Related
Okay, so I've tried everything. PDOCREAD, DUMPROM, pget, grab_it, testdump.exe, FiziFetch. I need help with getting at all of the files and doing a complete ROM dump of the device. The only ROM Dump I have is the one that ETEN provides for upgrading the phone, I have attached that here. EUU.exe is the exe you run on the pc, and normally the rom file is called temp.dat, and it uses the other .exe which is compiled for windows ce to the phone to do the updating process.
Any help here would be greatly appreciated. In particular I want btagext.dll in the /Windows directory and full instructions on how to do it myself for other protected files.
The ROM can be obtained by going to updates.eten.ch and downloading the latest English ROM file for the M600. The direct link is here:
ftp://support.com:[email protected]/Download/Updates/M600/ENG/EUU_M600_WWE_R01_100_0171.EXE
To get the ROM file and the update file, goto your documents and settings/profile name/local settings/temp folder and clear out all the files.
Run the .exe you downloaded from above, and then look in the temp folder you just cleared. You should see a temp.dat which is the ROM file, EUU.exe which is the file that facilitates the transfer of the file to the ETEN M600 and another file USBDLUpdate_Console.exe which is a windows CE compiled file that facilitates the flashing process in some way.
Pdocread part of the itsutils is able to read see some of the information on my device:
pdocread –l lists the following:
122.19M FLASHDR
| 1.03M Part00
| 1.52M Part01
| 33.98M Part02
| 85.47M Part03
1.89G DSK1:
| 1.89G SD
STRG handles: a34cc21e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
( 1.89G) e3b41b8a
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
( 85.47M) e3b4153e
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
( 33.98M) 83b41436
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
( 1.52M) a3b412be
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
( 1.03M)
However it is not able to do anything other then that. All attempts at trying to access those partitions or device (flashdr) fail with errors such as these (this is just a small list of commands command options i've tried):
C:\itsutils\build>pdocread -d DSK1
ERROR: ITTFFSGetInfo - The handle is invalid.
C:\itsutils\build>pdocread -d DSK1:
ERROR: ITLogDiskInfo - An exception occurred in the service when handling the co
ntrol request.
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
C:\itsutils\build>pdocread 0x0 0x200 foo.bin
0 partitions, 0 binary partitions
customerid=00000000 uniqueid= 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
CopyTFFSToFile(0x0, 0x200, foo.bin)
ERROR: ITReadDisk - An internal error occurred.
C:\itsutils\build>pdocread -o -p part03
ERROR: ITTFFSGetInfo: outbuf==NULL
WARNING: using default 512 bytes for sectorsize
C:\itsutils\build>pdocread -d FLASHDR -w
ERROR: ITTFFSGetInfo - The handle is invalid.
Re: Need help extracting files from ETEN M600 ROM will pay $
I don't think that you'll be able to get a working dump of btagext.dll or any other system DLL. It does not have relocation information.
temp.dat in eten upgrade is in some strange format, it seems that data blocks are mixed.
What is the result of testdump.exe? I've attached the WM5 build of this program.
Re: Need help extracting files from ETEN M600 ROM will pay $
I've tried that before. That just dumps some information that is in memory. You can see calendar information, contact information, etc. If you put in 128mb which is the ROM size, it says DUMP OK this time (it had filesys errors the time I tried it a couple weeks ago) See here:
http://www.eten-users.net/topic1085
Anyways, in the end it dumps a 64 meg file instead of the 128 you specified, which is just the stuff in memory the 64 megs of RAM that this thing is suppose to have. If you use romdump on that file it doesn't get to many files, just about 30 or so and none of them are very important (most you can get via windows explorer and activesync)
FB
Re: Need help extracting files from ETEN M600 ROM will pay $
why do you think that eten has 128Mb OS ROM? It has only 48Mb ROM, other is left to persistent storage. So these tools would never dump full 128Mb, only 64Mb max.
You should upload somewhere the output of testdump tool, so I can look at it. It should produce _correct_ ROM dump. You just cannot extract files from it correctly. "dumprom" is for older oses, and with "-5" switch it would extract only files from XIP section (about 20 files). Use my "viewimgfs" tool to get everything from IMGFS.
