General Modding your Joying/FYT SC9853i unit without root

Search This thread

gamer765

Senior Member
Jan 14, 2009
519
233
You guys are very welcome, here is the link.

https://drive.google.com/drive/folders/10uNmmbkGoB8sR5hgUYZuFVD-WDb0gOY4?usp=sharing

Let me know if you have issues accessing
This is amazing, with this we should be able to do a lot of stuff with our units. We can even roll our own custom ROMs if we wanted. I'm not a ROM cook, but I can definitely use this for our bluetooth endeavors and possibly legitimately unlocking features that are locked on our units.
 

xadamadax

Member
Oct 10, 2007
22
1
This is amazing, with this we should be able to do a lot of stuff with our units. We can even roll our own custom ROMs if we wanted. I'm not a ROM cook, but I can definitely use this for our bluetooth endeavors and possibly legitimately unlocking features that are locked on our units.

My main motivation for sharing here :D
@gurishark - you need to download the split zip in source, extract it, and then extract the tar inside. The apps specifically are in \idh.code\packages\apps

There are also lots of python scripts and windows tools, and it seems apps that they use for configuration purposes and later remove. So should be a lot of powerful stuff.

I sell these in the vertical style for a few different cars and we run a custom rom that I'm looking to make much much better. @gurishark, @gamer, @bambapin or whomever PM me if you want to chat.
 
Last edited:

gurishark

New member
Sep 5, 2020
2
0
@xadamadax - I think the apps in \idh.code\packages\apps are the standard apps from Android AOSP source, not the FYT apps or modified by FYT version of the apps. But still lot's of nice stuff there :good:
 

gamer765

Senior Member
Jan 14, 2009
519
233
I agree with the above, theres no FYT apps in the source code, only the standard AOSP apps, plus a few Spreadtrum proprietary apps. True this dump is good for building new base ROMs, but you're gonna need to pull FYT proprietary APKs and libs from the stock ROM. We can probably use this dump to restore the bluetooth stack in our units. If we want to fix the FYT proprietary bluetooth app, we need the source for that. Its difficult to work on the ready built apks since theyre obfuscated and makes tracing hard. However, im more interested in getting source code to libsyujni.so so we could roll our own. Also, my time is mostly dedicated to reversing Teyes stuff. I'm working with a guy from 4PDA and got a fytdata dump from a CC2 unit to work with.
 
Last edited:

xadamadax

Member
Oct 10, 2007
22
1
I agree with the above, theres no FYT apps in the source code, only the standard AOSP apps, plus a few Spreadtrum proprietary apps. True this dump is good for building new base ROMs, but you're gonna need to pull FYT proprietary APKs and libs from the stock ROM. We can probably use this dump to restore the bluetooth stack in our units. If we want to fix the FYT proprietary bluetooth app, we need the source for that. Its difficult to work on the ready built apks since theyre obfuscated and makes tracing hard. However, im more interested in getting source code to libsyujni.so so we could roll our own. Also, my time is mostly dedicated to reversing Teyes stuff. I'm working with a guy from 4PDA and got a fytdata dump from a CC2 unit to work with.

got it! sorry my mistake, glad it will help some. please share what you find from the dump from the cc2 :D as i'm sure you will. I spend time on 4da, but its a pain without an account and keyword search is trash with translate
 

gamer765

Senior Member
Jan 14, 2009
519
233
I managed to make an account using translate and found a trick online on how to bypass the annoying captcha, so I dont have to do it at all anymore. I only managed to get hold of this person because they have a Teyes unit that im guessing has issues and they want to basically convert a Joying unit to Teyes. So I asked for a dump and I found what I was looking for in it.
 

surfer63

Senior Member
May 4, 2010
4,131
1,684
Zwolle
hvdwolf.github.io
got it! sorry my mistake, glad it will help some. please share what you find from the dump from the cc2 :D as i'm sure you will. I spend time on 4da, but its a pain without an account and keyword search is trash with translate

I managed to make an account using translate and found a trick online on how to bypass the annoying captcha, so I dont have to do it at all anymore. I only managed to get hold of this person because they have a Teyes unit that im guessing has issues and they want to basically convert a Joying unit to Teyes. So I asked for a dump and I found what I was looking for in it.

