Advanced Mode

Opt-in controls for specialist operators. Leave it off unless you need permissions, AppOps, or a privileged-shell firewall.

Advanced Mode never unlocks bootloaders, flashes Magisk, or disables SELinux. If a privileged shell is refused, the failure is explained honestly.

Honest limitsSecurity

Enable Advanced Mode

  1. Open Settings and turn on Advanced Mode explicitly.
  2. Read any confirmations carefully — higher-risk actions stay behind extra gates.
  3. You can turn Advanced Mode off again at any time.

Runtime permissions

  1. Runtime / dangerous permissions use pm grant and pm revoke with confirmation.
  2. A successful pm grant on an already-granted special permission is not reported as a special-access change.

Special-access (AppOps)

  1. Special-access toggles (overlay, usage access, all-files, exact alarms, and related AppOps) follow AppOps — not dumpsys granted=true alone.
  2. Notification-listener binds and other component-based special access remain out of scope.

Per-app network block

  1. INTERNET-related network block uses a UID iptables/ip6tables firewall only when a privileged shell already exists.
  2. Privileged shell means adb root on userdebug/eng, or su on a device that is already rooted.
  3. Production user builds that refuse privileged shell will not get a fake pm revoke INTERNET success.
  4. A second privileged-shell confirm is required before applying or removing the firewall.

Serial USB queue

  1. Advanced Mode can queue additional USB Android targets.
  2. Installs run one at a time with a distinct confirm token per target.
  3. There is no silent fleet or install-to-all path.

Common issues

  • Firewall toggle fails on a retail phone

    Expected without an existing privileged shell. Install Dock will not exploit-root the device.

  • Special-access switch looks wrong after dumpsys

    Trust the AppOps-backed switch state, not an install-time granted=true line alone.