• Introducing XDA Computing: Discussion zones for Hardware, Software, and more!    Check it out!

Tesla Style Headunits

Search This thread

homer.ali

Senior Member
Jan 17, 2011
59
28
OnePlus 7 Pro
Hello All,

after long deliberations I've finally made the jump to one of those units and to be honest so far it's been a great disappointment, as mainly the sound and bluetooth are utter crap. I'm still considering whether not to return the unit or try to look for a partial refund (30 days since puchase).*

it's a PX6/4GB RAM/64GB ROM with RL78 MCU, Android Pie 9. Don't have root (is it possible to root it all?)

Copied over EventCenter.Apk and Settings.apk, but I cannot understand how to extract the password for the factory settings... @ramathorn1982 or @ShIvADeSt as you appear to be the most knowledgable, can you please give some hints how to proceed ?

Try 6681
Yes root is possible;
Try https://forum.xda-developers.com/an...to-root-klyde-kd-1280-tesla-headunit-t4035039
 

homer.ali

Senior Member
Jan 17, 2011
59
28
OnePlus 7 Pro
Hey guys need some help;

I believe I can fix a lot of bugs that are in this unit but I feel like i'm re-inventing the wheel here. Hoping I can benefit from your shared experience and expertise here.

I decompiled eventcenter.apk and added a few logging lines to a few methods so I can trace what happens when something in the car is triggered (steering wheel button, brake pressed, etc) all the way to the translated android action.

I thought I had it but something is not adding up.

My understanding is that hardware signals get picked up by the MCU which then communicates with android via EventCenter when eventservice opens the serial port. This is supported by the following code blocks;

Code:
    public void openSerialPort() {
        try {
            if (this.msp == null) {
                this.msp = new ZXWSerialPort();
                this.msp.open(EventUtils.getMcuComDevicePath(), EventUtils.UART_DEV_SPEED);
                startProcessCmdThread();
                startReceiveThread();
                startSendThread();
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

where openSerialPort() is called on initSysEventState method and startProcessCmdThread calls a message handler on a loop and if it has data, calls processcmd()

Code:
if (bybuf != null && bybuf.length > 0) {
          try {
                processCmd(bybuf);
           } catch (Exception e) {
                DebugLog.i(EventService.TAG, "processCmd error: " + e.toString());
           }
 }

Finally, processCmd just has a switch statement which determines which method to call based on the first numbers in the buffer array.

Code:
private void processCmd(byte[] bydata) {
                            switch (bydata[0]) {
                                case Byte.MIN_VALUE:
                                    onCmdFreqSelectEvt(bydata);
                                    return;
                                case -127:
                                    onCmdModePowerOnEvt(bydata);
                                    return;
                                case -126:
                                    onCmdDiscAutoInEvt(bydata);
                                    return;
                                    
                                case -125:
                                    onCmdSysRTCTimeEvt(bydata);
                                    return;
                                case -122:
                                    onCmd8825ValEvent(bydata);
                                    return;
                                case -120:
                                    OnCmdWheelState(bydata);
                                    return;
                                case -115:
                                    onCmdMcuIRRadarData(bydata);
                                    return;
                                case -114:
                                    onCmdMcu3DHData(bydata);
                                    return;
                                case -108:
                                    Intent intent = new Intent("com.szchoiceway.eventcenter.EventUtils.ACTION_MCU_8836_VALUE_EVENT");
                                    intent.putExtra("EventUtils.MCU_8836_VALUE_DATA", bydata);
                                    EventService.this.sendBroadcastAsUser(intent, UserHandle.ALL);
                                    return;
                                case -107:
                                    onCmdMcuHdmiResolutionData(bydata);
                                    return;
                                case -95:
                                    onCmdCarAirEvent(bydata);
                                    return;
                                case -91:
                                    onCmdCanEvent(bydata);
                                    return;
                                case -90:
                                    onCmdMcuATAData(bydata);
                                    return;
                                case EventUtils.CARTYPE_U6_LO /*109*/:
                                    onCmdMcuPlugInRadarData(bydata);
                                    return;
                                case EventUtils.CARTYPE_SenyaR7_HI /*112*/:
                                    onCmdModeAck(bydata);
                                    return;
                                case EventUtils.CARTYPE_Kaluola_LO /*113*/:
                                    onCmdSysEvent(bydata);
                                    return;
                                case EventUtils.CARTYPE_Kaluola_HI /*114*/:
                                    onCmdKeyEvent(bydata);
                                    return;
                                case EventUtils.CARTYPE_Siyu2016_LO /*115*/:
                                    onCmdRadioEvent(bydata);
                                    return;
                                case 116:
                                    onCmdWheelEvent(bydata);
                                    return;
                                case 117:
                                    onCmdTVEvent(bydata);
                                    return;
                                case EventUtils.CARTYPE_SLS_HI /*118*/:
                                    onCmdBMTVolEvent(bydata);
                                    return;
                                case EventUtils.CARTYPE_2013EXPLORER_LO /*119*/:
                                    onCmdEQEvent(bydata);
                                    return;
                                case 120:
                                    onCmdMuteEvent(bydata);
                                    return;
                                case EventUtils.CARTYPE_CRIDER_LO /*121*/:
                                    onCmdMainVolEvent(bydata);
                                    return;
                                case EventUtils.CARTYPE_CRIDER_HI /*122*/:
                                    onCmdBalanceEvent(bydata);
                                    return;
                                case EventUtils.CARTYPE_BIAOZHI408_LO /*123*/:
                                    onCmdLoudnessEvent(bydata);
                                    return;
                                case EventUtils.CARTYPE_BIAOZHI408_HI /*124*/:
                                    onCmdMcuInitEvent(bydata);
                                    return;
                                case 126:
                                    onCmdKeyADEvent(bydata);
                                    return;
                                case Byte.MAX_VALUE:
                                    onCmdUpgradeAck(bydata);
                                    return;
                                default:
                                    return;
                            }
                        }

Based on this logic above I assumed I should be able to capture the direct MCU data by simply hooking onto the data sent to processCMD method before it decides what to do with it. To test this, I added a Log to the smali right at the beginning of that method which gives me the string formatted form of the bybuf array. However, the data sent to processCMD doesn't seem to make any sense when trying to relate it to physical events in the car.

For example, here is a portion of my logcat; during this time, I started by doing nothing then I pressed a couple of unassigned steering wheel buttons.

