Hello manufacturer. Good device. But software we want to customize. If you allow, we will buy more.
Despite being advertised as "4K 1080P", it really downscales those to 720P.
But for 28.50 EUR from Amazon Warehuose Germany in 2025, one can't exactly complain. https://www.amazon.de/dp/B0DSP74YQW
Chengdu Hotack Technology Co., Ltd. is the OEM?
- Brightness not an issue in dark rooms
- Android built in
- HDMI-CEC lets you steer other devices over IR
- Built-in USB strong enough to power 3.5 inch USB3 hard disk and can play back from it
- You are not root on your own device (unless we find a solution). It is really a shame that we, the owners of the devices, can't have full control over what we purchased!
- GPL violation - BSP (AOSP) not available? (See below)
- Poor mono built in speaker. No audio jack, even though there are T, R, G connectors on the PCB
- 720p gets very poor soon when you use the built in software keystone correcetion
- Short throw means it needs to be positioned relatively closely to the projection surface
- Factory-installed malware? https://github.com/micha102/hy300pro-debloat
On the device it says: LED PROJECTOR Model: X1BQ
Firmware version: projector.20250507.175825
On the box a sticker says: Chengdu Hotack Technology Co. Ltd - https://www.hotack.cn/
Importer: EUbridge Advisory GmbH, Virginia Str. 2, 35510 Butzbach
LCD_2C_713_5755A-V1.0.0 2024_04_16
Chengdu Hotack Technology Co., Ltd.
Product Similarity Declaration
Product name: Projector Model name: X1BQ, X1, X1AQ, HY300 Pro+, X1A, X1B, X1C, X1D, X1E, X1F, X1G, X1H, X1L, X1J, X1K, X1M, X1N, X1P, X1Q, X1R, X1S, X1T, X1U, X1W, X1Y, X1Z, PG310 FCC ID: 2BFIZ-X1
We (Chengdu Hotack Technology Co., Ltd.) hereby state that all the models are electrical identical including the same software parameter and hardware design (i.e., circuit design, PCB Layout, RF module/circuit, antenna type(s) and antenna location, components on PCB, etc.,), same mechanical structure and design (including product enclosure, materials, etc.,), the only differ in appearance shape, color, antenna position and model name.
Model Name:
X1BQ, X1, HY300 Pro+, X1B
X1AQ, X1A, X1C, X1D, X1E, X1F, X1G, X1H, X1L, X1J, X1K, X1M, X1N, X1P, X1Q, X1R, X1S, X1T, X1U, X1W, X1Y, X1Z, PG310
Chengdu Hotack Technology Co., Ltd. Signature: Name: Star Hu Title: Manager 2025-06-19
Source: https://device.report/m/e288514af81a6c8da577b70697219adde9273a2a94be2cd0c861a98e0e861306
Related FCC IDs: 2BFIZ-X1 - Chengdu Hotack Technology Co., Ltd. Projector [-X1]
Allwinner H713 Quad-Core ARM Cortex-A53: https://linux-sunxi.org/H713
"The Allwinner H713 SoC is an A53 quad-core chip with support for MAX 2GB DDR, 1920x1080P LVDS interface, and keystone correction. It is ideal for developing projectors, especially low-cost LCD projectors."
According to https://linux-sunxi.org/Allwinner_SoC_Family,
"H for “Homlet”, mainly used in home entertainment applications, including smart OTT boxes, HDMI mini PCs, gaming boxes, etc."
There are 3 screws that must be removed. 1 at the back and 2 under the black plastic front grille. Then it is straightforward to open the case by squeezing the bottom base together a bit and inserting a spudger.
- The upper case is marked HY200Pro-4-1-F
- The front grille is marked HY300ultra-v2-1-F
So they seem to be re-using the same housing parts for different models.
The default launcher is called "LuminaOS" and hardcodes buttons for services I don't use, like Netflix. The same apk also contains the configuration interface for critical things including projection settings like keystone correction. The apk can be downloaded from the projector with adb pull /product/app/LuminaOS/LuminaOS.apk ./LuminaOS.apk. Possibly it is somewhat similar to https://github.com/xuhao120833/LuminaOS_D068/? When we compile that, it is essentially the same app and largely working, but it crashes when one tries to open the projection settings. Probably because it is configured for the Hotack D068 instead of the X1BQ. Too bad there is absolutely no documentation about any of this.
Possibly by comparing the content of the apk from the projector to the source code, one could modify the source code so that it works?
Or is it failing simply because our app is not a system app and cannot access the hardware abstraction layer for "security" reasons (read: keep out anyone but the hardware manufacturer)?
Any insights? Please comment below.
