Meraki MC74 Android Project [HW/SW] [Experience Required][Help][Android System Noob]

[sasha0413]

Hi all, I am new to the forums and I think that I need some help with a custom android project.

[Background]
I have bought a Meraki MC74, This phone is a VOIP office desk phone that has a nice 7 inch LCD screen that make for a ballin' custom intercom phone/general android device.
Cisco Meraki has dropped support for this phone, so even if I wanted to pay for a subscription, I couldn't. So custom android it is

[So what I know]
I know that the OEM OS is android 4.X.X with a custom Cisco Meraki dialer to do Meraki's cloud mumbojumbo. I was able to use ADB and Fastboot to flash ClockworkMod, and a custom version of Android 4.1.2 to get the device somewhat working. (it had lots of bugs and problems; but it was running android free of the Cisco Dialer!)
I was able to do this with the help of fellow xdadevelopers forum user "andrewmospak" (If you're reading this; I'm the dude from Ebay. And of course, thanks bro for the help so far!)
The storage is on a 4 GB Kingston EMMC.

[What I wanted for an end goal]
I wanted to have an interesting discontinued Meraki Desk phone that runs android and get all the functions of the phone working within android.
I also wanted to expand the storage from 4GB to 32GB. ( involving de-soldering existing EMMC and solder in the bigger EMMC.)

[What caused me to write this]

I would be fine if I wanted to stop there, but I wanted to try to install a GSI of android 9 in place of 4.1.2.
Again, this wouldn't be a big deal but I had to go and screw this up. I tried to resize some of the partitions (namely system to accommodate the bigger image of the android 9 GSI)but I accidentally completely killed the system,cache, and recovery partitions.
So, as one of the first steps of trouble shooting, I went to the hardest solution. The de-soldering of the EMMC.
I reached out to Andrewmospak again and asked for a full system emmc dump to try to flash his working file system to a spare 4GB EMMC to see an example of the file system of a working android EMMC. I received the image and flashed it to a spare Toshiba chip and soldered that to the phone, but I was unable to get the phone to boot into android right away, only able to load up fastboot.

Interestingly, I know that the EMMC is working because fastboot reports the S/N as the S/N of Andrewmospak's device and not the one written on my device.

[What I don't know]
Should some of the partitions on the EMMC not be recognized by Gparted in Debian? Like the User/System and others are partitioned ext4 while others are just not recognized.
Why when trying to flash partitions using Fastboot, wont fastboot recognise a recovery partition. It would just say that the partition just doesn't exist. same story with boot.

[What needs help]
I would like to know why fastboot wont see flashable volumes when using the EMMC dump flashed to another spare Toshiba EMMC, it is clearly there.
I would like to know how to reconstruct a volume to fix missing ones, and the number of partitions android needs to run.
Would I be able to flash an image of my working device to a 32gb emmc and just expand the system and user partitions into that extra space?

I will appreciate all help given to assist me and others that want a working device instead of a paperweight. ogChamp: :fingers-crossed:

 

[jyeley5]

That is an awesome project, and a great idea for an office line. I'll look into this!

 

[Cyber-Al]

Use MC74 for dashboard

I'm really interest to know, if you can have run a web browser on the MC74.

My needs are not fancy, I want to run a web browser on the touch screen, and have network connection with the ethernet jack in the back. I want to use it to interact with a touch dashboard for my home automation trough the webbrowser.

Thank you

 

[realc3blues]

Is it possible you didnt get the hidden boot partition in the emmc device? I know it isn't accessible through a sd card reader but can be seen through a SDIO controller interface.

page 15 of this document discusses this:

Google this: "us-17-Etemadieh-Hacking-Hardware-With-A-$10-SD-Card-Reader-wp.pdf" first link on blackhat.com

This project interests me as these devices are dirt cheap and i could use a few multipurpose desk phones

 

[kk_sensei]

Thank you for starting this work. I have been waiting for this day since past couple of years now.
When you get a chance, could you please post the steps up to the point where you decided to swap the emmc?

Hi all, I am new to the forums and I think that I need some help with a custom android project.

