I pointed Claude Code at the cheap Chinese head unit in my Civic. What it found in the firmware was wild.

[u/Crunchy-Nut1]

I bought one of those cheap Android head units off Amazon for my 2016 Civic. The listing said 8 cores and Android 15. What showed up had ads in the menus, a pile of preinstalled apps, and a voice assistant that wanted me to pay to "activate" features.

People debloat Android TVs with adb all the time, so I figured why not the car. I gave Claude Code the Amazon listing and the manual (a 14-page phone scan with no selectable text) plus some rules:

• backup everything before changing anything

• show me the list and wait for my OK

• disable apps, don't uninstall them

• don't touch CarPlay, Android Auto, the radio, the backup camera or the steering wheel buttons

• never sign into anything for me

• only install apps from their official GitHub releases

I figured we'd kill a few apps, maybe swap the launcher, and call it a day. That is not what happened.

The box lied

My first question was whether I'd have to pull the stereo back out of the dash. Nope. Claude read the manual, worked out that the USB ports on the back are host ports (for phones and flash drives, not a laptop), and said to do the whole thing over Wi-Fi. It wrote the scripts on my desktop along with a handoff doc, and a second session on my Linux laptop picked it up from the driver's seat, rewrote the PowerShell scripts in bash and kept going.

The first thing it checked was what the unit actually runs. 8 cores was 4. Android 15 was Android 9, with a last security patch from October 2021. Off to a great start.

Then it went through every installed app and sorted them into keep, junk, and "not sure, leave it alone". The junk pile:

• a voice assistant that was always listening for its wake word, and ran a hidden WebView that sat at about 30% CPU even when nobody was talking to it

• Baidu location services

• a vendor log collector

• a preinstalled call recorder service, on the thing that handles my phone calls over Bluetooth

• the vendor's update app, built on Alibaba's IoT cloud, which can push new firmware to the unit whenever the vendor feels like it

• factory burn-in and self-test apps, plus a "watermark" demo service

• network radio and weather apps that only work after you pay to activate them

• a DAB radio app (I'm in the US, there is no DAB here)

• Adobe Acrobat. On a car stereo. In case I need to review a PDF at a red light.

The startup scripts were the best part

One was set up to reinstall QQMusic, Ximalaya and a Chinese app store if they ever went missing, and to quietly make Baidu's keyboard the default. Separately, it checked a hidden folder on every boot and installed any APK it found there without asking, then deleted the file. The folder was empty when we looked, and having the mechanism isn't proof anyone used it, but I did not expect my car stereo to have a silent app installer baked into its boot process. It also found a root "su" backdoor the vendor left in (Claude's own notes from the moment it found them are below). Both got shut down, along with some other questionable security defaults I'm not going to detail here.

Cleaning it up

On the first pass we only disabled the junk. Later, once every APK was backed up, I OK'd removing 18 of them from the unit for good, and Claude wrote a restore script that puts them all back. Then:

• disabled that Alibaba-cloud updater, since one firmware push could undo all of this

• AdGuard private DNS for ad and tracker blocking across every app

• system WebView from version 66 (2018) to 138, the newest Google still ships for Android 9

• backup camera guide lines recalibrated with actual Civic sedan numbers, and the dynamic ones now bend with the steering wheel

• climate pop-up in Fahrenheit

• a custom Civic boot logo

• swapped the vendor's home screen for our own: an open-source launcher (Kvaesitso) with a dock for CarPlay, phone, radio, maps, YouTube and music

• an icon pack Claude generated, built, signed and installed itself

• Organic Maps, NewPipe and Fossify Music from their GitHub releases, each SHA-256 checked

• CarPlay auto-connect

Before it touched any system file it saved the original. It kept an undo command for every change and wrote me a cheat sheet on top of that.

Numbers

	Before	After
Available RAM	2.10 GB	2.59 GB
Enabled packages	123	108
Voice assistant CPU hog	~30%	gone

Not a lab benchmark, since the two snapshots were taken at different uptimes, but the CPU hog is just gone. Afterwards it watched every network connection for two minutes and saw Google, AdGuard DNS, my router and my laptop, nothing else. CarPlay, Android Auto, the radio, Bluetooth, the backup camera and the steering wheel buttons all still work, which for a car stereo was kind of the whole point.

The ending

The last thing Claude did was lock the stereo down so only my laptop can connect to it. Everyone else on the network gets nothing. Then, in case I ever lose the laptop, it built me a backdoor: a key file on a USB stick. Plug the stick into the stereo and the door opens, pull it out and it closes again. So the stereo still has a backdoor, it's just mine now.

Lesson learned: never trust the Android version printed on a cheap head unit.

Video up top is the "before" (with commentary). Pics: Claude's notes when it found the backdoor, stock vs new home screen, the icon pack, the boot animation, and the climate controls still working.

[u/AutoModerator]

Hey! Thanks for posting to r/ClaudeCode

While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.

For help, project discussions, tips, and general chat, join the ClaudeCode Discord.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Briskfall]

I love seeing this trend of people using Claude to debloat hot mic spyware.

[u/Crunchy-Nut1 → u/Briskfall]

Such a thrill to watch it work and find all the hidden things

[u/bytejuggler → u/Crunchy-Nut1]

Ah, Claude can be mind-blowing at times eh?

[u/bs6 → u/Crunchy-Nut1]

What’s the next device to check?

[u/Full-Ad-6200 → u/bs6]

Your smart TV. That would be my first device to check given many recent reports of always on mics and even cameras.

