SUNMI V3 Liberation

Debloat and no-root neutralization of the Sunmi "Experience mode" trial timer, the leftover MDM Device Owner, and the fleet device-lock on second-hand SUNMI V3 POS devices (e.g. ex-Deliveroo units resold on marketplaces).

Turn a locked, single-purpose ex-fleet POS into a general-purpose Android device for art, signage, hacking, or e-waste rescue — without rooting.

---

⚠️ Read this first — legal / responsible use

• Use this only on hardware you legally own.
• This is intended for right-to-repair, e-waste rescue, security research and education. Do not use it to defeat an active lease/rental agreement you still owe money on, or on lost/stolen devices.
• It voids any warranty and may violate the terms you accepted with the original vendor. You assume all responsibility.
• Everything here is non-destructive and reversible (see scripts/restore.sh). Nothing is flashed; the bootloader is not touched. No factory reset.

---

What this does (no root required)

Using only privileged adb (shell, uid 2000) — no root, no unlock, no flashing:

1. Kills the "Experiencing – N days left" trial timer by disabling com.sunmi.welcome and revoking its overlay permission. The countdown lives in that app; disabled, it never runs.
2. Debloats ~15 Sunmi/telemetry/remote-management/store packages (pm uninstall --user 0, restorable).
3. Neutralizes the leftover MDM (com.sunmi.remotecontrol.pro, a Device Owner that can't be removed without root) by restricting its network and guiding you to a proper per-app firewall block.
4. Disables the ex-fleet app (e.g. Deliveroo) that the Device Owner blocks from being uninstalled.

Result: a quiet, usable device with no trial nag and no phone-home — without ever risking a brick.

What it does NOT do

• It does not remove the Device Owner or the ro.sunmi.dev_lock_on lease-lock framework — that requires root (see ROADMAP).
• It does not activate the device (Sunmi's server refuses re-activation of ex-fleet units anyway — see docs/FINDINGS.md).

---

Requirements

• A SUNMI V3 with USB debugging enabled (Settings → Developer options).
• adb (Android platform-tools) on your PC.
• The device authorized for adb (adb devices shows device, not unauthorized).

Usage

# Linux / macOS / WSL / Git-Bash
adb devices                 # confirm the device is listed and authorized
./scripts/liberate.sh       # apply the neutralization

# Windows PowerShell
.\scripts\liberate.ps1

To undo everything:

./scripts/restore.sh

Optional helper — reset the trial timer to 14 days without a factory reset (only relevant if you keep com.sunmi.welcome enabled):

./scripts/reset-timer.sh

After running, follow the on-screen notes to (optionally) install a no-root firewall (NetGuard) and/or block *.sunmi.com on your router to fully stop the MDM from phoning home. See docs/FINDINGS.md for the why.

---

Roadmap — full liberation (root)

The no-root path neutralizes the problem but leaves the Device Owner dormant. To permanently remove the Device Owner and the dev_lock, root is required. On the V3 (Qualcomm QCM4325, bootloader locked but OEM-unlock allowed) the only self-contained route we've found is:

1. Dump init_boot.img via EDL / QFIL (read-only, non-destructive) — needs a QCM4325 firehose programmer.
2. Patch with Magisk, fastboot flashing unlock (wipes), flash the patched init_boot.
3. With root: delete the Device Owner, resetprop ro.sunmi.dev_lock_on false, uninstall the MDM for good.

This is not yet automated here and carries real (but reversible, if you keep the EDL backup) risk. Contributions welcome.

---

Documentation

Full technical write-up of how the lock works and how it was reverse-engineered: docs/FINDINGS.md.

License

MIT — see LICENSE.