[General Discussion] QF001 (ROCO K706) Head Units with UIS 7862s (not FYT based) [read first post first]

Search This thread


Nov 21, 2009
colorado springs
Thats very interesting. I was actually doing the same last night and managed to open some popups saying some chineese.
The only that concerns me when i do random codes is that we might enable or disable something in a Chinese menu...and with the support we have from the resellers not even God can help us...
Off course if we don't try we do nothing here..
Dont know i am very sceptical on that..
I think the ones that popup Chinese just export some log file. At least the ones I posted. Not sure if yours was different.


Senior Member
Jul 20, 2017
No... everything seems good for now.
In other platforms (FYT) there is some codes that if you enter deletes a file and the device pops up a red notification and doesn't boot..


Nov 23, 2007
Short question,
Have anyone a Mazda3 2004-2009?
I have the little Problem that in the Steering wheel the next / previus Buttons are swaped and the Mode Button that i must hold Long for switching the head Display information make a mute by Long press but i have a mute Button extra.


Senior Member
Dec 10, 2006
Huawei Mate 9
Xiaomi Mi 10T / 10T Pro
Short question,
Have anyone a Mazda3 2004-2009?
I have the little Problem that in the Steuerung wheel the next / previus Buttons are swaped and the Mode Button that i must hold Long for switching the head Display information make a mute by Long press but i have a mute Button extra.
You can change the steering wheel buttons inside the factory menu.


Senior Member
Feb 3, 2014
Can you Show me the way? I only found the Menü to Set the Touch buttons
Assume you bought this unit that matches your car, then just use the CarApp, SWC (steering wheel control).
If CarApp shows no SWC and only some text with no Canbus, then you need to set it right first.

What unit you actually have?

Learning touch buttons in factory settings is for the physical buttons on your unit.
Last edited:


Senior Member
Jul 20, 2017
Me too...
Trying everything.
I saw Google app didnt have all the system permissions on (show on top of other apps...ect) did that too.. no luck so far. And a finding ..The dsp rear speaker surround adjustment bar is not working


Senior Member
Feb 3, 2014
Regarding the Google assistant problem I've deleted toppal voice and service app but that did not solve the problem. The voice match feature is still greyed out.
As you probably know in trying to crack the nut.

Here and there in configuration files and Voiceapp.ini, Toppal is set as the main VA...so Google VA needs to be set as the main Voice app, but also not a developer of firmware.

Hope you not brick your device in trying by trial and error :rolleyes:

Appreciate your efforts, personally believe that you need to set the default voice assistant by coding changing Toppal to GA and have the services that GA needs.
Last edited:


Senior Member
Dec 3, 2022
Samsung Galaxy A70
Lenovo P11
Regarding the Google assistant problem I've deleted toppal voice and service app but that did not solve the problem. The voice match feature is still greyed out.
Toppal depends on TXZ Service which runs in the background for voice match. Google Assistant would need Speech Service for Google in stead running in the background for voice match to work. So there is the conflict.

Toppal gets automatically reinstalled when updating firmware btw. Found that when I did the 1216 fw update.
Last edited:


New member
Jan 29, 2023
When the car is connected, should the Canbus be visible in the Car app or do I have to select the car model by myself in the 8888 menu?


  • received_485225623803428.jpeg
    23.7 KB · Views: 47


Senior Member
Dec 10, 2006
Huawei Mate 9
Xiaomi Mi 10T / 10T Pro
I've managed to deactivate the internal microphone without desoldering it which I did not want. I've used ultra thin isolation tape on pin 1 and 2 of this ribbon cable connector. (You could also just cut through the two wires of the cable. A new one costs almost nothing.) Works perfectly. The external microphone becomes louder and clearer.
As always: do it on your own risk.


Senior Member
Dec 3, 2022
Samsung Galaxy A70
Lenovo P11
And what should you do if the exact model is not listed?? i drive a citroen c4 picasso, but that one is not listed in the factory menu car settings..?
Tom, try a similar model or the model before. If I remember well I could also select 2003-2007 Golf in stead of the actial 2008-2012 Golf, both worked but possibly Golf Plus or Golf Sportsvan would also work. Citroen C4 also has several versions but should basically be the same base model. Just try...
Last edited:


Senior Member
Dec 14, 2012
Do you guys know if it's possible to downgrade the firmware?
Dunno if it's just me but mine (v1.4-221216.1830) seems to reset many options I keep enabling.


