Onyx Boox Kon-Tiki 2 (Nova3 platform) - apps

[mergen3107]

Ok, there is also a path to generic keychars. There I can see those BUTTON_1 and stuff, they have no main key but a dallback to DPAD_CENTER.

I am going to try to put a copy of generic.kcr to a Magisk module to see if I can substitute it.

[Renate]

Originally Posted by mergen3107

Ok, there is also a path to generic keychars.
I am going to try to put a copy of generic.kcr to a Magisk module to see if I can substitute it.

No, do not modify anything that says "generic".
As I said above, get the VID/PID from the "attached" logcat.
Copy whatever you like to your own copy of Vendor_1234_Product_5678.kl or .kcm
Then you can go wild and put the alphabet in reverse order or whatever.

You can add your file(s) to /system/usr/keylayout (using Magisk) or to /data/system/devices/keylayout (using a rooted shell).

[mergen3107]

Thank you! Let me try

[mergen3107]

So it’s not showing anything under the attached logcat. Is there other command to list all connected devices with their VID/PID?

[mergen3107]

Ok, so Linux command lsusb works on Android!

Strangely, it gives me three devices for my keyboard. Gonna try the first one first

[Renate]

Originally Posted by mergen3107

Strangely, it gives me three devices for my keyboard. Gonna try the first one first

Hmm, are you sure that it isn't three interfaces? It could be three devices.
Why didn't you quote the lsusb?
What the heck kind of keyboard is it with "gaming" buttons?

[mergen3107]

I can share the output a little later, currently I have trublesome access to PC

I am using a USB-C to USB-A dongle. Will check it whether it is recognized by itself or not

[mergen3107]

OK, I was able to get logs through the Onyx Boox itself using Termux. Yes I am writing here from it right now, hello!

lsusb:

Bus 001 Device 002: ID 0c45:652f
Bus 001 Device 001: ID 1d6b:0002
Bus 002 Device 001: ID 1d6b:0003

First two devices are indeed just the USB dongle, although I though it is a passive one.

logcat keylayout:

root@android:/sdcard # logcat | grep keylayout
11-30 22:09:39.780  1345  1450 I EventHub: New device: id=1, fd=120, path='/dev/input/event7', name='sdm660-snd-card-skush Button Jack', classes=0x1, configuration='', keyLayout='/system/usr/keylayout/Generic.kl', keyCharacterMap='/system/usr/keychars/Generic.kcm', builtinKeyboard=false,
11-30 22:09:39.784  1345  1450 I EventHub: New device: id=3, fd=123, path='/dev/input/event3', name='sf-keys', classes=0x1, configuration='', keyLayout='/system/usr/keylayout/Generic.kl', keyCharacterMap='/system/usr/keychars/Generic.kcm', builtinKeyboard=false,
11-30 22:09:39.787  1345  1450 I EventHub: New device: id=4, fd=125, path='/dev/input/event1', name='fts_ts', classes=0x15, configuration='', keyLayout='/system/usr/keylayout/Generic.kl', keyCharacterMap='/system/usr/keychars/Generic.kcm', builtinKeyboard=false,
11-30 22:09:39.789  1345  1450 I EventHub: New device: id=6, fd=127, path='/dev/input/event0', name='qpnp_pon', classes=0x1, configuration='', keyLayout='/system/usr/keylayout/Generic.kl', keyCharacterMap='/system/usr/keychars/Generic.kcm', builtinKeyboard=false,
11-30 22:09:39.791  1345  1450 I EventHub: New device: id=7, fd=128, path='/dev/input/event5', name='gpio-keys', classes=0x1, configuration='', keyLayout='/system/usr/keylayout/gpio-keys.kl', keyCharacterMap='/system/usr/keychars/Generic.kcm', builtinKeyboard=false,
11-30 22:09:39.793  1345  1450 I EventHub: New device: id=8, fd=129, path='/dev/input/event4', name='onyx-hall', classes=0x1, configuration='', keyLayout='/system/usr/keylayout/Generic.kl', keyCharacterMap='/system/usr/keychars/Generic.kcm', builtinKeyboard=false,
12-01 20:35:58.054  1345  1450 I EventHub: New device: id=11, fd=290, path='/dev/input/event8', name='SONiX USB DEVICE', classes=0x80000003, configuration='', keyLayout='/system/usr/keylayout/Generic.kl', keyCharacterMap='/system/usr/keychars/Generic.kcm', builtinKeyboard=false,
12-01 20:35:58.104  1345  1450 I EventHub: New device: id=12, fd=288, path='/dev/input/event9', name='SONiX USB DEVICE', classes=0x80000123, configuration='', keyLayout='/system/usr/keylayout/Generic.kl', keyCharacterMap='/system/usr/keychars/Generic.kcm', builtinKeyboard=false,

