This is amazing, with this we should be able to do a lot of stuff with our units. We can even roll our own custom ROMs if we wanted. I'm not a ROM cook, but I can definitely use this for our bluetooth endeavors and possibly legitimately unlocking features that are locked on our units.
General Modding your Joying/FYT SC9853i unit without root
- Thread starter surfer63
- Start date
This looks interesting, but sadly the code for the FYT apk's are not there or am I missing something?
My main motivation for sharing here
@gurishark - you need to download the split zip in source, extract it, and then extract the tar inside. The apps specifically are in \idh.code\packages\apps
There are also lots of python scripts and windows tools, and it seems apps that they use for configuration purposes and later remove. So should be a lot of powerful stuff.
I sell these in the vertical style for a few different cars and we run a custom rom that I'm looking to make much much better. @gurishark, @gamer, @bambapin or whomever PM me if you want to chat.
Last edited:
@xadamadax - I think the apps in \idh.code\packages\apps are the standard apps from Android AOSP source, not the FYT apps or modified by FYT version of the apps. But still lot's of nice stuff there :good:
I agree with the above, theres no FYT apps in the source code, only the standard AOSP apps, plus a few Spreadtrum proprietary apps. True this dump is good for building new base ROMs, but you're gonna need to pull FYT proprietary APKs and libs from the stock ROM. We can probably use this dump to restore the bluetooth stack in our units. If we want to fix the FYT proprietary bluetooth app, we need the source for that. Its difficult to work on the ready built apks since theyre obfuscated and makes tracing hard. However, im more interested in getting source code to libsyujni.so so we could roll our own. Also, my time is mostly dedicated to reversing Teyes stuff. I'm working with a guy from 4PDA and got a fytdata dump from a CC2 unit to work with.
Last edited:
got it! sorry my mistake, glad it will help some. please share what you find from the dump from the cc2
as i'm sure you will. I spend time on 4da, but its a pain without an account and keyword search is trash with translateI managed to make an account using translate and found a trick online on how to bypass the annoying captcha, so I dont have to do it at all anymore. I only managed to get hold of this person because they have a Teyes unit that im guessing has issues and they want to basically convert a Joying unit to Teyes. So I asked for a dump and I found what I was looking for in it.
got it! sorry my mistake, glad it will help some. please share what you find from the dump from the cc2
I used the "howto" on this website to register on 4pda: https://www.offlinemods.net/2017/09/how-to-register-account-on-4pdaru.html
But there are more. Simply search for "register on 4pda" or "bypass 4pda captcha"
Not sure if anyone is interested, but i've been working on this meanwhile I work on libsyu_jni hacking. Only tested the SPRO+ launcher since it finally includes 1280p resolution support. Pretty sure other launchers are working perfectly now as well. Fully optimized. The radio app was fixed to allow station logos outside of the europe area. Would be great if everyone could compile a logo database for all cities. I got lazy and only did some for NYC. Add logos to res\drawable-nodpi-v4 directory and add stations and city info to res\raw\radio_freqs.json. Now that i've got the basics down, I think i'm going to move on to Teyes firmware since it is likely that Joying will not update their firmware anymore.
SPRO+ Launcher: https://anonymousfiles.io/0htP2gCO/
CC2 Launchers: Removed since reported it doesn't work.
CC2 Radio with Logo support: https://anonymousfiles.io/TTAbC26x/
SPRO+ Launcher: https://anonymousfiles.io/0htP2gCO/
CC2 Launchers: Removed since reported it doesn't work.
CC2 Radio with Logo support: https://anonymousfiles.io/TTAbC26x/
Last edited:
Before I could not install the launcher on my system. What did you change? or was it only the the 1280x720 resolution?
And w.r.t. the logo database: I already looked at it and also mentioned this to someone else, but In Europe (at least in the Netherlands and Germany), it is different. Every region has its own frequency. A radio station can have 11 different frequencies in the Netherlands. Only for the Netherlands the database would be huge. so I stopped it for myself. Maybe even more because I now use DAB+.
And indeed: I am also thinking of switching to T'eyes.