Senior Member
Dec 14, 2012
Try to upgrade to the latest firmware (20230104) and check if solves the issues
Thanks I thought mine was the latest, just saw it in the firmware thread. Thanks mate, I'll try asap

edit: nope, tried even latest version but the problem is still there
Video proof https://streamable.com/d82n3n
I know the version shown in the video it's different but it behaves the same as the new one
Last edited:

Top Liked Posts

  • 1
    I buyed the S8 from Hizpo.

    The wiring for my car is wrong. I could not use the wheel keys for Bluetooth.

    DAB usb dongles are not working. Reception is very poor.

    I would not buy it again.

    But you can return it for free 15 days.
  • 5
    my display panel does not dims when I turn on the headlights. Is there an additional setting? Headlight detection is activated.

    i have the S6
    First you need to manually set the brightness levels when the headlights are on and when the headlights are off.
    1. Turn on the headlights. Set the desired (low) brightness level.
    2. Turn off the headlights. Set the desired (high) brightness level.
    3. Turn on the headlights. Get "automatic" brightness reduction.
    4. Be happy, smile, drink coffee.

    It works like this.
    I took a look in the decompiled code to get all "factory" codes:

                if (charSequence.equalsIgnoreCase("1122")) {
                } else if (charSequence.equalsIgnoreCase("2211")) {
                } else if (charSequence.equalsIgnoreCase("1212")) {
                    FactoryPasswordManager.copyLogToUSB(this.mContext, this.mHandler);
                } else if (charSequence.equalsIgnoreCase("2121")) {
                } else if (charSequence.equalsIgnoreCase("111222")) {
                } else if (charSequence.equalsIgnoreCase("112233")) {
                } else if (charSequence.equalsIgnoreCase("332211")) {
                } else if (charSequence.equalsIgnoreCase("336699")) {
                } else if (charSequence.equalsIgnoreCase("996633")) {
                } else if (charSequence.equalsIgnoreCase("114477")) {
                } else if (charSequence.equalsIgnoreCase("774411")) {
                } else if (charSequence.equalsIgnoreCase("8888")) {
                    FactoryPasswordManager.onFactorySetting(this.mContext, 1);
                } else if (charSequence.equalsIgnoreCase("2687016")) {
                    FactoryPasswordManager.onFactorySetting(this.mContext, 2);
                } else if (charSequence.equalsIgnoreCase("225588")) {
                    FactoryPasswordManager.onFactoryReset(this.mContext, false);
                } else if (charSequence.equalsIgnoreCase("22558800")) {
                    FactoryPasswordManager.onFactoryReset(this.mContext, true);
                } else if (charSequence.equalsIgnoreCase("4455")) {
                } else if (charSequence.equalsIgnoreCase("456456")) {
                } else if (charSequence.equalsIgnoreCase("5544")) {
                } else if (charSequence.equalsIgnoreCase("555666")) {
                    FactoryPasswordManager.onTest(this.mContext, false);
                } else if (charSequence.equalsIgnoreCase("6655")) {
                    FactoryPasswordManager.onTest(this.mContext, true);
                } else if (charSequence.equalsIgnoreCase("789789")) {
                } else if (charSequence.equalsIgnoreCase("777888")) {
                } else if (charSequence.equalsIgnoreCase("778899")) {
                    FactoryPasswordManager.onDevice(this.mContext, true);
                } else if (charSequence.equalsIgnoreCase("998877")) {
                    FactoryPasswordManager.onDevice(this.mContext, false);
                } else if (this.mTvPwd.getText().toString().equals("45645600")) {
                    FactoryPasswordManager.onMcuOnlineUpgrade(this.mContext, this.mTvPwd.getText().toString());
                } else if (this.mTvPwd.getText().toString().equals("12457800")) {
                    FactoryPasswordManager.onMpuMode(this.mContext, false);
                } else if (this.mTvPwd.getText().toString().equals("87542100")) {
                    FactoryPasswordManager.onMpuMode(this.mContext, true);
                } else if (this.mTvPwd.getText().toString().equals("15935700")) {

    When going through the layout xml, I came across some settings that are currently hidden:

