Geely Tugella 2023: ADB, WiFi, CarLinkit

Research report and step-by-step guide for opening up the Tugella (FY11 / 星越S) head unit. Compiled from 4pda, drive2, XDA, Habr, Autohome and CarLinkit sources.

Compiled 7 Oct 2026. Nothing here has been tested on a GCC car yet. Every step is quoted from owner reports; source links at the bottom.

The Monjaro method does not carry over. The Monjaro runs a Qualcomm unit. The facelift Tugella runs an ECARX E02 on MediaTek MT6771 with Android 9, a package whitelist and USB locked in host/charge mode. Different exploits, different limits.

Short version

  1. Look at the UI. Light/white UI = IHU717P (most 2023 cars). Dark UI = IHU520G. Confirm in Settings → About.
  2. IHU717P: open engineering menu → T-Box → vave tbox升级 → tap the title 6+ times → shell指令. You now have a limited shell, no disassembly.
  3. From that shell: open WiFi settings, join your phone hotspot. WiFi stays on across reboots.
  4. From that shell: set ADB TCP port 5555, toggle ADB in engineering menu 1, adb connect. Resets on reboot.
  5. Installing arbitrary APKs is still gated by ECARX's whitelist. AutoKit installs; many APKs fail with INSTALL_FAILED_INVALID_APK. The community USB-stick tool (Magic_SQD v4) and paid GUHub claim full app install without disassembly.
  6. CarPlay: if the car has the dealer CarPlay update (IHU717P only, GCC 2023-24 reportedly eligible), any CarLinkit CarPlay dongle works on the left USB port. CP2A (4.0) gives Android Auto too. No native Android Auto exists.

1. Identify your head unit

The 2022-2023 facelift shipped with two different units. The path differs between them, so check this first.

UnitNickname (4pda)YearsHardwareWhat works
IHU717P"Белорест", light UI2023+, also Knewstar 001ECARX E02, MT6771, Android 9, 4/64 GB, 12.3" 1920x720 @160dpi, no GPS moduleshell, WiFi, WiFi ADB, CarPlay update
IHU520G"Чернорест", dark UI2022-2023Same E02 hardware, firmware IHU520G-11-0CXdisassembly only
IHU509GChina Xingyue S, some CN-market TugellasNot documentedno "vave tbox" entry, shell method fails
E01"дорест"Pre-facelift 2019-2022, Atlas ProMTK6735, Android 5.1UART only

Firmware strings seen on IHU717P: SWFY11J0905H8BGH:00121, SWFY11J0219H8B0H:00046, IHU717P-00-AAC, IHU717P-00-BDH. A GCC 2022 owner reported DL-5JA-PBAPO1A, which matches none of these. Write yours down before doing anything.

GCC 2023 = IHU717P is likely (the UAE/Qatar dealer CarPlay update covered 2023-24 cars, and that update only installs on IHU717P) but unconfirmed.

2. Engineering menu

Open the Phone app → keypad on the head unit and dial the code. Don't press call; the menu opens by itself. The code is built from the head unit's clock, in 12-hour format:

Examples from sources: 15 July 04:30 → #*121504 / #*171504. 25 March 3:20 PM → menu 2 #*132503. 19 Sep 21:30 → menu 1 #*141909.

Menu 1-
Menu 2-

If the unit's clock is wrong, the Gallery app's calendar shows the date it thinks it is. Emgrand / Belgee S50 use #*1101HH instead.

What's in there

3. Hidden shell (IHU717P, no disassembly)

Found by 4pda user kit.white, April 2026. The T-Box updater tool (com.linksci.tboxtool) has a hidden debug console.

  1. Open engineering menu 1 (calculator above).
  2. Go to the T-Box section and press vave tbox升级.
  3. Tap the screen title quickly 6 or more times. Hidden buttons appear: shell指令, tcp, AT, ...
  4. Press shell指令. A console opens (com.linksci.tboxtool.ShellActivity). It runs with the tool's limited rights, not root.

Useful activities to launch from here:

am start --user 0 -a android.settings.WIFI_SETTINGS     # WiFi screen
am start --user 0 -a android.settings.AP_SETTINGS       # hotspot screen
am start --user 0 -n ecarx.debugtools/.MainActivity     # engineering menu 1
am start --user 0 -n com.android.car.systemupdater/.SystemUpdaterActivity
am start --user 0 -n com.mediatek.engineermode/.EngineerMode

4. Enable WiFi

The WiFi chip is present on IHU717P but blocked in software: XCTBoxService [TBoxBinder] switches WiFi off about every 7 seconds. Opening the WiFi screen from the hidden shell gets past it.

