Six brbsix

hi, i'm daniel. i'm a 15-year-old high school junior. in my free time, i hack billion dollar companies and build cool stuff.

3 months ago, I discovered a unique 0-click deanonymization attack that allows an attacker to grab the location of any target within a 250 mile radius. With a vulnerable app installed on a target's phone (or as a background application on their laptop), an attacker can send a malicious payload and deanonymize you within seconds--and you wouldn't even know.

I'm publishing this writeup and research as a warning, especially for journalists, activists, and hackers, about this type of undetectable attack. Hundreds of applications are vulnerable, including some of the most popular apps in the world: Signal, Discord, Twitter/X, and others. Here's how it works:

Cloudflare

By the numbers, Cloudflare is easily the most popular CDN on the market. It beats out competitors such as Sucuri, Amazon CloudFront, Akamai, and Fastly. In 2019, a major Cloudflare outage k

Pre-Installation:

Starting in crDroid 10.x (Android 14.0) and onwards, we're using retrofitted dynamic partitions to avoid the constant threat of running out of space in the GPT system partition with any sizeable Google Apps package. Don't panic.

This will not permanently alter or damage your device, as it makes no changes to the underlying GPT partition table. Following any ROM's installation guide will overwite the changes, so there are no extra steps to "convert back to normal partitions".

This does mean that you cannot use TWRP or other custom recovery to install crDroid on the OnePlus 6-series, as they do not have the necessary kernel and dynamic partition layout changes compiled in to support the way we're doing things.
Phone setup:

PostgreSQL is Enough

Background and Cron Jobs

Prerequisites

Ensure you're running OxygenOS 11.1.2.2 firmware on your current slot.
If you do not have that firmware installed, grab it for you device from the following links:
enchilada (OnePlus 6)
fajita (OnePlus 6T)

Required Files

Download the latest platform-tools.

Archive.org Scanned Book Downloader Bookmarklet

A simple "1-click" javascript approach to downloading a scanned book from archive.org to read at your leisure on the device of your choosing w/out having to manually screenshot every pages of the book by hand. In short it's a glorified "Save Image As..." approach but consolidated down to "1 click". BTW there may be a much better option than this out there - I just built this as an autistic project to see if it would work.

Demo Video

Obligatory Legal/Disclaimer:

By using this script you agree to delete all book files/images after your 1 hour or 14 days is up! I don't support using this script for any other use cases. After all, none of us have ever kept a library book past it's return date, right?

Install Termux, an Android terminal emulator that provides a Linux execution environment and various tools.
Update system packages in Termux:
```
$ pkg update -y
```

	#!/usr/bin/env -S bash -c "docker run -p 8080:8080 -it --rm \$(docker build --progress plain -f \$0 . 2>&1 \| tee /dev/stderr \| grep -oP 'sha256:[0-9a-f]*')"

	# syntax = docker/dockerfile:1.4.0

	FROM node:20

	WORKDIR /root

	RUN npm install sqlite3

	pm disable-user --user 0 com.caf.fmradio
	pm disable-user --user 0 com.coloros.activation
	pm disable-user --user 0 com.coloros.activation.overlay.common
	pm disable-user --user 0 com.coloros.alarmclock
	pm disable-user --user 0 com.coloros.appmanager
	pm disable-user --user 0 com.coloros.assistantscreen
	pm disable-user --user 0 com.coloros.athena
	pm disable-user --user 0 com.coloros.avastofferwall
	pm disable-user --user 0 com.coloros.backuprestore
	pm disable-user --user 0 com.coloros.backuprestore.remoteservice

	#!/bin/bash

	set -o errexit
	set -o nounset
	set -o pipefail

	target="${1:-/opt/sublime_merge/sublime_merge}"

	check_sha() {
	local sha_valid

	#!/data/data/com.termux/files/usr/bin/bash
	if [ -z "${1:-}" ]; then
	exit 1
	fi

	url_is_supported() {
	REPLY=""
	declare -A arr

	case "$1" in