            <LinearLayout android:visibility="gone" style="@style/list_item_bg_and_split_layout_style">
                <com.qf.carsettings.view.HeaderLayout android:id="@id/factory_backlight_set" android:layout_width="wrap_content" android:layout_height="wrap_content" app:item_password_level="2" app:item_style="@integer/item_style_only_one_button" app:item_subTitle="@string/str_backlight_set" />
                <com.qf.carsettings.view.HeaderLayout android:id="@id/factory_sound_channel_gain_set" android:layout_width="wrap_content" android:layout_height="wrap_content" app:item_password_level="2" app:item_style="@integer/item_style_left_right_button" app:item_subTitle="@string/str_sound_channel_gain" />
                <com.qf.carsettings.view.HeaderLayout android:id="@id/factory_app_select_set" android:layout_width="wrap_content" android:layout_height="wrap_content" app:item_has_split_line="true" app:item_style="@integer/item_style_only_one_button" app:item_subTitle="@string/str_app_select" />
                <com.qf.carsettings.view.HeaderLayout android:id="@id/factory_language_select_set" android:layout_width="wrap_content" android:layout_height="wrap_content" app:item_has_split_line="true" app:item_style="@integer/item_style_only_one_button" app:item_subTitle="@string/str_language_select" />
                <com.qf.carsettings.view.HeaderLayout android:id="@id/factory_amp_switch_set" android:visibility="gone" android:layout_width="wrap_content" android:layout_height="wrap_content" app:item_has_split_line="true" app:item_style="@integer/item_style_only_checkbox" app:item_subTitle="@string/str_amp_control" />
                <com.qf.carsettings.view.HeaderLayout android:id="@id/factory_usb_for_dvr_set" android:visibility="gone" android:layout_width="wrap_content" android:layout_height="wrap_content" app:item_has_split_line="true" app:item_style="@integer/item_style_two_radiobutton" app:item_subTitle="@string/str_usb_interface_for_dvr" app:item_two_button_left="@string/str_dvr_use_usb1" app:item_two_button_right="@string/str_dvr_use_usb2" />

    Notably the factory_sound_channel_gain_set I would like to control, as I have a external amplifier in my car and thus the output signal is too loud. Even when setting the "power volume" to the lowest setting (-15dB).

    Recompiling and reinstalling failed unfortunately. Does anyone have this setting available?
    This is the decompiled content of the Fan Control apk, if anyone wants to take a peek.