Only the SPRO+ launcher will work for our 720p unit since that one has the added 720p resources. The CC2 launchers will continue to work only on 640p resolution units with the exception of launcher8, that one has the necessary 720p resources. We have to wait for the CC2+ firmware to drop so we can grab the launcher from there. W.r.t. the logos, previously it would only show if you had Europe selected in the radio settings, if you had another other region selected, no logos would show, if you added your stations and logos to the apk, the app would crash if you tried to set your city. Now it's enabled for every region.
Please test this modded launcher. I believe it should work 100% now.
https://anonymousfiles.io/G1AQjNiQ/
https://anonymousfiles.io/G1AQjNiQ/
How should it be installed?
Simply put it on a usb-stick and install?
Or via a minimal apk flash?
I copied it onto a USB-stick and simply double-clicked it to install. It installed and I rebooted. Then absolutely nothing: only the configured background screen and a non-functional topbar.
Fortunately my steering keys still worked and I tried to start navigation, but "no navigation app was assigned" which made it possible to reassign CarWebGuru and then from CarWebGuru make that the default launcher again.
I tried twice, but twice after reboot I only got the configured background screen.
And actually this is exactly the same as when I tried with the original launcher.
And by the way: the apk is called "190095005_com.android.launcher4.apk", but when installed I can only select "launcher 3" as launcher (with the blue-white T'eyes "roof" icon").
Last edited:
Ah.
As you removed the CC2 launchers, I thought this was an improved version of the SPRO+ launcher. So I downloaded the SPRO+ launcher again from your previous post.
But it still doesn't want to install. The install starts and asks whether I want to accept all necessary rights, and when I click Continue (or Yes or whatever), I get the error triangle that it is not installed.
You probably have another launcher installed with package name com.android.launcher4? Uninstall the previous ones before installing. I'll double check though maybe I uploaded the one without signing. My apologies, I uploaded one without a proper signature. Use this one instead. This one is the SPRO+ launcher with 720p support.
https://anonymousfiles.io/a5HFcBQD/
https://anonymousfiles.io/a5HFcBQD/
Last edited:
One of my flash scripts removes all Joying/FYT launchers together with a lot of useless apps, incl. data and cache. I did that already months ago.
There is no Joying launcher on my system anymore. Only CarWebGuru and Nova.
But that also came to mind with me so I really did check: No trace of any Joying launcher.
Top Liked Posts
-
There are no posts matching your filters.
-
11See title: Only for SC9853i Joying/FYT 8.1 units.
Due to some changes in the flashing process since the previous PX5 and Sofia 3GR models it is now partly possible to mod your unit without root.
Some info to start with:
(partly from 4pda, partly from a "hint" from @julien_blanche, mostly from own knowledge)
Contents of a firmware zip:
Code:6521_1.zip # The zip that contains the boot.img; the system/vendor/oem partitions and a few other things. Allapp.pkg # Special file that contains all FYT apps (actually a special XAR archive.) config.txt # file comparible to the build.prop which can contain additional properties lsec6521update # The binary that really does the update oem # Folder containing some additional apps Stm32ud.bin # The MCU binary. It is not always in every firmware updatecfg.txt # Contains instructions for the flashing process crruptoff # Special file for "WiFi only". Not in the normal firmwares. Be careful!
Some commands that can be put inside updatecfg.txt
Code:twipe_all # Wipe entire system twipe_data # Will wipe data partition (but not /sdcard, internal memory). Wiping the /data partition will wipe all config, all 3rd party apps and updates of system apps. This is the same as a "reset to factory defaults" twipe_sd # Will wipe internal memory /sdcard (but not the data partition) dellapp # Remove all 3rd party apps make_updates # Make an upgrade U-disk boot file test # test unit and firmware before flash
Some properties that can be put inside config.txt. Say you live in Brazil and you want your locale settings immediately on Brazil, you can add that, for example:
Code:ro.product.locale = pt_BR
The file crruptoff:Does not work anymore on the later firmwares. Chances are minimal but maybe it might work again "some day".
If you have a unit with a 4G module, but you don't have 4G (or don't want to use it), you can use this file. Put one line in this crruptoff being "fixwifi" and save it to the sdcard/usb-stick you use for flashing.
You can use it to get rid of the "No SIM" notification in your notification bar.
The Allapp.pkg
The Allapp.pkg file is a special XAR archive with a directory structure. You can use ApkPack.exe to create or extract it.