I used the "howto" on this website to register on 4pda: https://www.offlinemods.net/2017/09/how-to-register-account-on-4pdaru.html
But there are more. Simply search for "register on 4pda" or "bypass 4pda captcha"
 

gamer765

Senior Member
Jan 14, 2009
519
233
Not sure if anyone is interested, but i've been working on this meanwhile I work on libsyu_jni hacking. Only tested the SPRO+ launcher since it finally includes 1280p resolution support. Pretty sure other launchers are working perfectly now as well. Fully optimized. The radio app was fixed to allow station logos outside of the europe area. Would be great if everyone could compile a logo database for all cities. I got lazy and only did some for NYC. Add logos to res\drawable-nodpi-v4 directory and add stations and city info to res\raw\radio_freqs.json. Now that i've got the basics down, I think i'm going to move on to Teyes firmware since it is likely that Joying will not update their firmware anymore.
SPRO+ Launcher: https://anonymousfiles.io/0htP2gCO/
CC2 Launchers: Removed since reported it doesn't work.
CC2 Radio with Logo support: https://anonymousfiles.io/TTAbC26x/
 
Last edited:

surfer63

Senior Member
May 4, 2010
4,131
1,684
Zwolle
hvdwolf.github.io
Not sure if anyone is interested, but i've been working on this meanwhile I work on libsyu_jni hacking. Only tested the SPRO+ launcher since it finally includes 1280p resolution support. Pretty sure other launchers are working perfectly now as well. Fully optimized. The radio app was fixed to allow station logos outside of the europe area. Would be great if everyone could compile a logo database for all cities. I got lazy and only did some for NYC. Add logos to res\drawable-nodpi-v4 directory and add stations and city info to res\raw\radio_freqs.json. Now that i've got the basics down, I think i'm going to move on to Teyes firmware since it is likely that Joying will not update their firmware anymore.
SPRO+ Launcher: https://anonymousfiles.io/0htP2gCO/
CC2 Launchers: https://anonymousfiles.io/T3VzoYII/
CC2 Radio with Logo support: https://anonymousfiles.io/TTAbC26x/

Before I could not install the launcher on my system. What did you change? or was it only the the 1280x720 resolution?
And w.r.t. the logo database: I already looked at it and also mentioned this to someone else, but In Europe (at least in the Netherlands and Germany), it is different. Every region has its own frequency. A radio station can have 11 different frequencies in the Netherlands. Only for the Netherlands the database would be huge. so I stopped it for myself. Maybe even more because I now use DAB+.

And indeed: I am also thinking of switching to T'eyes.
 

gamer765

Senior Member
Jan 14, 2009
519
233
Only the SPRO+ launcher will work for our 720p unit since that one has the added 720p resources. The CC2 launchers will continue to work only on 640p resolution units with the exception of launcher8, that one has the necessary 720p resources. We have to wait for the CC2+ firmware to drop so we can grab the launcher from there. W.r.t. the logos, previously it would only show if you had Europe selected in the radio settings, if you had another other region selected, no logos would show, if you added your stations and logos to the apk, the app would crash if you tried to set your city. Now it's enabled for every region.
 

gamer765

Senior Member
Jan 14, 2009
519
233
Found more activation stuff in com.syu.us.
I think I fully solved this issue. I believe it checks the MCU if it contains TZY, if not, it will throw a blank window.
 
Last edited:

surfer63

Senior Member
May 4, 2010
4,131
1,684
Zwolle
hvdwolf.github.io
Please test this modded launcher. I believe it should work 100% now.
https://anonymousfiles.io/G1AQjNiQ/

How should it be installed?
Simply put it on a usb-stick and install?
Or via a minimal apk flash?

