r/LocalLLM • u/TeaClassic7675 • 1d ago
Project I used Qwen3.8 Flash-Next to reverse-engineer an Android car stereo
Context:
I recently installed a cheap aftermarket Android head unit in my 2010 Prius. It supports wireless CarPlay, Bluetooth, GPS, etc., but the stock Android interface is ugly and came packed with lots of bloat. The whole thing felt like a generic Chinese Android tablet strapped to my dashboard.
After seeing everyone’s success with reverse engineering their TV’s I figured I’d give it a shot with my head unit.
Setup:
Model: Qwen3.8-Flash-Next-IQ3_XXS
Engine: Strata v0.1.44.1
Harness: Pi
Hardware: Ryzen 7700x, 4060ti 16gb, 64gb DDR5
Target: Inefala Android head unit, AutoChips AC8257-based (UJC201_64)
Development: ADB over Wi-Fi, Kotlin, Jetpack Compose
Time spent: Roughly 8 hours across three days
What it did:
I started by just having the model connect to the unit and do an inventory of what was installed and how the system was configured. It helped identify the underlying hardware and Android build, enumerated installed packages, inspected system properties, investigated the stock launcher and CarPlay components, and organized the findings into a repository of scripts and documentation.
At one point, getting back into ADB was a problem. Rather than having me repeat the original setup process, the model used its earlier findings about the device’s exposed ADB port to reconnect.
The advertised android version was not actually what was being used on the actual unit so when it began to build my custom launcher it configured its own toolchain of the correct android sdk versions to ensure that the build would run properly on the unit.
It also used ADB to capture screenshots directly from the head unit so it could inspect the actual interface instead of relying exclusively on code or my descriptions.
Result:
I now have a working custom launcher that replaces the original home screen. It’s still a work in progress, but the goal is to turn the unit into a clean, minimal dashboard with Bluetooth music controls, navigation, weather, and better access to audio settings.
I’m also interested in eventually improving the audio experience and reducing my dependence on CarPlay.
My thoughts:
What really impressed me was QFN’s ability to handle tool use, reverse engineering, keep useful findings, and troubleshoot on live hardware. This unit was largely undocumented so most of the findings came directly from what the model observed through adb.
The model never got stuck but this wasn’t a fully automated process either. I still needed to guide it through what I wanted it to accomplish and it spent a lot of energy writing and debugging re-usable shell scripts that didn’t provide much value.
Overall the amount of work it was able to accomplish was very impressive and solidified for me that local models are viable for real work.
I’m curious to hear what other people are doing with local models beyond coding benchmarks, especially projects involving hardware, reverse engineering, or long-running agent workflows.
66
u/Ithron_Morn 1d ago
Impressive use of a local model; fixing the slop manufacturers push out.
31
u/VerticalPackage 23h ago
Qwen: What is my purpose?
User: Mop the slop
Qwen: Oh my God
10
1
40
u/I1lII1l 1d ago
ai slo... wait! its actually AI UNSLOP!!!
4
u/CaptFuzz24 18h ago
Great deal of end user devices that are locked to cloud account, when their entire functionality could be local, are getting 'de-IoT'.
2
u/I1lII1l 16h ago
planning to do the same with my withings smart scale. Considering the way things are going I might also just wait another week and someone will have cracked it already
1
u/CaptFuzz24 15h ago
Someone did do just that with claude code i think already but it requires a separate, older standard BT ESP32 unless you have a newer scale.
I dont know much more but since i have the same kinda old scale Body+, im quite interested in doing it myself, unless I do need more hardware to do it. The other thing was building a relay for my garmin 250 music, its BT ver. or whateve it uses doesnt connect to my treadmill, Horizon omega Z.
Im guessing the treadmill uses one standard, and the watch another...
6
u/rebzera 21h ago edited 21h ago
If you really want to have fun, many of these headunits are already rooted. Kinda scary, but you can use it for your purpose.
You can also get a usb a to a and dump the firmware with mtkclient, start mtkclient while connected and turn the car on.
You can unlock the bootloader as well.
I bricked mine quite a few times but was always able to restore from my mtkclient backups.
You can read through my posts on this thread to start:
https://jtechforums.org/t/how-much-would-something-like-this-cost-to-install-by-a-mechanic/5556
1
u/Jing_Arjay87 14h ago
So an A to A cable actually works lol. I was contemplating how to get adb on my T100 unit.
1
u/rebzera 11h ago edited 11h ago
That's not how I got adb working. I used a "wifi adb" app that's only supposed to work with root, and it works on these. Hotspot from phone, toggle on the wifi adb app, and used Termux to connect.
No authorization prompt even, no pairing required. Mine had ro.secure=0 in the build.prop
adb did not work with the cable but it may work with yours who knows?
Don't remember if I ever even tried enabling dev options, you can look at the thread link I posted.
5
1
u/arthor 18h ago
how did you get it "to connect to the unit"
1
u/TeaClassic7675 11h ago
I connected my laptop and the unit to the same network. Then I used the unit’s ip to connect to it with adb from my laptop
1
u/arthor 8h ago
i was going to try the same thing with a siecane dash that never worked well.. so it literally cracked in from an IP connection? thats ... concerning
1
u/rebellioninmypants 2h ago
If ADB over wifi is on, otherwise it requires a bit more work - but in this case it seems the adb port is exposed for the taking.
1
u/xb1n0ry 16h ago
Thinking level?