Folder path: This is where your files are being extracted to, or packed from
File path: This is the file that is being created (packed), or where the files are extracted from.
All apks (*.apk) and all libraries (*.so) will be installed as system apks and libraries, which means you can't uninstall them, but on the SC9853i units they are installed under /oem and not under /system.
Inside this Allapp.pkg you will also find two other files: fyt.prop and skipkillapp.prop.
The fyt.prop is identical to the build.prop but gives the option to add extra properties or replace/modify properties in the build.prop.
The skipkillapp.prop contains apps (package names) with values from -15 to 15.
When going into "deep sleep" the packages not mentioned in this list will be killed. Applications in this list with positive values will absolutely be killed (unstable otherwise??). The ones with higher values first. The ones with values 1 and 0 as last, where the app with value 0 will be the last killed before going into deep sleep.
The apps with negative values are considered system apps and will not be killed. In this case the most negative number (-15) has the highest priority. My assumption (not tested, not verified) is that negative numbers approaching 0 might be killed if the system needs the memory?
So in other words: If you do not want that some of your apps are killed, you can add them to this "skipkillapp.prop" by their package name. Say you use @realzoulou's DAB-Z app, you would add a line for DAB-Z (com.zoulou.dab). Or for example if you are a Tasker user, which is normally killed as well:
(I would suggest not using values like -15, -14, -13 to make sure you do not really interfere with the real system apps).Code:com.zoulou.dab = -10 net.dinglisch.android.taskerm = -10
And then you need to add this file to your own allapp.pkg
The lsec_updatesh folder and lsec.sh script
Practical applications:
- Making patches, an alternative to creating the Allapp.pkg package.
- Work on all folders in the unit (which Allapp.pkg cannot do).
- Delete unnecessary files or applications (who uses the calculator app?), or overwite files like the fyt.prop or others.
- Modify/overwrite config files that are otherwise not modifiable (like bluetooth config?)
- Setting properties that normally require root/admin rights.
- Creating backups of your partitions using the dd command. This can be handy on a device for which you do not have a firmware yet as backup.
- Rooting your unit, also if you do not have a firmware from your supplier.
- Make a Custom ROM by simply doing all kind of modifications after the "normal" firmware flash.
See for more info about the "The lsec_updatesh folder and lsec.sh script" in post #228.
Creating an Allapp.pkg and flash it to your device (post #2)
Some pre-build flashable images (post #3)
And if everything goes wrong and your unit ends up in a boot loop or doesn't get past the boot logo. (post #4)8Creating an Allapp.pkg and flash it to your device
Use the (English) version of ApkPack.exe (english version attached) to unpack/repack an Allapp.pkg. (It also works with wine on Linux/MacOS)
(See this youtube link for a really quick & dirty (and unsharp, sorry) video about what scrolls on your screen when flashing such a mini Allapp.pkg)
(1) Quick example:
- Create a folder Allapp
- Copy some wanted apks or mods into the folder.
- Use the ApkPack.exe to create the Allapp.pkg
- Simply copy the "Allapp.pkg" and "lsec6521update" onto a clean FAT32 formatted SD-card or USB-stick.
- Put the USB-stick into your unit and it will recognise the update and flash it to your unit.
- Other options:
- Copy the "Allapp.pkg", (optional) "updatecfg.txt", (optional) "config.txt" and "lsec6521update" onto a clean FAT32 formatted SD-card or USB-stick.
- In my case having a 4G unit without using 4G and wanting to use Google Assistant for calls: Copy the Allapp.pkg, config.txt (see above), crruptoff (see above) and lsec6521update onto a clean FAT32 formatted USB-stick.
- Note that when NOT using an updatecfg.txt, nothing will be wiped on your unit. Only added/replaced.
(2) Another example:
- Create folder Allapp on your pc/laptop
- add (2019-08-14) main server mod with extended navi_app.txt and "BT to background" hacks. (see my github repo. Be careful to choose the one for your specific firmware date)
- add BW-RDS radio mod (see my github repo. Only choose version for Android 8.1 if you want full functionality)
- add oandbackup (dk.jens.backup_305.apk) (Free and open source backup restore apk)
- add latest MagiskManager-v7.3.2.apk
- Use apkpack.exe (attached) to create a new Allapp.pkg by selecting the folder to be packaged, the name of the file being Allapp.pkg, and select button "Packed" (sloppy translation from Chinese)
- Copy created "Allapp.pkg" and "lsec6521update" onto a clean FAT32 formatted USB-stick.
