Samsung stock to no-Google MicroG based privacy reconfigure step by step - Samsung Galaxy S10 Guides, News, & Discussion

This is Niall's guide to reconfiguring stock Samsung S10 Android 10 into a privacy focused MicroG based sytem purged of the stock spyware and annoying and useless stuff, but with the actually useful Samsung Apps such as Camera, and VoLTE remaining fully functional. Don't get me wrong here, LineageOS on the S10 is better in all ways especially in regular security updates, but the current LineageOS camera experience just can't compete with Samsung's deep integration of camera software and hardware. I therefore reluctantly offer this guide as a stopgap until LineageOS gets a better Samsung camera experience.
After completing this guide, you will have only these apps left installed visibly in the launcher:
Aurora Services and Aurora Store (to replace Play Store)
Brave privacy web browser + Bromite privacy web view
Samsung Calendar
Samsung Camera
Samsung Clock
Samsung Contacts
F-Droid
Samsung Gallery
Magisk Manager (root, customisations etc)
Google Maps (retained only due to its great usefulness for public transport)
Samsung Messages (for text messages)
microG Settings
Samsung My Files
OsmAnd (for offline navigation)
Samsung Phone
Samsung Settings
Upon each boot you can choose whether you will have root via Magisk by booting your phone with the correct buttons pressed (Volume Up + Bixby + Power, but released after the boot screen). There is no need to run with root available, per boot, unless you want it.
The principle things removed from stock are:
Samsung AR stuff
Samsung Bixby (apart from QR codes and Routines which are useful)
Google Chrome (it keeps hanging and stalling if used with MicroG, and besides it leaks your browsing habits)
Google GMail
Facebook (all traces)
Google YouTube (you ought to use NewPipe from F-Droid instead)
Samsung App store
Samsung Games home app
Microsoft OneDrive
Samsung Tips
Samsung DexOnPC (it spams you with messages)
Samsung EasySetup (also spams you with messages)
Samsung Edge Panel (the swipey translucent tab which floats above at the top right and gets in the way of taps)
Google Play Store
Google Accounts
Google Services
Samsung Launcher and its Recent Apps, replaced with custom One Plus Launcher and its Recent Apps
Note that this is NOT a deep "debloat", I only removed the bits you can see, which make themselves noticeable, or stuff known to leak your information to others. I left everything else alone, even if on most common "debloat" lists for the S10.
This guide uses Nanodroid, which has a reputation for installing lots of stuff you don't want, which puts a lot of people off using it. As of recently, Nanodroid now offers small, single purpose, packages which you individually combine to get what you want. So no more random ringtones nor backdrops being installed that you don't want!
You should be warned that this conversion leaves your device insecure. OTA updates from Samsung self disable as soon as you modify any system image, so you'll need to manually go retrieve new firmwares and repeat the below instructions (obviously flashing HOME_CSC instead of CSC to not factory reset the device) to stay secure.
Privacy achieved limitations
As with any device with a mobile (cellular) connection, as soon as you see a mobile phone (cell) signal, your position is exposed as they can track you by IMEI. Outside the EU, your historical, and sometimes current, location data is routinely sold for money by your provider to commercial third parties. Within the EU, your mobile provider is not supposed to expose your location to anyone but law enforcement without your explicit permission, but some providers are still catching up with GDPR and still relying on implicit permission buried deep inside EULA text. In any case, as soon as you see a mobile phone tower with your phone you have declared your position, and only airplane mode prevents that. This is unavoidable no matter how you configure any device capable of interacting with mobile phone masts.
Google Maps obviously leaks your location and movements to Google as soon as you open it, so you should prefer to use OsmAnd for offline maps and navigation whenever possible. Equally only Google Maps can route over public transport, knows when buses will arrive etc, so that's why I've kept it. Use judiciously!
