Those ones I've tried and they don't work.... I'll try car launcher pro, I've tried another Activity Launcher to get past the lock screen, however i guess the necessary activity is not being started.
Tesla Style Headunits
- Thread starter Airwin13
- Start date
Those ones I've tried and they don't work.... I'll try car launcher pro, I've tried another Activity Launcher to get past the lock screen, however i guess the necessary activity is not being started.
Try 6681
Yes root is possible;
Try https://forum.xda-developers.com/an...to-root-klyde-kd-1280-tesla-headunit-t4035039
Hey guys need some help;
I believe I can fix a lot of bugs that are in this unit but I feel like i'm re-inventing the wheel here. Hoping I can benefit from your shared experience and expertise here.
I decompiled eventcenter.apk and added a few logging lines to a few methods so I can trace what happens when something in the car is triggered (steering wheel button, brake pressed, etc) all the way to the translated android action.
I thought I had it but something is not adding up.
My understanding is that hardware signals get picked up by the MCU which then communicates with android via EventCenter when eventservice opens the serial port. This is supported by the following code blocks;
where openSerialPort() is called on initSysEventState method and startProcessCmdThread calls a message handler on a loop and if it has data, calls processcmd()
Finally, processCmd just has a switch statement which determines which method to call based on the first numbers in the buffer array.
Based on this logic above I assumed I should be able to capture the direct MCU data by simply hooking onto the data sent to processCMD method before it decides what to do with it. To test this, I added a Log to the smali right at the beginning of that method which gives me the string formatted form of the bybuf array. However, the data sent to processCMD doesn't seem to make any sense when trying to relate it to physical events in the car.
For example, here is a portion of my logcat; during this time, I started by doing nothing then I pressed a couple of unassigned steering wheel buttons.
I can't seem to make sense of this stream especially since if I then assign that same steering wheel button via the settings app and then press it, i immediately get this in my logcat:
What am I missing here?
Does assigning an action to the steering wheel button somehow change the serial stream being sent by the MCU to EventCenter? or is the MCU communicating with some other method I haven't been able to find?
I believe I can fix a lot of bugs that are in this unit but I feel like i'm re-inventing the wheel here. Hoping I can benefit from your shared experience and expertise here.
I decompiled eventcenter.apk and added a few logging lines to a few methods so I can trace what happens when something in the car is triggered (steering wheel button, brake pressed, etc) all the way to the translated android action.
I thought I had it but something is not adding up.
My understanding is that hardware signals get picked up by the MCU which then communicates with android via EventCenter when eventservice opens the serial port. This is supported by the following code blocks;
Code:
public void openSerialPort() {
try {
if (this.msp == null) {
this.msp = new ZXWSerialPort();
this.msp.open(EventUtils.getMcuComDevicePath(), EventUtils.UART_DEV_SPEED);
startProcessCmdThread();
startReceiveThread();
startSendThread();
}
} catch (Exception e) {
e.printStackTrace();
}
}where openSerialPort() is called on initSysEventState method and startProcessCmdThread calls a message handler on a loop and if it has data, calls processcmd()
Code:
if (bybuf != null && bybuf.length > 0) {
try {
processCmd(bybuf);
} catch (Exception e) {
DebugLog.i(EventService.TAG, "processCmd error: " + e.toString());
}
}Finally, processCmd just has a switch statement which determines which method to call based on the first numbers in the buffer array.
