How to remap the 2 keys on the cover of the Nova Air with SDS100 Keymapper?

[csdvrx]

Hello

I'd like to remap the 2 keys (volume up/down or page up/down) with sds100 keymapper to define contextual functions (ex: be volume up/down in this app, page up/down in that other app, toggle wifi if they are pressed in sequence, etc.)

I have done that on other devices, it works great!

However, on the boox I can't record the keys: no action is detected.

Right now my best guess is that it's due to the smart cover app in settings: something must already be intercepting the buttons and trying to interpret their function.

However, I don't see any app with a telling name with`pm list packages |grep onyx`

• package:com.onyx.dict
• package:com.onyx.kime
• package:com.onyx.mail
• package:com.onyx.android.onyxotaservice
• package:com.onyx.android.production.test
• package:com.onyx.android.ksync
• package:com.onyx
• package:com.onyx.easytransfer
• package:com.onyx.kreader
• package:com.onyx.android.note
• package:com.onyx.floatingbutton
• package:com.onyx.tscalibration
• package:com.onyx.appmarket
• package:com.onyx.calculator

Pressing on the keys while running top doesn't show anything either

The only thing I see is in the dmesg:

• [ 2.438118] input: onyx-misc as /devices/platform/soc/socnyx_misc/input/input5
• [ 2.438454] input: onyx-hall as /devices/platform/soc/socnyx_hall/input/input6
• [ 2.631472] input: gpio-keys as /devices/platform/soc/soc:gpio_keys/input/input7

So I suppose the hall sensor (for the cover) is input6 sending key 1

With this information in hand, I've tried `cat /dev/input/event7` and I see actions whenever I press on the cover keys, even if the screen is off.

lsof reports all these are opened by the same thing:

Binder:1398_3 1398 system 161u CHR 13,71 0t0 10155 /dev/input/event7

So I think I'm missing something. Any help or hint would be appreciated!

[Renate]

The start of it all is the keylayout /system/usr/keylayout/gpio-keys.kl

Some key manipulation occurs in /system/framework/framework-res.apk in res/raw/keypad.json, res/raw/bt_keypad.json

See: https://www.mobileread.com/forums/sh...d.php?t=344237

[csdvrx]

After reading your message, I tried:

BOOX:/ $ settings put system switch_key 1

It did nothing to help keymapper, so I reverted that with:

BOOX:/ $ settings put system switch_key null

However, the next one is more interesting:

BOOX:/ $ settings put global key_custom_side_key_short_press_enable 1

It stops the keys from doing volume, while still making them uncatchable by keymapper. So whatever it does, it seems to do it in the right place!

Would you know what it influences? I'd like to disable that.

You mention:

Here's a simplified diagram I just made of how keys work. Your side keys are lots more complicated because they are intercepted somewhere and they get turned into a string and get processed through res/raw/keypad.json (or res/raw/bt_keypad.json) in /system/framework/framework-res.apk. That causes your PgDn to work only when you release the button (instead of when pressing) because it has to wait to determine short/long press. I defeated that on my Poke3 because it drove me crazy.

Super interesting as it confirms my guess about something doing a weird interpretation.

You're going to have to change the keylayout. Me, I'd change the dtb too (because it's easy and just a single change to the boot.img that doesn't need to be a Magisk module).

Can you please tell me what you did and how to replicate your changes?

My goal is to have the side buttons each emit a key (any key!) that I can intercept with keymapper to map that to actions.

Ideally, I would do the same to the power button, since the Hall sensor is sufficient to wakeup the boox, and the timeout sufficient to put it to sleep.

If you need a copy of my Nova Air C boot.img, I think you already have one as it's found inside the 3.2.2 update.upx you posted before (boot.img md5 7abc9ae7af6c05ef73bf6c08854b4786)

I don't know how to do that by hand, but it mustn't be too hard since that's what Magisk patches:

[Renate]

Well, it's framework-res.apk that you need to modify.
Unfortunately, since it's an .apk (and not a .jar) it's all signed.
You could sign it yourself, but that's not system signed, it won't work.
You could patch something somewhere to not check signing, but that's a whole other thing.

The funny thing is, the signing checks the contents of the .apk (.zip file) but not the file itself.
You can do silly things with renaming the zip local header. That actually breaks extraction of the file. The signing checks through the zip global header so the signing is ok.

See: https://www.mobileread.com/forums/sh...5&postcount=29

Be very careful because a stock Onyx has a late start ADB and if you break framework-res.apk it will never start ADB!