[Background]
I have bought a Meraki MC74, This phone is a VOIP office desk phone that has a nice 7 inch LCD screen that make for a ballin' custom intercom phone/general android device.
Cisco Meraki has dropped support for this phone, so even if I wanted to pay for a subscription, I couldn't. So custom android it is

[So what I know]
I know that the OEM OS is android 4.X.X with a custom Cisco Meraki dialer to do Meraki's cloud mumbojumbo. I was able to use ADB and Fastboot to flash ClockworkMod, and a custom version of Android 4.1.2 to get the device somewhat working. (it had lots of bugs and problems; but it was running android free of the Cisco Dialer!)
I was able to do this with the help of fellow xdadevelopers forum user "andrewmospak" (If you're reading this; I'm the dude from Ebay. And of course, thanks bro for the help so far!)
The storage is on a 4 GB Kingston EMMC.

[What I wanted for an end goal]
I wanted to have an interesting discontinued Meraki Desk phone that runs android and get all the functions of the phone working within android.
I also wanted to expand the storage from 4GB to 32GB. ( involving de-soldering existing EMMC and solder in the bigger EMMC.)

[What caused me to write this]

I would be fine if I wanted to stop there, but I wanted to try to install a GSI of android 9 in place of 4.1.2.
Again, this wouldn't be a big deal but I had to go and screw this up. I tried to resize some of the partitions (namely system to accommodate the bigger image of the android 9 GSI)but I accidentally completely killed the system,cache, and recovery partitions.
So, as one of the first steps of trouble shooting, I went to the hardest solution. The de-soldering of the EMMC.
I reached out to Andrewmospak again and asked for a full system emmc dump to try to flash his working file system to a spare 4GB EMMC to see an example of the file system of a working android EMMC. I received the image and flashed it to a spare Toshiba chip and soldered that to the phone, but I was unable to get the phone to boot into android right away, only able to load up fastboot.

Interestingly, I know that the EMMC is working because fastboot reports the S/N as the S/N of Andrewmospak's device and not the one written on my device.

[What I don't know]
Should some of the partitions on the EMMC not be recognized by Gparted in Debian? Like the User/System and others are partitioned ext4 while others are just not recognized.
Why when trying to flash partitions using Fastboot, wont fastboot recognise a recovery partition. It would just say that the partition just doesn't exist. same story with boot.

[What needs help]
I would like to know why fastboot wont see flashable volumes when using the EMMC dump flashed to another spare Toshiba EMMC, it is clearly there.
I would like to know how to reconstruct a volume to fix missing ones, and the number of partitions android needs to run.
Would I be able to flash an image of my working device to a 32gb emmc and just expand the system and user partitions into that extra space?

I will appreciate all help given to assist me and others that want a working device instead of a paperweight. ogChamp: :fingers-crossed:

 

[ribo]

Can't get to recovery mode -- wanna help

I'd like to help and write and app that is a (open) SIP client for the MC74. I bought an apparently new MC74 but I can't get it into recovery mode. Any help in doing this (so I can install a rooted Android)?

Holding down VolUp while connecting the POE ethernet to the WAN port doesn't work. The display remains blank then every several seconds the dislpay backlight flashes for a moment. Holding down Mute and connecting power has no effect, just boot normally to the Meraki logo screens then a minute later the normal keypad and menu display. (VolDn and powerup boots normally). I've tried this with USB flash drive (with some random recovery.img file on it) in the side USB port -- then I get an icon of a broken Android robot (presumably meaning it tried something with booting off the USB.

Has my MC74 been locked down somehow? What can I do to get a rooted Android on it?

 

[sasha0413]

I'd like to help and write and app that is a (open) SIP client for the MC74. I bought an apparently new MC74 but I can't get it into recovery mode. Any help in doing this (so I can install a rooted Android)?

Holding down VolUp while connecting the POE ethernet to the WAN port doesn't work. The display remains blank then every several seconds the dislpay backlight flashes for a moment. Holding down Mute and connecting power has no effect, just boot normally to the Meraki logo screens then a minute later the normal keypad and menu display. (VolDn and powerup boots normally). I've tried this with USB flash drive (with some random recovery.img file on it) in the side USB port -- then I get an icon of a broken Android robot (presumably meaning it tried something with booting off the USB.