Code:
private void processCmd(byte[] bydata) {
switch (bydata[0]) {
case Byte.MIN_VALUE:
onCmdFreqSelectEvt(bydata);
return;
case -127:
onCmdModePowerOnEvt(bydata);
return;
case -126:
onCmdDiscAutoInEvt(bydata);
return;
case -125:
onCmdSysRTCTimeEvt(bydata);
return;
case -122:
onCmd8825ValEvent(bydata);
return;
case -120:
OnCmdWheelState(bydata);
return;
case -115:
onCmdMcuIRRadarData(bydata);
return;
case -114:
onCmdMcu3DHData(bydata);
return;
case -108:
Intent intent = new Intent("com.szchoiceway.eventcenter.EventUtils.ACTION_MCU_8836_VALUE_EVENT");
intent.putExtra("EventUtils.MCU_8836_VALUE_DATA", bydata);
EventService.this.sendBroadcastAsUser(intent, UserHandle.ALL);
return;
case -107:
onCmdMcuHdmiResolutionData(bydata);
return;
case -95:
onCmdCarAirEvent(bydata);
return;
case -91:
onCmdCanEvent(bydata);
return;
case -90:
onCmdMcuATAData(bydata);
return;
case EventUtils.CARTYPE_U6_LO /*109*/:
onCmdMcuPlugInRadarData(bydata);
return;
case EventUtils.CARTYPE_SenyaR7_HI /*112*/:
onCmdModeAck(bydata);
return;
case EventUtils.CARTYPE_Kaluola_LO /*113*/:
onCmdSysEvent(bydata);
return;
case EventUtils.CARTYPE_Kaluola_HI /*114*/:
onCmdKeyEvent(bydata);
return;
case EventUtils.CARTYPE_Siyu2016_LO /*115*/:
onCmdRadioEvent(bydata);
return;
case 116:
onCmdWheelEvent(bydata);
return;
case 117:
onCmdTVEvent(bydata);
return;
case EventUtils.CARTYPE_SLS_HI /*118*/:
onCmdBMTVolEvent(bydata);
return;
case EventUtils.CARTYPE_2013EXPLORER_LO /*119*/:
onCmdEQEvent(bydata);
return;
case 120:
onCmdMuteEvent(bydata);
return;
case EventUtils.CARTYPE_CRIDER_LO /*121*/:
onCmdMainVolEvent(bydata);
return;
case EventUtils.CARTYPE_CRIDER_HI /*122*/:
onCmdBalanceEvent(bydata);
return;
case EventUtils.CARTYPE_BIAOZHI408_LO /*123*/:
onCmdLoudnessEvent(bydata);
return;
case EventUtils.CARTYPE_BIAOZHI408_HI /*124*/:
onCmdMcuInitEvent(bydata);
return;
case 126:
onCmdKeyADEvent(bydata);
return;
case Byte.MAX_VALUE:
onCmdUpgradeAck(bydata);
return;
default:
return;
}
}Based on this logic above I assumed I should be able to capture the direct MCU data by simply hooking onto the data sent to processCMD method before it decides what to do with it. To test this, I added a Log to the smali right at the beginning of that method which gives me the string formatted form of the bybuf array. However, the data sent to processCMD doesn't seem to make any sense when trying to relate it to physical events in the car.
For example, here is a portion of my logcat; during this time, I started by doing nothing then I pressed a couple of unassigned steering wheel buttons.
Code:
08-15 13:11:26.554 1167 1433 I EventService: onCmdMainVolEvent = 0x79 0x05 0x7e
08-15 13:11:26.570 1167 1433 I ProcessCMD: : 0x8e 0x20 0x03 0xc0 0xeb 0xc0 0x3d 0x9e
08-15 13:11:26.667 1167 1433 I ProcessCMD: : 0x8e 0x80 0x02 0xf0 0xeb 0x70 0x3d 0x5f
08-15 13:11:26.766 1167 1433 I ProcessCMD: : 0x8e 0x50 0x02 0xb0 0xeb 0x20 0x3c 0x20
08-15 13:11:26.868 1167 1433 I ProcessCMD: : 0x8e 0xd0 0x01 0xc0 0xeb 0x30 0x3d 0x80
08-15 13:11:26.967 1167 1433 I ProcessCMD: : 0x8e 0xc0 0x01 0xc0 0xeb 0xd0 0x3d 0xf0