MicroG needs to register with Google for push notifications, otherwise stuff like WhatsApp doesn't work. MicroG leaks as little information about you as it can, but ultimately Google can see from where you register including if by wifi alone, and thus determine your coarse location. You may wish to consider a VPN if you wish to obscure your physical location.
As much as you may secure your phone, individual apps you install may leak a great deal about you. For example most apps for tracking ovulation and when you have sex sell your personally identifying data and when you do it to others for money. You personally may not install such apps, but if anyone enters your private information into any phone, then your information is leaked. That information is composed into commercial databases which record everything about everyone. Is this paranoid? Note I said commercial databases. Most western governments are prohibited from mass survellience, so they simply buy the data from private firms which aggregate everything there is to know electronically about you. Amongst the many companies providing such service are Experian (you can request a dump of what they know about you, prepare to be disgusted) and Palantir (legislation hasn't caught up with them yet).
Finally, even if you are always in airplane mode, and all your friends and loved ones are as aware of personal data leakage as you are, ultimately this is a losing fight. Every time a CCTV camera facial recognises you, every time a satellite tracks your car, it's all being aggregated into databases about everyone, and more importantly, whom everyone has relations with. Even the device-less person is recorded, studied, tracked, and inferred from by algorithms. There is only so much any of us can do.
Instructions
Preparation: go find APKs for the following:
Magisk Manager. Rename it to MagiskManager.apk.
You really ought to insert a micro sd card. It makes life vastly easier when wiping the device, and this guide assumes that you have inserted one.
Make sure your bootloader is unlocked and your device has been configured to accept unofficial binaries. You can find instructions for how to do this at https://topjohnwu.github.io/Magisk/install.html#samsung-system-as-root. You will need adb shell working with your device in Developer mode.
In Odin, flash your choice of stock Android 10. Flash all parts, choosing CSC not HOME_CSC for the CSC slot in order to ensure a factory reset. Do NOT skip this complete reset to stock. Boot into stock firmware, enable wifi, and download and install any security updates available.
After updates have installed, enter Settings and MAKE SURE that OneUI is v2.5 or later. I originally wrote this guide in July 2020, but due to a showstopper bug in OneUI before v2.5 I had to sit on releasing this guide to xda-developers until September 2020 when OneUI v2.5 for S10 went public.
It will likely take multiple attempts of holding volume Up, Bixby and Power to boot into Stock Recovery, but keep at it until you get there. In Stock Recovery, reboot into bootloader mode. On Odin, flash AP slot with Ian's TWRP img + disabled vbmeta.img placed into a TAR archive using images and instructions from https://forum.xda-developers.com/ga...ecovery-twrp-3-3-0-galaxy-s10-exynos-t3924856.
Boot into TWRP recovery using Volume Up + Bixby + Power On. This may also take multiple attempts. It may be useful to know, if stuck on the first boot Samsung logo (you don't need to worry about interrupting first boot right now), that holding volume down and power button for long enough will force reboot the device.
In TWRP format data. Do NOT skip this part. This removes Samsung's encryption of the internal sdcard so you can take backups of your data etc in TWRP.
In TWRP install Ian's multidisabler zip available from https://forum.xda-developers.com/ga...ynos/g97xf-multi-disabler-encryption-t3919714. Make SURE you rename it to contain the string "_btfix" before you copy it to the sdcard by MTP (this enables the Bluetooth settings loss fix).
Put into a file called .nanodroid-setup:
Code:
nanodroid_nlpbackend=1001
nanodroid_play=21
nanodroid_gsync=0
