yashsingh1/xdaforums huggingface dataset:
[Android Head-Units] radux.m.dan:
If anyone is interested about the kepads, here are some logs.

add device 1: /dev/input/event0

bus: 0000

vendor 0000

product 0000

version 0000

name: "tcc-ts"

location: ""

id: ""

version: 1.0.1

events:

KEY (0001): KEY_EXIT BTN_2 BTN_TOUCH

ABS (0003): ABS_X : value 0, min 0, max 800, fuzz 0, flat 0, resolution 0

ABS_Y : value 0, min 0, max 480, fuzz 0, flat 0, resolution 0

ABS_HAT0X : value 0, min 0, max 800, fuzz 0, flat 0, resolution 0

ABS_HAT0Y : value 0, min 0, max 480, fuzz 0, flat 0, resolution 0

ABS_PRESSURE : value 0, min 0, max 1550, fuzz 0, flat 0, resolution 0

ABS_TOOL_WIDTH : value 0, min 0, max 15, fuzz 0, flat 0, resolution 0

ABS_MT_TOUCH_MAJOR : value 0, min 0, max 255, fuzz 0, flat 0, resolution 0

ABS_MT_POSITION_X : value 0, min 0, max 800, fuzz 0, flat 0, resolution 0

ABS_MT_POSITION_Y : value 0, min 0, max 480, fuzz 0, flat 0, resolution 0

input props:

<none>

add device 2: /dev/input/event2

bus: 0010

vendor ffff

product ffff

version 0100

name: "Kenwood Keypad"

location: "kwkey/input0"

id: ""

version: 1.0.1

events:

KEY (0001): KEY_MENU KEY_BACK KEY_HOMEPAGE

input props:

<none>

add device 3: /dev/input/event1

bus: 0000

vendor 0000

product 0000

version 0000

name: "telechips remote controller"

location: "tcc-remote"

id: ""

version: 1.0.1

events:

KEY (0001): KEY_1 KEY_2 KEY_3 KEY_4

KEY_5 KEY_6 KEY_7 KEY_8

KEY_9 KEY_0 KEY_MINUS KEY_BACKSPACE

KEY_TAB KEY_ENTER KEY_DOT KEY_F2

KEY_F3 KEY_F10 KEY_F11 KEY_F12

KEY_UP KEY_PAGEUP KEY_LEFT KEY_RIGHT

KEY_END KEY_DOWN KEY_PAGEDOWN KEY_MUTE

KEY_VOLUMEDOWN KEY_VOLUMEUP KEY_COMPOSE KEY_BACK

KEY_PLAYPAUSE KEY_STOPCD KEY_RECORD KEY_REWIND

KEY_HOMEPAGE KEY_FASTFORWARD

input props:

<none>

Now logging buttons press:

1664-538538: EV_KEY KEY_MENU DOWN

1664-539027: EV_SYN SYN_REPORT 00000000

1664-543913: EV_KEY KEY_MENU UP

1664-546483: EV_SYN SYN_REPORT 00000000

1666-499811: EV_KEY KEY_BACK DOWN

1666-499861: EV_SYN SYN_REPORT 00000000

1666-502809: EV_KEY KEY_BACK UP

1666-502845: EV_SYN SYN_REPORT 00000000

1667-717905: EV_KEY KEY_HOMEPAGE DOWN

1667-717957: EV_SYN SYN_REPORT 00000000

1667-719570: EV_KEY KEY_HOMEPAGE UP

1667-719604: EV_SYN SYN_REPORT 00000000

As you can see only 3 buttons are generating events, I don't know yet how the voulme or the other buttons are mapped.
[Android Head-Units] pdanders11:
Excellent! I will get you the log.

So I've been reading on entering recovery and the Telechips documentation talks of something like a "Magic Key". I assume this is the key combo needed to enter recovery. However I can't find in documentation where the "Magic Key" is setup in the code. I know it unknown what Kenwood did but I can't find where in the SDK when the recovery key combo is set. Thoughts?