  1. Turn on your phone's hotspot (2.4 GHz is the safe choice).
  2. In the hidden shell run:
    am start --user 0 -a android.settings.WIFI_SETTINGS
  3. Join the hotspot from the Android WiFi screen that opens.
  4. Done. WiFi stays on, and after a reboot the unit reconnects to the same hotspot automatically (infoehra, post #591).

Suggested in the same thread but unconfirmed: svc wifi enable, am start -n com.android.settings/com.android.settings.Settings\$WifiSettingsActivity.

One owner who changed ECARX settings in the engineering menu lost his Bluetooth MAC address; a factory reset did not restore it. It came back after WiFi was enabled. Don't toggle random ECARX options.

Car as a hotspot: android.settings.AP_SETTINGS opens the hotspot screen, default password 12345678. It only shares whatever internet the unit already has. No stock eSIM data hotspot was found for the Tugella (the Chinese Monjaro has one).

5. ADB over WiFi

From infoehra, 4pda post #477. Works with the head unit as hotspot, or with both on your phone's hotspot (post #599).

  1. In the hidden shell:
    setprop service.adb.tcp.port 5555
am start --user 0 -a android.settings.AP_SETTINGS
  2. Connect your laptop (or phone with the Bugjaeger app) to the head unit's hotspot, password 12345678.
  3. Open engineering menu 1 and flip the ADB toggle (this restarts adbd with the new port).
  4. From the laptop:
    adb connect 192.168.43.1:5555
adb shell getprop ro.build.display.id
    If the unit is joined to your phone hotspot instead, use its IP on that network.

6. Installing apps

This is the hard part. ECARX ships a whitelist: com.ecarx.apkauth.provider ("ApkAuthProvider") plus a patched PackageManager rejects non-whitelisted APKs ("not in white apps ... Ecarx apk auth result false"). A kernel thread ecarx_mem_check also kills processes not listed in /system/etc/app_ecarx_policy.xml. Root alone doesn't get past either.

Option A: adb install over WiFi partial

adb install -r app.apk

Confirmed: AutoKit (CarLinkit) installs and runs. Most other APKs fail with INSTALL_FAILED_INVALID_APK. A 16 May 2026 post says installs now work over WiFi ADB without disassembly, with a write-up "to follow". Try your APKs; expect failures.

Option B: Magic_SQD USB-stick tool reported working, free

By infoehra (FreeTUGA group). v4 installs a button-mapping app, file manager, accessibility manager and stock Android Settings. After that, "any apps from USB, browser or store". Confirmed by a Tugella owner installing Yandex Navigator, and the AutoEasy launcher "from a USB stick, no disassembly". Claimed working on Knewstar 001, Tugella (Android 9), Emgrand, Coolray, Okavango, Belgee X50/S50/X70, Livan.

Option C: GUHub paid

Russian commercial tool, about 14,900-19,900 RUB. USB stick with a .sh and .dex launched from the engineering menu, or over WiFi in about 3 minutes. Supports light-UI Tugella and Knewstar. Has a "to dealer" mode that hides the mod. Premium adds CarPlay/AA, split screen, steering buttons in all apps. guhub.ru, demo video YouTube.

Steps from the official video description (translated):

  1. Check the interface: you need the UI with the left-side menu and Home button on the left (light UI).
  2. USB stick: exactly 2 unpacked files in the root, nothing else. Left USB port under the gear lever.
  3. Engineering menu via the Phone app → console (shell).
  4. Type the GUHub install command character by character and run it.
  5. Connect WiFi (phone hotspot, 2.4 GHz preferred). About 200 MB download, 2-5 min. Keep the engine running, don't close the console.
  6. Initial setup, automatic reboot, GUHub launches.

Same description: wired Android Auto runs through Headunit Reloaded after disabling QDLink; don't delete GUHub or its file manager; base licence only unlocks steering button remapping.

Option D: UART (dash disassembly) invasive

3.3 V FT232 adapter, 921600 baud, gives a root shell. Then preinstall APKs from a USB stick:

su
setprop persist.sys.ota_upgrade_done true
setprop persist.sys.preinstalled true
cp /storage/usbotg-otg1/* /data/preinstall_app/
chmod 777 /data/preinstall_app/*.apk
pm disable com.neusoft.ssp.ces.c4.car.assistant   # kills QDLink, optional
reboot

Over WiFi ADB (no root) copying into /data/preinstall_app fails, so this needs UART.

