XGIMI SS Aurora [Android] | [Projector] [DLP]
DiscussionXGIMI SS Aurora
LED / DLP
Discussion пїЅ
There is no curator in the subject. For questions about filling the caps, please contact the section moderators via the button
under the messages to which you want to add links.
Post has been editedmihadom - 06.09.18, 08:10
LED / DLP
Discussion пїЅ
- To compare the device with competitors and on the choice of devices, please contact: Selection and Comparison
- Before posting photos, read the topic Working with Images on the forum
- Messages that are not related to the topic of discussion (offtopic) are deleted without warning.
Specifications
Portable projector.
Optical Resolution: 1280x720 (720p) (Resolution Support 1080P, 2K, 4K only H265 codec)
Technology: DLP
Light source: LED
Support 3D: Yes
Brightness: 350 lumens
Contrast ratio: 5000: 1
Diagonal projection: 40-200 inches
Processor: MSD6A638 Cortex-A53, 64-bit, 4 cores, 1.5 GHz
RAM: 1Gb
Internal Memory: 16Gb
HDMI input: Yes
USB: There are 2 USB2.0 ports
WiFi: 2.4 / 5 GHz 802.11a / b / g / n / ac
Bluetooth: 4.0 BLE
Sound: Built-in JBL surround sound system (the ability to work as a Bluetooth speaker)
Battery: Built 20000 mah (battery life time of the projector to 8 hours)
Operating system: Android 5.1.1
Noise:<30 dB
Power: 35-55W
Size: 138 * 135 * 119 mm
Weight: 1.5 kg
Optical Resolution: 1280x720 (720p) (Resolution Support 1080P, 2K, 4K only H265 codec)
Technology: DLP
Light source: LED
Support 3D: Yes
Brightness: 350 lumens
Contrast ratio: 5000: 1
Diagonal projection: 40-200 inches
Processor: MSD6A638 Cortex-A53, 64-bit, 4 cores, 1.5 GHz
RAM: 1Gb
Internal Memory: 16Gb
HDMI input: Yes
USB: There are 2 USB2.0 ports
WiFi: 2.4 / 5 GHz 802.11a / b / g / n / ac
Bluetooth: 4.0 BLE
Sound: Built-in JBL surround sound system (the ability to work as a Bluetooth speaker)
Battery: Built 20000 mah (battery life time of the projector to 8 hours)
Operating system: Android 5.1.1
Noise:<30 dB
Power: 35-55W
Size: 138 * 135 * 119 mm
Weight: 1.5 kg
A photo
 |
There is no curator in the subject. For questions about filling the caps, please contact the section moderators via the button
under the messages to which you want to add links. Post has been editedmihadom - 06.09.18, 08:10
Reason for editing: Russification settings menu xgimi cc aurora
He was "happy" owner of the projector in the Chinese version. Android 5.1.1, GMUI 1.10.2
I will report on this subject on his research.
1) Switching into English succeeded only in the manner described in the next branch.
XGIMI H1 / H1s [Android] (halfo # 58417936 Post)
XGIMImod-LangExec.apk file rename XGIMImod-LangExec.apk1 and in the file manager (all in Chinese!) His mark and open with the icon of green robot applications.
The applications will LANG icon (XGIMI Languages) where you can switch the language.
There are a couple BUT! English is everywhere. File Manager in English does not work (falls).
2) root Preparation.
all options automatic rutovaniya been tried. They do not work.
Rutovat have to manually. It works great method described in this report:
XGIMI H1 / H1s [Android]
Completed the ADB for incorporation instructions
XGIMI H1 / H1s [Android] (nikfree # 64014871 Post)
But there is a typo.
In teams
# Su --daemon - should be free & in the end!
Post has been editedAlexx99 - 17.05.18, 13:06
I will report on this subject on his research.
1) Switching into English succeeded only in the manner described in the next branch.
XGIMI H1 / H1s [Android] (halfo # 58417936 Post)
XGIMImod-LangExec.apk file rename XGIMImod-LangExec.apk1 and in the file manager (all in Chinese!) His mark and open with the icon of green robot applications.
The applications will LANG icon (XGIMI Languages) where you can switch the language.
There are a couple BUT! English is everywhere. File Manager in English does not work (falls).
2) root Preparation.
all options automatic rutovaniya been tried. They do not work.
Rutovat have to manually. It works great method described in this report:
XGIMI H1 / H1s [Android]
Completed the ADB for incorporation instructions
XGIMI H1 / H1s [Android] (nikfree # 64014871 Post)
But there is a typo.
In teams
# Chmod 0755 / system / bin / su
# Su --install
# Su --daemon &
# Setenforce 0
# Su --install
# Su --daemon &
# Setenforce 0
# Su --daemon - should be free & in the end!
Post has been editedAlexx99 - 17.05.18, 13:06
Reason for editing: Supplement instruction в„–1
Came the projector turned partially russifitsirovat, thanks for the information laid out above. It did not work, none of the existing applications to view youtube. More precisely, they are included but the video is not. And is there somewhere in the firmware for the device? The fact that there are two models of the projector and one of them is on the board and not just YouTube. Can someone remove dump of the system partition? Ruth access, I think it is possible to roll the euro firmware.
t_stan @ 28.05.18, 11:26
And is there somewhere in the firmware for the device?
Firmware only Chinese.
I have a device with 1.10.2, and the Chinese last Laid 1.9.2
Link to Chinese firmware:HERE
Of course if you can find the firmware from the European version, there will be joy. :)
P.S.
By the way I have XGIMI on amazonovskom cloud storage firmware
https://s3.amazonaws.com/file.xgimi.net
But for downloading firmware to CC do not have permission. Locked.
Post has been editedAlexx99 - 28.05.18, 16:34
Reason for editing: info added
I download the latest firmware for our projector with Chinese servaka and poured on themail.ru. There are two upgrade files: 1st full and 2nd PTA. Along with instructions on how to file is updated. I hope someone can help.