I guess Kenwood's known method is USB firmware upgrade which is also of little benefit as the system needs to be booted to trigger as does the ADB command.
[Android Head-Units] radux.m.dan:
You need to check the bootloader code (not recovery), that is where the key combination should be detected. Normally Telechips says it is the back key, but this means there should be a GPIO set for this job.
[Android Head-Units] pdanders11:
So in the only schematic I found floating around on the web which is for one of the newer TCC89XX chips, i see they have 2 buttons/keys going to GPIO directly. KEY_CTRL0 and KEY_CTRL1. Can't infer the GPIO as they are using GPIOE[24] and like 26 which don't exist on the TCC88xx. So maybe the keys your not seeing are tied directly to the CPU.....

I can hunt around for those signals
[Android Head-Units] chris.davis925:
You can get the unit to go into "System Rebuilding" which I assumed was either the kpanic partition or the default recovery, however with CWM flashed I couldn't get the unit to do this. It just boots into normal Android.

On a stock unit you can do this by interrupting the start up 6 times. For example, turn the unit off 6 times in a row when it is booting and showing the "Kenwood" screen.
[Android Head-Units] freddienux:
Hey guys I have a Dnx571hd and if I hook up HDMI/slimport cable to Nexus 5 would I be able to use touch screen for DNx? Thx in advance
[Android Head-Units] veonua:
what processor runs this unit? If we can find it out by software or opening the unit
[Android Head-Units] chris.davis925:
This unit runs TCC8801
[Android Head-Units] chris.davis925:
Here is a bit more info on the partition lock / reverting rw for /system.

log

<4>[ 721.257829] rtw_set_ps_mode(): Busy Traffic , Leave 802.11 power save..

<4>[ 721.257967] rtl8192c_set_FwPwrMode_cmd(): Mode = 0, SmartPS = 0

<4>[ 723.257834] rtw_set_ps_mode(): Enter 802.11 power save mode...

<4>[ 723.257856] rtl8192c_set_FwPwrMode_cmd(): Mode = 1, SmartPS = 2

#Edit - This is where the unit reverted back to read only after attempting to write a line of system to /system/text.log

<2>[ 723.888709] EXT4-fs error (device ndda2): ext4_mb_generate_buddy:736: grou

p 0, 1872 blocks in bitmap, 1873 in gd

<3>[ 723.888815] Aborting journal on device ndda2-8.

<2>[ 723.890511] EXT4-fs (ndda2): Remounting filesystem read-only

<2>[ 723.890593] EXT4-fs (ndda2): ext4_da_writepages: jbd2_start: 2147483647 pa

ges, ino 781; err -30

<4>[ 725.257762] rtw_set_ps_mode(): Busy Traffic , Leave 802.11 power save..

<4>[ 725.257955] rtl8192c_set_FwPwrMode_cmd(): Mode = 0, SmartPS = 0

<4>[ 727.257905] rtw_set_ps_mode(): Enter 802.11 power save mode...

<4>[ 727.257927] rtl8192c_set_FwPwrMode_cmd(): Mode = 1, SmartPS = 2

<4>[ 731.873296] rtw_set_ps_mode(): Busy Traffic , Leave 802.11 power save..

<4>[ 731.873460] rtl8192c_set_FwPwrMode_cmd(): Mode = 0, SmartPS = 0

<4>[ 733.258118] rtw_set_ps_mode(): Enter 802.11 power save mode...

<4>[ 733.258140] rtl8192c_set_FwPwrMode_cmd(): Mode = 1, SmartPS = 2
[Android Head-Units] radux.m.dan:
Hi Chris,

This must be a bug in the EXT4 file system, has nothing to do with any protection from Kenwood.

To solve this bug we need a newer kernel of just a newer EXT4 module.
[Android Head-Units] radux.m.dan:
The EXT4-fs error reported by "ext4_mb_generate_buddy" simply means that there is an inconsistency between the block allocation bitmap and the number of free blocks reported in a particular block group descriptor. An e2fsck should fix this.