Code:
08-15 13:11:26.554  1167  1433 I EventService: onCmdMainVolEvent = 0x79 0x05 0x7e
08-15 13:11:26.570  1167  1433 I ProcessCMD: : 0x8e 0x20 0x03 0xc0 0xeb 0xc0 0x3d 0x9e
08-15 13:11:26.667  1167  1433 I ProcessCMD: : 0x8e 0x80 0x02 0xf0 0xeb 0x70 0x3d 0x5f
08-15 13:11:26.766  1167  1433 I ProcessCMD: : 0x8e 0x50 0x02 0xb0 0xeb 0x20 0x3c 0x20
08-15 13:11:26.868  1167  1433 I ProcessCMD: : 0x8e 0xd0 0x01 0xc0 0xeb 0x30 0x3d 0x80
08-15 13:11:26.967  1167  1433 I ProcessCMD: : 0x8e 0xc0 0x01 0xc0 0xeb 0xd0 0x3d 0xf0
08-15 13:11:27.067  1167  1433 I ProcessCMD: : 0x8e 0x00 0x02 0xc0 0xeb 0x10 0x3e 0x6e
08-15 13:11:27.166  1167  1433 I ProcessCMD: : 0x8e 0x70 0x02 0x10 0xec 0x40 0x3e 0x7d
08-15 13:11:27.267  1167  1433 I ProcessCMD: : 0x8e 0x70 0x02 0x00 0xec 0x20 0x3e 0xad
08-15 13:11:27.368  1167  1433 I ProcessCMD: : 0x8e 0x80 0x02 0xe0 0xeb 0xa0 0x3c 0x40
08-15 13:11:27.467  1167  1433 I ProcessCMD: : 0x8e 0x30 0x02 0x40 0xeb 0xe0 0x3c 0xf0
08-15 13:11:27.568  1167  1433 I ProcessCMD: : 0x8e 0x60 0x02 0x80 0xeb 0x20 0x3d 0x3f
08-15 13:11:27.667  1167  1433 I ProcessCMD: : 0x8e 0xd0 0x02 0x70 0xeb 0xc0 0x3d 0x3f
08-15 13:11:27.767  1167  1433 I ProcessCMD: : 0x8e 0x10 0x03 0x90 0xeb 0xd0 0x3d 0xce
08-15 13:11:27.868  1167  1433 I ProcessCMD: : 0x8e 0xb0 0x02 0x00 0xec 0xe0 0x3d 0xae
08-15 13:11:27.966  1167  1433 I ProcessCMD: : 0x8e 0x80 0x02 0xd0 0xeb 0x50 0x3c 0xa0
08-15 13:11:28.067  1167  1433 I ProcessCMD: : 0x8e 0x00 0x02 0x70 0xeb 0xd0 0x3c 0x00
08-15 13:11:28.166  1167  1433 I ProcessCMD: : 0x8e 0x10 0x02 0x90 0xeb 0x40 0x3c 0x60
08-15 13:11:28.267  1167  1433 I ProcessCMD: : 0x8e 0x10 0x02 0x90 0xeb 0xf0 0x3c 0xb0
08-15 13:11:28.368  1167  1433 I ProcessCMD: : 0x8e 0x70 0x02 0xc0 0xeb 0xc0 0x3c 0x50
08-15 13:11:28.466  1167  1433 I ProcessCMD: : 0x8e 0xa0 0x02 0xa0 0xeb 0xe0 0x3d 0x1f
08-15 13:11:28.567  1167  1433 I ProcessCMD: : 0x8e 0x70 0x02 0x90 0xeb 0xf0 0x3a 0x52
08-15 13:11:28.667  1167  1433 I ProcessCMD: : 0x8e 0xd0 0x02 0x70 0xeb 0x70 0x3a 0x92
08-15 13:11:28.767  1167  1433 I ProcessCMD: : 0x8e 0xf0 0x02 0x80 0xeb 0x20 0x39 0xb3
08-15 13:11:28.868  1167  1433 I ProcessCMD: : 0x8e 0xb0 0x02 0x60 0xeb 0x60 0x38 0xd4
08-15 13:11:28.967  1167  1433 I ProcessCMD: : 0x8e 0x70 0x03 0xb0 0xeb 0xe0 0x38 0x43
08-15 13:11:29.067  1167  1433 I ProcessCMD: : 0x8e 0x20 0x03 0xa0 0xeb 0xf0 0x39 0x92
08-15 13:11:29.167  1167  1433 I ProcessCMD: : 0x8e 0x50 0x03 0x00 0xec 0x10 0x39 0xe1
08-15 13:11:29.266  1167  1433 I ProcessCMD: : 0x8e 0x30 0x03 0x00 0xec 0xc0 0x38 0x52
08-15 13:11:29.369  1167  1433 I ProcessCMD: : 0x8e 0x00 0x03 0xd0 0xeb 0x00 0x38 0x73
08-15 13:11:29.369  1167  1433 I ProcessCMD: : 0x71 0x01 0x00 0x89
08-15 13:11:29.369  1167  1433 I EventService: onCmdSysEvent: 0x71 0x01 0x00 0x89
08-15 13:11:29.467  1167  1433 I ProcessCMD: : 0x8e 0xf0 0x02 0xd0 0xeb 0xc0 0x37 0xc5
08-15 13:11:29.567  1167  1433 I ProcessCMD: : 0x8e 0xd0 0x02 0x20 0xec 0xd0 0x37 0x84
08-15 13:11:29.667  1167  1433 I ProcessCMD: : 0x8e 0xe0 0x02 0x00 0xec 0x60 0x39 0x02
08-15 13:11:29.766  1167  1433 I ProcessCMD: : 0x8e 0x20 0x03 0x50 0xec 0x80 0x3a 0x50
08-15 13:11:29.868  1167  1433 I ProcessCMD: : 0x8e 0xe0 0x02 0x50 0xec 0x20 0x3b 0xf0
08-15 13:11:29.968  1167  1433 I ProcessCMD: : 0x8e 0xe0 0x02 0x20 0xec 0x30 0x3b 0x10
08-15 13:11:30.066  1167  1433 I ProcessCMD: : 0x8e 0xd0 0x02 0xf0 0xeb 0x60 0x3b 0x21
08-15 13:11:30.166  1167  1433 I ProcessCMD: : 0x8e 0x60 0x02 0x10 0xec 0x70 0x3b 0x60
08-15 13:11:30.266  1167  1433 I ProcessCMD: : 0x8e 0x80 0x02 0xf0 0xeb 0x40 0x3b 0x91
08-15 13:11:30.368  1167  1433 I ProcessCMD: : 0x8e 0x40 0x02 0xe0 0xeb 0x00 0x3d 0x1f
08-15 13:11:30.467  1167  1433 I ProcessCMD: : 0x8e 0x20 0x02 0x20 0xec 0x50 0x3d 0xae
08-15 13:11:30.567  1167  1433 I ProcessCMD: : 0x8e 0x30 0x02 0x20 0xec 0xe0 0x3d 0x0e
08-15 13:11:30.666  1167  1433 I ProcessCMD: : 0x8e 0x60 0x02 0x60 0xec 0xa0 0x3d 0xde
08-15 13:11:30.767  1167  1433 I ProcessCMD: : 0x8e 0x10 0x02 0x20 0xec 0xb0 0x3d 0x5e
08-15 13:11:30.868  1167  1433 I ProcessCMD: : 0x8e 0x10 0x02 0xe0 0xeb 0x50 0x3c 0x00
08-15 13:11:30.967  1167  1433 I ProcessCMD: : 0x8e 0xe0 0x01 0x90 0xeb 0x50 0x3d 0x80
08-15 13:11:31.067  1167  1433 I ProcessCMD: : 0x8e 0x40 0x02 0x20 0xec 0x60 0x3d 0x7e
08-15 13:11:31.167  1167  1433 I ProcessCMD: : 0x8e 0xa0 0x02 0xe0 0xeb 0x20 0x3e 0x9e
08-15 13:11:31.267  1167  1433 I ProcessCMD: : 0x8e 0x00 0x03 0xd0 0xeb 0xf0 0x3d 0x7e
08-15 13:11:31.368  1167  1433 I ProcessCMD: : 0x8e 0xe0 0x02 0xe0 0xeb 0xe0 0x3d 0x9f
08-15 13:11:31.467  1167  1433 I ProcessCMD: : 0x8e 0x70 0x02 0xc0 0xeb 0xa0 0x3c 0x70
08-15 13:11:31.567  1167  1433 I ProcessCMD: : 0x8e 0x10 0x02 0x60 0xeb 0x30 0x3d 0x9f
08-15 13:11:31.574  1167  4828 W libEGL  : EGLNativeWindowType 0x77d8ee1010 disconnect failed
08-15 13:11:31.667  1167  1433 I ProcessCMD: : 0x8e 0x30 0x02 0xa0 0xeb 0x00 0x3d 0x6f
08-15 13:11:31.767  1167  1433 I ProcessCMD: : 0x8e 0x20 0x02 0x80 0xeb 0x00 0x3e 0x9e
08-15 13:11:31.868  1167  1433 I ProcessCMD: : 0x8e 0xa0 0x02 0xb0 0xeb 0xf0 0x3d 0xff
08-15 13:11:31.967  1167  1433 I ProcessCMD: : 0x8e 0x60 0x02 0xb0 0xeb 0x60 0x3e 0xce
08-15 13:11:32.067  1167  1433 I ProcessCMD: : 0x8e 0x60 0x02 0x80 0xeb 0x90 0x3c 0xd0
08-15 13:11:32.167  1167  1433 I ProcessCMD: : 0x8e 0x30 0x02 0x10 0xeb 0x00 0x3d 0xff
08-15 13:11:32.267  1167  1433 I ProcessCMD: : 0x8e 0x70 0x02 0x40 0xeb 0xe0 0x3c 0xb0
08-15 13:11:32.368  1167  1433 I ProcessCMD: : 0x8e 0x80 0x02 0x90 0xeb 0x10 0x3d 0x1f
08-15 13:11:32.467  1167  1433 I ProcessCMD: : 0x8e 0xe0 0x02 0xb0 0xeb 0xb0 0x3d 0xff
08-15 13:11:32.567  1167  1433 I ProcessCMD: : 0x8e 0x90 0x02 0x90 0xeb 0xd0 0x3d 0x4f
08-15 13:11:32.667  1167  1433 I ProcessCMD: : 0x8e 0x40 0x02 0x70 0xeb 0x10 0x3c 0x80
08-15 13:11:32.767  1167  1433 I ProcessCMD: : 0x8e 0xf0 0x01 0x70 0xeb 0xb0 0x3c 0x31
08-15 13:11:32.867  1167  1433 I ProcessCMD: : 0x8e 0x00 0x02 0xa0 0xeb 0x50 0x3c 0x50
08-15 13:11:32.967  1167  1433 I ProcessCMD: : 0x8e 0x00 0x02 0x80 0xeb 0xf0 0x3b 0xd1
08-15 13:11:33.067  1167  1433 I ProcessCMD: : 0x8e 0x60 0x02 0xe0 0xeb 0x40 0x3c 0xc0
08-15 13:11:33.167  1167  1433 I ProcessCMD: : 0x8e 0x70 0x02 0xd0 0xeb 0x70 0x3c 0x90
08-15 13:11:33.266  1167  1433 I ProcessCMD: : 0x8e 0x80 0x02 0xb0 0xeb 0x70 0x3b 0xa1
08-15 13:11:33.369  1167  1433 I ProcessCMD: : 0x8e 0x30 0x02 0x70 0xeb 0x10 0x3b 0x91
08-15 13:11:33.369  1167  1433 I ProcessCMD: : 0x71 0x01 0x00 0x89
08-15 13:11:33.369  1167  1433 I EventService: onCmdSysEvent: 0x71 0x01 0x00 0x89
08-15 13:11:33.467  1167  1433 I ProcessCMD: : 0x8e 0x70 0x02 0x60 0xeb 0xf0 0x3a 0x82
08-15 13:11:33.567  1167  1433 I ProcessCMD: : 0x8e 0xb0 0x02 0x20 0xeb 0x80 0x3a 0xf2
08-15 13:11:33.666  1167  1433 I ProcessCMD: : 0x8e 0x20 0x03 0x20 0xeb 0x20 0x3b 0xe0
08-15 13:11:33.766  1167  1433 I ProcessCMD: : 0x8e 0xf0 0x02 0x80 0xeb 0x00 0x3c 0xd0
08-15 13:11:33.868  1167  1433 I ProcessCMD: : 0x8e 0xd0 0x02 0xa0 0xeb 0x40 0x3a 0x92
08-15 13:11:33.967  1167  1433 I ProcessCMD: : 0x8e 0x90 0x02 0x40 0xeb 0xd0 0x3a 0xa2
08-15 13:11:34.067  1167  1433 I ProcessCMD: : 0x8e 0x50 0x02 0x40 0xeb 0xd0 0x3a 0xe2
08-15 13:11:34.167  1167  1433 I ProcessCMD: : 0x8e 0x00 0x02 0x70 0xeb 0xa0 0x3b 0x31
08-15 13:11:34.267  1167  1433 I ProcessCMD: : 0x8e 0x80 0x02 0x80 0xeb 0xe0 0x3b 0x61
08-15 13:11:34.368  1167  1433 I ProcessCMD: : 0x8e 0xa0 0x02 0x60 0xeb 0xa0 0x3c 0xa0
08-15 13:11:34.467  1167  1433 I ProcessCMD: : 0x8e 0xa0 0x02 0x50 0xeb 0xd0 0x3a 0x82
08-15 13:11:34.566  1167  1433 I ProcessCMD: : 0x8e 0xb0 0x02 0x30 0xeb 0x70 0x3b 0xf1
08-15 13:11:34.667  1167  1433 I ProcessCMD: : 0x8e 0xc0 0x02 0x30 0xeb 0xb0 0x3a 0xa2
08-15 13:11:34.766  1167  1433 I ProcessCMD: : 0x8e 0xc0 0x02 0x50 0xeb 0x90 0x3a 0xa2
08-15 13:11:34.868  1167  1433 I ProcessCMD: : 0x8e 0x10 0x03 0xb0 0xeb 0x70 0x3b 0x10
08-15 13:11:34.967  1167  1433 I ProcessCMD: : 0x8e 0xe0 0x02 0xa0 0xeb 0x80 0x3c 0x40
08-15 13:11:35.067  1167  1433 I ProcessCMD: : 0x8e 0xb0 0x02 0xc0 0xeb 0xf0 0x3a 0xe2
08-15 13:11:35.167  1167  1433 I ProcessCMD: : 0x8e 0x50 0x02 0xc0 0xeb 0x20 0x3b 0x11
08-15 13:11:35.267  1167  1433 I ProcessCMD: : 0x8e 0x00 0x02 0x70 0xeb 0xe0 0x3a 0xf2
08-15 13:11:35.368  1167  1433 I ProcessCMD: : 0x8e 0x50 0x02 0x90 0xeb 0xe0 0x3a 0x82
08-15 13:11:35.467  1167  1433 I ProcessCMD: : 0x8e 0xf0 0x02 0x30 0xec 0x50 0x3c 0xcf
08-15 13:11:35.567  1167  1433 I ProcessCMD: : 0x8e 0xc0 0x02 0x00 0xec 0xe0 0x3c 0x9f
08-15 13:11:35.667  1167  1433 I ProcessCMD: : 0x8e 0xd0 0x02 0x10 0xec 0x00 0x3c 0x5f
08-15 13:11:35.766  1167  1433 I ProcessCMD: : 0x8e 0x90 0x02 0xa0 0xeb 0xf0 0x3b 0x21
08-15 13:11:35.868  1167  1433 I ProcessCMD: : 0x8e 0x90 0x02 0x90 0xeb 0xb0 0x3c 0x70
08-15 13:11:35.967  1167  1433 I ProcessCMD: : 0x8e 0xc0 0x02 0x50 0xeb 0xf0 0x3c 0x40
08-15 13:11:36.067  1167  1433 I ProcessCMD: : 0x8e 0xd0 0x02 0xc0 0xeb 0x90 0x3d 0x1f
08-15 13:11:36.166  1167  1433 I ProcessCMD: : 0x8e 0xd0 0x02 0x00 0xec 0xd0 0x3d 0x9e
08-15 13:11:36.267  1167  1433 I ProcessCMD: : 0x8e 0x90 0x02 0x10 0xec 0x90 0x3c 0x0f
08-15 13:11:36.368  1167  1433 I ProcessCMD: : 0x8e 0xf0 0x01 0x70 0xeb 0xf0 0x3c 0xf1
08-15 13:11:36.466  1167  1433 I ProcessCMD: : 0x8e 0xd0 0x01 0xb0 0xeb 0xe0 0x3c 0xe1
08-15 13:11:36.567  1167  1433 I ProcessCMD: : 0x8e 0x10 0x02 0x90 0xeb 0xa0 0x3d 0xff
08-15 13:11:36.667  1167  1433 I ProcessCMD: : 0x8e 0xa0 0x02 0x80 0xeb 0xf0 0x3d 0x2f
08-15 13:11:36.766  1167  1433 I ProcessCMD: : 0x8e 0xa0 0x02 0xe0 0xeb 0x30 0x3f 0x8d
08-15 13:11:36.868  1167  1433 I ProcessCMD: : 0x8e 0xa0 0x01 0xb0 0xeb 0x00 0x3e 0xef

