This post is about two things that look unrelated but turn out to be the same thing.
The first: how deep the pre-installed software on Chinese-market Android phones can actually reach.
The second: when I don’t want to accept any of it, whether I still have a way out.
The answer to the first is deeper than most people think. The answer to the second is narrower than most people think.
1. SystemHelper: System-Level Data Collection in the Name of Security
In November 2025, members of the technical community ran ADB dynamic forensics and DEX reverse analysis on Xiaomi’s HyperOS. The conclusion is uncomfortable: what’s built into Chinese-market Android phones isn’t just an “anti-fraud” feature. It’s a systematic collection infrastructure layer covering device identifiers, network location, and app usage behavior.
What Was Found
SystemHelper (com.mobiletools.systemhelper) is a carrier terminal-management module pre-installed on Chinese-market Android phones from Xiaomi, OPPO, vivo, and others. According to the community analysis, its behavior includes:
- Collecting device identifiers (IMEI, ICCID, IMSI, MNC) and network parameters (cell tower TAC, CID, PCI)
- Using
UsageStatsManagerto collect foreground usage time for all apps, reported todm.wo.com.cnon 24/12/1-hour cycles - Holding background location permission by default
- Remaining present and running even with a non-China-Unicom SIM card installed
The anti-telecom-fraud module (com.miui.electricrisk) is even more aggressive:
- It maintains a local behavioral-profile database,
fraud_detection_data.db, recording screenshot timestamps, package names and durations of screen sharing sessions, and MD5 hashes of call numbers - Some of this collection has no user-facing switch at all and cannot be turned off
- In specific scenarios (WeChat and QQ video-call pages) it triggers screen recording at 720×1280, 24fps, using the hidden API
IMediaProjectionManager.createProjectionto bypass the normal authorization dialog - Recorded content is encrypted and uploaded to
detection-aigc.engine.miui.com - It also captures mixed downlink audio from the device and VoIP calls for ASR speech recognition
What’s even more notable: the service MiFraudDetectionService is also called by third-party apps—Alipay, Taobao, JD.com, Meituan, Douyin, Amap—through the ACCESS_XSOF permission. If that call chain holds up, it means this surveillance infrastructure is already being shared at the ecosystem level, not confined to one system app.
What the Technical Verification Concluded
After independent community verification, the following claims were considered true:
- A built-in anti-fraud database records screenshots, screen sharing, and call metadata
- Some of the collection cannot be disabled through user settings
- Screen recording bypasses normal authorization via a hidden API
- After turning off the relevant options in the phone-manager app, the underlying modules keep running
The following claims did not hold up, or were exaggerated:
- The “669 consecutive read/write operations” description doesn’t match reality
- “Every phone is screen-recording” is inaccurate. Recording only triggers in specific scenarios, in clips of about 3 seconds each
- Some domains were described incorrectly—for example,
fraud-detection.engine.miui.comis actually used for NFC access-card configuration
Of everything on this list, the item I care about most isn’t any single behavior. It’s the last one: flip the switch off, and the layer underneath keeps running.
That means the “off” the user sees may be nothing more than a UI state. Whether the actual collection logic has stopped is something users can neither confirm nor audit. On a phone whose bootloader is already locked down, that asymmetry is effectively irreversible.
2. Bootloader Unlocking: A Door That’s Closing
What the SystemHelper story exposes isn’t only “who is watching me”—it’s “can I stop them.” And the answer increasingly looks like: no.
Unlock Status by Brand (November 2026)
Brands That Let You Unlock Directly
| Brand | Unlockable models | Notes |
|---|---|---|
| Google Pixel | Pixel 3 through Pixel 11, entire lineup | Must buy the non-carrier version; Verizon units cannot be unlocked |
| Nothing / CMF | Phone (1) through (4b), CMF Phone 1/2 Pro, entire lineup | Currently one of the most open vendors |
| Fairphone | FP3/4/5, Gen.6, entire lineup | No unlock code required starting 2026 |
| Open hardware | SHIFTphone 8, Volla lineup, Teracube, Murena | Designed for openness from the ground up |
| Smaller brands | Blackview, Cubot, Oukitel, Ulefone, Umidigi | Few restrictions, but mediocre hardware and after-sales support |
Brands That Allow Unlocking but Require an Application or a Wait
| Brand | Conditions |
|---|---|
| OnePlus (international) | No restrictions, unlock directly via fastboot |
| Sony Xperia (international) | Unlock code requires an IMEI application |
| Motorola | Apply on the overseas official site; China-market units also go through the overseas channel |
| Samsung (older models) | Only One UI 7 and below; upgrading to One UI 8 permanently locks it out |
| Xiaomi (international) | Must grab a daily quota slot; limited to 1 device per account per year |
| RedMagic / Nubia (older models) | Must unlock offline instantly before upgrading; the author of the unlock tool has left the scene |
Brands Whose China-Market Units Are Being Locked Down
| Brand | China-market status |
|---|---|
| OnePlus (China) | ColorOS 16+ requires deep testing, real-name verification, face recognition, and quota limits; no slots issued in a new phone’s first month |
| Xiaomi (China) | Completely impossible to unlock since HyperOS 2 |
| OPPO / Realme (China) | Deep testing, 1 device per 60 days, extremely few slots |
| Samsung (China) | Permanently closed for all regions and all models since One UI 8 |
Brands That Have Closed Unlocking Entirely
Huawei, Honor, vivo/iQOO, Meizu (note16 series), ZTE, newer Asus models, HTC, LG, TCL, Amazon Fire—all impossible to unlock.