I looked in the control panel, you are right it appears that the system part takes up about 48 mb, with the rest of the 128mb as user storage. It's kind of wierd though that testdump would stop at 64mb, wouldn't it stop at 48mb instead? If not why is it not doing the full 128 mb.
I tried what you had suggested and unfortunately that doesn't work either. I dumped a 64mb image, and a 48mb image. viewimgfs.exe didn't work on those images. I tried prepimgfs on the 48mb one and it couldn't find imgfs start location. I tried it on the 64mb one and it found it but the resulting file was about 256kb with a 4kb "removed_data" file which is definately not right.
I tried it without first running prepareimgfs and it just says "unable to load compress .dll".
I can't send a rom dump of what I have yet as it contains all of my contacts and calender information in looking at the memory dump in a hex editor, I'll have to whip the device clean again and I can send one but that may take awhile, i've got a lot of stuff setup right now.
Any other suggestions?
I found another bit of information. I played around with MTTY, which I know is for HTC devices, just to see what it would do though I thought I would try. It connects to the bootloader, however you never get to a command prompt. It appears that i can send a command, but then it trys to just download a file (the updated ROM). So I'm not sure if anything else can be done with this, I was hoping I could do something like "d2s" but it appears that with MTTY that doesn't seem possible.
I'm wondering if there is some way to map a USB port to a COM port so I can use regular hyperterminal. Does anyone know how to do this as Hyperterminal only supports COM ports...
MTTY is identical to hyperterminal
Ahh okay, it must be that they haven't implemented a nice interface like HTC devices where you can issue all of those commands
Hi!
Until now can you dump it? I can help you dump....
PM me,OK?
Okay, so i've finally been able to get these files from Vijay, however I'm still running into issues as describe here:
http://www.eten-users.net/topic1500
Anyone have any information on how to reconstruct PE files?
Hi all
I was wondering if there's a way to change the default white Color of a window, e.g. the Programs window change the Color to black or something.
Thanks all
I found this
http://msdn.microsoft.com/library/d...lui5/html/wce50conCustomizingSystemColors.asp
every time I try to change one of the values I get an error "Error in line 1, not a valid hex string!"
I tried changing the value Corresponding to COLOR_WINDOW from FF FF FF 00 to 00 00 00 00 but the same error. Is there Something I'm missing here?
Thanks for your help
Many Thanks to xda- developers esp helmi c xplod and mamaich for wm6.
We're luving it
Has anyone tried making a 32mb pagepool version of this yet ?
Actully，I make my BA‘s pagepool be 0M,Its speed is the same as that of 16M pagepool.If you like,you can change pagepool to any number as you wish.Following the list.
adrress:0x2565D3
00 00 00 00 =0M
00 00 80 00 =8M
00 00 C0 00 =12M
00 00 00 01 =16M
00 00 80 01 =24M
00 00 00 02 =32M
00 00 00 03 =48M
wongjam said:
Actully,I make my BA‘s pagepool be 0M,Its speed is the same as that of 16M pagepool.If you like,you can change pagepool to any number as you wish.Following the list.
adrress:0x2565D3
00 00 00 00 =0M
00 00 80 00 =8M
00 00 C0 00 =12M
00 00 00 01 =16M
00 00 80 01 =24M
00 00 00 02 =32M
00 00 00 03 =48M
Click to expand...
Click to collapse
is this a hex edit? and if so, which file do we need to make it to? thx in advance.
hi, koi_desi_pagal
Have you tried to perform search and what results you get? Is there anything you dont understand or causing problems in tutorial you've found?
unsuccessful
wongjam said:
Actully，I make my BA‘s pagepool be 0M,Its speed is the same as that of 16M pagepool.If you like,you can change pagepool to any number as you wish.Following the list.
addrress:0x2565D3
00 00 00 00 =0M
00 00 80 00 =8M
00 00 C0 00 =12M
00 00 00 01 =16M
00 00 80 01 =24M
00 00 00 02 =32M
00 00 00 03 =48M
Click to expand...