I can't seem to make sense of this stream especially since if I then assign that same steering wheel button via the settings app and then press it, i immediately get this in my logcat:

Code:
08-15 13:11:26.239  1167  1433 I ProcessCMD: : 0x72 0x12 0x78
08-15 13:11:26.242  1167  1433 I ProcessCMD: : 0x79 0x04 0x7f
08-15 13:11:26.242  1167  1433 I EventService: onCmdMainVolEvent = 0x79 0x04 0x7f


What am I missing here?
Does assigning an action to the steering wheel button somehow change the serial stream being sent by the MCU to EventCenter? or is the MCU communicating with some other method I haven't been able to find?
 

apocalypse_bg

Senior Member
May 27, 2010
201
23
Huawei Mate 20 X

Thanks, I'll try.

Regarding your reverse engineering, I'm new to the Unit, I've done android application development as an amateur. So my experience is very limited.

Regarding:
Code:
08-15 13:11:26.239  1167  1433 I ProcessCMD: : 0x72 0x12 0x78
08-15 13:11:26.242  1167  1433 I ProcessCMD: : 0x79 0x04 0x7f

Those HEX values translate to
Code:
rx
y

Looking at the code, I think your assumptions are correct and the communication is: car's CAN Bus (messages and whatnot) -> MCU decodes CAN messages -> Sends Events to Android via this Serial Connection.