- Insert in your unit and the flashing process will start (Note: It will mention "Setting to factory defaults" before flash reboot, but it is really not doing that)
- After the (very quick) flash and normal reboot, you will have 2 new apps and 2 modded apps.
(3) Example for a FYT compatible SC9853i, like a Sinosmart or Zhan or "unnamed":
You can also create your own Allapp.pkg, also with a modded Joying apk as the apks are actually identical, but there is one big naming issue to take into account!
Even though the apks are identical having the same package name, they have different apk names. A normal install will check for the package name and replace the apk with that same package name, whatever its apk name (think of versions or build time stamps behind the the "normal" name). The flashing method simply looks at the apk name and will create an /oem/app/<apk_name>/<apk_name>.apk. In this case versions numbers of build timestamps will create again and again a new folder with the exact same apk and none will work.
As an example for the radio app:
- Joying: 190043001_com.syu.radio.apk
- Sinosmart: 190042001_com.syu.radio.apk
- "Some" unbranded: 190101001_com.syu.radio.apk
So, how to create an Allapp.pkg with a modded Joying apk for your FYT compatible SC9853i unit?
- Check the name of your unit's radio app (or BT, Video, Music app). (If you don't know how you can use my HWGet_info.apk and open the resulting HWget_info.zip and look inside the "oem_listing.txt")
- Find the name of the modded Joying app.
- Rename the modded Joying app to the name of your app. So for example for Joying-> Sinosmart radio app: rename 190043001_com.syu.radio.apk to 190042001_com.syu.radio.apk (Joying to Sinosmart)
- Create a folder Allapp
- Copy the modded and now renamed Joying radio apk into the folder (repeat if relevant for other mods).
- Use the ApkPack.exe to create the Allapp.pkg
- Simply copy the "Allapp.pkg" and "lsec6521update" onto a clean FAT32 formatted SD-card or USB-stick.
- Put the USB-stick into your unit and it will recognise the update and flash it to your unit.
- Also create an Allap.pkg for your original app so you can always flash back the original app if you want (or need) to.
7Some pre-build flashable images
Only for real Joying SC9853i units. Other FYT compatibles are not supported.
All SC9853i FYT models are actually the same, but boot images are mostly different and apks have different names. In the latter case you would have 2 identical apks with the same package name, but with a different apk name residing in different folders. Neither of them will work anymore as Android doesn't know which one is the correct one.
The zips that can be found in this post can be directly unzipped to a clean, empty Fat32 formatted USB-stick or SD-card. You do not need to be rooted and you don't need my JET apk.
When this USB-stick or SD-card is inserted into your unit, the unit will recognize it as a flashable firmware and start flashing the files to your unit.
Notes:
- These flashable firmware files will leave all your installed apps and settings as they are. Only the files in these Allapp.pkg files will be overwritten.
- The zips containing boot images will only overwrite the boot image. All apps and settings remain as they are.
- The "combi" zips are just combinations of possible mods and/or boot images. They behave the same as the previous two.
- The zips that can be downloaded from this post are all on one of my github repositories. You can find it here: SC98531BinRepo.
Boot images
2019-11-28 | 20191128-rooted-boot-image (thanks to @rigattoni) | 20191128-normal-boot-image
2019-09-17 | 20190917-rooted-boot-image | 20190917-normal-boot-image
2019-08-14 | 20190814-rooted-boot-image (thanks to @julien_blanche)
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Main server apk mods (the 190000000_com.syu.ms.apk)
The ORG version is the apk as delivered by Joying in their firmwares.
The ORG_extended is the Joying one including an extended navi_app.txt, extended player_app.txt, extended navi_audio_from_playstatus.txt.
The NoKill is the extended version where the normal functionality to kill all apps when going into "deep sleep" (turn of ignition), has been disabled.
