Repeated HAL logs & rejected zygote requests prior to vendor profile change

TangyJam

I'll state for potentially important context that I am prone to anxious overreaction (to the point of even breaking my phone preceding the Pixel after it was certainly compromised, prompting my full transition to a phone with GrapheneOS) and have only became insignificantly more digitally literate following these instances, so I'd like to apologise in advance for 1) the absence of retained logs - I factory reset the device -, and 2) my potentially uninformative descriptions or the mistakes I am oblivious to. I should also add I have no other device I can use for inspection at this time and am sending this from a borrowed phone.

That being said, allow me to explain - after experiencing increasingly sluggish performance more than usual, I began to inspect the logs on the phone which I had only done prior to attempt to familiarise myself gradually, and I noticed two things: constant HAL: ... messages, like 7 or 10 or so before more in the next timestap continuously in a stream, as well as repeated zygote: request rejected logs or something equivalent, and at this point, perhaps irrationally or rationally, I began to grow very worried. The issue had continued to persist for the next day or so even when I disabled dynamic code loading on all apps and revoked all background usage permissions, until at some stage I had read a log essentially saying that the vendor profile had been changed. It was at this point I grew very anxious, and decided to immediately wipe everything on the device (just a factory reset), and checked the logs after booting GrapheneOS again only to see a log informing me that the vendor profile had persisted. I tried to reflash the phone with a separate phone - following all the basic instructions that worked for first booting it, trying to unlock it after I changed the settings (OEM, developer etc etc), but I couldn't even get past that, I couldn't reflash the phone and the device/s I tried to use to do so bugged a lot when I used them. This issue happened a few months ago so its a bit blurry and I've put only details I have largely confirmed here, and I've been really too paranoid to do a lot since and could use some information and/or advice, even if it is only an idea of what could have happened or if this isn't as unusual as I assume, if anyone would be so kind. Thank you in advance.

userofgos

TangyJam I tried to reflash the phone with a separate phone - following all the basic instructions that worked for first booting it, trying to unlock it after I changed the settings (OEM, developer etc etc), but I couldn't even get past that, I couldn't reflash the phone and the device/s I tried to use to do so bugged a lot when I used them.

FYI this isn't necessary. All that is needed is to do a Factory Reset, this achieves the same thing as re-flashing

de0u

TangyJam Thanks for providing the important background context.

Without the exact text of any of the messages that were seen, it's hard to be confident about what was going on. Android includes multiple HAL components, each one of which can produce many messages.

Overall, it's probably important to know that, at present, the system log of a healthy uncompromised Android device contains many log entries. Also, it may be useful to keep in mind that professional effective malware tries to operate with a minimum number of extra log items (to be stealthy). So lots of messages doesn't mean there is a problem. More messages per second doesn't really indicate a higher risk of a problem.

The most productive way to determine the meaning of anything that shows up in an Android system log is to match the full and exact details of a log message against the source code of the relevant component. If that's not possible, posting the full and exact details of a log message in a forum may result in useful guidance. But in general the messages in an Android system log are designed by programmers to be useful to programmers. This is different from the messages that apps, or system components, pop up on the screen -- those are much more designed for non-programmers to read.

userofgos

TangyJam I noticed two things: constant HAL: ... messages, like 7 or 10 or so before more in the next timestap continuously in a stream

I'm not a developer, and it seems neither are you, regardless I don't think it's healthy to make assumptions about details, terminology, errors, etc found in system logs when we do not understand what we are looking at. It's all too easy to assume the worst when viewing System logs which are very technical and overwhelming to the untrained eye.

It is more likely that what you are seeing is more common than you might suspect and not something to worry about.

For example, you can find many discussions on this forum from users experiencing apps crashing constantly due to the Exploit Protections that GrapheneOS has developed which for the most part reveals how poorly their apps or coded. Sometimes newcomers see these crashes and immediately think they are experiencing someone trying to hack them, when often times its just GrapheneOS' Exploit Protections catching poorly coded apps.

Here's the documentation about what HAL's are: https://source.android.com/docs/core/architecture/hal