Thank! Firmware Chinese? What are the problems addressed in the current version of firmware in comparison to the base?
Firmware for the Chinese version of the projector. I stood with this firmware store. Before the impact the new owner arrived refreshed her earned not original YouTube, with a little thoughtfulness and yet earned. I'll try to find her, and also to fill in the mail ru. If someone finds euros firmware for this project, please lay out, or tell me where I downloaded and lay out.
Post has been editedt_stan - 17.06.18, 16:18
Post has been editedt_stan - 17.06.18, 16:18
Reason for editing: Editing
Added firmware 1.11.1 for the Chinese version of the projector. It is the same place where previously lined version.
It seems to us luck and amazonovskom cloud Chinese English posted firmware forgetting to lock it :))
https: //s3.amazonaws.c..._087B_MONET_WMP_EN.bin
But update_signed not download. No access. But the opportunity to earn from the Chinese.
https: //s3.amazonaws.c....2.0/update_signed.zip
Attention ! Not tested. Spread As Is (as is).
Post has been editedAlexx99 - 22.06.18, 00:31
https: //s3.amazonaws.c..._087B_MONET_WMP_EN.bin
But update_signed not download. No access. But the opportunity to earn from the Chinese.
https: //s3.amazonaws.c....2.0/update_signed.zip
Attention ! Not tested. Spread As Is (as is).
Post has been editedAlexx99 - 22.06.18, 00:31
Reason for editing: info added
Disassembly EEPROM for example from EEPROM GIMI_087B_MONET_WMP_EN.bin XGIMI CC Aurora
Unpacking the firmware.
- To unpack the firmware will need to install the latest version of Python (3.6.5 as of today) from the sitehttps: //www.python.org...ds/release/python-365/
- Also need to download a set of tools mstar-bin-tool sitehttps://github.com/dipcore/mstar-bin-tool
Attention! All operations for dismantling the assembly and modification of firmware is a complex operation, and if you do not have sufficient skills, we strongly recommend to wait for a turnkey solution.
We use AES key extracted from AESBoot.bin file
aescrypt2 1 boot.img boot.img.aes hex: 0007FF4154534D92FC55AA0FFF0110E0
aescrypt2 1 recovery.img recovery.img.aes hex: 0007FF4154534D92FC55AA0FFF0110E0
aescrypt2 1 tee.img tee.img.aes hex: 0007FF4154534D92FC55AA0FFF0110E0
After deciphering .aes remove the extension from the file.
Post has been editedAlexx99 - 22.06.18, 22:58
Unpacking the firmware.
- To unpack the firmware will need to install the latest version of Python (3.6.5 as of today) from the sitehttps: //www.python.org...ds/release/python-365/
- Also need to download a set of tools mstar-bin-tool sitehttps://github.com/dipcore/mstar-bin-tool
Attention! All operations for dismantling the assembly and modification of firmware is a complex operation, and if you do not have sufficient skills, we strongly recommend to wait for a turnkey solution.
Step 1. Unpack.
put the firmware in the directory D: \ temp \ XGIMI \ firmware \
unpack.py D: \ temp \ XGIMI \ firmware \ GIMI_087B_MONET_WMP_EN.bin D: \ temp \ XGIMI \ firmware \ unpacked
After the command will get the following list of files:
boot.img
bootSign
cache.img
dtb.img
MBOOT.img
NuttxConfig
recovery.img
recoverySign
RTPM.img
sboot.img
system.img
tee.img
teeSign
tvconfig.img
tvcustomer.img
tvdatabase.img
tvservice.img
userdata.img
~ header
~ header_script
unpack.py D: \ temp \ XGIMI \ firmware \ GIMI_087B_MONET_WMP_EN.bin D: \ temp \ XGIMI \ firmware \ unpacked
After the command will get the following list of files:
boot.img
bootSign
cache.img
dtb.img
MBOOT.img
NuttxConfig
recovery.img
recoverySign
RTPM.img
sboot.img
system.img
tee.img
teeSign
tvconfig.img
tvcustomer.img
tvdatabase.img
tvservice.img
userdata.img
~ header
~ header_script
Step 2. Extraction of encryption keys mboot.img
extract_keys.py D: \ temp \ XGIMI \ firmware \ unpacked \ MBOOT.img D: \ temp \ XGIMI \ firmware \ unpacked \ keys 0x18f200
In our firmware key block at offset 0x18f200
The result of executing this command is the directory \ keys to the following files:
AESBoot.bin
AESUpgrade.bin
key_bank.bin
RSAboot_pub.bin
RSAboot_pub.txt
RSAimage_pub.bin
RSAimage_pub.txt
RSAupgrade_pub.bin
RSAupgrade_pub.txt
All keys default. Therefore, together with mstar-bin-tool in komlekte default_keys is the directory where the inquisitive mind finds private RSA keys for signing images.
In our firmware key block at offset 0x18f200
The result of executing this command is the directory \ keys to the following files:
AESBoot.bin
AESUpgrade.bin
key_bank.bin
RSAboot_pub.bin
RSAboot_pub.txt
RSAimage_pub.bin
RSAimage_pub.txt
RSAupgrade_pub.bin
RSAupgrade_pub.txt
All keys default. Therefore, together with mstar-bin-tool in komlekte default_keys is the directory where the inquisitive mind finds private RSA keys for signing images.
Step 3. Explanation boot.img images, recovery.img, tee.img
We use AES key extracted from AESBoot.bin file
aescrypt2 1 boot.img boot.img.aes hex: 0007FF4154534D92FC55AA0FFF0110E0
aescrypt2 1 recovery.img recovery.img.aes hex: 0007FF4154534D92FC55AA0FFF0110E0
aescrypt2 1 tee.img tee.img.aes hex: 0007FF4154534D92FC55AA0FFF0110E0
After deciphering .aes remove the extension from the file.