Click to collapse
I am using winhex and realize that it doesn't use hexadecimal but decimal address, so I changed 0x2565D3 into 2450899 but it seemed unable to work although I tried 4 choice of searching (from begin, from back...). I also tried to find the value 00000001 but unsuccessful.
All works were done in nk.nbf
Any ideas?
oradoe said:
I am using winhex and realize that it doesn't use hexadecimal but decimal address, so I changed 0x2565D3 into 2450899 but it seemed unable to work although I tried 4 choice of searching (from begin, from back...). I also tried to find the value 00000001 but unsuccessful.
All works were done in nk.nbf
Any ideas?
Click to expand...
Click to collapse
@oradoe
In order to successfully hex edit a rom, you first need to convert the nk.nbf into NK.nba. Then, you hex edit, and finally reconvert it to nk.nbf.
Since you might ask how to do that, you may want to go to the Blue Angel Upgrading forum and look for the thread called "the Reason for the BA slowdown". If I am not mistaken, you should look within the first 5 to 7 pages and you will see a post from Forza that explains how to do the whole thing. Just remember that the WM5 address for the page pool is different from that of WM6.
Happy Hexing
Did anybody test different pagepool?
i been searching for 8hrs at wiki n forum, downloading more than 50 files (typho5.exe, xda3nbftool.exe etc:..) but still nothing.
Still trying....
And the addresses for Wm6.1? Thanks.
Hi, Weather Database Editor doesnt work with my Girlfriends Touch 3G (german).
Is there any Solution to manually add Cities?
Thanks. =)
Same problem here
Try this one..
http://forum.xda-developers.com/showpost.php?p=2488224&postcount=73
Thanks but it does no show any cities...
yepp, seems that the database has another filename...
i try investigating this...
Ok, found the Database. =)
Its HH_0407_WeatherCities.xml (for German Users i think).
Bad news:
Its hidden/system/in rom
Any ideas how to rename it?
I copied it to the PC and edited the Cities in but i cant copy it back to the phone...
You can easily overwrite the file with resco explorer after disabling touchflo from the today screen but I have yet to find a way to copy the file to the pc. Could you share your xml please?
Ok I am getting nearer.
Disable touchflo
Copy HH_0407_WeatherCities.xml from the /windows folder to your pc.
Edit the xml to include your new city.
Copy it back to the phone into somewhere like "My Documents" then use resco explorer to move it to /windows and overwrite the original file.
Copy manil2d.exe from windows to your pc,
download XVI32 from http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm
download sign code from N2A's site http://weather.not2advanced.com/files/SignCode.zip
Open manila2d.exe in XVI32 and do a search for "weather.manila1.htc.com" ( make sure Unicode check box is checked )
You will see the update URL in unicode , which means that if you want to replace it , there has to be a hex 00 between every letter !
It needs to be changed to something like weather.not2advanced.com/htcweather/forecastdata.php?locCode=%s%s%s
save manila2d.exe and sign it using N2A's batch file
Copy it back to the phone into somewhere like "My Documents" then use resco explorer to move it to /windows and overwrite the original file.
Now I have the new city listed but when I update, all the temperatures = 0
I'm not sure what I have done wrong but I think the URL is wrong.
Any ideas?
Ok, the URL was different for me.
Done that but without the %s%s%s.
Still not working.
I can select the cities but i cant see them in the tab.
Update says that it cannot get updates for the selected city.
Hi Vibez
I reply here instead of the PM , so the others can read it aswell
I don't have a touch 3G so I cannot experiment for you , but 1 thing is sure ,
people had the same issue on the Diamond ( cities not updating after hex-edit ) when the hex-edit was not done 100% correctly ...
So 2 questions :
1) Did any of you try the reigistry hack from the diamond ?
In stock ROM, the URL used to update the weather is a specific Accuweather URL. WDE change it to point to N2A'website ( http://weather.not2advanced.com/ ).
Registry key=HKEY_CURRENT_USER\Software\HTC\Manila
String value Name=Weather.ServerURLOverride
Click to expand...
