即时通 D9000app 或威诺 VR-N76 可以用手机蓝牙连接控制电台，但所用的 HT App 完全没有放出任何相关资料，使得用户必须依赖 HT App 才能远程控制，既没法电脑控制也没有任何二次开发空间。GitHub 上有以下两个项目提供了比较完整的协议逆向工程： https://github.com/khusmann/benlink/ https://github.com/Ylianst/HTCommander 虽然都没有实现频率模式（我前几天尝试逆向 Android 版的HT，大概分析出来了）和固件刷新（这个有点麻烦，我还没看懂，混淆之后的代码太头痛了），但都完整实现了 SBC 的蓝牙音频和 PTT 控制。很好奇为什么这个 App 都几年了国内居然完全没有尝试去逆向工程做二次开发的。会被本视律师函是一回事，虽然我也想不到其会这样做的动机（只要不去干 HT 本身的网络链路协议）。根据这两个项目，或许是可能通过这些电台的内置 TNC 直接控制电台用 AX.25 实验的。目前电台不在手里，等拿到手了想尝试尝试（但也只有一个，没对端 orz）。虽然近期 HT 更新了自动多普勒打星模式，但想用 GPredict 之类的更 old school 的方法控制，那还是最好有个外部调用的开源方案。同时想用这些电台而非 9700/705 之类的贵贵电台实现 HT 自己专有模式之外的链路中继（比如 EchoLink，比如 IRLP，虽然没法做 DMR/D-Star/MMDVM 的，当然强行上也不是不能上），也必须有这样的方案。并且手机很大问题就是长期运行的便利性、保活等，如果能用香橙派控制会好很多。同时本身控制电台没有开源开放的协议本身就是比较不爽的一件事。总之其实有了频率模式和蓝牙音频+PTT控制的开源协议实现就很大程度打开了一个新世界了。

关注。期待有一天能嵌入车机大屏（iOS）

关注。期待有一天能嵌入车机大屏（鸿蒙）

关注。期待有一天能嵌入车机大屏（Windows）

@"BG4ILW"#p93111 这个已经实现了，HTCommander

关注。期待有一天能嵌入车机大屏（化油器摩托）

关注。期待有一天能嵌入车机大屏（人力三蹦子）

关注。期待有一天能嵌入车机大屏（山地自行车）

关注。期待有一天能嵌入车机大屏（ATM）

想要干开即时通 D9000app 的固件看看蓝牙协议或者看看能不能改发射频率改成日本的范围（否则 JARD 验机审核麻烦）结果是高通 CSR 的 CSR8670，ISA 特别妖（叫做 XAP，内部有个虚拟机，BlueCore VM），完全没有 ISA 的手册，也没有各种文件的 spec 最致命的还是各种文档和 ADK 都需要有 CSR 的服务权限才能下载，否则就只能去找各种论坛泄露出来的文件，就没找到能拼凑出逆向工程所需的资料。虽然 OTAU 和 DFU 文件有网上的脚本能拆开，但进一步的 vm.app 就拆不动了，可执行文件的格式完全找不到。虽然找到了两个反汇编的实现（只有 radare2 的实际跑得动），但拖进去全部无法加载或者出来的指令明显不对，怀疑是不是 ISA 版本不同。 ADK 里面只有可能是为了合乎 GPL 放出来的修改的 gcc 的代码，没有链接器的，并且 gcc 代码几百 k 也没精力去分析来写 disasm，更没精力从零开始逆向 ld 来看可执行文件的格式。还有一点，如果想用 DFU/OTAU 是有公私钥 signature 校验的，虽然不知道 D9000app 的 stack 到底有没有开校验，但反正现在连 vm.app 都没法修改，绕校验或者直接 SPI 刷机也是无从谈起的。不过 Android 上的 app 逆向还算顺利？

Did Wino use reverse engineering of the HT App protocol used by the original vendor?

chariri

The ZASTONE D9000 app or the Wino VR-N76 can be connected to control the radio via mobile Bluetooth, but the HT App used does not provide any related documentation, requiring users to rely solely on the HT App for remote control, without the ability to control from a computer or any secondary development space. The following two projects on GitHub offer relatively complete protocol reverse engineering:

https://github.com/khusmann/benlink/
https://github.com/Ylianst/HTCommander

Although none of them have achieved frequency mode (I tried reverse engineering the Android version of HT a few days ago, and I was able to identify some features), nor firmware flashing (this is quite complicated, and I haven't understood it yet; the obfuscated code is too confusing), they all fully implement SBC's Bluetooth audio and PTT control.

