I just started poking around the rootfs.img file, was able to mount it, and noticed the AaMenuApplication folder. It looks separated from the rest of the code.
The AaMenuFrontEnd.js.bin file is especially intriguing.
Has anyone been able to reverse that binary file?
It's 2.4mb, so too big for pastebin, so I put in the first and last +/- 300 lines:
https://pastebin.com/gSGTz8zf