Step 4. Unpacking system.img
Download the utilityU-boot
In the IN directory put the decrypted system.img
Run _Boot.bat, select option 9 (Init Tools) and then option 5 (Unpack System (ext4))
The outcome of the utility will be extracted files in the directory / Unpack
In the IN directory put the decrypted system.img
Run _Boot.bat, select option 9 (Init Tools) and then option 5 (Unpack System (ext4))
The outcome of the utility will be extracted files in the directory / Unpack
Post has been editedAlexx99 - 22.06.18, 22:58
Reason for editing: info added
So the experiment showed that the English firmware flows and works (for downloading firmware must be removed from the title prefix _EN). But protection is triggered narrow-eyed with a window (that the firmware is installed on a Chinese unit). Box clean is not yet possible ... We will carry out research.
I am reporting on the process of research.
In general, I disassembled the firmware. Dekompilnul. I found the check model.
It looks like this:
1) derbanit system.img
2) decompiled services.odex
inside are on the way: com.android.server ->xgimi ->modelname ->modelNameDetect
And we see here is such a procedure there:
The easiest is probably to patch and replace it services.odex A511 to the Chinese ID A111
More interesting is to find a place where the model name is retrieved and placed in the environment variables.
In general, I disassembled the firmware. Dekompilnul. I found the check model.
It looks like this:
1) derbanit system.img
2) decompiled services.odex
inside are on the way: com.android.server ->xgimi ->modelname ->modelNameDetect
And we see here is such a procedure there:
private boolean isCCAurora ()
{
boolean bool1 = false;
try
{
String str = getEnvironment ( "XgimiModelName");
Log.d ( "modelnameDetect", "the modelname is:" + str);
if (! str.equals ( "A511"))
{
boolean bool2 = str.equals ( "");
if (! bool2) {}
}
else
{
bool1 = true;
}
return bool1;
}
catch (Exception localException) {}
return false;
}
{
boolean bool1 = false;
try
{
String str = getEnvironment ( "XgimiModelName");
Log.d ( "modelnameDetect", "the modelname is:" + str);
if (! str.equals ( "A511"))
{
boolean bool2 = str.equals ( "");
if (! bool2) {}
}
else
{
bool1 = true;
}
return bool1;
}
catch (Exception localException) {}
return false;
}
The easiest is probably to patch and replace it services.odex A511 to the Chinese ID A111
More interesting is to find a place where the model name is retrieved and placed in the environment variables.
I think it is necessarily useful to someone and help.
In MSettings.apk describes all XhimiModelName, for the CC model:
I examined the applications for setting the variable XgimiModelName.
Yet found a place. This application miniTvFactory.apk
It has the following code:
Having carefully considered the raw, you will notice changeMacFromNet procedure
in which the operation treasured
. XgimiCommonManager.getInstance () setEnvironmentHideInsecure ( "XgimiModelName", (String) localObject6);
The business is left - to understand that she was fed and how to call :))
In MSettings.apk describes all XhimiModelName, for the CC model:
public static boolean isCCAurora ()
{
return getEnvironment ( "XgimiModelName") equals ( "A511").;
}
public static boolean isCCJiGuang ()
{
return getEnvironment ( "XgimiModelName") equals ( "A211").;
}
public static boolean isCCJiGuangKumanon ()
{
return getEnvironment ( "XgimiModelName") equals ( "A311").;
}
public static boolean isCCStandard ()
{
return getEnvironment ( "XgimiModelName") equals ( "A111").;
}
{
return getEnvironment ( "XgimiModelName") equals ( "A511").;
}
public static boolean isCCJiGuang ()
{
return getEnvironment ( "XgimiModelName") equals ( "A211").;
}
public static boolean isCCJiGuangKumanon ()
{
return getEnvironment ( "XgimiModelName") equals ( "A311").;
}
public static boolean isCCStandard ()
{
return getEnvironment ( "XgimiModelName") equals ( "A111").;
}
I examined the applications for setting the variable XgimiModelName.
Yet found a place. This application miniTvFactory.apk
It has the following code:
package com.xgimi.minitvfactory.ui.view;
import android.content.Context;
import android.content.res.Resources;
import android.os.Handler;
import android.os.Message;
import android.text.TextUtils;
import android.util.Log;
import android.view.View;
import android.view.View.OnFocusChangeListener;
import android.view.ViewGroup.LayoutParams;
import android.widget.EditText;
import android.widget.LinearLayout.LayoutParams;
import android.widget.TextView;
import android.widget.Toast;
import com.xgimi.api.service.XgimiCommonManager;
import com.xgimi.minitvfactory.bean.FactoryTvAPI;
import java.io.IOException;
import org.apache.http.HttpResponse;
import org.apache.http.StatusLine;
import org.apache.http.client.ClientProtocolException;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.impl.client.DefaultHttpClient;
import org.apache.http.util.EntityUtils;
import org.json.JSONException;
import org.json.JSONObject;
public class PidEditItem
extends EditItem
{
private Handler mHandler = new Handler ()
{
public void handleMessage (Message paramAnonymousMessage)
{
switch (paramAnonymousMessage.what)
{
}
do
{
return;
paramAnonymousMessage = XgimiCommonManager.getInstance () getEnvironment ( "ethaddr").;
PidEditItem.this.setTitle (PidEditItem.this.getResources () getString (2131165198) + "::" + paramAnonymousMessage.);
Toast.makeText (PidEditItem.this.getContext (), "mac:" + paramAnonymousMessage + "????", 0) .show ();
return;
paramAnonymousMessage = XgimiCommonManager.getInstance () getEnvironment ( "XgimiModelName").;
PidEditItem.this.modelTextView.setText ( "model:" + paramAnonymousMessage);
return;
} While (paramAnonymousMessage.obj == null);
Toast.makeText (PidEditItem.this.getContext (), "" + paramAnonymousMessage.obj, 0) .show ();
}
};
