[Android Head-Units] dro1dy:
Thank you for those details. Mine has SYNC/BT _and_ a blue screen. I ordered mine from `NAVISTART` store but the PCB is marked `TOPWAY` so I think we have (more or less) the same unit and the same canbox. Perhaps the canbox does not differ from seller to seller and only differs from unit to unit or possibly from car to car?

It seems like all the canbox/MCU stuff is managed from

cardoor.cn.

When you select the make/model/year, you apparently download an APK:

GET /apk/tw-carchoose/202108/com.tw.car_00_41_0000_210812.apk HTTP/1.1
User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; ums512_1h10_Natv Build/QP1A.190711.020)
Host: cdn.mcu.cardoor.cn
Connection: Keep-Alive
Accept-Encoding: gzip

I have not looked further, but it looks like that APK contains the code needed to open UART to the canbox and flash the MCU with the can message definitions.

There are a few other things in this packet dump that are interesting:

```

POST /move/mcu/queryRelationConfig HTTP/1.1

Content-Type: application/json; charset=UTF-8

Charset: UTF-8

Content-Length: 169

User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; ums512_1h10_Natv Build/QP1A.190711.020)

Host: api.mcu.cardoor.cn

Connection: Keep-Alive

Accept-Encoding: gzip

{"appid":"dfsgherthdfghkj6o78tdftyw4uyrtyj","id":"300","language":"en-US","level":"1","ratio":"3","remark":"2","resourcesId":"","sig":"e8d2640269eb7148ad6a266133563355"}HTTP/1.1 200 OK

Server: Tengine

Content-Type: application/json;charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Date: Fri, 05 Nov 2021 01:25:34 GMT

Via: cache43.l2cn1850[78,0], cache7.us11[323,0]

Timing-Allow-Origin: *

EagleId: 0830559b16360755346362101e

{"code":"CD000001","msg":"............","body":{"appRelationConfigList":[{"configJson":"","cipherStatus":"","level":"1","configId":"000","name":"00: General","rank":106,"logo":null,"remark":"2","id":"10016502","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"203","name":"03: Simple Soft","rank":99,"logo":null,"remark":"2","id":"10010980","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"213","name":"13: BINARY","rank":100,"logo":null,"remark":"2","id":"10014461","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"202","name":"02: Raise","rank":105,"logo":null,"remark":"2","id":"10010595","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"210","name":"10: Raise(special)","rank":104,"logo":null,"remark":"2","id":"10014130","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"101","name":"01: Hiworld","rank":103,"logo":null,"remark":"2","id":"10010484","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"204","name":"04: OuDi","rank":98,"logo":null,"remark":"2","id":"10013664","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"205","name":"05: XingBaSi","rank":97,"logo":null,"remark":"2","id":"10013869","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"206","name":"06: DaoJun","rank":96,"logo":null,"remark":"2","id":"10014053","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"207","name":"07: AnSheng","rank":95,"logo":null,"remark":"2","id":"10014073","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"208","name":"08: HuaChenYu","rank":94,"logo":null,"remark":"2","id":"10014092","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"209","name":"09: BaShiDa","rank":93,"logo":null,"remark":"2","id":"10014128","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"211","name":"11: ChangYuanTong","rank":92,"logo":null,"remark":"2","id":"10014285","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"212","name":"12: BaGu","rank":91,"logo":null,"remark":"2","id":"10014291","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"214","name":"14: LuZheng","rank":90,"logo":null,"remark":"2","id":"10014819","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"215","name":"15: HeChi","rank":89,"logo":null,"remark":"2","id":"10014870","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"217","name":"17: XinFeiYang","rank":88,"logo":null,"remark":"2","id":"10017021","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"218","name":"18: RuiShengWei","rank":87,"logo":null,"remark":"2","id":"10017375","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"220","name":"20: PCBA","rank":85,"logo":null,"remark":"2","id":"10032214","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"221","name":"21: Bao Shijie","rank":84,"logo":null,"remark":"2","id":"10039500","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"222","name":"22: IR Protocol","rank":83,"logo":null,"remark":"2","id":"10041763","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"223","name":"23: PengHui","rank":82,"logo":null,"remark":"2","id":"10043152","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"226","name":"26: XinChengChuangXin","rank":81,"logo":null,"remark":"2","id":"10046240","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"224","name":"24: TD","rank":81,"logo":null,"remark":"2","id":"10044859","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"225","name":"25: ZhiXing","rank":80,"logo":null,"remark":"2","id":"10045413","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"227","name":"27: BaoXunFeng","rank":79,"logo":null,"remark":"2","id":"10046699","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"229","name":"29: Fuhang","rank":78,"logo":null,"remark":"2","id":"10047373","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"228","name":"28: Mi Xun","rank":78,"logo":null,"remark":"2","id":"10047114","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"230","name":"30: CW","rank":76,"logo":null,"remark":"2","id":"10047855","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"231","name":"31: GOLDEN DRAGON","rank":75,"logo":null,"remark":"2","id":"10049919","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"232","name":"32: SANY HEAVY INDUSTRY CO., LTD.","rank":74,"logo":null,"remark":"2","id":"10050050","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"234","name":"34: ......","rank":73,"logo":null,"remark":"2","id":"10051144","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"233","name":"33: Keyichuang","rank":73,"logo":null,"remark":"2","id":"10050795","superId":"2","type":0},{"configJson":"","cipherStatus":"","level":"1","configId":"219","name":"19: No protocol","rank":72,"logo":null,"remark":"2","id":"10026521","superId":"2","type":0}]}}POST /move/mcu/queryRelationConfig HTTP/1.1

Content-Type: application/json; charset=UTF-8

Charset: UTF-8

Content-Length: 181

User-Agent: Dalvik/2.1.0 (Linux; U; Android 10; ums512_1h10_Natv Build/QP1A.190711.020)

Host: api.mcu.cardoor.cn

Connection: Keep-Alive

Accept-Encoding: gzip

{"appid":"dfsgherthdfghkj6o78tdftyw4uyrtyj","id":"300","language":"en-US","level":"2","ratio":"3","remark":"2_203","resourcesId":"10010980","sig":"fdf4bf3d1d7892c2644da5d8c34d5c71"}

And the themes (for the primary launcher app) seem to come from here:

POST /themeoverseas/getCarThemeList HTTP/1.1

Charset: UTF-8

Origin-flag: car

Content-Type: application/json; charset=utf-8

Content-Length: 432

Host: overseas.theme.dofuncar.com:9198

Connection: Keep-Alive

Accept-Encoding: gzip

User-Agent: okhttp/3.12.12

{"appid":"jasbfnweofghsbvasdhgoanglkahpobihak","business":"downloads","carSystem":"common","currPage":"1","imeiTwo":"36395f43000f3232504d4d3503001eb6","language":"en_US","pageSize":"14","pipLabel":"true","platForm":"ums512_1h10_Natv","pluginLabel":"true","projectName":"overseastheme","screen":"2","sig":"e16e0bbfd1feefcd3b6dc5c4b0e7755e","supdChannel":"theme","supdCode":"theme","themeVersion":"90","varBusiness":"user_auth_theme"}HTTP/1.1 200

Server: nginx/1.6.2

Date: Fri, 05 Nov 2021 02:30:05 GMT