Has my MC74 been locked down somehow? What can I do to get a rooted Android on it?

The way That I was able to boot into recovery was to hold mute and volume down NOT IMMEDIATELY hold the two only after the LCD backlight turns on. Only then you will be in recovery.

 

[sasha0413]

Is it possible you didnt get the hidden boot partition in the emmc device? I know it isn't accessible through a sd card reader but can be seen through a SDIO controller interface.

page 15 of this document discusses this:

Google this: "us-17-Etemadieh-Hacking-Hardware-With-A-$10-SD-Card-Reader-wp.pdf" first link on blackhat.com

This project interests me as these devices are dirt cheap and i could use a few multipurpose desk phones

My linux machine recognizes the mystery partitions but not their contents or partition scheme with some cheap USB to SD adapters. I think it works well. Thanks for the recommendation though!

 

[jazzcandle]

I'd like to help and write and app that is a (open) SIP client for the MC74. I bought an apparently new MC74 but I can't get it into recovery mode. Any help in doing this (so I can install a rooted Android)?

Holding down VolUp while connecting the POE ethernet to the WAN port doesn't work. The display remains blank then every several seconds the dislpay backlight flashes for a moment. Holding down Mute and connecting power has no effect, just boot normally to the Meraki logo screens then a minute later the normal keypad and menu display. (VolDn and powerup boots normally). I've tried this with USB flash drive (with some random recovery.img file on it) in the side USB port -- then I get an icon of a broken Android robot (presumably meaning it tried something with booting off the USB.

Has my MC74 been locked down somehow? What can I do to get a rooted Android on it?

You need to hold down the VOLUME DOWN button before powering on the unit, and then continue to hold it. The phone will go into Fastboot mode. The screen will be blank, but backlit, and usually the LED lights up red. Here, you can flash a custom recovery firmware image (such as the ClockworkMod one that's floating around) that allows you to make changes to the system and user partitions. The thing you're seeing with the Android robot is expected. That's the default recovery firmware. Once you flash custom recovery firmware in Fastboot mode, you then unplug the unit, hold down the MUTE button, plug the device in, and continue to hold the MUTE button. It may take some time for it to get into the recovery firmware, but be patient. FYI, VOLUME UP is used for that feature where you can switch between two "slots" for firmware. I don't really know what that is, but I know that it's a thing with Android. It's pretty much unused on the MC as far as I can tell.

Has anyone considered working backwards with the version of Android running on the MC, rather than installing an entirely new version? So, instead of trying to get new firmware to work on the unit, why not work with whatever's on the device by default and pull out what you don't need? I know that some people have gotten different versions of Android to work on the unit, but this leads to bugs or hiccups. I'd imagine that this is because the kernel for that firmware isn't specifically made for the MC, but don't take my word for it. That's just a guess.

Due to the current pandemic situation that's going on here, I've decided to occupy my time by examining the MC in depth. I've managed to get ADB shell working when the device has booted normally, allowing me to examine the filesystem and pull out whatever Meraki included with the firmware. Even got the rainbow LED to stop obnoxiously glowing! I'm currently working on getting the system UI to work (there's no status bar or app switcher).

 

[ribo]

Got adbd running on MC74, Sort of got Linphone going

@sasha0413 and @jazzcandle, I got the boot.img updated so I could set 'ro.secure=0' in /default.prop in the boot up ramdisk. So now I can 'adb' into it by TCP or USB. Thanks for the help. (My MC74 calls itself a 'test-phone' so it may be a little different software. The problem was that the 'recovery' mode installed on it was pretty subtle, nothing showed on the screen.

My MC74 runs '4.2.5-meraki' version of JellyBean api 17, because I'm not good at porting newer versions of Android -- and because there may be modifications / drivers that Meraki put in to support the hardware, I'm working on a phone app with the original JellyBean.

I managed to get an old version of 'linphone' working to the extent that I can make a call -- and can be heard -- but I haven't mastered the speakers (Android AudioManager/MediaPlayer, etc) so I can't hear the phone call. I can play audio speakerphone speaker, but can't play it on the handset speaker. Figuring out the Android Audio system for JellyBean is hard, the implementation has change a lot since then.