This custom .nanodroid-setup adds the install of the radiocells location backend (this uses a downloaded on-device database of mobile phone mast ids to locate you), and prevents the install of the Google Sync Adapters which prevents Google getting your contacts list and calendar.
In TWRP mount Product, System and Vendor.
Do the following from your PC with TWRP still running:
Code:
adb shell
rm /system_root/system/app/ARZone/ARZone.apk
rm /system_root/system/app/BixbyWakeup/BixbyWakeup.apk
rm /system_root/system/app/FBAppManager_NS/FBAppManager_NS.apk
rm /system_root/system/app/Facebook_stub/Facebook_stub.apk
rm /system_root/system/app/YouTube/YouTube.apk
rm /system_root/system/priv-app/Bixby/Bixby.apk
rm /system_root/system/priv-app/BixbyAgentStub/BixbyAgentStub.apk
rm /system_root/system/priv-app/BixbyService/BixbyService.apk
rm /system_root/system/priv-app/GalaxyAppsWidget_Phone_Dream/GalaxyAppsWidget_Phone_Dream.apk
rm /system_root/system/priv-app/GalaxyApps_OPEN/GalaxyApps_OPEN.apk
rm /system_root/system/priv-app/GameHome/GameHome.apk
rm /system_root/system/priv-app/FBInstaller_NS/FBInstaller_NS.apk
rm /system_root/system/priv-app/FBServices/FBServices.apk
rm /system_root/system/priv-app/EasySetup/EasySetup.apk
rm /system_root/system/priv-app/OneDrive_Samsung_v3/OneDrive_Samsung_v3.apk
rm /system_root/system/priv-app/Tips/Tips.apk # stupid Samsung Tips popups
rm /system_root/system/priv-app/DeXonPC/DeXonPC.apk
rm /system_root/system/priv-app/CocktailBarService_v3.2/CocktailBarService_v3.2.apk # Edge panel top right floats
rm /system_root/system/app/Chrome/Chrome.apk
rm /system_root/system/app/ChromeCustomizations/ChromeCustomizations.apk
rm /system_root/system/app/Gmail2/Gmail2.apk
rm /system_root/system/app/GoogleCalendarSyncAdapter/GoogleCalendarSyncAdapter.apk
rm /system_root/system/app/GoogleContactsSyncAdapter/GoogleContactsSyncAdapter.apk
rm /system_root/system/app/GoogleLocationHistory/GoogleLocationHistory.apk
rm /system_root/system/priv-app/SetupWizard/SetupWizard.apk # Without removal never passes initial setup
rm /system_root/system/priv-app/TouchWizHome_2017/TouchWizHome_2017.apk # OneUI launcher
# Stuff replaced by MicroG
rm /system_root/system/priv-app/GmsCore/GmsCore.apk
rm /system_root/system/priv-app/GoogleServicesFramework/GoogleServicesFramework.apk
rm /system_root/system/priv-app/Phonesky/Phonesky.apk
rm /system_root/system/priv-app/Velvet/Velvet.apk
mkdir /system_root/system/app/MagiskManager
exit
adb push MagiskManager.apk /system_root/system/app/MagiskManager/
adb push .nanodroid-setup /external_sd/
All the removed apps free up enough space on the priv-app partition to install the Nanodroid apps coming next, so the above step isn't really avoidable. You also need to repeat it after any firmware upgrade.
In TWRP install exactly these individual packages from https://gitlab.com/Nanolx/NanoDroid:
NanoDroid-BromiteWebView-23.0.1.20201029.zip
NanoDroid-fdroid-23.0.1.20201029.zip
NanoDroid-microG-23.0.1.20201029.zip
NanoDroid-OsmAnd-23.0.1.20201029.zip
NanoDroid-patcher-23.0.1.20201029.zip
(Later, but not earlier, versions will probably work fine too)
Still in TWRP, install the modded One Plus Launcher from https://forum.xda-developers.com/android/apps-games/app-oneplus-launcher-4-6-4-t4140631. You will want the TWRP for ROM edition (NOT GSI!). Note that if you don't want the One Plus Launcher, and are happy with the stock Samsung launcher (which may send telemetry to Samsung), don't delete the TouchWizHome_2017 apk earlier on. If you want a different launcher altogether, be aware that you need one which specifically implements an Android 10 Recents provider. Many popular choices e.g. Nova Launcher, do not.
NOTE: There is a bug in v4.6.5 of the One Plus Launcher TWRP install script which silently fails to install anything into /system. To fix, extract the contents of the zip file. After TWRP install, remount Product, System and Vendor, then do 'adb push TWRP.ROM.OnePlus.4.6.5.RandomAJL\system /'. Then reinstall the ZIP within TWRP to set permissions.
Reboot into System. It will get stuck on the Samsung boot logo for a while, but will eventually open onto the final All Done stage of setup (we earlier removed all the earlier parts of setup). Hit Finish to reach the One Plus Launcher. Enable wifi and connect to your wifi connection.