I copied it onto a USB-stick and simply double-clicked it to install. It installed and I rebooted. Then absolutely nothing: only the configured background screen and a non-functional topbar.
Fortunately my steering keys still worked and I tried to start navigation, but "no navigation app was assigned" which made it possible to reassign CarWebGuru and then from CarWebGuru make that the default launcher again.
I tried twice, but twice after reboot I only got the configured background screen.

And actually this is exactly the same as when I tried with the original launcher.
And by the way: the apk is called "190095005_com.android.launcher4.apk", but when installed I can only select "launcher 3" as launcher (with the blue-white T'eyes "roof" icon").
 
Last edited:

gamer765

Senior Member
Jan 14, 2009
519
233
Forgot to mention, only for 640p and lower devices. Won't work for 720p. For 720p only the SPRO+ one will work. I am personally using that one on my device.
 

surfer63

Senior Member
May 4, 2010
4,131
1,684
Zwolle
hvdwolf.github.io
Forgot to mention, only for 640p and lower devices. Won't work for 720p. For 720p only the SPRO+ one will work. I am personally using that one on my device.

Ah.
As you removed the CC2 launchers, I thought this was an improved version of the SPRO+ launcher. So I downloaded the SPRO+ launcher again from your previous post.
But it still doesn't want to install. The install starts and asks whether I want to accept all necessary rights, and when I click Continue (or Yes or whatever), I get the error triangle that it is not installed.
 

gamer765

Senior Member
Jan 14, 2009
519
233
You probably have another launcher installed with package name com.android.launcher4? Uninstall the previous ones before installing. I'll double check though maybe I uploaded the one without signing. My apologies, I uploaded one without a proper signature. Use this one instead. This one is the SPRO+ launcher with 720p support.
https://anonymousfiles.io/a5HFcBQD/
 
Last edited:

surfer63

Senior Member
May 4, 2010
4,131
1,684
Zwolle
hvdwolf.github.io
You probably have another launcher installed with package name com.android.launcher4? Uninstall the previous ones before installing. I'll double check though maybe I uploaded the one without signing.

One of my flash scripts removes all Joying/FYT launchers together with a lot of useless apps, incl. data and cache. I did that already months ago.
There is no Joying launcher on my system anymore. Only CarWebGuru and Nova.
But that also came to mind with me so I really did check: No trace of any Joying launcher.
 

gamer765

Senior Member
Jan 14, 2009
519
233
I posted an updated version above. I resigned it.
Here's what the SPRO+ launcher looks on my Joying.
 

Attachments

  • 20200923_104550.jpg
    20200923_104550.jpg
    257.2 KB · Views: 124
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 11
    See title: Only for SC9853i Joying/FYT 8.1 units.
    Due to some changes in the flashing process since the previous PX5 and Sofia 3GR models it is now partly possible to mod your unit without root.

    Some info to start with:
    (partly from 4pda, partly from a "hint" from @julien_blanche, mostly from own knowledge)

    Contents of a firmware zip:
    Code:
    6521_1.zip           # The zip that contains the boot.img; the system/vendor/oem partitions and a few other things.
    Allapp.pkg           # Special file that contains all FYT apps (actually a special XAR archive.)
    config.txt           # file comparible to the build.prop which can contain additional properties
    lsec6521update       # The binary that really does the update
    oem                  # Folder containing some additional apps
    Stm32ud.bin          # The MCU binary. It is not always in every firmware
    updatecfg.txt        # Contains instructions for the flashing process
    crruptoff            # Special file for "WiFi only". Not in the normal firmwares. Be careful!