10-20 01:21:35.842 2677 3579 I ActivityTaskManager: START u0 {flg=0x10000000 cmp=com.htc.luminaos/.activity.ProjectActivity} from uid 1000
- https://github.com/sinusinu/Molla/ allows one to put the apps on the launcher that one really cares about
- When using Molla as a launcher, apps behave more like TV apps; e.g., naviagtion in the zapp app is suddenly possible with the remote control rather than requiring touch (things like this are really unintuitive in Android imho)
- To switch to HDMI run
adb shell am start -n com.softwinner.awlivetv/.MainActivity(I have written a tiny app that does just that)
However, it still needs to be checked whether things like Keystone correction and HDMI CEC still work if one disables the LuminaOS launcher with adb shell pm disable-user --user 0 com.htc.luminaos. (Turns out that basic keystone correction still works, but there is no UI anymore for the more advanced vertical correction.)
I would like the projector to behave like a regular old-school TV set, that is, to open an app that plays a TV channel upon boot. Specifically, I would like to run https://f-droid.org/en/packages/de.christinecoenen.code.zapp/ upon boot.
Possibly it can be done with https://github.com/tabletradio/altlauncher?
https://f-droid.org/en/packages/news.androidtv.launchonboot/ does NOT seem to work.
Any insights? Please comment below.
Over ADB, can launch using monkey -p de.christinecoenen.code.zapp 1 (with de.christinecoenen.code.zapp being the app to be launched).
To see the currently running activity, dumpsys activity top | grep "ACTIVITY". Start it with, e.g., am start -n de.christinecoenen.code.zapp/.app.main.MainActivity. Maybe we can use monkey to automate clicking on certain buttons?
However, I did not find a way yet to set it as the default home.
cmd package set-home-activity de.christinecoenen.code.zapp/.app.main.MainActivity
Error: Failed to set default home.
Any insights? Please comment below.
Using input it is possible to simulate keyboard entry via ADB, e.g.,:
# Enter
input keyevent 66
https://slideshow.digital/documentation/mqtt-integration/ allows to send shell commands via MQTT, even when the application is not running!
Instead of using WLAN, I would like to use an USB Ethernet dongle.
It works out of the box with a USB Ethernet dongle with the ASIX AX88772B chip (0b95:772b) and a Realtek Semiconductor RTL8152 Fast Ethernet Adapter (0bda:8152). I have not tested others yet.
By clicking a couple of times on the model name in About, one can enable Developer Mode. One can then enable "USB Debugging" (Note: USB peripherals like network, mouse, keyboard then won't work anymore) and/or "ADB Debugging".
With "ADB Debugging" on, one can access adb over the network with adb connect <ip address> (no port needed). Then, do adb shell.
ADB can be downloaded from https://developer.android.com/tools/releases/platform-tools ("Platform Tools").
uname -a
Linux localhost 5.4.99-00042-gfef13bfcf59a-dirty #346 SMP PREEMPT Wed May 7 17:55:19 CST 2025 armv7l
Appanently it is not possible to remove the malware without rooting, but one can at least disable it over adb:
According to https://github.com/micha102/hy300pro-debloat
adb shell pm disable-user --user 0 com.hotack.silentsdk
adb shell pm disable-user --user 0 com.hotack.writesn
com.htc.htclauncherhighenglishd08 is also a malware (accessing to shortx.srafx.com which is a video shorts website and imasdk.googleapis.com), but to remove it you must first install an alternative Android TV launcher and create an app to launch the HDMI source which is com.softwinner.awlivetv.MainActivity
adb pull /system/app/Update/Update.apk
Can we extract the OTA URL from here?
