I'm also thinking of this. Not quite what you said. But more general. I think using HANS on system apps (transfer app or settings app, maybe) and modifying the romfs could lead to a kernel exploit, somehow, or at least more permissions.

Click to expand...