---------- Post added at 14:11 ---------- Previous post was at 14:04 ----------

[/COLOR @jazzcandle I installed com.teslacoilsw.launcher-4.1.0-41000-minAPI16.apk as a launcher and told use it as the launcher rather than /data/app/com.meraki.dialer2-1.apk

How did you stop the RGB LED from cycling through the colors? Does something like: /system/app/DroidNode.apk or /system/app/DroidNodeSystemSvcs.apk start the led cycling, then perahps com.meraki.dialer2 stop it -- when it initializes?

 

[jazzcandle]

My MC74 calls itself a 'test-phone' so it may be a little different software. The problem was that the 'recovery' mode installed on it was pretty subtle, nothing showed on the screen.

This is something that stumped me early on as well. But have no fear, all MCs run the same firmware, and you're not running different "test" firmware. The "test phone" value you're referring to is only seen in the recovery partition in the "default.prop" file, where "ro.product.model" is set to "BCM28155_TEST_PHONE". When booting normally, this value is set to "Meraki MC74" instead.

I managed to get an old version of 'linphone' working to the extent that I can make a call -- and can be heard -- but I haven't mastered the speakers (Android AudioManager/MediaPlayer, etc) so I can't hear the phone call. I can play audio speakerphone speaker, but can't play it on the handset speaker. Figuring out the Android Audio system for JellyBean is hard, the implementation has change a lot since then.

The way audio output works on the MC is a bit strange. In fact, it's not really Android's fault from what I can tell. However, I found that you have to "poke" the audio HAL to get it functioning somewhat normally (ie. getting audio to actually play through the speakers). You can do this by running the following command in the shell:

$ tinymix 1 1

At this point, you should be able to hear audio output through the speakers. Additionally, you should be able to switch between handset and speakerphone mode (so long as the app you're using allows you to do this).

I installed com.teslacoilsw.launcher-4.1.0-41000-minAPI16.apk as a launcher and told use it as the launcher rather than /data/app/com.meraki.dialer2-1.apk

You should delete the Dialer apk, you don't need it. In fact, you should delete the DroidNode.apk and DroidNodeSystemSvcs.apk files as well.

How did you stop the RGB LED from cycling through the colors? Does something like: /system/app/DroidNode.apk or /system/app/DroidNodeSystemSvcs.apk start the led cycling, then perahps com.meraki.dialer2 stop it -- when it initializes?

You need to modify "init.bcm911130_me1.rc" within "boot.img" and either remove or comment out the following:

service lightsd /system/bin/lightsd
    class main
    socket lightsd stream 600 system system
    user root

 

[ribo]

Controlling RGB LED on MC74

Thanks jazzcandle, I'll look into /system/bin/lightsd to see what it does.

lightsd seems to open ANDROID_SOCKET_lightsd and listen to /dev/socket/lightsd

It seems to directly write to these /sys files to change the LEDs through which must be controlled through the SOC's GPIO pins..

/sys/class/leds/red/brightness
/sys/class/leds/green/brightness
/sys/class/leds/blue/brightness
/sys/class/leds/white/delay_off
/sys/class/leds/white/brightness

/sys/class/gpio/export
/sys/class/gpio/gpio11/directionout
/sys/class/gpio/gpio11/value

am broadcast -a com.meraki.LIGHTSD_START

I would be great to know what all the GPIO devices did and their a addresses.

I've left the Dialer2, DroidNode and DroidNodeSystemSvcs apps running at this point to see what they do and how they are used. I agree that eventually they need to be removed because they connect to cisco/meraki web services when they start up.

I noticed that the com.meraki.dialer2.LEDController class is how the dialer controls the LEDs:

public void notifyLeds(LedMode mode, int red, int green, int blue) {
this.r = red;
this.g = green;
this.b = blue;
this.m = mode;
sendLightCommand();
}

class LightCmd implements Consumer {
public void accept(Object o) {
Intent i = (Intent)o;
i.putExtra("red", r);
i.putExtra("green", g);
i.putExtra("blue", b);
Log.i(TAG, String.format("Broadcasting color change to rgb(%d, %d, %d)",
new Object[]{r, Integer.valueOf(g), Integer.valueOf(b)}));
ctx.sendBroadcast(i);
}
}

private void sendLightCommand() {
Consumer cons = new LightCmd();
getIntent().ifPresent(cons);
}

Methods ilke 'notifyLeds' takes a mode (Solid, Pulse, or Rainbow) and the R, G, B values and uses the sendLightCommand() method which broadcasts an intent that will probably be handled by something like the /system/bin/lightsd daemon. (I'm trying to document all these things for customizing/developing a SIP app.