Click to collapse
2) when u tried patching , did the replacement weather string have EXACTLY the same length as the original ? On the diamond , it was an absolute no-go when the length was different
Open manila exe in XVI32 and do a search for "weather.manila1.htc.com" ( make sure Unicode check box is checked )
You will see the update URL in unicode , which means that if you want to replace it , there has to be a hex 00 between every letter !
I then replaced : http://weather.manila1.htc.com/widget/htc/forecast-data_v3.asp?locCode=%1s&?ac=TR2cra9U
with : http://weather.not2advanced.com/htcweather/forecastdata.php?locCode=%1s&ac=XDADevs1234
Those two lines have exactely the same length upto there ( That's why i added 1234 to the XDAdevs , thankfully that's ok with N2A's site ) so the rest of the URL ( &device=innovation etc.. ) can remain unchanged !
Click to expand...
Click to collapse
If that fails to work , send me a copy of the manila app ( modded and original maybe so I can see what u did ) , I'll look at it , patch it & send it back for you to try ...
I can't promise anything of course , but I'm on holidays this week , so I've got a little time to spare ;-)
cheers,
Claude
Thanks for the info!
Unicode-Strings should be NULL-terminated to, so all i've done was to zero out the remaining chars.
I give it a try and answer here asap.
//edit:
Ok, works but Temps are at 0°C.
Seems that the XML-Format has been changed.
BTW: String used for Patching Mainila2D.exe was:
000D8858 68 00 74 00 74 00 70 00 3A 00 2F 00 2F 00 77 00 65 00 61 00 74 00 68 00 h.t.t.p.:././.w.e.a.t.h.
000D8870 65 00 72 00 2E 00 6E 00 6F 00 74 00 32 00 61 00 64 00 76 00 61 00 6E 00 e.r...n.o.t.2.a.d.v.a.n.
000D8888 63 00 65 00 64 00 2E 00 63 00 6F 00 6D 00 2F 00 68 00 74 00 63 00 77 00 c.e.d...c.o.m./.h.t.c.w.
000D88A0 65 00 61 00 74 00 68 00 65 00 72 00 2F 00 66 00 6F 00 72 00 65 00 63 00 e.a.t.h.e.r./.f.o.r.e.c.
000D88B8 61 00 73 00 74 00 64 00 61 00 74 00 61 00 2E 00 70 00 68 00 70 00 3F 00 a.s.t.d.a.t.a...p.h.p.?.
000D88D0 6C 00 6F 00 63 00 43 00 6F 00 64 00 65 00 3D 00 25 00 31 00 73 00 00 00 l.o.c.C.o.d.e.=.%.1.s...
Ahw F...!
Tested the original URL:
first, city in original database:
http://htc.accuweather.com/widget/htc/forecast-data.asp?ac=TR2cra9U&locCode=EUR|DE|GM011|AACHEN
second, city manually added:
http://htc.accuweather.com/widget/h...ac=TR2cra9U&locCode=EUR|DE|GM017|SCHMALKALDEN
second URL does NOT give any information back in the XML...
Seems that the database is also online and it trys to find the city there...
OK, tried the not2advanced URL, XML Format has changed heavily...
*sniff*
Garfield1970,
Thanks for helping out.
The registry trick did not work.
I did find a patched version of manila2d.exe from another rom that works perfect on our phone, but ideally I would like to see how to patch the original version that our phone ships with. The hex surrounding the URL string in our manilla2d.exe looks a little different. I'm not 100% there is enough room to fit the full N2A url in!
I will post all 3 versions later for you to play with.
Weltherrscher said:
Ahw F...!
Tested the original URL:
first, city in original database:
http://htc.accuweather.com/widget/htc/forecast-data.asp?ac=TR2cra9U&locCode=EUR|DE|GM011|AACHEN
Click to expand...
Click to collapse
Ok
second, city manually added:
http://htc.accuweather.com/widget/h...ac=TR2cra9U&locCode=EUR|DE|GM017|SCHMALKALDEN
second URL does NOT give any information back in the XML...
Seems that the database is also online and it trys to find the city there...
Click to expand...
Click to collapse
That's normal as that city is unknown to the HTC Server
OK, tried the not2advanced URL, XML Format has changed heavily...
*sniff*
Click to expand...
