Deep Integration
Reverse Engineering Built Into My Android Launcher
This isn’t just a launcher. It’s a full in-car operating environment — built from the ground up with my own tools, diagnostics, and workflows hardcoded into the interface.
At the center is my Edge2 board running a custom AOSP Android 14 ROM, hooked into a 14" display in landscape mode. But instead of launching third-party tools like SavvyCAN or Torque, I built everything natively into a custom fork of Lawnchair.
Native RE Tools, No App Launching
All reverse engineering tools — sniffers, signal viewers, UDS explorers, multi-frame loggers, DBC viewers — are built directly into the launcher itself.
These aren’t apps you open. They’re features embedded into live tiles, overlays, or triggered via gestures or input buttons.
What’s built-in:
- Live CAN signal viewer (sorted by frame ID with auto-refresh)
- Multi-frame ISO-TP tracker with byte breakdown and session mapping
- UDS explorer for quick service request tests (with safety gating)
- DBC loader + signal visualizer (live mapping from your own DBCs)
- Session logger with auto-start on boot, filtering by bus, ID, or payload pattern
- Custom signal tagging and annotation for long-term RE work
Everything is memory-safe, battery-safe, and built specifically for vehicle runtime use — no external libraries, no Qt, no Electron bloat.
Why Native?
Because launching an app, waiting for it to load, then poking through menus isn’t how you do RE in the car.
This stack is meant to work at 110 km/h, on a winding road, or five minutes before a track session. I want to tap the screen, see raw hex live, tag a byte, and go. I want to correlate 034 boost with OEM boost across buses. I want to toggle a flag and inject a test frame on the fly. And I want all that from the launcher UI itself — not buried behind Android’s task manager.
The CAN Stack
Data comes in from:
- Teensy 4.1 triple-CAN gateway, routing physical buses cleanly
- Panda over USB-OTG, for fast bulk reads and injection
- Custom sockets and direct HAL taps from my Android ROM
No rooting required. Everything is sandboxed through my native C++ service layer and accessed by the launcher as a privileged client.
Multitasking & Windows
Despite the embedded UI focus, you can still launch regular apps — OBDeleven, SPI, Torque, etc. — in true freeform window mode. I kept that in for comparison testing and to support existing workflows.
My own modules run behind the launcher or as floating overlays. They hook into input, media buttons, or gesture zones I’ve wired in via ESP32.
Not a Product. Just My Setup.
This isn’t for sale. This is what happens when a AAA tech lead builds their own car tools from scratch — for fun.
I’ve spent 5 years building this stack — firmware, launchers, ROM mods, hardware integration — and it’s evolved into something I use every day. It reads your car. It logs your drive. It helps me reverse new ECUs. And it just works.
More posts coming soon — I’ll break down the logging format and my injection pipeline next.