Is my Android device booting into a "stealth" partition?


Question

OK, this is a weird problem I’m encountering with an Android system I’ve been using without problems for several years now… and I’m practically out of ideas on how to potentially fix it.



Let’s start at the beginning to describe the problem and what I’ve been trying for the past 12 hours.



I woke up to my device this morning seeing that a recently installed app (via Google Play store) had crashed, and obviously a truckload of other apps and services also showed a hickup too.




  1. I decided to simply uninstall it and reboot my phone (clearing the Dalvik cache while I was at it to avoid any hickups). The system booted as usual, but I noticed the app I just uninstalled is still there. Tried again, same result.


  2. Knowing I have a 5-day old TWRP backup, I decided to restore that to get back to my old system state. Done, wiped Dalvik cache and rebooted. No success, the old system (with the app that shouldn’t be there) boots up. So, that TWRP backup wasn’t a solution.


  3. Crying a silent tear, I decided to whipe all partitions via TWRP and simply reflash the ROM from scratch. Rebooted… and to my surprise the old system showed up (incl. wallpaper, settings, and that one weird app et al.)


  4. Not wanting to give up, I even tried to install another ROM. TWRP confirms this succeeds. But rebooting again ignores every system change and boots that darn old OS (incl. settings and apps – which shouldn’t exist due to a factory reset.)


  5. Getting a bit upset by all this I said to myself – OK, I’ll wipe all partitions and reboot. Having no OS the device should not boot at all, confirming I got rid of whatever messed up my device. Booted into TWRP, whiped ALL partitions listed (including the external SD). I confirmed this worked by using the TWRP file manager to check on the contents of every partition available. They are all empty. I was convinced this was going to work and my device would hickup due to a missing OS. So, I rebooted… and whoops, the device again boots into the system (with that app, the old wallpaper, etc.) Logic says this can’t be – since all partitions are empty.




Long story short: I meanwhile tried about every trick in my bag to get rid of the old OS, but no matter what I do – I can’t. Whiping, flashing, etc. doesn’t seem to change the fact the phone happily boots into an OS that – according to the TWRP file manager – doesn’t exist.



Now, I’m out of ideas on how to fix it. It’s almost as if I’m fighting some "hidden/stealth" partition which gets booted into. As said: this even happens when I whipe all partitions (System + Cache + Data + Internal Storage + Micro SD card) followed by a Format Data) and then reboot.



Meanwhile, I’m starting to suspect the last app I installed via the Google Play store might have been malware. But that shouldn’t result in a bootable OS after a complete device whipe.




  • Can it nevertheless be that my Android device boots into a "stealth" partition? If, how can I get rid of it when I can’t see it via TWRP?

  • Is there any way to hard-format and repartition the internal SDs and recreate the partitions besides TWRP’s functionality? (In case there’s some problem with one of the partitions, which TWRP doesn’t actually whipe.)

  • Or (which would really make my day) has anyone ever experienced something alike and has a solution which might help me fix this by getting rid of the old OS which the device seems to detect who-knows-where and happily boots up?



EDIT



Since a comment asked for some version details et al:




  • Device is a Samsung GT-P3100, aka espresso3g

  • TWRP 3.2.1-0

  • Rom that is (let’s just call it) “non-killable” is SlimKat. To be more specific



    Slim-4.4.4.build.9.0-OFFICIAL-8293



Looking at things again and again it seems TWRP fails to correctly whipe one or more partitions (System, Data), even though there is not a single error message or warning when doing so.



I also tried erasing all partitions as well as the internal storage and flash lineage-13.0-20180211-nightly-espresso3g-signed, which results in an error 7 (rebooting the same darn “non-killable” SlimKat).



Same goes for trying to erase all partitions as well as the internal storage and flash Slim_espresso3g-6.0.1-20180414-1959, which results in an error 7 (rebooting the same darn “non-killable” SlimKat).



Also, it might be helpful to know I have another espresso3g device available, which doesn’t show any similar problems. On that other device, I can flash, whipe, backup, recover, and consequently successfully boot into the related ROM as expected.



Therefore, I’m suspecting there’s something wrong with one or more partitions, which also prevents TWRP from correctly formatting in contrast to its claims. Even using the TWRP terminal and being crazy enough to try rm -rf /data/* and rm -rf /system/* seemed to work at first glimpse. Yet, the partition contents simply shows up on reboot as if nothing happened. Another indicator it might be some partition hickup is that – any change to any setting or even starting any app in the booting “non-killable” SlimKat results in the whole OS collapsing piece by piece until the device reboots into recovery.