Content-Type: application/json;charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

{"code":"CD000001","msg":"............","body":{"resultPage":{"currPage":"1","totalPage":"2","pageSize":"14","totalRec":"25","nextFlag":"0"},"resultList":[{"previewAddress":["http://overseas.cdn.cardoor.cn/theme/202110/20211015100154/1634263147675.jpg"],"pckageCode":"21","themeName":"distance","themeStt":"00","price":null,"themeVersion":null,"themeId":"20211015100154","iconAddress":"http://overseas.cdn.cardoor.cn/theme/202110/20211015100154/1634263136643.jpg","time":"20211015100205"},{"previewAddress":["http://overseas.cdn.cardoor.cn/theme/202110/20211020105912/1634698698794.jpg"],"pckageCode":"252","themeName":"Qingying","themeStt":"00","price":null,"themeVersion":null,"themeId":"20211020105912","iconAddress":"http://overseas.cdn.cardoor.cn/theme/202110/20211020105912/1634698691234.jpg","time":"20211020105925"},{"previewAddress":["http://overseas.cdn.cardoor.cn/theme/202110/20211027101124/1635300645317.png"],"pckageCode":"58","themeName":"Buddha","themeStt":"00","price":null,"themeVersion":null,"themeId":"20211027101124","iconAddress":"http://overseas.cdn.cardoor.cn/theme/202110/20211027101124/1635300640752.png","time":"20211027101131"},{"previewAddress":["http://overseas.cdn.cardoor.cn/theme/202110/20211018163824/1634546240483.jpg"],"pckageCode":"75","themeName":"Secret_test","themeStt":"00","price":null,"themeVersion":null,"themeId":"20211018163824","iconAddress":"http://overseas.cdn.cardoor.cn/theme/202110/20211018163824/1634546231946.jpg","time":"20211018163829"},{"previewAddress":["http://overseas.cdn.cardoor.cn/theme/202110/20211021153351/1634801613138.jpg"],"pckageCode":"56","themeName":"Glasstexture","themeStt":"00","price":null,"themeVersion":null,"themeId":"20211021153351","iconAddress":"http://overseas.cdn.cardoor.cn/theme/202110/20211021153351/1634801608980.jpg","time":"20211021153359"},{"previewAddress":["http://overseas.cdn.cardoor.cn/theme/202111/20211103143239/1635921085732.jpg"],"pckageCode":"90","themeName":"Apollo","themeStt":"00","price":null,"themeVersion":null,"themeId":"20211103143239","iconAddress":"http://overseas.cdn.cardoor.cn/theme/202111/20211103143239/1635921080244.jpg","time":"20211103143248"},{"previewAddress":["http://overseas.cdn.cardoor.cn/theme/202109/20210826193311/1631152841712.jpg"],"pckageCode":"138","themeName":"Goldenyears","themeStt":"00","price":null,"themeVersion":"NaN","themeId":"20210826193311","iconAddress":"http://overseas.cdn.cardoor.cn/theme/202109/20210826193311/1631152834420.jpg","time":"20210826193327"},{"previewAddress":["http://overseas.cdn.cardoor.cn/theme/202109/20210826193932/1631154773306.jpg"],"pckageCode":"26","themeName":"TombRaider","themeStt":"00","price":null,"themeVersion":"NaN","themeId":"20210826193932","iconAddress":"http://overseas.cdn.cardoor.cn/theme/202109/20210826193932/1631154761383.jpg","time":"20210826194033"},{"previewAddress":["http://overseas.cdn.cardoor.cn/theme/202109/20210826194608/1631153591513.png"],"pckageCode":"143","themeName":"SongintheCloud","themeStt":"00","price":null,"themeVersion":"NaN","themeId":"20210826194608","iconAddress":"http://overseas.cdn.cardoor.cn/theme/202109/20210826194608/1631153585585.png","time":"20210826194655"},{"previewAddress":["http://overseas.cdn.cardoor.cn/theme/202108/20210827093335/1630027984404.png"],"pckageCode":"138","themeName":"Aoyou","themeStt":"00","price":null,"themeVersion":"NaN","themeId":"20210827093335","iconAddress":"http://overseas.cdn.cardoor.cn/theme/202108/20210827093335/1630027980027.png","time":"20210827093438"},{"previewAddress":["http://overseas.cdn.cardoor.cn/theme/202109/20210917111242/1631848031357.jpg"],"pckageCode":"50","themeName":"Night","themeStt":"00","price":null,"themeVersion":null,"themeId":"20210917111242","iconAddress":"http