[csdvrx]

Uh, sorry to keep bothering but it's not exactly clear yet what I should do.

You message says to get /system/framework/framework-res.apk and hexedit it to change occurence 5/8 and 6/8 of keypad into zeypad - ok that I should be able to do!

But:

First, is it possible to test the changes manually first, like by using adb do su then killing the framework process then do some kind of mount and restart the process to make sure my change work?

Then, "Put it in your Magisk module directory" - that's a bit unclear, especially given how you mention the late start of adb could mess up things and may require reflashing the system partition (which I don't know how to do yet because it's merged with product inside the "super" part)

After reading https://topjohnwu.github.io/Magisk/guides.html if I decide to call my module say novaairc_coverbuttons_keymapper, I understand I should:

- create a folder called novaairc_coverbuttons_keymapper
- create a subfolder called system containing another subfolder name framework that would contain my hexedited framework-res.apk once I've validated it works
- create module.prop file containing:

id=novaairc_coverbuttons_keymapper
name=Nova Air C cover buttons fix
version=v1
versionCode=1
author=csvrx
description=Make the Nova Air C cover buttons remappable with sds100 keymapper

The documentation mentions post-fs-data.sh and service.sh. After looking at the examples from selinux_permissive_v2.zip and the documentation on adb on https://developer.android.com/studio/command-line/adb, I think I should be able to use either or both of the scripts to start adb early, by using the same scripts skeleton:

post-fs-data.sh:

# start adb on a non standard port
NONSTANDARD_PORT=5556
ARGUMENTS="something something"
adbd $ARGUMENTS $NONSTANDARD_PORT

service.sh:

# Schedule task

nohup /bin/sh > /dev/null 2>&1 <<EOF &

wait_boot_complete()
{
until [ "x\$(getprop sys.boot_completed)" == "x1" ]
do
sleep 5
done
}

wait_boot_complete

# stop the extra adb we don't need anymore
NONSTANDARD_PORT=5556
ps a |grep $NONSTANDARD_PORT | grep adb | sed -e 's/^ //g' -e 's/ .*//g' | head -n 1 | xargs kill

However, ps a doesn't seem to work, so I can't find the arguments used by the current adbd.

Could you tell me if my plans are sound or if I'm doing something horribly wrong? Your experience doing the same thing would be helpful: I don't want to spend 2 nights fixing the problem like when I messed up with the partitions and couldn't make a restore of the boot.img work (then I realized it was a bug )

[Renate]

Mmm, those scripts are not going to work.
Getting ADB going is more than just starting the adbd daemon.
Usually setprop sys.usb.config adb is used, but I believe Onyx screwed around with all that.

If you're using Magisk it does the file shadowing/substitution in init. So any changes are not immediately propagated.

In worst case, you can flash the stock boot image back and there won't be any Magisk. Then you can delete/modify your Magisk module.

Keep it simple, no shell scripts in your Magisk module.
Try something simple like putting system/hello in your module and see if it's visible.

[csdvrx]

Originally Posted by Renate

Mmm, those scripts are not going to work.

Yeah, it's more of a general idea

I'm trying to understand how things work first!

Originally Posted by Renate

Getting ADB going is more than just starting the adbd daemon.
Usually setprop sys.usb.config adb is used, but I believe Onyx screwed around with all that.

Actually my plan is to run adbd as root but inside a chroot environment, so any kind screwing up of the defaults by Onyx can be easily fixed and I can use any adbd option I like.

I'm thinking about something like:

chroot /system/apex/com.android.adbd /bin/adbd

However, it fails for mysterious reasons while of course the /system/apex/com.android.adbd/bin/adbd file exists:

chroot: exec /bin/adbd: No such file or directory

I think it's due to dynamic linking but it's not clear why yet. More on that below.

I would be a handy magisk module (to always be able to recover from bad things) but if I can't make that approach work, do you know how to make adb execute earlier on the boox, so that messing up with the framework apk can't prevent me from getting adb shell to fix things?

Originally Posted by Renate

If you're using Magisk it does the file shadowing/substitution in init. So any changes are not immediately propagated.

Oh you mean it will only be done on next boot? So yeah I'd rather have adb working lol. I guess I'm back to the "adbd as root inside a chroot" plan.

Originally Posted by Renate

In worst case, you can flash the stock boot image back and there won't be any Magisk. Then you can delete/modify your Magisk module.
Keep it simple, no shell scripts in your Magisk module.
Try something simple like putting system/hello in your module and see if it's visible.