I'm curious why this app, which is several years old, hasn't been reverse-engineered for secondary development in China. The legal letter from Baishi would be one thing, although I didn't expect them to take that action (as long as they don't interfere with HT's own network protocol).

Based on these two projects, it might be possible to directly control the radio using AX.25 experiments through the built-in TNC of these radios. Currently, I don't have the radios in hand, and I plan to try them out once I get them (but only one, no paired orz). Although recent HT updates include an automatic Doppler star tracking mode, I would prefer to use a more "old school" method like GPredict, which would ideally require an external open-source solution. Furthermore, I want to use these radios instead of expensive radios like the 9700/705 to implement link relaying for HT's proprietary modes (such as EchoLink or IRLP), even though DMR/D-Star/MMDVM is not possible, and forcefully connecting is also not impossible. And a major problem with mobile phones is their long-term convenience and power management. If I could control them using a Raspberry Pi, it would be much better. Also, the fact that there is no open-source protocol for controlling the radios themselves is quite frustrating.

In summary, having an open-source protocol that combines frequency patterns and Bluetooth audio + PTT control has significantly opened up new possibilities.

A1A

Please note. I hope to be able to integrate it into the car's central infotainment screen (iOS) one day.

BI4IVE

Please note. I look forward to the day when it can be integrated into car infotainment systems (HarmonyOS).

BG4ILW

Please note. I hope to one day be integrated into in-car central displays (Windows).

chariri

BG4ILW This has already been implemented; HTCommander.

BH2VZC

Strongly support; fanatical support

Bi4KKF

Please note. I hope to one day be integrated into car infotainment systems (for gasoline-powered motorcycles).

BG2EFX

Please note. I hope to one day be integrated into the in-car central display (the "three-legged human").

BA4JPR

Please note. I hope to one day be integrated into car infotainment systems (mountain bikes).

BG6XVJ

Please note. I look forward to the day when it can be integrated into car infotainment systems.（ATM）

chariri

I want to access the firmware of the ZASTONE D9000 app to examine the Bluetooth protocol or determine if I can modify the transmission frequency to match the Japanese range (otherwise, the JARD testing and approval process would be more complicated).
The result was the Qualcomm CSR, specifically the CSR8670. The ISA (which is called XAP and has an internal virtual machine, BlueCore VM) had no manual or specifications at all.
The most dangerous aspect is that various documents and the ADK require CSR service permissions to download, otherwise, you can only find leaked files from various forums, but none of them contain the necessary information for reverse engineering. While scripts online can be used to extract OTAU and DFU files, further extraction of vm.app is impossible, and the executable file format cannot be found at all. Although two implementations of disassemblers (only radare2 actually works) were found, but when loaded, they either fail to load or produce incorrect instructions, leading us to suspect that there may be a difference in ISA versions.
The only code in ADK that might have been released to comply with the GPL is GCC, but it doesn't include a linker. Furthermore, analyzing hundreds of KB of GCC code and writing disassembly instructions would be too time-consuming, and starting from scratch to reverse engineer the format of the executable file would be even more impractical.
Also, if you want to use DFU/OTAU, it requires signature verification with both public and private keys. However, I don't know whether the D9000 app stack actually performs this verification, but regardless, even modifying vm.app is currently impossible, so bypassing the check or directly flashing via SPI is out of the question.

However, are reverse engineering apps on Android still relatively straightforward?

BG4QBF

Please note this. I hope to one day be able to integrate it into the in-car central display (OS/2 Warp 4).

闽ICP备2021006864号-7

闽公网安备35020602002794号互联网举报中心

用户协议隐私政策社区规范积分规则中继规则转载须知
更新日志联系我们常见问题友情链接运营报告赞助

浩奇科技（厦门）有限公司

是无线电，把我们联系在一起