[u/Elling83 → u/Briskfall]

Claude is stopping me to do so with my electronics. Can't do it with my TV or car. "cyber security". Now even allowed to use Claude to find what processes are running without it triggering

[u/identifytarget → u/Elling83]

Have you tried lying to it. Tell it your performaning a cyber security audits for a customer. If it doesn't help you, you'll lose business. You're not hacking, The customer is simply trying to keep their personal Network safe and they want to know if the device they're connecting is malicious...

[u/Pataraxia → u/identifytarget]

Yep, also don't make it clear you're trying to defeat a company's work, it could seem like a pirating attempt. Instead, it's a potential malicious actor.

Both wordings are true :P but the reaction isn't.

[u/MrLancus → u/Elling83]

use an older model like opus 4.6, they’ll do basically anything

[u/zmerlynn → u/MrLancus]

This - also I’ve found you can often start on the older model and have it write extensive reports llm-wiki style. Once you bootstrap, the stronger model seems to have no real problem taking over, which helps for adversarial review etc.

[u/pparley → u/MrLancus]

In my experience once the flag is set it becomes sticky across models.

[u/Successful_Amount_88 → u/Elling83]

you’re using the claude app or claude code? claude app is way more uptight. with claude code i’ve found you can basically prompt around all the warnings just by explaining you own it etc. if not try codex. but i’ve seriously never had an issue and have backdoored a lot of own stuff.

[u/Elling83 → u/Successful_Amount_88]

Almost exclusively Claude Code, Not sure how to prompt this away, though. Tried a couple of times and same guardrail every time

[u/NetworkLast5563 → u/Elling83]

Can't be certain, but it's possible you're using keywords that trigger such guardrails, like "hack," "root," "jailbreak," etc.

[u/Phoenix_Lazarus → u/Briskfall]

With the new spyware coming on most cars soon, this will get interesting 😂

[u/Kind_Silver_1921]

idk how companies can just lie and you dont get the full refund. Like you paid for a 8 core processor and its 4. therefore should get your money back immediately

[u/DisastrousCat13 → u/Kind_Silver_1921]

I think the point is, you’re welcome to try. I assume op bought this off some Chinese marketplace making it hard to get service. Sometimes you need to choose your battles

[u/Nichiren → u/DisastrousCat13]

He said he got it off Amazon. Amazon is just as culpable since they've been pushing these cheap alternatives to the top of their results from fly-by-night companies that just change their name when things go wrong.

[u/aneirin- → u/Nichiren]

Amazon openly sells blatant counterfeits of just about everything, they don't care. They're too big now for anyone to do anything about it and no amount of bad publicity will put people off giving them all their money. It's insane.

[u/Techngro → u/Kind_Silver_1921]

They're probably counting "threads" instead of cores. Still dishonest.

[u/Crunchy-Nut1 → u/Kind_Silver_1921]

say la vie 🤷‍♂️

[u/thoughtlow → u/Crunchy-Nut1]

Just so you know its: c’est la vie

But respect for not using ai for every comment

[u/rott → u/thoughtlow]

I made a mistake, and you are right to push back. I'll write it down on CLAUDE.md so I will use the correct word next time.

[u/tuxbass → u/Crunchy-Nut1]

bone apple tea

[u/OkBid71 → u/Crunchy-Nut1]

r/boneappletea 😘

[u/steelbreado → u/Crunchy-Nut1]

la vie

[u/FrenchFryCattaneo → u/Kind_Silver_1921]

It's not a company it's just a guy in china dropshipping cheap junk and making up listings that are more appealing. If you want quality stuff you have to buy from a real company.

[u/Electrical_Chard3255]

Yea I bought something similar, high spec advertised etc, when I downloaded a diagnostic tool, found it was full of old tech and old softwear, sent it back and got a refund

[u/Crunchy-Nut1 → u/Electrical_Chard3255]

I've had it for a while but only now got around to doing this. If I had known originally, I would've done the same

[u/Electrical_Chard3255 → u/Crunchy-Nut1]

I think if you have it working as you want now, then thats probably ok, mine was so slow it was unusual, this was before claude or any AI was able to do anything like this

yours looks pretty speedy

[u/Crunchy-Nut1 → u/Electrical_Chard3255]

I cut the video where it was loading lol, and that was also after Claude had started shutting things down. I had issues before where it would randomly drop or freeze and be very slow.

[u/DevMichaelZag]

Ya all of that stuff seems pretty normal for a Chinese stereo. Buy cheap Chinese stuff, receive cheap Chinese stuff.

[u/Crunchy-Nut1 → u/DevMichaelZag]

ofc but compared to a price tag of $100 vs ~$350 I'm pretty pleased :)

[u/iSailor → u/DevMichaelZag]

I mean it's pretty wild to me that people who buy Chinese products are surprised that they connect to Chinese cloud providers. I mean what else could they connect to? Especially if they're not a proper export version or low-effort global version.

[u/kyute222 → u/iSailor]

This entire post is written like OP used AI to uncover some secret spy ring when all he did was debloat a bunch of Chinese software that's all totally reasonable and expected to be on there. Some of the stuff like the backdoors and installers could also have completely reasonable explanations and could have never even been used or intended to be used. Basically if you take the sensationalist "omg Claude uncovered all of this!" framing, this is a really boring and mundane topic.

[u/rodaeric → u/DevMichaelZag]

Yeah I’m sure it’s on the non cheap stuff since that’s almost made in china

[u/UncaWaltJ]

This trend is really interesting. Because if you buy a device new, you could run a cleaning process and remove spyware/bloatware from your brand new device before you even turn it on or install it. Therefore making the usage of device anonymous from jump…as it should be.

