• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

Recon Jet Basic Info

Search This thread

LeighUK

Member
Apr 20, 2021
5
0
I wonder if I could get a Arduino or better still a Raspberry pie in the Jet case and just take the android unit out of the loop. Running a Raspberry Pi would open this up to all sorts of potential.
 

Razorsixfive

New member
Apr 6, 2021
1
0
this thread is exactly what I have been looking for i think. i can show you what i have on my onlocked recon jet glasses but how one of you guys found a app without login or do we need to hack it just asking before i have a go at it (Dont like to waste time on someting someone have done)
 

cayleyflyer

Member
Jan 18, 2021
20
1
hi,
I have impart surrendered for the moment on this one. my locked glasses are still locked. I copied a working set of files kindly donated on this forum to my glasses and these were duly overwriten back to the originals on boot and "activate go to the website" messages. I believe there is a partition on the memory which it boots from, checks the filing sytem and overites/corrects changes. Do not see a way arround it at the moment apart from the suggestion of taking out the android board and using somthing else to drive the screen.
 

TristanLeBoss

Senior Member
Dec 11, 2005
186
155
Hello,

I may be able to help. I started reversing the Recon Uplink app. Luckily, it's a app coded in .NET and it can be easily decompiled using Jetbrains dotPeek for example.

The app stores verbose log files in C:\Users\YOURACCOUNT\AppData\Local\Recon Instruments
When a login is successfull, the app stores credentials and tokens in file engageLoginState.bin in the previously mentionned folder.

In C:\Program Files (x86)\Recon Instruments\Uplink we have:
- ReconUplink.exe : .NET main executable
- ReconUplink_API_Wrapper.dll : .NET library wrapper over C ReconUplink_API.dll
- ReconUplink_API.dll : C library => the real deal
- libcurl.dll : CURL
- libeay32.dll and ssleay32.dll : OpenSSL
- Resources/cacert.pem : probably the root CA trusted by CURL

Using IDA on the C library, I discovered the API was located at https://api.reconinstruments.com and was using JSON.

The login is a POST to /login.json with body client_id=XXXX&client_secret=XXXX&email=XXXX&password=XXXX
I found the expected body.

Once logged in, the app do a GET request to /me.json with a Authorization Bearer + token header to check the data from this entrypoint match the ones returned from /login.json
I found the expected body.

Then, it waits for a device to be plugged (I don't have one).

During startup, the app also do a POST request to /software_versions/uplink_updates.json with body id=&uplink_flavour=windows&uplink_svn=010201&db_info=&installed_packages=&map_info= in order to grab updates. Updates can be of types: app_data, firmware, map_data, custom_dashboard_data
Unfortunately, update files are probably lost because no backup of api.reconinstruments.com exists: even Wayback Machine returns no result.
 

TristanLeBoss

Senior Member
Dec 11, 2005
186
155
A new server can probably be coded and both the Windows and Android app can be edited to use a new domain name.

I have yet to check this Android app (I attached a copy as an attachment)... I hope after logged in it's not just a webview displaying a website :(
Hopefully, it's a real app using the same API as the Windows software.

The Windows software seems to be mostly useless: it was made to download media from the glasses and process updates. It seems the real deal is the Android compagnion app.

I found some repository on GitHub related to Recon Jet (mostly apps for the glasses but also kernel and latest sdk):
- https://github.com/b1g0n3/MyCamRemote
- https://github.com/b1g0n3/MyWeather2.0
- https://github.com/b1g0n3/MyWeather2.1
- https://github.com/ErosFricker/bachelor-thesis
- https://github.com/evandcoleman/jet_kernel => Real Kernel?
- https://github.com/gstarnet/sdk => Last SDK?
- https://github.com/johncarpenter/ReconJetLogger
- https://github.com/pasho/OsmJet
- https://github.com/rahulsinghk991/ReconJet
- https://github.com/SARscene/Triage
- https://github.com/tajitaji551/reconjet-bebopdrone
- https://github.com/TugcaEker/ReconApp
- https://github.com/txz1226/getSensorData
- https://github.com/Yxwww/ERWear_ReconJetClient

It seems the latest version of the Windows software is 1.2.x and ReconOS (the custom android on the glasses) is 4.6.x

I added an Intel presentation "Developing Apps for Recon HUDs' as attachement.
 

Attachments

  • Recon Engage_v4.4.4.203_apkpure.com.apk
    8.3 MB · Views: 5
  • Developing Apps for Recon HUDs.pdf
    1.5 MB · Views: 6

TristanLeBoss

Senior Member
Dec 11, 2005
186
155
The LipXML thing seems to be the way to communicate with the glasses.

Here is a fake XML file with all the available commands I found. Some need arguments but I haven't dug deeper yet.