private TextView modelTextView;
private Boolean shouldFocus = Boolean.valueOf (true);
public PidEditItem (Context paramContext)
{
super (paramContext);
}
private void changeMacFromNet (final String paramString)
{
new Thread (new Runnable ()
{
public void run ()
{
String str3 = "";
String str2 = "";
String str1 = "";
String str5 = "";
Object localObject16 = str2;
Object localObject12 = str1;
Object localObject8 = str3;
Object localObject17 = str2;
Object localObject13 = str1;
Object localObject9 = str3;
Object localObject18 = str2;
Object localObject14 = str1;
Object localObject10 = str3;
Object localObject19 = str2;
Object localObject15 = str1;
Object localObject11 = str3;
try
{
localObject1 = PidEditItem.this.getResultForHttpGet (paramString);
localObject16 = str2;
localObject12 = str1;
localObject8 = str3;
localObject17 = str2;
localObject13 = str1;
localObject9 = str3;
localObject18 = str2;
localObject14 = str1;
localObject10 = str3;
localObject19 = str2;
localObject15 = str1;
localObject11 = str3;
Log.i ( "PidEditItem", (String) localObject1);
localObject16 = str2;
localObject12 = str1;
localObject8 = str3;
localObject17 = str2;
localObject13 = str1;
localObject9 = str3;
localObject18 = str2;
localObject14 = str1;
localObject10 = str3;
localObject19 = str2;
localObject15 = str1;
localObject11 = str3;
JSONObject localJSONObject = new JSONObject ((String) localObject1);
str4 = str5;
localObject1 = str2;
localObject6 = str1;
localObject7 = str3;
if (localJSONObject! = null)
{
localObject16 = str2;
localObject12 = str1;
localObject8 = str3;
localObject17 = str2;
localObject13 = str1;
localObject9 = str3;
localObject18 = str2;
localObject14 = str1;
localObject10 = str3;
localObject19 = str2;
localObject15 = str1;
localObject11 = str3;
. LocalObject7 = PidEditItem.this.editText.getText () toString () trim ().;
localObject16 = str2;
localObject12 = str1;
localObject8 = localObject7;
localObject17 = str2;
localObject13 = str1;
localObject9 = localObject7;
localObject18 = str2;
localObject14 = str1;
localObject10 = localObject7;
localObject19 = str2;
localObject15 = str1;
localObject11 = localObject7;
. LocalObject1 = localJSONObject.get ( "data_mac") toString () replace ( "-", ":");.
localObject16 = localObject1;
localObject12 = str1;
localObject8 = localObject7;
localObject17 = localObject1;
localObject13 = str1;
localObject9 = localObject7;
localObject18 = localObject1;
localObject14 = str1;
localObject10 = localObject7;
localObject19 = localObject1;
localObject15 = str1;
localObject11 = localObject7;
. LocalObject6 = localJSONObject.get ( "data_model_code") toString ();
localObject16 = localObject1;
localObject12 = localObject6;
localObject8 = localObject7;
localObject17 = localObject1;
localObject13 = localObject6;
localObject9 = localObject7;
localObject18 = localObject1;
localObject14 = localObject6;
localObject10 = localObject7;
localObject19 = localObject1;
localObject15 = localObject6;
localObject11 = localObject7;
. Str4 = localJSONObject.get ( "remark") toString ();
}
}
catch (ClientProtocolException localClientProtocolException)
{
for (;;)
{
Object localObject1;
localClientProtocolException.printStackTrace ();
str4 = str5;
Object localObject2 = localObject16;
localObject6 = localObject12;
localObject7 = localObject8;
}
}
catch (IOException localIOException)
{
for (;;)
{
localIOException.printStackTrace ();
str4 = str5;
Object localObject3 = localObject17;
localObject6 = localObject13;
localObject7 = localObject9;
}
}
catch (JSONException localJSONException)
{
for (;;)
{
localJSONException.printStackTrace ();
str4 = str5;
Object localObject4 = localObject18;
localObject6 = localObject14;
localObject7 = localObject10;
}
}
catch (NullPointerException localNullPointerException)
{
String str4;
do
{
for (;;)
{
localNullPointerException.printStackTrace ();
str4 = str5;
localObject5 = localObject19;
Object localObject6 = localObject15;
Object localObject7 = localObject11;
}
} While (TextUtils.isEmpty (str4));
Object localObject5 = new Message ();
((Message) localObject5) .what = -1;
((Message) localObject5) .obj = str4;
PidEditItem.this.mHandler.sendMessage ((Message) localObject5);
}
if ((! TextUtils.isEmpty ((CharSequence) localObject7)) && (! TextUtils.isEmpty ((CharSequence) localObject1)))
{
FactoryTvAPI.setPID ((String) localObject7);
. XgimiCommonManager.getInstance () setEnvironmentHideInsecure ( "ethaddr", (String) localObject1);
localObject7 = new Message ();
((Message) localObject7) .what = 8;
((Message) localObject7) .obj = localObject1;
PidEditItem.this.mHandler.sendMessage ((Message) localObject7);
if (! TextUtils.isEmpty ((CharSequence) localObject6))
{
. XgimiCommonManager.getInstance () setEnvironmentHideInsecure ( "XgimiModelName", (String) localObject6);
localObject1 = new Message ();
((Message) localObject1) .what = 9;
((Message) localObject1) .obj = localObject6;
PidEditItem.this.mHandler.sendMessage ((Message) localObject1);
}
return;
}
}
.}) Start ();
}
private String getResultForHttpGet (String paramString)
throws ClientProtocolException, IOException
{
String str = "http://192.168.1.111/index.php?c=api&imei=" + paramString;
Object localObject = FactoryTvAPI.getPID ();
paramString = str;
if (! TextUtils.isEmpty ((CharSequence) localObject)) {
paramString = str + "& old_imei =" + (String) localObject;
}
str = "";
paramString = paramString.replaceAll ( "", "% 20");
Log.i ( "PidEditItem", paramString);
try
{
paramString = new HttpGet (paramString);
. LocalObject = new DefaultHttpClient () execute (paramString);
paramString = str;
if (((HttpResponse) localObject) .getStatusLine (). getStatusCode () == 200) {
paramString = EntityUtils.toString (((HttpResponse) localObject) .getEntity (), "UTF-8");
}
return paramString;
}
catch (Exception paramString)
{
Log.i ( "PidEditItem", "\ n YXP ######### URI IS ERR !!!! \ n");