Once into the device, open the microG settings app. Run the Self-Check, the "System grants signature spoofing" will be unticked. Tap it, grant permission. The item "Play Store (Phonesky) has correct signature" will also be unticked. Tap that, grant permission. Now the self check should report everything is working and having correct signature. Signature spoofing should be working.
Within MicroG settings, enable Google device registration, cloud messaging and safety net. If you don't enable these, any applications you install next will never receive notifications, ever. Enter location modules. Enable Deja Vu, Radiocells and Nominatim backends. The Deja Vu backend doesn't need configuring, it simply records Wifi and mobile phone mast data and your GPS location when available, and builds a database matching wifi and mast data to GPS. Next tap the Radiocells entry, then Configure, then download offline catalog now, choose your country, then choose offline mode. Now your phone can locate itself purely using an offline database of phone masts and wifi. Next tap the Nominatum entry, then Configure, then choose Nominatum API server, and then OSM.
Open OsmAnd~ the app, choose your country, and download your offline map so you can navigate without an internet connection. Open the app, ensure navigation is working.
Enable and enter Developer options in the settings, open the WebView implementation, and set it to Bromite System WebView.
You should now root your device. Copy Ian's TWRP img to the sdcard, then open Magisk Manager with a wifi connection active. Choose install. Then choose Select and Patch file. Patch Ian's TWRP img previously copied. Magisk Manager will output a root patched img into Downloads. Copy that back to the PC. Make a new TAR file of that and the vbmeta disabled image. Flash that in Odin in the AP slot. Boot the device using Volume Up + Bixby + Power, but release as soon as the bootloader warning screen appears. Go back into Magisk Manager, let it do its install and setup. If root ever appears to have got lost or isn't working, check the Magisk Manager, you probably forgot to hold the right keys during boot.
Go to https://nextdns.io/ and create yourself an account and unique id. From Aurora Store, find and install the NextDNS app. Configure the app with the id you got from your account on the website, and tell it to send your device's name. NextDNS acts as if a VPN for your Android device and thus all internet traffic routes through it, but it blackholes DNS lookup for a configurable list of items in your NextDNS account. Via this, you can block a long list of leakage of your personal information, and also optionally block ads on your device. If you log into nextdns.io from time to time, you will no doubt be fairly saddened by how much of your data is attempted to be leaked all the time.
From Aurora Store, find and install the Brave privacy web browser. As we removed Chrome due to it not working well with this modified system (it keeps stalling), you will need a new system web browser in any case and out of the box, Brave blocks all adverts and tracking. If you enter its settings, you can also disable Javascript by default (only enable it per site on a case by case basis, you can enable temporarily per site, or store an exception). Be aware that if you don't enable Brave rewards, the Brave authors silently pocket any BAT tokens your web browsing earns, so you may wish to enable Brave rewards for the very tiny income generated by your attention if you leave Brave ads disabled (it is local browser only, nothing gets enabled online, BAT tokens are conferred by crypto exchange so none of your browsing gets leaked). Personally speaking, I'm quite keen on the idea of me getting paid personally to see adverts as none of my personal browsing history leaves the Brave browser, even if it's pennies a month, so I leave that stuff turned on.
Settings
You probably want a decent set of settings rather than iterating through the Settings app. These are mine obviously, so you can skip these or not. With Developer Mode enabled, do the following:
Code:
adb shell
settings put global display_size_forced 1440,3040
settings put global navigationbar_key_order 1