08-15 13:11:27.067 1167 1433 I ProcessCMD: : 0x8e 0x00 0x02 0xc0 0xeb 0x10 0x3e 0x6e
08-15 13:11:27.166 1167 1433 I ProcessCMD: : 0x8e 0x70 0x02 0x10 0xec 0x40 0x3e 0x7d
08-15 13:11:27.267 1167 1433 I ProcessCMD: : 0x8e 0x70 0x02 0x00 0xec 0x20 0x3e 0xad
08-15 13:11:27.368 1167 1433 I ProcessCMD: : 0x8e 0x80 0x02 0xe0 0xeb 0xa0 0x3c 0x40
08-15 13:11:27.467 1167 1433 I ProcessCMD: : 0x8e 0x30 0x02 0x40 0xeb 0xe0 0x3c 0xf0
08-15 13:11:27.568 1167 1433 I ProcessCMD: : 0x8e 0x60 0x02 0x80 0xeb 0x20 0x3d 0x3f
08-15 13:11:27.667 1167 1433 I ProcessCMD: : 0x8e 0xd0 0x02 0x70 0xeb 0xc0 0x3d 0x3f
08-15 13:11:27.767 1167 1433 I ProcessCMD: : 0x8e 0x10 0x03 0x90 0xeb 0xd0 0x3d 0xce
08-15 13:11:27.868 1167 1433 I ProcessCMD: : 0x8e 0xb0 0x02 0x00 0xec 0xe0 0x3d 0xae
08-15 13:11:27.966 1167 1433 I ProcessCMD: : 0x8e 0x80 0x02 0xd0 0xeb 0x50 0x3c 0xa0
08-15 13:11:28.067 1167 1433 I ProcessCMD: : 0x8e 0x00 0x02 0x70 0xeb 0xd0 0x3c 0x00
08-15 13:11:28.166 1167 1433 I ProcessCMD: : 0x8e 0x10 0x02 0x90 0xeb 0x40 0x3c 0x60
08-15 13:11:28.267 1167 1433 I ProcessCMD: : 0x8e 0x10 0x02 0x90 0xeb 0xf0 0x3c 0xb0
08-15 13:11:28.368 1167 1433 I ProcessCMD: : 0x8e 0x70 0x02 0xc0 0xeb 0xc0 0x3c 0x50
08-15 13:11:28.466 1167 1433 I ProcessCMD: : 0x8e 0xa0 0x02 0xa0 0xeb 0xe0 0x3d 0x1f
08-15 13:11:28.567 1167 1433 I ProcessCMD: : 0x8e 0x70 0x02 0x90 0xeb 0xf0 0x3a 0x52
08-15 13:11:28.667 1167 1433 I ProcessCMD: : 0x8e 0xd0 0x02 0x70 0xeb 0x70 0x3a 0x92
08-15 13:11:28.767 1167 1433 I ProcessCMD: : 0x8e 0xf0 0x02 0x80 0xeb 0x20 0x39 0xb3
08-15 13:11:28.868 1167 1433 I ProcessCMD: : 0x8e 0xb0 0x02 0x60 0xeb 0x60 0x38 0xd4
08-15 13:11:28.967 1167 1433 I ProcessCMD: : 0x8e 0x70 0x03 0xb0 0xeb 0xe0 0x38 0x43
08-15 13:11:29.067 1167 1433 I ProcessCMD: : 0x8e 0x20 0x03 0xa0 0xeb 0xf0 0x39 0x92
08-15 13:11:29.167 1167 1433 I ProcessCMD: : 0x8e 0x50 0x03 0x00 0xec 0x10 0x39 0xe1
08-15 13:11:29.266 1167 1433 I ProcessCMD: : 0x8e 0x30 0x03 0x00 0xec 0xc0 0x38 0x52
08-15 13:11:29.369 1167 1433 I ProcessCMD: : 0x8e 0x00 0x03 0xd0 0xeb 0x00 0x38 0x73
08-15 13:11:29.369 1167 1433 I ProcessCMD: : 0x71 0x01 0x00 0x89
08-15 13:11:29.369 1167 1433 I EventService: onCmdSysEvent: 0x71 0x01 0x00 0x89
08-15 13:11:29.467 1167 1433 I ProcessCMD: : 0x8e 0xf0 0x02 0xd0 0xeb 0xc0 0x37 0xc5
08-15 13:11:29.567 1167 1433 I ProcessCMD: : 0x8e 0xd0 0x02 0x20 0xec 0xd0 0x37 0x84
08-15 13:11:29.667 1167 1433 I ProcessCMD: : 0x8e 0xe0 0x02 0x00 0xec 0x60 0x39 0x02
08-15 13:11:29.766 1167 1433 I ProcessCMD: : 0x8e 0x20 0x03 0x50 0xec 0x80 0x3a 0x50
08-15 13:11:29.868 1167 1433 I ProcessCMD: : 0x8e 0xe0 0x02 0x50 0xec 0x20 0x3b 0xf0
08-15 13:11:29.968 1167 1433 I ProcessCMD: : 0x8e 0xe0 0x02 0x20 0xec 0x30 0x3b 0x10
08-15 13:11:30.066 1167 1433 I ProcessCMD: : 0x8e 0xd0 0x02 0xf0 0xeb 0x60 0x3b 0x21
08-15 13:11:30.166 1167 1433 I ProcessCMD: : 0x8e 0x60 0x02 0x10 0xec 0x70 0x3b 0x60
08-15 13:11:30.266 1167 1433 I ProcessCMD: : 0x8e 0x80 0x02 0xf0 0xeb 0x40 0x3b 0x91
08-15 13:11:30.368 1167 1433 I ProcessCMD: : 0x8e 0x40 0x02 0xe0 0xeb 0x00 0x3d 0x1f