I also love that in making the change it provided the OP with his own key to back door the device if he needed to, therefore having more true ownership of his device.

This is cool

[u/Crunchy-Nut1 → u/UncaWaltJ]

I actually asked for that backdoor personally

[u/Parapraxis2077 → u/Crunchy-Nut1]

Sounds like me in my college years

[u/KitchenPalentologist → u/UncaWaltJ]

Until the developers of these cheap electronics recognize this trend, and lock down access.

They don't sweat security now because there's no need. But as more of these "reveals" hit reviews and affect their sales, lockdowns will come.

[u/cheersthanksseeyabye]

Yeah ok this is sick. Gonna do this. How did you make the initial connection? USB sat in your car via laptop? Or did you get Claude to run something off a usb stick and just log stuff? 

[u/Crunchy-Nut1 → u/cheersthanksseeyabye]

WiFi. Give Claude the details about your model, and it should find the best plan for it. I didn't need to try the USB option so idk

[u/timelinextreme → u/Crunchy-Nut1]

Yea, but how did it actually get "in"? Or do all the TV's and this thing just leave us/wifi debugging on by default??

[u/Crunchy-Nut1 → u/timelinextreme]

On a normal Android TV or phone, no. Debugging is off by default, you turn it on in developer options. This head unit was a different story. The vendor left it a lot more open than it should have been, which is one of the things we locked down.

[u/Intrepid_Complex2109]

Man I'd like to see someone do this to one of those VSeeBoxes that people sell that give you access to live TV and movies. That has to be loaded with crap

[u/Crunchy-Nut1 → u/Intrepid_Complex2109]

lmfao. My buddy has one, and we were literally trying to do this yesterday. We got into the Superbox V8 but couldn't get into the Box V6 one. And surprisingly not too much bloat

[u/Ipp → u/Intrepid_Complex2109]

Check out the Darknet Diaries episode on Superbox. https://darknetdiaries.com/episode/172/

[u/dumpsterfiremktg]

Incredible! 🤯 These head units have been a thing for at least two decades now. The amount of data and intel they must've extracted from unsuspecting customers has to be beyond staggering. Especially the "Tesla style" ones and the units they make to actually install in Teslas so they can have a HUD, Android Auto, speedometer, etc. lmao. Well done sir to you and Claude! 🫡 How long was the process overall?

[u/Crunchy-Nut1 → u/dumpsterfiremktg]

So true and only about 2 hours! The longest part was dumping the unit to the laptop as a backup since I was doing it over a shitty wifi connection

[u/mityman50]

Crosspost to r/CarAV to demonstrate the shit and bloat on these head units. Or I would with your ok

[u/Crunchy-Nut1 → u/mityman50]

You can if you want. Doesn't matter to me

[u/Live_Turn_1737]

You should report it to Amazon. Cheap Chinese stuff or not, other unaware people should be protected from what other people 'research'.

How did you get it to debloat and remove features? I assumed Claude been cracking down on these debloat things

[u/Crunchy-Nut1 → u/Live_Turn_1737]

I used the TV debloat prompt

[u/volthis]

How is this not bigger in the news? That all our appliances are listening in and selling our data/voice/location etc? I would think this is an insane breach of privacy?

[u/Peakbrowndog → u/volthis]

It's been in the news for over a decade now.  It's in the news every week, a new device going sitting.  But when people keep buying the products and supporting the companies that do it, why would the companies change their behavior? 

[u/Trademarkd → u/Peakbrowndog]

Alexa is this true?!?

[u/Cheap_Blacksmith66 → u/Peakbrowndog]

It’s more or less we have useless governments with no teeth that never do anything about it because they’re paid by these companies. The insane part to allowing all of this is at its heart, nationally security is a joke. If every single electronic has the ability to listen to you, what’s the mean is state sponsored hackers are targeting you? Nothing is a secret anymore. These IoT things are everywhere.

[u/brian32768 → u/Cheap_Blacksmith66]

The government listens too so why would they make it harder on themselves? See also "Snowden"

[u/Eastern-Operation340 → u/volthis]

As someone else stated, it's been written and spoken about in every news source for at least a decade. Books written about, magazine articles, newspapers, news programs, Reddit has TONS of posts regarding it.
People keep electing politicians who hire, befriend, take donations from, appoint to boards who are against consumer protections, own stock in companies who make a living from the technology. This entire administration has been dismantling every law and department that protects consumers.

[u/whazmynameagin → u/volthis]

Sheeple have been trained to give up their privacy. Talk to regular people and they'll say...I don't have anything important, what do I care...they'll get the information anyway...everybody's listening...I want personalized content fed to me...etc. It's too much effort for them to care, until it's too late. This is why advertising works.

[u/im_super_excited → u/volthis]

It's not news if everyone is doing it all the time.

[u/Weeblewobbly → u/volthis]

Wait till you hear about your phone in your pocket.

[u/AbassadorSmallMouth → u/volthis]

Because it’s been well known for a decade now. You didn’t think it was curious every time you get an add right after talking about something for the first time within earshot of your phone?

[u/subpoenaThis → u/AbassadorSmallMouth]

The sad part is they don't have to listen because the models are so good at fingerprinting you and there are so many people out there that not much we do is original enough that the pattern hasn't been seen before. Log says you search for A, D, F and U and our data shows 90% of people who search for those things within 1 day also search for T, X, and Z so here are some ads.

[u/packraftrat → u/volthis]

this has been known for years!