settings put secure default_display_density_forced 560
settings put secure display_density_forced 560
settings put secure default_display_size_forced 1440,3040
settings put secure package_verifier_state 1
settings put secure screensaver_components
settings put secure selected_input_method_subtype 65538
settings put secure ui_night_mode 2
settings put system hdr_effect 1
settings put system display_night_theme_wallpaper 1
settings put system screen_off_timeout 300000
settings put system aod_servicebox_page_gravity 17
settings put system aod_show_state 1
settings put system aod_tap_to_show_mode 0
settings put system display_night_theme 1
settings put system hearing_diagnosis 1
settings put system hearing_direction 0
settings put system hearing_musiccheck 0
settings put system hearing_parameters 5,5,5,5,5,5,5,5,5,5,5,5
settings put system hearing_revision 0
settings put system hearing_videocheck 0
settings put system lock_clock_adaptive_colors 'fffaeecd;ffd9faeb;fffae7b4;ffc0fae0'
settings put system qs_detail_content_primary_text_color -2500135
settings put system qs_detail_content_secondary_text_color -1710619
settings put system remote_control 0
This is mainly how I like my settings. I want the actual resolution of my fancy device, not some subset (why bother buying a device with better otherwise?). I want dark theming to take advantage of power saving in my fancy AMOLED screen.
Swype keyboard
Enter Settings, General Management, Language and input, On-screen keyboard, then Samsung Keyboard, and then Swipe, Keyboard swipe controls. Enable Swipe to type.
Firmware upgrades
To apply future firmware upgrades, you will need to acquire the latest Samsung firmware for your device from a reputable source. You almost certainly want to take a full backup in Titanium Backup, and copy that backup onto an external sd card to be safe. During flashing in Odin, flash the HOME_CSC, not the CSC, image into the CSC slot. This should preserve all your settings and installed applications. Disable auto rebooting in the Odin options. Then when the flash is done, manually reboot into stock recovery, then back into Download, then flash the root modded Ian's TWRP recovery you made earlier into the AP slot. Reboot into TWRP, and repeat all the steps above.
If you do it right, you'll reboot into your device just as you left it, just with all the components upgraded to latest. If you screwed up, that Titanium Backup you made will be very useful.
Not that I'd recommend running out of date firmware images, but I would say that by far the most common upgrade you'll need to do is latest MicroG because Google bumped the minimum version of Play Services its apps will accept, so for example Google Maps will barf about Play Services being too old. There is a very simple fix for this: don't upgrade Google apps! An older Google Maps works just fine even if it's many months old.
Credits
What this guide achieves wouldn't have been possible without the following hard work from many people creating the components I have reused:
topjohnwu
ianmacd
Christopher Roy Bratusek
RandomAJL
mar-v-in
Whomever makes available Samsung Odin and the other stuff which makes LineageOS and AOSP become ever better for the S10 devices.

---

Changelog:
15th Nov 2020: Lots of improvements after a month of testing as a daily driver:
Replace Chrome browser with Brave browser to fix browsing hangs, and reduce browsing habits leakage.
Remove GMail as well, stop Google getting more of your info.
Remove Samsung Edge panel, which I had previously missed.
Use latest NanoDroid.
Add paragraph on how to upgrade this with new Samsung firmware releases.
12th Oct 2020: Replaced NextDNS instructions as .xapk's can't be adb installed, and installing from Aurora Store is better anyway.
10th Oct 2020: First release to xda.

---

Looks like a fantastic guide, thank you!

---

It's for S10E to?
Sent from my [device_name] using XDA-Developers Legacy app

---

[email protected] said:
It's for S10E to?
Click to expand...
Click to collapse
I've only tested it on a S10, but because we begin from stock, and the stock Samsung Android 10 images are all basically the same (at least at the level we're working with), the guide should be widely portable to most of the current generation of Samsung Android 10 devices.