It seems this bug was tracked in bugzilla already: https://bugzilla.kernel.org/show_bug.cgi?id=42723
[Android Head-Units] chris.davis925:
That makes sense. When I researched this, it seems that if there is a NAND lock triggered somehow the log will show this same kind of error. It seems odd to me that the file system would corrupt with the addition of a text file or removal of a file. This is the series of commands I did to trigger this:

-Mount /system as rw

-echo lolcat > /system/test.txt

:: System correctly mounts and writes the file with "lolcat" - everything is fine.

-echo lolcat2 >> /system/test.txt

::System reverts to RO and log generates the corruption.

It would seem to me that something else is triggering this? Especially since it's only observed a few reboots after an update is applied. Also applied to removing data from /system.

I am more than happy to have my hunch be wrong and have this fixed! :p
[Android Head-Units] pdanders11:
So what are the chances we can rebuild the kernel?

I have to disable several modules to build telechips kernel using the .config extracted from the unit. From what I remember camera and I2c parameters were missing that kenwood must have added. Should we start going through the errors and patch the ext 4 module?

What are the chances the 991 kernel is fixed and it could be dropped in a 990?

seems risky without recovery.

Seems like we need to figure out the recovery entry via hard keys, make a fwdn image, or get jtag working or risk bricking boards.
[Android Head-Units] chris.davis925:
Anything is possible, but the kernel version is the same on the 991.
[Android Head-Units] pdanders11:
sorry for the delay
[Android Head-Units] khan.waqar:
Root DNN990 Kenwood

What are next steps after root? Dose every thing works afterwords, Navigation, Webcams, phone etc..
[Android Head-Units] radux.m.dan:
[MENTION=4791431]pdanders11[/MENTION] Do you still have the unit on the desk? If you do can you run a small test with the UART connected on Debug port?

I would like you to send on UART port letter r or f while booting the unit, if you had a look on the bootloader code you can see that this should trigger a boot in fastboot or recovery mode, but I don't now if the code is present in our KW bootloader.

Thanks and regards!
[Android Head-Units] pdanders11:
Yes I do.

I can try it later this afternoon.
[Android Head-Units] pdanders11:
Can you tell me which file you found this? Even knowing the answer I can't seem to find the code that does this.

Also if you have some time, can you show how you switch the NAND driver from V7 to V8? I BoardConfig.mk that called 7 in and changed t to 8 but keeps building with 7 despite changing it to 8. If I copy nand code from the newer SDK, the whole thing blows up.

This SW is just more then I've every tried to dig into. I'm more of a firmware/Hardware guy but would like to understand if you have time. Same for CWM recovery when if you have the time.

This is what I changed to try to use the v8 NAND driver

./tcc8800/BoardConfig.mk:TARGET_NAND_TNFTL_VERSION := 8
[Android Head-Units] radux.m.dan:
Hi!

I can try to explain you more, but I would prefer to do it over a Skype call as I don't have too much time to write everything down.

About the file you need to look into is the app that starts after the low level init in bootloader, this is located in :

bootable/bootloader/lk/app/aboot/aboot.c

Cheers!
[Android Head-Units] freddienux:
Need a little help I have kenwood dnx571hd and I was wondering can I use a Verizon dongle for it? I mean if i attach it to the USB will I get internet? Thx in advance
[Android Head-Units] jbeavis19:
There is an earlier post in this thread about someone getting a usb dongle working but it's not as simple as plugging it in.
[Android Head-Units] freddienux:
Ok thx.. I seen on a bunch of forums that you can wit kenwoods that have wifi but not sure wit none wifi head unit. Can you direct me to the post where you saw it? Thx
[Android Head-Units] pdanders11:
This is the post I assume. Do you have the radio rooted?

http://xdaforums.com/showpost.php?p=54082291&postcount=492
[Android Head-Units] freddienux:
No I didn't think you cab root dnx571hd... And thx

N5-Carbon Rom/Team Blackout
[Android Head-Units] pdanders11:
I honestly don't know if you can root the unit or not. But if the unit is not rooted, you can't really add the modules needed to use a wifi or 3G dongle. This thread has documented getting root via a web exploit (not a option for you if the unit doesn't have internet) and a 2nd method of tearing there unit open and finding the USB OTG connector (if Kenwood is sill populating it and enabling it) and try to hack into the unit that way. That's assuming your radio is also based on the TCC8801. I'm guessing it is but without opening the unit we don't know.

