Junsun V1 - TWRP, Root, Discussion and more. (AC8227L) (Android 8.1) (2GB + 32GB)

Search This thread

maxou2

Member
May 15, 2012
38
1
Nadie tiene un firmware o mcu actualizado de la junsun v1 1g 16g de los que se actualizan con ficheros update-ty.zip y ms51_update.bin?????

Ask your vendor or try in some other place.... I think you can find forums where varios MCU type are identified ad discussed somewehere...
BTW did you check the BT antenna? Keep in mind that is just a short wire, check for short circuit or ground contact...
IMG_20201222_141215.jpg
 
Dec 8, 2020
16
0
[QUOTE = "maxou2, publicación: 84151783, miembro: 4643209"]
Pregúntele a su proveedor o pruebe en algún otro lugar ... Creo que puede encontrar foros donde se identifican varios tipos de MCU y se discuten en algún lugar ...
Por cierto, ¿revisaste la antena BT? Tenga en cuenta que es solo un cable corto, verifique si hay cortocircuito o contacto a tierra ...
View attachment 5164787
[/CITAR]

Es una buena idea, pero no sé si podré identificarlo. Gracias
 
Dec 8, 2020
16
0
[QUOTE = "maxou2, publicación: 84151783, miembro: 4643209"]
Pregúntele a su proveedor o pruebe en algún otro lugar ... Creo que puede encontrar foros donde se identifican varios tipos de MCU y se discuten en algún lugar ...
Por cierto, ¿revisaste la antena BT? Tenga en cuenta que es solo un cable corto, verifique si hay cortocircuito o contacto a tierra ...
View attachment 5164787
[/CITAR]

It's a good idea, but I don't know if I'll be able to identify it. Thank you
 

maxou2

Member
May 15, 2012
38
1
Okay, I've been digging through the firmware to see where the f*** the programmers set most apps to fullscreen mode, and finally found it. In case any of you, like me, does not want to force fullscreen for all apps, you have to set this setting in /vendor/build.prop or /system/build.prop:

forfan.force_fullscreen=0

It took me a few hours to find, so hopefully nobody else has to go through the pain again :p

Did not work for me... First try: i modified the /system/build.prop,;after a reboot nothing changed.. Next try was to modify ALSO the /vendor/build.prop , after a reboot the system had a weird behaivior, some apps crashed, the keyboard did not respond properly and so on... In the end i put back the original build.prop in both dirs and the system was ok again. I've noticed in the /system and the /vendor dir the presence of a file named "build.prop~" but i did not have enough time to check its content, only its size was slightly different from the build.prop one.
 

iscle

Senior Member
Apr 19, 2014
221
479
22
Barcelona
I've been reverse engineering the native library which controls the MCU, DSP and gets CAN messages. MCU is on /dev/ttyMT2, DSP is on /dev/ttyMT3.

Both serial ports use 38400 baudrate.

The Android -> MCU packet format is:

0x23 (1 byte)
Command (1 byte)
Data length (1 byte)
Data ("Data length" bytes)
Checksum (1 byte, XOR of all previous bytes except first byte)

The MCU -> Android format should be the same, but I'm still not 100% sure.

My goal is to write a completely new MainUI apk, since the current one uses a lot of system resources. I'll only focus on making it work on my Junsun V1 2GB + 32GB.
 

maxou2

Member
May 15, 2012
38
1
I've been reverse engineering the native library which controls the MCU, DSP and gets CAN messages. MCU is on /dev/ttyMT2, DSP is on /dev/ttyMT3.

....

My goal is to write a completely new MainUI apk, since the current one uses a lot of system resources. I'll only focus on making it work on my Junsun V1 2GB + 32GB.

Good Job, I'm not an Andoird programmer neither an app architecture expert but anyway this MainUi.apk seems to be a big mess...
Your reverse engineering is really interesting, unfortunately my unit is in the car otherwise i'd really liked play with it to check all this and discover more... Pls let us know about your future achievements if yuo don't mind.
 

iscle

Senior Member
Apr 19, 2014
221
479
22
Barcelona
Well I've got some updates.

I've posted my current progress to GitHub. Currently it basically does nothing by itself, but the code to communicate with the touchscreen works perfectly. Also, the code for the MCU seems to be partially working, but I could not get it to do anything, even something as simple as turning off the backlight.