}
return "";
}
protected void initItem ()
{
super.initItem ();
this.modelTextView = new TextView (getContext ());
this.modelTextView.setTextSize (20.0F);
this.modelTextView.setTextColor (-1);
this.modelTextView.setGravity (16);
Object localObject = new LinearLayout.LayoutParams (300, 40);
addView (this.modelTextView, (ViewGroup.LayoutParams) localObject);
String str = XgimiCommonManager.getInstance () getEnvironment ( "XgimiModelName").;
if ((str! = null) && (! TextUtils.isEmpty (str)))
{
localObject = str;
if (str! = "null") {}
}
else
{
localObject = "";
}
this.modelTextView.setText ( "model:" + (String) localObject);
this.editText.setInputType (0);
this.editText.setFocusable (true);
this.editText.setFocusableInTouchMode (true);
this.editText.setText (FactoryTvAPI.getPID ());
this.editText.setSelectAllOnFocus (true);
this.editText.setOnFocusChangeListener (new View.OnFocusChangeListener ()
{
public void onFocusChange (View paramAnonymousView, boolean paramAnonymousBoolean)
{
boolean bool2 = true;
PidEditItem localPidEditItem = PidEditItem.this;
boolean bool1;
if (! paramAnonymousBoolean)
{
bool1 = true;
localPidEditItem.setFocusable (bool1);
localPidEditItem = PidEditItem.this;
if (paramAnonymousBoolean) {
break label50;
}
bool1 = bool2;
label34:
localPidEditItem.setFocusableInTouchMode (bool1);
if (! paramAnonymousBoolean) {
break label55;
}
}
label50:
label55:
do
{
return;
bool1 = false;
break;
bool1 = false;
break label34;
.. ParamAnonymousView = ((EditText) paramAnonymousView) .getText () toString () trim ();
} While ((paramAnonymousView == null) || (paramAnonymousView.equals ( "")));
if (paramAnonymousView.length ()> 30)
{
Toast.makeText (PidEditItem.this.getContext (), "???????????????", 0) .show ();
PidEditItem.this.setText ( "");
FactoryTvAPI.setPID ( "");
return;
}
PidEditItem.this.changeMacFromNet (paramAnonymousView);
}
});
}
}
import android.content.Context;
import android.content.res.Resources;
import android.os.Handler;
import android.os.Message;
import android.text.TextUtils;
import android.util.Log;
import android.view.View;
import android.view.View.OnFocusChangeListener;
import android.view.ViewGroup.LayoutParams;
import android.widget.EditText;
import android.widget.LinearLayout.LayoutParams;
import android.widget.TextView;
import android.widget.Toast;
import com.xgimi.api.service.XgimiCommonManager;
import com.xgimi.minitvfactory.bean.FactoryTvAPI;
import java.io.IOException;
import org.apache.http.HttpResponse;
import org.apache.http.StatusLine;
import org.apache.http.client.ClientProtocolException;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.impl.client.DefaultHttpClient;
import org.apache.http.util.EntityUtils;
import org.json.JSONException;
import org.json.JSONObject;
public class PidEditItem
extends EditItem
{
private Handler mHandler = new Handler ()
{
public void handleMessage (Message paramAnonymousMessage)
{
switch (paramAnonymousMessage.what)
{
}
do
{
return;
paramAnonymousMessage = XgimiCommonManager.getInstance () getEnvironment ( "ethaddr").;
PidEditItem.this.setTitle (PidEditItem.this.getResources () getString (2131165198) + "::" + paramAnonymousMessage.);
Toast.makeText (PidEditItem.this.getContext (), "mac:" + paramAnonymousMessage + "????", 0) .show ();
return;
paramAnonymousMessage = XgimiCommonManager.getInstance () getEnvironment ( "XgimiModelName").;
PidEditItem.this.modelTextView.setText ( "model:" + paramAnonymousMessage);
return;
} While (paramAnonymousMessage.obj == null);
Toast.makeText (PidEditItem.this.getContext (), "" + paramAnonymousMessage.obj, 0) .show ();
}
};
private TextView modelTextView;
private Boolean shouldFocus = Boolean.valueOf (true);
public PidEditItem (Context paramContext)
{
super (paramContext);
}
private void changeMacFromNet (final String paramString)
{
new Thread (new Runnable ()
{
public void run ()
{
String str3 = "";
String str2 = "";
String str1 = "";
String str5 = "";
Object localObject16 = str2;
Object localObject12 = str1;
Object localObject8 = str3;
Object localObject17 = str2;
Object localObject13 = str1;
Object localObject9 = str3;
Object localObject18 = str2;
Object localObject14 = str1;
Object localObject10 = str3;
Object localObject19 = str2;
Object localObject15 = str1;
Object localObject11 = str3;
try
{
localObject1 = PidEditItem.this.getResultForHttpGet (paramString);
localObject16 = str2;
localObject12 = str1;
localObject8 = str3;
localObject17 = str2;
localObject13 = str1;
localObject9 = str3;
localObject18 = str2;
localObject14 = str1;
localObject10 = str3;
localObject19 = str2;
localObject15 = str1;
localObject11 = str3;
Log.i ( "PidEditItem", (String) localObject1);
localObject16 = str2;
localObject12 = str1;
localObject8 = str3;
localObject17 = str2;
localObject13 = str1;
localObject9 = str3;
localObject18 = str2;
localObject14 = str1;
localObject10 = str3;
localObject19 = str2;
localObject15 = str1;
localObject11 = str3;
JSONObject localJSONObject = new JSONObject ((String) localObject1);
str4 = str5;
localObject1 = str2;
localObject6 = str1;
localObject7 = str3;
if (localJSONObject! = null)
{
localObject16 = str2;
localObject12 = str1;
localObject8 = str3;
localObject17 = str2;
localObject13 = str1;
localObject9 = str3;
localObject18 = str2;
localObject14 = str1;
localObject10 = str3;
localObject19 = str2;
localObject15 = str1;
localObject11 = str3;
. LocalObject7 = PidEditItem.this.editText.getText () toString () trim ().;
localObject16 = str2;
localObject12 = str1;
localObject8 = localObject7;
localObject17 = str2;
localObject13 = str1;
localObject9 = localObject7;
localObject18 = str2;
localObject14 = str1;
localObject10 = localObject7;
localObject19 = str2;
localObject15 = str1;
localObject11 = localObject7;
. LocalObject1 = localJSONObject.get ( "data_mac") toString () replace ( "-", ":");.