08-15 13:11:30.467 1167 1433 I ProcessCMD: : 0x8e 0x20 0x02 0x20 0xec 0x50 0x3d 0xae
08-15 13:11:30.567 1167 1433 I ProcessCMD: : 0x8e 0x30 0x02 0x20 0xec 0xe0 0x3d 0x0e
08-15 13:11:30.666 1167 1433 I ProcessCMD: : 0x8e 0x60 0x02 0x60 0xec 0xa0 0x3d 0xde
08-15 13:11:30.767 1167 1433 I ProcessCMD: : 0x8e 0x10 0x02 0x20 0xec 0xb0 0x3d 0x5e
08-15 13:11:30.868 1167 1433 I ProcessCMD: : 0x8e 0x10 0x02 0xe0 0xeb 0x50 0x3c 0x00
08-15 13:11:30.967 1167 1433 I ProcessCMD: : 0x8e 0xe0 0x01 0x90 0xeb 0x50 0x3d 0x80
08-15 13:11:31.067 1167 1433 I ProcessCMD: : 0x8e 0x40 0x02 0x20 0xec 0x60 0x3d 0x7e
08-15 13:11:31.167 1167 1433 I ProcessCMD: : 0x8e 0xa0 0x02 0xe0 0xeb 0x20 0x3e 0x9e
08-15 13:11:31.267 1167 1433 I ProcessCMD: : 0x8e 0x00 0x03 0xd0 0xeb 0xf0 0x3d 0x7e
08-15 13:11:31.368 1167 1433 I ProcessCMD: : 0x8e 0xe0 0x02 0xe0 0xeb 0xe0 0x3d 0x9f
08-15 13:11:31.467 1167 1433 I ProcessCMD: : 0x8e 0x70 0x02 0xc0 0xeb 0xa0 0x3c 0x70
08-15 13:11:31.567 1167 1433 I ProcessCMD: : 0x8e 0x10 0x02 0x60 0xeb 0x30 0x3d 0x9f
08-15 13:11:31.574 1167 4828 W libEGL : EGLNativeWindowType 0x77d8ee1010 disconnect failed
08-15 13:11:31.667 1167 1433 I ProcessCMD: : 0x8e 0x30 0x02 0xa0 0xeb 0x00 0x3d 0x6f
08-15 13:11:31.767 1167 1433 I ProcessCMD: : 0x8e 0x20 0x02 0x80 0xeb 0x00 0x3e 0x9e
08-15 13:11:31.868 1167 1433 I ProcessCMD: : 0x8e 0xa0 0x02 0xb0 0xeb 0xf0 0x3d 0xff
08-15 13:11:31.967 1167 1433 I ProcessCMD: : 0x8e 0x60 0x02 0xb0 0xeb 0x60 0x3e 0xce
08-15 13:11:32.067 1167 1433 I ProcessCMD: : 0x8e 0x60 0x02 0x80 0xeb 0x90 0x3c 0xd0
08-15 13:11:32.167 1167 1433 I ProcessCMD: : 0x8e 0x30 0x02 0x10 0xeb 0x00 0x3d 0xff
08-15 13:11:32.267 1167 1433 I ProcessCMD: : 0x8e 0x70 0x02 0x40 0xeb 0xe0 0x3c 0xb0
08-15 13:11:32.368 1167 1433 I ProcessCMD: : 0x8e 0x80 0x02 0x90 0xeb 0x10 0x3d 0x1f
08-15 13:11:32.467 1167 1433 I ProcessCMD: : 0x8e 0xe0 0x02 0xb0 0xeb 0xb0 0x3d 0xff
08-15 13:11:32.567 1167 1433 I ProcessCMD: : 0x8e 0x90 0x02 0x90 0xeb 0xd0 0x3d 0x4f
08-15 13:11:32.667 1167 1433 I ProcessCMD: : 0x8e 0x40 0x02 0x70 0xeb 0x10 0x3c 0x80
08-15 13:11:32.767 1167 1433 I ProcessCMD: : 0x8e 0xf0 0x01 0x70 0xeb 0xb0 0x3c 0x31
08-15 13:11:32.867 1167 1433 I ProcessCMD: : 0x8e 0x00 0x02 0xa0 0xeb 0x50 0x3c 0x50
08-15 13:11:32.967 1167 1433 I ProcessCMD: : 0x8e 0x00 0x02 0x80 0xeb 0xf0 0x3b 0xd1
08-15 13:11:33.067 1167 1433 I ProcessCMD: : 0x8e 0x60 0x02 0xe0 0xeb 0x40 0x3c 0xc0
08-15 13:11:33.167 1167 1433 I ProcessCMD: : 0x8e 0x70 0x02 0xd0 0xeb 0x70 0x3c 0x90
08-15 13:11:33.266 1167 1433 I ProcessCMD: : 0x8e 0x80 0x02 0xb0 0xeb 0x70 0x3b 0xa1
08-15 13:11:33.369 1167 1433 I ProcessCMD: : 0x8e 0x30 0x02 0x70 0xeb 0x10 0x3b 0x91
08-15 13:11:33.369 1167 1433 I ProcessCMD: : 0x71 0x01 0x00 0x89
08-15 13:11:33.369 1167 1433 I EventService: onCmdSysEvent: 0x71 0x01 0x00 0x89
08-15 13:11:33.467 1167 1433 I ProcessCMD: : 0x8e 0x70 0x02 0x60 0xeb 0xf0 0x3a 0x82
08-15 13:11:33.567 1167 1433 I ProcessCMD: : 0x8e 0xb0 0x02 0x20 0xeb 0x80 0x3a 0xf2
08-15 13:11:33.666 1167 1433 I ProcessCMD: : 0x8e 0x20 0x03 0x20 0xeb 0x20 0x3b 0xe0
