PRS+ 300 (Browse Folders, Book History, Key Bindings, Dictionary, epub customization) - Page 4

kartu · 09-12-2010, 01:22 AM

Quote:

Originally Posted by minox.b

...besides, I think i messed up Fsk and Root partition when I did forced installation without backup yesterday. Is there a way to get back to the original Fsk and Root?

I cannot imagine how you could have "messed up" the partitions (if no errors were reported when flashing them).

If problem appears only when dealing with dictionary, I'd rather have look at the dic file you are using. I haven't tested if it works at all on 300, so there might be a compatibility problem.

Anyway, if you still want to flash something somewhere, you can get the firmware files here.

Mark Nord · 09-12-2010, 04:54 AM

Quote:

Quote: From The-Ebook.org

Quote:

3. 3. Установил историю книг на кнопке
Очень неудобно, что нельзя как на 505 установить на прижатую клавишу, стало сильно неудобно

Увы, в этой прошивке скрипт не поддерживает "hold цифры", с другой стороны, поддерживает "hold" кнопок джойстика. все поддерживаемые прошивкой кнопки.
Теоретически должно быть возможно добавить многие комбинации (полагаю, в ebook.so есть таблица "системный ивент " - "что передать скрипту) может igorsk или еще кто сильный в декомпилировании бинарников поможет.

Google-Translation:

Quote:

1 Established history books on the 1
Very inconvenient, as it is impossible to install on 505 pressed down, it became very uncomfortable

Alas, this firmware does not support script "hold the numbers, on the other hand, maintains" hold "button joystick. I brought in all the key bindings supported by the firmware button. Theoretically, it should be possible to add many combinations (think in ebook.so have a table "System Event" - "what should we tell the script) can igorsk or someone strong to help decompiling binaries.

Decompiling ebook.so from the 300-firmware-folder and comparing it to the 505 version isn't the problem.

Unfortunately there isn't a simply Event-Table, but the FSK-event-generation is done in "SubcpuThreadPostKeyEvent" by fireing "SubcpuThreadPostDigitEvent" or "SubcpuThreadPostBooleanEvent".

Relevant snippet here:

Code:

.text:0000CCF8                 EXPORT SubcpuThreadPostKeyEvent
.text:0000CCF8 SubcpuThreadPostKeyEvent                ; CODE XREF: 
mode
...
.text:0000CDEC                 LDRB    R3, [R5,#0x84]
.text:0000CDF0                 CMP     R3, #0
.text:0000CDF4                 BNE     loc_CE98
.text:0000CDF8                 MOV     R4, SP
.text:0000CDFC                 MOV     R0, SP          ; char *
.text:0000CE00                 LDR     R3, =0x3FC
.text:0000CE04                 LDR     R1, [R10,R3]    ; R10 = DCD __GLOBAL_OFFSET_TABLE_ + 0x3FC = .got 1ABB4 
                                                       ; rodata:000115D8 DCB "%d",0 
.text:0000CE08                 MOV     R2, R6
.text:0000CE0C                 BL      _sprintf
.text:0000CE10                 MOV     R0, R5
.text:0000CE14                 MOV     R1, SP
.text:0000CE18                 BL      SubcpuThreadPostDigitEvent
.text:0000CE1C                 B       loc_CE98
.text:0000CE20 ; ---------------------------------------------------------------------------
.text:0000CE20
.text:0000CE20 loc_CE20                                ; CODE XREF: SubcpuThreadPostKeyEvent+F0
.text:0000CE20                 MOV     R4, SP
.text:0000CE24                 MOV     R0, SP          ; char *
.text:0000CE28                 LDR     R3, =0x3FC      ; again "%d",0 for the PRS 505 this points to "kHold%d",0
.text:0000CE2C                 LDR     R1, [R10,R3]    ; char *
.text:0000CE30                 MOV     R2, R6
.text:0000CE34                 BL      _sprintf
.text:0000CE38                 MOV     R0, R5
.text:0000CE3C                 MOV     R1, SP
.text:0000CE40                 BL      SubcpuThreadPostDigitEvent
.text:0000CE44                 B       loc_CED8
.text:0000CE48 ; -----------------------------------------------------------------------