    Some commands that can be put inside updatecfg.txt
    Code:
    twipe_all     # Wipe entire system
    twipe_data    # Will wipe data partition (but not /sdcard, internal memory). Wiping the /data partition will wipe all config, all 3rd party apps and updates of system apps. This is the same as a "reset to factory defaults"
    twipe_sd      # Will wipe internal memory /sdcard (but not the data partition)
    dellapp       # Remove all 3rd party apps
    make_updates  # Make an upgrade U-disk boot file
    test             # test unit and firmware before flash

    Some properties that can be put inside config.txt. Say you live in Brazil and you want your locale settings immediately on Brazil, you can add that, for example:
    Code:
    ro.product.locale = pt_BR

    The file crruptoff:
    If you have a unit with a 4G module, but you don't have 4G (or don't want to use it), you can use this file. Put one line in this crruptoff being "fixwifi" and save it to the sdcard/usb-stick you use for flashing.
    You can use it to get rid of the "No SIM" notification in your notification bar.
    Does not work anymore on the later firmwares. Chances are minimal but maybe it might work again "some day".

    The Allapp.pkg
    The Allapp.pkg file is a special XAR archive with a directory structure. You can use ApkPack.exe to create or extract it.
    Folder path: This is where your files are being extracted to, or packed from
    File path: This is the file that is being created (packed), or where the files are extracted from.
    All apks (*.apk) and all libraries (*.so) will be installed as system apks and libraries, which means you can't uninstall them, but on the SC9853i units they are installed under /oem and not under /system.
    Inside this Allapp.pkg you will also find two other files: fyt.prop and skipkillapp.prop.
    The fyt.prop is identical to the build.prop but gives the option to add extra properties or replace/modify properties in the build.prop.
    The skipkillapp.prop contains apps (package names) with values from -15 to 15.
    When going into "deep sleep" the packages not mentioned in this list will be killed. Applications in this list with positive values will absolutely be killed (unstable otherwise??). The ones with higher values first. The ones with values 1 and 0 as last, where the app with value 0 will be the last killed before going into deep sleep.
    The apps with negative values are considered system apps and will not be killed. In this case the most negative number (-15) has the highest priority. My assumption (not tested, not verified) is that negative numbers approaching 0 might be killed if the system needs the memory?
    So in other words: If you do not want that some of your apps are killed, you can add them to this "skipkillapp.prop" by their package name. Say you use @realzoulou's DAB-Z app, you would add a line for DAB-Z (com.zoulou.dab). Or for example if you are a Tasker user, which is normally killed as well:
    Code:
    com.zoulou.dab = -10
    net.dinglisch.android.taskerm = -10
    (I would suggest not using values like -15, -14, -13 to make sure you do not really interfere with the real system apps).
    And then you need to add this file to your own allapp.pkg

    The lsec_updatesh folder and lsec.sh script
    Practical applications:
    • Making patches, an alternative to creating the Allapp.pkg package.
    • Work on all folders in the unit (which Allapp.pkg cannot do).
    • Delete unnecessary files or applications (who uses the calculator app?), or overwite files like the fyt.prop or others.
    • Modify/overwrite config files that are otherwise not modifiable (like bluetooth config?)
    • Setting properties that normally require root/admin rights.
    • Creating backups of your partitions using the dd command. This can be handy on a device for which you do not have a firmware yet as backup.
    • Rooting your unit, also if you do not have a firmware from your supplier.
    • Make a Custom ROM by simply doing all kind of modifications after the "normal" firmware flash.

    See for more info about the "The lsec_updatesh folder and lsec.sh script" in post #228.

    Creating an Allapp.pkg and flash it to your device (post #2)
    Some pre-build flashable images (post #3)
    And if everything goes wrong and your unit ends up in a boot loop or doesn't get past the boot logo. (post #4)
    8
    Creating an Allapp.pkg and flash it to your device

    Use the (English) version of ApkPack.exe (english version attached) to unpack/repack an Allapp.pkg. (It also works with wine on Linux/MacOS)

    (See this youtube link for a really quick & dirty (and unsharp, sorry) video about what scrolls on your screen when flashing such a mini Allapp.pkg)