08-15 13:11:33.766 1167 1433 I ProcessCMD: : 0x8e 0xf0 0x02 0x80 0xeb 0x00 0x3c 0xd0
08-15 13:11:33.868 1167 1433 I ProcessCMD: : 0x8e 0xd0 0x02 0xa0 0xeb 0x40 0x3a 0x92
08-15 13:11:33.967 1167 1433 I ProcessCMD: : 0x8e 0x90 0x02 0x40 0xeb 0xd0 0x3a 0xa2
08-15 13:11:34.067 1167 1433 I ProcessCMD: : 0x8e 0x50 0x02 0x40 0xeb 0xd0 0x3a 0xe2
08-15 13:11:34.167 1167 1433 I ProcessCMD: : 0x8e 0x00 0x02 0x70 0xeb 0xa0 0x3b 0x31
08-15 13:11:34.267 1167 1433 I ProcessCMD: : 0x8e 0x80 0x02 0x80 0xeb 0xe0 0x3b 0x61
08-15 13:11:34.368 1167 1433 I ProcessCMD: : 0x8e 0xa0 0x02 0x60 0xeb 0xa0 0x3c 0xa0
08-15 13:11:34.467 1167 1433 I ProcessCMD: : 0x8e 0xa0 0x02 0x50 0xeb 0xd0 0x3a 0x82
08-15 13:11:34.566 1167 1433 I ProcessCMD: : 0x8e 0xb0 0x02 0x30 0xeb 0x70 0x3b 0xf1
08-15 13:11:34.667 1167 1433 I ProcessCMD: : 0x8e 0xc0 0x02 0x30 0xeb 0xb0 0x3a 0xa2
08-15 13:11:34.766 1167 1433 I ProcessCMD: : 0x8e 0xc0 0x02 0x50 0xeb 0x90 0x3a 0xa2
08-15 13:11:34.868 1167 1433 I ProcessCMD: : 0x8e 0x10 0x03 0xb0 0xeb 0x70 0x3b 0x10
08-15 13:11:34.967 1167 1433 I ProcessCMD: : 0x8e 0xe0 0x02 0xa0 0xeb 0x80 0x3c 0x40
08-15 13:11:35.067 1167 1433 I ProcessCMD: : 0x8e 0xb0 0x02 0xc0 0xeb 0xf0 0x3a 0xe2
08-15 13:11:35.167 1167 1433 I ProcessCMD: : 0x8e 0x50 0x02 0xc0 0xeb 0x20 0x3b 0x11
08-15 13:11:35.267 1167 1433 I ProcessCMD: : 0x8e 0x00 0x02 0x70 0xeb 0xe0 0x3a 0xf2
08-15 13:11:35.368 1167 1433 I ProcessCMD: : 0x8e 0x50 0x02 0x90 0xeb 0xe0 0x3a 0x82
08-15 13:11:35.467 1167 1433 I ProcessCMD: : 0x8e 0xf0 0x02 0x30 0xec 0x50 0x3c 0xcf
08-15 13:11:35.567 1167 1433 I ProcessCMD: : 0x8e 0xc0 0x02 0x00 0xec 0xe0 0x3c 0x9f
08-15 13:11:35.667 1167 1433 I ProcessCMD: : 0x8e 0xd0 0x02 0x10 0xec 0x00 0x3c 0x5f
08-15 13:11:35.766 1167 1433 I ProcessCMD: : 0x8e 0x90 0x02 0xa0 0xeb 0xf0 0x3b 0x21
08-15 13:11:35.868 1167 1433 I ProcessCMD: : 0x8e 0x90 0x02 0x90 0xeb 0xb0 0x3c 0x70
08-15 13:11:35.967 1167 1433 I ProcessCMD: : 0x8e 0xc0 0x02 0x50 0xeb 0xf0 0x3c 0x40
08-15 13:11:36.067 1167 1433 I ProcessCMD: : 0x8e 0xd0 0x02 0xc0 0xeb 0x90 0x3d 0x1f
08-15 13:11:36.166 1167 1433 I ProcessCMD: : 0x8e 0xd0 0x02 0x00 0xec 0xd0 0x3d 0x9e
08-15 13:11:36.267 1167 1433 I ProcessCMD: : 0x8e 0x90 0x02 0x10 0xec 0x90 0x3c 0x0f
08-15 13:11:36.368 1167 1433 I ProcessCMD: : 0x8e 0xf0 0x01 0x70 0xeb 0xf0 0x3c 0xf1
08-15 13:11:36.466 1167 1433 I ProcessCMD: : 0x8e 0xd0 0x01 0xb0 0xeb 0xe0 0x3c 0xe1
08-15 13:11:36.567 1167 1433 I ProcessCMD: : 0x8e 0x10 0x02 0x90 0xeb 0xa0 0x3d 0xff
08-15 13:11:36.667 1167 1433 I ProcessCMD: : 0x8e 0xa0 0x02 0x80 0xeb 0xf0 0x3d 0x2f
08-15 13:11:36.766 1167 1433 I ProcessCMD: : 0x8e 0xa0 0x02 0xe0 0xeb 0x30 0x3f 0x8d
08-15 13:11:36.868 1167 1433 I ProcessCMD: : 0x8e 0xa0 0x01 0xb0 0xeb 0x00 0x3e 0xefI can't seem to make sense of this stream especially since if I then assign that same steering wheel button via the settings app and then press it, i immediately get this in my logcat:
Code:
08-15 13:11:26.239 1167 1433 I ProcessCMD: : 0x72 0x12 0x78
08-15 13:11:26.242 1167 1433 I ProcessCMD: : 0x79 0x04 0x7f
