Next let’s talk about Judy.

I think that's self explanatory.

You can build your own weirdo boot-debug.img by touching a force_debuggable file in ramdisk, copying adb_debug.prop from AOSP, touching a blank userdebug_plat_sepolicy.cil file in ramdisk. Further, anything added to adb_debug.prop takes precedence, you can mark ro.build.type=eng or userdebug to bypass judy and force enable adb

There was some way to keep adb enabled on the first firmware, but unfortunately for me, my unit updated as soon as I connected to wifi (you must realise i had no idea about what this orange contraption was). There are still references in the RabbitLauncher code to enable a factory mode that grants adb but I'm sure this is stripped out.

Coming to unlocking the bootloader. You can simply unlock it using mtkclient's seccfg commands. But for some reason, I quite often was left with dm-verity issues when using seccfg directly. Don't get me wrong, it did work most of the times, but I wanted a more reliable way to unlock. I opted for pulling partition frp, flipping the last byte, and writing it back to the device. Then booting to fastboot using meta bootcmd/sequence, and issuing fastboot flashing unlock. Since there are no volume keys, it automatically selects "Yes". If frp was updated correctly, the bootloader unlocks normally.

Now, my first plan of action was to just try a GSI. After all, I have no kernel source, and this was not a certified device. Would be interesting to see what a GSI would do, would it even boot?

bootloader unlocked

It does boot, but there's constant crashes, mostly with launcher3. Looking at the logs and some sifting through AOSP, I realised, vendor doesn't have handheld_core_hardware.xml and other standard handheld smartphone permission files & configs.

I copied over the GSI target from AOSP and started working on that, adding what was missing, initial IMS port and figuring out what to do with the keys and camera. For keys, you have 2 approaches:
1. framework keyhandler
2. keylayout
I have both on my tree, but I'm actively using only the framework keyhandler approach, since it lets me retain default behaviour for when someone manages to port a simple rabbitlauncher apk.

That brings us to reversing the rabbit launcher that actually teaches us quite a bit!

step_motor_ms35774 -> camera orientation step motor
och1970_holl_key -> scroll wheel

Further, the most annoying bit of the device is that long pressing power DOES NOT hard reset the device, unless you are talking to preloader or brom, and something has disabled its watchdog.

was looking at ifixit’s photos and noticed the button (next to the 2 unmarked golden pads)

In the sim tray, theres a very tiny button, if you press this, it hard resets the soc

For the step motor, you can use a QS tile like such:
https://github.com/RabbitHoleEscapeR1/device_rabbit_r1/tree/main/StepMotorControls

This will toggle it between its 3 "most useful states", but realistically it takes any value between 0 and 180

The second most annoying thing of this device: the prebuilt kernel. The kernel does not for the love-of-god let you go permissive

good luck auditing denials here :))))

Process to install magisk is much like any other device, I wont dive into it here.