# Acer V Pro Series 32-inch QLED Smart Google TV — Reverse Engineering & Architecture Deep Dive

**Device Identifier:** `AR32QDXGU2841AT` (Amazon ASIN `B0D9BYGT8J`)  
**Motherboard / Board Platform:** MOKA / SCBC `R3G` (`com.mk.tv.fivekey`), Realtek RTD Chipset  
**OS:** Android 14 (API Level 34, Build `UKR1.250803`)  
**Custom Launcher:** NLRC Home (`com.gathin.tvhome`)  
**Verified Configuration:** Stock Google TV intact · Direct Boot Aware · Hardware Remote Remapped · TV Storage Offline Media

---

## 1. Clean Architecture & Verified Pipeline

```text
[ Stock Acer Google TV ]                        [ NLRC Home Fail-Safe Pipeline ]
┌──────────────────────────────────────┐        ┌──────────────────────────────────────┐
│  RescueParty Trigger on Disabling    │        │  launcherx 100% Preserved (DirectBoot│
│  com.google.android.apps.tv.launcherx│   ➔    │  HomeKeyService (Accessibility Hook) │
│  Hardware Remote Sponsored Locks     │        │  Hardware Remote Hijack to HDMI 2    │
└──────────────────────────────────────┘        └──────────────────────────────────────┘
```

---

## 2. Reverse-Engineered Hardware & Architecture

### TV Hardware Input Services (Realtek Passthrough URIs)
Through ADB query inspection into the Android TV Content Provider (`content://android.media.tv/passthrough`), the low-level hardware ports for the Realtek RTD chipset were extracted:

- **HDMI 1 (Jio TV / Set Top Box):** `com.realtek.tv.passthrough/.hdmiinput.HDMITvInputService/HW151519488`
- **HDMI 2:** `com.realtek.tv.passthrough/.hdmiinput.HDMITvInputService/HW151519744`
- **AV Composite:** `com.realtek.tv.passthrough/.avinput.AVTvInputService/HW50593792`
- **DTV Tuner:** `com.realtek.dtv/.tvinput.DTVTvInputService/HW33685504`
- **ATV Tuner:** `com.realtek.tv.atv/.atvinput.AtvInputService/HW33619968`

To switch to HDMI 2 without opening any stock settings menu, we launch a targeted Intent:
```java
Uri uri = TvContract.buildChannelUriForPassthroughInput(
    "com.realtek.tv.passthrough/.hdmiinput.HDMITvInputService/HW151519744"
);
Intent intent = new Intent(Intent.ACTION_VIEW, uri);
intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK);
context.startActivity(intent);
```

### Physical Chin Button Pitfall (DO NOT HOLD ON POWER-UP)
The physical button centered under the Acer chin is mapped to `com.mk.tv.fivekey` at runtime.
> [!CAUTION]
> Holding this button while inserting AC power does **NOT** enter Android Recovery. Instead, it triggers the Realtek SoC bootloader into **Forced USB Firmware Flash Mode** (indicated by an indefinitely blinking red LED waiting for an `install.img` flash drive). If accidentally triggered, unplug AC power, wait 15 seconds, and reconnect power without touching the button.

---

## 3. The Android 14 Bootloop Crisis & Root Cause Analysis

### Why Traditional Debloat Scripts Brick Android 14 Google TVs
Historically on Android 9–12, developers debloated TVs by running:
```bash
pm disable-user --user 0 com.google.android.apps.tv.launcherx
```
On Android 14 (API 34), doing this triggers a catastrophic failure:
1. **Direct Boot & Credential Encryption (CE):** On cold boot, user storage remains encrypted until first unlock. System services only launch components flagged with `android:directBootAware="true"`.
2. **RescueParty Trigger:** When `launcherx` is disabled and custom launchers lack `directBootAware="true"`, Android 14 finds **zero valid Home activities**.
3. After repeated boot attempts fail to resolve a Home activity, Android's `RescueParty` service escalates to Level 5, locking the TV in black-screen recovery and aborting all UI rendering.