    package com.qf.fancontrol;
    import android.app.Activity;
    import android.content.res.Resources;
    import android.os.Bundle;
    import android.os.Handler;
    import android.os.Message;
    import android.os.RemoteException;
    import android.os.SystemProperties;
    import android.qf.config.ConfigInfoManager;
    import android.util.Log;
    import android.view.View;
    import android.view.Window;
    import android.widget.CheckBox;
    import android.widget.CompoundButton;
    import android.widget.ImageView;
    import android.widget.TextView;
    import java.lang.ref.WeakReference;
    /* loaded from: classes.dex */
    public class FanControlActivity extends Activity implements CompoundButton.OnCheckedChangeListener, View.OnClickListener {
        private static final int ANIM_STANDARD_DURATION = 40;
        private static final int AUTO_MODE_SWITCH_TEMP = 50;
        private static final String CPU_TEMP_PATH = "/sys/devices/virtual/thermal/thermal_zone0/temp";
        private static final String FAN_ENABLE_PATH = "/sys/devices/platform/back_det/fan_enable";
        private static final int IMAGE_ID_MAX_INDEX = 11;
        private static final int IMAGE_ID_MIN_INDEX = 1;
        private static final int MSG_ID_FAN_ANIM = 1;
        private static final int MSG_ID_HIDE_PROMPT = 2;
        private static final int MSG_ID_UPDATE_CPU_TEMP = 0;
        public static final String PERSYS_AUTO_MODE = "persist.sys.auto_mode";
        public static final String PERSYS_MANUAL_MODE = "persist.sys.manual_mode";
        private static final String TAG = FanControlActivity.class.getSimpleName();
        private CheckBox mCBAutoMode;
        private CheckBox mCBManualMode;
        private MyHandler mHandler = new MyHandler();
        private ImageView mIVAutoModePrompt;
        private ImageView mIVFan;
        private int mImageIdIndex;
        private TextView mTVAutoModePrompt;
        private TextView mTVCPUTemp;
        private void setStatusBarFullTransparent() {
            Window window = getWindow();
        @Override // android.app.Activity
        protected void onCreate(Bundle bundle) {
        private void initView() {
            this.mCBAutoMode = (CheckBox) findViewById(R.id.ck_auto_mode);
            this.mCBManualMode = (CheckBox) findViewById(R.id.ck_manual_mode);
            this.mCBAutoMode.setChecked(SystemProperties.getBoolean(PERSYS_AUTO_MODE, false));
            this.mCBManualMode.setChecked(SystemProperties.getBoolean(PERSYS_MANUAL_MODE, false));
            this.mIVAutoModePrompt = (ImageView) findViewById(R.id.iv_auto_mode_prompt);
            this.mTVAutoModePrompt = (TextView) findViewById(R.id.tv_auto_mode_prompt);
            this.mTVCPUTemp = (TextView) findViewById(R.id.tv_cpu_temp);
            this.mIVFan = (ImageView) findViewById(R.id.iv_fan);
        /* JADX INFO: Access modifiers changed from: private */
        public void updateCPUInfo() {
            String readData = FileOperationUtils.readData(CPU_TEMP_PATH);
            int parseInt = Integer.parseInt(readData) / 1000;
            if (readData != null && !readData.isEmpty()) {
                TextView textView = this.mTVCPUTemp;
                textView.setText("CPU:" + parseInt + "℃");
            this.mHandler.sendEmptyMessageDelayed(0, 1000L);
            if (SystemProperties.getBoolean(PERSYS_AUTO_MODE, false)) {
                if (parseInt >= AUTO_MODE_SWITCH_TEMP) {
                    this.mHandler.sendEmptyMessageDelayed(1, 0L);
                    FileOperationUtils.writeData(FAN_ENABLE_PATH, "1");
                FileOperationUtils.writeData(FAN_ENABLE_PATH, "0");
        /* JADX INFO: Access modifiers changed from: private */
        public void fanAnim() {
            if (this.mImageIdIndex <= 11) {
                Resources resources = getResources();
                this.mIVFan.setImageResource(resources.getIdentifier("ic_fan_control_line_" + this.mImageIdIndex, "drawable", getPackageName()));
                this.mImageIdIndex = this.mImageIdIndex + 1;
            if (this.mImageIdIndex > 11) {
                this.mImageIdIndex = 1;
            this.mHandler.sendEmptyMessageDelayed(1, 40L);
        @Override // android.app.Activity
        protected void onDestroy() {
            MyHandler myHandler = this.mHandler;
            if (myHandler != null) {
        @Override // android.widget.CompoundButton.OnCheckedChangeListener
        public void onCheckedChanged(CompoundButton compoundButton, boolean z) {
            String str;
            int id = compoundButton.getId();
            str = "1";
            if (id != R.id.ck_auto_mode) {
                if (id == R.id.ck_manual_mode) {
                    String str2 = TAG;
                    Log.i(str2, "ck_manual_mode - checked: " + z);
                    if (z) {
                        this.mHandler.sendEmptyMessageDelayed(1, 100L);
                    } else {
                    FileOperationUtils.writeData(FAN_ENABLE_PATH, z ? "1" : "0");
                    SystemProperties.set(PERSYS_MANUAL_MODE, Boolean.toString(z));
            String str3 = TAG;
            Log.i(str3, "ck_auto_mode - checked: " + z);
            if (z) {
            SystemProperties.set(PERSYS_AUTO_MODE, Boolean.toString(z));
            ConfigInfoManager configInfoManager = (ConfigInfoManager) getSystemService("config_service");
            if (!z) {
                str = "0";
            try {
                configInfoManager.updateConfigItemInfo("fan_control_set", str);
            } catch (RemoteException e) {
        @Override // android.view.View.OnClickListener
        public void onClick(View view) {
            if (view.getId() == R.id.iv_auto_mode_prompt) {
                if (this.mTVAutoModePrompt.getVisibility() == 8) {
                    this.mHandler.sendEmptyMessageDelayed(2, 8000L);
        /* JADX INFO: Access modifiers changed from: private */
        /* loaded from: classes.dex */
        public static class MyHandler extends Handler {
            private final WeakReference<FanControlActivity> mActivity;
            private MyHandler(FanControlActivity fanControlActivity) {
                this.mActivity = new WeakReference<>(fanControlActivity);
            @Override // android.os.Handler
            public void handleMessage(Message message) {
                int i = message.what;
                if (i == 0) {
                } else if (i == 1) {
                } else if (i == 2) {
    I will explain why the majority of the radio does not play as well as the native radio played. The head unit is tuned to your acoustics, each acoustic is different in everything, like the interior of each car, and the manufacturer makes these settings initially. When you buy a new radio, absolutely any, at any cost, it is not tuned to your acoustics and your car, so it simply does not play, and all the proposed saved equalizers will play badly. In order for your radio to play beautifully and loudly, you need to adjust the equalizers. You need to skip the Sweep signal, 20-20000 Hz and you will hear that the sound is not uniform, then louder then quieter. The sound should go evenly and approximately in the same range. A professional will be able to adjust the Sweep signal by ear, but a simple person is unlikely. There is a way for the deaf to do this)
    Believe me, installing equalizers is a huge increase in quality and volume! The volume is definitely enough for you, but you can make the quality even better only with the help of an amplifier, but this is a completely different topic. But I think there are those people who are satisfied with it, or everything coincided well and the music plays more or less normally.