XML:
<?xml version="1.0"?>
<lispxml xmlns:io="com.reconinstruments.lispxml.module.io"
xmlns:m="com.reconinstruments.lispxml.module.math"
xmlns:s="com.reconinstruments.lispxml.module.settings"
xmlns:a="com.reconinstruments.lispxml.module.android">
       <a:get-battery-level/>
       <a:reboot>
       <a:scan-file>
       <a:scan-sdcard/>
       <a:send-broadcast>
       <a:start-activity>
       <a:uninstall>
       <io:cp>
       <io:log>
       <io:ls>
       <io:print>
       <io:rm>
       <io:unzip>
       <io:write-b64-to-file>
       <io:write-to-file>
       <m:i>
       <s:current-time-secs/>
       <s:get-int>
       <s:get-time-zone/>
       <s:set-int>
       <s:set-time>
       <s:set-time-zone>
</lispxml>

Below is a few complete XML from the ReconUplink_API.dll file. There is more occurences in the file but XML are constructed by code so they can't be extracted as comple XML.

XML:
<?xml version="1.0"?>
<lispxml xmlns:io="com.reconinstruments.lispxml.module.io"
xmlns:m="com.reconinstruments.lispxml.module.math"
xmlns:s="com.reconinstruments.lispxml.module.settings"
xmlns:a="com.reconinstruments.lispxml.module.android">
<!-- mv the recovery file -->
<io:cp><s>/cache/command_bak</s><s>/cache/recovery/command</s></io:cp>
<io:rm><s>/cache/command_bak</s></io:rm>
<!-- Remove installed packages -->
<io:rm><s>/storage/sdcard0/ReconApps/Installer/installed_packages.xml</s></io:rm>
<!-- reboot -->v<a:reboot><s>recovery</s></a:reboot>
</lispxml>

XML:
<?xml version="1.0" encoding="UTF-8"?>
<lispxml xmlns:io="com.reconinstruments.lispxml.module.io"
         xmlns:m="com.reconinstruments.lispxml.module.math"
         xmlns:s="com.reconinstruments.lispxml.module.settings"
         xmlns:a="com.reconinstruments.lispxml.module.android"
>
<a:start-activity>
<s>com.reconinstruments.systemui.uplink.UPLINK_IN_PROGRESS</s>
</a:start-activity>
<a:scan-sdcard/></lispxml>

XML:
<?xml version="1.0" encoding="UTF-8"?>
<lispxml xmlns:io="com.reconinstruments.lispxml.module.io"
         xmlns:m="com.reconinstruments.lispxml.module.math"
         xmlns:s="com.reconinstruments.lispxml.module.settings"
         xmlns:a="com.reconinstruments.lispxml.module.android"
>
<a:send-broadcast><s>com.reconinstruments.systemui.uplink.UPLINK_DONE</s></a:send-broadcast></lispxml>

XML:
<?xml version="1.0"?>
<lispxml xmlns:io="com.reconinstruments.lispxml.module.io"
xmlns:m="com.reconinstruments.lispxml.module.math"
xmlns:s="com.reconinstruments.lispxml.module.settings"
xmlns:a="com.reconinstruments.lispxml.module.android">
<s:get-int>
<s>com.reconinstruments.settings.PASSCODE_ENABLED</s>
<m:i>0</m:i>
</s:get-int>
</lispxml>

XML:
<?xml version="1.0"?>
<lispxml xmlns:io="com.reconinstruments.lispxml.module.io"
xmlns:m="com.reconinstruments.lispxml.module.math"
xmlns:s="com.reconinstruments.lispxml.module.settings"
xmlns:a="com.reconinstruments.lispxml.module.android">
<io:print><cat><a:get-battery-level /></cat></io:print>
</lispxml>
 
Last edited:

TristanLeBoss

Senior Member
Dec 11, 2005
186
155
I wonder if you could help me out again with a couple of files. Reading the intel documents, it says whilst Jets do have ADB set as a default, if its not, and you do not have a laucher loaded on it then!

"NOTE: If the device does not have a launcher on it and Settings cannot be accessed manually, a LispXML script can be used to enable USB Debugging. In this case, transfer an adb.lxl file to the Jet in the “ReconApps\Developer\LispXML\Input\” directory.Contact the Applications Engineering team for assistance with LispXML .

Both my Launcher and LIspXML folders are empty, could you have a look at your device and see if you have and files in LIspXML folder and the LAuncher folder. If you do cuould you send them.

many thanks for your help
jez
Can you share these documents?
 

slayerkaido

New member
Jul 29, 2021
1
0
Wow I just noticed that this picked back up from years ago, It just so Happens that I activated 1 of my recon Jets but unfortuantely I'm not as savvy at rooting as I would like to be, if someone still needs info from it all I need is a step by step guide on how to obtain what you need and I'll try to get it. I would really like to root my recon jet as there is soo much that can be done with them if they are freed from their software.
 

TristanLeBoss

Senior Member
Dec 11, 2005
186
155
I successfully made the Android app working.
I only had to make a few modifications:
- redirect the log output to logcat in EngageLogger.smali in order to see the error messages from the developpers
- remove HTTP2 from default protocols of OkHttpClient.smali because it's an old implementation and it was not compatible with actual implementation of my nginx server
- change the API server URL in EngageWebPaths$API_SERVER.smali
I emulated many API endpoints so they provide data to the app but I made no action... everything is read only. It would be time consuming to recode a real read/write API...
 

Top Liked Posts