Hi all
Is there software that enables the creation of virtual machines on an Android phone?
For context, I'm looking to run a Linux desktop on my phone.
Is the best way to accomplish this to use Termux instead?
Thanks in advance.
So basically my phone OS has been corrupted, and so whenever i go to turn it on, i see a dm-verity corruption message before the phone either shuts back down, or I press the power button so that it continues anyway, however this doesn't work, as the phone either starts bootlooping, or it stays stuck on either The Mi startup screen you see when you turn on your phone or stuck on the HyperOS screen. My problem being is that I am unable to flash new firmware on it, because the phone's bootloader is locked, and to unlock it, i need to turn on the phone, turn on OEM unlocking since Im not sure if i have it on or off, and connect it to a Mi account and also add a recovery phone number. Because the phone was reset before it was broken, and there was no Mi account added to it. If anyone knows how to forcibly get the phone to boot into the OS, Or some way to flash firmware on it without the bootloader being unlocked, Or somehow unlocking the bootloader without using a Mi account, I would greatly appreciate It.
Did a read-only ADB recon on mine (network ADB, no modifications). Sharing in case it helps anyone else and to ask if there's any existing work on this platform I've missed.
**Identification:**
- Codename: `queen`, board: `tl1`
- SoC: Amlogic TL1, 4× Cortex-A55 (running AArch32-only, no 64-bit ABIs)
- 2 GB RAM, 10 GB /data
- Android 9 (SDK 28), security patch 2019-11-05
- Build: `Fengmi/queen/queen:9/PQ3B.190705.003/2.0.0.1422:user/release-keys` (Feb 2022)
- Brand: Fengmi (Formovie internationally), rebadged as Wemax Go Advance for export
**Boot/security state:**
- AVB 2.0, vbmeta `locked`, verifiedbootstate `green`
- dm-verity `enforcing` on both /system and /vendor
- SELinux enforcing, user build, invalidate-on-error=yes
- Dedicated /mnt/vendor/tee partition (TrustZone active)
- Single-slot layout (no A/B), single-slot OTA via /cache
- /proc/partitions is denied to shell user (SELinux tightened beyond stock)
**Vendor stack:** ~25 Fengmi/Formovie system apps handling imaging, autofocus, keystone, launcher, settings, plus one custom native binder service (`media.fmplayer`). Also ships with `com.xiaomi.mi_connect_service` as a priv-app even on the export build.
**Questions for the community:**
Has anyone successfully rooted or unlocked any Fengmi/Formovie "queen" or any Amlogic TL1 projector? The main XDA Xiaomi/Fengmi/Wemax thread covers rainman/batman/jerry/eva but I haven't found queen mentioned.
Is there a known USB-burn / Amlogic emergency-flash procedure for TL1 that survives a locked vbmeta? (I'm assuming no, but asking.)
Any leaked or shared `queen` firmware dumps floating around? Even partial — boot.img, vbmeta.img, or a full update.zip — would be useful for reference.
Has anyone characterized the `media.fmplayer` binder service or the Fengmi imaging stack? Curious whether the optics control surface is reachable from userland without root.
Not planning anything destructive — fully aware that locked AVB + no A/B + no published recovery = single-shot device. Just trying to map what's been done and whether queen is a dead-end or just unexplored.
Will share my full recon dump (getprop, package list, mounts, service list, bugreport) if anyone wants it for reference.