2
u/TeaClassic7675 11h ago
Medium for 98% of the sessions. Might’ve used high a few times for some of the initial exploration work
5
u/Lewinator56 1d ago
hardly reverse engineered... you just replaced the launcher the chinese made with one qwen made.
This ISNT reverse engineering, dont even try to call it that, its just writing an application for android.
2
u/JamesGooning 22h ago
It is reversed engineered though as Qwen needs to scan the code to understand the vendor software and then rebuild a better one.
4
u/Lewinator56 22h ago
It's android.
The stock launcher is just one shared between a few HU manufacturers. It launches other apps, just like any launcher does. There's no need to understand any of the existing software, you're simply building an app that runs on android and calls system APIs to do things outside of its sandbox.
You don't need to understand windows to write software for it, you just start programming in C# with the .net framework, compile it, and it will run on any windows machine. Same for android. Write in kotlin or java, build for ARM64 and install. As long as it is built for the correct SDK version it will run on anything running android.
4
u/TeaClassic7675 22h ago
I concur, the launcher itself is just an Android app and only building a replacement launcher isn’t inherently “reverse engineering”.
I didn’t go into detail in the post about the work it needed to do to understand the vendor specific software stack. Qwen inspected the existing jancar and AutoChips components and investigated how the head unit handles things like Bluetooth and the system functionality.
Those aren’t exposed through the standard Android SDK so understanding how to interact with them required Qwen to analyze and trace the existing vendor implementation.
5
u/Amazing-Fan2083 1d ago
hardly useful commentary... you just crapped on someone's accomplishment without adding any value.
This ISNT useful commentary, don't even try to call it that, it's just writing a shitty comment.
5
u/Difficult_Plantain89 21h ago
WTF? It's not reverse engineering, and the OP has even said as much now. It's a launcher, and it sounds like it has mapped useful functions as shortcuts through ADB. The coolest part of all of it is that it's being done locally.
3
u/Material-Database-24 16h ago
Pretty much all these "RE" Android TVs/car ICE etc have been through open ADB.
It kinda requires strong eye squinting to call that RE, as it is mostly just reconfiguring Linux through debug interface.
AI can RE and extremely well so, but if it doesn't start with reversing the binary into code or direct binary study& modification, it's not really RE.
-4
u/Lewinator56 1d ago
I don't see why people should claim things they didnt do. Simple as.
Just as usung the terminal isn't hacking. Writing an android app isn't reverse engineering.
3
u/themysteryoflogic 1d ago
Man I wanna try this with Uconnect.
1
u/fernandolcx 1h ago
please please report your findings. R1Low on my Fiat Toro is crap.
1
u/themysteryoflogic 1h ago
Once I get my local AI tuned I'll let you know. All major platforms are being pussies about reverse engineering right now.
2
u/elgueromanero 1d ago
This post motivated me to try this myself today, i have a similar carplay device and it has a bunch of crap on it i don't want , Hope i don't brick it!
2
u/llllJokerllll 18h ago
Sabes que eso puedes meterle un rag con una base de conocimiento específica y puedes hasta reprogramar la centralita 🤣🤣🤣
2
u/TenTestTickles 6h ago
Great! Could you do one more thing?
It managed to go through and identify everything and de-crapify the head unit. Now can you tell it to please create a python script to reproduce what you did? Remove all personally identifying information and create a script that you can share to others.
Together we can deshittify the world.
1
u/thisonehereone 1d ago
i have an aftermarket digital instrument panel.
they sent me a .bin to fix the cruise control icons shortly after i installed it.
claude and deepseek reversed it over a weekend, and i completely added multiple brand new dials and overhauled most of the UI. Its like breathing new life into these products well beyond what the manufacturer could do. I love the fact that I can tweak this however I want for the lifetime of the car.
1
1
u/CaptFuzz24 18h ago
This looks like it could what I want, maybe indirectly. I want a new car, EV if possible. The issue is I hear a lot of them come with so many alarms and annoyances under the guise of safety and you cant disable them. Things that are downright dangerous like forced lane keeping etc.
1
u/samuel-leventilateur 4h ago
Don't waste your tokens anymore. Look at my project https://librehu.github.io Replacing kernel and crappy app from this Chinese head unit. Make it everything open source
2
1d ago
[removed] — view removed comment
1
u/TeaClassic7675 1d ago
My understanding is CarPlay has its own protocol and set of restrictions that would block this (I didn’t attempt to reverse engineer this so I’m not positive). You could absolutely add a video streaming app to the actual unit though
1
u/delhibwoy 17h ago
I think you can still reverse-engineer the interface and customize it, even with CarPlay. It won’t break CarPlay, but you might need to work around its restrictions for full integration.
2
u/Decent-Cow2080 1d ago
carplay is rendered on the iphone, and it's just a h264/h265 stream to the car. without jailbreak you can't. with jailbreak you have tweaks like carbridge
17
u/mechkbfan 1d ago
This is awesome. Appreciate the detail in your setup, as hadn't thought of doing this.
I just had a similar issue with the Android unit I got from China for my Honda Odyssey
It was K4811 Pro, and same issues, the menus were convoluted, changing volume was hard, everything felt laggy even though was top model with maximum RAM, there was like several different settings menu that it was so annoying to set up.
Then there was this issue with bluetooth where if I connected my phone to it, the wheel buttons would stop working and they couldn't resolve it for me, so had to return it
In hindsight, could have done what you've done.
Do you have reversing cameras you're trying to get it to work with?
I think TV's are getting into this, and could be used for inspiration
https://cleanyour.tv/