Is my Android device booting into a "stealth" partition?

Question

OK, this is a weird problem I’m encountering with an Android system I’ve been using without problems for several years now… and I’m practically out of ideas on how to potentially fix it.

Let’s start at the beginning to describe the problem and what I’ve been trying for the past 12 hours.

I woke up to my device this morning seeing that a recently installed app (via Google Play store) had crashed, and obviously a truckload of other apps and services also showed a hickup too.

1. I decided to simply uninstall it and reboot my phone (clearing the Dalvik cache while I was at it to avoid any hickups). The system booted as usual, but I noticed the app I just uninstalled is still there. Tried again, same result.

2. Knowing I have a 5-day old TWRP backup, I decided to restore that to get back to my old system state. Done, wiped Dalvik cache and rebooted. No success, the old system (with the app that shouldn’t be there) boots up. So, that TWRP backup wasn’t a solution.

3. Crying a silent tear, I decided to whipe all partitions via TWRP and simply reflash the ROM from scratch. Rebooted… and to my surprise the old system showed up (incl. wallpaper, settings, and that one weird app et al.)

4. Not wanting to give up, I even tried to install another ROM. TWRP confirms this succeeds. But rebooting again ignores every system change and boots that darn old OS (incl. settings and apps – which shouldn’t exist due to a factory reset.)

5. Getting a bit upset by all this I said to myself – OK, I’ll wipe all partitions and reboot. Having no OS the device should not boot at all, confirming I got rid of whatever messed up my device. Booted into TWRP, whiped ALL partitions listed (including the external SD). I confirmed this worked by using the TWRP file manager to check on the contents of every partition available. They are all empty. I was convinced this was going to work and my device would hickup due to a missing OS. So, I rebooted… and whoops, the device again boots into the system (with that app, the old wallpaper, etc.) Logic says this can’t be – since all partitions are empty.

Long story short: I meanwhile tried about every trick in my bag to get rid of the old OS, but no matter what I do – I can’t. Whiping, flashing, etc. doesn’t seem to change the fact the phone happily boots into an OS that – according to the TWRP file manager – doesn’t exist.

Now, I’m out of ideas on how to fix it. It’s almost as if I’m fighting some "hidden/stealth" partition which gets booted into. As said: this even happens when I whipe all partitions (System + Cache + Data + Internal Storage + Micro SD card) followed by a Format Data) and then reboot.

Meanwhile, I’m starting to suspect the last app I installed via the Google Play store might have been malware. But that shouldn’t result in a bootable OS after a complete device whipe.

• Can it nevertheless be that my Android device boots into a "stealth" partition? If, how can I get rid of it when I can’t see it via TWRP?
• Is there any way to hard-format and repartition the internal SDs and recreate the partitions besides TWRP’s functionality? (In case there’s some problem with one of the partitions, which TWRP doesn’t actually whipe.)
• Or (which would really make my day) has anyone ever experienced something alike and has a solution which might help me fix this by getting rid of the old OS which the device seems to detect who-knows-where and happily boots up?

EDIT

Since a comment asked for some version details et al:

• Device is a Samsung GT-P3100, aka espresso3g
• TWRP 3.2.1-0

• Rom that is (let’s just call it) “non-killable” is SlimKat. To be more specific

  Slim-4.4.4.build.9.0-OFFICIAL-8293
  

Looking at things again and again it seems TWRP fails to correctly whipe one or more partitions (System, Data), even though there is not a single error message or warning when doing so.

I also tried erasing all partitions as well as the internal storage and flash lineage-13.0-20180211-nightly-espresso3g-signed, which results in an error 7 (rebooting the same darn “non-killable” SlimKat).

Same goes for trying to erase all partitions as well as the internal storage and flash Slim_espresso3g-6.0.1-20180414-1959, which results in an error 7 (rebooting the same darn “non-killable” SlimKat).

Also, it might be helpful to know I have another espresso3g device available, which doesn’t show any similar problems. On that other device, I can flash, whipe, backup, recover, and consequently successfully boot into the related ROM as expected.

Therefore, I’m suspecting there’s something wrong with one or more partitions, which also prevents TWRP from correctly formatting in contrast to its claims. Even using the TWRP terminal and being crazy enough to try rm -rf /data/* and rm -rf /system/* seemed to work at first glimpse. Yet, the partition contents simply shows up on reboot as if nothing happened. Another indicator it might be some partition hickup is that – any change to any setting or even starting any app in the booting “non-killable” SlimKat results in the whole OS collapsing piece by piece until the device reboots into recovery.

Answer 1

Seems I’ve found the answer at https://andi34.github.io/faq.html

Quote:

I can't change my rom, wipe / format doesn't work. Nothing changed after flashing with Odin. 16 GB Tab 2 have a known faulty EMMC (MAG2GA). It can happen, that your EMMC get “read only”, so you can’t perform any write actions (also you can’t format) anymore.

From the EMMC data sheet:

5.1.7 End of Life Management:

The end of device life time is defined when there is no more available reserved block for bad block management in the device. When the device reaches to end of its life time, device shall change its state to permanent write protection state. In this case, write operation is not allowed any more but read operation are still allowed.

But, reliability of the operation can not be guaranteed after end of life.

On a faulty EMMC firmware it happens a lot faster.

What are the symptoms?

• Uninstalled apps and deleted files are back after a reboot
• Formating the storage doesn’t work (after reboot the old rom and apps are back)
• You can flash whatever you like via Odin
• it showes “passed” but after reboot nothing changed (e.g. still no StockRom or still the old Recovery you had previously installed)

… there might be some more, but only to mention some …

In most cases, the issue can be fixed by a EMMC firmware update, but you need someone who’s able to do it (possible via ISP, nothing you can do esylie at home yourself). In some bad cases you need to find someone who can replace your EMMC.

Well, that’s that then. Obviously I will have to buy myself a new device first thing in the morning, after crying a river all the way to the bank while blaming Samsung for its End of Life Management.