Unlocking the brightness of the HY-300 projector via ADB and reverse engineering

Unlocking Max Brightness on HY-300 Projector via ADB and Rockchip Firmware Reverse Engineering

Budget projector makers often cap brightness artificially, with no user controls in sight. Using the HY-300 on Rockchip RK3326 as our example, we'll show you how to gain root access via ADB, disable dm-verity, and tweak the gamma LUT to restore full display brightness.

Hardware Platform Analysis and the Problem

The HY-300 projector runs on the Rockchip RK3326 SoC with Android TV OS. The main issue? Zero brightness controls in the interface. Brightness drops right after boot, hovering at about 70% of its true potential. Digging deeper revealed that Android's standard backlight control isn't working: the backlight node in the device tree is misconfigured, with no PWM channel binding.

What we tried without success:

• Tweaking screen_brightness via settings
• Messing with system properties (persist.vendor.brightness.main)
• Direct control via /sys/class/leds/Lcd_power
• SurfaceFlinger commands for color matrix

ADB Connection and Gaining Root Access

USB connections cause power conflicts, so ADB over Wi-Fi is the only reliable way. On Android TV, developer mode is enabled by tapping the OS version, but here ADB and root were available out of the box.

adb connect <projector IP>:5555
adb root

Once connected, we found /system and /vendor partitions locked by dm-verity, blocking writes. The fix: run adb disable-verity once, then reboot. This enables overlayfs, making system partitions editable.

Hunting Down the Brightness Control Mechanism

Boot logs pointed to a testgamma service that runs on startup. Its script at /system/bin/testgammatx.sh holds parameters directly affecting gamma correction:

testgamma --wb_r 1.0 --wb_g 0.96 --wb_b 0.95 --contrast 58 --brightness 30 --saturation 80 --hue 35 --target_gamma 1.8 --native_gamma 2.9

The testgamma tool writes a Look-Up Table (LUT) straight to the VOP video processor via DRM ioctl. But brightness, contrast, saturation, and hue? Dummies—RK3326's VOP Lite doesn't support those DRM properties (BCSH). The real players are:

• wb_r, wb_g, wb_b — white balance coefficients (0.0–1.0), acting as brightness multipliers per color channel.
• target_gamma, native_gamma — shape the gamma curve, impacting dark tones.

Why Changes Need a Reboot

The testgamma service runs before SurfaceFlinger and HWC (hwcomposer). HWC takes over the DRM device and overwrites VOP settings every frame, nullifying any runtime testgamma calls. Editing the script and rebooting is the only way to make changes stick.

Optimizing Parameters for Peak Brightness

Systematic testing after each reboot uncovered the sweet spot. Factory settings dimmed output in two ways: nerfed green/blue coefficients (0.96/0.95) and target_gamma=1.8 against native_gamma=2.9.

Test Results:

• wb_r/g/b = 0.1, target_gamma=2.2 — ~10% brightness
• wb_r/g/b = 0.5, target_gamma=1.8 — ~50% brightness
• wb_r/g/b = 1.0, target_gamma=1.0 — max brightness but inverted colors
• wb_r/g/b = 1.0, target_gamma=1.6 — ideal brightness and color balance

Step-by-Step Setup Guide

For HY-300 owners on RK3326 (TXCZ firmware), follow this:

1. Prep and Connect:

Install Android Platform Tools on your PC, grab the projector's IP. Run:

adb connect <IP>:5555
adb root

2. Disable dm-verity (one-time):

adb disable-verity
adb reboot

Wait for full boot and reconnect.

3. Set Max Brightness:

adb shell mount -o remount,rw /system
adb shell "echo '#!/system/bin/sh\ntestgamma --wb_r 1.0 --wb_g 1.0 --wb_b 1.0 --contrast 58 --brightness 50 --saturation 80 --hue 35 --target_gamma 1.6 --native_gamma 2.9' > /system/bin/testgammatx.sh"
adb reboot

4. Revert to Factory Settings:

adb shell mount -o remount,rw /system
adb shell "echo '#!/system/bin/sh\ntestgamma --wb_r 1.0 --wb_g 0.96 --wb_b 0.95 --contrast 58 --brightness 30 --saturation 80 --hue 35 --target_gamma 1.8 --native_gamma 2.9' > /system/bin/testgammatx.sh"
adb reboot

Key Takeaways

• ADB and root are enabled by default in this firmware—huge plus for tinkering.
• Core brightness control is the gamma LUT written by testgamma to VOP.
• Reboot required since HWC overrides settings at runtime.
• Optimal params: wb_r/g/b = 1.0, target_gamma = 1.6 (native_gamma = 2.9).
• Works for other Rockchip devices with similar setups.

Lessons for Developers

This case highlights common pitfalls in budget Android gear: botched device tree configs, reliance on outdated or undocumented hardware controls. Mastering DRM, gamma LUTs, and overlayfs lets you fix issues and dissect embedded systems. For other SoCs, adapt the approach—but log analysis, service reverse-engineering, and debug interfaces remain universal.

— Editorial Team