08-15 13:11:26.242 1167 1433 I EventService: onCmdMainVolEvent = 0x79 0x04 0x7fWhat am I missing here?
Does assigning an action to the steering wheel button somehow change the serial stream being sent by the MCU to EventCenter? or is the MCU communicating with some other method I haven't been able to find?
Thanks, I'll try.
Regarding your reverse engineering, I'm new to the Unit, I've done android application development as an amateur. So my experience is very limited.
Regarding:
Code:
08-15 13:11:26.239 1167 1433 I ProcessCMD: : 0x72 0x12 0x78
08-15 13:11:26.242 1167 1433 I ProcessCMD: : 0x79 0x04 0x7fThose HEX values translate to
Code:
rx
yLooking at the code, I think your assumptions are correct and the communication is: car's CAN Bus (messages and whatnot) -> MCU decodes CAN messages -> Sends Events to Android via this Serial Connection.
However, how exactly the original developers implemented the MCU <-> Android communication is a wild guess (just bytes, which are mapped somewhere to specific logic (that not might even not be described except in code comments/outside documentation slicing parts of the original CAN messages and sending them to Android, strings from the values, etc..). I guess you'd need to identify first one consistent event that you can get always the same output in logcat (for example for volume up and after that for volume down), and then compare the values to see what is the difference in bytes.
I'm not a developer, more of a troubleshooter. This is as deep as I got when attempting to figure out commands to send to make my own custom buttons with Automagic. Probably won't help but maybe?
https://forum.xda-developers.com/showthread.php?p=80393727
Sent from my HTC U11 using Tapatalk
Hello, friends. Can you tell me how to determine if I have a real android 9 and what kind of firmware is needed for my device?
Tesla style KLUDE KD 12108
MCUVer - RL7Ac_KLD9M_dsp_F028 - BNR CY V509-11
FrameworkVer - rk3399-userdebug9PQ2A.190305.002
eng.work2.20200509.195418 test-keys
OSVer - 9 Sat May 9 11:12:56 CST 2020
APPVer - 20200515-1024*768 - 960-kld
Nandflash - 64,00G
RAM - 3G/4G
BTVer - SD_carplay_I2S_20200306_sdk1.6
Thanks
Tesla style KLUDE KD 12108
MCUVer - RL7Ac_KLD9M_dsp_F028 - BNR CY V509-11
FrameworkVer - rk3399-userdebug9PQ2A.190305.002
eng.work2.20200509.195418 test-keys
OSVer - 9 Sat May 9 11:12:56 CST 2020
APPVer - 20200515-1024*768 - 960-kld
Nandflash - 64,00G
RAM - 3G/4G
BTVer - SD_carplay_I2S_20200306_sdk1.6
Thanks
That's unfortunate, I have sent mine back (but this was relating to another matter, the HDMI output was not working - faulty hw it seems) and they will be shipping me a new device. I did however get about a week to play with it before sending back, and my audio/sound was actually really great (my unit used the 'new' DSP system they talk about and also it had a direct output to my Factory JBL Amp so that may have been where the sound was better). Bluetooth audio I did not have an issue (I do not use android auto or carplay).