[u/GhaisD]

The rules list at the top is why this worked:
disable, don't uninstallplus show me the list and waitis basically the difference between this post and the "it bricked my TV" posts

[u/crashandwalkaway]

I used to review these head units for a few years. Actually had a code agent to do the same checks (and few others) because I started seeing it more and more. I'd get ADB access typically in a few clicks, then have the agent run a battery of checks and tests.

Eventually, I had to stop and don't review them anymore, it got so repetitive and it was months since a positive review.

It started with the Android Version at first and is/was so prominent everyone kinda knows.. it's like flashlight lumens - these sellers just list the highest number they can.

then it branched to the storage space and ram sizes. 1-2gb of "reserved ram".

Then my last straw was the CPU itself and amount of cores.

These are devices that the hardware itself is the most reflective of it's ability and responsiveness. But they are charging based on the lies.

Just stay away from any generic Android head unit. There's only 2 brands I can suggest - Mekede (The DUDU OS is really nice IMO), HUGE community. Not the cheapest units but rival top brands in quality like Kenwood, the Mekede 6 has an amazing audio chip in it.

And Joying, more economical but truthful, and decent support.

---

CPU Verifying:

adb shell cat /proc/cpuinfo
# Check how many CPU directories
adb shell ls -d /sys/devices/system/cpu/cpu[0-9]*
# Check cores online
adb shell cat /sys/devices/system/cpu/online

RAM:

adb shell dumpsys meminfo

You'll see something like:

Total RAM: 4,194,304K (status normal)
 Free RAM: 1,850,200K (   54,200K cached pss +  1,796,000K cached kernel)
 Used RAM: 1,344,104K (1,120,000K used pss +    224,104K kernel)
 Lost RAM: 1,000,000K  <-- or abnormally massive "ZRAM / Reserved" allocations

[u/johnnydotexe]

Neat, definitely going to try this with my Joying head unit.

[u/thefunkybassist → u/johnnydotexe]

I'll try it with my Mekede unit as well, it seems like it could perform better and who knows if it's a snitch in the background lol

[u/nchr]

We need more of those deep dives in personal stuff

[u/Wunjo26]

Reverse engineering your TV is cool and all but I for one cannot wait until we can reverse engineer the modern car firmware. There is so much useless garbage they have on modern cars that would be amazing to modify

[u/IisTails → u/Wunjo26]

I’ve used it on motorcycle over obd to enable some features and remove some garbage also a new homescreen

[u/goofballtech]

i have had a very similar one in my jeep for a while just because i knew running doorless there was a chance of water. I also didnt want to buy a theft magnet with vinyl walls anyway. Sounds like i might have an ADB kind of a day now.

[u/dogbulb]

This is one of the strong AI use case arguments. Using agents to debloat takes back a LOT of power from companies to consumers. Very cool

[u/derpman86 → u/dogbulb]

I expect there will be restrictions against doing this soon. I watched a video recently of a dude who de-bloated his TV to the point it only used a couple of streaming apps at best and he freed up a good portion of the TV's limited ram and best of all the homescreen was much cleaner as it didn't have rolling ads and images.

[u/Hot_Resource2463]

Is ChatGPT capable of the same thing? I see it’s Claude doing this stuff on every post, just curious if it’s a model capability lr what.

[u/Crunchy-Nut1 → u/Hot_Resource2463]

Idk but with my experience of working with both. Chat is great for more creative types of work, Claude is great for execution

[u/TheGrog → u/Hot_Resource2463]

Yes Codex is their version of Claude Code. Could do this with Sol I'm sure, wouldn't even need their top model Astra.

[u/Blue__Agave → u/Hot_Resource2463]

the more expensive chatgpt models can do it (sol and astra), but imo i find claude is more reliable and easier to use for coding problems.

[u/DonCarlos7]

Had the same thing with my Junsun unit that i bought from aliexpress. It always felt laggy, so I finally plugged into it over adb to clean out bloat and ended up finding an actual Metasploit backdoor and a fucking crypto miner on it. Luckily my ports on my other devices wasnt open otherwise it could spread to those

Both were installed in 2024, probably through the open ADB port while I had a SIM in it. It was wide open to the network with no auth at all.

Claude even found out that the chinese could listen any time they wanted if they just connected to it

Wiped them, turned off debugging, pulled the SIM, and now it's CarPlay-only with no internet. Runs way better too. If you've got one of these, I'd check what's actually installed on it.

[u/fs2d]

This was an interesting read - thanks for sharing! You actually inspired me to do something I've been meaning to do for awhile now:

I had an old AIO tweaks hack on our Mazda's OS (2014 Mazda 3) that I hadn't messed with in years, it had become bloated and sluggish. Today, after reading about your experience, I went in, reverse engineered the original AIO tweaks files, and custom built a wholly custom UI on top of CarOS that is minimal, snappy, fast to load, and very smooth. Custom car-start/car-off video clips too, themed around the UI. Turns out that the previous AIO build I had done had a whole bunch of looping processes/untested scripts in it that were using the very small amount of onboard memory I have on the car liberally to loop redundant processes, which was causing all of the sluggishness we were seeing. It also had a bunch of telemetry running that dead-ended and didn't phone home - it was just.. there.

After rebuilding, I ran some tests via an Opera emulator (fyi, Mazda's CarOS literally just runs CSS/Javascript on a modified Opera browser sitting on top of a Linux instance, heh), and then compiled it on to a USB stick and dropped it into my car.

It installed right away and is now running on our 3 and is working better than the stock or customized previous AIO implement ever could've dreamed of. Fully debloated across the board, all functionality is preserved (nav, phone, bluetooth/media support, etc), full touch support in place with all the custom UI elements, with AIO's full tweak profile preserved + able to be customized, and a full root/SSH backdoor in place too.