2020-04-07 | 2020-04-07-com_syu_ms-ORG | 2020-04-07-com_syu_ms-ORG_extended | 2020-04-07-com_syu_ms-nokill | ( Zips, modified smali files, modified assets text files, some info)
2019-11-28 | 2019-11-28-com_syu_ms-ORG | 2019-11-28-com_syu_ms-ORG_extended | 2019-11-28-com_syu_ms-NoKill | ( Zips, modified smali files, modified assets text files, some info)
2019-09-17 | 2019-09-17-com_syu_ms-ORG | 2019-09-17-com_syu_ms-ORG_extended | 2019-09-17-com_syu_ms-NoKill | ( Zips, modified smali files, modified assets text files, some info)
2019-08-14 | 2019-08-14-com_syu_ms-ORG | 2019-08-14-com_syu_ms-ORG_extended | 2019-08-14-com_syu_ms-NoKill
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Other mods
There are currently two mods for the radio: One very nice one from user @Soiski71 and one which I made.
The ORG version in this case is the one delivered with the Joying firmwares.
Radio | SC98531-Radio-ORG | SC98531-Radio-Mod (preview) | SC98531-Radio-Mod-Soiski71 (preview)
----------------------------------------------------------------------------------------------------------------------------------------------------------------
Combinations
These are combinations of above files which I found useful. Undoing them can be done by using one of the above ORG zips.
2019-09-17 | 2019-09-17-radio_mainserver | 2019-09-17-rootedboot_radio_mainserver4If everything goes wrong and your unit gets in a boot loop or stops on boot logo
- Download a fresh firmware from the Joying blog.
- Unzip it to an SD-card/USB-stick (as normal)
- Put the USB-stick/SD-card in your unit and "push" the Reset (RST) with a paperclip or something like that. When the boot logo appears, reset the unit again. Now the flashing process should start.4This post recaps some of the work done to enable voice calling using Google Assistant (GA) through a Bluetooth attached phone on an sc9853i FYT compatible Android Head Unit (HU). I have a TEyes SPro 4/64 with CC2 firmware installed. This should work on other FYT compatible, including Joying units, but no guarantees. This includes required files and instructions/steps for those that may find this at some point in the future.
Attached is the software to enable GA voice calling:
- Telecom script to update the Telecom server, if required. FYI, the Telecom server on my head unit was missing code to handle the voice call.
- The updated simple phone app that is called by the GA when a voice call is made. The Telecom server calls this app when the voice call is made. This is a release version and not a debug version of the app.
- GVC CallHandler I used. This app is called by the simple phone app. This app passes the details to the Bluetooth app to make the call.
- Ensure you have up to date/latest Google Assistant, Google app and the Google Contacts app and they have appropriate or all Permissions given...from Play store if you don't already have them.
- Install the attached GVC CallHandler and CustomGVCBluetoothPhoneHandler applications normally and give them permission to make calls. Root is not required. The GVC app is available from the Google Play Store. That may work, but the attached is a version that I tested with.
- Try voice calling using Google Assistant...say "Call xxxxx" where xxxxx is any of your contacts from Google Contacts. i don't believe that Google Assistant uses contacts from the Bluetooth phone app on the HU. If prompted, set the GVC CallHandler as the default app to make calls. One of two things will happen:
- It works and no messages or errors occur....the call will be made and you are finished! Note that there seems to be an issue where the first and/or second attempt don't work. Try the voice call a second or third time.
- It doesn't work and a message similar to "App isn't installed." then you need to replace the Android Telecom server app that is currently installed on your head unit.
- To replace the Telecom server, unzip the attached telecom_script.zip to a usb drive and insert into the HU. This should invoke the standard update process. The script includes the original TEyes Telecom server from my unit and the new one from another Joying unit, as described in a previous post. When it runs, it creates some information from your unit as well as copying the existing Telecom server on your head unit to the USB drive. If you need it or want to re-install it at some point, save it somewhere. You can also get it back from your own firmware.
- If it didn't work previously and you replaced your Telecom server, try the voice call again.
- That's it...it should have worked.
I'll be trying to figure out more info about the voice call not working on the initial attempt(s). I suspect I won't be able to determine the issue as I believe it occurs within the GVC app.
If you update to a different / newer firmware in the future, you will probably have to repeat this process.