I tried putting the proper kcm and kl files through Magisk modules method, they changed alright, the logcat said it was using the kl file as a layout, but it didn't work.
Yes, strangely, NUMAPD keys 1-4 are hijacked, as well as all of the function keys F1-F12 by Onyx. Maybe that's the issue.

I am going to see if there is something hidden in the /vendor and /onyxconfig partitions about the keylayouts. Not sure though if I can replace them with Magisk modules method too.

[Renate]

1d6b/0002 and 1d6b/0003 are the (Linux Foundation) root USB hubs for USB2 and USB3.
They don't really physically exist.

If it says that it has loaded whatever.kl and whatever.kcm you need look no further.

You can see what should be hijacked if you look at res/raw/keypad.json in system/framework/framework-res.apk (if you haven't disabled this by modding system/framework/framework.jar).

Spoiler:

{
    "keypad": [
    {
      "keySet": [
        "KEYCODE_BACK"
      ],
      "shortPressAction": "KEYCODE_BACK",
      "longPressAction": "toggleFrontLight",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_MENU"
      ],
      "shortPressAction": "KEYCODE_MENU",
      "longPressAction": "fullRefreshScreen",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_DPAD_CENTER"
      ],
      "shortPressAction": "KEYCODE_DPAD_CENTER",
      "longPressAction": "toggleByConf",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_PAGE_UP"
      ],
      "shortPressAction": "KEYCODE_PAGE_UP",
      "longPressAction": "KEYCODE_MENU",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_PAGE_DOWN"
      ],
      "shortPressAction": "KEYCODE_PAGE_DOWN",
      "longPressAction": "fullRefreshScreen",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_F11"
      ],
      "shortPressAction": "toggleA2",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_VOLUME_UP"
      ],
      "shortPressAction": "switchByConf",
      "longPressAction": "customSideKeyLongPressUp",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_VOLUME_DOWN"
      ],
      "shortPressAction": "switchByConf",
      "longPressAction": "customSideKeyLongPressDown",
      "repeat": false
    }
  ]
}

If you tell me something has been "hijacked", please tell me what the result is. Can you see this in UsbMode.apk? Gaming buttons don't generally generate normal KeyEvents.

[mergen3107]

Thank you!

The json file is exact the same.

OK then, I guess it is my keyboard (GMMK Full Size, version 1) which is wonky with Android.

In UsbMode.apk those buttons are BUTTON_1, etc.

In Button Mapper though they are NUMPAD_1 etc, but I can't remap them there to output a keycode (yet).

I'll keep looking.

[mergen3107]

Here is all the output from logcat about "SONiX":