    I promised to tell you how to set up the radio.
    1- download the SPECTRA PLUS program to the laptop, it is free for a month, and then see for yourself. Install the Frequency Sound Generator program on your phone. Program for android, for iPhone look for yourself.
    Settings for SPECTRA PLUS on the first photo.
    2 - download sweep signal the link below and run it in the SPECTRA PLUS program. We save the result at the maximum values. Now we see how the sound card works on a laptop, and we can consider this graph as ideal, we will stream to it.
    3 - we go into the equalizer on the radio, set the filter from 60 hertz as in the second photo. We go into the equalizer mode and turn on the user settings. We download sweep signal to the flute or to the radio tape recorder. We turn on the radio volume to 15, turn on the graph recording in SPECTRA PLUS on the laptop and start sweep signal. We need to take the chart off the radio. Now we see all deviations from the schedule.
    4 - we start playing with the equalizer settings, where we need to raise, where we need to lower. All values in hertz coincide with the equalizers on the radio. Please note that if we raise or lower one scale, then with it the wave and neighboring scales should smoothly rise or fall.
    We adjusted the equalizers, then launched sweep signal again and took readings in SPECTRA PLUS. See what happened and move on.
    If it’s hard for you to find the scale that needs to be adjusted, turn on the Frequency Sound Generator program, start the sound through the bluetooth on the radio and start looking for what scale we need, I did it in order to have a general concept.
    I spent an hour setting it up and you can see what I got in the third photo. Then we make fine adjustments as we like.
    There is also such an item in the setting as to select any frequency and amplify it, usually it is low frequencies, I selected 87 hertz and set the values to 9, this gives a good bass. Play around with these settings depending on the style of the music. 4th photo.
    There is another important setting like delay. You are not sitting in the center of the car and the sound does not reach you evenly, here you can adjust all this. But I don’t use this setting, because I set up the radio not only for myself, but also for the passenger. This topic is well open on YouTube, search.
    The main problem is that I cannot save user settings, either it is not possible in this firmware, or I have not found how. You may accidentally press the default button and all settings will be lost. If you know how to save settings or download them, write! At the end of the photo is what I got on the equalizers. Sound after tuning heaven and earth. Perhaps you have super hearing and can do all this without programs, but I could not.

    For everyone who asks for an external microphone and everyone who is not satisfied with its quality. I soldered the microphone and lengthened its legs with a thin wire, placed it right on the hole and stuffed pieces of ordinary cotton wool in a circle. The microphone works great! Now I'm talking on the phone in the floor of my voice, the sound is clear, you can't separate it from a regular mobile phone. Absolutely vseravno where the head is turned, everything is heard equally cool.
    At first I wanted to lengthen it by cutting off the legs from the LED, but the hole is not exactly in the center and I could not bend them. At what I carelessly unsoldered the microphone and one leg flew off, I just stuck it back and soldered it, I thought the microphone was damaged, but no!
    Don't even bother looking for an external microphone, etc., if you know how to solder, then everything is elementary. In comparison, the VW's external microphone, which is located as close to the face as possible, does not sound better.
    Voice commands work even with music playing! I had an external microphone included, but I don’t even see the point of putting it in.
  • 9
    Hello all,

    it seems that there are some QF001 owners out there but not much informations. So i will try to collect everything and put it at one place.

    The original manufactor is shenzhen jitu technology co. ltd.

    These units are sold from Ossuret, Hizpo and other brands. This are the sellers specs:

    The Android 12 is fake which is Android 10 in reality.