Click to collapse
Indeed , I just compared the XML Outputs for Aachen from HTC & N2A , they changed the format .... But if you ask N2A very very nicely and if he has some time to spare , he might eventually adapt a version of his script to reflect the other XML format
You can clearly see the differences between the following two outputs :
http://weather.not2advanced.com/htc...hp?locCode=EUR|DE|GM011|AACHEN&ac=XDADevs1234
is the Diamond compatible format
http://htc.accuweather.com/widget/htc/forecast-data.asp?ac=TR2cra9U&locCode=EUR|DE|GM011|AACHEN
is the format the touch 3g seems to need ....
I'll crosspost the URL's to N2A's main thread so he can maybe have a look
Claude
Just for info the XML format that ships with our ROM works fine with N2A.
To me it seems N2A provides extra elements which I assume is for compatibility with HTC home.
So no need as far as I can tell to ask him to change anything.
Unless i'm getting confused in what you are saying?
vibez said:
Just for info the XML format that ships with our ROM works fine with N2A.
To me it seems N2A provides extra elements which I assume is for compatibility with HTC home.
So no need as far as I can tell to ask him to change anything.
Unless i'm getting confused in what you are saying?
Click to expand...
Click to collapse
Are you sure that the N2A output works for you ?
Because if you look at the XML's , what your device expects is to see includes blocks titled :
Today
Tonight
Tomorrow
and then the following weekdays
whereas on my Diamond it's just current and the different Weekdays being reported
Claude
I'm 100% sure it works with this version of manila2d.exe that i'm using. Now it may be that this version I have uses the old format.
We don't have
Today
Tonight
Tomorrow
we just have current temp, and hi, lo for each day
You mean using the patched manila from the other rom that you mentionned earlier ?
Might be that the format switch has happened between differen Rom versions ?
Claude
Garfield1970 said:
You mean using the patched manila from the other rom that you mentionned earlier ?
Might be that the format switch has happened between differen Rom versions ?
Claude
Click to expand...
Click to collapse
Yes it could be that. Although the end result is the same. The original version only showed Current and hi/lo temps
Ok i've attached the files
Manila2D_original.exe
This is the original unpatched file
Manila2D_original_patched_not_working.exe
This the original file I tried to patch without success
Manila2D_patched_ok.exe
This is the patched file from another rom that works ok.
Browsing through the kernel source, I got very curious about the flag "qcom,mdss-dsi-panel-inverted" being commented out in this file:
https://github.com/OnePlusOSS/andro...qcom/dsi-panel-samsung_s6e3fa5_1080p_cmd.dtsi
Could an experimented kernel builder create a kernel with this flag enabled, and check if the refresh direction of the panel changes, or the jello effect is diminished ?
I don't want to unlock my bootloader just yet
Hmmm.... Interesting...
maybe we will end up with a 180° inverted display.
Watching the thread
paratox said:
maybe we will end up with a 180° inverted display.
Click to expand...
Click to collapse
That is easy to fix in software though The HW is a *****
This flag is not in the documentation, it is not mentioned anywhere else in the kernel source, only oneplus devices have it in their source. For the prop to actually be readable it needs to be recognized in other parts of the kernel like this.
So, at best, the device will boot with no changes because the flag won't be recognized.
Flar2 mentioned that this change doesn't impact jelly affect...
ram4ufriends said:
Flar2 mentioned that this change doesn't impact jelly affect...
Click to expand...
Click to collapse
nah he just said "It doesn't seem to make any difference"
and the second response is "I'm not sure. I think if it was easily fixed, OnePlus would fix it in an update."
thats all
dukat0s said:
nah he just said "It doesn't seem to make any difference"
and the second response is "I'm not sure. I think if it was easily fixed, OnePlus would fix it in an update."
thats all
Click to expand...
Click to collapse
Which means that flag fix didn't work, isn't it?
ram4ufriends said:
Which means that flag fix didn't work, isn't it?
Click to expand...
Click to collapse
? what " flag fix" u talking about ? : >
ram4ufriends said:
Which means that flag fix didn't work, isn't it?
Click to expand...
Click to collapse
I know what you mean and no, it didn't work.
