[Kri]

Originally Posted by Svenson

Don't need this.
Download the update, copy the px6.zip to a clean FAT32 formatted USB stick and insert it on the usb connector from the device. Wait a moment then will pop up a window for starting the update.

Thanks Svenson, i now tried an very old 4 GB Thumbdrive and it now recognized the update

I installed it, it seems to have lots of new features

For The Dimming guys, the new Firmware has an option to witch between Car-Dimming and manual dimming.
You can also adjust the Displaybrightnes now manually at the Settings !

Unfortunateley the lockscreen is still there, so no change in this

sincerely Chri

[__fred__]

Originally Posted by Kri

Hello

I just wanted to share some information, as i got into the sideload screen by mistake by me, rebooting the device via wlan into sideload mode

After this the device is showing the first screen:

At this screen no USB device does work at all, also directly rebooting does not help to get out of the sideload screen.
I tried to connect the device to my "Android updating" laptop with adb installed via A USB A-A cable, but no success, also there is no response, the connectors seem to be not active at this boot state.

to get out of this and into the normal system you have to wait 5 minutes, after this time the second screen does appear


unfortunateley as no usb port does work its also not possible to select anything.
but the good thing is, when you now powercycle the device it will start normally into bootloader mode again

@ Fred, i`m willing to share pictures and informations of my PX6 device, i also have disassebmled is as far as i could, because i`m not using this device so i can play around with it.

i have a github account, but i`m not fimilar with the "folder" structure.

i think it would be good to start some kind of Database of the different available hardware variants / clones.
A database based on the first string of the MCUVer. (+CPU) may be the best i think, because this is the most common identification possible.
from there on built like a tree with information / pictures / how-to`s, ect ?

any hint for me to start this ?

sincerely Chri

There is a wiki with information:

https://chinesebmwheadunits.github.io/

I only just started writing it, feel free to join.

There is also a repository where I keep the mcu firmware updates:

https://github.com/chinesebmwheadunits/mcu

There is no hardware difference in MCU's between Android 7.1 and Android 8+ units. Newer firmware files will have newer features.

However the android daugtherboard is completely different between PX3 and RX3399 (PX6 does not exist, but they call it this).

The firmware format is different, distribution format is different, the android 7 rom is not odexed, the android 8 rom is. etc. etc. I suspect the android 8 rom is 64bit, while the android 7 rom is 32bit.

These will never be compatible and as long as I don't have an PX6 unit, most information that I provide will be about andoird 7.1 PX3 units.

The screen above is the android recovery screen. You can enter it as well through a terminal with su -c reboot recovery (if it's rooted). When you connect an usb keyboard to the unit you can control it. It does not respond to the touch screen.

[Svenson]

Originally Posted by Kri

Unfortunateley the lockscreen is still there, so no change in this

sincerely Chri

What do you mean with lockscreen? Do you have a picture from?

[Kri]

Originally Posted by Svenson

What do you mean with lockscreen? Do you have a picture from?

since i made a factory reset when i bought it, when booting its showing the lockscreen first.
before the reset it was showing the Android GUI directly without need to slide to unlock.


sincerely Chri

[tpaxadpom]

Originally Posted by nomorebigideas

This is too much man, I've been waiting for YEARS to get the auto dimming shit sorted and now this!?

It would great if the Tasker intent + brightness selection could be coupled with Locale/Tasker Twilight Plugin to allow for auto-dimming (conversely!) when the sun goes down etc.

I meant to write this post a while ago. I am using CF.lumen app to improve display performance on my android 4.4 unit. It has a horrible blue tint that give me the headache. Originally I have used RGB settings and used my colorimeter with test patterns to adjust the white level (greyscale). Though since you only have 1 setting for the entire range (0IRE to 100 IRE - think high gain only for those that calibrate TV sets) I had to compromise. For this to work properly you will need a root as without root you can only add colors, not reduce them. So the black screen without root will likely be greyish and as a result the overall contrast will drop. The same app can adjust the screen brightness depending on your time zone (sunset/sunrise). I haven't implemented that yet.
Looks like the latest CF.lumen version of the app requires Android 5.0 though the older version are available for download.