As you can see at .text:0000CE00 and .text:0000CE28 "%d" is given as parameter to _sprintf, while in the corresponding PRS505 code, the second LDR points to "kHold%d".
So the necessary code for detection of a number-key-hold event is there, but it will trigger the generation of a simple key press event

With Intel-Opcodes I would try to find a "free" string-resource replace it with "kHold%d",0 and point at .text:0000CE28 to this.
But with ARM-Opcodes I'm not sure if this can be done.
Alternatively the doHold-Numberkey-branch could be redirected to the doHold-anyother key branch, thus maybe giving a 0x##-hold FSK-Event.
As the original firmware isn't aware of kHold#, this shouldn't do any harm, and PRS+ code could eventualy use this 0x##-hold.
But again, I'm just learning about ARM-OPCode and don't know if it is possible to patch the binary that way.

As a reference I attach the relevant part of the disassembly

kartu · 09-12-2010, 08:10 AM

Mark Nord
Fantastic!

What is different in regards to referencing Strings between Intel/ARM? (just wondering)

Did you find out why 300 supports "kUp-hold" and 505 doesn't?
What does SubcpuHwKeyToSwKey function do?

PS
Not sure if this could help you (an elf editor)

Jonimeesermann · 09-12-2010, 07:09 PM

Hi Kartu, I'm still new in this stuff, and have one question to ask:
You say that prs+ support custom css, does it mean it support fully justified epub too?

I really want this feature and just want to make sure before I take the plunge to install prs+ (while you say it's nearly unbrickable, I think I'm still kind of scared to mess it up)

kartu · 09-13-2010, 01:46 AM

Quote:

Originally Posted by Jonimeesermann

Hi Kartu, I'm still new in this stuff, and have one question to ask:
You say that prs+ support custom css, does it mean it support fully justified epub too?

Unfortunatelly it doesn't. Using pepak's hack, it simply allows you to to have your own CSS styles, reference your own fonts, set size, margins, etc and switch between those styles.

You could have "justify" setting in CSS file, but it is ignored by the EPUB viewer.

Mark Nord · 09-13-2010, 04:20 AM

Quote:

Originally Posted by kartu

Mark Nord
Fantastic!

Your are welcome!
Just a quick first answer

Quote:

What is different in regards to referencing Strings between Intel/ARM? (just wondering)

My reference here says:

instruction stream can't be used as data
adresses to constants are given as offset relative to PC and are read from a literal pool (.got _golbal_offset_tabel_ )

Quote:

Did you find out why 300 supports "kUp-hold" and 505 doesn't?

Because of slightly different implementation of "SubcpuThreadBuildTag"
With PRS505 only keys other then #26-23 are passed to the code appending "-hold" for a doHold Event,
In the code for the 300 there is additional _sprintf followed by a jump to append "-hold" via _strcat

Quote:

What does SubcpuHwKeyToSwKey function do?

For sure it's a loop, terminating at 0x17 for the 505 and 0x12 for the 300.
There is some refenrenz to the .got, but can't say now what and why this is done.

BTW: as the PRS 505 is based on a linux kernel 2.4.17 the mount --bind trick via psrp.sh should work?

Will it be possible to bind a pached ebook.so? (As described here for the languages resources)

And why is the file first cp (copied if a have done my linux-class correctly) to \tmp and refenzed in the mount --bind again from \Data\ ?

kartu · 09-13-2010, 09:25 AM

Quote:

Originally Posted by Mark Nord

Your are welcome!
Just a quick first answer

My reference here says:

instruction stream can't be used as data
adresses to constants are given as offset relative to PC and are read from a literal pool (.got _golbal_offset_tabel_ )

I don't get the meaning of the latter, isn't it related to assembly language, rather than CPU capabilities?

If function is referencing string A from constant pool, what's the deal with referencing (existing) string B instead? I was thinking about "take unlikely to be used under normal circumstances error text, put %d there, reference this string instead of simply "%d"". Or, no idea if that's possible, cutting the string with 0 somewhere and then referencing only part of it with "ref to some symb" + offset.

Quote:

BTW: as the PRS 505 is based on a linux kernel 2.4.17 the mount --bind trick via psrplus.sh should work?

