Harden Nubia

#!/usr/bin/env bash
# Nubia V80 Design (MyOS 16) hardening script
# Run from inside your android-tools distrobox container, phone connected via adb, screen unlocked.
# Usage: bash harden_nubia.sh

set -e

echo "=== Checking device connection ==="
adb devices
read -p "Confirm device shows as 'device' above, then press Enter to continue..."

### PHASE 1: Install F-Droid ###
echo "=== Installing F-Droid ==="
mkdir -p ~/Downloads
wget -O ~/Downloads/FDroid.apk https://f-droid.org/F-Droid.apk
adb install -r ~/Downloads/FDroid.apk
echo "F-Droid installed. Open it once on-device to sync repo index before installing apps from it."
read -p "Press Enter once F-Droid has synced on the phone..."

### PHASE 2: Strip non-essential Google apps (Play Store & GMS untouched) ###
echo "=== Removing non-essential Google apps ==="
GOOGLE_APPS=(
  com.google.android.googlequicksearchbox
  com.google.android.apps.tachyon
  com.google.android.apps.bard
  com.google.android.calendar
  com.google.android.calculator
  com.google.android.dialer
  com.google.android.apps.translate
  com.google.android.apps.wallpaper
  com.google.android.apps.walletnfcrel
  com.google.android.apps.restore
  com.google.android.apps.safetyhub
  com.google.android.tts
  com.google.android.feedback
  com.google.android.printservice.recommendation
  com.google.android.apps.wellbeing
)
for pkg in "${GOOGLE_APPS[@]}"; do
  adb shell pm uninstall --user 0 "$pkg" || echo "  (skip: $pkg not found or already removed)"
done

### PHASE 3: Remove Contacts and Messaging directly (no replacement staged first — by request) ###
echo "=== Removing Google Contacts and Messaging directly ==="
echo "WARNING: no replacement SMS/contacts app is staged yet. You may lose SMS capability until you install one from F-Droid (Fossify Messages / Fossify Contacts)."
adb shell pm uninstall --user 0 com.google.android.apps.messaging || echo "  (skip: messaging not found)"
adb shell pm uninstall --user 0 com.google.android.contacts || echo "  (skip: contacts not found)"

### PHASE 4: Facebook bloat ###
echo "=== Removing Facebook system bloat ==="
adb shell pm uninstall --user 0 com.facebook.appmanager || echo "  (skip)"
adb shell pm uninstall --user 0 com.facebook.services || echo "  (skip)"

### PHASE 5: ZTE bloat ###
echo "=== Removing confirmed ZTE bloat ==="
adb shell pm uninstall --user 0 com.android.aftersaleservice || echo "  (skip: ZTE Cares)"
adb shell pm uninstall --user 0 com.quicinc.fmradio || echo "  (skip: FM Radio)"
adb shell pm uninstall --user 0 cn.zte.recorder || echo "  (skip: Voice Recorder)"

echo "--- Checking for LinkFree / Phone Switch package names ---"
adb shell pm list packages | grep -i linkfree || echo "  (no linkfree match found)"
adb shell pm list packages | grep -i phoneswitch || echo "  (no phoneswitch match found)"
echo "If either was found above, uninstall manually with: adb shell pm uninstall --user 0 <package>"

### PHASE 6: GMS / Play Store permission hardening ###
# NOTE: This is likely to further degrade Play Integrity results (banking/finance apps).
# Comment out this block if you need Play Integrity to keep passing.
echo "=== Hardening GMS and Play Store permissions ==="
GMS_DENY_OPS=(COARSE_LOCATION FINE_LOCATION RECORD_AUDIO CAMERA READ_CONTACTS)
for op in "${GMS_DENY_OPS[@]}"; do
  adb shell appops set com.google.android.gms "$op" deny || true
done
adb shell cmd appops set com.google.android.gms RUN_IN_BACKGROUND deny || true
adb shell cmd appops set com.google.android.gms RUN_ANY_IN_BACKGROUND deny || true

VENDING_DENY_OPS=(COARSE_LOCATION FINE_LOCATION RECORD_AUDIO CAMERA READ_CONTACTS)
for op in "${VENDING_DENY_OPS[@]}"; do
  adb shell appops set com.android.vending "$op" deny || true
done
adb shell cmd appops set com.android.vending RUN_IN_BACKGROUND deny || true

echo "GMS/Play Store hardened. TEST YOUR BANK APP NOW before continuing further."
read -p "Press Enter to continue once you've confirmed banking app status..."

### PHASE 7: Disable telemetry (ZTE AI already removed by user — skipped here) ###
echo "=== Disabling remaining Google telemetry services ==="
adb shell pm disable-user --user 0 com.google.android.adservices.api || true
adb shell pm disable-user --user 0 com.google.android.federatedcompute || true
adb shell pm disable-user --user 0 com.google.android.as || true

### PHASE 8: Privacy toggles ###
echo "=== Setting privacy toggles ==="
adb shell settings put global ad_id_enabled 0
adb shell settings put secure usage_and_diagnostics_enabled 0

### PHASE 9: Network hardening ###
echo "=== Locking network mode (LTE/5G only, 2G disabled) ==="
adb shell settings put global disable_2g_flag 1
adb shell settings put global preferred_network_mode 24
echo "Verify after reboot with:"
echo "  adb shell settings get global disable_2g_flag"
echo "  adb shell settings get global preferred_network_mode"

echo ""
echo "=== DONE ==="
echo "Remaining manual steps (on-device, via F-Droid app):"
echo "  - Install: Fossify Messages, Fossify Contacts, Signal, Orbot, NetGuard, Cromite"
echo "  - Set Fossify Messages as default SMS app (Settings > Apps > Default apps > SMS app)"
echo "  - Confirm with: adb shell dumpsys role | grep -A 2 'android.app.role.SMS'"
echo "  - Configure NetGuard: default-deny firewall, whitelist only apps you use"
echo ""
echo "Reboot the phone now, then re-check network settings and test all critical apps (banking, messaging)."