TS9 SP9853i: Fact Finding Mission

Search This thread

RabbidHampster

Senior Member
Oct 30, 2008
55
4
Hey all, I know this a long shot but I am looking for someone who could possibly lend a bit of their time to share some knowledge. No, I am not looking for a custom firmware for my device because none exists. What I am hoping for is a sanity check and maybe a nudge in the right direction. I have spent countless hours trolling translated 4PDA posts. While I am certainly no developer, I do like to poke around in files and learn what I can. I understand all the risks and consequences.

Wanted to verify if root can be obtained by patching the boot image with Magisk. Not looking to do anything crazy but I am trying to make some small edits to how Steering Wheel commands work. My unit uses the canbus decoder to handle several features including SWC. I found that with the canbus, SWC could not be mapped using the built in app. I found the wiring info for my vehicle and rewired SWC from canbus to the KEY1 and KEY2 wires on the head unit. This allows me to now program my wheel buttons and even set long presses, yay. The one thing that does not work is mapping the voice button to launch Google Assistant or similar. Canbus mapping was weak and had duplicate functions like making the voice button a second mute button, lame. I also want to start learning how to modify the OEM apps like Radio, Music, BT, etc. So enter my need for root permissions.

I do have a copy of some firmware files for this device that were provided as hotfix for people having boot issues. I was able to merge the Android files into the System.img file using CMD but no luck figuring out how to decrypt the boot img file. The last file I believe is the MCU file. Kaier Tool seems unavailable from every link I've tried(edit: found what i was looking for and am now much closer). Some of these Russian links are straight up bogus as well...

Anyways, here is the system info page for my device and a link to the firmware files. Now I should add that I may not actually flash these files to my device but someone with a damaged unit may volunteer to test it out. I like my stuff working. I just kind of want to go through the motions and see whats up. I appreciate any help someone is willing to offer. At the very least maybe these files can assist someone else as the firmware for these devices is not easily obtained (Please do not flash them to your device and hope it will work, it won't). Again, I am looking to learn, so this will be an ongoing process for me. Thanks!

EDIT: I did obtain Root. See post https://xdaforums.com/showpost.php?p=83963285&postcount=17

Drive Link to Firmware Files:
TS9 4Runner Firmware (853 MB)

System Info:
foWLSj7.jpg
 
Last edited:
Jul 17, 2015
5
1
Wiring and swc issues

Hi there,

I hope you can kindly help me with this head unit.

I'm from Germany and own a Toyota Hilux VIII (2016 Model, GUN125).
From Australia I brought an Android radio.
Mine is a sp9853i_1h10_vmm (according to Android system information).
MCU version is Ts9.4.3-133-300-C03681-200514

My problem is now, that some things don't work like expected. And I don't know where to find any help.
For example music information is not shown on the car's multi-information-display.
And the wiring harness has one connector for which I don't have a corresponding connector on vehicle side.
Some pins inside the connectors seem to be in wrong position.

From my point of view, the cars sold in Australia have a slighty different wiring compared to the european ones.
What I already did is to re-pin one of the can bus decoder connectors, so that the can bus high/low matches the vehicle side.
But still I get no music/navi info on the multi-information-display of my car.

And, of course, I have the same issue with remapping of swc keys.

So I would be glad about any information regarding wiring, or known wiring issues with these head units.

And @RabbidHampster:
How did you re-wire the swc?

Tanks a lot
Michael
 

RabbidHampster

Senior Member
Oct 30, 2008
55
4
hi. i have also SWC working, but cannot program them. can you help me finding key 1 and key 2 connections?
thanks
Key 1 and Key 2 will depend on your Head Unit. On my unit they were two loose wires. Orange and Orange/White. I studied wiring diagrams of my vehicle to find the correct wires on the vehicle side.

The firmware files, it is based on Android 8.1 or Android 9 ?
It is based on 8.1

And, of course, I have the same issue with remapping of swc keys.

So I would be glad about any information regarding wiring, or known wiring issues with these head units.

And @RabbidHampster:
How did you re-wire the swc?

Tanks a lot
Michael

I don't know if these units can send info back to vehicle displays. Never seen it personally. I got the "voice" SWC option to finally work after reflashing the firmware. Apparently there were several revisions but they didn't bother updating the system version on my unit.
 
Last edited:

RabbidHampster

Senior Member
Oct 30, 2008
55
4
So I came up with this back in Feb but never followed up because I got busy. It does work for Root.
If your stock firmware doesn't have 4192eb4c-c1fc-11e8-8f83-a7a51df1443b then my posted firmware probably wont work for you. Ownice/Allwinner has some similar units.

Steps for MY Head Unit (no guarantees for anyone else):
  1. The file 4192eb4c-c1fc-11e8-8f83-a7a51df1443b in the firmware is the encrypted boot.img
  2. Decrypt 4192eb4c-c1fc-11e8-8f83-a7a51df1443b using Kaier tool.
  3. Use Magisk on the Ts9 unit to patch the boot.img
  4. Encrypt patched boot.img using Kaier tool save as 4192eb4c-c1fc-11e8-8f83-a7a51df1443b
  5. Put 4192eb4c-c1fc-11e8-8f83-a7a51df1443b on fat32 usb and update unit
  6. Check with Root Checker
 
Dec 20, 2019
21
12
hello everyone I want to ask if someone tries software from isudar or Ownice on ullgo head unit
This is my head unit
20191215_114154.jpg
 
Last edited:

Kaelub

Senior Member
Aug 14, 2020
59
5
So I came up with this back in Feb but never followed up because I got busy. It does work for Root.
If your stock firmware doesn't have 4192eb4c-c1fc-11e8-8f83-a7a51df1443b then my posted firmware probably wont work for you. Ownice/Allwinner has some similar units.

Steps for MY Head Unit (no guarantees for anyone else):
  1. The file 4192eb4c-c1fc-11e8-8f83-a7a51df1443b in the firmware is the encrypted boot.img
  2. Decrypt 4192eb4c-c1fc-11e8-8f83-a7a51df1443b using Kaier tool.
  3. Use Magisk on the Ts9 unit to patch the boot.img
  4. Encrypt patched boot.img using Kaier tool save as 4192eb4c-c1fc-11e8-8f83-a7a51df1443b
  5. Put 4192eb4c-c1fc-11e8-8f83-a7a51df1443b on fat32 usb and update unit
  6. Check with Root Checker

so your firmware should have root permissions? each of these files is the same as the files the seller sent me for my unit, so I am pretty sure it will work if I try it, the only thing is... the system and MCU and Android versions seem to be newer on my device... :(

---------- Post added at 03:47 AM ---------- Previous post was at 02:48 AM ----------

Android 10 ( I think it is not correct ... I think it is 8.1)

MCU Version:
Ts9.4.3-100-30-A4C695-200804(MM031)

No CAN apparently

System Version:
V11.1.2_20200428.171515_TS9L-TW8X

and my resolution is 1024_600 I believe


I have fw for it if anyone would like to analyze and perhaps add root?
sent from seller:
the file name is V11.1.2_20200428.171515_TS9L-TW8-X.zip if that means anything....
 
Last edited:

Top Liked Posts