err4o4 / spotify-car-thing-reverse-engineering

426 stars 4 forks source link

Button combinations #3

Open MostHated opened 2 years ago

MostHated commented 2 years ago

I just wanted to share that I came across the fact that if you hold the top 4 left buttons (excluding the recessed button) and then boot it, it seems to go into a different mode that shows up under lsusb. I am not well versed in the hardware side of things, so the info you have on here already might mean that you know this already, but just wanted to let you know.

Thanks, -MH

mekanoe commented 2 years ago

This got me a little farther

In Windows, it showed up as "GX-CHIP", which after installing the AMLogic USB driver, ended up showing up as a real device called "WorldCup Device". It seems AMLogic flashing tools could potentially work from here, but I'm thinking the bootloader is pretty significantly locked away from us.

The AML tooling on Windows has a place for a "password" binary input but obviously we don't have these for this device yet...

risograph commented 2 years ago

you hold the top 4 left buttons (excluding the recessed button)

not high priority addition, just wanted to provide a visual for this image

bwool1 commented 2 years ago

Playing around with this approach, just figured I would share my experience... I got the same results as @kayteh above. Here's what I did:

The tool now shows a connected device, but not much else. No apparent option to pull an image from the device, just an option to import and burn a new one to the device. Connected device line in software doesn't disappear or throw an error if you pull the plug on it.

image

Another note: once you plug in the car thing to USB with all four buttons held down, it will connect with your computer until you remove and re-add power without holding down the buttons (because it will boot normally in that case).

mekanoe commented 2 years ago

Yo! This gets us pretty far, there's some ROMs for these AMLogic devices we might be able to leverage, especially if we can just get the bare minimum of a kernel going.

AppointMike commented 2 years ago

I would love to help and get this thing hacked open

JordanEJ commented 2 years ago

I have a Gopro Karma remote controller which also shows up as WorldCup device. It runs a custom version of android but can be flashed with full android. Not sure it this is much help but as @kayteh said there is the possibility of a custom rom for this device.

everettperiman commented 2 years ago

image

Can confirm that the aforementioned steps worked for me as well.

JordanEJ commented 2 years ago

Found this: https://github.com/frederic/superbird-bulkcmd

Not sure how much it helps.