    (1) Quick example:
    • Create a folder Allapp
    • Copy some wanted apks or mods into the folder.
    • Use the ApkPack.exe to create the Allapp.pkg
    • Simply copy the "Allapp.pkg" and "lsec6521update" onto a clean FAT32 formatted SD-card or USB-stick.
    • Put the USB-stick into your unit and it will recognise the update and flash it to your unit.
    • Other options:
      • Copy the "Allapp.pkg", (optional) "updatecfg.txt", (optional) "config.txt" and "lsec6521update" onto a clean FAT32 formatted SD-card or USB-stick.
      • In my case having a 4G unit without using 4G and wanting to use Google Assistant for calls: Copy the Allapp.pkg, config.txt (see above), crruptoff (see above) and lsec6521update onto a clean FAT32 formatted USB-stick.
      • Note that when NOT using an updatecfg.txt, nothing will be wiped on your unit. Only added/replaced.

    (2) Another example:
    • Create folder Allapp on your pc/laptop
      • add (2019-08-14) main server mod with extended navi_app.txt and "BT to background" hacks. (see my github repo. Be careful to choose the one for your specific firmware date)
      • add BW-RDS radio mod (see my github repo. Only choose version for Android 8.1 if you want full functionality)
      • add oandbackup (dk.jens.backup_305.apk) (Free and open source backup restore apk)
      • add latest MagiskManager-v7.3.2.apk
    • Use apkpack.exe (attached) to create a new Allapp.pkg by selecting the folder to be packaged, the name of the file being Allapp.pkg, and select button "Packed" (sloppy translation from Chinese)
    • Copy created "Allapp.pkg" and "lsec6521update" onto a clean FAT32 formatted USB-stick.
    • Insert in your unit and the flashing process will start (Note: It will mention "Setting to factory defaults" before flash reboot, but it is really not doing that)
    • After the (very quick) flash and normal reboot, you will have 2 new apps and 2 modded apps.

    (3) Example for a FYT compatible SC9853i, like a Sinosmart or Zhan or "unnamed":
    You can also create your own Allapp.pkg, also with a modded Joying apk as the apks are actually identical, but there is one big naming issue to take into account!
    Even though the apks are identical having the same package name, they have different apk names. A normal install will check for the package name and replace the apk with that same package name, whatever its apk name (think of versions or build time stamps behind the the "normal" name). The flashing method simply looks at the apk name and will create an /oem/app/<apk_name>/<apk_name>.apk. In this case versions numbers of build timestamps will create again and again a new folder with the exact same apk and none will work.
    As an example for the radio app:
    • Joying: 190043001_com.syu.radio.apk
    • Sinosmart: 190042001_com.syu.radio.apk
    • "Some" unbranded: 190101001_com.syu.radio.apk
    Again: The apks are exactly the same but have a different name. If you simply flash one next to the other, both will not work anymore as both have the same internal package name being "com.syu.radio". So you have no radio at all.
    So, how to create an Allapp.pkg with a modded Joying apk for your FYT compatible SC9853i unit?
    • Check the name of your unit's radio app (or BT, Video, Music app). (If you don't know how you can use my HWGet_info.apk and open the resulting HWget_info.zip and look inside the "oem_listing.txt")
    • Find the name of the modded Joying app.
    • Rename the modded Joying app to the name of your app. So for example for Joying-> Sinosmart radio app: rename 190043001_com.syu.radio.apk to 190042001_com.syu.radio.apk (Joying to Sinosmart)
    • Create a folder Allapp
    • Copy the modded and now renamed Joying radio apk into the folder (repeat if relevant for other mods).
    • Use the ApkPack.exe to create the Allapp.pkg
    • Simply copy the "Allapp.pkg" and "lsec6521update" onto a clean FAT32 formatted SD-card or USB-stick.
    • Put the USB-stick into your unit and it will recognise the update and flash it to your unit.
    • Also create an Allap.pkg for your original app so you can always flash back the original app if you want (or need) to.
    7
    Some pre-build flashable images

    Only for real Joying SC9853i units. Other FYT compatibles are not supported.
    All SC9853i FYT models are actually the same, but boot images are mostly different and apks have different names. In the latter case you would have 2 identical apks with the same package name, but with a different apk name residing in different folders. Neither of them will work anymore as Android doesn't know which one is the correct one.

