The Phantomhardening protocol.
Every Phantom-tier device passes through a seven-station audit before it leaves our Sydney facility. This document details each station — the kernel work, the blob excision, the eSIM plumbing, the physical modifications, the app suite, the tamper-evident shipping chain, and finally the reproducible-build verification anyone can perform themselves. Nothing on this page is marketing. Every claim corresponds to a checklist item in our internal QA workflow.
Kernel-level hardening
The stock Google kernel is replaced with a GrapheneOS build compiled with our internal hardening flags: CFI (Control-Flow Integrity) forced, KASLR entropy widened, hardened_malloc replacing the default allocator, and unused syscalls masked. The build tag is signed and reproducible against our public checksum registry.
- [01]hardened_malloc + slab quarantine
- [02]Full CFI on every executable
- [03]KASLR + KPTI on every boot
- [04]Zeroed pages on free()
- [05]Syscall filter (seccomp) per app
Proprietary blob excision
Every closed-source binary that shipped from Google is audited. Where a replacement exists we swap it (Fossify, Aurora, Molly). Where it doesn't, we neuter the blob's network privileges and route its telemetry sockets to /dev/null. The result: no undocumented radio can phone home.
- [01]Play Services · removed
- [02]Play Store · replaced (F-Droid + Aurora)
- [03]Play Protect · disabled
- [04]GPS assist blobs · sandboxed
- [05]OEM diagnostic partitions · read-only
Encrypted eSIMs
Each Phantom device is configured with two eSIM slots: a primary provisioned to a carrier of your choice, and a secondary quarantine profile that routes all data through a WireGuard tunnel with kill-switch. We provide printed activation cards; the eSIM profile is delivered by encrypted courier or PGP-signed email.
- [01]Two eSIM slots per device
- [02]Primary + quarantine profiles
- [03]Kill-switch on secondary APN
- [04]IMSI catcher detector installed
- [05]Carrier-agnostic (BYO or ours)
Physical hardware modifications
For the operator who cannot tolerate a single acoustic leak: primary microphone modules physically disconnected at our facility, USB data pins severed (power still works), and location services blocked at the sensor bus. Bluetooth is retained for accessory use only.
- [01]Mic module physical disconnect
- [02]USB data pin severed (power only)
- [03]Location bus hardware-blocked
- [04]Speaker retained (playback still works)
- [05]Bluetooth accessory-scope only
Encrypted app suite
Every Phantom ships with a curated toolkit installed and configured. Nothing bolted on. Nothing left to chance.
- [01]Molly · hardened Signal fork
- [02]Session · metadata-free messaging
- [03]Aegis · offline 2FA
- [04]OnionShare · Tor-native file share
- [05]KeePassDX · encrypted vault
- [06]Mullvad Browser · fingerprint-resistant
- [07]Orbot · Tor for all apps
Tamper-evident chain of custody
Every device receives a serialised seal number. Screws are lacquered with glitter nail polish; a macro photograph is taken and delivered to you before dispatch. Sealed in a Faraday bag inside a holographic tamper-evident pouch. Any mismatch on arrival = do not open. Contact us immediately.
- [01]Serialised seal number per unit
- [02]Glitter-lacquer on every screw
- [03]Macro-photo verified before ship
- [04]Faraday + holographic pouch
- [05]Signature-on-delivery only
Reproducible-build verification
Every Phantom-tier release ships as a byte-for-byte reproducible build. We publish a signed manifest containing SHA-256 hashes for boot.img, system.img and vendor.img for each device. Anyone can pull the manifest, rebuild GrapheneOS from source with our published patch stack, and confirm the hashes match. If they don't — don't flash the device. Contact us.
| Device | Image | SHA-256 |
|---|---|---|
| pixel-9 | boot.img | PENDING_PER_RELEASE_HASH_boot_pixel9 |
| pixel-9 | system.img | PENDING_PER_RELEASE_HASH_system_pixel9 |
| pixel-9 | vendor.img | PENDING_PER_RELEASE_HASH_vendor_pixel9 |
| pixel-9-pro | boot.img | PENDING_PER_RELEASE_HASH_boot_pixel9pro |
| pixel-9-pro | system.img | PENDING_PER_RELEASE_HASH_system_pixel9pro |
| pixel-9-pro | vendor.img | PENDING_PER_RELEASE_HASH_vendor_pixel9pro |
| pixel-10 | boot.img | PENDING_PER_RELEASE_HASH_boot_pixel10 |
| pixel-10 | system.img | PENDING_PER_RELEASE_HASH_system_pixel10 |
| pixel-10 | vendor.img | PENDING_PER_RELEASE_HASH_vendor_pixel10 |
# 1. Pull the signed manifest + its clearsigned envelope curl -s https://phantomphone.info/api/verify/manifest > phantom.json curl -s https://phantomphone.info/api/verify/manifest.asc > phantom.asc # 2. Verify the signature against the admin key (fingerprint 0977 1DBB … BCC2) gpg --verify phantom.asc # 3. Extract the images off your device (or use the ones we ship on the USB stick) adb pull /dev/block/by-name/boot boot.img adb pull /dev/block/by-name/system system.img adb pull /dev/block/by-name/vendor vendor.img # 4. Compare sha256sum boot.img system.img vendor.img # expected hashes are listed in phantom.json → artifacts[device].images[].sha256 # 5. Any mismatch = your device has been tampered with. Do not use. Contact admin@phantomphone.info.
- [01]Reproducible-build toolchain pinned per release
- [02]Public GrapheneOS patch stack (git-verifiable)
- [03]SHA-256 per image, per device, per release
- [04]Manifest clearsigned with admin PGP key
- [05]Printed hash card enclosed with every unit
- [06]Public build changelog with prior tags