Yes. I've used it intensively.

Quote:

Will it be possible to bind a pached ebook.so? (As described here for the languages resources)

And why is the file first cp (copied if a have done my linux-class correctly) to \tmp and refenzed in the mount --bind again from \Data\ ?

It's an error, /tmp should have been referenced.
The point of binding to /tmp is not to interfere with readers mount/umount (happens with Data when connecting/disconnecting from PC) but it would work both ways without causing trouble most of the time.

PS
By the way, which disassembler do you use?

kravitz · 09-13-2010, 09:52 AM

Quote:

Originally Posted by Mark Nord

As you can see at .text:0000CE00 and .text:0000CE28 "%d" is given as parameter to _sprintf, while in the corresponding PRS505 code, the second LDR points to "kHold%d".
So the necessary code for detection of a number-key-hold event is there, but it will trigger the generation of a simple key press event

With Intel-Opcodes I would try to find a "free" string-resource replace it with "kHold%d",0 and point at .text:0000CE28 to this.
But with ARM-Opcodes I'm not sure if this can be done.

Try it, "%d" replaced with "kHold%d" at 0000CE28

[UPDATE]

Bad... Unfortunately both were replaced... 0000CE00 and 0000CE28

.text:0000CE00 LDR R3, =(off_1ABB4 - 0x1A7B8)
.text:0000CE04 LDR R1, [R10,R3] ; "kHold%d"
.text:0000CE08 MOV R2, R6
.text:0000CE0C BL .sprintf
.text:0000CE10 MOV R0, R5
.text:0000CE14 MOV R1, SP
.text:0000CE18 BL SubcpuThreadPostDigitEvent
.text:0000CE1C B loc_CE98
.text:0000CE20 ; ---------------------------------------------------------------------------
.text:0000CE20
.text:0000CE20 loc_CE20 ; CODE XREF: SubcpuThreadPostKeyEvent+F0j
.text:0000CE20 MOV R4, SP
.text:0000CE24 MOV R0, SP ; s
.text:0000CE28 LDR R3, =(off_1ABB4 - 0x1A7B8)
.text:0000CE2C LDR R1, [R10,R3] ; "kHold%d"
.text:0000CE30 MOV R2, R6
.text:0000CE34 BL .sprintf

Mark Nord · 09-13-2010, 10:27 AM

I got the concept with the string replace, [Update] cancle this. You can't simpley replace the ref to %d,0, because we need it, we have to use another reference.[/Update]
but thats what I tought,

Code:

.text:0000CDFC                 MOV     R0, SP          ; char *
.text:0000CE00                 LDR     R3, =0x3FC
.text:0000CE04                 LDR     R1, [R10,R3]    ; char *
.text:0000CE08                 MOV     R2, R6
.text:0000CE0C                 BL      _sprintf
.text:0000CE10                 MOV     R0, R5
.text:0000CE14                 MOV     R1, SP
.text:0000CE18                 BL      SubcpuThreadPostDigitEvent
.text:0000CE1C                 B       loc_CE98
.text:0000CE20 ; ---------------------------------------------------------------------------
.text:0000CE20
.text:0000CE20 loc_CE20                                ; CODE XREF: SubcpuThreadPostKeyEvent+F0j
.text:0000CE20                 MOV     R4, SP
.text:0000CE24                 MOV     R0, SP          ; char *
.text:0000CE28                 LDR     R3, =0x3FC
.text:0000CE2C                 LDR     R1, [R10,R3]    ; char *
.text:0000CE30                 MOV     R2, R6
.text:0000CE34                 BL      _sprintf
...
.text:0000CEEC ; End of function SubcpuThreadPostKeyEvent
.text:0000CEEC
.text:0000CEEC ; ---------------------------------------------------------------------------
.text:0000CEF0 off_CEF0        DCD __GLOBAL_OFFSET_TABLE_
.text:0000CEF0                                         ; DATA XREF: SubcpuThreadPostKeyEvent+8
.text:0000CEF4 dword_CEF4      DCD 0x410               ; DATA XREF: SubcpuThreadPostKeyEvent+D8
.text:0000CEF4                                         ; SubcpuThreadPostKeyEvent+16C ...
.text:0000CEF8 dword_CEF8      DCD 0x3FC               ; DATA XREF: SubcpuThreadPostKeyEvent+108
.text:0000CEF8                                         ; SubcpuThreadPostKeyEvent+130

