Malicious hidden in root partition

Question

Hello everyone :) excuse me for creating a new thread but i couldnt find any info on this matter.

As a gift, my parents brought Samsung galaxy s4 from someone i dont trust who sells it. I factory reset the phone thinking its enough to clean everything.
After a while i feel unsafe because the person knows things out of nowhere and i found out many $py software are more advanced now that its installed via root and very stealth.

I read wiping the partition and flashing the rom could help. But limited to only boot, data, cache, system while other such as /misc, /recovery remain the same?

What if its hidden in there. i want to make sure just to be safe. On a side note the person is a techie and also know im careful and observant.

Whats your suggestion on this?

Please help. Any inputs will be very much appreciated. :(
Thank you in advance.

— Rootloop | Sources

Answer

You'll need to "flash" the firmware on the phone to stock firmware to overwrite everything (including system files) that you had on it before.

Go to http://www.sammobile.com/ and enter your device model number. You'll be directed to a long list of each country variant of every Android version made for the device. If you have a preference for version, (AKA you hate 5.0 Lollipop), then download 4.4 Kitkat. This is a good 3 hour download, and you may have to download it multiple times before you get a perfect download (MD5 matching file). Also, sammobile requires you to sign up before you download. It's not a big deal, I used my real e-mail.

You will then download Odin v3 from XDA onto your computer as well as the Samsung USB Drivers (Official link) and install each.

Boot your phone to Download Mode (by pressing Power + Volume down) and hook it up to your computer. You'll then click on the PDA button in Odin and find your .tar file. If your download is a .zip you'll have to extract the zip. If you're below Windows 7, the zip extraction wizard will appear to have frozen for about 10 minutes. It takes much longer than usual with a single .tar file.

Make sure all the checked boxes are as so:

..And flash!

When finished, it may or may not boot right up! If not, go into stock recovery (by pressing Power + Volume up) and "Clear Dalvik Cache". Now, your phone should be up and running. If not, clear data as well.

Hope this helps!

— Aaron Gillion | Sources

Topics