Finding hooks for NickelHook

[sherman]

Don't forget, Nickel is old. I imagine it still carries a lot of baggage from its Qt 4.6 days, despite the fact they're now using Qt 5.2.

As far as styling goes, geek1011 was (I think) referring to stuff like font face and size, as well as border styles etc. Unstyled widgets on Kobo's are... not pretty.

[sherman]

I've done some experimenting today, and managed to subclass a QPushButton and respond to standard QGesture events. Or at least tap events.

[halfdozen]

Which signals were you able to see when using a standard widget?

I've not played much more as I've been tidying up how my symbols work, the C code was bugging me some what but now I have an `IconButton` class that behaves as a QObject so I can create a button like a Qt class without passing things into functions (pretty much a shim on top of the NickelHook symbols).

With that and some playing around with the Nickel GenericContainer I've been able to inject some new buttons into the `More` menu.

[sherman]

I've been doing some more experimenting and it appears there's at least some support for QTouchEvent as well, if enabled by setting Qt::WA_AcceptTouchEvents attribute on a widget.

I've only ever seen TouchBegin events though.

And I've discovered that Qt gestures are a PITA

[lumping-sugar66]

Hello everyone,

Would it be possible for you, any of you, to share a symdump or something similar to help with workong on libnickel in Ghidra? As a decompilation novice, I would take any help I could get to develop mods.

Thanks!

[geek1011]

All the symbols you'll get are in libnickel itself, and should work with most tools. The only other information is the Qt metaobject stuff (see the NickelDBus-related stuff for more about that), and the C++ RTTI. For tail call address extraction, use my symdump tool in the Kobo patch repo. For Qt resources, use my qrc tool, or look in the kobopatch firmware release issues on GitHub.

[lumping-sugar66]

Thank you @geek1011.

I am making slow progress but I think I'm at a point where I can ask a few questions.

I'm having trouble getting hooks to be established. dlsym grabs are working fine. Here's how I'm configuring.

If I have only the following:

typedef QObject OverDriveActionProxy;
void (*OverDriveActionProxy_setShowOverdrive)(OverDrive ActionProxy *_this, bool setShow);

struct nh_dlsym NickelNoteDlsym[] = {
{
.name = "_ZN20OverDriveActionProxy16setShowOverDriveEb ",
.out = nh_symoutptr(OverDriveActionProxy_setShowOverdrive ),
.desc = "OverDriveActionProxy_setShowOverdrive"
},
{0},
};

My init call executes fine (I am logging to a text file)

But, when I switch to a hook instead with the following, my init doesn't work anymore.

typedef QObject OverDriveActionProxy;
void (*OverDriveActionProxy_setShowOverdrive)(OverDrive ActionProxy *_this, bool setShow);

extern "C" void _always_show_overdrive(OverDriveActionProxy *_this, bool setShow) {
appendToFile(NICKEL_NOTE_DIR "logs.txt", "Intercepted... _always_show_overdrive");
OverDriveActionProxy_setShowOverdrive(_this, setShow);
}

struct nh_hook NickelNoteHook[] = {

{
.sym = "_ZN20OverDriveActionProxy16setShowOverDriveEb ",
.sym_new = "_always_show_overdrive",
.lib = "libnickel.so.1.0.0",
.out = nh_symoutptr(OverDriveActionProxy_setShowOverdrive ),
.desc = "Always show overdrive"
},
{0}
};

There's literally nothing in the code apart from the NickelHook macro, init and uninstall calls, and I think my function signatures are right. Do you see anything out of place here?

Thanks

[geek1011]

Originally Posted by lumping-sugar66

There's literally nothing in the code apart from the NickelHook macro, init and uninstall calls, and I think my function signatures are right. Do you see anything out of place here?

Try adding this after the extern C: __attribute__((visibility("default")))

[lumping-sugar66]

Originally Posted by geek1011

Try adding this after the extern C: __attribute__((visibility("default")))

Unfortunately didn’t make a difference. I started out with that copying from nickelclock.

[geek1011]

I'll take a closer look at it later this week if nobody gets to it first.

Do any log lines appear in the syslog at all?

[lumping-sugar66]

Thank you.

I've published the complete code here at this repository as well.

https://github.com/onatbas/nickelnote.git

I'm not seeing any logs. I used to get NickelNote_<TIMESTAMP>.txt files generated in the .adds folder when I was setting up the system; I saw fatal errors get captured, but that was an earlier issue. Now, with this one, I'm not getting any files.

I don't have syslog in its usual place (I checked /var/log/syslog and syslog. conf). Is that in a different spot on a kobo?

"find / | grep log" doesn't yield anything useful either.

[lumping-sugar66]

I've managed to get some logs, it looks like it fails to find the symbol.

Nov 28 12:18:39 nickel: (NickelNote) (NickelHook) checking config
Nov 28 12:18:39 nickel: (NickelNote) (NickelHook) checking for uninstall flag '/mnt/onboard/nn_uninstall'
Nov 28 12:18:39 nickel: (NickelNote) (NickelHook) loading libraries
Nov 28 12:18:39 nickel: (NickelNote) (NickelHook) resolving symbols
Nov 28 12:18:39 nickel: (NickelNote) (NickelHook) applying hooks
Nov 28 12:18:39 nickel: (NickelNote) (NickelHook) info: nh_hook: setting hook on ('libnickel.so.1.0.0', '_ZN20OverDriveActionProxy16setShowOverDriveEb') to (self, '_always_show_overdrive') (desc: Always show overdrive)
Nov 28 12:18:39 nickel: (NickelNote) (NickelHook) ... dlhook: info: lib /usr/local/Kobo/libnickel.so.1 is mapped at 7552b000
Nov 28 12:18:39 nickel: (NickelNote) (NickelHook) ... dlhook: info: DT_DYNAMIC: plt_is_rela=0 plt=0x75b550f4 plt_sz=1991945464 plt_ent_sz=194808 sym=(nil) str=0x8
Nov 28 12:18:39 nickel: (NickelNote) (NickelHook) ... dlhook: error: could not find symbol
Nov 28 12:18:39 nickel: (NickelNote) (NickelHook) ... fatal: could not hook symbol
Nov 28 12:18:39 nickel: (NickelNote) (NickelHook) fatal error

I analyzed the libnickel.so.1.0.0 directly from the device and I seem to have the symbol correct, plus dlsym seem to work well. Does this mean the missing symbol is for _always_show_overdrive?

[geek1011]

It's the "logread" command, btw.

The symbol error is coming from the OverDriveActionProxy one. I'll check in an hour or two.

[geek1011]

I don't see anything obviously incorrect about the code, but do note that you'll want to include the Makefile in the repository. Also, on a side note, the overdrive thing you're doing is better suited as a patch than a hook, though a hook should work fine (I'd hook the getter personally, though).

[lumping-sugar66]

Thanks for checking it. The Makefile is unchanged from what nickelhook generates. I'll commit that, too.

I tried with many other symbols, and I don't seem to be able to hook anything. I will check the ways of implementing it (along with a few other mods I'm planning based on Nickelhook). I didn't see the getter, hah!

I can recompile nickelclock using the same setup, and it works. I used your symdump to ensure the symbols are in place; they are. I checked the NickelHook versions between various projects; the only difference is the readme between my version and others. I'll try uninstalling all other things and check again.