Hacking the Oculus Quest: how to show Android Settings, Alarm and more!

Today I’ve played around with Oculus Quest, trying to hack it a bit via command-line tools (ADB), hoping to activate some cool features. I’ve made some interesting discoveries, and of course, I want to share them with you, the VR community!

Caveat

Before you read, a little warning: try the things described below at your own risk. They shouldn’t harm your device, but be careful anyway.

Camera access

I am very passionate about mixed reality and I am incredibly happy of having developed a Unity plugin to let every developer create AR/MR apps on the Vive Focus Plus (you can find it on GitHub!), with which we of NTW have created the first mixed reality fitness game, HitMotion: Reloaded.

Unluckily, this is not possible on the Quest, because the SDK doesn’t give you access to the cameras. I remember Eduardo Siman telling that if someone could unlock that feature, that could be me (I’m very flattered by his esteem), so I tried not disappoint him and find a way to get access to the cameras. Spoiler: I failed.

I had the idea of accessing the cameras via standard Android interface (so, without going through the Oculus SDK, but using Android tools), but it seems that Oculus has been very paranoid regarding cameras, and in fact, they aren’t accessible in any way.

There’s no intent associated with taking a picture, there’s no media service launched, and there’s not even “camera” listed as a hardware capability of the device. I’ve verified it by attaching the Quest to my PC and writing “adb shell pm list features” in the command line.

I asked the OS what are the features of the device, and there is no android.hardware.camera. Android sees no cameras, it just sees “oculus.software.guardian”

So, for the Quest OS, those cameras are not really cameras, in the Android sense of the term. They are probably a tracking device, a guardian system as a whole. They are not accessible individually. This is good for cybersecurity and privacy, but bad for me: no MR on Quest this time 🙁

Codename Monterey

Monterey is the codename of the Quest, and in fact, you can find its name everywhere when pinging the parameters and infos of the device through “adb shell getprop”.

Monterey, Monterey everywhere!

Oculus Go was codenamed “Pacific”, instead. It is curious that even after the launch, those devices keep many references to their previous internal names.

Oculus Assistant

I got the list of packages installed by typing “adb shell dumpsys package r”, obtaining a super long list of info.

As previously spotted by Upload VR, when you go through the list of the intents available on the device, you can see that there is the package “com.oculus.assistant/.testui.AssistantVRShellActivity” available. This is the sign of a future feature that Facebook is going to introduce: according to rumors, Oculus is working on a vocal assistant for your Quest, that should help you in launching your apps without using controllers, plus other stuff that we still don’t know.

If you run that activity (using the command “adb shell am start -n com.oculus.assistant/.testui.AssistantVRShellActivity”), you see in your Quest a window about the Oculus Assistant popping up, with just a rotating waiting gizmo.

This is what you obtain launching the assistant test app. Not that much…

If you try to speak, nothing happens. Looking at LogCat (the logger of Android), you can spot that the problem is that the current user is not authorized to use the vocal assistant.

02-03 17:22:08.496 30845-30845/? I/VrDesktopPanelApp: Target: LaunchConfiguration{w=720 h=540 shape=2 dpi=160 intent=Intent { flg=0x14000000 cmp=com.oculus.assistant/.testui.AssistantTestActivity }}
02-03 17:22:55.155 1748-1765/? D/VrDesktopService: startActivity(): Intent { flg=0x14000000 cmp=com.oculus.assistant/.testui.AssistantTestActivity }
02-03 17:22:55.159 1101-1125/? I/ActivityManager: START u0 {flg=0x14010000 cmp=com.oculus.assistant/.testui.AssistantTestActivity} from uid 1000 on display 50
02-03 17:22:55.426 30826-30826/? D/AssistantService: OnCreate
02-03 17:22:55.435 30826-30826/? E/AssistantService: Assistant is not enabled for this user on this device

There are also various references to actions like “com.oculus.assistant.COMMAND”, “com.oculus.assistant.ACTIVATE_ASSISTANT” and “com.oculus.assistant.DEACTIVATE_ASSISTANT”, but I found no use in them 🙁

That’s so sad… I guess we’ll have to wait until Facebook distributes the feature officially to try it!

Horizon

Facebook Horizon is the new social XR application that Facebook plans to launch in Spring this year.

Zuck announcing Facebook Horizon

Looking at the list of elements installed, many things already belong to the namespace com.oculus.horizon, that I think refers to this social world. The fact that there is something talking about abuse prevention, reinforces this belief of mine.