As for password, this is also dependant on your "customer number", if you copy over the customer.xml file from your HU, and check what "CustomerNum" it is set to, it is a different password for certain customer numbers. The APK to copy over to decompile is NaviSettings.apk (not Settings.apk - thats the Google/Android settings app - NaviSettings is the HU 3rd party settings app). After extracting NaviSettings.apk and decompiling the classes.dex using dex2jar (or similar) open up the JAR file in jd-gui and then go into "com > szchoiceway > settings > FragmentSysSet.class" or "FragmentAdvancedSet.class" and in those classes I found a "boolean isValidUserFreq()" function, and it listed out a number of password entrys throughout the byte code under the "ldc" or "ldc_w" entries - and I believe dependant on which CustomerNum you are, only one of those codes is valid (I didnt really look to see where it determined which customer number was what passcode, but it's probably coded in there somewhere, I just got all the passes and tried them until one worked).
Here are the possible passwords listed in my apk from my unit, my passwords were 8861 and 1688 I believe..
FragmentSysSet.class: (I believe this is the Long-press password in the System info page to get Factory Settings):
8861
1799
666888
1680
8888
3377
FragmentAdvancedSet.class (This is either Advanced menu or Install Set menu, depending on what your vendor/warehouse has set this name to in Settings):
8861
1688
666888
126
1680
9300
8888
3377
i'd like to buy one of these head unit for my chevy cruze, i can find x86 4/64 gb for 250 euros...is it a good price?
px6 model is way more expensive...is there any reasonable difference?
what product should i buy also considering support?
thx
px6 model is way more expensive...is there any reasonable difference?
what product should i buy also considering support?
thx
This maybe a biased opinion but as of right now I cannot recommend you buy this model unfortunately..
I really would have liked to be able to recommend as the 12.8 inch screen is gorgeous but it's so full of bugs it's not worth it for me-- and I'm a modder/developer.
I'm looking into other units at the moment. I will let you know if any come out good .
Before this I was using an xtrons px5 10.1 inch which was fantastic. I got tired of it however and am looking for a new one.
Hope that helps!
are you talking about the px6 or intel version..or both?
because i can also find px5 units (not tesla style) for my car
Sorry;
I'm specifically referring to the PX6 Tesla style headunit talked about in this thread which uses rockchip chipset.
The px5 models are fine in my opinion and so are a lot of the PX6 models (my experience is with the MTC headunits)
I have never tried an Intel seicane unit yet but I just ordered one from joying.
Can let you know how I feel about it after I try it out
ok...i think i'll give a chance to the intel i found, i'll report my impressions...
Hey guys I need some help and was recommended to go here.
I recently bought and installed a new Phoenix Auto PX6 10.4” radio. It installed fine and worked properly for about 5 days. The issue I initially started having was that the head unit would not turn off with my vehicle, normally when I shut the vehicle off the music would stop and then when I opened my door the unit would turn off, this was no longer happening. Unfortunately I was at work so I could not do any real troubleshooting, so I had to disconnect my battery or it would’ve died while I was at work. NOW the head unit will not turn on at all. It started happening a first time where I would start the truck and it wouldn’t turn on or boot, finally it did, so I figured it got the kinks worked out. After the weekend I started my truck up for work and NOTHING again. Since then whenever I start the truck the boot screen will briefly flicker and the unit will seemingly turn back off. And I will sometimes get a random car play connection to my iPhone, but the screen is off and I don’t have any control over A/C, radio, volume, literally nothing. And I live in Texas so it’s pretty damn hot. And help or recommendations would be appreciated!! Also I have already verified fuses, connections, and attempted reset button on head unit. Thanks!
---------- Post added at 06:49 PM ---------- Previous post was at 06:04 PM ----------
I recently bought and installed a new Phoenix Auto PX6 10.4” radio. It installed fine and worked properly for about 5 days. The issue I initially started having was that the head unit would not turn off with my vehicle, normally when I shut the vehicle off the music would stop and then when I opened my door the unit would turn off, this was no longer happening. Unfortunately I was at work so I could not do any real troubleshooting, so I had to disconnect my battery or it would’ve died while I was at work. NOW the head unit will not turn on at all. It started happening a first time where I would start the truck and it wouldn’t turn on or boot, finally it did, so I figured it got the kinks worked out. After the weekend I started my truck up for work and NOTHING again. Since then whenever I start the truck the boot screen will briefly flicker and the unit will seemingly turn back off. And I will sometimes get a random car play connection to my iPhone, but the screen is off and I don’t have any control over A/C, radio, volume, literally nothing. And I live in Texas so it’s pretty damn hot. And help or recommendations would be appreciated!! Also I have already verified fuses, connections, and attempted reset button on head unit. Thanks!
---------- Post added at 06:49 PM ---------- Previous post was at 06:04 PM ----------
Quick update, the unit finally booted up, not that I did anything, just randomly started up. Any suggestions while it’s working would be great, along with help while it isn’t working. Thanks!