However, how exactly the original developers implemented the MCU <-> Android communication is a wild guess (just bytes, which are mapped somewhere to specific logic (that not might even not be described except in code comments/outside documentation slicing parts of the original CAN messages and sending them to Android, strings from the values, etc..). I guess you'd need to identify first one consistent event that you can get always the same output in logcat (for example for volume up and after that for volume down), and then compare the values to see what is the difference in bytes.
 

ramathorn1982

Senior Member
Apr 21, 2015
398
53
Hey guys need some help;



I believe I can fix a lot of bugs that are in this unit but I feel like i'm re-inventing the wheel here. Hoping I can benefit from your shared experience and expertise here.



I decompiled eventcenter.apk and added a few logging lines to a few methods so I can trace what happens when something in the car is triggered (steering wheel button, brake pressed, etc) all the way to the translated android action.



I thought I had it but something is not adding up.



My understanding is that hardware signals get picked up by the MCU which then communicates with android via EventCenter when eventservice opens the serial port. This is supported by the following code blocks;



Code:
    public void openSerialPort() {

        try {

            if (this.msp == null) {

                this.msp = new ZXWSerialPort();

                this.msp.open(EventUtils.getMcuComDevicePath(), EventUtils.UART_DEV_SPEED);

                startProcessCmdThread();

                startReceiveThread();

                startSendThread();

            }

        } catch (Exception e) {

            e.printStackTrace();

        }

    }



where openSerialPort() is called on initSysEventState method and startProcessCmdThread calls a message handler on a loop and if it has data, calls processcmd()



Code:
if (bybuf != null && bybuf.length > 0) {

          try {

                processCmd(bybuf);

           } catch (Exception e) {

                DebugLog.i(EventService.TAG, "processCmd error: " + e.toString());

           }

 }



Finally, processCmd just has a switch statement which determines which method to call based on the first numbers in the buffer array.



Code:
private void processCmd(byte[] bydata) {

                            switch (bydata[0]) {

                                case Byte.MIN_VALUE:

                                    onCmdFreqSelectEvt(bydata);

                                    return;

                                case -127:

                                    onCmdModePowerOnEvt(bydata);

                                    return;

                                case -126:

                                    onCmdDiscAutoInEvt(bydata);

                                    return;

                                    

                                case -125:

                                    onCmdSysRTCTimeEvt(bydata);

                                    return;

                                case -122:

                                    onCmd8825ValEvent(bydata);

                                    return;

                                case -120:

                                    OnCmdWheelState(bydata);

                                    return;

                                case -115:

                                    onCmdMcuIRRadarData(bydata);

                                    return;

                                case -114:

                                    onCmdMcu3DHData(bydata);

                                    return;

                                case -108:

                                    Intent intent = new Intent("com.szchoiceway.eventcenter.EventUtils.ACTION_MCU_8836_VALUE_EVENT");

                                    intent.putExtra("EventUtils.MCU_8836_VALUE_DATA", bydata);

                                    EventService.this.sendBroadcastAsUser(intent, UserHandle.ALL);

                                    return;

                                case -107:

                                    onCmdMcuHdmiResolutionData(bydata);

                                    return;

                                case -95:

                                    onCmdCarAirEvent(bydata);

                                    return;

                                case -91:

                                    onCmdCanEvent(bydata);

                                    return;

                                case -90:

                                    onCmdMcuATAData(bydata);

                                    return;

                                case EventUtils.CARTYPE_U6_LO /*109*/:

                                    onCmdMcuPlugInRadarData(bydata);

                                    return;

                                case EventUtils.CARTYPE_SenyaR7_HI /*112*/:

                                    onCmdModeAck(bydata);

                                    return;

                                case EventUtils.CARTYPE_Kaluola_LO /*113*/:

                                    onCmdSysEvent(bydata);

                                    return;

                                case EventUtils.CARTYPE_Kaluola_HI /*114*/:

                                    onCmdKeyEvent(bydata);

                                    return;

                                case EventUtils.CARTYPE_Siyu2016_LO /*115*/:

                                    onCmdRadioEvent(bydata);

                                    return;

                                case 116:

                                    onCmdWheelEvent(bydata);

                                    return;

                                case 117:

                                    onCmdTVEvent(bydata);

                                    return;

                                case EventUtils.CARTYPE_SLS_HI /*118*/:

                                    onCmdBMTVolEvent(bydata);

                                    return;

                                case EventUtils.CARTYPE_2013EXPLORER_LO /*119*/:

                                    onCmdEQEvent(bydata);

                                    return;

                                case 120:

                                    onCmdMuteEvent(bydata);

                                    return;

                                case EventUtils.CARTYPE_CRIDER_LO /*121*/:

                                    onCmdMainVolEvent(bydata);

                                    return;

                                case EventUtils.CARTYPE_CRIDER_HI /*122*/:

                                    onCmdBalanceEvent(bydata);

                                    return;

                                case EventUtils.CARTYPE_BIAOZHI408_LO /*123*/:

                                    onCmdLoudnessEvent(bydata);

                                    return;

                                case EventUtils.CARTYPE_BIAOZHI408_HI /*124*/:

                                    onCmdMcuInitEvent(bydata);

                                    return;

                                case 126:

                                    onCmdKeyADEvent(bydata);

                                    return;

                                case Byte.MAX_VALUE:

                                    onCmdUpgradeAck(bydata);

                                    return;

                                default:

                                    return;

                            }

                        }



Based on this logic above I assumed I should be able to capture the direct MCU data by simply hooking onto the data sent to processCMD method before it decides what to do with it. To test this, I added a Log to the smali right at the beginning of that method which gives me the string formatted form of the bybuf array. However, the data sent to processCMD doesn't seem to make any sense when trying to relate it to physical events in the car.



For example, here is a portion of my logcat; during this time, I started by doing nothing then I pressed a couple of unassigned steering wheel buttons.



Code:
08-15 13:11:26.554  1167  1433 I EventService: onCmdMainVolEvent = 0x79 0x05 0x7e

08-15 13:11:26.570  1167  1433 I ProcessCMD: : 0x8e 0x20 0x03 0xc0 0xeb 0xc0 0x3d 0x9e

08-15 13:11:26.667  1167  1433 I ProcessCMD: : 0x8e 0x80 0x02 0xf0 0xeb 0x70 0x3d 0x5f

08-15 13:11:26.766  1167  1433 I ProcessCMD: : 0x8e 0x50 0x02 0xb0 0xeb 0x20 0x3c 0x20

08-15 13:11:26.868  1167  1433 I ProcessCMD: : 0x8e 0xd0 0x01 0xc0 0xeb 0x30 0x3d 0x80

08-15 13:11:26.967  1167  1433 I ProcessCMD: : 0x8e 0xc0 0x01 0xc0 0xeb 0xd0 0x3d 0xf0

08-15 13:11:27.067  1167  1433 I ProcessCMD: : 0x8e 0x00 0x02 0xc0 0xeb 0x10 0x3e 0x6e

08-15 13:11:27.166  1167  1433 I ProcessCMD: : 0x8e 0x70 0x02 0x10 0xec 0x40 0x3e 0x7d

08-15 13:11:27.267  1167  1433 I ProcessCMD: : 0x8e 0x70 0x02 0x00 0xec 0x20 0x3e 0xad

08-15 13:11:27.368  1167  1433 I ProcessCMD: : 0x8e 0x80 0x02 0xe0 0xeb 0xa0 0x3c 0x40

08-15 13:11:27.467  1167  1433 I ProcessCMD: : 0x8e 0x30 0x02 0x40 0xeb 0xe0 0x3c 0xf0

08-15 13:11:27.568  1167  1433 I ProcessCMD: : 0x8e 0x60 0x02 0x80 0xeb 0x20 0x3d 0x3f

08-15 13:11:27.667  1167  1433 I ProcessCMD: : 0x8e 0xd0 0x02 0x70 0xeb 0xc0 0x3d 0x3f

08-15 13:11:27.767  1167  1433 I ProcessCMD: : 0x8e 0x10 0x03 0x90 0xeb 0xd0 0x3d 0xce

08-15 13:11:27.868  1167  1433 I ProcessCMD: : 0x8e 0xb0 0x02 0x00 0xec 0xe0 0x3d 0xae

08-15 13:11:27.966  1167  1433 I ProcessCMD: : 0x8e 0x80 0x02 0xd0 0xeb 0x50 0x3c 0xa0

08-15 13:11:28.067  1167  1433 I ProcessCMD: : 0x8e 0x00 0x02 0x70 0xeb 0xd0 0x3c 0x00