App notes

7. CarLinkit / CarPlay

A CarLinkit dongle only converts wired CarPlay into wireless. So the question is whether your unit has wired CarPlay.

Step 1: check for wired CarPlay

  1. Look for an Apple CarPlay icon on the home screen.
  2. Plug an iPhone into the left USB port on the lower shelf (driver side) with a data cable. The right port is charge-only.
  3. No CarPlay? Ask the dealer for the CarPlay update. It installs only on IHU717P. A UAE owner reports GCC dealers offer it for 2023-24 Tugellas, not 2022.

DIY CarPlay update (4pda, IHU717P only): FAT32 stick ≥ 2 GB, update.zip in the root, not unzipped (reported MD5 0caa2a3369321e440b1ee49befb39400). Insert in the left USB port, engine running, engineering menu 2 → U盘升级, wait about 10 minutes. It refuses other platforms. Side effects reported: phone's Bluetooth link to the car drops while CarPlay is active; some lost left-USB data; one dealer bricked a unit. No native Android Auto exists on any Tugella.

Step 2: pick a dongle

ProductTugella resultPrice (official store)
Carlinkit 4.0 CPC200-CP2AWorks. Wireless CarPlay, and Android Auto over the CarPlay link. Steering buttons work after settings fix. Best pick if you have both phone types.$69
U2W Mini2 / Mini UltraRecommended for iPhone only.$35-47
Carlinkit 5.0 2airMixed. iPhone fine, Android failed for one owner.$58
Tbox Ambient / Plus (Android box)Works, fits the screen correctly, has own GPS/SIM/WiFi, runs any Android app. Slow boot (1.5-2 min), runs hot. Easiest way to get YouTube/Maps with zero hacking.$149-179
OttocastFailed twice: CarPlay icon blinks, never connects.
Cheap white no-name adaptersDrops in city centres.

Buy: carlinkitmall.com, AliExpress official, Noon (GCC).

Step 3: set it up

  1. In the car's Bluetooth settings, forget your phone.
  2. Plug the dongle into the left USB port. Pair the phone to the dongle (not the car).
  3. Open the settings page: join the dongle's WiFi (Autokit_..., password 12345678) and browse to http://192.168.50.2, or use the AutoKitools app. Tbox boxes use 192.168.50.100.
  4. Update the dongle firmware from the same page (fixed city-centre audio stutter for one owner).
  5. Tune for the 1920x720 screen:
    • Android Auto looks stretched on CP2A: set resolution 1920x1080 with DPI 154-250, or a custom 1920x720.
    • Music cuts out: Media Delay 1500-2000 ms (default 1000).
    • Lag: frame rate 20. Freezes: lower Video Bit Rate (one owner used 5).
    • Try switching WiFi band between 2.4 and 5 GHz. Call Quality: HD.

Known limits: Android Auto via a CarPlay dongle has no multi-touch. One owner lost steering wheel skip/pause in CarPlay after a dealer firmware update.

No wired CarPlay? Two fallbacks

8. Other internet options

9. Dark-UI units (IHU520G)

No known software-only path. All routes need the head unit out of the dash (about 15 min: cluster, screen, unit; Torx and PZ bits).

10. Other findings

Hidden features in the stock UI

OBD

Internals worth knowing

Communities

11. Risks

12. vs your Monjaro

MonjaroTugella 2023 (IHU717P)
SoCQualcomm (SA8155P)MediaTek MT6771 (ECARX E02)
AndroidNewer9 (API 28)
USB ADBWorked for youBlocked (host/charge only)
WiFi ADBYes, via T-Box hidden shell
WiFiHidden, enabledBlocked by T-Box service, enable from hidden shell
Free APK installYesWhitelist; AutoKit OK, others via Magic_SQD/GUHub
GPSBuilt inNot fitted on light-UI unit

13. Videos

All links checked live on 7 Oct 2026 through each platform's API. Russian titles are translated. "Title only" means nobody has watched it for this report. Knewstar 001 is the Belarus-built light-UI Tugella with the same IHU717P unit, so its videos apply directly.

Start here

App install and FreeTUGA (light UI)

Engineering menu

CarPlay and adapters on Tugella

Disassembly, UART and custom firmware

Sibling models (same ECARX family)

Not found in any language: a video of the dealer CarPlay firmware update, or a Tbox on a Tugella. Not verifiable (anti-bot): GeelyModCustom playlists on VK Video. Many Rutube channels re-upload the videos above; links here point to the originals.

Sources