I notice that the MC74 app is built on the PJSIP ( org.pjsip.pjua2 package) I was thinking of use the org.linphone SIP package. Anyone have experience with these SIP packages?

 

[scotttherobot]

(I'm trying to document all these things for customizing/developing a SIP app.

I notice that the MC74 app is built on the PJSIP ( org.pjsip.pjua2 package) I was thinking of use the org.linphone SIP package. Anyone have experience with these SIP packages?

Thanks for documenting this, this is awesome info. A while back I built a rudimentary SIP client for MC74 based on the AJVoIP SIP package. I gave up on it once my trial period for that package expired. It was quirky, with flaky audio and no LED control (which both now could be solved by the info in this thread), but I did have hookswitch (hangup/answer by picking up the handset) working.

In the spirit of documentation, the hookswitch is an ambient light sensor that gets covered or uncovered by the handset's earpiece. The original Dialer2 app reads the raw value and compares it to a calibrated set point to determine on/off hook state. Reading the path

/sys/devices/virtual/input/input0/event0/device/raw_adc

with a FileReader will get you the current value. For my device, off hook (answered) is a value below 110. On hook (hung up) is a value above 110. For my testing I just polled this file every 250ms but you could attach a FileObserver to it or something.

 

[drraccoon]

Has anyone considered working backwards with the version of Android running on the MC, rather than installing an entirely new version? So, instead of trying to get new firmware to work on the unit, why not work with whatever's on the device by default and pull out what you don't need?

This is actually what I am working on with a unit that I got.

The phone I have (from the build.prop file):

ro.build.version.release=4.2.3-phone-5068355-southern-userdebug
ro.product.model=Meraki MC 74
ro.product.brand=Meraki
ro.product.name=capri_me1
ro.product.device=capri_me1
ro.product.board=capri

Currently trying to work on getting ADB working from within the phone and not just within the Clockwork recovery that I got loaded on it.

 

[drraccoon]

Getting a pretty close stock experience on the MC74 is totally possible with some dedication and work. For reasons I cant get into, I am unable to provide the steps / files that it took to get where I am, but I have a functional MC74 with working handset & speakerphone. The only next thing I need to work on is getting the "IR" sensor to hangup in specific Dialer applications.

https://imgur.com/a/FFVq1sL

I am using Grandstream Softphone dialer.

 

[alex39wkd]

Getting a pretty close stock experience on the MC74 is totally possible with some dedication and work. For reasons I cant get into, I am unable to provide the steps / files that it took to get where I am, but I have a functional MC74 with working handset & speakerphone. The only next thing I need to work on is getting the "IR" sensor to hangup in specific Dialer applications.

I was able to achieve the same, except GS dialer is not scaled correctly.
Not able to post link to image, as I don't have 10 messages.
So it is a/6aQYsz6 on imgur

Did not bother to fix it, as my intent is custom PJSIP dialer (someday
Headset sensor, led, mixer - figured out.
The only mystery is "mute" button and the red LED behind it.

 

[rcky844]

Hi all, I am new to the forums and I think that I need some help with a custom android project.

[Background]
I have bought a Meraki MC74, This phone is a VOIP office desk phone that has a nice 7 inch LCD screen that make for a ballin' custom intercom phone/general android device.
Cisco Meraki has dropped support for this phone, so even if I wanted to pay for a subscription, I couldn't. So custom android it is

[So what I know]
I know that the OEM OS is android 4.X.X with a custom Cisco Meraki dialer to do Meraki's cloud mumbojumbo. I was able to use ADB and Fastboot to flash ClockworkMod, and a custom version of Android 4.1.2 to get the device somewhat working. (it had lots of bugs and problems; but it was running android free of the Cisco Dialer!)
I was able to do this with the help of fellow xdadevelopers forum user "andrewmospak" (If you're reading this; I'm the dude from Ebay. And of course, thanks bro for the help so far!)
The storage is on a 4 GB Kingston EMMC.