localObject16 = localObject1;
localObject12 = str1;
localObject8 = localObject7;
localObject17 = localObject1;
localObject13 = str1;
localObject9 = localObject7;
localObject18 = localObject1;
localObject14 = str1;
localObject10 = localObject7;
localObject19 = localObject1;
localObject15 = str1;
localObject11 = localObject7;
. LocalObject6 = localJSONObject.get ( "data_model_code") toString ();
localObject16 = localObject1;
localObject12 = localObject6;
localObject8 = localObject7;
localObject17 = localObject1;
localObject13 = localObject6;
localObject9 = localObject7;
localObject18 = localObject1;
localObject14 = localObject6;
localObject10 = localObject7;
localObject19 = localObject1;
localObject15 = localObject6;
localObject11 = localObject7;
. Str4 = localJSONObject.get ( "remark") toString ();
}
}
catch (ClientProtocolException localClientProtocolException)
{
for (;;)
{
Object localObject1;
localClientProtocolException.printStackTrace ();
str4 = str5;
Object localObject2 = localObject16;
localObject6 = localObject12;
localObject7 = localObject8;
}
}
catch (IOException localIOException)
{
for (;;)
{
localIOException.printStackTrace ();
str4 = str5;
Object localObject3 = localObject17;
localObject6 = localObject13;
localObject7 = localObject9;
}
}
catch (JSONException localJSONException)
{
for (;;)
{
localJSONException.printStackTrace ();
str4 = str5;
Object localObject4 = localObject18;
localObject6 = localObject14;
localObject7 = localObject10;
}
}
catch (NullPointerException localNullPointerException)
{
String str4;
do
{
for (;;)
{
localNullPointerException.printStackTrace ();
str4 = str5;
localObject5 = localObject19;
Object localObject6 = localObject15;
Object localObject7 = localObject11;
}
} While (TextUtils.isEmpty (str4));
Object localObject5 = new Message ();
((Message) localObject5) .what = -1;
((Message) localObject5) .obj = str4;
PidEditItem.this.mHandler.sendMessage ((Message) localObject5);
}
if ((! TextUtils.isEmpty ((CharSequence) localObject7)) && (! TextUtils.isEmpty ((CharSequence) localObject1)))
{
FactoryTvAPI.setPID ((String) localObject7);
. XgimiCommonManager.getInstance () setEnvironmentHideInsecure ( "ethaddr", (String) localObject1);
localObject7 = new Message ();
((Message) localObject7) .what = 8;
((Message) localObject7) .obj = localObject1;
PidEditItem.this.mHandler.sendMessage ((Message) localObject7);
if (! TextUtils.isEmpty ((CharSequence) localObject6))
{
. XgimiCommonManager.getInstance () setEnvironmentHideInsecure ( "XgimiModelName", (String) localObject6);
localObject1 = new Message ();
((Message) localObject1) .what = 9;
((Message) localObject1) .obj = localObject6;
PidEditItem.this.mHandler.sendMessage ((Message) localObject1);
}
return;
}
}
.}) Start ();
}
private String getResultForHttpGet (String paramString)
throws ClientProtocolException, IOException
{
String str = "http://192.168.1.111/index.php?c=api&imei=" + paramString;
Object localObject = FactoryTvAPI.getPID ();
paramString = str;
if (! TextUtils.isEmpty ((CharSequence) localObject)) {
paramString = str + "& old_imei =" + (String) localObject;
}
str = "";
paramString = paramString.replaceAll ( "", "% 20");
Log.i ( "PidEditItem", paramString);
try
{
paramString = new HttpGet (paramString);
. LocalObject = new DefaultHttpClient () execute (paramString);
paramString = str;
if (((HttpResponse) localObject) .getStatusLine (). getStatusCode () == 200) {
paramString = EntityUtils.toString (((HttpResponse) localObject) .getEntity (), "UTF-8");
}
return paramString;
}
catch (Exception paramString)
{
Log.i ( "PidEditItem", "\ n YXP ######### URI IS ERR !!!! \ n");
}
return "";
}
protected void initItem ()
{
super.initItem ();
this.modelTextView = new TextView (getContext ());
this.modelTextView.setTextSize (20.0F);
this.modelTextView.setTextColor (-1);
this.modelTextView.setGravity (16);
Object localObject = new LinearLayout.LayoutParams (300, 40);
addView (this.modelTextView, (ViewGroup.LayoutParams) localObject);
String str = XgimiCommonManager.getInstance () getEnvironment ( "XgimiModelName").;
if ((str! = null) && (! TextUtils.isEmpty (str)))
{
localObject = str;
if (str! = "null") {}
}
else
{
localObject = "";
}
this.modelTextView.setText ( "model:" + (String) localObject);
this.editText.setInputType (0);
this.editText.setFocusable (true);
this.editText.setFocusableInTouchMode (true);
this.editText.setText (FactoryTvAPI.getPID ());
this.editText.setSelectAllOnFocus (true);
this.editText.setOnFocusChangeListener (new View.OnFocusChangeListener ()
{
public void onFocusChange (View paramAnonymousView, boolean paramAnonymousBoolean)
{
boolean bool2 = true;
PidEditItem localPidEditItem = PidEditItem.this;
boolean bool1;
if (! paramAnonymousBoolean)
{
bool1 = true;
localPidEditItem.setFocusable (bool1);
localPidEditItem = PidEditItem.this;
if (paramAnonymousBoolean) {
break label50;
}
bool1 = bool2;
label34:
localPidEditItem.setFocusableInTouchMode (bool1);
if (! paramAnonymousBoolean) {
break label55;
}
}
label50:
label55:
do
{
return;
bool1 = false;
break;
bool1 = false;
break label34;
.. ParamAnonymousView = ((EditText) paramAnonymousView) .getText () toString () trim ();
} While ((paramAnonymousView == null) || (paramAnonymousView.equals ( "")));
if (paramAnonymousView.length ()> 30)
{
Toast.makeText (PidEditItem.this.getContext (), "???????????????", 0) .show ();
PidEditItem.this.setText ( "");
FactoryTvAPI.setPID ( "");
return;
}
PidEditItem.this.changeMacFromNet (paramAnonymousView);
}
});
}
}
Having carefully considered the raw, you will notice changeMacFromNet procedure
in which the operation treasured
. XgimiCommonManager.getInstance () setEnvironmentHideInsecure ( "XgimiModelName", (String) localObject6);
The business is left - to understand that she was fed and how to call :))
Last to find today.