[tpaxadpom]

Originally Posted by __fred__

This works. Twilight plugin is just a condition plugin for Tasker, so you can couple it with sending the intent and it will work. In the basis:

When going from day to night: send intent 3 times to go from 100% to 0%, 33%, 66%.

When going from night to day: send intent 1 time to go from 66% to 100%.

You might need one at boot as well if these intents don't fire while the unit was powered off. It will work better when you can send the absolute brightness value through an intent. But this will require modification of the Eventcenter APK.

Great job Fred!
CF.lumagen is another program that can adjust the screen brightness without the need for tasker.

[__fred__]

Originally Posted by tpaxadpom

Great job Fred!
CF.lumagen is another program that can adjust the screen brightness without the need for tasker.

It won’t be able to control the backlight as it is not implemented as a normal android backlight driver. The mcu controls the backlight of the screen and only gets its commands through a serial port connection in Eventcenter.apk

[Kri]

Originally Posted by __fred__

There is a wiki with information:

https://chinesebmwheadunits.github.io/

I only just started writing it, feel free to join.

There is also a repository where I keep the mcu firmware updates:

https://github.com/chinesebmwheadunits/mcu

There is no hardware difference in MCU's between Android 7.1 and Android 8+ units. Newer firmware files will have newer features.

However the android daugtherboard is completely different between PX3 and RX3399 (PX6 does not exist, but they call it this).

The firmware format is different, distribution format is different, the android 7 rom is not odexed, the android 8 rom is. etc. etc. I suspect the android 8 rom is 64bit, while the android 7 rom is 32bit.

These will never be compatible and as long as I don't have an PX6 unit, most information that I provide will be about andoird 7.1 PX3 units.

The screen above is the android recovery screen. You can enter it as well through a terminal with su -c reboot recovery (if it's rooted). When you connect an usb keyboard to the unit you can control it. It does not respond to the touch screen.

I`ll see what i can do, maybe some other model from user will also join

i already have connected a usb keyboard when at the recovery mode, but it does not respond, also not able to switch "num", so no power.
it seems that the USB ports are not active, it also won`t be recognized by my normal computer at this state.
when android has booted normally USB keyboard and USB adb do work fine.

sincerely Chri

[tpaxadpom]

Originally Posted by __fred__

It won’t be able to control the backlight as it is not implemented as a normal android backlight driver. The mcu controls the backlight of the screen and only gets its commands through a serial port connection in Eventcenter.apk

On Android 4.4 units one can adjust the brightness in the settings. There 2 independent controls for brightness One for rearview camera/info screen when you are in oem menu and the second one for Android mode. When it gets dark and I turn on the headlights it dims the screen by reducing the backlight. It works well for me with one exception. I keep the brightness at max setting (100) for Android mode to fight with reflective screen during the day. When it is dark the light output with reduced backlight setting is still too bright. I have to reduce the brightness further to 80 or even 70. CF.lumen can fix my problem by reducing the gain (rgb). Basically it is a contrast control with independent controls for rgb. I am currently using it to reduce the horrible blue tint my screen has. The original screen is of higher quality when it comes to greyscale accuracy. Will you be able intrested in Android 4.4 mcu file?
I am not sure how brightness control is implemented on other units (android 7, 8) from various manufacturers.

[__fred__]

Originally Posted by tpaxadpom

On Android 4.4 units one can adjust the brightness in the settings. There 2 independent controls for brightness One for rearview camera/info screen when you are in oem menu and the second one for Android mode. When it gets dark and I turn on the headlights it dims the screen by reducing the backlight. It works well for me with one exception. I keep the brightness at max setting (100) for Android mode to fight with reflective screen during the day. When it is dark the light output with reduced backlight setting is still too bright. I have to reduce the brightness further to 80 or even 70. CF.lumen can fix my problem by reducing the gain (rgb). Basically it is a contrast control with independent controls for rgb. I am currently using it to reduce the horrible blue tint my screen has. The original screen is of higher quality when it comes to greyscale accuracy. Will you be able intrested in Android 4.4 mcu file?
I am not sure how brightness control is implemented on other units (android 7, 8) from various manufacturers.

The android 4 units are completely different mcu wise. They use an STM8 instead of an STM32 and a different video chip. Apparently they have separate brightness controls for the android and OEM side, whereas the new units have a single brightness toggle button. I”m interested in the mcu firmware file and pictures, but probably just to have a look. Won’t be modding them.