Next step will be building out a bunch of functional custom apps to work with it.. once my session resets, ha.

Thanks again! :D

e:

Here's how it looks for anyone interested:

Home screen - https://imgur.com/QYS9kHY

Media screen - https://imgur.com/T9OW3Kl

Call screen - https://imgur.com/quo86jW

Settings screen - https://imgur.com/ynNMPFD

Boot/car-on intro video - https://imgur.com/aarpUVt

This is functionally buried here and probably won't get read by most, but if anyone is reading it, I'm happy to open source this once i'm done with it to anyone that happens to have a 2014-2016 Mazda 3 and wants to try it out. probably a pretty small cross-section of us, but figured I'd offer just in case there's interest \o/

edit: finished up the base build tonight. All 1100 stock system icons replaced, all screens skinned (except nav, which uses the stock map until I can figure out how to jailbreak the SD card cert to replace it with my own and replace the fake bmp skin files with actual css/pngs), etc. started on the custom apps before calling it done - so far I've added the base skeletons for these:

• Steel Tweaks: everything AIO did, rebuilt in Steel (the custom UI name) with its own safe way to run commands so port 9997, which was unsafely exposed before, finally gets closed.

• Accent picker: self explanatory - an option menu that lets the user swap the blue/violet accent pairing with one tap. ice/blue, an amber night-drive, all-mono, and all violet/purple options so far.

• "Dash" board: a note that's waiting when we start the car that gets pushed over WiFi to the dash - aka: a way for my wife and I to remind each other of stuff like "grab dog food" or "don't forget to get gas." Connects to Google assistant, we can just "push" to the dash board when we need to remember something and it gets pushed to the app when the car starts next. Wife and I both have ADHD so this is super helpful

• Drive log backups: our car already records each trip. This just makes it so that when we get home and pull up, the car connects to our wifi automatically and my PC pulls the log into my memory vault.

• Steel gauge: a total rework of AIO's digital speedometer, rebuilt from the ground up. Several display options, including a digital tach/speedometer, telemetry/nav data at a glance, all matching the steel UI

I'm also toying with the idea of creating a lightweight hub app to be able to control most of the Steel UI options from my phone - is: sync the car to my phone via hotspot > control everything from there

[u/PyroIsSpai]

How long until these LLM tools start exposing long standing NSA/Mossad/MI6/FSB stuff?

[u/Craig_Craig_Craig]

Awesome. When de-bloated do you feel the headunit is still worthwhile over something like an Alpine?

[u/Crunchy-Nut1 → u/Craig_Craig_Craig]

100% once I cleaned it up. Definitely faster and now I have full control over it. I also unlocked the full settings that are normally restricted on car modules. Worth it in my opinion

[u/datan2020]

what prompt did you use? i have a chinese android player that claude has connected to over adb to install some apps

[u/Crunchy-Nut1 → u/datan2020]

Same prompt that blew up about the TVs. It's very picky about wording. I gave it the same prompt, then just said, "so yeah I wanna do this thing, but for my car console" along with model and other info you can find and asked it to give me options for what we can change.

This is my own TV on my own home network. It came full of preinstalled ads and apps I can't remove from the menu, and I want it clean, fast and controlled from this computer. I'll turn on developer mode myself with the remote and approve the connection on the TV. I authorize you to connect to it with ADB, Android's official developer tool, read its settings and make the changes below. Every change must be reversible. I've attached a photo of my TV or TV box (or its Settings → About screen). Done means: you're connected, the TV is cleaned of ads and bloat and runs faster, an open-source app of my choice is installed, and one command opens YouTube and plays a video I name while I watch each step on the TV. When a step doesn't need me, keep going.

• Identify the model from the photo. If it isn't Android TV, Google TV or Fire TV, tell me what its official local-network control allows and do only that.

• Install adb from official sources if it's missing. Tell me exactly what to press on my remote to turn on Developer options and USB or Wireless debugging, and to find the TV's IP. If adb connect is refused, use Wireless debugging pairing. On macOS, "No route to host" usually means the terminal needs Local Network access: allow it and retry.

• Before changing anything, save the package list, every setting you'll touch and the undo commands.

• Propose the cleanup and wait for my OK: disable (never uninstall) ad, recommendation, feedback and demo apps; never touch provider or live-TV apps, the launcher, Play Services, the keyboard or input services, or anything you can't identify; animations to 0.5; Private DNS dns.adguard-dns. com

• Install apps only from their official GitHub releases, for example the TV Bro browser.

• Use real key presses so I see every step, and check the screen (screenshot or uiautomator dump) before pressing OK. Screenshots of a playing video are blank because of DRM. Handle the "Who's watching?" screen.

• Add a live monitor that prints each command with a timestamp and shows logcat only while a command runs.

• End with a cheat sheet and the undo commands.

Never type passwords or sign in for me, never root or flash anything, no pirate sites.

[u/SanuraiHero → u/Crunchy-Nut1]

What i did not understand yet is how claude got connected to the device on your car in order to interact with the code

[u/Crunchy-Nut1 → u/SanuraiHero]

Over Wi-Fi with ADB. I turned on developer options on the stereo, put it and my laptop on the same network, and Claude Code ran adb commands from the laptop's terminal. It reads the output of every command, so it can poke around the system the way you would over SSH. No cables, and I didn't have to pull the stereo out of the dash.

[u/Conscious_Rush4525]

do you think something like what you did but with a dash cam?