08-15 13:11:28.166  1167  1433 I ProcessCMD: : 0x8e 0x10 0x02 0x90 0xeb 0x40 0x3c 0x60

08-15 13:11:28.267  1167  1433 I ProcessCMD: : 0x8e 0x10 0x02 0x90 0xeb 0xf0 0x3c 0xb0

08-15 13:11:28.368  1167  1433 I ProcessCMD: : 0x8e 0x70 0x02 0xc0 0xeb 0xc0 0x3c 0x50

08-15 13:11:28.466  1167  1433 I ProcessCMD: : 0x8e 0xa0 0x02 0xa0 0xeb 0xe0 0x3d 0x1f

08-15 13:11:28.567  1167  1433 I ProcessCMD: : 0x8e 0x70 0x02 0x90 0xeb 0xf0 0x3a 0x52

08-15 13:11:28.667  1167  1433 I ProcessCMD: : 0x8e 0xd0 0x02 0x70 0xeb 0x70 0x3a 0x92

08-15 13:11:28.767  1167  1433 I ProcessCMD: : 0x8e 0xf0 0x02 0x80 0xeb 0x20 0x39 0xb3

08-15 13:11:28.868  1167  1433 I ProcessCMD: : 0x8e 0xb0 0x02 0x60 0xeb 0x60 0x38 0xd4

08-15 13:11:28.967  1167  1433 I ProcessCMD: : 0x8e 0x70 0x03 0xb0 0xeb 0xe0 0x38 0x43

08-15 13:11:29.067  1167  1433 I ProcessCMD: : 0x8e 0x20 0x03 0xa0 0xeb 0xf0 0x39 0x92

08-15 13:11:29.167  1167  1433 I ProcessCMD: : 0x8e 0x50 0x03 0x00 0xec 0x10 0x39 0xe1

08-15 13:11:29.266  1167  1433 I ProcessCMD: : 0x8e 0x30 0x03 0x00 0xec 0xc0 0x38 0x52

08-15 13:11:29.369  1167  1433 I ProcessCMD: : 0x8e 0x00 0x03 0xd0 0xeb 0x00 0x38 0x73

08-15 13:11:29.369  1167  1433 I ProcessCMD: : 0x71 0x01 0x00 0x89

08-15 13:11:29.369  1167  1433 I EventService: onCmdSysEvent: 0x71 0x01 0x00 0x89

08-15 13:11:29.467  1167  1433 I ProcessCMD: : 0x8e 0xf0 0x02 0xd0 0xeb 0xc0 0x37 0xc5

08-15 13:11:29.567  1167  1433 I ProcessCMD: : 0x8e 0xd0 0x02 0x20 0xec 0xd0 0x37 0x84

08-15 13:11:29.667  1167  1433 I ProcessCMD: : 0x8e 0xe0 0x02 0x00 0xec 0x60 0x39 0x02

08-15 13:11:29.766  1167  1433 I ProcessCMD: : 0x8e 0x20 0x03 0x50 0xec 0x80 0x3a 0x50

08-15 13:11:29.868  1167  1433 I ProcessCMD: : 0x8e 0xe0 0x02 0x50 0xec 0x20 0x3b 0xf0

08-15 13:11:29.968  1167  1433 I ProcessCMD: : 0x8e 0xe0 0x02 0x20 0xec 0x30 0x3b 0x10

08-15 13:11:30.066  1167  1433 I ProcessCMD: : 0x8e 0xd0 0x02 0xf0 0xeb 0x60 0x3b 0x21

08-15 13:11:30.166  1167  1433 I ProcessCMD: : 0x8e 0x60 0x02 0x10 0xec 0x70 0x3b 0x60

08-15 13:11:30.266  1167  1433 I ProcessCMD: : 0x8e 0x80 0x02 0xf0 0xeb 0x40 0x3b 0x91

08-15 13:11:30.368  1167  1433 I ProcessCMD: : 0x8e 0x40 0x02 0xe0 0xeb 0x00 0x3d 0x1f

08-15 13:11:30.467  1167  1433 I ProcessCMD: : 0x8e 0x20 0x02 0x20 0xec 0x50 0x3d 0xae

08-15 13:11:30.567  1167  1433 I ProcessCMD: : 0x8e 0x30 0x02 0x20 0xec 0xe0 0x3d 0x0e

08-15 13:11:30.666  1167  1433 I ProcessCMD: : 0x8e 0x60 0x02 0x60 0xec 0xa0 0x3d 0xde

08-15 13:11:30.767  1167  1433 I ProcessCMD: : 0x8e 0x10 0x02 0x20 0xec 0xb0 0x3d 0x5e

08-15 13:11:30.868  1167  1433 I ProcessCMD: : 0x8e 0x10 0x02 0xe0 0xeb 0x50 0x3c 0x00

08-15 13:11:30.967  1167  1433 I ProcessCMD: : 0x8e 0xe0 0x01 0x90 0xeb 0x50 0x3d 0x80

08-15 13:11:31.067  1167  1433 I ProcessCMD: : 0x8e 0x40 0x02 0x20 0xec 0x60 0x3d 0x7e

08-15 13:11:31.167  1167  1433 I ProcessCMD: : 0x8e 0xa0 0x02 0xe0 0xeb 0x20 0x3e 0x9e

08-15 13:11:31.267  1167  1433 I ProcessCMD: : 0x8e 0x00 0x03 0xd0 0xeb 0xf0 0x3d 0x7e

08-15 13:11:31.368  1167  1433 I ProcessCMD: : 0x8e 0xe0 0x02 0xe0 0xeb 0xe0 0x3d 0x9f

08-15 13:11:31.467  1167  1433 I ProcessCMD: : 0x8e 0x70 0x02 0xc0 0xeb 0xa0 0x3c 0x70

08-15 13:11:31.567  1167  1433 I ProcessCMD: : 0x8e 0x10 0x02 0x60 0xeb 0x30 0x3d 0x9f

08-15 13:11:31.574  1167  4828 W libEGL  : EGLNativeWindowType 0x77d8ee1010 disconnect failed

08-15 13:11:31.667  1167  1433 I ProcessCMD: : 0x8e 0x30 0x02 0xa0 0xeb 0x00 0x3d 0x6f

08-15 13:11:31.767  1167  1433 I ProcessCMD: : 0x8e 0x20 0x02 0x80 0xeb 0x00 0x3e 0x9e

08-15 13:11:31.868  1167  1433 I ProcessCMD: : 0x8e 0xa0 0x02 0xb0 0xeb 0xf0 0x3d 0xff

08-15 13:11:31.967  1167  1433 I ProcessCMD: : 0x8e 0x60 0x02 0xb0 0xeb 0x60 0x3e 0xce

08-15 13:11:32.067  1167  1433 I ProcessCMD: : 0x8e 0x60 0x02 0x80 0xeb 0x90 0x3c 0xd0

08-15 13:11:32.167  1167  1433 I ProcessCMD: : 0x8e 0x30 0x02 0x10 0xeb 0x00 0x3d 0xff

08-15 13:11:32.267  1167  1433 I ProcessCMD: : 0x8e 0x70 0x02 0x40 0xeb 0xe0 0x3c 0xb0

08-15 13:11:32.368  1167  1433 I ProcessCMD: : 0x8e 0x80 0x02 0x90 0xeb 0x10 0x3d 0x1f

08-15 13:11:32.467  1167  1433 I ProcessCMD: : 0x8e 0xe0 0x02 0xb0 0xeb 0xb0 0x3d 0xff

08-15 13:11:32.567  1167  1433 I ProcessCMD: : 0x8e 0x90 0x02 0x90 0xeb 0xd0 0x3d 0x4f

08-15 13:11:32.667  1167  1433 I ProcessCMD: : 0x8e 0x40 0x02 0x70 0xeb 0x10 0x3c 0x80

08-15 13:11:32.767  1167  1433 I ProcessCMD: : 0x8e 0xf0 0x01 0x70 0xeb 0xb0 0x3c 0x31

08-15 13:11:32.867  1167  1433 I ProcessCMD: : 0x8e 0x00 0x02 0xa0 0xeb 0x50 0x3c 0x50

08-15 13:11:32.967  1167  1433 I ProcessCMD: : 0x8e 0x00 0x02 0x80 0xeb 0xf0 0x3b 0xd1

08-15 13:11:33.067  1167  1433 I ProcessCMD: : 0x8e 0x60 0x02 0xe0 0xeb 0x40 0x3c 0xc0

08-15 13:11:33.167  1167  1433 I ProcessCMD: : 0x8e 0x70 0x02 0xd0 0xeb 0x70 0x3c 0x90