[cederron]

Originally Posted by __fred__

... so set it to ARM-v7m, no floating point instructions and THUMB mode. It's little-endian.

ROM starts at 0x08000000 and is 0x20000 bytes big (128k)
RAM starts at 0x20000000 and is 0x10000 bytes big (64k)

The first 10k bytes to 0x080027FF are the bootloader which is not included in the mcuupdate.bin. From 0x08002800 the user application starts which is included in the mcuupdate.bin. So load the bin file at offset 0x08002800.
The first 340 bytes are the Interrupt vector table and specify offsets to interrupts in the file. Very first 4 bytes at 0x08002800 are the initial stack pointer. It should point into the 0x20000000 ....

Hi fred, Im trying to decompile the mcu firmware for learning purposes, but i cant do it even with your info
Using IDA Pro, Open the firmware .bin, select ARM little endian processor, ARM v7m architecture, no vfp, thumb mode. In next screen I write ram/rom offsets, but IDA hangs or loads incorrect data (or so it seems). For example first 4 bytes at 0x08002800 dont point into the 0x20000000 range...

Do you mind check the screens and point where the error is?
Thank you for your time.

[max414]

View post on imgur.com

hey guys new member stuck on the following point.. the connectors sit really snug and i cant seem to figure out where to pull the plugs ?

thx for ur help

[__fred__]

Originally Posted by cederron

Hi fred, Im trying to decompile the mcu firmware for learning purposes, but i cant do it even with your info
Using IDA Pro, Open the firmware .bin, select ARM little endian processor, ARM v7m architecture, no vfp, thumb mode. In next screen I write ram/rom offsets, but IDA hangs or loads incorrect data (or so it seems). For example first 4 bytes at 0x08002800 dont point into the 0x20000000 range...

Do you mind check the screens and point where the error is?
Thank you for your time.

Third one is correct. But then you look at the space that the bootloader occupies and that is unknown yet... So it's all zeroes. The bootloader at some points to the Interrupt vector table (IVT) by setting the VTOR (vector table offset register) to 0x08002800. Then it sets the stackpointer to the first WORD (4 bytes) value and then jumps to the address of the reset vector (Second WORD at 0x08002800+4)

I say word because for ARM word = 32 bits, however IDA is originally an x86 dissasembler and there it's called a DWORD. So pay attention to that.

So:

ARM byte = IDA byte = 8bits.
ARM halfword = IDA word = 16bits.
ARM word = IDA DWord = 32bits.

You should jump to 0x08002800 to find the interrupt vector table. So press G and fill in 0x08002800 to jump to that address.

There you will find the IVT. Press D a few times until the line reads DWORD. IT probably points to 0x20001700 or something. This is the initial stack pointer.
Now right click the DWORD and select array. Then create an array of 84 elements. Select 1 per line, otherwise it's unreadable. This is your IVT. You could create a segment and/or a struct for it. For now, this is enough.
The second value at 0x08002804 is the address of the reset vector. You will notice that it is an odd value. Probably something like 0x08002969. This points to an odd address. When the program counter register on ARM is odd, it indicates that it is in Thumb mode (16bit instructions instead of 32bit). This processor supports Thumb-2, so that is the mode that you should have selected at the first screen.
Click right on 0x08002969 and select Jump to operand. Now you jump to that address. It's odd, so substract 1 position and set the cursor on 0x08002968. This is the address where the reset vector starts.
Now press Alt+T and select 01 (thumb mode) for T. Press C and it will start autoanalyzing all code that is reachable from the reset vector.
This is a LOT, so you'll get a lot of functions that it will automatically detect.

Your memory layout should be filled with blue sections that are code sections. Notice yellow parts in between. These are still undefined. Could be either data (gray) or code (blue). There are two options for these parts:

Either they are pointed to by another interrupt vector, so you could follow all of them. Or they are dynamically invoked code, where the address of a function is calculated before it's invoked. Either way, functions on ARM have distinctive prologues and epilogues:

ARM functions usually start with a PUSH instruction where registers that are used in the function are pushed on the stack, to be restored after the function ends. R0 to R3 are function arguments, so these are typically skipped, but R4+ and the Link register (LR, which contains the return address for this function to return to after execution). are frequently pushed in the first instruction.