The reference to .got is done via the relative offset DCD at 0CEF8, which happens to occur only once.
So we would have to trick the offset-calculation at line ce2c so get [EDIT] the new ref [\EDIT] as result.

psst: Disassembler used is I D A

kravitz · 09-13-2010, 11:01 AM

Mark Nord

I have allocated "kHold%d" at 0001160A. Reference at this string is written at 0012BB4 (001ABB4), but unfortunately this reference is used both command LDR at 0000CE00 and at 0000CE28.
As result all Num buttons will be sent with Hold, with ebook.so attached above.

kravitz · 09-15-2010, 03:22 AM

Mark Nord
kartu

In this version LDR at 0x0000CE04 uses immediate value (0x3FC) thereby releases dword at 0x0000CEF8. 0x0000CEF8 contains format string address now. LDR at 0x0000CE28 takes address from there.

Code:

.text:0000CDE8                 BNE     loc_CE20
.text:0000CDEC                 LDRB    R3, [R5,#0x84]
.text:0000CDF0                 CMP     R3, #0
.text:0000CDF4                 BNE     loc_CE98
.text:0000CDF8                 MOV     R4, SP
.text:0000CDFC                 MOV     R0, SP          ; s
.text:0000CE00                 NOP
.text:0000CE04                 LDR     R1, [R10,#0x3FC] ; format
.text:0000CE08                 MOV     R2, R6
.text:0000CE0C                 BL      .sprintf
.text:0000CE10                 MOV     R0, R5
.text:0000CE14                 MOV     R1, SP
.text:0000CE18                 BL      SubcpuThreadPostDigitEvent
.text:0000CE1C                 B       loc_CE98
.text:0000CE20 ; ---------------------------------------------------------------------------
.text:0000CE20
.text:0000CE20 loc_CE20.text:0000CE20                 MOV     R4, SP
.text:0000CE24                 MOV     R0, SP          ; s
.text:0000CE28                 LDR     R1, =aKholdD    ; "kHold%d"
.text:0000CE2C                 NOP
.text:0000CE30                 MOV     R2, R6
.text:0000CE34                 BL      .sprintf
.text:0000CE38                 MOV     R0, R5
.text:0000CE3C                 MOV     R1, SP
.text:0000CE40                 BL      SubcpuThreadPostDigitEvent
.text:0000CE44                 B       loc_CED8
.text:0000CE48 ; ---------------------------------------------------------------------------
…
.text:0000CEF8 ; char *format
.text:0000CEF8 format DCD aKholdD ; DATA XREF: SubcpuThreadPostKeyEvent+130 r
.text:0000CEF8 ; "kHold%d"

kartu, you can try this ebook.so but be ready to little crash)))

kravitz · 09-15-2010, 04:10 AM

or... a little different way)

Code:

.text:0000CDE8                 BNE     loc_CE20
.text:0000CDEC                 LDRB    R3, [R5,#0x84]
.text:0000CDF0                 CMP     R3, #0
.text:0000CDF4                 BNE     loc_CE98
.text:0000CDF8                 MOV     R4, SP
.text:0000CDFC                 MOV     R0, SP          ; s
.text:0000CE00                 MOV     R3, #0x3FC
.text:0000CE04                 LDR     R1, [R10,R3]    ; format
.text:0000CE08                 MOV     R2, R6
.text:0000CE0C                 BL      .sprintf
...

[UPDATE]
It's possible only because 0x3FC is 1111111100b)

Mark Nord · 09-15-2010, 04:55 AM

kravitz
You are some minutes faster :-)

I also found LDR immediate value.
But increased .got size by 4 bytes in the header and put a new offset at 1AC70.
[Edit] Maybe messed up the headers by appending .got) [\EDIT]
Also tried to align kHold%d at 4 byte border.
Don't know if this will work (can't test)

Just out of curiosity: have you found a ARM-Assembler to build the codes, or are you doing it by hand like me?

kartu · 09-15-2010, 04:59 AM

Tried versions from kravitz, both work, first hang up when connecting ot USB (rechecking it now) second works, but reports "" as a key instead of kHold*.