08-15 13:11:33.266  1167  1433 I ProcessCMD: : 0x8e 0x80 0x02 0xb0 0xeb 0x70 0x3b 0xa1

08-15 13:11:33.369  1167  1433 I ProcessCMD: : 0x8e 0x30 0x02 0x70 0xeb 0x10 0x3b 0x91

08-15 13:11:33.369  1167  1433 I ProcessCMD: : 0x71 0x01 0x00 0x89

08-15 13:11:33.369  1167  1433 I EventService: onCmdSysEvent: 0x71 0x01 0x00 0x89

08-15 13:11:33.467  1167  1433 I ProcessCMD: : 0x8e 0x70 0x02 0x60 0xeb 0xf0 0x3a 0x82

08-15 13:11:33.567  1167  1433 I ProcessCMD: : 0x8e 0xb0 0x02 0x20 0xeb 0x80 0x3a 0xf2

08-15 13:11:33.666  1167  1433 I ProcessCMD: : 0x8e 0x20 0x03 0x20 0xeb 0x20 0x3b 0xe0

08-15 13:11:33.766  1167  1433 I ProcessCMD: : 0x8e 0xf0 0x02 0x80 0xeb 0x00 0x3c 0xd0

08-15 13:11:33.868  1167  1433 I ProcessCMD: : 0x8e 0xd0 0x02 0xa0 0xeb 0x40 0x3a 0x92

08-15 13:11:33.967  1167  1433 I ProcessCMD: : 0x8e 0x90 0x02 0x40 0xeb 0xd0 0x3a 0xa2

08-15 13:11:34.067  1167  1433 I ProcessCMD: : 0x8e 0x50 0x02 0x40 0xeb 0xd0 0x3a 0xe2

08-15 13:11:34.167  1167  1433 I ProcessCMD: : 0x8e 0x00 0x02 0x70 0xeb 0xa0 0x3b 0x31

08-15 13:11:34.267  1167  1433 I ProcessCMD: : 0x8e 0x80 0x02 0x80 0xeb 0xe0 0x3b 0x61

08-15 13:11:34.368  1167  1433 I ProcessCMD: : 0x8e 0xa0 0x02 0x60 0xeb 0xa0 0x3c 0xa0

08-15 13:11:34.467  1167  1433 I ProcessCMD: : 0x8e 0xa0 0x02 0x50 0xeb 0xd0 0x3a 0x82

08-15 13:11:34.566  1167  1433 I ProcessCMD: : 0x8e 0xb0 0x02 0x30 0xeb 0x70 0x3b 0xf1

08-15 13:11:34.667  1167  1433 I ProcessCMD: : 0x8e 0xc0 0x02 0x30 0xeb 0xb0 0x3a 0xa2

08-15 13:11:34.766  1167  1433 I ProcessCMD: : 0x8e 0xc0 0x02 0x50 0xeb 0x90 0x3a 0xa2

08-15 13:11:34.868  1167  1433 I ProcessCMD: : 0x8e 0x10 0x03 0xb0 0xeb 0x70 0x3b 0x10

08-15 13:11:34.967  1167  1433 I ProcessCMD: : 0x8e 0xe0 0x02 0xa0 0xeb 0x80 0x3c 0x40

08-15 13:11:35.067  1167  1433 I ProcessCMD: : 0x8e 0xb0 0x02 0xc0 0xeb 0xf0 0x3a 0xe2

08-15 13:11:35.167  1167  1433 I ProcessCMD: : 0x8e 0x50 0x02 0xc0 0xeb 0x20 0x3b 0x11

08-15 13:11:35.267  1167  1433 I ProcessCMD: : 0x8e 0x00 0x02 0x70 0xeb 0xe0 0x3a 0xf2

08-15 13:11:35.368  1167  1433 I ProcessCMD: : 0x8e 0x50 0x02 0x90 0xeb 0xe0 0x3a 0x82

08-15 13:11:35.467  1167  1433 I ProcessCMD: : 0x8e 0xf0 0x02 0x30 0xec 0x50 0x3c 0xcf

08-15 13:11:35.567  1167  1433 I ProcessCMD: : 0x8e 0xc0 0x02 0x00 0xec 0xe0 0x3c 0x9f

08-15 13:11:35.667  1167  1433 I ProcessCMD: : 0x8e 0xd0 0x02 0x10 0xec 0x00 0x3c 0x5f

08-15 13:11:35.766  1167  1433 I ProcessCMD: : 0x8e 0x90 0x02 0xa0 0xeb 0xf0 0x3b 0x21

08-15 13:11:35.868  1167  1433 I ProcessCMD: : 0x8e 0x90 0x02 0x90 0xeb 0xb0 0x3c 0x70

08-15 13:11:35.967  1167  1433 I ProcessCMD: : 0x8e 0xc0 0x02 0x50 0xeb 0xf0 0x3c 0x40

08-15 13:11:36.067  1167  1433 I ProcessCMD: : 0x8e 0xd0 0x02 0xc0 0xeb 0x90 0x3d 0x1f

08-15 13:11:36.166  1167  1433 I ProcessCMD: : 0x8e 0xd0 0x02 0x00 0xec 0xd0 0x3d 0x9e

08-15 13:11:36.267  1167  1433 I ProcessCMD: : 0x8e 0x90 0x02 0x10 0xec 0x90 0x3c 0x0f

08-15 13:11:36.368  1167  1433 I ProcessCMD: : 0x8e 0xf0 0x01 0x70 0xeb 0xf0 0x3c 0xf1

08-15 13:11:36.466  1167  1433 I ProcessCMD: : 0x8e 0xd0 0x01 0xb0 0xeb 0xe0 0x3c 0xe1

08-15 13:11:36.567  1167  1433 I ProcessCMD: : 0x8e 0x10 0x02 0x90 0xeb 0xa0 0x3d 0xff

08-15 13:11:36.667  1167  1433 I ProcessCMD: : 0x8e 0xa0 0x02 0x80 0xeb 0xf0 0x3d 0x2f

08-15 13:11:36.766  1167  1433 I ProcessCMD: : 0x8e 0xa0 0x02 0xe0 0xeb 0x30 0x3f 0x8d

08-15 13:11:36.868  1167  1433 I ProcessCMD: : 0x8e 0xa0 0x01 0xb0 0xeb 0x00 0x3e 0xef



I can't seem to make sense of this stream especially since if I then assign that same steering wheel button via the settings app and then press it, i immediately get this in my logcat:



Code:
08-15 13:11:26.239  1167  1433 I ProcessCMD: : 0x72 0x12 0x78

08-15 13:11:26.242  1167  1433 I ProcessCMD: : 0x79 0x04 0x7f

08-15 13:11:26.242  1167  1433 I EventService: onCmdMainVolEvent = 0x79 0x04 0x7f





What am I missing here?

Does assigning an action to the steering wheel button somehow change the serial stream being sent by the MCU to EventCenter? or is the MCU communicating with some other method I haven't been able to find?
I'm not a developer, more of a troubleshooter. This is as deep as I got when attempting to figure out commands to send to make my own custom buttons with Automagic. Probably won't help but maybe?

https://forum.xda-developers.com/showthread.php?p=80393727

Sent from my HTC U11 using Tapatalk
 

Novosmaxim

Member
Aug 16, 2020
12
0
Hello, friends. Can you tell me how to determine if I have a real android 9 and what kind of firmware is needed for my device?
Tesla style KLUDE KD 12108
MCUVer - RL7Ac_KLD9M_dsp_F028 - BNR CY V509-11
FrameworkVer - rk3399-userdebug9PQ2A.190305.002
eng.work2.20200509.195418 test-keys
OSVer - 9 Sat May 9 11:12:56 CST 2020
APPVer - 20200515-1024*768 - 960-kld
Nandflash - 64,00G
RAM - 3G/4G
BTVer - SD_carplay_I2S_20200306_sdk1.6
Thanks
 

Leighm0

Senior Member
Apr 2, 2007
174
70
Perth
Hello All,

after long deliberations I've finally made the jump to one of those units and to be honest so far it's been a great disappointment, as mainly the sound and bluetooth are utter crap. I'm still considering whether not to return the unit or try to look for a partial refund (30 days since puchase).*

it's a PX6/4GB RAM/64GB ROM with RL78 MCU, Android Pie 9. Don't have root (is it possible to root it all?)