In case any of you want to dig into the code, here it is:

It's quite messy right now, and some parts are directly copy-paste from ghidra. However, nothing crashes, which is good to see too.

Feel free to make suggestions and even pull requests if you feel like doing so. To be able to run the .apk, it has to be signed with system certificates and installed as a normal .apk as an update, or replacing the apk into /system/priv-app/MainUI.

I chose to sign it with system certificates directly so that I can just click "play" on Android Studio.
 

iscle

Senior Member
Apr 19, 2014
221
479
22
Barcelona
Good news!

I got MCU communication working! Actually, the communitacion was always working, what failed was the initialization sequence, which is quite weird.

Anyway, it now works and at least I can adjust the screen brightness :D

All the code is in github, as always.
 

maxou2

Member
May 15, 2012
38
1
Well I've got some updates.

I've posted my current progress to GitHub. Currently it basically does nothing by itself, but the code to communicate with the touchscreen works perfectly. Also, the code for the MCU seems to be partially working, but I could not get it to do anything, even something as simple as turning off the backlight.

In case any of you want to dig into the code, here it is:

It's quite messy right now, and some parts are directly copy-paste from ghidra. However, nothing crashes, which is good to see too.

Feel free to make suggestions and even pull requests if you feel like doing so. To be able to run the .apk, it has to be signed with system certificates and installed as a normal .apk as an update, or replacing the apk into /system/priv-app/MainUI.

I chose to sign it with system certificates directly so that I can just click "play" on Android Studio.

I'm quite busy at the moment and i also can't user the unit as lab test, anyway i really appreciate your work and i really hope to have spare time and knowledge so i can help you ASAP... BTW the worst about our unit is about the responsiveness, sometimes it really sucks... On my other car i have a YT9217 unit ( that has the same SOC but with only 1 GB RAM ) and it really beats our in almost everything ( except radio and DSP ), it's really a pleasure to use it... unfortunately the fw is not compatible ( i suppose ) but it seems to be optimized for the HW.
 

iscle

Senior Member
Apr 19, 2014
221
479
22
Barcelona
I'm quite busy at the moment and i also can't user the unit as lab test, anyway i really appreciate your work and i really hope to have spare time and knowledge so i can help you ASAP... BTW the worst about our unit is about the responsiveness, sometimes it really sucks... On my other car i have a YT9217 unit ( that has the same SOC but with only 1 GB RAM ) and it really beats our in almost everything ( except radio and DSP ), it's really a pleasure to use it... unfortunately the fw is not compatible ( i suppose ) but it seems to be optimized for the HW.

Wow really? I thought the bad performance was mostly because of the SOC... This is the only AC8227L radio I own, I have three more but those are running MT6852, Allwinner T3 and MStar Cedric. The snappiest one is the MT6582, then 8227L, then T3, and then MStar.

I will look into it now that you have mentioned it. It's true that the firmware in the Junsun is crap, log is full of debug output which only speeds thing down more. My goal is to speed it up even if it's just a bit more.

Regarding my work, I'm now working on the DSP, and some functions will be hard to reverse engineer like reverb, fad/bal, mixer/channel selection (bluetooth, radio or android, or a mix of the three).

As always, the code is on github :)
 

Proff55

Member
Feb 21, 2021
10
2
Padova
Hello, I would like to ask a question to the TWRP experts, about my HU AC8227L with system YT9216C_AHD_000005_V004_20190807
I have installed the TWRP vers. 3.0.2.0, which seems to be the only one working on these radios.
I can't make a backup even of the system partition.
After less than a minute, the video freezes, the monitor wobbles and the system restarts.
Screen timeout is disabled.
Backing up small partitions like boot - lk - recovery etc does it without any problems, zip file installations ok
Has anyone happened the same thing?
Thank you all for the work you are doing.
 

arcadilius

Member
Aug 29, 2020
8
1
Gents, you are doing impressive work here however I have different question. Maybe it's wrong place to ask but you look like you know your stuff, not to mention I've tried elsewhere without success. During playing with different softwares and making my own changes I've managed to brick my V1 2/32 and I can't re-flash it back without knowing where the "TEST POINT" is in the board. Maybe you could shed some light. Any clue would be appreciated. Pics of my board attached. Thank you!
 