Yeah but then no adb if I mess up, unless I flash another boot.img etc. I guess I could fastboot boot an image without the problematic zip but it's not super clear yet, and I prefer to do things more carefully and understand what I'm doing and why.
About the chroot environment: I can't run any binary that's not static - for example, no dynamically linked binaries from even termux work inside the chroot, while they work just fine outside:

#!/bin/sh
cd /data/data/com.termux/files || exit -1

# don't care about bad flags for data
#mount -o remount,dev,suid /data

# create the bind directories if they don't exist
ls ./apex/ > /dev/null || mkdir ./apex
ls ./system/ > /dev/null || mkdir ./system
ls ./dev/ > /dev/null || mkdir ./dev
Ils ./dev/pts > /dev/null || mkdir ./dev/pts
ls ./sys > /dev/null || mkdir ./sys
ls ./proc/ > /dev/null || mkdir ./proc

# bind the true root dirs
mount --bind /dev ./files/dev
mount --bind /dev/pts ./files/dev/pts
mount --bind /sys ./files/sys
mount --bind /proc ./files/proc
mount --bind /apex ./files/apex

chroot /data/data/com.termux/files/ /bin/sh

This works if /data/data/com.termux/files/bin/sh is a static binary, but it doesn't work otherwise say with /usr/bin/bash - or any other dynamic binary actually.

~ # strace-static ./usr/bin/bash
execve("./usr/bin/bash", ["./usr/bin/bash"], [/* 26 vars */]) = -1 ENOENT (No such file or directory)
write(2, "strace-static: exec: No such fil"..., 47strace-static: exec: No such file or directory
) = 47
mprotect(0x78f37e0000, 4096, PROT_READ|PROT_WRITE) = 0
mprotect(0x78f37e0000, 4096, PROT_READ) = 0
mprotect(0x78f37e0000, 4096, PROT_READ|PROT_WRITE) = 0
mprotect(0x78f37e0000, 4096, PROT_READ) = 0
munmap(0x78f37e0000, 4096) = 0
exit_group(1) = ?
+++ exited with 1 +++

To debug the issue and understand more what's happening, I've tried putting all the libs I see with ldd into a directory in case the ld.conf is the problem, but even strace-static can't see the binary (!!) while it's there otherwise md5 wouldn't work:

~ # /bin/ls -la ./test/
total 3459
drwxr-xr-x 2 root root 3488 Oct 30 21:06 .
drwxrwx--x 17 u0_a150 u0_a150 3488 Oct 30 22:07 ..
-rwx--x--x 1 root root 810936 Oct 30 20:55 bash
-rwx--x--x 1 root root 21808 Oct 30 20:55 libandroid-support.so
-rwxr-xr-x 1 root root 978160 Oct 30 20:55 libc.so
-rwxr-xr-x 1 root root 14176 Oct 30 20:55 libdl.so
-rwx--x--x 1 root root 1050584 Oct 30 20:55 libiconv.so
-rwx--x--x 1 root root 339192 Oct 30 20:55 libncursesw.so.6.2
-rwx--x--x 1 root root 311240 Oct 30 20:55 libreadline.so.8.2
~ # /bin/whoami
root
~ # /bin/md5sum ./test/bash
0bcd4b7ec4961d3cf493cb4280c205e7 ./test/bash
~ # /bin/strace-static ./test/bash
execve("./test/bash", ["./test/bash"], [/* 26 vars */]) = -1 ENOENT (No such file or directory)
write(2, "/bin/strace-static: exec: No suc"..., 52/bin/strace-static: exec: No such file or directory
) = 52
mprotect(0x70bb8d5000, 4096, PROT_READ|PROT_WRITE) = 0
mprotect(0x70bb8d5000, 4096, PROT_READ) = 0
mprotect(0x70bb8d5000, 4096, PROT_READ|PROT_WRITE) = 0
mprotect(0x70bb8d5000, 4096, PROT_READ) = 0
munmap(0x70bb8d5000, 4096) = 0
exit_group(1) = ?
+++ exited with 1 +++

I just don't understand, as it's all in test: outside the chroot, I can see which libraries are needed:

1|BOOX:/data/data/com.termux # linker64 --list

/data/data/com.termux/files/test/bash
linux-vdso.so.1 => [vdso] (0x7a59929000)
(null) => /data/data/com.termux/files/usr/lib/libandroid-support.so (0x7a581b8000)
libreadline.so.8 => /data/data/com.termux/files/usr/lib/libreadline.so.8.2 (0x7a58395000)
libiconv.so => /data/data/com.termux/files/usr/lib/libiconv.so (0x7a581e5000)
libdl.so => /apex/com.android.runtime/lib64/bionic/libdl.so (0x7a58422000)
libc.so => /apex/com.android.runtime/lib64/bionic/libc.so (0x7a58444000)
libncursesw.so.6 => /data/data/com.termux/files/usr/lib/libncursesw.so.6.2 (0x7a5832b000)

I'm a bit lost there. I'd rather have a spare adbd working manually on another port at first, then put it inside a magisk module, and only then start messing up with the framework.