ZakooZ said:
This flag is not in the documentation, it is not mentioned anywhere else in the kernel source, only oneplus devices have it in their source. For the prop to actually be readable it needs to be recognized in other parts of the kernel like this.
So, at best, the device will boot with no changes because the flag won't be recognized.
Click to expand...
Click to collapse
Fair enough, I didn't check whenever this symbol is further referenced. Moreover, in MIPI DCS language, 'inverted' refers to 'color-inverted' display, not 'orientation-inverted'.
So I got curious, and took the DTSi file for the panel and the patch to enable the closely related S6E3FA0 panel on Exynos (never made it upstream), and decoded the `qcom,mdss-dsi-on-command` sequence, since it seems the best place to insert a command to rotate the display, if it exists; my decoding is below (references https://www.tonylabs.com/wp-content/uploads/MIPI_DCS_specification_v1.02.00.pdf)
Code:
.1 .2 .3 .4 .5 .6 .7 .8 .9 # decode of byte .8
#=============================================
05 01 00 00 14 00 02 11 00 # DCS exit_sleep_mode
15 01 00 00 00 00 02 35 00 # DCS set_tear_on
39 01 00 00 00 00 03 F0 5A 5A # MCS_KEY_LEV1
39 01 00 00 00 00 02 B0 04 # MCS_GLOBAL_PARAMETER
39 01 00 00 00 00 04 B4 06 0C 12 # ?? undocumented
39 01 00 00 00 00 03 F0 A5 A5 # MCS_KEY_LEV1
15 01 00 00 00 00 02 53 20 # ?? undocumented
15 01 00 00 00 00 02 55 00 # ?? DCS_WRITE_CABC
39 01 00 00 00 00 03 F0 5A 5A # MCS_KEY_LEV1
39 01 00 00 00 00 02 C3 01 # ?? undocumented
39 01 00 00 00 00 02 B0 18 # MCS_GLOBAL_PARAMETER
39 01 00 00 00 00 02 C3 00 # ?? undocumented
39 01 00 00 00 00 03 F0 A5 A5 # MCS_KEY_LEV1
05 01 00 00 00 00 02 29 00 # DCS set_display_on
In the MIPI DCS specification, one can control the Device Line Refresh Order:
1155 Bit B4 – Display Device Line Refresh Order
1156 This bit controls the display device’s horizontal line refresh order. The image shown on the display device
1157 is unaffected, regardless of the bit setting.
1158 ‘0’ = Display device is refreshed from the top line to the bottom line
1159 ‘1’ = Display device is refreshed from the bottom line to the top line
Click to expand...
Click to collapse
Things I would try:
Find Samsung references for the display controller so we can find the undocumented commands below
Use command DCS set_address_mode 36h to flip the display: insert before the last line:
Code:
15 01 00 00 00 00 02 36 10
or
Code:
15 01 00 00 00 00 02 36 00
and see what we get on display and if we can change the refresh direction. In worst case, we need to try all values from 00 for FF for the last byte in the command.
Anybody with a unlocked bootloader and time to recompile the kernel to test this ?
ddalex said:
Fair enough, I didn't check whenever this symbol is further referenced. Moreover, in MIPI DCS language, 'inverted' refers to 'color-inverted' display, not 'orientation-inverted'.
So I got curious, and took the DTSi file for the panel and the patch to enable the closely related S6E3FA0 panel on Exynos (never made it upstream), and decoded the `qcom,mdss-dsi-on-command` sequence, since it seems the best place to insert a command to rotate the display, if it exists; my decoding is below (references https://www.tonylabs.com/wp-content/uploads/MIPI_DCS_specification_v1.02.00.pdf)
In the MIPI DCS specification, one can control the Device Line Refresh Order:
1155 Bit B4 – Display Device Line Refresh Order
1156 This bit controls the display device’s horizontal line refresh order. The image shown on the display device
1157 is unaffected, regardless of the bit setting.
