| Both sides previous revisionPrevious revisionNext revision | Previous revision |
| hacking:start [2026/05/24 23:52] – instantchow | hacking:start [2026/06/02 10:07] (current) – [Projects] instantchow |
|---|
| ====== Start Page for Vesper Hacking ====== | ====== Start Page for Vesper Hacking ====== |
| |
| Information regarding reverse engineering the hardware and software of the Cortex system. An attempt to identify and describe any useful interfaces, documented and hidden. Including any ethernet between the Hub and Handset, NMEA, etc. | ===== Preface ===== |
| |
| |
| [[previous-garmin-hacks|Other Examples of Garmin Hacking, most positive.]] | This project is an independent, community-driven effort to explore, understand, and improve the hardware and software of Garmin Cortex devices for personal use. We do not represent Garmin Ltd. or any of its affiliates, and this project is in no way affiliated with, endorsed by, or sponsored by Garmin. |
| | Our goal is to ethically advance our understanding of these devices, improve their functionality for our own use, and openly share our findings, tools, and documentation with anyone who wishes to benefit from them. |
| | All work produced by this project is released as open source. We believe in transparency, community collaboration, and responsible disclosure. We do not seek to enable unauthorized access to third-party systems, harm other users, or facilitate any activity that violates applicable laws. Any modification of device firmware or software is performed solely on hardware owned by community members, for personal use. |
| |
| | Use of any tools, firmware modifications, or information provided here is entirely at your own risk. |
| |
| [[FCC Hardware Images]] | |
| |
| [[Source]] | ===== History ===== |
| |
| | Garmin (Fmr. Vesper) Cortex Marine VHF and AIS system. In 2022 Garmin [[https://www.garmin.com/en-US/newsroom/press-release/corporate/garmin-acquires-vesper-marine-a-leading-provider-of-marine-communication-equipment-and-services/|purchaced]] Vesper Marine and with that, development slowed. Cortex system owners are far and few, but the majority seem to find the integration of VHF 2-way radio, AIS, WiFi, and NMEA interfaces compelling. However, the hardware and software is a bit lacking. We seek to unlock functionality original to the Vesper roadmap and beyond. Unlike the typical marine hardware from Garmin, closed source with proprietary interfaces, the Cortex was built with a relatively open stack of extensible software. The speaker mics handsets (the main user interface for this radio) runs a vanilla Android SBC and the interface to the Hub is standard WiFi Ethernet. With APK binaries are available, aka, Cortex Onboard, it's worth investigating what features can be harnessed, reimagined or simply integrated to other systems. |
| |
| ====== Projects ====== | Wouldn't it be nice to have a H1P handset in your pocket. A handset that is actually waterproof and not full of terrible buttons that fail after a year out at sea? How about being able to stream the VHF radio audio to any device via WiFi Ethernet? Or do you simply want to read some sensor data that the M1 hub is capturing already and integrate it to your boat's [[https://signalk.org|SignalK]] network? The flaws of the OEM software and hardware should not stop us from utilizing the good parts of the system that we already own. |
| |
| [[Eärendil]] seeks to be a full functioning Vesper Cortex handset you can run on your own Android device. VHF 2 way comms from your phone to your Cortex system. | |
| |
| | ==== Reference Links ==== |
| |
| |
| | [[https://www.eff.org/issues/right-to-repair|Right To Repair]] |
| |
| | [[https://en.wikipedia.org/wiki/Enshittification|Wikipedia: Enshittification]] |
| |
| ====== Interfaces ====== | [[previous-garmin-hacks|Other Examples of Garmin Hacking, most positive.]] |
| |
| | [[fcc_hardware_images|Found FCC Hardware Images]] |
| |
| ===== NMEA ===== | [[Source]] |
| |
| tba | |
| |
| | ====== Projects ====== |
| |
| ===== Ethernet (WiFi) ===== | [[Cortini]] A python proof of concept handset and hub emulator |
| |
| |
| ==== Open Ports ===== | [[Eärendil]] seeks to be a full functioning Vesper Cortex handset you can run on your own Android device. VHF 2 way comms from your phone to your Cortex system. |
| |
| |
| === M1 Hub === | [[Patched Onboard]] a patched Cortex Onboard Android app to allow the VHF radio capability. |