Those in this thread working on the DNN990 have devoted a lot of time and money in hardware, software, and research so it's unlikely one of us would invest in more hardware. I think your best bet (if I understand what you want to do) is pop the top off the radio and if it's like the DNN units, you'll find a daughter board under the top cover under a metal plate/heatsink. Get a picture of that and there may be some things to try.
[Android Head-Units] freddienux:
OK Thx.. I figured because there is a USB port lol.. I'm newbeee when it comes to radio. I'm good with the phones lol.. Also another question you know if you can use Chromecast? Its like a Mhl/slash slimport right? I have a Nexus 5 so Mhl isn't compatible gotta use HDMI slimport..
[Android Head-Units] pdanders11:
If it's like the 990, all the external USB ports are slaves and the radio is the host. So all you can do is add peripherals. You need to get the radio to act like a peripheral and let your PC be the host. On the telechips devices, they provide one OTG port for this but on the units we've looked out, kenwood doesn't route this out to the chassis.

But yes, it is a lot like a phone, if you can get to the OTG port and get the radio to reliably show up as a peripheral. The main challenge after that is telechips is sort of a off brand vs most of the phone hacking using Qualcom. And most of all the user base is much much smaller so getting the right people involved is hard.

I think I read chrmocast works but I don't have a HDMI unit. kenwoodforums dot com has alot of good info also.
[Android Head-Units] freddienux:
Thanks

N5-Carbon Rom/Team Blackout
[Android Head-Units] chris.davis925:
For those who are interested, the DNN991HD 1.3 firmware update is live.
[Android Head-Units] pdanders11:
Is it just me or is Kenwoods terms of use questionable

Item 1 - no issue

#2 technically this means I can't unzip the download to upgrade my radio. Right? much less modifying

#3 this is the one I question the most. JVC Kenwood is th sole owner of copyrights and IP of linux and Android. I'm not a lawyer but this seems like BS

#4 Kenwood can't own GPL Software they didn't write, correct?

You must agree to the following conditions before downloading this update program.

1 •	A written permission from JVC KENWOOD Corp. is necessary in order to redistribute this software on your personal web page.

2 •	Modification, alteration, translation, merging, reverse compiling, or reverse engineering of this software is prohibited.

3 •	JVC KENWOOD Corp. is the sole owner of all copyrights and intellectual property rights of this software and accompanying manuals and other documents.

4 This software is not sold but licensed to the user by JVC KENWOOD Corp. The customer has ownership only of the media containing this software and the ownership of the software itself is reserved by JVC KENWOOD Corp.

4 •	JVC KENWOOD Corp. does not guarantee the suitability of this software or its quality and function for the customer's use and will not be liable for any problems caused by the use of this software except as explicitly noted.

The customer is responsible for the selection and installation of this software as well as the result of using this software.
[Android Head-Units] pdanders11:
So I was messing around with fastboot tonight and I was able to flash the recovery partition from stock to CWM and back.

While it appears the unit accepts the command, fastboot write to the boot partition doesn't seem to work or once again it's getting detected and wrote back.
[Android Head-Units] chris.davis925:
Is it possible the file system partition / lock is to blame? Can you check the log?
[Android Head-Units] pdanders11:
I'm not sure and the unit is in a soft brick state now. I can get into fast boot mode and recovery over the uart as Dan discovered. With stock recovery I get like 6 recovery reboots and the snapshot Sig fail and the board just sits there at the boot screen. So whatever I did, I tripped the snapshot recovery mode. I have images of most of the partitions and fastbooted those and I got back into the reboot loop and freeze.

