This is the basic installation. You can use it as a guide.

1. Requirements

This is a little bit tricky! It can be different depends on your phone.

If you're not sure how it all works, just send us an email or create an issue.

1.1. Hardware

You need an Android phone. There is no proper way with an Apple phone.

1.1.1. Check bootloader

Find out if your phone has the ability to unlock your bootloader.
xda-developers.com offers a wide selection of phones that will help you find a tutorial on opening your bootloader, if possible.

Straight to your manufacturer:

Huawei & Honor discontinued support for unlocking the bootloader. There are paid ways out there that I do not like to post here. Sell the phone and buy another one.
Don't open your bootloader now! Let's do it when we go through the whole installation. Just check it if it's possible or not. If not, you can sell your phone and buy another one. That's the only way, sorry.

 

1.2. Software

 

1.2.1. ADB & fastboot drivers

Depends on your operating system (Linux, Windows, Mac) you have to download the driver for ADB & Fastboot connection (computer to phone).

Got to searx.pwoss.org (or whatever you prefer) and search for adb drivers windows linux and mac. There you can follow a tutorial.

 

Arch Linux & Manjaro Linux:

sudo pacman -S android-tools android-udev

 

1.2.2. Custom ROM

Download your ROM from lineage.microg.org.
Get the rom to your phone. Use an external micro SD card if it's possible.

 

1.2.3. TWRP recovery

Get the recovery from twrp.me

 

1.2.4. Applications

1.2.4.1. Magisk from GitHub:

Magisk-'latest-version'.zip
MagiskManager-'latest-version'.apk
Magisk-uninstaller-.zip

Magisk is necessary to get root access and to install EdXposed & riru.

1.2.4.2. Riru from GitHub:

magisk-riru-core-'latest-version'.zip

Riru is necessary for EdXposed.

1.2.4.3. EdXposed from GitHub:

magisk-EdXposed-'latest-version'.zip
EdXposedInstaller_'latest-version'.apk
EdXposedUninstaller_rec.zip

EdXposed is necessary for XPrivacyLua

1.2.4.4. NanoDroid from nanolx.org:

NanoDroid-BromiteWebView-.zip

1.2.4.5. XPrivacyLua from F-Droid:

eu.faircode.xlua_'latest-version'.apk

Scroll down to Download APK

1.2.4.6. AFWall+ from F-Droid:

dev.ukanth.ufirewall_'latest-version'.apk

Scroll down to Download APK

Get all downloaded applications on your phone. Use an external micro SD card if it's possible.
Leave eu.faircode.xlua_'latest-version'.apk, dev.ukanth.ufirewall_'latest-version'.apk, MagiskManager-'latest-version'.apk and EdXposedInstaller-'latest-version'.apk on your computer.

 

1.2.5. Heimdall (Samsung phones only)

Download Heimdall from glassechidna.com.au

This is necessary to install TWRP.

Arch Linux & Manjaro Linux:

sudo pacman -S heimdall

 

2. How To

If you got every requirements then we can go further with the first step (4 steps in total).

Get yourself a coffee or tea and let's go through this.

2.1. Step 1 - Bootloader

2.1.1. Backup

If you haven't done it already it's now a good time to do it. Get all your photos, videos, contacts, calendar, etc. on a separate device.

 

2.1.2. ADB connection & unlock bootloader (Not for Samsung phones)

 

2.1.2.1. ADB

Go to your Settings and click on About phone. Push the Build number seven times or more. Go back to the main view of the Settings and click on System and Developer options (maybe advanced first). Turn Android debugging on.

Connect your phone via USB to the computer.

 

2.1.3. Unlock bootloader

Follow the instruction of the requirements - bootloader (manufacturer) to unlock your bootloader.

When you unlock your bootloader, all files on your phone will be deleted!

After that reboot your phone without any new installation (just to save time).

 

2.1.4. TWRP (Not for Samsung phones)

This can be necessary again: Go to your Settings and click on About phone of your phone. Push the Build number seven times or more. Go back to the main view of the Settings and click on System and Developer options (maybe advanced first). Turn Android debugging on.