It looks like more a hardware issue to me. Unless you have an app causing an issue. Have you made sure the harness to the unit and all the connections are tight? Did you reset the unit? If everything seems to be ok after double checking and you still have issues, I will suggest you request a replacement and/or refund as it might be hardware related and the unit might be defective.
Sent from my ONEPLUS A6013 using Tapatalk
Last edited:
Hey Lewis, are you the same guy for my YouTube channel? Don't be fooled by the name @Mr. Clown is a smart guy. LOL. That's what I was thinking to.... hardware problem.
Is this in a RAM?
If so, you might want to try our specific RAM thread in the Rams forum.
https://www.ramforum.com/threads/tesla-style-10-4-android-radio-information.115875/page-291
Sent from my Pixel 2 XL using Tapatalk
Mr. Clown,
I have already ensured that the connections are tight and reset the unit already. Are there any apps that you may have heard of that may cause issues? I have already sent out a request for replacement but no response from the seller. Thank you.
---------- Post added at 02:39 AM ---------- Previous post was at 02:34 AM ----------
Big_daddys_house,
Yes I’m the same guy lol. It’s been weird, it started working and booting up again the last few times I tried, just worried about it happening again with this unit. It’s the PX6 10.4” unit, it’s installed in my 2013 Ram 1500 Sport. Thanks!
Well if you did that already, then the unit must be defective. Sometimes my PX3 from Phoenix freeze out, becoming somewhat unresponsive not near what you are experiencing though, but with a factory reset fixes everything.
Sent from my ONEPLUS A6013 using Tapatalk
Mr. Clown,
I’ll trying running a factory reset again while it is working... if it keeps working, and see if it has any positive long term effect. Thanks for your insight, I’ll keep y’all updated if anything happens, I feel like most of my trouble will be communication with Phoenix Auto, so fingers crossed.
Yep, Phoenix sucks on customer service. Call them instead..but like a serious stalker..that worked for me sometime ago[emoji23]
Sent from my ONEPLUS A6013 using Tapatalk
Another thing to note about Phoenix, (I've never bought a stereo from them but) things I've read in the various forms, they don't keep new units in stock (AKA ready to sell units in the states) so when you ordered your unit and if you got it faster than a month, it probably was a return that they had in their local stock and was reselling. Just something to note if you received your unit faster than 30 days.
Sent from my Pixel 2 XL using Tapatalk
Similar threads
Top Liked Posts
-
There are no posts matching your filters.
-
3
You have already the most fresh firmware (april 2019). You can google about using ADB wifi to get root for your device. But You need to know theme numbers to add to customer.xml for selection. Or You can download Phoenix Radio stock firmware with unlocked themes. Also You can buy custom firmware with unlocked themes and more features.
Make your choice
3I've been working on my 7.1.1 HU to get it to look and work how I like it but without using 3rd party software.
This keeps it as fast and slick as possible... boots instantly from sleep with radio or music playing before I've started the engine.
It uses a page of the top bar for 'what's playing' and GPS speed even when using maps or whatever. You can still scroll left<>right to bring up the shortcut icons as normal.
Also changed the Radio to show the station name in large rather than frequency (which is now in the top bar)
Big thanks to ShIvADeSt for the help on the top bar programming :good::good:3For completeness, I'll show you the images ive changed on my unit, and list the mods done so far.
1) Changed the stereos 'boot screen' to the attached BootScreen.jpg
2) Changed the stereos 'home screen logo' to the attached ZXWLOGO.png
3) Modified EventCenter.apk to fix multiple typos and spelling/grammar mistakes
4) Modified MusicPlayer.apk to remove 'Lyrics', make a single colour, fix some spelling/grammar mistakes, enlarge font sizes, change font colours, change player control buttons and their positions
5) Currently trying to work on editing the TPMS app, but having issues when trying to install/update it after the mods.
PS: If you want to have a go at the modded MusicPlayer, you can checkout the git repo I setup, and build it using apktool
https://bitbucket.org/wishie/musicplayer-tesla-style-android-car-stereo/src/master/32There are some small updates.
First: Rooting via Kingroot is possible.
Second: I've managed to get the SystemApps and found the Bundle ID's com.choiceway for the launcher and com.szchoiceway for other apps like radio. But google it, did not bring any results
Further I was able to decompile the settings APK and extract all factory Pin codes. For now, I won't post it public, to keep the risk that the manufacturer maybe changes them, as low as possible. But if you are interested in them, you can PM me anytime. If interest is increasing, I will post them here of course.
New posts
-
-
Enable Galaxy TAB S7/S7+ 4K resolution (Using ADB)- Latest: Stryker_Echo9er
Our Apps
Get our official app!
The best way to access XDA on your phone
Nav Gestures
Add swipe gestures to any Android
One Handed Mode
Eases uses one hand with your phone