Attachments

  • IMG_0338.jpeg
    IMG_0338.jpeg
    3 MB · Views: 43
  • IMG_0340.jpeg
    IMG_0340.jpeg
    2.1 MB · Views: 42
  • IMG_0339.jpeg
    IMG_0339.jpeg
    2.4 MB · Views: 43

iscle

Senior Member
Apr 19, 2014
221
479
22
Barcelona
Gents, you are doing impressive work here however I have different question. Maybe it's wrong place to ask but you look like you know your stuff, not to mention I've tried elsewhere without success. During playing with different softwares and making my own changes I've managed to brick my V1 2/32 and I can't re-flash it back without knowing where the "TEST POINT" is in the board. Maybe you could shed some light. Any clue would be appreciated. Pics of my board attached. Thank you!
It's not getting detected by the computer at all?
 

arcadilius

Member
Aug 29, 2020
8
1
No, I have no response at all. No physical buttons as well. As described in some flashing posts, I need to press (short) Volume Button before the board is plugged to computer. Below pic is just an example found for different board...
 

Attachments

  • Screenshot_1.jpg
    Screenshot_1.jpg
    125 KB · Views: 24

iscle

Senior Member
Apr 19, 2014
221
479
22
Barcelona
No, I have no response at all. No physical buttons as well. As described in some flashing posts, I need to press (short) Volume Button before the board is plugged to computer. Below pic is just an example found for different board...
You can try those two points with a very thin and long cable (or with a 1k resistor if you have one, to avoid shorting something if it's not the correct ones)

1615052039099.png
 

arcadilius

Member
Aug 29, 2020
8
1
That's a good call, but I've already tried that. I've spent long hours now trying to revive it - I think it's time to let it go. I may not be aware but at this point the board may be broken completely. I truly appreciate your input mate. Thanks a lot and keep a good work!
 

iscle

Senior Member
Apr 19, 2014
221
479
22
Barcelona
MediaTek hardware is quite hard to brick, even if secure boot is enabled (not the case) so I think your device can definetly be revived. However, it's tricky to know the pin out. I'm almost 100% sure that the pin we're looking for is exposed on that module, on the pins that get soldered to the main board, it's just a matter of finding it.

What I would do is: find a GND on the board, solder a small cable with a 500ohm or 1k resistor in series, and start trying every pad on the CPU module and see if any of it triggers the USB recovery bootloader.

Once you find it, be sure to document it for the community, and post pictures of your device working again :)
For the recovery firmware, asumming you have a Junsun V1 or any other FF-5500 device, use this firmware: https://drive.google.com/file/d/1Cz0DgZFq9onp7goZjHmXLOqusLVg_6B6/view?usp=sharing

EDIT: Remember to power the unit up only after shorting the pin! Also, remove the big electrolytic capacitors from the board to avoid having to wait 4-5 seconds between tries (they take a while to discharge).
 

Top Liked Posts

  • There are no posts matching your filters.
  • 2
    Good evening everyone!

    I recently bought a Junsun V1 head unit for my Golf 7. I specifically chose it because of the AC8227L SOC, which is a renamed MT8127. It includes a few more peripherals that are useful in car infotainment systems, but the core is identical.

    I'm in the process of creating a new firmware from scratch, to replace the chinglish, buggy stock one. However, I have not succeeded yet.

    What I have done so far is create a TWRP image for it, completely from source, using the prebuilt kernel. It's available here (any mirrors will be appreciated and linked in this post):
    https://mega.nz/file/1Gp2gJ5S#gAxcP1WK8nwXivYTpAlyEsWNoWwNZBZ8VTs3fm57gEc

    I have also dumped the firmware from the 2GB + 32GB version: https://mega.nz/file/hXhEjTab#AowvrX36nn9rXIkeu_zgnGmLyDxtiSUSWswwmXcN46k

    To install install TWRP simply put it on the "RECOVERY" section in SP Flash Tool using the scatter and preloader provided in the firmware dump. Uncheck everything else and press flash.
    You'll need a type-a to type-a USB cable connected to the 4-pin USB connector (not the 6-pin), and then give power to the unit.

    Any other information about the device, serial communication between android and the MCU, decompiled apps, modified apps, etc are also welcome!

    I hope this is useful for somebody.