Connect your phone via USB to the computer again. And go through the following commands:

adb reboot bootloader
fastboot flash recovery your-twrp.img
adb reboot recovery

 

2.1.5. Heimdall (Samsung phones only)

 

2.1.5.1. Reboot to Bootloader

Reboot your phone and hold VOL-DOWN, Power Button and the Home Button until you see a warning message. Now VOL-UP and you'll see an Android logo and "Downloading ..." etc..
Connect your phone via USB to your computer.

 

2.1.6. Start Heimdall

2.1.6.1. Device detection

Start Heimdall and go to Utilities. Click on Detect by Detect Device. You can see by Output Device Detected.

 

2.1.6.2. Create .pit file

Now you have to create a .pit (Partition Information Table) file.
Click on Save as by Download PIT and choose a folder and name -> Save -> Download.

Output:

Heimdall v1.4.2  
  
Copyright (c) 2010-2017 Benjamin Dobell, Glass Echidna  
http://www.glassechidna.com.au/  
  
This software is provided free of charge. Copying and redistribution is  
encouraged.  
  
If you appreciate this software and you would like to support future  
development please consider donating:  
http://www.glassechidna.com.au/donate/  
  
Initialising connection...  
Detecting device...  
Claiming interface...  
Setting up interface...  
  
Initialising protocol...  
Protocol initialisation successful.  
  
Beginning session...  
  
Some devices may take up to 2 minutes to respond.  
Please be patient!  
  
Session begun.  
  
Downloading device's PIT file...  
PIT file download successful.  
  
Ending session...  
Releasing device interface...  

 

2.1.6.3. Flashing TWRP

Go to Flash and click on Browse by PIT. Use the just created .pit file. Click on Add by Partitions (files) and choose by Partition Details / Partition Name RECOVERY. Click on Browse by File and choose your-twrp.img.
Now click on Start.

Check if an installation line appears on your phone.

You can also see a process in Heimdall under Status. It should look like this:

Initialising connection...
Detecting device...
Claiming interface...
Setting up interface...

Initialising protocol...
Protocol initialisation successful.

Beginning session...

Some devices may take up to 2 minutes to respond.
Please be patient!

Session begun.

Downloading device's PIT file...
PIT file download successful.

Uploading RECOVERY
0%
6%
13%
19%
26%
32%
39%
46%
52%
59%
65%
72%
79%
85%
92%
98%
100%

RECOVERY upload successful

Ending session...
Rebooting device...
Releasing device interface...

 

2.1.6.4. Trouble?

For Linux. If you encounter errors while trying to download your .pit file, you must create a new file on your computer and add the following:

sudo nano /etc/udev/rules.d/79-samsung.rules
ATTRS{idVendor}=="04e8", ENV{ID_MM_DEVICE_IGNORE}="1"
ATTRS{idVendor}=="04e8", ATTRS{product}=="Gadget Serial", ENV{ID_MM_DEVICE_IGNORE}="1", ENV{MTP_NO_PROBE}="1"
ctrl + x & yes
sudo systemctl restart systemd-udevd
Try it again. You may need to restart Heimdall if it's still running.

 

2.2. Step 2 - Recovery

2.2.1. Reboot to new recovery

After that, you can reboot your phone to the recovery. Hold VOL-UP, Power Button and the Home Button until you reach the new recovery TWRP.

 

2.2.1.1. WIPE / delete internal storage

Click on Wipe and on Advanced Wipe and select only:

  • Internal Storage

Now Swipe to Wipe.

Go back to the main view.

 

2.2.1.2. Backup with TWRP

Before we flash a custom-ROM let's do a "quick" backup of your system.
Click on Backup and Select every Partition and Swipe to Backup.

Go back to the main view.

 

2.2.1.3. WIPE / delete your phone

Click on Wipe and on Advanced Wipe and select only:

  • Dalvik / ART Cache
  • System
  • Data
  • Cache

Now Swipe to Wipe.

Go back to the main view.

 

2.2.2. Custom ROM

Click on Install and Select Storage and choose Micro SD card. Look for lineage-16.0-20190327-microG-.zip click on it and Swipe to confirm Flash. Wait until it's done. And wipe the Cache.

Go back to the main view.

 

2.2.3. Applications

 

2.2.3.1. Magisk, NanoDroid, Riru & EdXposed

Click on Install and Select Storage and choose Micro SD card. Look for Magisk-'latest-version'.zip, NanoDroid-BromiteWebView-'latest-version'.zip, magisk-riru-core-'latest-version'.zip and magisk-EdXposed-'latest-version'.zip. Click at first on Magisk-'latest-version'.zip and then Add more Zips and add the other files.
Now Swipe to confirm Flash.