Under closer examination went mboot.img
This is our loader is responsible for restoring the system from a USB drive.
It also lies AES decryption key boot.img, recovery.img, tee.img and public RSA keys to verify the signatures of the other firmware images.
Without hesitation I drove it good with IDA. Use the 32 bit version. Select ARM Little Endian and go!
The result was the following finding:
As you can see from the code, on a flash drive with the firmware file may be located XgimiModelName.ini with XgimiModelName parameter
There was a question of data format for XgimiModelName option :)
Under closer examination went mboot.img
This is our loader is responsible for restoring the system from a USB drive.
It also lies AES decryption key boot.img, recovery.img, tee.img and public RSA keys to verify the signatures of the other firmware images.
Without hesitation I drove it good with IDA. Use the 32 bit version. Select ARM Little Endian and go!
The result was the following finding:
signed int sub_5F478 ()
{
int v0; // r6
const char * v1; // r0
int v2; // r5
signed int v3; // r7
int v4; // r4
int v5; // r1
int v6; // r0
const char * v7; // r0
int v8; // r0
int v9; // r10
int v10; // r0
int v12; // [sp + 10h] [bp-30h]
char v13; // [sp + 14h] [bp-2Ch]
int v14; // [sp + 18h] [bp-28h]
int v15; // [sp + 1Ch] [bp-24h]
v12 = 0;
v13 = 0;
v15 = 0;
v14 = 0;
if (MEMORY [0x2AD687F4] & 4)
{
sub_6BEEC ( "\ x1B [0; 32m [TRACE]% s \ x1B [0m", "xgimi_check_usb_update_modelname");
sub_6BEEC ( "IN \ n");
}
if (sub_E768 ( "/ XgimiModelName.ini", & v14, & v15))
{
v1 = "fail: no file in usb \ n";
LABEL_7:
sub_6BEEC (v1);
return -1;
}
v2 = sub_6C71C (0x20000);
if (! v2)
{
v1 = "malloc fail \ n";
goto LABEL_7;
}
sub_7BAFC ();
v4 = sub_6C71C (128);
if (v4)
{
sub_7BAFC ();
sub_E659C (
v4,
128,
"Fatload usb% d:% d% X% s% X",
v14,
v15,
v2,
"/XgimiModelName.ini",
0x20000,
v12,
* (_ DWORD *) & v13);
sub_6BEEC ( "cmd =% s \ n", v4);
if (sub_71494 (v4, 0) == -1)
{
v3 = -1;
sub_6BEEC ( "Error: cmd:% s \ n", v4);
LABEL_29:
sub_6C4C0 (v4);
goto LABEL_23;
}
v0 = sub_6C71C (128);
if (v0)
{
sub_7BAFC ();
v5 = sub_7BC44 (v2, & unk_1558D4) - v2;
if (v5<= 128 )
{
sub_E659C (v0, v5, (const char *) & unk_1506F4, v2);
sub_6BEEC ((const char *) & unk_1505A1, v0);
}
v6 = sub_7BC44 (v0, "XgimiModelName");
if (! v6)
{
v7 = "No USB Upgrade bin XgimiModelName in file \ n";
LABEL_19:
sub_6BEEC (v7);
goto LABEL_28;
}
v8 = sub_7BC44 (v6, & unk_16199B);
if (! v8)
{
v7 = "No USB Upgrade bin XgimiModelName in file \ n";
goto LABEL_19;
}
v9 = v8 + 1;
if (v8! = -1 && sub_7B918 (v8 + 1) == 4)
{
v10 = sub_7B918 (v9);
sub_7B7DC (& v12, v9, v10);
sub_6BEEC ( "USB Upgrade XgimiModelName =% s \ n", & v12);
v3 = 0;
sub_68DF8 ( "XgimiModelName", & v12);
goto LABEL_29;
}
}
LABEL_28:
v3 = -1;
goto LABEL_29;
}
v3 = -1;
sub_6BEEC ( "malloc fail \ n");
LABEL_23:
sub_6C4C0 (v2);
if (v0)
sub_6C4C0 (v0);
if (MEMORY [0x2AD687F4] & 4)
{
sub_6BEEC ( "\ x1B [0; 32m [TRACE]% s \ x1B [0m", "xgimi_check_usb_update_modelname");
sub_6BEEC ( "OK \ n");
}
return v3;
}
{
int v0; // r6
const char * v1; // r0
int v2; // r5
signed int v3; // r7
int v4; // r4
int v5; // r1
int v6; // r0
const char * v7; // r0
int v8; // r0
int v9; // r10
int v10; // r0
int v12; // [sp + 10h] [bp-30h]
char v13; // [sp + 14h] [bp-2Ch]
int v14; // [sp + 18h] [bp-28h]
int v15; // [sp + 1Ch] [bp-24h]
v12 = 0;
v13 = 0;
v15 = 0;
v14 = 0;
if (MEMORY [0x2AD687F4] & 4)
{
sub_6BEEC ( "\ x1B [0; 32m [TRACE]% s \ x1B [0m", "xgimi_check_usb_update_modelname");
sub_6BEEC ( "IN \ n");
}
if (sub_E768 ( "/ XgimiModelName.ini", & v14, & v15))
{
v1 = "fail: no file in usb \ n";
LABEL_7:
sub_6BEEC (v1);
return -1;
}
v2 = sub_6C71C (0x20000);
if (! v2)
{
v1 = "malloc fail \ n";
goto LABEL_7;
}
sub_7BAFC ();
v4 = sub_6C71C (128);
if (v4)
{
sub_7BAFC ();
sub_E659C (
v4,
128,
"Fatload usb% d:% d% X% s% X",
v14,
v15,
v2,
"/XgimiModelName.ini",
0x20000,
v12,
* (_ DWORD *) & v13);
sub_6BEEC ( "cmd =% s \ n", v4);
if (sub_71494 (v4, 0) == -1)
{
v3 = -1;
sub_6BEEC ( "Error: cmd:% s \ n", v4);
LABEL_29:
sub_6C4C0 (v4);
goto LABEL_23;
}
v0 = sub_6C71C (128);
if (v0)
{
sub_7BAFC ();
v5 = sub_7BC44 (v2, & unk_1558D4) - v2;
if (v5<= 128 )
{
sub_E659C (v0, v5, (const char *) & unk_1506F4, v2);
sub_6BEEC ((const char *) & unk_1505A1, v0);
}
v6 = sub_7BC44 (v0, "XgimiModelName");