| | ====== Interfaces ====== |
| |
| |
| === H1 Handset === | ===== NMEA ===== |
| |
| | tba |
| |
| Poking around, found only 1 port from 1-9999 open | ===== Ethernet (WiFi) ===== |
| |
| |
| It's ADB 3794 | ==== Open Ports ===== |
| |
| <code> | TBA |
| |
| | === M1 Hub === |
| |
| ⏺ Bash(~/Library/Android/sdk/platform-tools/adb -s 192.168.123.27:3794 shell id 2>&1 | UDP Audio Stream 53435 |
| ~/Library/Android/sdk/platform-tools/adb -s 192.168.123.27:3794 shell getprop ro.build.version.release 2>&1 | |
| ~/Library/Android/sdk/platform-tools/adb -s 192.168.123.27:3794 shell getprop ro.product.model 2>&1) | |
| ⎿ uid=2000(shell) gid=2000(shell) groups=1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats) context=u:r:shell:s0 | |
| 5.1.1 | |
| MSM8916 for arm64 | |
| |
| 12:56 AM claude-sonnet-4-6 | |
| ⏺ We're in. Android 5.1.1 on MSM8916 — exactly the H1. Let's grab everything useful right now. | |
| |
| ⏺ Bash(~/Library/Android/sdk/platform-tools/adb -s 192.168.123.27:3794 shell "getprop ro.serialno; getprop ro.product.model; getprop ro.product.name; getprop ro.build.display.id; getprop | === H1 Handset === |
| ro.build.description; getprop ro.debuggable; getprop service.adb.tcp.port; getprop ro.hardware" 2>&1) | |
| ⎿ 233010105152063609 | |
| MSM8916 for arm64 | |
| msm8916_64 | |
| msm8916_64-userdebug 5.1.1 VM-2.1.18 eng.androidbuild.20231019.011103 test-keys | |
| msm8916_64-userdebug 5.1.1 VM-2.1.18 eng.androidbuild.20231019.011103 test-keys | |
| 1 | |
| 3794 | |
| qcom | |
| |
| ⏺ Bash(~/Library/Android/sdk/platform-tools/adb -s 192.168.123.27:3794 shell "pm list packages | grep -E 'blades|handset|cortex|needle|crush'" 2>&1) | ADB 3794 |
| ⎿ package:com.blades.narsilpackage:com.handsetfinaltest | UDP Audio Stream 53435 |
| |
| 12:57 AM claude-sonnet-4-6 | |
| ⏺ Interesting — com.blades.needle isn't there, it's com.blades.narsil. And com.handsetfinaltest is confirmed present. Let's dig deeper. | |
| |
| ⏺ Bash(~/Library/Android/sdk/platform-tools/adb -s 192.168.123.27:3794 pull /system/app/Narsil/Narsil.apk /Users/chow/Documents/SynologyDrive/Projects/boat/Cortex\ Hacking/cortex-apk-tinker/h1_narsil.apk | |
| 2>&1 & | |
| ~/Library/Android/sdk/platform-tools/adb -s 192.168.123.27:3794 pull /system/app/Handsetfinaltest/Handsetfinaltest.apk /Users/chow/Documents/SynologyDrive/Projects/boat/Cortex\ | |
| Hacking/cortex-apk-tinker/h1_handsetfinaltest.apk 2>&1 & | |
| wait) | |
| ⎿ /system/app/Handsetfinaltest/Handsetfinaltest.apk: 1 file pulled, 0 skipped. 0.5 MB/s (6350691 bytes in 11.438s) | |
| /system/app/Narsil/Narsil.apk: 1 file pulled, 0 skipped. 0.6 MB/s (19418640 bytes in 31.617s) | |
| |
| 01:04 AM claude-sonnet-4-6 | |
| ⏺ Both pulled. While we have shell access, let's grab more useful info in parallel. | |
| |
| ⏺ Bash(~/Library/Android/sdk/platform-tools/adb -s 192.168.123.27:3794 shell "ip addr show; echo '---'; ip route show" 2>&1) | |
| ⎿ 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN | |
| link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 | |
| inet 127.0.0.1/8 scope host lo | |
| valid_lft forever preferred_lft forever | |
| inet6 ::1/128 scope host | |
| valid_lft forever preferred_lft forever | |
| 2: dummy0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN | |
| link/ether de:7c:8e:41:13:e5 brd ff:ff:ff:ff:ff:ff | |
| 3: sit0: <NOARP> mtu 1480 qdisc noop state DOWN | |
| link/sit 0.0.0.0 brd 0.0.0.0 | |
| 4: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000 | |
| link/ether 00:d0:ca:02:04:86 brd ff:ff:ff:ff:ff:ff | |
| inet 192.168.123.27/24 brd 192.168.123.255 scope global wlan0 | |
| valid_lft forever preferred_lft forever | |
| inet6 fe80::2d0:caff:fe02:486/64 scope link | |
| valid_lft forever preferred_lft forever | |
| 5: p2p0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN qlen 1000 | |
| link/ether 02:d0:ca:02:04:86 brd ff:ff:ff:ff:ff:ff | |
| --- | |
| 192.168.123.0/24 dev wlan0 proto kernel scope link src 192.168.123.27 metric 304 | |
| |
| ⏺ Bash(~/Library/Android/sdk/platform-tools/adb -s 192.168.123.27:3794 shell "netstat -tlnp 2>/dev/null || cat /proc/net/tcp" 2>&1) | ⏺ Bash(~/Library/Android/sdk/platform-tools/adb -s 192.168.123.27:3794 shell "netstat -tlnp 2>/dev/null || cat /proc/net/tcp" 2>&1) |
| udp6 0 0 :::5353 :::* CLOSE | udp6 0 0 :::5353 :::* CLOSE |
| udp6 0 0 :::55049 :::* CLOSE | udp6 0 0 :::55049 :::* CLOSE |
| | |
| </code> | |