Answer

Seems I’ve found the answer at https://andi34.github.io/faq.html



Quote:




I can't change my rom, wipe / format doesn't work. Nothing changed after flashing with Odin.
16 GB Tab 2 have a known faulty EMMC (MAG2GA). It can happen, that your EMMC get “read only”, so you can’t perform any write actions (also you can’t format) anymore.



From the EMMC data sheet:




5.1.7 End of Life Management:



The end of device life time is defined when there is no more available reserved block for bad block management in the device. When the device reaches to end of its life time, device shall change its state to permanent write protection state. In this case, write operation is not allowed any more but read operation are still allowed.




But, reliability of the operation can not be guaranteed after end of life.



On a faulty EMMC firmware it happens a lot faster.



What are the symptoms?




  • Uninstalled apps and deleted files are back after a reboot

  • Formating the storage doesn’t work (after reboot the old rom and apps are back)

  • You can flash whatever you like via Odin

  • it showes “passed” but after reboot nothing changed (e.g. still no StockRom or still the old Recovery you had previously installed)



… there might be some more, but only to mention some …



In most cases, the issue can be fixed by a EMMC firmware update, but you need someone who’s able to do it (possible via ISP, nothing you can do esylie at home yourself). In some bad cases you need to find someone who can replace your EMMC.




Well, that’s that then. Obviously I will have to buy myself a new device first thing in the morning, after crying a river all the way to the bank while blaming Samsung for its End of Life Management.


Topics


2D Engines   3D Engines   9-Patch   Action Bars   Activities   ADB   Advertisements   Analytics   Animations   ANR   AOP   API   APK   APT   Architecture   Audio   Autocomplete   Background Processing   Backward Compatibility   Badges   Bar Codes   Benchmarking   Bitmaps   Bluetooth   Blur Effects   Bread Crumbs   BRMS   Browser Extensions   Build Systems   Bundles   Buttons   Caching   Camera   Canvas   Cards   Carousels   Changelog   Checkboxes   Cloud Storages   Color Analysis   Color Pickers   Colors   Comet/Push   Compass Sensors   Conferences   Content Providers   Continuous Integration   Crash Reports   Credit Cards   Credits   CSV   Curl/Flip   Data Binding   Data Generators   Data Structures   Database   Database Browsers   Date &   Debugging   Decompilers   Deep Links   Dependency Injections   Design   Design Patterns   Dex   Dialogs   Distributed Computing   Distribution Platforms   Download Managers   Drawables   Emoji   Emulators   EPUB   Equalizers &   Event Buses   Exception Handling   Face Recognition   Feedback &   File System   File/Directory   Fingerprint   Floating Action   Fonts   Forms   Fragments   FRP   FSM   Functional Programming   Gamepads   Games   Geocaching   Gestures   GIF   Glow Pad   Gradle Plugins   Graphics   Grid Views   Highlighting   HTML   HTTP Mocking   Icons   IDE   IDE Plugins   Image Croppers   Image Loaders   Image Pickers   Image Processing   Image Views   Instrumentation   Intents   Job Schedulers   JSON   Keyboard   Kotlin   Layouts   Library Demos   List View   List Views   Localization   Location   Lock Patterns   Logcat   Logging   Mails   Maps   Markdown   Mathematics   Maven Plugins   MBaaS   Media   Menus   Messaging   MIME   Mobile Web   Native Image   Navigation   NDK   Networking   NFC   NoSQL   Number Pickers   OAuth   Object Mocking   OCR Engines   OpenGL   ORM   Other Pickers   Parallax List   Parcelables   Particle Systems   Password Inputs   PDF   Permissions   Physics Engines   Platforms   Plugin Frameworks   Preferences   Progress Indicators   ProGuard   Properties   Protocol Buffer   Pull To   Purchases   Push/Pull   QR Codes   Quick Return   Radio Buttons   Range Bars   Ratings   Recycler Views   Resources   REST   Ripple Effects   RSS   Screenshots   Scripting   Scroll Views   SDK   Search Inputs   Security   Sensors   Services   Showcase Views   Signatures   Sliding Panels   Snackbars   SOAP   Social Networks   Spannable   Spinners   Splash Screens   SSH   Static Analysis   Status Bars   Styling   SVG   System   Tags   Task Managers   TDD &   Template Engines   Testing   Testing Tools   Text Formatting   Text Views   Text Watchers   Text-to   Toasts   Toolkits For   Tools   Tooltips   Trainings   TV   Twitter   Updaters   USB   User Stories   Utils   Validation   Video   View Adapters   View Pagers   Views   Watch Face   Wearable Data   Wearables   Weather   Web Tools   Web Views   WebRTC   WebSockets   Wheel Widgets   Wi-Fi   Widgets   Windows   Wizards   XML   XMPP   YAML   ZIP Codes