57 Field Modifications

Complete log of all unauthorized modifications applied to unit XT1524. From filesystem bootstrap to kernel exploitation.

Infrastructure — 7 hacks

proot, Ubuntu rootfs, dpkg fixes, DNS, git wrappers

#01proot-distro Manual InstallInfrastructure>

proot-distro not available in Termux repos for Android 5/6 (ARM32, old API level).

#02Ubuntu 25.10 Rootfs Manual ExtractionInfrastructure>

Official proot-distro install script fails on old Termux versions.

#03Git Wrapper BridgeInfrastructure>

npm needs git for some dependencies but git can't install in proot (dpkg broken on ARM32).

#04Git Argument ParserInfrastructure>

npm passes git arguments in unexpected order that the simple wrapper doesn't handle.

#05--ignore-scripts (Skip Native Compilation)Infrastructure>

llama.cpp and other native modules try to compile with gcc/make — impossible on 1 GB RAM ARM32.

#06npm Cache on SD CardInfrastructure>

700 MB internal storage, npm cache + node_modules = 500 MB+. No space for anything.

#07run-proot.sh Helper ScriptInfrastructure>

Running proot with all bind mounts, env vars, and flags is complex and error-prone.

Runtime — 6 hacks

Node.js cross-compile, NDK, LD_PRELOAD, libc++, native execution

#08Node.js 22 in prootRuntime>

dpkg broken in proot, can't install Node via apt. Termux native Node is v12.

#09hijack.js (Bionic Bypass + GC + Lazy Loading)Runtime>

os.networkInterfaces() crashes on Android 6 bionic libc. Multiple runtime incompatibilities.

#10Bypass systemd (gateway run)Runtime>

openclaw gateway start tries to register as systemd service. No systemd in proot.

#11Git Wrapper sed RewriteRuntime>

npm passes SSH URLs in 3 formats: git+ssh://, ssh://, git@. Bash substitution catches only one.

#12Native node22-icu (proot eliminated)Runtime>

proot adds ~30 MB overhead and causes subtle syscall translation bugs.

#13fs.promises PatchingRuntime>

OpenClaw uses fs.promises.mkdir('/root/...') which fails on native Android (no /root directory).

RAM — 9 hacks

V8 heap tuning, lazy loading, semi-space, dead module stubs

#14Low-Memory Mode (--max-old-space-size)RAM>

Gateway needs 218+ MB heap, OOM kill with Android + proot overhead.

#15ESM Dead Module StubsRAM>

OpenClaw bundles ALL channel SDKs via ESM. import resolves at link-time, can't skip unused ones.

#16V8 Heap Binary SearchRAM>

V8 heap too large wastes RAM for Android, too small = OOM. Need minimum viable heap.

#17Compile Cache CleanupRAM>

Node 22 compile cache accumulates 51 MB of duplicate .cache files.

#18Lazy Loading v3 (Proxy-based deferred require)RAM>

OpenClaw loads 1547 modules at startup. Most are never used (Discord when using Telegram, etc.).

#19Dead Packages (_DEAD_PKGS instant stubs)RAM>

Even lazy loading loads modules when accessed. Some providers will NEVER be used on this device.

#20V8 Heap 192 MB MinimumRAM>

128 MB heap OOMs during startup compilation phase (~186 MB needed for ESM module linking).

#21V8 Semi-Space 2 -> 1 MBRAM>

V8 young generation (semi-space) defaults to 2 MB. Wasted for I/O-bound gateway.

#22UV_THREADPOOL_SIZE=1RAM>

libuv spawns 4 worker threads by default, each consuming stack memory.

Debloat — 11 hacks

Package removal, SystemUI, telephony, rootfs diet

#23Android Debloat (No Root)Debloat>

Stock Android uses ~450 MB RAM. No room for the gateway.

#24Don't Kill GMS (WiFi Routing Dependency)Debloat>

Killing GMS frees 270 MB but breaks WiFi routing — default gateway route disappears.

#25Static IP + GMS KillDebloat>

GMS uses 270 MB but killing it breaks WiFi. Need a way to kill GMS safely.

#26boot-debloat.sh (51+ Packages via Dirty COW)Debloat>

After factory reset all packages are back. Manual pm disable one-by-one is tedious.

#27Extended Boot Debloat (+3 Packages)Debloat>

Chrome (45 MB), defcontainer (35 MB), qcrilmsgtunnel (35 MB) still running after initial debloat.

#28Proot Rootfs Diet (741 -> 550 MB)Debloat>

Proot Ubuntu rootfs bloated at 741 MB. Most space wasted on things OpenClaw never touches.

#29Deep Rootfs Diet (550 -> 498 MB)Debloat>

Still 50+ MB of unused system libraries after first diet.