    I have the 8/128GB Version myself:

    Codes for the factory settings menu:

    Different firmware versions are inside this thread. Take care of the right MCU file and beware that clear user data is enabled by default on update. There is also a dedicated firmware thread: https://forum.xda-developers.com/t/...s-with-uis-7862a-7862s-not-fyt-based.4541261/

    Dedicated thread for gaining recovery access: https://forum.xda-developers.com/t/...uret-s4-s8-uis-7862-headunits-no-fyt.4538107/

    Beside the faked Android 12 Version the head unit seems to be a good bang for the buck. I´ve paid around 230 Euros including VAT and shipping. The unit runs stable and powerful so far. Everything works as expected. The Android is a bit downcutted by the manufactor. There are no text notifications in the statusbar e.g. But i can compensate that with widgets.

    Against the description android auto works wireless with my Xiaomi Mi10t pro. So that's also nice to have.

    Tweaks, mods and others:
    - my wire harness was labeled wrong. Key 2 and Key GND were swapped. So better check the cables before connecting. For me the correct wire names/functions were in the printed manual.

    - replacement fan that fits my model: Sunon MF35101V21000UA99

    - there's a sleep whitelist in the factory settings menu that prevents apps from being killed in standby mode (ignition off). That's very useful. I've whitelisted Google maps e.g. and don't lose my programmed route anymore if i turn off the engine for a short stop.

    - tasker trigger for warm boot: detect any USB device connected. (You have to plug in something into the usb port, dashcam or pendrive e.g.)

    - the status bar only shows a few symbols and no text notifications. Therefore I use a notification widget in combination with nova launcher. This way I can see all notifications in a widget which would be at the status bar originally.

    - wireless ADB is enabled by default with root user. 🎉 The port is 9876. ( I've found that inside the build.prop)

    - if you want to have a look inside the firmware you can use a rom kitchen tool like CBR

    - how to change the boot logo:
    1. If your player is 1280*720 screen, you need to rotate the picture 90 degree, and cut it into 720*1280 size, transform the picture to .BMP format.
    2. If your player is 1024*600 screen, you need to cut the picture to 1024*600 size, transform the picture to .BMP format.
    3. copy the picture into your Udisk root path, and then connect Udisk to the player. follow the steps settings-factory-8888-Logo set-then you can see your picture and select it- click update logo.
    - how to change boot animation: https://forum.xda-developers.com/t/...uis-7862s-not-fyt-based.4525675/post-88086835

    - enhance the microphone and call quality by using the external microphone and disable the internal microphone by masking two pins of a ribbon cable. It's explained inside this thread (link to post will follow)

    - GPS tweak: https://forum.xda-developers.com/t/...uis-7862s-not-fyt-based.4525675/post-88112693

    Known issues:
    - "hey Google" (activate the assistant by hotword) doesn't work
    - no car speed dependent volume control (manufacturer says it would be implemented later)
    - the firmware is a debug release which is a serious security risk (every app or malware can get root access through ADB shell). On the upside you can also get root access through ADB and do everything you want

    To be continued...

    And now a few more!

    1122 / 2211 - both popup a bubble with chinese text. I thought they were the same at first but they have different characters. (They both have the word “log” in it)

    6655 - opens up a screen that appears to be the same as 555666 but these are also in Chinese so I don’t know if there are differences. Notably when you enter this menu with either code it will record a snippet of audio from the mic and play it back.

    4455 - engineer mode (lots of stuff in here to explore, includes adb shell)

    5544 - gps stuff

    1212 - notification that says “slog copied to unkown”

    2121 - seems to just take you home

    45645600 - download mcu file
    I have created a dedicated thread for firmware files in the hope of having a central repository for updates that isn't comingled with this thread. If you have new links to firmware please post it there and then quote your comment and post it here for visibility, or vice versa. Thanks.

    How did you discover the codes?
    Just by trying a bunch of different codes and looking for patterns. Starting by looking at the codes we already knew I discovered they are all a repeating sequence of digits that are adjacent to each other on the keypad. Once you find a pattern there’s usually another code that uses the same pattern somewhere else on the keypad. If you actually type in the codes and look at the physical pattern they make you’ll see what I mean. For example 114477 is just the digits in the left column of the keypad going down. 336699 is the same pattern in the right column. And then some codes are just variations on top of that, like doing a code in reverse (which we already knew) as well as adding 00 to the end of some. This is how I discovered all the codes. Once I’d find one code Id try that same pattern in all places and variations. Simple as that! I’m sure there’s more patterns yet to be discovered so try different ideas out and see what you can find. With many people using these strategies I’m sure we can discover more! I may have even missed a few using the patterns of ones I found.
    Additional factory codes:

    332211 - Shows temperature and clock speed
    996633 - Exports some config file