Three Trends Worth Watching
1. The same brand lives in two worlds: China-market vs. international
Pixel and international OnePlus can be unlocked directly, while the China-market versions require approval or are closed off completely. That means Chinese consumers buying the same brand get far less control over their devices than overseas users.
2. Fuse-blowing mechanisms are spreading
- OnePlus’s “kernel-level fuse”: after upgrading to a specific version, even a previously unlocked phone is permanently locked
- Samsung One UI 8: the unlock switch is removed at the bootloader level, and the upgrade is irreversible
- Xiaomi HyperOS: anti-rollback mechanism—no downgrading once locked
- Lenovo Legion tablets: signing keys publicized for the previous generation have been blocked
What these mechanisms have in common: once triggered, there’s no going back. You can’t even restore unlock capability by flashing back to an older system.
3. The chipset matters more than the brand
Devices with Unisoc (紫光展锐) chipsets cannot be unlocked through official channels, even when they come from a “friendly” brand. When buying a phone, don’t just look at the brand—check the chipset behind the specific model.
3. What Users Are Losing
From Root to Unlock: Control Stripped Away Step by Step
Ten years ago, rooting an Android phone was relatively simple. Install an APK, tap a button, and you had the highest privileges on the device.
Five years ago, most vendors started locking bootloaders but still offered official unlock channels. You had to wait, but at least you could unlock.
Today the situation has changed qualitatively:
- Unlocking requires real-name verification, face recognition, community tier
- Slots are limited and have to be grabbed
- A system upgrade can permanently blow the unlock fuse
- Some brands have shut the unlock channel entirely
You Pay for the Hardware; the Vendor Keeps the Final Say
This would be almost unthinkable in the PC world. Nobody can stop me from installing any operating system on my own motherboard. But in the phone world, through the Secure Boot chain of trust (PBL → SBL → ABL → UEFI), vendors control at the hardware level what software the device is allowed to run.
Unless the vendor adds the user’s own key to its public-key list, a self-compiled ROM can’t pass verification. This isn’t a technical question of “can it be unlocked”—it’s a power question: the root of trust sits entirely in the vendor’s hands.
What SystemHelper Tells Us
When users can’t unlock the bootloader and can’t flash a custom ROM, they are powerless against any data-collection module pre-installed in the system. Even if you know it exists, even if you find a way to switch it off, a single system update can undo your settings.
Device control is the infrastructure of privacy. Without the former, the latter is just a favor the vendor grants you.
4. If You Want to Buy a Phone You Can Actually Control Right Now
The Safest Choices
Google Pixel (non-carrier version): unlockable out of the box, the AOSP reference implementation, the best mainline-kernel support—the first-choice platform for self-compiled ROMs.
Nothing Phone: currently one of the most unlock-friendly vendors, with distinctive hardware design to boot.
The Runner-Up
OnePlus (international): stronger hardware, unrestricted unlocking—but you must confirm it’s running international firmware. The China-market version has been tightened considerably.
If You Care About Hardware Freedom
Fairphone: modular design, no unlock code needed starting 2026, but middling hardware performance, and it’s sold mainly in Europe.
SHIFTphone / Volla / Teracube: niche open hardware. Great for tinkering; not suitable as a daily driver.
Choices I Would Not Recommend as Flashing Platforms
- Any China-market OnePlus/OPPO/Realme: deep testing plus fuse-blowing risk
- Any China-market Xiaomi: completely locked since HyperOS 2
- Any Huawei/Honor/vivo: closed entirely
- Any Samsung: permanently closed since One UI 8, with Knox fuse-blowing
- Any Unisoc-chipset device: no official unlock path
5. In Closing
The SystemHelper story isn’t just another “privacy leak” headline. It’s a signal: under the banner of “security” and “anti-fraud,” phone vendors are building a deep, persistent, system-level infrastructure for monitoring user behavior. At the same time, users’ control over their own devices is being stripped away step by step—in the name of security.
Put the two together and you get an ironic closed loop: vendors monitor you for security reasons, and for the same security reasons they won’t let you stop them.
I’m not writing this to urge everyone to go flash their phones. Flashing has a learning curve and real risks: warranty, payments, banking apps, system updates—any of them can break. But if the option of “can I unlock it” doesn’t even exist, users don’t get to take on the risk of choosing, because the choice itself has already been taken away.
If you care about this, there’s still something you can do right now: buy a Pixel or a Nothing Phone, unlock it, and flash a system you trust.
But don’t wait too long. This door is closing.
Data sources for this post: community technical verification (GitHub gist), the DroidRooter 2026 device list, AdaUnlocked’s cross-brand BL unlock status roundup, and Appinn’s hall of shame, as of November 2026. Vendor policies can change at any time; for specific models and versions, defer to the latest official information or hands-on testing.
评论
0 条评论