    UPDATE 07-01-2021:
    I've been reverse engineering the MainUI apk for a week now. I've extracted the MCU communication protocol, now I'm trying to extract the DSP protocol, and CAN will be next.
    The touch buttons on the left side of the unit is managed by this .apk as well, and that has already been reverse engineered, only the implementation has to be done with the available API I wrote.

    All help is welcome. You can find the source code in github. The important work is being done in native libraries, the java stuff is useless right now. https://github.com/Iscle/MainUI
    1
    Hola, encuentro poca información sobre mi mcu TS907. Creo que la unidad es diferente pero la misma mcu.
    ¿Podrías decirme si servirían para rootear tus archivos? Gracias
    ver archivos adjuntos
    View attachment 5164087View attachment 5164089View attachment 5164091View attachment 5164093

    Si la resolución de pantalla es 1024x600, entonces muy seguramente sí. De todas maneras, haz una copia antes de todo el sistema, o, como mínimo, del recovery.img por si el TWRP falla.
    1
    Pictures of the unit "guts" :

    IMG_20201127_170932.jpg


    The Power amplifier chip :
    IMG_20201127_234117.jpg

    It uses a chinese chip ( http://www.autochips.com/en/Amplifier/ ) claiming to ba an AB Mosfet low noise/distortion amplifier.
    Seems to have 4 x 26 W / 4 @ 14.4 V, 1 kHz, 10 % THD.
    Million dollar question : does it worth to replace with something like TDA7851?
    Note the electrolitic capacitor, seems to be quite undersized, i solder another capacitor in parallel to raise the total capacity at about 6000uF, maybe low basses will improve.

    IMG_20201128_144855.jpg

    In my unit i found a flaw about the heat dissipation, don't know if it's only my unit or if it's a design one.
    This unit uses a passive thermal method so the whole back chassis is a heat radiator: the board hottest point are the SOC ( that is the AC8227L) and the Power amplifier.
    The PU chip is in contact with the back chassis ( no screws, only back chassis contact with a lot of dissipating thermal paste ). This shouldn't be a big issue as a Mosfet chip of that power does not generate an immense amount of heat...

    The flaw about the SOC heat dissipation: this is the back of the unit, you can see the slot where the PU chip goes and the square "leg" that should touch the CPU; actually that leg doesn't touch the SOC case, so the heat disspation is far to be optimal in this case...


    InkedIMG_20201128_174715_LI.jpg


    So i decided to put a thin conductive adhesive film ontop of the SOC case:

    IMG_20201128_144853.jpg

    I tested the system by loading the cpu at 100% ( with a thread load generator apk ) for few hours: without the mod the temperature raised to 75° whereas the mod lowered the max temp to 65°.
    Having spares 12V fans I went for a paranoiac modification :

    IMG_20201213_114048.jpg
    due to the fans noise i used a DC step down controller to drive the fans at about 8V so the noise was inaudible.
    The same "cooking" test above reported a max temp of about 55°.

    Pratical results? The DAB+ app sometime had issues; it muted sound for a short time, it seemed to me that with this mod it works better... ( or it was the choice of Christmas wines to make me think so... )

    So in the end I suggest to check if in your unit the SOC case has a good contact with the chassis "leg".
    1
    Okay, I've been digging through the firmware to see where the f*** the programmers set most apps to fullscreen mode, and finally found it. In case any of you, like me, does not want to force fullscreen for all apps, you have to set this setting in /vendor/build.prop or /system/build.prop:

    forfan.force_fullscreen=0

    It took me a few hours to find, so hopefully nobody else has to go through the pain again :p
    1
    Yes, that's correct. "Secret menu" solves some of problems but not all of them. Backlight is not working at all (and I'm assuming this should work out of the box). Screen is oriented correctly but touch surface is "negative" horizontally, x axis is flipped (on original firmware this should be sorted out of the box as well). Side on-screen buttons apart from reset, which is the only physical button, don't work. I may have damaged the board while I was trying to figure out where that bloody test point is. Moreover there are stability and bluetooth issues I've encountered earlier which encouraged me to put my fingers on it in first place. That was a total flop from the beginning... I'm truly grateful iscle, for you time and advice, when many just turned their heads away. I wouldn't get this far without your guidance. There's nothing left to do but to call it: X5D v 1.1 - time of death Fri 26 17:06.
Our Apps
Get our official app!
The best way to access XDA on your phone
Nav Gestures
Add swipe gestures to any Android
One Handed Mode
Eases uses one hand with your phone