At the end there is either a pop where LR is restored as well (for subroutines that call other subroutines), or a BL instruction where there is a branch to the address of the unmodified link register.

So if you press C on an even address in between functions and you see that it e.g. starts with:

PUSH R4, LR

and it ends with

POP R4, PC

you have found a subroutine. Sometimes IDA will autodetect a functions, sometime you have to help it by pressing P at the address of the PUSH instruction. Note that as thumb instructions are very small (only 16bits) and a significant part of these bits are either opcode or some sort of modifier, there is not enough space to directly address 32bit memory addresses in a single opcode. So ARM uses something called PC relative addressing. Below a function there is some data with 32 bit values that point to the data in the memory space. This is called the literal pool. The instruction references a position in the literal pool by specifying it relative to the PC register (program counter).



As an example a function part that turns on the backlight. It starts with a push and ends with a POP. There are some branches that are not shown, but you get the idea.

The literal pool is below and shows a reference to a byte at 0x20000CC8 that controls the status of the backlight. It also stores a reference to the GPIOB_CRL register that is used to control GPIO pins for port B.

That is probably enough to now. To decompile (if you have the decompiler plugin). Press tab or F5. F5 will always decompile, Tab will only decompile on first invocation. Then it just switches to a cached representation of the function.

[Kri]

Originally Posted by max414

View post on imgur.com

hey guys new member stuck on the following point.. the connectors sit really snug and i cant seem to figure out where to pull the plugs ?

thx for ur help

the middle part is one with the lower is the male part, the upper one is the shorter female.
so hold down the male and pull the upper female.
Normally ther is a small nose on the wider side inside, with a tiny screwdriver you should be able to lift it.

sincerely Chri

[cederron]

Originally Posted by __fred__

Third one is correct. But then you look at the space that the bootloader occupies and that is unknown yet... So it's all zeroes. The bootloader at some points to the Interrupt vector table (IVT) by setting the VTOR (vector table offset register) to 0x08002800. Then it sets the stackpointer to the first WORD (4 bytes) value and then jumps to the address of the reset vector (Second WORD at 0x08002800+4)
...

wow thanks for the tutorial, will need some time to assimilate though.

[Kri]

I noticed that the Phonelink app is missing since the 050519 Android update.
does someone know how the name of the original software was so i can reinstall it ?

sincerely Chri

[Svenson]

Originally Posted by Kri

I noticed that the Phonelink app is missing since the 050519 Android update.
does someone know how the name of the original software was so i can reinstall it ?

sincerely Chri

Maybe "EasyCon"?

[Kri]

Originally Posted by Svenson

Maybe "EasyCon"?

I found the apk at via adb at root/oem/easyconnected, i copied it to my computer and back to the android system as it self has no access to root and installed it from there

it seems to be a special version for the ZXW Android Mainboard

sincerely Chri

[trooper1414]

Hi All,

I have a 2015 328i with the NBT Nav. I have already done one of these installs for the first gen Avin for his car (different model). I am now in the market to get one for myself. As i was ready to order, i noticed quite a few vendors now exist including Aliexpress, 4x4shop, so I have the following questions:

1. Who should i order my 10.2 from? Any recommendations?
2. As i was about to order, I read on page #101 of this thread that a 4gb variant is soon to be launched with Android 9 and ID7, anyone have any word on that? If its stable and if thats the specs i should get? I checked with Avin and they confired they will be launching it at the end of the month?
3. I have done a full Bavsound upgrade on my car, so sound quality is very important, will installing the unit make the sound quality suffer?
4. Anything in addition that i need to look out for.

Sorry, I have read quite a few pages on this thread, but i am trying to catch up on the new advancements and how to proceed further.

[ngandjui]

Hi everyone
Is there a way on the PX6 unit to disable the feature that cuts the sound when i put the car in reverse?
Thanks in advance

[amfgray]

Originally Posted by ngandjui

Hi everyone
Is there a way on the PX6 unit to disable the feature that cuts the sound when i put the car in reverse?
Thanks in advance

"backsound off" in the factory settings

[antonius2018]

Originally Posted by ngandjui

Hi everyone
Is there a way on the PX6 unit to disable the feature that cuts the sound when i put the car in reverse?
Thanks in advance

In factory settings select "BackCarSnd" ON.