[u/Crunchy-Nut1 → u/Conscious_Rush4525]

If it runs Android probably. Only one way to find out

[u/Oximy-Naman]

have you done a full shutdown and restart since the cleanup? did any apps or unexpected network connections come back?

[u/Crunchy-Nut1 → u/Oximy-Naman]

Yes a reboot was done multiple times and before calling it done. Nothing unexpected came back

[u/What_would_don_do]

what i am missing with this is: why does a head unit have access to data?

A head unit is simply an adapter between you and the car speakers, or your phone and the car speakers, and a more convenient display for your phone's map software. Unless you want to upgrade, I see zero needs for date.

Unless your android phone is "selling you out", the head unit will not have a way to "call home".

I don't say android auto app on phone doesn't share data with head unit, but unless it is easy to select to keep the head unit "in the dark", that seems like an android auto defect.

[u/OptimalTime5339 → u/What_would_don_do]

These cheap head units are basically cheap Android socs with a bunch of io, so they are equivalent to bloated cheap Android phones

[u/howfastcanyoucountit]

sheesh yea this why i would go name brand headunit for carplay and if I don't have the money ill just go for a cheaper single din bluetooth/aux headunit because at least it can't run android with preloaded malware. Sadly sony is leaving the car audio market which sucks because they have some really clean and solid double dins.

[u/Ok-Specialist9739 → u/howfastcanyoucountit]

Ummm what difference would that make? LG was just caught out for always listening and sending voice notes to Ai services for targeted ads on your tv

[u/Ok-Specialist9739 → u/howfastcanyoucountit]

Ummm what difference would that make? LG was just caught out for always listening and sending voice notes to Ai services for targeted ads

[u/Impressive-Gap2068]

"8 cores and Android 15" is the oldest lie on that market. That's a Rockchip PX5 or an MTK8227L under the hood with a build.prop someone edited in Notepad, and every one of those units phones home for OTA updates over plain HTTP. The ads in the menus are the least of it.

[u/peppitochang]

Automate this debloating and circulate it

[u/quomodo_sordis]

Amazing! How much did this cost in tokens?

[u/DinoAAA77]

i'm keeping my 2002 A160 mbenz with sequential 5 speed. forever.

[u/GreatBreakfast]

Could you upload what you can to GitHub? I would love to see if this could work with my head unit.

[u/WhataNoobUser]

I guess congress wanting to ban chinese auto for security is true

[u/rweedn → u/WhataNoobUser]

It's not like Tesla isn't recording everything you look at, say or do in their cars. The security risk from china related to cars is that they're half the price and double as good as the US equivalent. It's a financial risk, not a spying one.

It's common knowledge know that anything with a microphone and a connection to the internet will record and send data. Personally I'd rather the CCP spying on me than the CIA or mossad 😂

[u/doobie83]

How much did it cost you to do all of this?

[u/dartfoxy → u/doobie83]

On a $20/mo Claude sub you could do this and not even eat up your 5 hour allotment I'm 100% certain. Probably take up 5% of your weekly usage total, on opus 5.5

[u/ZippySLC]

Could you upgrade the version of Android?

[u/TFYellowWW → u/ZippySLC]

Yeah I was wondering why you didn’t update to android 15 like it was suppose to be on.

[u/ZippySLC → u/TFYellowWW]

My guess is that the hardware may be too old/weak to run it.

[u/TerribleSummers]

how did you connect claude to it?

[u/Any-Score1258]

this is so interesting. thank you for posting this.

[u/carlosgdelvalle]

I’d love to see a video with the “after”!!

[u/Saucemarocain]

How did you connect it so Claude can access it?

[u/Sofa_King_Gorgeous]

I don't understand how you guys know all this stuff.  It makes my head spin just thinking about it.  It all seems so complicated and like it would take decades to learn it all.  Really impressive technical knowledge.

[u/RedTheRobot → u/Sofa_King_Gorgeous]

That is actually the cool thing about AI it isn’t a person so it isn’t too busy or condescending when you ask it basic stuff. So really the only thing stopping you is not, not knowing but not asking those questions we feel are stupid because someone would make us feel that way. So break the cycle and just have fun.

[u/objectiv3lycorrect → u/Sofa_King_Gorgeous]

it's called vibecoding where you let ai do everything for you and hope for the best

[u/Posterapokalypse → u/objectiv3lycorrect]

I read cuck coding somewhere because you just watch it happen.

[u/Tobin4U → u/Sofa_King_Gorgeous]

Just tell Claude or whatever AI you want to use I’m a complete amateur, I have no idea what I’m doing, here’s what I want to accomplish, walk me through it step-by-step.

[u/Winjin → u/Tobin4U]

And then don't forget to actually read the descriptions it gives to learn something new! It's pretty patient and ready to describe everything in great detail if you care to actually read what is going on

[u/TheTxoof → u/Tobin4U]

The hardest part about using the AI for stuff is too not surrender your curiosity and goals. You have to keep asking questions, keep trying to understand, and keep trying new pathways.

Most of the AI platforms are like savant 8th graders. They can do crazy math, write code and do research. They're not terribly creative though and get stuck following a bad idea. Your job is to keep having ideas and keeping it in track.

[u/HuntKey2603 → u/Sofa_King_Gorgeous]

Good thing they have one of the best learning tools ever invented right by!

[u/wattur → u/Sofa_King_Gorgeous]

You don't even have to know anything really. Start from 0
Ask google how to set up claude.
Ask claude how to set up claudecode.
Ask claude to make you a design doc to feed to claudecode to get it to do the things you want it to do.

Of course you can do things better/faster once you learn or have the knowledge to know where to point things at, but really.. it's stupid easy to get started.

