Android Car Radio for Mazda 6 (china) Teardown
Taobao.com has lots of Android car radios available. I'w got one and wanted to take a look at it what kind of hardware it has. Building a custom car media center would be awesome, but then it is difficult to make the LCD fit nicely into car dashboard. These Android car radios look very nice when installed.
Hardware
CPU in the PCB module is Allwinner R16, which has Quad-core Cortex™-A7 ARM processor. Same PCB module has GPS on it. Pinout of the module is unknown, please e-mail me if u find it.
Motherboard holding the PCB CPU module has FM radio receiver, power source, audio amplifier and Wi-Fi. Additional STM8S207RB processor running at 8MHz is probably for controlling the LCD, FM Radio or other parts during boot time. On startup the FM Radio starts fast, while Android takes much longer time to boot up.
 |
| More photos: https://photos.app.goo.gl/DG4PyaszG2QEj1NB3 |
Bluetooth module is based on RDA 5851S Bluetooth chip. FM Radio receiver is soldered inside sheet metal housing, which I did not desolder to see what chip is inside. The FM Radio part is really bad quality. It can not automatically change the frequency to follow the radio channel, and goes out of tune all the time. Receiver sensitivity is also bad, so there is often static and the sound quality is bad. Only with strong signal the sound quality is the same as with original Mazda car radio (which has internal CD changer in 2009 model).
Software
"Settings" -> "General" -> "Extra settings" has a access pin code, it is "123456"
"Developer mode" settings can be accessed with pin code "7890"
"USB Debugging" can be enabled with password "john@tw-desktop"
"Restore factory settings" has the same pin code as dev mode, "7890"
Malware/Spyware
Android has Chinese "connection app" DoFunCore.apk installed as a system program, which can not be removed. DoFun is a Chinese software company, offering a some sort of connection platform, to connect and track devices. App for example constantly reports GPS location to this service.
Rooting
Several attempts is required for the KingRoot to work, but it does work. Once the device halted completely and use of reset button was required. Finally rooting worked.
I used Titanium Backup to backup everything to USB stick.
Links
DoFunCore.apk analysis
Report 
| DateTime | 2017-08-20 22:28:01 (Last analysis) | |
| MD5 | f7e1e64b9df95d9d60683c5a6d18cb6a | |
| SHA1 | ff4007444e1fdb704271ba9cc007c07fcc8e4653 | |
| SHA256 | 5d69aa491ba176efcfb14da910052d037a4bc844fc3173ab8e1be5d2ec1bb189 | |
| Filesize | 45.8 kB (45818 Byte) | |
| Filename | dofuncore.apk | |
| Packagename | com.dofun.dofuncore.main | |
| ssdeep APK | 768:08lqnBgjxZV9JaBNjPsGj8x0GVytNkI0O/aQb4pVUSY17T:kBaP3a0A8x0VtWI0O/vbKVUSC7T | |
| SHA256 DEX | 9f53162556a491eb11d48d4839bdb22f17afe178cdbc93e5cf6464d9bec142f1 | |
| ssdeep DEX | 1536:tckF8bfSM0LgwsYdAHSQR1NS9X6QP6lksMQcyJs:ttF8mM0LgwsYdAHSQR12XMlks96 | |
| Date DEX | 29.06.2013 | |
| Ad-supported | No | |
| Requested Permissions | ||
| android.permission.ACCESS_COARSE_LOCATION |  | |
| android.permission.ACCESS_FINE_LOCATION | | |
| android.permission.ACCESS_NETWORK_STATE |  | |
| android.permission.ACCESS_WIFI_STATE | | |
| android.permission.BLUETOOTH | | |
| android.permission.CHANGE_NETWORK_STATE | | |
| android.permission.CHANGE_WIFI_STATE |  | |
| android.permission.DELETE_PACKAGES |  | |
| android.permission.FORCE_STOP_PACKAGES | | |
| android.permission.INSTALL_PACKAGES | | |
| android.permission.INTERNET | | |
| android.permission.READ_EXTERNAL_STORAGE | | |
| android.permission.READ_PHONE_STATE | | |
| android.permission.RECEIVE_BOOT_COMPLETED | | |
| android.permission.WRITE_EXTERNAL_STORAGE | | |
| Responsible API calls for used Permissions | ||
| android/bluetooth/BluetoothAdapter;->getAddress | ||
| android/content/Context;->startService | ||
| android/content/pm/PackageManager;->installPackage | ||
| android/location/LocationManager;->requestLocationUpdates | ||
| android/net/ConnectivityManager;->getActiveNetworkInfo | ||
| android/net/ConnectivityManager;->getAllNetworkInfo | ||
| android/net/wifi/WifiManager;->getConnectionInfo | ||
| android/net/wifi/WifiManager;->isWifiEnabled | ||
| android/net/wifi/WifiManager;->setWifiEnabled | ||
| android/telephony/TelephonyManager;->getCellLocation | ||
| android/telephony/TelephonyManager;->getDeviceId | ||
| android/telephony/TelephonyManager;->getLine1Number | ||
| android/telephony/TelephonyManager;->getSimSerialNumber | ||
| android/telephony/TelephonyManager;->getSubscriberId | ||
| java/lang/Runtime;->exec | ||
| java/net/URL;->openConnection | ||
| Potentially dangerous Calls | ||
| getDeviceId | ||
| getLine1Number | ||
| getPackageInfo | ||
| getSimSerialNumber | ||
| getSubscriberId | ||
| getSystemService | ||
| printStackTrace | ||
| Read/Write External Storage | ||
| setWifiEnabled | ||
| Actions/Intents | ||
| android.intent.action.BOOT_COMPLETED | ||
| android.intent.action.MAIN | ||
| android.intent.category.DEFAULT | ||
| com.dofun.dofuncore.DESTROY_DAMEONSERVICE | ||
| com.dofun.dofuncore.DESTROY_MAINSERVICE | ||
| Activities | ||
| com.dofun.dofuncore.main.MainActivity | ||
| Receivers | ||
| com.dofun.dofuncore.model.BootReceiver | ||
| Services | ||
| com.dofun.dofuncore.model.DameonService | ||
| com.dofun.dofuncore.model.MainService | ||
| URLs | ||
| http://maps.google.cn/maps/api/geocode/json?latlng= | ||
| http://plat.dofun.cc/tools/uploadErrorLog | ||
| http://update.cardoor.cn:10256/terminal/software/update/car/android/dofuncore | ||
| http://update.cardoor.cn:10256/terminal/software/update/car/android/dofunsoftpackage | ||
| http://vehicle.cardoor.cn:10256/server/json/carInit.json | ||
| http://vehicle.cardoor.cn:10256/server/json/carLocationInfo.json | ||