[What I wanted for an end goal]
I wanted to have an interesting discontinued Meraki Desk phone that runs android and get all the functions of the phone working within android.
I also wanted to expand the storage from 4GB to 32GB. ( involving de-soldering existing EMMC and solder in the bigger EMMC.)

[What caused me to write this]

I would be fine if I wanted to stop there, but I wanted to try to install a GSI of android 9 in place of 4.1.2.
Again, this wouldn't be a big deal but I had to go and screw this up. I tried to resize some of the partitions (namely system to accommodate the bigger image of the android 9 GSI)but I accidentally completely killed the system,cache, and recovery partitions.
So, as one of the first steps of trouble shooting, I went to the hardest solution. The de-soldering of the EMMC.
I reached out to Andrewmospak again and asked for a full system emmc dump to try to flash his working file system to a spare 4GB EMMC to see an example of the file system of a working android EMMC. I received the image and flashed it to a spare Toshiba chip and soldered that to the phone, but I was unable to get the phone to boot into android right away, only able to load up fastboot.

Interestingly, I know that the EMMC is working because fastboot reports the S/N as the S/N of Andrewmospak's device and not the one written on my device.

[What I don't know]
Should some of the partitions on the EMMC not be recognized by Gparted in Debian? Like the User/System and others are partitioned ext4 while others are just not recognized.
Why when trying to flash partitions using Fastboot, wont fastboot recognise a recovery partition. It would just say that the partition just doesn't exist. same story with boot.

[What needs help]
I would like to know why fastboot wont see flashable volumes when using the EMMC dump flashed to another spare Toshiba EMMC, it is clearly there.
I would like to know how to reconstruct a volume to fix missing ones, and the number of partitions android needs to run.
Would I be able to flash an image of my working device to a 32gb emmc and just expand the system and user partitions into that extra space?

I will appreciate all help given to assist me and others that want a working device instead of a paperweight. ogChamp: :fingers-crossed:

Hey, I am interested but I don't have the device.

First of all:

I would be fine if I wanted to stop there, but I wanted to try to install a GSI of android 9 in place of 4.1.2.

You can install a GSI on a 4.1.2 based device, but you can't without creating a vendor partition, GSI is a part of the Project Treble released with Oreo. It requires a vendor partition to work. On 4.1.2, there's simply no device with a partition called vendor, so you can't flash a GSI.
But, if you have a fully working Android Pie tree, you can make a vendor partition yourself.

 

[jtthecanadian]

I was able to achieve the same, except GS dialer is not scaled correctly.
Not able to post link to image, as I don't have 10 messages.
So it is a/6aQYsz6 on imgur

Did not bother to fix it, as my intent is custom PJSIP dialer (someday
Headset sensor, led, mixer - figured out.
The only mystery is "mute" button and the red LED behind it.

As you didn't mention that you couldn't share any information like the reply previous to yours, would it be possible for you to share what you used to get there?
As someone with only linux, networking and voip knowledge and that never played around with Android ROMs/ADB before, that would get me started as I can ATM only get to ADB.
Also, did you use the version of android already on the Phone or Flashed it with a new ROM?
Thank you!

 

[alex39wkd]

As you didn't mention that you couldn't share any information like the reply previous to yours, would it be possible for you to share what you used to get there?
As someone with only linux, networking and voip knowledge and that never played around with Android ROMs/ADB before, that would get me started as I can ATM only get to ADB.
Also, did you use the version of android already on the Phone or Flashed it with a new ROM?
Thank you!

I have used "adb pull" (in recovery mode) to dump boot partition, just used path to it in /dev/...
Used android tools to decompress and unpack boot.
Changed ro.secure to 0 and something like "meraki usb debug" to 1
Repacked boot partition
Used adb to switch to fastboot
Flashed boot and boot2 with this image
Now it is accessable as normal Android phone, for whatever you might want to do with it.

 

[nyflyguy]

Is anyone able to provide a working ROM for this device? I'm extremely confused about how to get this working. I would greatly appreciate any advice.