All these references to Oculus Horizon make me think… I’m not sure they’re about the virtual world, though

What surprises me is that Googling “com.oculus.horizon”, I found some Oculus forums talking about elements of this namespace draining the battery of GearVRs already in 2015! :O

This may mean two things:

  1. Horizon” is not referring to Facebook Horizon, but to some other generic features already in the work since years. It may be an internal codename that, later on, has become the name of a separate product;
  2. Facebook is actually working on Horizon since many years. This is a fascinating hypothesis, that would show the long term vision of this company.

Honestly, I don’t know where the truth is. I guess we’ll discover more by analyzing the Quest when Horizon will be effectively deployed (by checking its namespace).

Android Settings

Do you want to access the standard Android settings window in the Quest? Well, you just have to launch one of the many activities that point to them. One example is this command line “adb shell am start -n com.android.settings/.UsageStatsActivity”

https://gfycat.com/smugshimmeringalligatorgar

If you do, you find yourself inside the standard system black environment of the Quest, with a big white window in front of you, with the standard Android settings view that you can find on the phones. This giant screen follows your head when you move it, so it is always in front of your eyes. I also navigated to the system info and seen that the Quest runs Android 7.1.1.

The memory view in the settings window of the Quest. You can see how much of the memory is occupied, in the classical Android view

This settings window is much unstable and some items don’t work or lead the app to crash, but some works well, and you can change Wi-fi, analyze memory occupation, battery consumption, etc… You can also go to the accessibility section and toggle the “Invert color” switch. You will find yourself with a Quest that has inverted colors! It is pretty cool, actually.

https://gfycat.com/ashamedgenuineivorybilledwoodpecker
The passthrough with inverted colors look like X-rays… I love it!

Be careful with what you do, though: I wasn’t able to reset that setting in the window, so luckily I found how to do that via command line online! (“adb shell settings put secure accessibility_display_inversion_enabled 0” if you remain stuck as me)

Alarm

Do you want to use your Quest to wake up? Well, there is an app for that. You can still launch the standard Clock app from the command line. Just type “adb shell am start -n com.android.deskclock/.DeskClock” and it will come out!

https://gfycat.com/marriedmeanbasenji
Let me put an alarm on my Quest. It actually emitted the sound!

You can set the alarm… and if you keep the app on the foreground when the time will come, the Quest will actually play the ringtone! :O If you are running another app (like a game), instead, you can’t play the sound, but you will still see the toast notification of the alarm. This could be very useful to put some reminders for instance if you want to play some games, but you have to stop at a certain time because you have an important appointment!

Extras

I’ve found some other interesting things. First of all, the fact that the name of the Android User is… “null” on my Quest.

Then, while looking at LogCat, I’ve found a line talking about “GateKeepers”. Here it is possible to find some flags of things that are activated or forbidden. Among the forbidden things, there are interesting voices like:

  • “false:oculus_enable_guardian_on_screen_capture”, that is probably the flag that doesn’t let you see the passthrough during screen capture, for privacy reasons;
  • “false:assistant_on_oculus”, that probably disables Oculus assistant;
  • “false:oculus_vrshell_anytimeui_passthrough_button”, that is probably the future functionality that Oculus promised us at OC6, that is the possibility of double-clicking the Oculus button on your Touch controllers to activate the passthrough automatically. It hasn’t been shipped yet.

In the features listed above, instead, it is cool to see that there is “oculus.software.anti_piracy” and “android.software.voice_recognizers”, whose names are self-explanatory.


And that’s it for these experiments! Unluckily I haven’t been able to unlock the cameras of the Quest, but it was a fun ride anyway. I hope that someone with more low-level knowledge on Android than me will do other experiments in this sense and find other fun functionalities in the Quest! If it is the case, please contact me and let me know what you’ve been able to come up with!

In the meanwhile, if you like this kind of posts, please register to my newsletter and donate on my Patreon!

Skarredghost: AR/VR developer, startupper, zombie killer. Sometimes I pretend I can blog, but actually I've no idea what I'm doing. I tried to change the world with my startup Immotionar, offering super-awesome full body virtual reality, but now the dream is over. But I'm not giving up: I've started an AR/VR agency called New Technology Walkers with which help you in realizing your XR dreams with our consultancies (Contact us if you need a project done!)
Related Post
Disqus Comments Loading...