Copied over EventCenter.Apk and Settings.apk, but I cannot understand how to extract the password for the factory settings... @ramathorn1982 or @ShIvADeSt as you appear to be the most knowledgable, can you please give some hints how to proceed ?

That's unfortunate, I have sent mine back (but this was relating to another matter, the HDMI output was not working - faulty hw it seems) and they will be shipping me a new device. I did however get about a week to play with it before sending back, and my audio/sound was actually really great (my unit used the 'new' DSP system they talk about and also it had a direct output to my Factory JBL Amp so that may have been where the sound was better). Bluetooth audio I did not have an issue (I do not use android auto or carplay).

As for password, this is also dependant on your "customer number", if you copy over the customer.xml file from your HU, and check what "CustomerNum" it is set to, it is a different password for certain customer numbers. The APK to copy over to decompile is NaviSettings.apk (not Settings.apk - thats the Google/Android settings app - NaviSettings is the HU 3rd party settings app). After extracting NaviSettings.apk and decompiling the classes.dex using dex2jar (or similar) open up the JAR file in jd-gui and then go into "com > szchoiceway > settings > FragmentSysSet.class" or "FragmentAdvancedSet.class" and in those classes I found a "boolean isValidUserFreq()" function, and it listed out a number of password entrys throughout the byte code under the "ldc" or "ldc_w" entries - and I believe dependant on which CustomerNum you are, only one of those codes is valid (I didnt really look to see where it determined which customer number was what passcode, but it's probably coded in there somewhere, I just got all the passes and tried them until one worked).

Here are the possible passwords listed in my apk from my unit, my passwords were 8861 and 1688 I believe..

FragmentSysSet.class: (I believe this is the Long-press password in the System info page to get Factory Settings):
8861
1799
666888
1680
8888
3377

FragmentAdvancedSet.class (This is either Advanced menu or Install Set menu, depending on what your vendor/warehouse has set this name to in Settings):
8861
1688
666888
126
1680
9300
8888
3377
 

beren

Senior Member
Jun 17, 2008
460
73
i'd like to buy one of these head unit for my chevy cruze, i can find x86 4/64 gb for 250 euros...is it a good price?
px6 model is way more expensive...is there any reasonable difference?
what product should i buy also considering support?

thx
 

homer.ali

Senior Member
Jan 17, 2011
59
28
OnePlus 7 Pro
i'd like to buy one of these head unit for my chevy cruze, i can find x86 4/64 gb for 250 euros...is it a good price?
px6 model is way more expensive...is there any reasonable difference?
what product should i buy also considering support?

thx

This maybe a biased opinion but as of right now I cannot recommend you buy this model unfortunately..
I really would have liked to be able to recommend as the 12.8 inch screen is gorgeous but it's so full of bugs it's not worth it for me-- and I'm a modder/developer.

I'm looking into other units at the moment. I will let you know if any come out good .

Before this I was using an xtrons px5 10.1 inch which was fantastic. I got tired of it however and am looking for a new one.

Hope that helps!
 
  • Like
Reactions: beren

beren

Senior Member
Jun 17, 2008
460
73
This maybe a biased opinion but as of right now I cannot recommend you buy this model unfortunately..
I really would have liked to be able to recommend as the 12.8 inch screen is gorgeous but it's so full of bugs it's not worth it for me-- and I'm a modder/developer.

I'm looking into other units at the moment. I will let you know if any come out good .

Before this I was using an xtrons px5 10.1 inch which was fantastic. I got tired of it however and am looking for a new one.

Hope that helps!

are you talking about the px6 or intel version..or both?
because i can also find px5 units (not tesla style) for my car
 

homer.ali

Senior Member
Jan 17, 2011
59
28
OnePlus 7 Pro
are you talking about the px6 or intel version..or both?
because i can also find px5 units (not tesla style) for my car

Sorry;

I'm specifically referring to the PX6 Tesla style headunit talked about in this thread which uses rockchip chipset.


The px5 models are fine in my opinion and so are a lot of the PX6 models (my experience is with the MTC headunits)

I have never tried an Intel seicane unit yet but I just ordered one from joying.

Can let you know how I feel about it after I try it out
 

beren

Senior Member
Jun 17, 2008
460
73
Sorry;

I'm specifically referring to the PX6 Tesla style headunit talked about in this thread which uses rockchip chipset.


The px5 models are fine in my opinion and so are a lot of the PX6 models (my experience is with the MTC headunits)

I have never tried an Intel seicane unit yet but I just ordered one from joying.

Can let you know how I feel about it after I try it out

ok...i think i'll give a chance to the intel i found, i'll report my impressions...
 

Luis45306

New member
Sep 11, 2020
3
0
Hey guys I need some help and was recommended to go here.
I recently bought and installed a new Phoenix Auto PX6 10.4” radio. It installed fine and worked properly for about 5 days. The issue I initially started having was that the head unit would not turn off with my vehicle, normally when I shut the vehicle off the music would stop and then when I opened my door the unit would turn off, this was no longer happening. Unfortunately I was at work so I could not do any real troubleshooting, so I had to disconnect my battery or it would’ve died while I was at work. NOW the head unit will not turn on at all. It started happening a first time where I would start the truck and it wouldn’t turn on or boot, finally it did, so I figured it got the kinks worked out. After the weekend I started my truck up for work and NOTHING again. Since then whenever I start the truck the boot screen will briefly flicker and the unit will seemingly turn back off. And I will sometimes get a random car play connection to my iPhone, but the screen is off and I don’t have any control over A/C, radio, volume, literally nothing. And I live in Texas so it’s pretty damn hot. And help or recommendations would be appreciated!! Also I have already verified fuses, connections, and attempted reset button on head unit. Thanks!

---------- Post added at 06:49 PM ---------- Previous post was at 06:04 PM ----------

Hey guys I need some help and was recommended to go here.
I recently bought and installed a new Phoenix Auto PX6 10.4” radio. It installed fine and worked properly for about 5 days. The issue I initially started having was that the head unit would not turn off with my vehicle, normally when I shut the vehicle off the music would stop and then when I opened my door the unit would turn off, this was no longer happening. Unfortunately I was at work so I could not do any real troubleshooting, so I had to disconnect my battery or it would’ve died while I was at work. NOW the head unit will not turn on at all. It started happening a first time where I would start the truck and it wouldn’t turn on or boot, finally it did, so I figured it got the kinks worked out. After the weekend I started my truck up for work and NOTHING again. Since then whenever I start the truck the boot screen will briefly flicker and the unit will seemingly turn back off. And I will sometimes get a random car play connection to my iPhone, but the screen is off and I don’t have any control over A/C, radio, volume, literally nothing. And I live in Texas so it’s pretty damn hot. And help or recommendations would be appreciated!! Also I have already verified fuses, connections, and attempted reset button on head unit. Thanks!
Quick update, the unit finally booted up, not that I did anything, just randomly started up. Any suggestions while it’s working would be great, along with help while it isn’t working. Thanks!
 

Mr. Clown

Senior Moderator / RC-RT Committee - Fear a Clown
Staff member
Nov 29, 2008
6,883
3,659
41
Lake Ridge, Virginia
Hey guys I need some help and was recommended to go here.
I recently bought and installed a new Phoenix Auto PX6 10.4” radio. It installed fine and worked properly for about 5 days. The issue I initially started having was that the head unit would not turn off with my vehicle, normally when I shut the vehicle off the music would stop and then when I opened my door the unit would turn off, this was no longer happening. Unfortunately I was at work so I could not do any real troubleshooting, so I had to disconnect my battery or it would’ve died while I was at work. NOW the head unit will not turn on at all. It started happening a first time where I would start the truck and it wouldn’t turn on or boot, finally it did, so I figured it got the kinks worked out. After the weekend I started my truck up for work and NOTHING again. Since then whenever I start the truck the boot screen will briefly flicker and the unit will seemingly turn back off. And I will sometimes get a random car play connection to my iPhone, but the screen is off and I don’t have any control over A/C, radio, volume, literally nothing. And I live in Texas so it’s pretty damn hot. And help or recommendations would be appreciated!! Also I have already verified fuses, connections, and attempted reset button on head unit. Thanks!

---------- Post added at 06:49 PM ---------- Previous post was at 06:04 PM ----------



Quick update, the unit finally booted up, not that I did anything, just randomly started up. Any suggestions while it’s working would be great, along with help while it isn’t working. Thanks!
It looks like more a hardware issue to me. Unless you have an app causing an issue. Have you made sure the harness to the unit and all the connections are tight? Did you reset the unit? If everything seems to be ok after double checking and you still have issues, I will suggest you request a replacement and/or refund as it might be hardware related and the unit might be defective.