root@android:/data/ssh/root # logcat | grep SONiX
12-02 20:18:33.658  1351  1457 D EventHub: No input device configuration file found for device 'SONiX USB DEVICE'.
12-02 20:18:33.663  1351  1457 I EventHub: New device: id=9, fd=182, path='/dev/input/event8', name='SONiX USB DEVICE', classes=0x80000003, configuration='', keyLayout='/system/usr/keylayout/Generic.kl', keyCharacterMap='/system/usr/keychars/Generic.kcm', builtinKeyboard=false,
12-02 20:18:33.672  1351  1457 I InputReader: Device added: id=9, name='SONiX USB DEVICE', sources=0x00000101
12-02 20:18:33.724  1351  1457 D EventHub: No input device configuration file found for device 'SONiX USB DEVICE'.
12-02 20:18:33.727  1351  1457 I EventHub: New device: id=10, fd=181, path='/dev/input/event9', name='SONiX USB DEVICE', classes=0x80000123, configuration='', keyLayout='/system/usr/keylayout/Generic.kl', keyCharacterMap='/system/usr/keychars/Generic.kcm', builtinKeyboard=false,
12-02 20:18:33.730  1351  1457 I InputReader: Ignoring joystick 'SONiX USB DEVICE' axis 55 because all of the generic axis ids have already been assigned to other axes.
12-02 20:18:33.730  1351  1457 I InputReader: Ignoring joystick 'SONiX USB DEVICE' axis 56 because all of the generic axis ids have already been assigned to other axes.
12-02 20:18:33.730  1351  1457 I InputReader: Ignoring joystick 'SONiX USB DEVICE' axis 57 because all of the generic axis ids have already been assigned to other axes.
12-02 20:18:33.730  1351  1457 I InputReader: Ignoring joystick 'SONiX USB DEVICE' axis 58 because all of the generic axis ids have already been assigned to other axes.
12-02 20:18:33.730  1351  1457 I InputReader: Ignoring joystick 'SONiX USB DEVICE' axis 59 because all of the generic axis ids have already been assigned to other axes.
12-02 20:18:33.730  1351  1457 I InputReader: Ignoring joystick 'SONiX USB DEVICE' axis 60 because all of the generic axis ids have already been assigned to other axes.
12-02 20:18:33.730  1351  1457 I InputReader: Ignoring joystick 'SONiX USB DEVICE' axis 61 because all of the generic axis ids have already been assigned to other axes.
12-02 20:18:33.730  1351  1457 I InputReader: Ignoring joystick 'SONiX USB DEVICE' axis 62 because all of the generic axis ids have already been assigned to other axes.
12-02 20:18:33.730  1351  1457 I InputReader: Ignoring joystick 'SONiX USB DEVICE' axis 63 because all of the generic axis ids have already been assigned to other axes.
12-02 20:18:33.730  1351  1457 I InputReader: Device added: id=10, name='SONiX USB DEVICE', sources=0x01000311

[mergen3107]

The .kl file replacement still works, however it isn't being used anymore. It is all again Generic.kl and .kcm now.

[Renate]

Originally Posted by mergen3107

However it isn't being used anymore.

And why is that?

I don't know why you want to take a sufficiently confusing situation and add another layer of confusion with some "Button Mapper".

[mergen3107]

I don’t know why that happened.

Button Mapper is just another avenue for me to attack this issue

[mergen3107]

Some progress!

I tested the keyboard with a Samsung Galaxy phone - it works fine, NUMPAD keys 1-4 are correct.

In res/raw/bt_keypad.json I found this:

{
  "keypad": [
    {
      "keySet": [
        "KEYCODE_F1"
      ],
      "shortPressAction": "KEYCODE_MENU",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_F2"
      ],
      "shortPressAction": "KEYCODE_BACK",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_F3"
      ],
      "shortPressAction": "showDisplayControlAndIncreaseContrast",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_F4"
      ],
      "shortPressAction": "fullRefreshScreen",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_F5"
      ],
      "shortPressAction": "screenshot",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_F6"
      ],
      "shortPressAction": "toggleFrontLight",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_F7"
      ],
      "shortPressAction": "KEYCODE_F7",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_F8"
      ],
      "shortPressAction": "back_to_home",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_F9"
      ],
      "shortPressAction": "showDisplayControlDialog",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_F10"
      ],
      "shortPressAction": "showRefreshModeDialog",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_F11"
      ],
      "shortPressAction": "KEYCODE_F11",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_F12"
      ],
      "shortPressAction": "openFrontLightDialog",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_NUMPAD_1"
      ],
      "shortPressAction": "KEYCODE_BUTTON_1",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_NUMPAD_2"
      ],
      "shortPressAction": "KEYCODE_BUTTON_2",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_NUMPAD_3"
      ],
      "shortPressAction": "KEYCODE_BUTTON_3",
      "longPressAction": "",
      "repeat": false
    },
    {
      "keySet": [
        "KEYCODE_NUMPAD_4"
      ],
      "shortPressAction": "KEYCODE_BUTTON_4",
      "longPressAction": "",
      "repeat": false
    }
  ]
}

As you can see this is exactly the substitution used for hijacking!
Onyx uses those for any keyboard connected, BT or not, I think.

Now, how could I proceed to replace this file in the apk safely?