Junsun V1 - TWRP, Root, Discussion and more. (AC8227L) (Android 8.1) (2GB + 32GB)

Search This thread

iscle

Senior Member
Apr 19, 2014
221
479
22
Barcelona
I have found the UART TX pin for the forfan module! It was a bit tricky, but it works! And it's set at 921600 baud as it's typical for MediaTek CPUs.

The pin where the green wire is attached is the TX pin for the default UART used by the preloader and lk!

photo-2021-03-24-00-41-46.jpg
 

arcadilius

Member
Aug 29, 2020
8
1
Great work, this is fantastic! However this procedure will require a bit of study on my part as my experience with UART and MediaTek is very limited. At least I have a starting point, and few articles/posts to dig through. I'll get to it as soon as I can. Thanks you so much for your help.
 

arcadilius

Member
Aug 29, 2020
8
1
I have some progress... first of all I've found out that my Macbook Pro had issues with USB connection while running Windows in virtual machine, this happened after an update and went unnoticed for a while. Second of all - you were absolutely right about location of the test point on this board. After few attempts I've managed to write preloader and rest is a history. The outcome: I have system running on device but... touch recognition is way off, I can pull down top bar, I can't select on-screen apps or settings but I can change wallpaper because it does not care where you hold your finger, sound does not kick in and backlight is off. As on-screen navigation is broken and behavior exactly the same on two tested firmwares, I don't know how possibly I could recover from that :) Anyway - you are the man!
 

iscle

Senior Member
Apr 19, 2014
221
479
22
Barcelona
I have some progress... first of all I've found out that my Macbook Pro had issues with USB connection while running Windows in virtual machine, this happened after an update and went unnoticed for a while. Second of all - you were absolutely right about location of the test point on this board. After few attempts I've managed to write preloader and rest is a history. The outcome: I have system running on device but... touch recognition is way off, I can pull down top bar, I can't select on-screen apps or settings but I can change wallpaper because it does not care where you hold your finger, sound does not kick in and backlight is off. As on-screen navigation is broken and behavior exactly the same on two tested firmwares, I don't know how possibly I could recover from that :) Anyway - you are the man!
Hmm the touchscreen settings can be set on the secret menu (8888), as well as bluetooth, radio, etc. Just connect a USB mouse to use it properly :)
 

arcadilius

Member
Aug 29, 2020
8
1
Yes, that's correct. "Secret menu" solves some of problems but not all of them. Backlight is not working at all (and I'm assuming this should work out of the box). Screen is oriented correctly but touch surface is "negative" horizontally, x axis is flipped (on original firmware this should be sorted out of the box as well). Side on-screen buttons apart from reset, which is the only physical button, don't work. I may have damaged the board while I was trying to figure out where that bloody test point is. Moreover there are stability and bluetooth issues I've encountered earlier which encouraged me to put my fingers on it in first place. That was a total flop from the beginning... I'm truly grateful iscle, for you time and advice, when many just turned their heads away. I wouldn't get this far without your guidance. There's nothing left to do but to call it: X5D v 1.1 - time of death Fri 26 17:06.
 
  • Like
Reactions: iscle

iscle

Senior Member
Apr 19, 2014
221
479
22
Barcelona
Second of all - you were absolutely right about location of the test point on this board. After few attempts I've managed to write preloader and rest is a history.
Would you mind sharing which pin was the one that let you flash the device? I'm working on a new preloader and I'm sure it won't work first try :p
 

arcadilius

Member
Aug 29, 2020
8
1
Sure... I believe I've used ADVANCED MODE and WRITE MEMORY tab in SPL for initial preloader write at address 0x0. From there, the device was detectable under the DOWNLOAD tab as well. In case when preloader on the device is correct, DOWNLOAD mode alone should be efficient.
 

Attachments

  • pin.png
    pin.png
    3.2 MB · Views: 23

iscle

Senior Member
Apr 19, 2014
221
479
22
Barcelona
Sure... I believe I've used ADVANCED MODE and WRITE MEMORY tab in SPL for initial preloader write at address 0x0. From there, the device was detectable under the DOWNLOAD tab as well. In case when preloader on the device is correct, DOWNLOAD mode alone should be efficient.
Oh, I was hoping it was one of the ones in the outside... Removing the shield is a pain...

Well, thanks for the information! I'll try my best not to brick it haha
 

eecon

Member
Aug 2, 2017
11
3
Magisk works just fine, I actually recommend it over SuperSU, as SuperSU is practically obsolete nowadays.

Also, no need to unlock the bootloader, just flash the recovery image as I explained on the first post.
Please how do you boot into recovery after flashing?
 

Lori.Dr

Member
Mar 2, 2021
9
0
Good evening everyone!

I recently bought a Junsun V1 head unit for my Golf 7. I specifically chose it because of the AC8227L SOC, which is a renamed MT8127. It includes a few more peripherals that are useful in car infotainment systems, but the core is identical.

