Reverse engineering paper #11 — where the cluster composites an Android surface
The cluster panel is 1920×720, but an app's surface lands in a 440-pixel band — full width in Full, a 640-pixel card in Small.
BYD Sealion 7 · MoroccoConfirmed
RE papers
Numbered reverse-engineering papers on BYD head-unit software. One question per paper, answered with its evidence and the confidence that evidence supports.
11 RE papers
Reverse engineering paper #10 — roundabout icons are angle-indexed, not ordinal
The ROUNDABOUT_EXIT_1..18 icon ids are not exit numbers. The unit picks them by exit angle, in eight 45-degree buckets.
BYD Sealion 7 · MoroccoStrong evidence
Reverse engineering paper #9 — which endpoint feeds the cluster's own turn card
DataType 37 on msgType 3, subtype 20 feeds the cluster's native turn card. DataType 15 and 16 have no sender anywhere in the firmware.
BYD Sealion 7 · MoroccoConfirmedmedium risk
Reverse engineering paper #8 — what selects the cluster's navigation view
Simple, Small and Full. One vendor display mode picks which the instrument shows, it lives in a system setting, and it outlives the app that set it.
BYD Sealion 7 · MoroccoConfirmedmedium risk
Reverse engineering paper #7 — how an app reaches the instrument cluster
One system service, one AIDL and a Bundle command set reach the cluster — with no session token, no heartbeat and no client-liveness tracking.
BYD Sealion 7 · MoroccoConfirmedmedium risk
Reverse engineering paper #6 — the one gate a normal app controls
BYD's background killer spares any process owning a visible activity. The cluster is a public display, so an ordinary app can put one there.
BYD Sealion 7 · MoroccoConfirmed
Reverse engineering paper #5 — why a backgrounded app is killed
BYD's PerfMonitor SIGKILLs any backgrounded process whose PSS passes a per-process cap — 370 688 kB here — and a foreground service does not save it.
BYD Sealion 7 · MoroccoConfirmed
Reverse engineering paper #4 — the fused position API we cannot reach
BYD's SDK defines a vehicle position with a heading in it. The contract is readable on this car; the implementation is not in this app.
BYD Sealion 7 · MoroccoStrong evidence
Reverse engineering paper #3 — no heading signal on the vehicle bus
No yaw rate, no steering angle, no compass anywhere in the 277-class BYD SDK. Heading is not published — it always has to be derived.
BYD Sealion 7 · MoroccoConfirmed
Reverse engineering paper #2 — the vehicle signals a normal app can read
Twenty-two live signals — battery, charging, tyres, motor, gear — reachable from an ordinary sideloaded app, and the two interfaces that hand them over.
BYD Sealion 7 · MoroccoConfirmed
Reverse engineering paper #1 — the export Sealion 7 has no navigation engine
The export head unit carries no map engine at all. Navigation is the phone's, projected — and that changes what an app on this car can and cannot do.
BYD Sealion 7 · MoroccoConfirmed