Sent from my ONEPLUS A6013 using Tapatalk
 
Last edited:
Jun 30, 2019
19
3
Hey guys I need some help and was recommended to go here.
I recently bought and installed a new Phoenix Auto PX6 10.4” radio. It installed fine and worked properly for about 5 days. The issue I initially started having was that the head unit would not turn off with my vehicle, normally when I shut the vehicle off the music would stop and then when I opened my door the unit would turn off, this was no longer happening. Unfortunately I was at work so I could not do any real troubleshooting, so I had to disconnect my battery or it would’ve died while I was at work. NOW the head unit will not turn on at all. It started happening a first time where I would start the truck and it wouldn’t turn on or boot, finally it did, so I figured it got the kinks worked out. After the weekend I started my truck up for work and NOTHING again. Since then whenever I start the truck the boot screen will briefly flicker and the unit will seemingly turn back off. And I will sometimes get a random car play connection to my iPhone, but the screen is off and I don’t have any control over A/C, radio, volume, literally nothing. And I live in Texas so it’s pretty damn hot. And help or recommendations would be appreciated!! Also I have already verified fuses, connections, and attempted reset button on head unit. Thanks!

---------- Post added at 06:49 PM ---------- Previous post was at 06:04 PM ----------



Quick update, the unit finally booted up, not that I did anything, just randomly started up. Any suggestions while it’s working would be great, along with help while it isn’t working. Thanks!
Hey Lewis, are you the same guy for my YouTube channel? Don't be fooled by the name @Mr. Clown is a smart guy. LOL. That's what I was thinking to.... hardware problem.
Is this in a RAM?
If so, you might want to try our specific RAM thread in the Rams forum.
https://www.ramforum.com/threads/tesla-style-10-4-android-radio-information.115875/page-291


Sent from my Pixel 2 XL using Tapatalk
 

Luis45306

New member
Sep 11, 2020
3
0
It looks like more a hardware issue to me. Unless you have an app causing an issue. Have you made sure the harness to the unit and all the connections are tight? Did you reset the unit? If everything seems to be ok after double checking and you still have issues, I will suggest you request a replacement and/or refund as it might be hardware related and the unit might be defective.

Sent from my ONEPLUS A6013 using Tapatalk

Mr. Clown,
I have already ensured that the connections are tight and reset the unit already. Are there any apps that you may have heard of that may cause issues? I have already sent out a request for replacement but no response from the seller. Thank you.

---------- Post added at 02:39 AM ---------- Previous post was at 02:34 AM ----------

Hey Lewis, are you the same guy for my YouTube channel? Don't be fooled by the name @Mr. Clown is a smart guy. LOL. That's what I was thinking to.... hardware problem.
Is this in a RAM?
If so, you might want to try our specific RAM thread in the Rams forum.



Sent from my Pixel 2 XL using Tapatalk
Big_daddys_house,
Yes I’m the same guy lol. It’s been weird, it started working and booting up again the last few times I tried, just worried about it happening again with this unit. It’s the PX6 10.4” unit, it’s installed in my 2013 Ram 1500 Sport. Thanks!
 

Mr. Clown

Senior Moderator / RC-RT Committee - Fear a Clown
Staff member
Nov 29, 2008
6,883
3,659
41
Lake Ridge, Virginia
Mr. Clown,

I have already ensured that the connections are tight and reset the unit already. Are there any apps that you may have heard of that may cause issues? I have already sent out a request for replacement but no response from the seller. Thank you.
Well if you did that already, then the unit must be defective. Sometimes my PX3 from Phoenix freeze out, becoming somewhat unresponsive not near what you are experiencing though, but with a factory reset fixes everything.

Sent from my ONEPLUS A6013 using Tapatalk
 

Luis45306

New member
Sep 11, 2020
3
0
Well if you did that already, then the unit must be defective. Sometimes my PX3 from Phoenix freeze out, becoming somewhat unresponsive not near what you are experiencing though, but with a factory reset fixes everything.

Sent from my ONEPLUS A6013 using Tapatalk
Mr. Clown,

I’ll trying running a factory reset again while it is working... if it keeps working, and see if it has any positive long term effect. Thanks for your insight, I’ll keep y’all updated if anything happens, I feel like most of my trouble will be communication with Phoenix Auto, so fingers crossed.
 

Mr. Clown

Senior Moderator / RC-RT Committee - Fear a Clown
Staff member
Nov 29, 2008
6,883
3,659
41
Lake Ridge, Virginia
Mr. Clown,



I’ll trying running a factory reset again while it is working... if it keeps working, and see if it has any positive long term effect. Thanks for your insight, I’ll keep y’all updated if anything happens, I feel like most of my trouble will be communication with Phoenix Auto, so fingers crossed.
Yep, Phoenix sucks on customer service. Call them instead..but like a serious stalker..that worked for me sometime ago[emoji23]

Sent from my ONEPLUS A6013 using Tapatalk
 
Jun 30, 2019
19
3
Mr. Clown,



I’ll trying running a factory reset again while it is working... if it keeps working, and see if it has any positive long term effect. Thanks for your insight, I’ll keep y’all updated if anything happens, I feel like most of my trouble will be communication with Phoenix Auto, so fingers crossed.
Another thing to note about Phoenix, (I've never bought a stereo from them but) things I've read in the various forms, they don't keep new units in stock (AKA ready to sell units in the states) so when you ordered your unit and if you got it faster than a month, it probably was a return that they had in their local stock and was reselling. Just something to note if you received your unit faster than 30 days.


Sent from my Pixel 2 XL using Tapatalk
 

l33boy

Senior Member
Jul 16, 2013
202
53
Bluetooth antenna

Hi all, been a while...
I'm looking to extend the range of the BT so it picks up BT TPMS at the rear of the car, my phone picks them up but the head unit doesn't see them.
Does anyone know if the BT antenna is separate or is it using the wifi antenna.. seeing as they transmit at the same frequency.. ?
Cheers
I have the android 7.1 head unit and there is only one antenna on the back
 
Last edited:

Top Liked Posts

  • There are no posts matching your filters.
  • 3
    There are some small updates.

    First: Rooting via Kingroot is possible.

    Second: I've managed to get the SystemApps and found the Bundle ID's com.choiceway for the launcher and com.szchoiceway for other apps like radio. But google it, did not bring any results :mad:
    Further I was able to decompile the settings APK and extract all factory Pin codes. For now, I won't post it public, to keep the risk that the manufacturer maybe changes them, as low as possible. But if you are interested in them, you can PM me anytime. If interest is increasing, I will post them here of course.
    3
    Looking to root mine for more themes mine was only shipped with 2. Not sure which firmware to go with? I want to be on the latest firmware I can get on. Any help much appreciated

    Here's my unit info:

    You have already the most fresh firmware (april 2019). You can google about using ADB wifi to get root for your device. But You need to know theme numbers to add to customer.xml for selection. Or You can download Phoenix Radio stock firmware with unlocked themes. Also You can buy custom firmware with unlocked themes and more features.
    Make your choice :)
    3
    I've been working on my 7.1.1 HU to get it to look and work how I like it but without using 3rd party software.
    This keeps it as fast and slick as possible... boots instantly from sleep with radio or music playing before I've started the engine.
    It uses a page of the top bar for 'what's playing' and GPS speed even when using maps or whatever. You can still scroll left<>right to bring up the shortcut icons as normal.
    Also changed the Radio to show the station name in large rather than frequency (which is now in the top bar)
    Big thanks to ShIvADeSt for the help on the top bar programming :good::good:
    3
    For completeness, I'll show you the images ive changed on my unit, and list the mods done so far.

    1) Changed the stereos 'boot screen' to the attached BootScreen.jpg
    2) Changed the stereos 'home screen logo' to the attached ZXWLOGO.png
    3) Modified EventCenter.apk to fix multiple typos and spelling/grammar mistakes
    4) Modified MusicPlayer.apk to remove 'Lyrics', make a single colour, fix some spelling/grammar mistakes, enlarge font sizes, change font colours, change player control buttons and their positions
    5) Currently trying to work on editing the TPMS app, but having issues when trying to install/update it after the mods.


    PS: If you want to have a go at the modded MusicPlayer, you can checkout the git repo I setup, and build it using apktool

    https://bitbucket.org/wishie/musicplayer-tesla-style-android-car-stereo/src/master/
    3
    where is this option?

    There is no such option. Need root and manually change some files.