    The zips that can be found in this post can be directly unzipped to a clean, empty Fat32 formatted USB-stick or SD-card. You do not need to be rooted and you don't need my JET apk.
    When this USB-stick or SD-card is inserted into your unit, the unit will recognize it as a flashable firmware and start flashing the files to your unit.

    Notes:
    • These flashable firmware files will leave all your installed apps and settings as they are. Only the files in these Allapp.pkg files will be overwritten.
    • The zips containing boot images will only overwrite the boot image. All apps and settings remain as they are.
    • The "combi" zips are just combinations of possible mods and/or boot images. They behave the same as the previous two.
    • The zips that can be downloaded from this post are all on one of my github repositories. You can find it here: SC98531BinRepo.
    ----------------------------------------------------------------------------------------------------------------------------------------------------------------
    Boot images
    2019-11-28 | 20191128-rooted-boot-image (thanks to @rigattoni) | 20191128-normal-boot-image
    2019-09-17 | 20190917-rooted-boot-image | 20190917-normal-boot-image
    2019-08-14 | 20190814-rooted-boot-image (thanks to @julien_blanche)

    ----------------------------------------------------------------------------------------------------------------------------------------------------------------
    Main server apk mods (the 190000000_com.syu.ms.apk)
    The ORG version is the apk as delivered by Joying in their firmwares.
    The ORG_extended is the Joying one including an extended navi_app.txt, extended player_app.txt, extended navi_audio_from_playstatus.txt.
    The NoKill is the extended version where the normal functionality to kill all apps when going into "deep sleep" (turn of ignition), has been disabled.

    2020-04-07 | 2020-04-07-com_syu_ms-ORG | 2020-04-07-com_syu_ms-ORG_extended | 2020-04-07-com_syu_ms-nokill | ( Zips, modified smali files, modified assets text files, some info)
    2019-11-28 | 2019-11-28-com_syu_ms-ORG | 2019-11-28-com_syu_ms-ORG_extended | 2019-11-28-com_syu_ms-NoKill | ( Zips, modified smali files, modified assets text files, some info)
    2019-09-17 | 2019-09-17-com_syu_ms-ORG | 2019-09-17-com_syu_ms-ORG_extended | 2019-09-17-com_syu_ms-NoKill | ( Zips, modified smali files, modified assets text files, some info)
    2019-08-14 | 2019-08-14-com_syu_ms-ORG | 2019-08-14-com_syu_ms-ORG_extended | 2019-08-14-com_syu_ms-NoKill

    ----------------------------------------------------------------------------------------------------------------------------------------------------------------
    Other mods
    There are currently two mods for the radio: One very nice one from user @Soiski71 and one which I made.
    The ORG version in this case is the one delivered with the Joying firmwares.

    Radio | SC98531-Radio-ORG | SC98531-Radio-Mod (preview) | SC98531-Radio-Mod-Soiski71 (preview)

    ----------------------------------------------------------------------------------------------------------------------------------------------------------------
    Combinations
    These are combinations of above files which I found useful. Undoing them can be done by using one of the above ORG zips.
    2019-09-17 | 2019-09-17-radio_mainserver | 2019-09-17-rootedboot_radio_mainserver
    4
    If everything goes wrong and your unit gets in a boot loop or stops on boot logo

    - Download a fresh firmware from the Joying blog.
    - Unzip it to an SD-card/USB-stick (as normal)
    - Put the USB-stick/SD-card in your unit and "push" the Reset (RST) with a paperclip or something like that. When the boot logo appears, reset the unit again. Now the flashing process should start.
    4
    L
    Less praying more reading?