Help reverse engineering flip phone APIs

I’m the developer of PodLP, a podcast app for KaiOS and Cloud Phone flip phones. I’m in the process of building a version specifically for Android flip phones. Currently I’m testing on the Kyocera DuraXV Extreme and my friend is testing on the Cat S22, but I’d like to reverse engineer what other hidden Android APIs are out there for things like soft key navigation.

If you have an Android flip phone with ADB access, you can check the list of installed packages (adb shell cmd package list packages -f) and pull a few system APKs (i.e. SystemUI, Settings, and any OEM-specific apps). My goal is to check them in Apktool and reconstruct what vendor-specific permissions, features, and APIs are out there for flip phones.

The example in my blog shows jp.kyocera.kcfp.util.KCfpSoftkeyGuide API used to set, show, and hide the system-wide soft keys on my Kyocera. I suspect other APIs exist for different vendors. Thank you for your help!

10 Likes

TCL Flip 2 firmware (T408DL)

Kyocera E4810 firmware

http://perpetuity.kyocera.co.jp/pctool/kcfirmware/binfile66.bin

CAT S22 firmware (kitty)

F21 Pro firmware

TIQ M5 firmware

3 Likes

@ars18 does the Qin F21 Pro work well with the dpad that it will help the OP’s goal?

@ars18 Thank you! I actually have the E4810, and my friend has a CAT S22, so those are covered. I also have a somewhat broken F22, but it doesn’t have soft keys. Surprisingly, it has very few customizations. I’ll check out the F21 Pro and TIQ in case they’re different, and the TCL Flip, thanks for the links!

I’m especially interested in Ketai, Sonim, TCL, Schok… any of those devices where I’ve seen on Jose Briones’ videos that they have soft key navigation and lots of customizations.

1 Like

Well, I covered the t408dl.

Have a system image of an unknown sonim phone, from @flipphoneguy , will upload in a few.

@flipphoneguy which model is it?

@PodLP

Unknown sonim system image from @flipphoneguy

Sonim xp5800. (aka xp5s)
candy bar style but still dumbphone obviously.

if you want for the xp3800, upload speed by me is very slow so i’d rather send just necessary apps instead of system image so just let me know which apps.

edit: actually i haven’t rooted the xp3 so anyway can’t get full image. I can pull any app though.

1 Like

Interested in Nokia?

maybe we should rename the thread to flip phone firmware and just upload everything…

3 Likes

@flipphoneguy I’d rather just have a handleful of APKs, since I’m also downloading and extracting entire system images just to get framework-res.apk, SystemUI.apk, and a few system apps (esp vendor-specific ones).

@ars18 I’m interested in any Android flip phones or dumb phones, but not necessarily touchscreen phones. Does Nokia make Android flip phones? I’m well aware of their KaiOS and S30+ (Mocor) devices

sorry not sure i get it. Do you want me to upload specific apps for both the xp5 and xp3? If yes, (or eitherway) which apps?

About nokia, I’m honestly not sure. I just have some firmware in my collection.

Kyoecera E4811

https://cdn2.vzwdm.com/Kyocera_E4811_1.023VZ_1.118VZ.bin
https://cdn2.vzwdm.com/Kyocera_E4811_1.023VZ_1.151VZ.bin
https://cdn2.vzwdm.com/Kyocera_E4811_1.118VZ_1.151VZ.bin
https://cdn2.vzwdm.com/Kyocera_E4811_1.151VZ_1.200VZ.bin
https://cdn2.vzwdm.com/Kyocera_E4811_1.200VZ_1.300VZ.bin
https://cdn2.vzwdm.com/Kyocera_E4811_1.300VZ_1.401VZ.bin

Probably incremental, not full, but just in case…

I don’t know about the XP5800, but the xp3800 doesn’t have traditional soft keys.

The Xp3900 does.

Pretty sure that Nokia only has KaiOs and S30+ devices, but no Androids.

2 Likes

true. Xp5800 is the same. (actually almost the same software in everything just 64bit)

Alright, I’ve gone through some of the firmware and here’s what I found:

  • TIQ M5 has almost nothing proprietary outside of Mediatek stuff like EngineerMode
  • Sonim XP5800 has TONS of proprietary APIs including Sonim SPCC but the documentation isn’t available anymore

Many apps were built by Borqs Technologies, and some appear to be fairly permissive (although I don’t have a device to confirm). For instance, com.borqs.easervice.IEAService, which I assume means “Event Aggregator” service registers a notification listener and exposes an API for apps to use (not permission or package restricted). It offers the complete Notification data (icon, title, text, etc), but only for a whitelisted set of apps. Nothing about soft keys, likely because this model doesn’t have hardware soft keys. I didn’t see GMS itself, but there’s tons of GMS and Firebase integrations so notifications might be possible. I saw these permissions so I’m curious if you can override the PTT and SOS keys like on the Kyocera:

<uses-permission android:name="com.sonim.permission.USE_PTT_KEY"/>
<uses-permission android:name="com.sonim.permission.USE_SOS_KEY"/>

There’s so much more in the Sonim firmware, like an app whitelist to determine what shows up in the launcher, but nothing I’m interested in from an app perspective.

Also there are two secret dialer codes: 70616 (app updater), and 726882 (Sonim care). Likely not very useful

  • The TCL Flip 2 firmware only contained bsdiff patch files, so I wasn’t able to extract the full system.img or APKs

I’ll be curious to see what the Japanese/ Korean phones have, or other budget Android flip phones. I’ll also need to think through how the user experience will work without soft keys. Thanks everyone for sharing!

6 Likes
1 Like

I’m confused on the Cat S22. There’s a hidden API calling a function isExternalSoftKeySupported, and the Sonim documentation for the XP3+ mentions “External soft keys.” https://sonim-tech.files.svdcdn.com/production/documents/xp3plus_downloads/User_Guides/Sonim_XP3plus_UG_ATT_021723_Final.pdf?dm=1728057959

What makes them external? The Cat S22 doesn’t have soft keys. I’ve tried detecting soft key presence using the standard APIs, but it never worked reliably. I guess I’ll have to rely on other means

Not sure what you mean with cat s22 but the sonim xp3800 doesn’t have soft keys. The xp3+ does.