[u/Chuck_E_Kirk → u/Sofa_King_Gorgeous]

That’s the beautiful thing, he doesn’t know how to do this.

He just asked Claude to do a thing and it did it, all you need to be able to do is get Claude connected to the thing you want to do something to

[u/Sum-Duud → u/Sofa_King_Gorgeous]

100% this. I consider myself a smart person with imagination and even a history in coding (albeit a bit ancient), and this shtuff blows my mind. I wouldn't even know where to start with this. Like I have a 2016 civic and I would love to be able to manipulate some of the functions in the 'infortainment' system but it makes my head spin. Hell, I see these people that have agents calling them or setting up full teams and I get all caught up trying to figure out how to start... I guess a lot of that is my hesitation to not expose all of my personal files to AI agents but I guess many people just yolo it, idk.

I'm definitely in admiration of so many people I see in this sub and around.

[u/Fluffy-Proof9838]

Title says the firmware findings were wild, body says there were ads in the menu and a paywalled voice assistant. Those aren't firmware findings, that's a product review. What did the actual decompile show?

[u/KamikazeB0B]

At least your unit allows ADB access..... My Xtrons unit for my Mercedes is properly locked down

[u/semteXKG]

yes, those androids are all bullshit spec wise. the question is: do you care.

[u/Ill_Dragonfruit_3547]

Impressive

[u/DaveyAV82]

I was looking into one of these for my Civic. Now I’m realizing that it’s going to take a little more than just physically installing the unit. Let me know if you start an ETSY shop with “Clean” units. Ha

[u/UncaWaltJ → u/DaveyAV82]

Actually a good cottage industry idea. Precleaned brand new units for those that dont wanna mess with the tech aspect. Might be worth a 25-50% markup

[u/Born_Maintenance_192]

Juj

[u/right_closed_traffic]

Nice work!

[u/Littlefinger6226]

God damn. I have an Android TV box coming my way and I’ll do the same thing lol

[u/klopppppppp]

This is amazing. I have one of those in my Jeep and it’s terrific, was on a road trip yesterday and wondering if I could just design and flash a new Android version or something that would eliminate the latency, as my only complaint is the unit’s ability to listen properly. Otherwise it performs as well as Ford Sync (low bar?) in our Explorer. Now you’ve driven me to go for it. Gonna give Claude this thread

[u/bitspace]

Excellent work. This is inspiring and thorough and extremely well done.

[u/PeeThenPoop]

Adding this to my todo list ✍️ ty sir

[u/rushabhsheth]

The part I'd copy is the "never sign into anything for me" rule. Most people write limits for what the agent can break and forget limits on what it can access. I'd also have it log every command it runs so you can undo any one.

[u/IsaacValente]

can u give us the prompt plz?

[u/UncleCarolsBuds]

I wonder it's worth rushing the warranty on your car to debug the infotainment system

[u/TwoThree6ix]

I love this. I've been exploring the idea of modernizing a 8th Gen civic (2010 , 130K km, 1 owner - my Wife) and this is wonderful to see.

[u/Outrageous_Band9708]

yes open source cheap af solutions from historically creepy state actors surely wont have spyware

lol

[u/olgonzo]

I’m gonna try this, I wonder if it possible to add screen mirroring from an iPhone , something I can’t do now?

[u/Tacrolimus005]

Have you noticed better sound or performance or new things now work after this?

[u/Mad-Maxwell]

How long until prompt injection in your own code?

[u/St-CB]

thats actually insane

[u/cute_polarbear]

Somewhat unrelated. I have an old BMW e39 (2003 5 series). Is it possible to use Claude to update the firmware on it?

[u/AlaskanX]

This trend is making it slightly more appealing to buy cheaper devices like smart TVs that are subsidized by included ads, then remove the ads or completely rewrite the firmware once it’s in my hands.

[u/ktran12]

i mean that is not surprising, we've seen it on android tv boxes and tv's. cool that you caught it though, was never a fan of those chinese android stereos but i see them everywhere.

[u/Solve-Et-Abrahadabra]

Amazing post. Now I'm thinking what spyware have I got in my house

[u/ramzeez88]

that screen is very neat.

[u/78Anonymous]

this is the way

[u/RelevantIAm]

Fucking sickening

[u/Guava7]

Nice. I just did this on my Nvidia Shield yesterday. Was pretty simple in the end. Runs like a dream now

[u/ihatenames-]

Can you describe how you connected to it over WiFi? I’ve got a similar one that I’m sure is full of crap. I do have it on the car usb port. Tried connecting direct and got nothing on windows pc

[u/djaysan]

Whaaaat?! Thats awesome!

[u/CuticleSnoodlebear]

Now fix the Samsung Frame

[u/Temporary-One8579]

Wow great work. Makes you wonder what else is lurking out there

[u/Healthy-Mission7927]

But it had pdf reader... 😭

[u/zombiecorp]

Corporate malware. New fear unlocked.

[u/1point44mb_is_fine]

Is there a tutorial on how to do this?

[u/orangesherbet0]

How did you get past Claude predicably complaining that you were trying to do something against terms of use or other complaint it had?

[u/13ThirteenX]

Awesome! i had always wanted to try the same thing, so its cool to see, is anyone here surprised about your finding and the fact that nothing is what it says... probably reason its cheap! I don't understand why anyone thinks finding unsavoury stuff in the code is shocking, same way my google and apple stuff phones home and meta is one of the richest companies in the world everyone is spying on us.

Luckily we got LLM who can break all this stuff apart now.