#30Tier 1.5: Headless Server ModeDebloat>

SystemUI (70 MB), Phone (42 MB), Media (40 MB), Keychain (35 MB) still running on headless server.

#31npm Cache on ext4Debloat>

FAT32/sdcardfs can't handle deep nested paths that git creates during npm install.

#32ESM Stubs at HOST PathDebloat>

Stubs created in rootfs are invisible — proot bind mount shadows them with real packages.

#33setsid Gateway DetachDebloat>

Gateway is child of Termux bash. Killing Dalvik VM kills the gateway too (cgroup cascade).

Dirty COW — 5 hacks

Kernel exploit chain, SELinux bypass, boot loop recovery

#34Dirty COW Root (CVE-2016-5195)Dirty COW>

Need root to kill GMS and pm disable packages. Bootloader locked. Kernel 3.10.49 unpatched.

#35Recovery After Boot LoopDirty COW>

Removed com.motorola.android.providers.settings -> permanent boot loop. Framework NPE every 90s.

#36Dirty COW SELinux Bypass (zygote context)Dirty COW>

SELinux blocks ALL writes to /data/system/ even with root uid=0 in shell context.

#37API Keys Out of ps OutputDirty COW>

API keys (Kimi, Telegram, OpenAI) visible in clear text in ps -eo args when passed as proot arguments.

#38--legacy-peer-depsDirty COW>

npm dependency version conflicts during OpenClaw install.

Launcher — 5 hacks

Canvas APK, CRT renderer, escape hatches, native dashboard

#39PocketClaw Launcher APK (8.5 KB)Launcher>

KISS Launcher uses 33 MB RAM for an unused search bar on a headless phone.

#40Native APK: Kill the WebView (216 -> 45 MB)Launcher>

WebView launcher uses 216 MB RSS — more than the gateway itself (186 MB).

#41APK v2: Escape Hatches (Post-Brick Fix)Launcher>

APK v1 was a brick trap: fullscreen hid ADB auth popup, back disabled, no escape to Settings.

#42Dashboard v6: Green Cyberpunk + RAM BreakdownLauncher>

Dashboard was red-themed, had unused tabs, didn't explain WHY RAM was high.

#43Process Name Cleanup in DashboardLauncher>

Dashboard shows ugly raw Android package names, wastes space on 4.5-inch screen.

Network — 4 hacks

WiFi watchdog, SSH config, npm cache, provider setup

#44IPv6 DNS + autoSelectFamilyNetwork>

DNS resolution fails intermittently in proot with IPv4-only resolv.conf.

#45Kimi Coding Provider + User-Agent SpoofNetwork>

3 obstacles: wrong endpoint (Kimi Coding != Moonshot), 403 without recognized User-Agent, reasoning_content conflicts.

#46WiFi WatchdogNetwork>

WiFi drops silently, gateway can't reach API providers. No automatic recovery.

#47SSH Config + Static IPNetwork>

Typing SSH commands with IP, port, key path every time is tedious and error-prone.

Gateway — 4 hacks

hijack.js, dashboard, API endpoints, key management, setup wizard

#48Dashboard via hijack.js (HTTP Intercept)Gateway>

No way to see phone status at a glance without SSH.

#493-Page Dashboard (STATUS / KEYS / LOGS)Gateway>

Single dashboard page insufficient as PocketClaw grew. No way to view logs or manage keys without SSH.

#50API Key Management (Dashboard KEYS Page)Gateway>

Changing API keys requires SSH access and manual env file editing.

#51Setup Wizard (/setup)Gateway>

Setting up PocketClaw requires SSH + JSON config editing. No normal person can do this.

Boot — 4 hacks

Termux boot, healthcheck, crontab, daemon stopper, wake lock

#52Termux:Boot Auto-StartBoot>

Phone reboot means manual restart of gateway, sshd, crons. Not viable for autonomous operation.

#53Boot Script with WiFi RetryBoot>

Sleep 15 for WiFi is fragile. If WiFi takes 30s, everything fails silently.

#54Healthcheck (2-Phase Gateway Check)Boot>

Gateway process can be alive but not responding (hung state).

#55termux-wake-lock + Doze BypassBoot>

Doze mode suspends CPU after 30 min screen off. Telegram messages delayed 2-3 hours.

Desktop — 2 hacks

Merged kill loop, V8 semi-space tuning, final optimizations

#56Merged Kill Loop (3 bash -> 1 bash)Desktop>

3 separate while-true loops for background kills: SystemUI, dormant services, monitor. Each ~1.5 MB RSS.

#57kill-dalvik Cron (Auto-Free ~40 MB)Desktop>

Termux Dalvik VMs (com.termux ~49 MB + com.termux.boot ~40 MB) waste 89 MB after boot.