if (! v6)
{
v7 = "No USB Upgrade bin XgimiModelName in file \ n";
LABEL_19:
sub_6BEEC (v7);
goto LABEL_28;
}
v8 = sub_7BC44 (v6, & unk_16199B);
if (! v8)
{
v7 = "No USB Upgrade bin XgimiModelName in file \ n";
goto LABEL_19;
}
v9 = v8 + 1;
if (v8! = -1 && sub_7B918 (v8 + 1) == 4)
{
v10 = sub_7B918 (v9);
sub_7B7DC (& v12, v9, v10);
sub_6BEEC ( "USB Upgrade XgimiModelName =% s \ n", & v12);
v3 = 0;
sub_68DF8 ( "XgimiModelName", & v12);
goto LABEL_29;
}
}
LABEL_28:
v3 = -1;
goto LABEL_29;
}
v3 = -1;
sub_6BEEC ( "malloc fail \ n");
LABEL_23:
sub_6C4C0 (v2);
if (v0)
sub_6C4C0 (v0);
if (MEMORY [0x2AD687F4] & 4)
{
sub_6BEEC ( "\ x1B [0; 32m [TRACE]% s \ x1B [0m", "xgimi_check_usb_update_modelname");
sub_6BEEC ( "OK \ n");
}
return v3;
}
As you can see from the code, on a flash drive with the firmware file may be located XgimiModelName.ini with XgimiModelName parameter
There was a question of data format for XgimiModelName option :)
Instead of easier throughFlashfireKojima alter aids Meiz fill only just systems section of Europeans instead of Chinese? I'm certainly not such a deep knowledge in programming as you Alexx99. But a lot of help this method, for example c Meizu M3 and Meizu M3S, have similar hardware but they were made for different markets, M3 for the Chinese market only, but it filled a section of the 3S system and everything worked. I do not have right now the unit, the new owner, if there is a way to try it.
t_stan @ 30.06.18, 00:30
Instead of easier through FlashFire Kojima alter aids Meiz fill only just systems section of Europeans instead of Chinese?
It will not help. Section System contains once again with the same Framework Services.jar, where it is checked and XgimiModelName environment variable on your model with the conclusion of the ill-fated window.
And generally do compote of pieces of firmware is not interesting. Much more interesting to do without crutches and change lronburg model identifier.
As the easiest option seeing substitution services.odex system library for patched (only need to change it in the "A511" to "A111"). But it crutches. Until the next update :)
P.S. I just only today for the first time in Android plunged. Funny thing.
Post has been editedAlexx99 - 30.06.18, 00:46
Reason for editing: info added
Friends, turnkey solution to change the product code and hassle-free projector Altering the English firmware I will do at the end of August.
It is also possible to try to describe how to restore okirpichennyh XGIMI devices.
The projector is now being actively used on vacation and do not want okirpichit it for a few weeks :)
It is also possible to try to describe how to restore okirpichennyh XGIMI devices.
The projector is now being actively used on vacation and do not want okirpichit it for a few weeks :)
Alexx99 I have this projector on the international version GMUI V. 1.2.0 If an affordable way to tell it with salt and throw off to you, it will be easier drank normal Russian translation interface ...Pitosh @ 02.08.18, 05:51
I have this projector on the international version GMUI V. 1.2.0 If an affordable way to tell it with salt and throw off
Thank! International version of the firmware already got.
Also I can fight software to switch the projector model with Chinese international trip.
Russification The task I have not particularly necessary. Most like to get rid of characters :))
it blunt all :(
I tuner dvb-t2 wifi h264 stream is - the picture slows down.
tv in the annex have hardware aceleration - but CC does not support it with Mali 720.
Cyrillic generally silent horror - half does not clear. I am using English interface.
Battery in battery mode - 3:00 with external speaker only.
for the money I expected more.
I tuner dvb-t2 wifi h264 stream is - the picture slows down.
tv in the annex have hardware aceleration - but CC does not support it with Mali 720.
Cyrillic generally silent horror - half does not clear. I am using English interface.
Battery in battery mode - 3:00 with external speaker only.
for the money I expected more.
©savagemessiahzine.com2005-2020 All rights reserved.
savagemessiahzine.com®- registered trademark.
Terms of Use | Denial of responsibility | Advertising placement
savagemessiahzine.com®- registered trademark.
Terms of Use | Denial of responsibility | Advertising placement