Suspicious thing about fastboot flash to boot is the operation finishes way too fast. There should be a little delay to program but it's almost instantaneous. Other partitions show a lag as expected. Final test was just a boot erase that seemed to change nothing then out of the blue the unit seemed to trip recovery. So I'm not sure if it caught me playing with boot or I got something through that was corrupted.

---------- Post added at 04:57 PM ---------- Previous post was at 04:42 PM ----------

I guess I'll also state I just got the gpl covered source from Kenwood.

It took four weeks and they make it difficult so I'm not exactly ready to share it. I need to cover my butt but I will answer questions until I understand the gpl better.

I have kernel source, Kenwood hardware drivers, and some chromium source that seems to have the snapshot code.
[Android Head-Units] chris.davis925:
What Kenwood hardware is included?

Or maybe a better question - what Kenwood hardware is controlled via Android?
[Android Head-Units] bodieism:
Indeed. I wish this thread had more people interested in rooting this head unit. I'm getting F'in tired of the problems I run into with the AppRadio 2 and ARLiberator. I always wanted an Android based head unit that had all the features of my smartphone, but the AppRadio 2 with ARLiberator was the closest thing I could find at the time.

I'm ready to put some cash down to get this going :good:
[Android Head-Units] ScottyMCSE:
Agreed. I'd definitely throw a few bucks at it as well if someone would take it on.

Scott
[Android Head-Units] lanman1:
same here
[Android Head-Units] Orisai:
Watch out what you say... Some people believe its a heresy to expect smartphone features in a car stereo, as evidenced in the OUKU thread.

Now being serious, if we can find a few developers and fund their work through donations so they can crack down the DNN990HD or one of the chinese units in the OUKU thread, i'll be glad to donate and contribute to their work in some way.
[Android Head-Units] Dubbins:
I registered just to throw in a "me too.". The dnn990 is a lot of potential with meh execution. I'll chuck some money at a developer to get a reliable device that I can fully manage.
[Android Head-Units] Elixis:
Find & contact member "bbelos" on here. He is part of the Epic 4G dev community and is doing a phenominal job in keeping our device up to date and damn good at what he does. I have NO idea if he's even remotely interested in this, I am just saying the first name that comes to mind through my personal experience here. Perhaps if donations were offered, he MIGHT be interested, but do not message him saying that I said he was...I have no idea. I provide this information for everyones possible benefit.

I am just a quick passer-by that found this thread in a google search, as I am currently looking for a unit.

It has come down to this, KW-NT810HDT by JVC, or the Pioneer AVIC-Z150BH - what do you all think I should do?
[Android Head-Units] CarRamrod.u91:
Are there any updates on this? Im looking to get an indash system and this would be perfect if it was rooted.
[Android Head-Units] Highonthefloor:
Working on it

I have been an installer at CARTOYS for several years now and i have done hundreds of updates to 2DIN kenwood radios, all new software can be rendered to the unit via the female usb ports on the rear of the radio, although i have no knowledge of how to root something for the first time, i would assume that downloading an update patch from kenwood and then somehow use that as a mask to get into the rest of the system, would be a good place to start? also you would typically run the update via jump drive, so accessing it from a computer may be a little difficult as i am not sure how the access permissions are set up on this unit.
[Android Head-Units] jdyo:
Hi All,

Very keen to get the play store on my DNN unit also with the ability to install apps. I have a contact who may possibly be able to help us out.

what exact information would we need to help out so i can see what i can do, to do my part with this for all

Thanks

JD
[Android Head-Units] ScottyMCSE:
I happen to have the latest update that's not available on the website yet. Sooo... if anyone wants to have a go at it. I've got the latest firmware.

Scott
[Android Head-Units] sshams95:
1.4 or 1.5?
[Android Head-Units] ScottyMCSE:
1.4

I didn't realize they finally put it up on their site. I had it a couple of weeks before then. Is there a 1.5 available? (or were you thinking that's what I had?)

