BYDLab
Search
Menu
Search guides, apps and RE papers

Tag

reverse-engineering

11 articles

  1. RE paper

    6 min read

    Reverse engineering paper #4 — the fused position API we cannot reach

    BYD's SDK defines a vehicle position with a heading in it. The contract is readable on this car; the implementation is not in this app.

    BYD Sealion 7 · MoroccoStrong evidence

  2. RE paper

    8 min read

    Reverse engineering paper #8 — what selects the cluster's navigation view

    Simple, Small and Full. One vendor display mode picks which the instrument shows, it lives in a system setting, and it outlives the app that set it.

    BYD Sealion 7 · MoroccoConfirmedmedium risk

  3. RE paper

    5 min read

    Reverse engineering paper #11 — where the cluster composites an Android surface

    The cluster panel is 1920×720, but an app's surface lands in a 440-pixel band — full width in Full, a 640-pixel card in Small.

    BYD Sealion 7 · MoroccoConfirmed

  4. RE paper

    8 min read

    Reverse engineering paper #7 — how an app reaches the instrument cluster

    One system service, one AIDL and a Bundle command set reach the cluster — with no session token, no heartbeat and no client-liveness tracking.

    BYD Sealion 7 · MoroccoConfirmedmedium risk

  5. RE paper

    5 min read

    Reverse engineering paper #10 — roundabout icons are angle-indexed, not ordinal

    The ROUNDABOUT_EXIT_1..18 icon ids are not exit numbers. The unit picks them by exit angle, in eight 45-degree buckets.

    BYD Sealion 7 · MoroccoStrong evidence

  6. RE paper

    8 min read

    Reverse engineering paper #9 — which endpoint feeds the cluster's own turn card

    DataType 37 on msgType 3, subtype 20 feeds the cluster's native turn card. DataType 15 and 16 have no sender anywhere in the firmware.

    BYD Sealion 7 · MoroccoConfirmedmedium risk

  7. RE paper

    8 min read

    Reverse engineering paper #6 — the one gate a normal app controls

    BYD's background killer spares any process owning a visible activity. The cluster is a public display, so an ordinary app can put one there.

    BYD Sealion 7 · MoroccoConfirmed

  8. RE paper

    4 min read

    Reverse engineering paper #1 — the export Sealion 7 has no navigation engine

    The export head unit carries no map engine at all. Navigation is the phone's, projected — and that changes what an app on this car can and cannot do.

    BYD Sealion 7 · MoroccoConfirmed

  9. RE paper

    7 min read

    Reverse engineering paper #3 — no heading signal on the vehicle bus

    No yaw rate, no steering angle, no compass anywhere in the 277-class BYD SDK. Heading is not published — it always has to be derived.

    BYD Sealion 7 · MoroccoConfirmed

  10. RE paper

    8 min read

    Reverse engineering paper #5 — why a backgrounded app is killed

    BYD's PerfMonitor SIGKILLs any backgrounded process whose PSS passes a per-process cap — 370 688 kB here — and a foreground service does not save it.

    BYD Sealion 7 · MoroccoConfirmed

  11. RE paper

    5 min read

    Reverse engineering paper #2 — the vehicle signals a normal app can read

    Twenty-two live signals — battery, charging, tyres, motor, gear — reachable from an ordinary sideloaded app, and the two interfaces that hand them over.

    BYD Sealion 7 · MoroccoConfirmed