Can I please ask for some help?

[Renate]

You get high marks for the most convoluted solution.
I've never mixed it up with chroot so I have nothing to say on that.

When you reboot your device does ADB show up before the boot animation starts?
Or does it only connect when your home screen shows?

I take it back, you have to change the last four of eight occurences of "keypad".
It was working fine before. I had back annotated my documentation and got it wrong.
When I tried to redo it by the documentation, it didn't work.

[csdvrx]

Originally Posted by Renate

You get high marks for the most convoluted solution.
I've never mixed it up with chroot so I have nothing to say on that.

Uh, that's not a nice thing to say?

Or if you prefer it in passive-aggressive tone, you get high marks for not engaging the core problem, giving obscure advice, and not being curious of what's happening or why.

You said adbd might have a few problems? Since I plan to do some more hacks, I'm both curious about them, and I want to make sure adbd can't be messed with too easily by the rest of the system.

I don't want to blindly try hacking a boot.img until something works: I prefer to understand what's happening, which parts does what, then make some precise changes to do what I want.

A chroot seemed like the easiest way. But it doesn't work, and that's super intriguing me: I believe everything that doesn't work the way it should is often a wonderful opportunity to learn and improve things!

I'm not well versed in android stuff yet, but by default I think this way is the right way to do things. Or at least, that's my way.

However, given your dismissive answer, we may have very different way of doing things.

So I will not bother you with questions anymore, I'll keep chugging along exploring and understanding the system, then post a detailed explanation of my "convoluted" solution on reddit when I'm done.

Have a nice day

[Renate]

I've changed my mind again. Modifying framework-res.apk has too many problems.
It's better to patch framework.jar
Currently I'm having some problems with the patching.

[csdvrx]

I'll start fixing the adb problem my way and let you know when it's done.

FYI the problem with ENOENT were due to the missing linker: more details here with an example here

Android 10 that Onyx uses has introduced changes

You can work on your solution with patching framework.apk, or wait a bit: when my adbd solution is ready you should have fewer problems, as you will be able to see what's going wrong through adb, and why.

[csdvrx]

@Renate a first version of a working chroot in https://github.com/csdvrx/chroot-android10/

It comes with a few static binaries to help you debug (not just adb_static, but busybox_static and strace_static)

[Renate]

I've filed a bug on apktool 2.6.1

[csdvrx]

Originally Posted by Renate

I've filed a bug on apktool 2.6.1

I'm not sure I understand. You want to run apktool in chroot?

Lmk if you need more help with the script - this is just an early version, but it should already allow you to run in a chroot any binary you want, static or dynamic.

For more advanced tools like apktool, of course you will need to add a few libraries and directories to the chroot. It's not easy **yet** but it should already be possible.

I will try to facilitate that by adding a parsing of dependencies through linker64 (ldd)

Next will be cgroups and iterative overlayfs snapshots to give quotas for CPU, network etc.

Please post questions related to this chroot on https://old.reddit.com/r/Onyx_Boox/c..._designed_for/ ass I prefer staying on reddit.

For adbd in chroot I'm still learning the details as I'd like adbd_static to coexist on a different port if possible, to start and stop it as needed and only act as a supplement to the normal adbd

There are a lot of details on https://events.static.linuxfound.org..._kobayashi.pdf to understand https://android.googlesource.com/pla...se/adb/adb.cpp

Given evdenis patch on http://github.com/evdenis/adb_root/ I may just add auth and give up and lead adbd_static be the only adbd.

Anyway, it's a WIP, I will let you know when it's ready, I hope it will help you with your hacks!

[Renate]

Originally Posted by Renate

I've filed a bug on apktool 2.6.1

Originally Posted by csdvrx

I'm not sure I understand.

Originally Posted by Renate

It's better to patch framework.jar
Currently I'm having some problems with the patching.

apktool 2.6.1 can't "round-trip" framework.jar