Information regarding reverse engineering the hardware and software of the Cortex system. An attempt to identify and describe any useful interfaces, documented and hidden. Including any ethernet between the Hub and Handset, NMEA, etc.

Other Examples of Garmin Hacking, most positive.

FCC Hardware Images

Source

Interfaces

tba

Poking around, found only 1 port from 1-9999 open

It's ADB 3794

⏺ Bash(~/Library/Android/sdk/platform-tools/adb -s 192.168.123.27:3794 shell id 2>&1
      ~/Library/Android/sdk/platform-tools/adb -s 192.168.123.27:3794 shell getprop ro.build.version.release 2>&1
      ~/Library/Android/sdk/platform-tools/adb -s 192.168.123.27:3794 shell getprop ro.product.model 2>&1)
  ⎿  uid=2000(shell) gid=2000(shell) groups=1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats) context=u:r:shell:s0
     5.1.1
     MSM8916 for arm64

                                                                                                                                                                             12:56 AM claude-sonnet-4-6
⏺ We're in. Android 5.1.1 on MSM8916 — exactly the H1. Let's grab everything useful right now.

⏺ Bash(~/Library/Android/sdk/platform-tools/adb -s 192.168.123.27:3794 shell "getprop ro.serialno; getprop ro.product.model; getprop ro.product.name; getprop ro.build.display.id; getprop
      ro.build.description; getprop ro.debuggable; getprop service.adb.tcp.port; getprop ro.hardware" 2>&1)
  ⎿  233010105152063609
     MSM8916 for arm64
     msm8916_64
     msm8916_64-userdebug 5.1.1 VM-2.1.18 eng.androidbuild.20231019.011103 test-keys
     msm8916_64-userdebug 5.1.1 VM-2.1.18 eng.androidbuild.20231019.011103 test-keys
     1
     3794
     qcom

⏺ Bash(~/Library/Android/sdk/platform-tools/adb -s 192.168.123.27:3794 shell "pm list packages | grep -E 'blades|handset|cortex|needle|crush'" 2>&1)
  ⎿  package:com.blades.narsilpackage:com.handsetfinaltest

                                                                                                                                                                             12:57 AM claude-sonnet-4-6
⏺ Interesting — com.blades.needle isn't there, it's com.blades.narsil. And com.handsetfinaltest is confirmed present. Let's dig deeper.

⏺ Bash(~/Library/Android/sdk/platform-tools/adb -s 192.168.123.27:3794 pull /system/app/Narsil/Narsil.apk /Users/chow/Documents/SynologyDrive/Projects/boat/Cortex\ Hacking/cortex-apk-tinker/h1_narsil.apk
      2>&1 &
      ~/Library/Android/sdk/platform-tools/adb -s 192.168.123.27:3794 pull /system/app/Handsetfinaltest/Handsetfinaltest.apk /Users/chow/Documents/SynologyDrive/Projects/boat/Cortex\
      Hacking/cortex-apk-tinker/h1_handsetfinaltest.apk 2>&1 &
      wait)
  ⎿  /system/app/Handsetfinaltest/Handsetfinaltest.apk: 1 file pulled, 0 skipped. 0.5 MB/s (6350691 bytes in 11.438s)
     /system/app/Narsil/Narsil.apk: 1 file pulled, 0 skipped. 0.6 MB/s (19418640 bytes in 31.617s)

                                                                                                                                                                             01:04 AM claude-sonnet-4-6
⏺ Both pulled. While we have shell access, let's grab more useful info in parallel.

⏺ Bash(~/Library/Android/sdk/platform-tools/adb -s 192.168.123.27:3794 shell "ip addr show; echo '---'; ip route show" 2>&1)
  ⎿  1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN
         link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
         inet 127.0.0.1/8 scope host lo
            valid_lft forever preferred_lft forever
         inet6 ::1/128 scope host
            valid_lft forever preferred_lft forever
     2: dummy0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN
         link/ether de:7c:8e:41:13:e5 brd ff:ff:ff:ff:ff:ff
     3: sit0: <NOARP> mtu 1480 qdisc noop state DOWN
         link/sit 0.0.0.0 brd 0.0.0.0
     4: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
         link/ether 00:d0:ca:02:04:86 brd ff:ff:ff:ff:ff:ff
         inet 192.168.123.27/24 brd 192.168.123.255 scope global wlan0
            valid_lft forever preferred_lft forever
         inet6 fe80::2d0:caff:fe02:486/64 scope link
            valid_lft forever preferred_lft forever
     5: p2p0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN qlen 1000
         link/ether 02:d0:ca:02:04:86 brd ff:ff:ff:ff:ff:ff
     ---
     192.168.123.0/24 dev wlan0  proto kernel  scope link  src 192.168.123.27  metric 304

⏺ Bash(~/Library/Android/sdk/platform-tools/adb -s 192.168.123.27:3794 shell "netstat -tlnp 2>/dev/null || cat /proc/net/tcp" 2>&1)
  ⎿  Proto Recv-Q Send-Q Local Address          Foreign Address        State
      tcp       0      0 0.0.0.0:3794           0.0.0.0:*              LISTEN
      tcp       0     95 192.168.123.27:3794    192.168.1.62:55552     ESTABLISHED
      udp       0      0 0.0.0.0:53435          0.0.0.0:*              CLOSE
      udp       0      0 0.0.0.0:5353           0.0.0.0:*              CLOSE
     udp6       0      0 :::48031               :::*                   CLOSE
     udp6       0      0 :::15056               :::*                   CLOSE
     udp6       0      0 :::5353                :::*                   CLOSE
     udp6       0      0 :::55049               :::*                   CLOSE