Scott
[Android Head-Units] sshams95:
Thought you had 1.5. I installed 1.4 yesterday, now my Nav freezes up as soon as I press any button. Everything else ok.
[Android Head-Units] Antd0g:
1.4 came out 2 days ago. You have something newer than that?
[Android Head-Units] ScottyMCSE:
No, I thought I did. I've had 1.4 for a few weeks now and didn't know they finally released it. Sorry for the confusion.

Scott
[Android Head-Units] Antd0g:
That was happening to mine until I did a total reset. Not from the red triangle but from in the Androids settings. Works great now.
[Android Head-Units] kwarwick:
Latest is 1.4 released 3 days ago. Do you have something newer version than that?
[Android Head-Units] sshams95:
Thanks, I'll give that a try!
[Android Head-Units] kwarwick:
Sorry, didn't see the dozen people asking the same question before... :eek:

Now on to the real issue... how to root these beasts? I believe doing so via a hacked/modified firmware upgrade is the way to go, but it comes down to the risks involved and how to recover if things go bad? I'd really like to have a complete backup I could restore back from just in case. These are still expensive little devices (although I see refurbished models on eBay in the $600 range now)... I think the risk/reward ratio is what is keeping anyone from trying at this point.
[Android Head-Units] donaldta:
I noticed that the firmware updates for this unit isn't encrypted and its contents can be uncompressed using 7-zip. Since it seems that none of you have ever had experience rooting an Android device before, then perhaps you might consider getting in contact with [MENTION=531561]WonderEkin[/MENTION]. He had recently assisted my friends in another thread for the AN-21 U in obtaining root. I'm not sure how much is possible considering your unit seems pretty well locked down, but it would hurt to bounce some questions or ask for some advice.
[Android Head-Units] pdanders11:
I don't have the source in front of me but keyboard, LCD panel, and gpio are the ones I remember that are built standalone. I'll have to see about the kernel.

The chromium source was and still is something I know little about in a Android environment. The code it's 2-3 years old per copyright so what the chromium team is doing today vs then is hard to connect the little i looked.

I don't see board specific bootloader code. Either it was missed or it's running stock tcc8800 evm
[Android Head-Units] radux.m.dan:
Hi pdanders11,

You are actually writing the boot partition, I'm 100% sure. The point is that we have the quick boot option active on this unit and it will just resume from the ram backup partition which is ndda11. You need to trigger a system rebuild which will actually reconstruct the RAM image.

To trigger the rebuild you need to use the stock recovery and just reboot in recovery mode (it's done automatically).

I had the same issue when I flashed the boot image with an unsecured version (changed default.prop). I was booting the unit and my changes were not reflected, then I realized the unit is just resuming not really cold boot.

Hope this helps. Cheers!
[Android Head-Units] pdanders11:
Thank you. I did flash stock recovery but it won't kick off a rebuild. It just reboots again, again, again, again, and the dies.

Stock recovery flashes on the screen briefly but not for long. I was wondering if my system partition "recovery/recovery-from-boot.p" and "recovery/etc/install-recovery.sh" modifications (renaming) is preventing the rebuild. I haven't gotten system mount again to fix this and my system image probably was after I renamed the files.

I have 2nd unit I can take the system image from, I just haven't had a chance. Do you think that is the issue? i can still get in the unit with your recovery over adb. I figure I can mount system in your recovery also. I just haven't found the right command.
[Android Head-Units] radux.m.dan:
I will release a new version for recovery that you can use to apply the zip file if you want or just mount any partition you like from the menu or from ADB shell with mount command.

---------- Post added at 12:37 PM ---------- Previous post was at 12:35 PM ----------

By the way, I forgot to mention, you can use the update zip file and modify it in any way you want cause this is the nice part of the CWM, it will ask you if you want to install it even if it is not signed. So you can modify the install script and also the content of system folder to get a rooted unit right after the update process.