How to get in

The android at the head unit is the first valuable target.
This video tells us the first step to access the filesystem and install additional software. This might be different at your car based on your software version. For example there are versions where you have to press five times at the airbag-symbol in the lower right corner or maybe in the upper right corner. Find out how to get there and document it here together with the software version you have.
At the developer menu ignore the adb switch, this does not help much. Find the ES-Browser and open it. It gives you access to the filesystem, lets you install apps and execute it. If you enable the adb-mode the usb-port flips to OTG and does not work with USB-sticks anymore and carplay will be gone as well.

1. Reveal the hidden menu. Go to Settings → About, tap About five times — a new entry AP Version appears below the Factory Reset menu item — tap AP Version five times. Then click on ES-Browser On older software the unlock was five taps on the airbag icon in the lower-right corner. For firmware 1.9.2 there is a password needed which is Aiways7921
2. Open the built-in file manager — ES File Explorer (on some versions it wants an unlock PIN 0000). It can browse a USB stick and install APKs.
3. Prepare a USB stick (FAT32) with the ADC Connect app (APK, source) on it, and plug it into the head unit's USB port.
4. Install the bootstrap app from the stick via ES File Explorer.
5. Join your Wi-Fi so the car is on your LAN (the bootstrap app manages Wi-Fi networks, or use Android settings).
6. Enable ADB over Wi-Fi — the bootstrap app sets the ADB TCP port and restarts adbd. It can do this because it is system-signed (see below).
7. Set a root SSH key (recommended). The bootstrap app also runs a bundled root SSH server. From any device on the same Wi-Fi, open http://<HEAD-UNIT-IP>:8080/ and paste your public key — unlike plain ADB it survives reboots and doesn't fight a laptop's adb for this unit's single connection.
8. Connect from your computer: ssh root@<HEAD-UNIT-IP> (once a key is set) or adb connect <HEAD-UNIT-IP>:5555. Either gets you a root shell and you can install and debug everything else — see Development.

These steps were taken on a software-version 1.7.0. - head-unit build F5.37 (firmware MX64_V2.01.0051.05-9-R-210326, dated 2021-03-26). The hidden-menu unlock might differ between software versions — check yours in the car's About screen first.

• adbd runs as root on this ROM — once you reach it over TCP you have full access.
• System privileges are free to obtain. The ROM was never re-keyed by Aiways — it's signed with the public NXP/Freescale i.MX BSP test key (not extracted from any device; NXP reused it across i.MX BSPs for about a decade, and it's openly available). So an ordinary app signed with that same public key can legitimately declare sharedUserId=“android.uid.system” and run with system rights — needed to toggle ADB, overlay the driver cluster, and reach the CAN service — and can update itself in place without losing its settings. Fingerprint and where to get the key: Signing — the platform key. This is what makes the bootstrap app possible.

adbd is a disabled init service, started only by a USB-config trigger, and it reads its TCP port only at startup. The bootstrap app sets service.adb.tcp.port 5555 then cycles sys.usb.config (none → adb), which restarts adbd bound to TCP. This is not persistent across reboots, so the app re-applies it automatically on each boot.