diff --git a/configs/permissions/privapp-permissions-mediatek.xml b/configs/permissions/privapp-permissions-mediatek.xml
new file mode 100644
index 0000000..88f63c3
--- /dev/null
+++ b/configs/permissions/privapp-permissions-mediatek.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="utf-8"?>
+<permissions>
+    <privapp-permissions package="com.mediatek.engineermode">
+        <permission name="android.permission.WRITE_SECURE_SETTINGS"/>
+        <permission name="android.permission.DUMP"/>
+        <permission name="android.permission.WRITE_MEDIA_STORAGE"/>
+        <permission name="android.permission.READ_PRIVILEGED_PHONE_STATE"/>
+        <permission name="android.permission.READ_PRECISE_PHONE_STATE"/>
+        <permission name="android.permission.CONNECTIVITY_INTERNAL"/>
+        <permission name="android.permission.BLUETOOTH_PRIVILEGED"/>
+        <permission name="android.permission.LOCATION_HARDWARE"/>
+        <permission name="android.permission.MASTER_CLEAR"/>
+        <permission name="android.permission.REAL_GET_TASKS"/>
+        <permission name="android.permission.READ_LOGS"/>
+        <permission name="android.permission.MODIFY_PHONE_STATE"/>
+        <permission name="android.permission.MANAGE_USB"/>
+    </privapp-permissions>
+</permissions>
diff --git a/device.mk b/device.mk
index 5823c70..732a624 100644
--- a/device.mk
+++ b/device.mk
@@ -172,6 +172,10 @@ PRODUCT_USE_DYNAMIC_PARTITIONS := true
 # Enforce generic ramdisk allow list
 $(call inherit-product, $(SRC_TARGET_DIR)/product/generic_ramdisk.mk)
 
+# Engineering mode
+PRODUCT_PACKAGES += \
+    libjni_shim
+
 # FastbootD
 PRODUCT_PACKAGES += \
     android.hardware.fastboot@1.1-impl-mock \
@@ -331,6 +335,7 @@ PRODUCT_PACKAGES += \
 
 # Permissions
 PRODUCT_COPY_FILES += \
+    $(LOCAL_PATH)/configs/permissions/privapp-permissions-mediatek.xml:$(TARGET_COPY_OUT_SYSTEM)/etc/permissions/privapp-permissions-mediatek.xml \
     frameworks/native/data/etc/android.hardware.audio.low_latency.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.audio.low_latency.xml \
     frameworks/native/data/etc/android.hardware.bluetooth.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.bluetooth.xml \
     frameworks/native/data/etc/android.hardware.bluetooth_le.xml:$(TARGET_COPY_OUT_VENDOR)/etc/permissions/android.hardware.bluetooth_le.xml \
diff --git a/proprietary-files.txt b/proprietary-files.txt
index a5d4469..633f843 100644
--- a/proprietary-files.txt
+++ b/proprietary-files.txt
@@ -1432,6 +1432,17 @@ vendor/lib64/libtlcWidevineModularDrm.so
 vendor/lib64/liburee_meta_drmkeyinstall.so
 vendor/lib64/libwvhidl.so
 
+# EngineerMode
+lib/libem_support_jni.so
+lib64/libem_support_jni.so
+priv-app/EngineerMode/EngineerMode.apk:priv-app/EngineerMode/EngineerMode.apk
+-vendor/bin/em_hidl
+vendor/etc/init/em_hidl_user.rc
+-vendor/lib64/vendor.mediatek.hardware.engineermode@1.0.so
+-vendor/lib64/vendor.mediatek.hardware.engineermode@1.1.so
+-vendor/lib64/vendor.mediatek.hardware.engineermode@1.2.so
+-vendor/lib64/vendor.mediatek.hardware.engineermode@1.3.so
+
 # Fingerprint
 vendor/bin/hw/android.hardware.biometrics.fingerprint@2.1-service
 vendor/etc/init/android.hardware.biometrics.fingerprint@2.1-service.rc
@@ -1981,4 +1992,4 @@ vendor/lib64/vendor.transsion.hardware.tranlogconfig@1.0.so
 vendor/bin/wlan_assistant
 vendor/etc/init/init.wlan_drv.rc
 vendor/etc/init/wlan_assistant.rc
-vendor/lib64/libwifi-hal.so:vendor/lib64/libwifi-hal-mtk.so;FIX_SONAME
\ No newline at end of file
+vendor/lib64/libwifi-hal.so:vendor/lib64/libwifi-hal-mtk.so;FIX_SONAME
diff --git a/shims/Android.bp b/shims/Android.bp
new file mode 100644
index 0000000..92aa5bc
--- /dev/null
+++ b/shims/Android.bp
@@ -0,0 +1,17 @@
+cc_library_shared {
+    name: "libshim_sensors",
+    whole_static_libs: [
+        "android.hardware.sensors@1.0-convert"
+    ],
+    shared_libs: [
+        "libhardware",
+        "libhidlbase",
+        "android.hardware.sensors@1.0"
+    ],
+    vendor: true
+}
+
+cc_library_shared {
+    name: "libjni_shim",
+    srcs: ["engineering_mode/libjni_shim.c"]
+}
diff --git a/shims/engineering_mode/libjni_shim.c b/shims/engineering_mode/libjni_shim.c
new file mode 100644
index 0000000..548ccf8
--- /dev/null
+++ b/shims/engineering_mode/libjni_shim.c
@@ -0,0 +1 @@
+void _ZN7android21SurfaceComposerClient23getInternalDisplayTokenEv() {}