Go back to the main view and click on Reboot and System.

<<Note("It may be necessary to start the phone first before installing all these "applications". This means that after installing your custom ROM you will need to boot the system first. Each additional installation of the application must first be started on the system. Install them all separately if you have problems afterwards.

 

2.3. Step 3 - Applications

2.3.1. Internet connection

Turn all your internet connection off at first.

 

2.3.2. Install Magisk, EdXposed, XPrivacyLUA & AFWall+ applications

 

2.3.2.1. On your phone

Go to your Settings and click on About phone of your phone. Push the Build number seven times or more. Go back to the main view of the Settings and click on System and Developer options (maybe advanced first). Turn Android debugging on.

Connect your phone via USB to the computer.

 

2.3.2.2. On your computer

Start the terminal and go to the folder where you downloaded ... .apk files. Maybe /home/user/Download:

2.3.2.2.1. Magisk

adb install MagiskManager-'latest-version'.apk
Check your phone for Magisk. Start Magisk and click on the "burger" (three lines top - left) and on modules. Check if all are selected (Riru - Core, Riru - Ed Xposed). If not do a reboot.
2.3.2.2.2. EdXposed
adb install EdXposedInstaller_'latest-version'.apk && adb install eu.faircode.xlua_'latest-version'.apk && adb install dev.ukanth.ufirewall_'latest-version'.apk

Check your phone for EdXposed Installer. Start EdXposed Installer and click on the "burger" (three lines top - left) and on modules. Select AFWall+ and XPrivacyLUA.

Do a reboot.

 

2.4. Step 4 - Configuration

2.4.1. Internet connection

Turn your Internet on (WIFI or / and LTE).

 

2.4.2. AFWall+

Start AFWall+ and click on the three dots (top-right) and click on Preferences and on UI Preferences

 

2.4.2.1. UI preferences

Select:

  • Enable Notifications
  • Show notification icon
  • Rules Progress
  • Show UID for apps
  • Confirm AFWall+ disable

Go back and click on Rules/Connectivity.

 

2.4.2.2. Rules / connectivity

Select:

  • Active rules
  • Roaming control
  • LAN control
  • VPN control

<<Note("Check IPv6 Chains if you are using IPv6.

Go back to the main view (first start of the app).

 

2.4.2.3. Allow internet access for certain apps

Select WLAN, Mobile Connection (2 arrows without roaming (R)) and VPN for:

  • [1000] Android System, Advanced, ...
  • [10008] Media Storage, Download ...
  • Android System Web View
  • Browser
  • F-Droid
  • Magisk Manager
  • microG DroidGuard Helper
  • *

Depending on your application, you may need to give your application access to the Internet when needed. Each time you install an application, a notification is displayed, and you can choose whether this application needs Internet or not. If no pop-up notification is displayed, it may be because the AFWall + message is not working properly or your installed application does not require Internet access.

 

2.4.3. microG

 

2.4.3.1. Permissions

Start the microG application and grant all necessary permissions. Then click on Self-Check and check everything. It should have everything selected. Maybe UnifiedNlp status did not select everything. That's okay.

 

2.4.3.2. Google device registration & cloud messaging

Go back to microG Settings and click Google Device Registration and enable it. The same applies to Google Cloud Messaging.

If you do not install apps from the Play Store via Aurora, you do not need to enable Google.

If you're using AdAway or other ADS blocking apps on your phone you'll have to add to your Whitelist = mtalk.google.com if you need Google.

 

2.4.4. XPrivayLUA

This is quite similar like AFWall+. Start XPrivacyLUA and click on the "burger" (three lines top - left) and select Notify on new apps and Restrict new apps.

Example:

  • Contact Apps need the possibility to read you contacts. You have to unselect Get contacts.
  • GPS need access to your Location. You have to unselect Get location.

It's actually pretty obvious.

XPrivacyLUA doesn't block the contacts for example. It fakes it. If you block Read clipboard and you paste a name to your Contact app it doesn't paste the name. It paste Private instead.

Don't forget that.

That's it. Enjoy

 



Problems?

If you encounter problems, simply create an issue.