View Single Post
Old 09-12-2010, 04:54 AM   #47
Mark Nord
2B || !2B
Mark Nord ought to be getting tired of karma fortunes by now.Mark Nord ought to be getting tired of karma fortunes by now.Mark Nord ought to be getting tired of karma fortunes by now.Mark Nord ought to be getting tired of karma fortunes by now.Mark Nord ought to be getting tired of karma fortunes by now.Mark Nord ought to be getting tired of karma fortunes by now.Mark Nord ought to be getting tired of karma fortunes by now.Mark Nord ought to be getting tired of karma fortunes by now.Mark Nord ought to be getting tired of karma fortunes by now.Mark Nord ought to be getting tired of karma fortunes by now.Mark Nord ought to be getting tired of karma fortunes by now.
 
Posts: 854
Karma: 327896
Join Date: Feb 2010
Location: Austria
Device: Sony PRS505/650/T1/tolino vision 5
Missing kHold# Event on PRS 300

Quote:
Quote: From The-Ebook.org
Quote:
3. 3. Установил историю книг на кнопке
Очень неудобно, что нельзя как на 505 установить на прижатую клавишу, стало сильно неудобно
Увы, в этой прошивке скрипт не поддерживает "hold цифры", с другой стороны, поддерживает "hold" кнопок джойстика. все поддерживаемые прошивкой кнопки.
Теоретически должно быть возможно добавить многие комбинации (полагаю, в ebook.so есть таблица "системный ивент " - "что передать скрипту) может igorsk или еще кто сильный в декомпилировании бинарников поможет.

Google-Translation:
Quote:
1 Established history books on the 1
Very inconvenient, as it is impossible to install on 505 pressed down, it became very uncomfortable
Alas, this firmware does not support script "hold the numbers, on the other hand, maintains" hold "button joystick. I brought in all the key bindings supported by the firmware button. Theoretically, it should be possible to add many combinations (think in ebook.so have a table "System Event" - "what should we tell the script) can igorsk or someone strong to help decompiling binaries.
Decompiling ebook.so from the 300-firmware-folder and comparing it to the 505 version isn't the problem.

Unfortunately there isn't a simply Event-Table, but the FSK-event-generation is done in "SubcpuThreadPostKeyEvent" by fireing "SubcpuThreadPostDigitEvent" or "SubcpuThreadPostBooleanEvent".

Relevant snippet here:
Code:
.text:0000CCF8                 EXPORT SubcpuThreadPostKeyEvent
.text:0000CCF8 SubcpuThreadPostKeyEvent                ; CODE XREF: 
mode
...
.text:0000CDEC                 LDRB    R3, [R5,#0x84]
.text:0000CDF0                 CMP     R3, #0
.text:0000CDF4                 BNE     loc_CE98
.text:0000CDF8                 MOV     R4, SP
.text:0000CDFC                 MOV     R0, SP          ; char *
.text:0000CE00                 LDR     R3, =0x3FC
.text:0000CE04                 LDR     R1, [R10,R3]    ; R10 = DCD __GLOBAL_OFFSET_TABLE_ + 0x3FC = .got 1ABB4 
                                                       ; rodata:000115D8 DCB "%d",0 
.text:0000CE08                 MOV     R2, R6
.text:0000CE0C                 BL      _sprintf
.text:0000CE10                 MOV     R0, R5
.text:0000CE14                 MOV     R1, SP
.text:0000CE18                 BL      SubcpuThreadPostDigitEvent
.text:0000CE1C                 B       loc_CE98
.text:0000CE20 ; ---------------------------------------------------------------------------
.text:0000CE20
.text:0000CE20 loc_CE20                                ; CODE XREF: SubcpuThreadPostKeyEvent+F0
.text:0000CE20                 MOV     R4, SP
.text:0000CE24                 MOV     R0, SP          ; char *
.text:0000CE28                 LDR     R3, =0x3FC      ; again "%d",0 for the PRS 505 this points to "kHold%d",0
.text:0000CE2C                 LDR     R1, [R10,R3]    ; char *
.text:0000CE30                 MOV     R2, R6
.text:0000CE34                 BL      _sprintf
.text:0000CE38                 MOV     R0, R5
.text:0000CE3C                 MOV     R1, SP
.text:0000CE40                 BL      SubcpuThreadPostDigitEvent
.text:0000CE44                 B       loc_CED8
.text:0000CE48 ; -----------------------------------------------------------------------
As you can see at .text:0000CE00 and .text:0000CE28 "%d" is given as parameter to _sprintf, while in the corresponding PRS505 code, the second LDR points to "kHold%d".
So the necessary code for detection of a number-key-hold event is there, but it will trigger the generation of a simple key press event

With Intel-Opcodes I would try to find a "free" string-resource replace it with "kHold%d",0 and point at .text:0000CE28 to this.
But with ARM-Opcodes I'm not sure if this can be done.
Alternatively the doHold-Numberkey-branch could be redirected to the doHold-anyother key branch, thus maybe giving a 0x##-hold FSK-Event.
As the original firmware isn't aware of kHold#, this shouldn't do any harm, and PRS+ code could eventualy use this 0x##-hold.
But again, I'm just learning about ARM-OPCode and don't know if it is possible to patch the binary that way.

As a reference I attach the relevant part of the disassembly
Attached Files
File Type: txt ebook.so.300.txt (45.1 KB, 279 views)

Last edited by Mark Nord; 09-13-2010 at 04:26 AM.
Mark Nord is offline