[Android Head-Units] sloory:
I took a look in the decompiled code to get all "factory" codes:

if (charSequence.equalsIgnoreCase("1122")) {
FactoryPasswordManager.enableLogFun(this.mContext);

} else if (charSequence.equalsIgnoreCase("2211")) {
FactoryPasswordManager.disableLogFun(this.mContext);

} else if (charSequence.equalsIgnoreCase("1212")) {
FactoryPasswordManager.copyLogToUSB(this.mContext, this.mHandler);
} else if (charSequence.equalsIgnoreCase("2121")) {
FactoryPasswordManager.showLogUploadDialog(this.mContext);
} else if (charSequence.equalsIgnoreCase("111222")) {
FactoryPasswordManager.onSprdLog(this.mContext);
} else if (charSequence.equalsIgnoreCase("112233")) {
FactoryPasswordManager.showSimState(this.mContext);
} else if (charSequence.equalsIgnoreCase("332211")) {
FactoryPasswordManager.showCPUTempInfo(this.mContext);
} else if (charSequence.equalsIgnoreCase("336699")) {
FactoryPasswordManager.showTPVersion(this.mContext);
} else if (charSequence.equalsIgnoreCase("996633")) {
FactoryPasswordManager.exportTPConfig(this.mContext);
} else if (charSequence.equalsIgnoreCase("114477")) {
FactoryPasswordManager.enableOrDisableDevelopment(this.mContext);
} else if (charSequence.equalsIgnoreCase("774411")) {
FactoryPasswordManager.enableMcuUpgradeLimit();
} else if (charSequence.equalsIgnoreCase("8888")) {
FactoryPasswordManager.onFactorySetting(this.mContext, 1);
} else if (charSequence.equalsIgnoreCase("2687016")) {
FactoryPasswordManager.onFactorySetting(this.mContext, 2);
} else if (charSequence.equalsIgnoreCase("225588")) {
FactoryPasswordManager.onFactoryReset(this.mContext, false);
} else if (charSequence.equalsIgnoreCase("22558800")) {
FactoryPasswordManager.onFactoryReset(this.mContext, true);
} else if (charSequence.equalsIgnoreCase("4455")) {
FactoryPasswordManager.onEngineerMode(this.mContext);
} else if (charSequence.equalsIgnoreCase("456456")) {
FactoryPasswordManager.onValidationTools(this.mContext);
} else if (charSequence.equalsIgnoreCase("5544")) {
FactoryPasswordManager.onSGPS(this.mContext);
} else if (charSequence.equalsIgnoreCase("555666")) {
FactoryPasswordManager.onTest(this.mContext, false);
} else if (charSequence.equalsIgnoreCase("6655")) {
FactoryPasswordManager.onTest(this.mContext, true);
} else if (charSequence.equalsIgnoreCase("789789")) {
FactoryPasswordManager.onCanDebug(this.mContext);
} else if (charSequence.equalsIgnoreCase("777888")) {
FactoryPasswordManager.onTxznet(this.mContext);
} else if (charSequence.equalsIgnoreCase("778899")) {
FactoryPasswordManager.onDevice(this.mContext, true);
} else if (charSequence.equalsIgnoreCase("998877")) {
FactoryPasswordManager.onDevice(this.mContext, false);
} else if (this.mTvPwd.getText().toString().equals("45645600")) {
FactoryPasswordManager.onMcuOnlineUpgrade(this.mContext, this.mTvPwd.getText().toString());
} else if (this.mTvPwd.getText().toString().equals("12457800")) {
FactoryPasswordManager.onMpuMode(this.mContext, false);
} else if (this.mTvPwd.getText().toString().equals("87542100")) {
FactoryPasswordManager.onMpuMode(this.mContext, true);
} else if (this.mTvPwd.getText().toString().equals("15935700")) {
FactoryPasswordManager.useSleepModeSet(this.mContext);
}

When going through the layout xml, I came across some settings that are currently hidden:

<LinearLayout android:visibility="gone" style="@style/list_item_bg_and_split_layout_style">
<com.qf.carsettings.view.HeaderLayout android:id="@id/factory_backlight_set" android:layout_width="wrap_content" android:layout_height="wrap_content" app:item_password_level="2" app:item_style="@integer/item_style_only_one_button" app:item_subTitle="@string/str_backlight_set" />
<com.qf.carsettings.view.HeaderLayout android:id="@id/factory_sound_channel_gain_set" android:layout_width="wrap_content" android:layout_height="wrap_content" app:item_password_level="2" app:item_style="@integer/item_style_left_right_button" app:item_subTitle="@string/str_sound_channel_gain" />
<com.qf.carsettings.view.HeaderLayout android:id="@id/factory_app_select_set" android:layout_width="wrap_content" android:layout_height="wrap_content" app:item_has_split_line="true" app:item_style="@integer/item_style_only_one_button" app:item_subTitle="@string/str_app_select" />
<com.qf.carsettings.view.HeaderLayout android:id="@id/factory_language_select_set" android:layout_width="wrap_content" android:layout_height="wrap_content" app:item_has_split_line="true" app:item_style="@integer/item_style_only_one_button" app:item_subTitle="@string/str_language_select" />
<com.qf.carsettings.view.HeaderLayout android:id="@id/factory_amp_switch_set" android:visibility="gone" android:layout_width="wrap_content" android:layout_height="wrap_content" app:item_has_split_line="true" app:item_style="@integer/item_style_only_checkbox" app:item_subTitle="@string/str_amp_control" />
<com.qf.carsettings.view.HeaderLayout android:id="@id/factory_usb_for_dvr_set" android:visibility="gone" android:layout_width="wrap_content" android:layout_height="wrap_content" app:item_has_split_line="true" app:item_style="@integer/item_style_two_radiobutton" app:item_subTitle="@string/str_usb_interface_for_dvr" app:item_two_button_left="@string/str_dvr_use_usb1" app:item_two_button_right="@string/str_dvr_use_usb2" />
</LinearLayout>

Notably the factory_sound_channel_gain_set I would like to control, as I have a external amplifier in my car and thus the output signal is too loud. Even when setting the "power volume" to the lowest setting (-15dB).

Recompiling and reinstalling failed unfortunately. Does anyone have this setting available?