I'm in the process of creating a new firmware from scratch, to replace the chinglish, buggy stock one. However, I have not succeeded yet.

What I have done so far is create a TWRP image for it, completely from source, using the prebuilt kernel. It's available here (any mirrors will be appreciated and linked in this post):
https://mega.nz/file/1Gp2gJ5S#gAxcP1WK8nwXivYTpAlyEsWNoWwNZBZ8VTs3fm57gEc

I have also dumped the firmware from the 2GB + 32GB version: https://mega.nz/file/hXhEjTab#AowvrX36nn9rXIkeu_zgnGmLyDxtiSUSWswwmXcN46k

To install install TWRP simply put it on the "RECOVERY" section in SP Flash Tool using the scatter and preloader provided in the firmware dump. Uncheck everything else and press flash.
You'll need a type-a to type-a USB cable connected to the 4-pin USB connector (not the 6-pin), and then give power to the unit.

Anche qualsiasi altra informazione sul dispositivo, comunicazione seriale tra Android e MCU, app decompilate, app modificate, ecc. Sono benvenute!

Spero che questo sia utile per qualcuno.

AGGIORNAMENTO 07-01-2021:
Sto decodificando l'apk MainUI da una settimana ormai. Ho estratto il protocollo di comunicazione MCU, ora sto cercando di estrarre il protocollo DSP e CAN sarà il prossimo.
Anche i pulsanti a sfioramento sul lato sinistro dell'unità sono gestiti da questo .apk, e che è già stato decodificato, solo l'implementazione deve essere eseguita con l'API disponibile che ho scritto.

Ogni aiuto è benvenuto. Puoi trovare il codice sorgente in github. Il lavoro importante viene svolto nelle librerie native, la roba java è inutile in questo momento. https://github.com/Iscle/MainUI
 

Attachments

  • IMG_20210515_203421.jpg
    IMG_20210515_203421.jpg
    9.3 MB · Views: 12

Lori.Dr

Member
Mar 2, 2021
9
0
Good evening everyone!

I recently bought a Junsun V1 head unit for my Golf 7. I specifically chose it because of the AC8227L SOC, which is a renamed MT8127. It includes a few more peripherals that are useful in car infotainment systems, but the core is identical.

I'm in the process of creating a new firmware from scratch, to replace the chinglish, buggy stock one. However, I have not succeeded yet.

What I have done so far is create a TWRP image for it, completely from source, using the prebuilt kernel. It's available here (any mirrors will be appreciated and linked in this post):
https://mega.nz/file/1Gp2gJ5S#gAxcP1WK8nwXivYTpAlyEsWNoWwNZBZ8VTs3fm57gEc

I have also dumped the firmware from the 2GB + 32GB version: https://mega.nz/file/hXhEjTab#AowvrX36nn9rXIkeu_zgnGmLyDxtiSUSWswwmXcN46k

To install install TWRP simply put it on the "RECOVERY" section in SP Flash Tool using the scatter and preloader provided in the firmware dump. Uncheck everything else and press flash.
You'll need a type-a to type-a USB cable connected to the 4-pin USB connector (not the 6-pin), and then give power to the unit.

Any other information about the device, serial communication between android and the MCU, decompiled apps, modified apps, etc are also welcome!

I hope this is useful for somebody.

UPDATE 07-01-2021:
I've been reverse engineering the MainUI apk for a week now. I've extracted the MCU communication protocol, now I'm trying to extract the DSP protocol, and CAN will be next.
The touch buttons on the left side of the unit is managed by this .apk as well, and that has already been reverse engineered, only the implementation has to be done with the available API I wrote.

All help is welcome. You can find the source code in github. The important work is being done in native libraries, the java stuff is useless right now. https://github.com/Iscle/MainUI
Hi all can anyone help me i can't flash the tprw recovery gives me this error. Who can give me advice
 

Top Liked Posts

  • There are no posts matching your filters.
  • 2
    Good evening everyone!

    I recently bought a Junsun V1 head unit for my Golf 7. I specifically chose it because of the AC8227L SOC, which is a renamed MT8127. It includes a few more peripherals that are useful in car infotainment systems, but the core is identical.

    I'm in the process of creating a new firmware from scratch, to replace the chinglish, buggy stock one. However, I have not succeeded yet.

    What I have done so far is create a TWRP image for it, completely from source, using the prebuilt kernel. It's available here (any mirrors will be appreciated and linked in this post):
    https://mega.nz/file/1Gp2gJ5S#gAxcP1WK8nwXivYTpAlyEsWNoWwNZBZ8VTs3fm57gEc

    I have also dumped the firmware from the 2GB + 32GB version: https://mega.nz/file/hXhEjTab#AowvrX36nn9rXIkeu_zgnGmLyDxtiSUSWswwmXcN46k

    To install install TWRP simply put it on the "RECOVERY" section in SP Flash Tool using the scatter and preloader provided in the firmware dump. Uncheck everything else and press flash.
    You'll need a type-a to type-a USB cable connected to the 4-pin USB connector (not the 6-pin), and then give power to the unit.