1158 ‘0’ = Display device is refreshed from the top line to the bottom line
1159 ‘1’ = Display device is refreshed from the bottom line to the top line
Things I would try:
Find Samsung references for the display controller so we can find the undocumented commands below
Use command DCS set_address_mode 36h to flip the display: insert before the last line:
Things I would try:
Find Samsung references for the display controller so we can find the undocumented commands below
Use command DCS set_address_mode 36h to flip the display: insert before the last line:
15 01 00 00 00 00 02 36 10 or
and see what we get on display and if we can change the refresh direction. In worst case, we need to try all values from 00 for FF for the last byte in the command.
Anybody with a unlocked bootloader and time to recompile the kernel to test this ?
Click to expand...
Click to collapse
Interesting. I could only recommend you to try to get in touch with @flar2 - Dev of the EX kernel. He might be eventually able to do some experiments (as he already did with "inverted" command).
ddalex said:
Fair enough, I didn't check whenever this symbol is further referenced. Moreover, in MIPI DCS language, 'inverted' refers to 'color-inverted' display, not 'orientation-inverted'.
So I got curious, and took the DTSi file for the panel and the patch to enable the closely related S6E3FA0 panel on Exynos (never made it upstream), and decoded the `qcom,mdss-dsi-on-command` sequence, since it seems the best place to insert a command to rotate the display, if it exists; my decoding is below (references https://www.tonylabs.com/wp-content/uploads/MIPI_DCS_specification_v1.02.00.pdf)
Code:
.1 .2 .3 .4 .5 .6 .7 .8 .9 # decode of byte .8
#=============================================
05 01 00 00 14 00 02 11 00 # DCS exit_sleep_mode
15 01 00 00 00 00 02 35 00 # DCS set_tear_on
39 01 00 00 00 00 03 F0 5A 5A # MCS_KEY_LEV1
39 01 00 00 00 00 02 B0 04 # MCS_GLOBAL_PARAMETER
39 01 00 00 00 00 04 B4 06 0C 12 # ?? undocumented
39 01 00 00 00 00 03 F0 A5 A5 # MCS_KEY_LEV1
15 01 00 00 00 00 02 53 20 # ?? undocumented
15 01 00 00 00 00 02 55 00 # ?? DCS_WRITE_CABC
39 01 00 00 00 00 03 F0 5A 5A # MCS_KEY_LEV1
39 01 00 00 00 00 02 C3 01 # ?? undocumented
39 01 00 00 00 00 02 B0 18 # MCS_GLOBAL_PARAMETER
39 01 00 00 00 00 02 C3 00 # ?? undocumented
39 01 00 00 00 00 03 F0 A5 A5 # MCS_KEY_LEV1
05 01 00 00 00 00 02 29 00 # DCS set_display_on
In the MIPI DCS specification, one can control the Device Line Refresh Order:
Things I would try:
Find Samsung references for the display controller so we can find the undocumented commands below
Use command DCS set_address_mode 36h to flip the display: insert before the last line:
Code:
15 01 00 00 00 00 02 36 10
or
Code:
15 01 00 00 00 00 02 36 00
and see what we get on display and if we can change the refresh direction. In worst case, we need to try all values from 00 for FF for the last byte in the command.
Anybody with a unlocked bootloader and time to recompile the kernel to test this ?
Click to expand...
Click to collapse
This looks correct. I wondered about this but couldn't find a DCS spec sheet.
Could you specify what 15 01 does? Put the device into command mode or something?
Looking at the command documentation these bytes '#9' could be useful:
0x10 - scan from bottom to top (top to bottom in reality)
0x04 - latch from right to left (left to right in reality) (reverses tilt of the active scan line)
0x14 - combine previous 2
There are 2 problems that can come out of this:
1. The panel itself just doesn't support setting these bits and will just ignore them
2. "qcom,mdss-dsi-panel-orientation" might actually call that same command after qcom,mdss-dsi-on-command and override the settings we added in. This would show the same symptoms as problem 1), nothing would change in the display. I've been looking at the dsi panel init source code but it's a bit of a rabbit hole so I don't know if this is the case. Luckily the code is full of debug prints, so it is relatively easy to enable them and see what is actually happening in the dmesg.
who's gonna try this then ?
ZakooZ said:
This looks correct. I wondered about this but couldn't find a DCS spec sheet.
