Methodology

Evidence classes

Every substantive claim uses one of these labels:

• Observed: direct device state, file contents, a log, or a captured command.
• Decompiled: a conclusion tied to a binary function or offset. Decompiler output is evidence, not proof by itself; call sites and runtime behavior are used to validate it.
• Inferred: a hypothesis consistent with the evidence. It is not presented as confirmed fact.
• Unknown: missing or contradictory evidence. The gap remains open rather than being filled with plausible fiction.

Sources

1. A read-only SSH dump from root@192.168.88.66.
2. The pre-jailbreak full NAND capture and its UBIFS/DTB metadata.
3. Live metadata: kernel command line, MTD table, mounts, UBI devices, boot slots, USB FunctionFS, and process list.
4. ELF strings, symbols, disassembly, and Hex-Rays output where needed.
5. The setup audio encoder recovered from the Android package and its native libADSSS.so.

The live unit runs a third-party root package. Files unique to it are marked live-only in the hash manifest and are not silently treated as stock VK code.

Safety and privacy

Acquisition commands are read-only. No partition, environment, service, or package changes are made on the Mini. Tokens, session secrets, Wi-Fi keys, and unrelated personal identifiers are excluded from narrative pages. A serial number is retained because it is needed to distinguish this unit from another Mini on the same network.

Paths and references

firmware/live/ mirrors absolute device paths. Thus /usr/bin/voice-agent becomes firmware/live/usr/bin/voice-agent. Function references use the file offset shown by the disassembler, for example voice-agent:0x16fd10.

The complete inventory is in evidence/manifest.