$ lsmod
Module Size Used by
aic8800_fdrv 299008 0
aic8800_btlpm 24576 0
aic8800_bsp 73728 1 aic8800_fdrv
xvatouch 16384 0
snd_alsa_trid 110592 1
mcu_comm_dev 24576 2
demux_dev 348160 0
cpu_comm_dev 131072 2
hidtvreg_dev 16384 28
sunxi_dtmbip 20480 0
decd 77824 2
ge2d_dev 135168 4
vs_io_helper 16384 3 demux_dev,cpu_comm_dev,ge2d_dev
mali_kbase 417792 16
sunxi_rfkill 24576 2 aic8800_fdrv,aic8800_bsp
google_ve 20480 0
backlight 24576 1 ge2d_dev
sunxi_tvtop 20480 3 sunxi_dtmbip,decd,ge2d_dev
sunxi_ve 28672 0
sunxi_addr 16384 1 aic8800_fdrv
Available modules
adt3:/ $ find vendor/lib/modules/
vendor/lib/modules/
vendor/lib/modules/cpu_comm_dev.ko
vendor/lib/modules/logger.ko
vendor/lib/modules/aic8800_bsp.ko
vendor/lib/modules/aic8800_fdrv.ko
vendor/lib/modules/modules.load
vendor/lib/modules/init-input.ko
vendor/lib/modules/88x2bs.ko
vendor/lib/modules/88x2cu.ko
vendor/lib/modules/demux_dev.ko
vendor/lib/modules/snd_alsa_trid.ko
vendor/lib/modules/modules.softdep
vendor/lib/modules/vs_io_helper.ko
vendor/lib/modules/modules.alias
vendor/lib/modules/sunxi_rfkill.ko
vendor/lib/modules/aic8800_btlpm.ko
vendor/lib/modules/stk3x1x.ko
vendor/lib/modules/vf-test.ko
vendor/lib/modules/modules.dep
vendor/lib/modules/8723du.ko
vendor/lib/modules/sprdbt_tty.ko
vendor/lib/modules/sprdwl_ng.ko
vendor/lib/modules/sunxi_dtmbip.ko
vendor/lib/modules/hall_sensor.ko
vendor/lib/modules/ci_dev.ko
vendor/lib/modules/decd.ko
vendor/lib/modules/uwe5622_bsp_sdio.ko
vendor/lib/modules/xr819.ko
vendor/lib/modules/dma-buf-test-exporter.ko
vendor/lib/modules/hidtvreg_dev.ko
vendor/lib/modules/gslX680new.ko
vendor/lib/modules/mali_kbase.ko
vendor/lib/modules/atbm602x_wifi_usb.ko
vendor/lib/modules/8188fu.ko
vendor/lib/modules/rtl_btlpm.ko
vendor/lib/modules/mcu_comm_dev.ko
vendor/lib/modules/gspca_main.ko
vendor/lib/modules/bufmem_dev.ko
vendor/lib/modules/xvatouch.ko
vendor/lib/modules/rtk_btusb.ko
vendor/lib/modules/tvutils.ko
vendor/lib/modules/ge2d_dev.ko
vendor/lib/modules/incrementalfs.ko
vendor/lib/modules/xradio_btlpm.ko
vendor/lib/modules/wireless_switch.ko
Note HYK_TEST. So related to https://hyk-projector.com/ indeed?
adt3:/ $ ls product/app/
AirPlayServer HTC_Wizard_QZ ScreenSaverQZ
BluetoothSpeaker HYK_TEST StoreOs_QZ
Browser2 HanYingH713TVApp_HY USBCastServer
ClearMemory HiFileManager UpdateService_L010
CloseDialog_QZ HtcOfficeSuite htc_cast
EventUploadService HtcOtaUpdate_QZ iOSUsbCastServer
ExpandSDK LatinIME tpjz_allwinner
FtDlnaNoUi LuminaOS webview
Gallery2 ModuleMetadata
HTCBluetoothRemoteControl PackageOverride
Interestingly, MobiOffice from https://mobisystems.com/ is preinstalled. See https://play.google.com/store/apps/details?id=com.mobisystems.office
Firmware seems to be related to Allwinner h713_tuna_p3.
[ 2.018939] init: Using Android DT directory /proc/device-tree/firmware/android/
[ 2.028080] init: Overriding previous 'ro.' property 'ro.product.system.brand':'ADT-3' with new value 'Allwinner'
[ 2.028175] init: Overriding previous 'ro.' property 'ro.product.system.model':'ADT-3' with new value 'QUAD-CORE h713 tuna_p3'
[ 2.028218] init: Overriding previous 'ro.' property 'ro.product.system.name':'adt3' with new value 'h713_tuna_p3'
[ 2.029047] init: Overriding previous 'ro.' property 'pm.dexopt.shared':'speed' with new value 'quicken'
[ 2.032013] init: Overriding previous 'ro.' property 'ro.product.system.name':'h713_tuna_p3' with new value 'adt3'
[ 2.032136] init: Overriding previous 'ro.' property 'ro.product.system.brand':'Allwinner' with new value 'ADT-3'
[ 2.032252] init: Overriding previous 'ro.' property 'ro.product.model':'adt3' with new value 'ADT-3'
[ 2.032331] init: Overriding previous 'ro.' property 'ro.product.system.model':'QUAD-CORE h713 tuna_p3' with new value 'ADT-3'
This thread seems related:
https://blog.csdn.net/yyzsyx/article/details/135954060
- Disconnect the power cable entirely
- Use a USB A to USB A cable and connect it to the host OC
- A red LED comes up on the projector (note that it is ONLY connected via USB, power is NOT attached)
- Press the power button
- dmesg shows
<vendor 0x1f3a product 0xefe8> at usbus1("sunxi SoC OTG connector in FEL/flashing mode") - On the host PC use a tool like sunxi-tools
But currently it crashes: linux-sunxi/sunxi-tools#226
Project Treble seems to be supported, can it be used to boot generic Android images?
