware/manifest/mounts.txt: live filesystem layout.
  • firmware/manifest/boot-control.txt: active slot 0, both slots bootable, slot 1 offline.
  • firmware/manifest/ubi.txt: UBI device inventory.
  • firmware/manifest/usb.txt: FunctionFS adb endpoints and amlogic gadget directory.
  • firmware/manifest/processes.txt: running services.
  • firmware/manifest/listeners.txt: TCP/UDP listeners and owning processes.
  • firmware/manifest/cmdlines.txt: full process command lines.
  • firmware/manifest/usb-config.txt: configfs gadget properties.

These paths refer to raw evidence outside MkDocs source and are intentionally not web navigation links.

Acquisition scripts

  • firmware/manifest/acquire.sh: read-only userspace dump.
  • firmware/manifest/collect-env.sh: read-only environment snapshots.
  • firmware/manifest/hash_files.py: inventory and stock/live-only classification.