Will try version from Mark right now.

kartu · 09-15-2010, 05:10 AM

Couldn't repeat "hang" problem with the first version from kravitz.

Version from Mark: boots, but crashes on hold 0 event.

PS
Guys, remeber that you can experiment with enabling joypad up/down/left/right hold events on 505.

09-12-2010, 08:10 AM	#48
kartu PRS+ author Posts: 1,637 Karma: 2446233 Join Date: Dec 2007 Device: Sony PRS-300, 505, 600, 650, 950	Mark Nord Fantastic! What is different in regards to referencing Strings between Intel/ARM? (just wondering) Did you find out why 300 supports "kUp-hold" and 505 doesn't? What does SubcpuHwKeyToSwKey function do? PS Not sure if this could help you (an elf editor) Last edited by kartu; 09-12-2010 at 08:21 AM.

09-13-2010, 11:01 AM	#55
kravitz Connoisseur Posts: 51 Karma: 104 Join Date: Mar 2010 Device: 505, Kindle PW	Mark Nord I have allocated "kHold%d" at 0001160A. Reference at this string is written at 0012BB4 (001ABB4), but unfortunately this reference is used both command LDR at 0000CE00 and at 0000CE28. As result all Num buttons will be sent with Hold, with ebook.so attached above. Last edited by kravitz; 09-13-2010 at 11:17 AM.

09-15-2010, 04:55 AM	#58
Mark Nord 2B \|\| !2B Posts: 851 Karma: 194010 Join Date: Feb 2010 Location: Austria Device: Sony PRS505/650/T1/tolino vision 5	kravitz You are some minutes faster :-) I also found LDR immediate value. But increased .got size by 4 bytes in the header and put a new offset at 1AC70. [Edit] Maybe messed up the headers by appending .got) [\EDIT] Also tried to align kHold%d at 4 byte border. Don't know if this will work (can't test) Just out of curiosity: have you found a ARM-Assembler to build the codes, or are you doing it by hand like me? Last edited by Mark Nord; 09-17-2010 at 03:26 AM. Reason: Attachment removed, wasn't working

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
PRS-505 PRS+: 2 Questions on "Browse Folders" and Dictionary Format	crc	Sony Reader	2	06-23-2010 01:36 AM
PRS-300 English dictionary for PRS-300	theles92843	Sony Reader	7	04-23-2010 02:25 PM
database of book bindings	Nate the great	Deals and Resources (No Self-Promotion or Affiliate Links)	0	12-05-2009 08:59 PM
iLiad custom key bindings for fbreader	cnbcad	iRex Developer's Corner	2	05-25-2008 02:27 AM
Key Events in Microsoft History	Colin Dunstan	Lounge	2	11-16-2004 01:03 PM

09-12-2010, 07:09 PM	#49
Jonimeesermann Connoisseur Posts: 82 Karma: 12 Join Date: Apr 2010 Device: Nokia e71, Ipod Touch, Sony PRS 300	Hi Kartu, I'm still new in this stuff, and have one question to ask: You say that prs+ support custom css, does it mean it support fully justified epub too? I really want this feature and just want to make sure before I take the plunge to install prs+ (while you say it's nearly unbrickable, I think I'm still kind of scared to mess it up)

09-15-2010, 04:59 AM	#59
kartu PRS+ author Posts: 1,637 Karma: 2446233 Join Date: Dec 2007 Device: Sony PRS-300, 505, 600, 650, 950	Tried versions from kravitz, both work, first hang up when connecting ot USB (rechecking it now) second works, but reports "" as a key instead of kHold*. Will try version from Mark right now.

09-15-2010, 05:10 AM	#60
kartu PRS+ author Posts: 1,637 Karma: 2446233 Join Date: Dec 2007 Device: Sony PRS-300, 505, 600, 650, 950	Couldn't repeat "hang" problem with the first version from kravitz. Version from Mark: boots, but crashes on hold 0 event. PS Guys, remeber that you can experiment with enabling joypad up/down/left/right hold events on 505.

Advert

Advert