---

## 4. The 100% Fail-Safe Architecture

To eliminate all boot-loop risks and guarantee that the custom launcher is immortal and indestructible:

1. **Stock Launcher Stays 100% Intact:** `com.google.android.apps.tv.launcherx` is **NEVER** disabled. Android's internal watchdog and RescueParty stay completely satisfied.
2. **Direct Boot Aware Everywhere:** `com.gathin.tvhome` marks all critical components with `android:directBootAware="true"` in `AndroidManifest.xml`:
   ```xml
   <activity
       android:name=".MainActivity"
       android:directBootAware="true"
       android:exported="true">
       <intent-filter>
           <action android:name="android.intent.action.MAIN" />
           <category android:name="android.intent.category.HOME" />
           <category android:name="android.intent.category.DEFAULT" />
       </intent-filter>
   </activity>
   ```
3. **Dual-Interception Mechanism:**
   - **`HomeKeyService` (Accessibility Service):** Intercepts `KEYCODE_HOME` events before `launcherx` can consume them. It also listens for `TYPE_WINDOW_STATE_CHANGED` on `com.google.android.apps.tv.launcherx`. Whenever the stock Google TV launcher attempts to display, NLRC intercepts it in <10ms and brings the clean home screen to the foreground.
   - **`BootReceiver`:** Listens to both `ACTION_BOOT_COMPLETED` and `ACTION_LOCKED_BOOT_COMPLETED` to launch the launcher immediately upon power-on.
4. **Instant Safe Fallback:** If `com.gathin.tvhome` is ever uninstalled or disabled, stock Google TV immediately takes over without user lockout or factory resets.

---

## 5. Hardware Remote Key Hijacking (Zero Root)

Most Google TV remotes feature hardcoded sponsored app buttons (Netflix, Prime Video, YouTube, etc.) that users cannot remap through standard Android settings.

By declaring `android:canRequestFilterKeyEvents="true"` in the `AccessibilityService`:
- `KEYCODE_BUTTON_3` (Hardware Netflix key)
- `KEYCODE_BUTTON_4` (Hardware Prime Video key)
- `KEYCODE_PROG_RED` & `KEYCODE_PROG_GREEN`

are intercepted directly in `HomeKeyService.onKeyEvent()`. Instead of opening Netflix or Prime Video, the key event is consumed (`return true;`) and automatically invokes `HdmiHelper.launchHdmi2(this)`, switching straight to the Set-Top Box on HDMI 2 in under 150 milliseconds.

---

## 6. Offline TV Media Vault & Legacy Video Transcoding

### The Challenge: Legacy MPEG-2 Home Recordings
Home videos or old family recordings stored on USB drives often use legacy DVD-era `mpeg2video` encoding. Android's native `MediaCodec` and `VideoView` fail to decode MPEG-2 inside modern MP4 containers without heavyweight external players.

### The Universal Solution: Hardware-Accelerated H.264 Transcoding & Local TV Storage
1. **Transcoding Pipeline:**
   ```bash
   ffmpeg -i "input_video.mp4" -c:v libx264 -preset faster -crf 23 -c:a aac -b:a 192k "Part_1.mp4"
   ```
   - Compresses video files by ~50% while preserving full clarity.
   - Enables native Android hardware-accelerated H.264 decoding at smooth 60fps.
2. **Direct Push to Internal TV Storage:**
   Push directly to `/sdcard/Movies/NLRC/`:
   ```bash
   adb push Part_1.mp4 /sdcard/Movies/NLRC/Part_1.mp4
   ```
3. **Zero USB Reliance:** Unplug the USB drive entirely; videos play directly from the TV's internal flash storage.
4. **Remote-Friendly Navigation:** Built-in `VideoPlayerActivity` with remote D-pad controls:
   - ◄ / ►: Seek -10s / +10s with real-time HUD display.
   - ▲ / ▼ or CH+ / CH-: Switch to Next / Previous video part.
   - OK: Play / Pause toggle.