    Any other information about the device, serial communication between android and the MCU, decompiled apps, modified apps, etc are also welcome!

    I hope this is useful for somebody.

    UPDATE 07-01-2021:
    I've been reverse engineering the MainUI apk for a week now. I've extracted the MCU communication protocol, now I'm trying to extract the DSP protocol, and CAN will be next.
    The touch buttons on the left side of the unit is managed by this .apk as well, and that has already been reverse engineered, only the implementation has to be done with the available API I wrote.

    All help is welcome. You can find the source code in github. The important work is being done in native libraries, the java stuff is useless right now. https://github.com/Iscle/MainUI
    1
    Hola, encuentro poca información sobre mi mcu TS907. Creo que la unidad es diferente pero la misma mcu.
    ¿Podrías decirme si servirían para rootear tus archivos? Gracias
    ver archivos adjuntos
    View attachment 5164087View attachment 5164089View attachment 5164091View attachment 5164093

    Si la resolución de pantalla es 1024x600, entonces muy seguramente sí. De todas maneras, haz una copia antes de todo el sistema, o, como mínimo, del recovery.img por si el TWRP falla.
    1
    Pictures of the unit "guts" :

    IMG_20201127_170932.jpg


    The Power amplifier chip :
    IMG_20201127_234117.jpg

    It uses a chinese chip ( http://www.autochips.com/en/Amplifier/ ) claiming to ba an AB Mosfet low noise/distortion amplifier.
    Seems to have 4 x 26 W / 4 @ 14.4 V, 1 kHz, 10 % THD.
    Million dollar question : does it worth to replace with something like TDA7851?
    Note the electrolitic capacitor, seems to be quite undersized, i solder another capacitor in parallel to raise the total capacity at about 6000uF, maybe low basses will improve.

    IMG_20201128_144855.jpg

    In my unit i found a flaw about the heat dissipation, don't know if it's only my unit or if it's a design one.
    This unit uses a passive thermal method so the whole back chassis is a heat radiator: the board hottest point are the SOC ( that is the AC8227L) and the Power amplifier.
    The PU chip is in contact with the back chassis ( no screws, only back chassis contact with a lot of dissipating thermal paste ). This shouldn't be a big issue as a Mosfet chip of that power does not generate an immense amount of heat...

    The flaw about the SOC heat dissipation: this is the back of the unit, you can see the slot where the PU chip goes and the square "leg" that should touch the CPU; actually that leg doesn't touch the SOC case, so the heat disspation is far to be optimal in this case...


    InkedIMG_20201128_174715_LI.jpg


    So i decided to put a thin conductive adhesive film ontop of the SOC case:

    IMG_20201128_144853.jpg

    I tested the system by loading the cpu at 100% ( with a thread load generator apk ) for few hours: without the mod the temperature raised to 75° whereas the mod lowered the max temp to 65°.
    Having spares 12V fans I went for a paranoiac modification :

    IMG_20201213_114048.jpg
    due to the fans noise i used a DC step down controller to drive the fans at about 8V so the noise was inaudible.
    The same "cooking" test above reported a max temp of about 55°.

    Pratical results? The DAB+ app sometime had issues; it muted sound for a short time, it seemed to me that with this mod it works better... ( or it was the choice of Christmas wines to make me think so... )

    So in the end I suggest to check if in your unit the SOC case has a good contact with the chassis "leg".
    1
    Okay, I've been digging through the firmware to see where the f*** the programmers set most apps to fullscreen mode, and finally found it. In case any of you, like me, does not want to force fullscreen for all apps, you have to set this setting in /vendor/build.prop or /system/build.prop:

    forfan.force_fullscreen=0

    It took me a few hours to find, so hopefully nobody else has to go through the pain again :p
    1
    Yes, that's correct. "Secret menu" solves some of problems but not all of them. Backlight is not working at all (and I'm assuming this should work out of the box). Screen is oriented correctly but touch surface is "negative" horizontally, x axis is flipped (on original firmware this should be sorted out of the box as well). Side on-screen buttons apart from reset, which is the only physical button, don't work. I may have damaged the board while I was trying to figure out where that bloody test point is. Moreover there are stability and bluetooth issues I've encountered earlier which encouraged me to put my fingers on it in first place. That was a total flop from the beginning... I'm truly grateful iscle, for you time and advice, when many just turned their heads away. I wouldn't get this far without your guidance. There's nothing left to do but to call it: X5D v 1.1 - time of death Fri 26 17:06.