% adb shell getprop ro.treble.enabled
true
Any insights? Please comment below.
For this to work, we would need a factory firmware image?
Will it work on the HY300 PRO?
Is there a factory firmware to flash safely in case the above goes wrong?
Apparently PhoenixSuit is the Windows tool for firmware flashing for Allwinner chips.
https://mega.nz/file/2RIxHQra#wWv5jAIdscmkaTsRSe3r6uJWg9Tos39TeyEx83vH7VM shows an update procedure using a USB stick with update/update.img and update/auto_update.txt (containing sunxi_flash write update/update.img firmware) files and no Windows tools. Source: https://xdaforums.com/t/magcubic-hy300-smart-projector-4k-android-11-firmware-upgrade-how-to.4676913/page-10#post-90207204 (but this is for the non-PRO model!)
According to https://4pda.to/forum/index.php?showtopic=1087405&view=findpost&p=136736890,
- Extract it to a USB flash drive formatted as FAT32. The folder named "update" must be at the root of the drive.
- Rename the projector firmware file you need — for example, "HY320_user_public_en_E_weidong_OTA_2024-03-22-1557.img" (NOTE: THIS IS FOR A DIFFERENT PROJECTOR! IT SEEMS IT IS THE SAME FILE THAT CAN BE USED WITH PhoenixSuit?) — to "update.img" and copy it into the "update" folder on the flash drive. In the end, the "update" folder should contain two files: "auto_update.txt" and "update.img".
- Important! It seems the projector is sensitive to letter case in file and folder names, so all file and folder names must be lowercase.
- Disconnect the projector from 220 V (unplug it).
- Insert the prepared flash drive into the projector.
- Plug the projector back into the mains. Do not press the power button on the projector or the remote. After a short time, when the projector is powered from the 220 V outlet, the update should start — a green progress bar will appear. Note that flashing is a long procedure. Let it finish; do not turn off the projector while it is running.
- When the firmware update finishes, a fully filled progress bar and a confirmation of completion will appear.
- Unplug the projector from the 220 V mains.
- Remove the flash drive from the projector, otherwise re-powering the projector will start the update again.
- Plug the projector into the mains and turn it on using the power button. The projector should boot and begin the initial setup (language selection and so on).
https://github.com/chainsx/u-boot-t527-vendor/blob/9946258bf4e9adc6c0309f0067639c0400fbc58b/sprite/sprite_auto_update.c#L1057-L1068 explains the syntax.
sunxi_flash write update/update.img firmware means "flash the file update/update.img to the partition firmware.
I am wondering whether I can use an auto_update.txt file containing a sunxi_flash read (...) command to dump (backup) the factory firmware in a similar way. But looking at the above source code, it doesn't seem that is implemented, as the code focuses on updating firmware from external storage (such as USB sticks) to internal flash memory, not for dumping data from internal memory to a file on external media.
https://mega.nz/file/pXUwnb7L#Vd9Rd9PNP2wQNKGzQscpfxs4byZclZu80EbZAhnbhJU has "HY300_T08_OTA_2024-04-19-2028_AndroidPC .rar" (1.08 GB) which claims to be "Firmware / ROM for HY300 / Pro Projector with Allwinner H713 SoC (2024-10-31)" according to https://androidpctv.com/firmware-hy300-pro-projector/.
Other firmware file names (NOT tested to work):
- HY300_T08_OTA_2024-04-19-2028
- HY300Pro_user_public_en_2.69_F_cyh_FT_OTA_2024-12-25-1754_2024-12-26-1834
- HY300Pro_user_public_en_E_2.69_F_weidong_OTA_2024-07-12-1731
Also see
Dear manufacturer: Please offer an OFFICIAL link to the firmware file.
Any insights? Please comment below.
https://blog.csdn.net/yyzsyx/article/details/134729866 seems to have information regarding the Allwinner TV303/H713 BSP.
But where can the BSP itself be downloaded?
Any insights? Please comment below.
https://github.com/shift/sun50iw12p1-research "Mainline Linux porting project for Allwinner H713 (sun50iw12p1) SoC - HY300 Android projector hardware enablement with complete device tree, U-Boot support, and driver integration research"
Does it work on the HY300 PRO?
Any insights? Please comment below.
https://gitlab.com/Atharok/BtRemote
`dmesg shows:
[ 0.551410] Registered IR keymap rc_map_sunxi
[ 0.551486] rc rc0: sunxi-ir as /devices/platform/soc@2900000/7040000.s_cir/rc/rc0
[ 0.551607] input: sunxi-ir as /devices/platform/soc@2900000/7040000.s_cir/rc/rc0/s_cir_rx
This thread seems related: https://developer.aliyun.com/article/1599735
To be read using https://github.com/bengtmartensson/IrScrutinizer.
Any insights? Please comment below.