Finding hooks for NickelHook

[lumping-sugar66]

So, more progress. I've had some success!

I wanted to triple-check the symbols availability on the device and change the nh.c to dump all the available symbols to a text file, and then I checked for the symbols from working mods vs. unsuccessful attempts of mine.

Sure enough, "_ZN11ReadingView19readerIsDoneLoadingEv" is on this list (nickelclock)

But, "_ZN20OverDriveActionProxy16setShowOverDriveEb " is not. Some of the other symbols I've tried are not there as well.

I ended up basing my search on this list instead of Ghidra and symdump results, and for this use case of forcing OverDrive, thankfully, there's a "_ZN20OverDriveCardManager18isOverDriveEnabled Ev". I hooked onto that and overridden the internal logic, and sure enough, the mod works with no hiccup.

So I'm not sure if it's the particular libnickel.so.1.0.0 that doesn't expose these symbols in some way or make them available to nickelhook, but I think I'll base my search for hookable symbols on that list and proceed with other tools to see the decompilation result, unless there's other suggestions.

FWIW, I'm sharing that list here: https://gist.github.com/onatbas/a203...0968ab9aee3db2

[sherman]

You know you can just dump the symbols using nm right?

Anyway, you probably had a firmware version mismatch or something. Symbols are often only found in later firmware versions. Sometimes they are also removed.

[lumping-sugar66]

I guess I don’t. Which tool is that?

Also, I need some help with getting the qt resources exported. The qrc2zip instructions are to look for some registration and init calls to get the parameters required but I’m seeing to trace to these calls. shermp, I see in your code you act based on the design and structure of these internal qt files. Is there an easy way to get them or the parameter set for qrc2zip?

Thank you.

FWIW: I was playing around with the DragonQuiltedPowerView method and hooking into it , getting the size written to see which widget it was etc. and managed to completely factory reset the device. No idea how that happened, but creating mods aren’t as safe as I initially thought!

[sherman]

For the Qt resources, I don't bother getting them myself. In the kobo-patches repository, geek1011 extracts them on every firmware issue. Just find the issue for the latest firmware and look for the comment that includes them.

Once you have the zip file, the file structure inside tells you what path to use.

As far as nm is concerned, it is generally installed as part of the standard binutils package on any linux distro. Therefore it should also be available in the nickeltc docker container, if you aren't already developing on linux.

[geek1011]

Originally Posted by lumping-sugar66

Also, I need some help with getting the qt resources exported. The qrc2zip instructions are to look for some registration and init calls to get the parameters required but I’m seeing to trace to these calls. shermp, I see in your code you act based on the design and structure of these internal qt files. Is there an easy way to get them or the parameter set for qrc2zip?

https://github.com/pgaskin/qrc/blob/...ipts/armqrc.py

FWIW: I was playing around with the DragonQuiltedPowerView method and hooking into it , getting the size written to see which widget it was etc. and managed to completely factory reset the device. No idea how that happened, but creating mods aren’t as safe as I initially thought!

It's always riskier hooking stuff which is used before getting to the home screen. It's also possible that something you did (not necessarily in the mod itself) interfered with the database, which would cause a reset. Mods should always be safer than nearly all other methods, though, since they remove themselves eventually, and they only load when nickel loads.

[lumping-sugar66]

Thank you guys for your help.

I just shared my first mode in another thread. Couldn’t have done it without your support.
https://www.mobileread.com/forums/sh...d.php?t=357540