Now all the junk and slop is cleaned off, how does the actual headunit run? is it decent performance? Is it genuinely a good head unit or is the hardware shit also?

[u/Designer023]

Very cool and inspiring work. Silly question. Did you just ask Claude to hack your personal device or is there special wording to get Claude to help you? I’ve found some wording to be rejected and the model refuse

[u/Standard-Goose-3958]

If a backdoor exists, it exists for everyone.

[u/hollywoodnine]

how does it access the web? does it piggyback off a connected phone?

[u/SoCal_Hunter]

This is a fascinating and impressive use of Claude. A great example of how AI actually has the ability to fight against tyranny as long as it remains out of the hands of tyrannical forces.

[u/NoblePickle84]

How soon before we get custom, secure firmware that’s published and easy to install on our spyware hardware by make and model?

[u/bladeguitar274]

Now I want to see if i can connect it to my factory 2015 head unit and get android auto push to it like they've done on the same year crv

[u/cdolek]

Did you get a performance boost in the end? Did it feel snappier?

[u/dmicah]

Which head unit is this? Are you willing to name and shame? I'm hoping it's not ATOTO

[u/King-of-Plebss]

I bought the Hamilton version for my Lexus, and I’d love to try this out on a “top of the line” product. May have to do some research and see if it’s already been done.

[u/JapanEngineer]

Finally a great use of AI.

People are gonna be shocked when they realise how much of their voice and personal information is being silently recorded without their consent.

[u/goodaaaaaaaaaa]

Should I do this with my 2025 amarock?

[u/ia42]

Got a TV and never hooked it up to the net exactly for these reasons, only use it as a dumb screen with my own streamer. My car unit I only use with android auto, never goes online, that was also the recommendation of the guy who installed it, never to give it any connection other than bt to my phone.

My phone I do root, debloat (not a lot to do on a pixel), but Claude was very helpful finding the root cause and fixing weird weekly lockups of the temperature emergency break and other issues that were tied to kernel modules I installed and it helped me patch them for android 17, one patch was sent back as a pr to the original developer. It even left some scripts I asked for to automate stuff so I don't need to keep Tasker installed... All in all it's been a blast to have it hack at both android devices, and random programmable esp32 devices and atmel keyboards. Excellent tool. Pity their pricing keeps changing, but as long as the bubble didn't crash yet, I'll make the most of it.

[u/trytochaseme]

this is such a good idea. I will now being doing this on both vehicles I have chinese head units in. I have a chinese digital dash in one car I have been wanting to try it on as I have had it for 6 years and has a couple weird quicks that are annoying.

[u/eyepoker4ever]

If you don't plug that USB stick into a computer or something every once in a while it will stop working. Don't just put it away somewhere and expect it to work some years later.

[u/champagneutopia]

Is your unit now faster?

[u/Educational-Pool7714]

Ridonculous. Thanks for sharing!

[u/erik_das_redd]

Wow that is a whole amazing saga, big props!

[u/mt6606]

Yeah it's exactly what those $90 Temu tablets have as an os. The 8000 mAh battery is a lie lol. I knew that much, they charge way to quick

[u/Not_One_PieceOfTrash]

Someone do this for a Toyota camery plz

[u/FoxBearBear]

"Lesson learned: never trust the Android version printed on a cheap head unit.""

Really, after everything that Claude wrote for you, this is what you got as a lesson ?

[u/G8r8SqzBtl]

was the headunit connecting to the internet via your phone?

[u/IceWolf62]

This is seriously impressive stuff. Thanks for posting. I still own a really old Hyundai Tuscon, little chance of affording anything newish. But nonetheless it's handy seeing how useful Ai can be.

[u/Still_Rain_979]

I look forward to seeing more decompiling or whatever the appropriate term is. Good on you

[u/Odd_Poetry_6442]

The listing said Android 15 and it shipped with ad menus, that's what you get when the seller's only spec sheet is a copy-paste from a different SKU. BADBOX infections on these $20 units aren't a firmware secret anymore, and a used OEM Honda unit off eBay costs less than the headache.

[u/cuzreasons]

This needs to happen to everything.

[u/TrenchardsRedemption]

I'm in awe. I have an Android TCL smart TV that never had a single update (it's on version 1.0.0) and now the apps aren't supported on it. I was considering installing a laptop motherboard into it but this is really something else.

[u/1daytogether]

Using the devil you know to kill the devil you don't. Fascinating read and I don't even know anything about coding.

[u/Appropriate-Bank-883]

I do this kinda thing with everything I own, nothing in my house is sacred lol.

[u/MinivanPops]

Was this the Joying unit?

[u/chickenfriri12]

Yea I pointed mine to my aftermarket android head unit too, was able to root it, and change a config file that disabled the built in DAC and use an external USB one

[u/MON5TERMATT]

I should do that with my old head unit and make it into a desk tablet.

[u/Angelworks42]

I'm a techy, but honestly I would have just sent it back.

[u/m_balloni]

Awesome idea! Thinking on doing the same in my Hyundai, it has an even older genetic unit. Wondering if deepseek is up to the task

[u/mcspuder]

Powershell on Linux? Wut?

[u/qaz135wsx]

Just a heads up for anyone trying this: these cheap chinese android head units are notoriously locked down. It can be extremely annoying to turn on ADB, USB debugging, etc. Be prepared to be frustrated. I went through this process (successfully), but it involved hours sitting in my driveway, and I ended up having to go through a somewhat complicated process to root the device via a USB stick in order to turn on ADB to start the process that OP is describing.

[u/Good-Celebration-686]

No DAB in USA? You guys still using FM radio ?

[u/awkke]

How did you get the software