://overseas.cdn.cardoor.cn/theme/202109/20210917111242/1631848024486.jpg","time":"20210917111302"},{"previewAddress":["http://overseas.cdn.cardoor.cn/theme/202110/20211019144643/1634625970408.jpg"],"pckageCode":"37","themeName":"Chinese-style","themeStt":"00","price":null,"themeVersion":"NaN","themeId":"20211019144643","iconAddress":"http://overseas.cdn.cardoor.cn/theme/202110/20211019144643/1634625959573.jpg","time":"20211019144654"},{"previewAddress":["http://overseas.cdn.cardoor.cn/theme/202110/20211023100014/1634954375097.jpg"],"pckageCode":"153","themeName":"astronaut","themeStt":"00","price":null,"themeVersion":null,"themeId":"20211023100014","iconAddress":"http://overseas.cdn.cardoor.cn/theme/202110/20211023100014/1634954370112.jpg","time":"20211023100023"},{"previewAddress":["http://overseas.cdn.cardoor.cn/theme/202110/20211016100658/1634349965476.jpg"],"pckageCode":"11","themeName":"Longing","themeStt":"00","price":null,"themeVersion":null,"themeId":"20211016100658","iconAddress":"http://overseas.cdn.cardoor.cn/theme/202110/20211016100658/1634349960247.jpg","time":"20211016100706"}]}}POST /themeoverseas/getCarThemeDetails HTTP/1.1

Charset: UTF-8

Origin-flag: car

Content-Type: application/json; charset=utf-8

Content-Length: 402

Host: overseas.theme.dofuncar.com:9198

Connection: Keep-Alive

Accept-Encoding: gzip

User-Agent: okhttp/3.12.12

{"appid":"jasbfnweofghsbvasdhgoanglkahpobihak","business":"time","imeiTwo":"36395f43000f3232504d4d3503001eb6","language":"en_US","pipLabel":"true","platForm":"ums512_1h10_Natv","pluginLabel":"true","projectName":"overseastheme","screen":"2","sig":"89ea72b0b2b961c0506ab902ec2cd2dc","supdChannel":"theme","supdCode":"theme","themeId":"20210831151547","themeVersion":"90","varBusiness":"user_auth_theme"}HTTP/1.1 200

Server: nginx/1.6.2

Date: Fri, 05 Nov 2021 02:30:13 GMT

Content-Type: application/json;charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

{"code":"CD000001","msg":"............","body":{"address":null,"theme":{"previewAddress":["http://overseas.cdn.cardoor.cn/theme/202108/20210831151547/1630394343382.jpg"],"pckageCode":"17","themeName":"Goodluck","themeStt":"00","price":null,"themeVersion":"NaN","themeId":"20210831151547","iconAddress":"http://overseas.cdn.cardoor.cn/theme/202108/20210831151547/1630394339120.jpg","time":"20210831151637"},"payStatus":null}}POST /themeoverseas/getUserVipTime HTTP/1.1

Charset: UTF-8

Origin-flag: car

Content-Type: application/json; charset=utf-8

Content-Length: 357

Host: overseas.theme.dofuncar.com:9198

Connection: Keep-Alive

Accept-Encoding: gzip

User-Agent: okhttp/3.12.12

{"appid":"jasbfnweofghsbvasdhgoanglkahpobihak","imeiTwo":"36395f43000f3232504d4d3503001eb6","language":"en_US","pipLabel":"true","platForm":"ums512_1h10_Natv","pluginLabel":"true","projectName":"overseastheme","screen":"2","sig":"958f2b40fb0cc79e52196ffffe8c315b","supdChannel":"theme","supdCode":"theme","themeVersion":"90","varBusiness":"user_auth_theme"}HTTP/1.1 200

Server: nginx/1.6.2

Date: Fri, 05 Nov 2021 02:30:21 GMT

Content-Type: application/json;charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

{"code":"CD001009","msg":"....................................","body":null}HTTP/1.1 200

Server: nginx/1.6.2

Date: Fri, 05 Nov 2021 02:30:21 GMT

Content-Type: application/json;charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

{"code":"CD001009","msg":"....................................","body":null}

Hopefully somebody finds those URLs/endpoints useful.

I don't know much about android internals, but downloading an APK over HTTP and then executing that APK to flash the canbox seems like potential avenue for rooting things. Inject your own APK and if the process on the head unit runs the APK as a system level user, the injected APK sould also get system level permissions, right?