Could you specify what 15 01 does? Put the device into command mode or something?
Click to expand...
Click to collapse
Each line in there is a MIPI DCS packet - first byte is the packet type, with the defines below
Code:
/* dcs read/write */
#define DTYPE_DCS_WRITE 0x05 /* short write, 0 parameter */
#define DTYPE_DCS_WRITE1 0x15 /* short write, 1 parameter */
#define DTYPE_DCS_READ 0x06 /* read */
#define DTYPE_DCS_LWRITE 0x39 /* long write */
The complete header definition is:
Code:
struct dsi_ctrl_hdr {
char dtype; /* data type */
char last; /* last in chain */
char vc; /* virtual chan */
char ack; /* ask ACK from peripheral */
char wait; /* ms */
short dlen; /* 16 bits */
} __packed;
After the header, the payload follows directly.
ZakooZ said:
Looking at the command documentation these bytes '#9' could be useful:
0x10 - scan from bottom to top (top to bottom in reality)
0x04 - latch from right to left (left to right in reality) (reverses tilt of the active scan line)
0x14 - combine previous 2
Click to expand...
Click to collapse
Yep, we need to test these - the problem is that we don;t know if there is another piece of code that resets this flag after the initial init, you correctly touch on this below.
ZakooZ said:
There are 2 problems that can come out of this:
1. The panel itself just doesn't support setting these bits and will just ignore them
2. "qcom,mdss-dsi-panel-orientation" might actually call that same command after qcom,mdss-dsi-on-command and override the settings we added in. This would show the same symptoms as problem 1), nothing would change in the display. I've been looking at the dsi panel init source code but it's a bit of a rabbit hole so I don't know if this is the case. Luckily the code is full of debug prints, so it is relatively easy to enable them and see what is actually happening in the dmesg.
Click to expand...
Click to collapse
Or, possible but not probable outcome no. 3: the HUT (Hardware Under Test) is damaged by this testing
:victory:
That flag is shipped in this commit: https://github.com/MoKee/android_ke...mmit/7ca61f58d8b59a4ae716e08405df8368a45407fb
As I am a Chinese, this commit message indicates the screen is upside-down. This flag is not as others say, only see in Oneplus devices. It is a flag introduced by CAF, to support
upside-down screens: https://github.com/MoKee/android_ke...mmit/63203b502ef862f756535e080c4261031eb4110f. Further research shows that it actually does is to make the display oriented: https://github.com/MoKee/android_ke...f9e1a022ef5/include/uapi/linux/msm_mdp.h#L254.
Oneplus seems to take entire CAF solution in kernel. But actually it is something besides than kernel. But I doubt there is something in closed-source vendors as well (third-party roms still have this effect).
aviraxp said:
That flag is shipped in this commit: https://github.com/MoKee/android_ke...mmit/7ca61f58d8b59a4ae716e08405df8368a45407fb
As I am a Chinese, this commit message indicates the screen is upside-down. This flag is not as others say, only see in Oneplus devices. It is a flag introduced by CAF, to support
upside-down screens: https://github.com/MoKee/android_ke...mmit/63203b502ef862f756535e080c4261031eb4110f. Further research shows that it actually does is to make the display oriented: https://github.com/MoKee/android_ke...f9e1a022ef5/include/uapi/linux/msm_mdp.h#L254.
Oneplus seems to take entire CAF solution in kernel. But actually it is something besides than kernel. But I doubt there is something in closed-source vendors as well (third-party roms still have this effect).
Click to expand...
Click to collapse
Yes, but we don't need to reverse the screen, we need to set the inverse refresh.
Inviato dal mio ONEPLUS A5000 utilizzando Tapatalk
robertogl said:
Yes, but we don't need to reverse the screen, we need to set the inverse refresh.
Click to expand...
Click to collapse
I referenced above the Display Line Refresh Order option on the MIPI DCS standard set_address_mode option, that maybe could inverse the refresh. We need somebody to build the kernel with the command added in the DTSi file, and test it. Maybe @Sultanxda ?
Someone really should try this :0
Sent from my SM-A510M using Tapatalk