Undocumented features of phones - Windows Mobile Development and Hacking General

I've been working on an application for my HTC Nikki (a.k.a Dual Touch) that reacts to the phone being slid open and closed. To make it work I had to deduce (using RegLogger) a registry notification key regarding it.
Having found it I'm wondering if there's any place such otherwise undocumented information about phones is being gathered. If not, I'd like to suggest we start posting these things in, say, this thread. Eventually if it looksl ike enough interesting info is being gathered it might become a more formalised effort.
This is what I learned (and it'd be nice if people with other sliding phones, even non-HTC ones, checked if this holds true for theirs. Does it hold true for the more flip like ones? I'd like to know so I can improve my app, I'm sure others would benefit as well):
The HTC Dual Touch (a.k.a Nikki) records changes to it's slide positon in:
HKEY_LOCAL_MACHINE\Software\OEM\Keyboard DWORD:SlidingOut
0 = Closed
1 = Open

Related

Help on other phones Slide notifications

I've written an application to extend phones behaviour when moving their slides (hanging up, locking, etc). I wrote it to work on my HTC Dual Touch a.k.a Nikki. Here's it's thread and homepage.
This application may very well work with any HTC Slider (running WM6 and/or .NET CF 2) but I don't know. I haven't any to test.
If any volunteers would like to do me and my application a favour, and possibly get to use this application themself, could they please give it a go on and let me know if it works on their non-Niki phone.
If someone was generous and has a phone it doesn't work on, possibly even a non-HTC phone, it'd be nice if they could use RegLogger or the like to try and find a different notificastion key that records the phones slider state.
The Niki (and maybe others) stores it in "HKEY_LOCAL_MACHINE\Software\OEM\Keyboard DWORD:SlidingOut".
I'm trying find out how wide spread that is, or other options for other phones.

Finger-friendly Homepage!

I'm working on a new concept for a homepage for all touch devices.
I know it's not the greatest idea of all, but I really think it's good enough to have some value.
I wont release all details as I have a decent amount planned, but here goes...
http://neotelos.com/mobile/
Works great in opera beta and firefox, PIE is very underdeveloped and I've had issues...so no support at the moment, but may come in the future.
So far it's only a preview of what is to come, I'd like to know what you guys think so far.
I've even seen alot of touch PCs and Tablets emerging, and hope to aim towards that audience too!
Got it working with keys now
I can't wait to get this done...I'm also making this so I have something nice for even my own homepage.
nice idea...
what do you intend to put in there ?
I confess - I don't see the point in this, you're using an onhover effect wich won't be activated in a mobile - because theres no such thing as on hover on a touchscreen.
Sorry, I may be being ignorant.
interesting, the page is working on opera. in qvga mode, the font is oversize.
Napbree said:
I confess - I don't see the point in this, you're using an onhover effect wich won't be activated in a mobile - because theres no such thing as on hover on a touchscreen.
Sorry, I may be being ignorant.
Click to expand...
Click to collapse
im no mobile web developer (although I've done my fair share of sites), but isn't the onhover property applied when the user taps the link? at least I think that's what is does in the iphone
Yes, is true.
The only issues that I haven't found a way to overcome:
1) Override context menu
2) Capture drag action
I plan on making a user-customizable CMS (Content Management System) and hope to just keep adding features over time.
My first goal is to allow users to setup accounts which they can customize links and content to their liking.
Like I said, it's nothing major, just something that might come in handy as there aren't many good web portals designed for mobile.
Edit:
Oh, yeah, it doesn't use hover, it actually grabs when the mouse moves and calculates actions...for a number of reasons I chose this method, may not be the most oiptimal but I find it to be more compatable.
When a user taps the screen, or even ends a drag, when the pressure is lifted mouse movement is activated. Not to mention it works with arrow keys and overrides the scrolling, so it can be used with devices w/o touchscreens.
Neotelos_com said:
Yes, is true.
The only issues that I haven't found a way to overcome:
1) Override context menu
2) Capture drag action
I plan on making a user-customizable CMS (Content Management System) and hope to just keep adding features over time.
My first goal is to allow users to setup accounts which they can customize links and content to their liking.
Like I said, it's nothing major, just something that might come in handy as there aren't many good web portals designed for mobile.
Click to expand...
Click to collapse
I think having the whole login account would be overkill, unless the user does not delete his or her cookies after each session
Neotelos, this is a very cool idea, but why don't you team up with whoever made Touch-innovation.com and develope it with him? he created it not a long while ago and it would be much more productive if you guys did that together instead of creating a whole new one (just a thought )
nir36: Not too bad of an idea, I've his site before and it's a nice start. Just that this is a web design geared for mobile devices, not resources for them. Maybe I'll shoot him a message and see if he wants to form an affiliation, who knows.
mbarvian: There's a few ideas I have, one would be just to use a simple URL for a basic start page, with configuration password protected. ex: somewebsite.com/somehomepage.php?user=myusername
nir36 said:
Neotelos, this is a very cool idea, but why don't you team up with whoever made Touch-innovation.com and develope it with him? he created it not a long while ago and it would be much more productive if you guys did that together instead of creating a whole new one (just a thought )
Click to expand...
Click to collapse
I tried contacting Nathan over there, but even though he remains active, I have yet to receive a response.
I don't see that his site is the busiest and if he can't even respond to messages as a courtesey, i don't think i'll be working with him. thanks for the advice though.

Thinking of Getting HTC Snap

Hi All,
Sorry for opening a thread.
I wish to find out more from the users over here what do they think of this phone.
Is it recommended for user like me who needs a phone to do lots of emailing.
My previous WM phones are Touch aka Elf and TyTN II aka Kaiser. My current phone is iPhone.
Do i need to flash the ROM to make it faster and lighter??
Thanks in advance...
Unfortunately I do not recommend the Snap anymore. It is just my personal opinion, and I am sure there are many happy users out there.
But I went trough two sets with the same keyboard problem (see my other thread about sticky keys) and many users are reporting the same issue.
I think the screen is too small, and the trackball implementation leaves a lot to be desired. (No proper acceleration, e.g. like on blackberry)
The way Windows leaves the top title bar and bottom menu bar always on the screen further reduces the available real estate for applications.
Yes, Exchange support is great, like any other Windows phone. But if you got used to the huge screen of the iphone you will find the Snap disappointing.
I also have a Blackberry curve, and it's unbeatable for plain messaging.
I cannot not notice the huge Android wave that is about to hit the world, for example the Moto Cliq is going to be a great device (and the inexpensive HTC Tattoo) so my advice is to stay tuned and hold off buying for a couple months.
just my 2c

LiveView reverse-engineering effort

Hi all,
A few weeks ago I started taking apart the LiveView software and manager. I'm really unhappy with the current plugin system, the menu structure and more. So, I started to reverse-engineer the Bluetooth protocol. I'm at the very beginning but it's looking promising.
Here's the repo: https://github.com/BurntBrunch/LivelierView
The protocol is not very difficult - just request-acknowledge-response serial communication over RFCOMM. Also, the kind people from SE didn't run the manager through Proguard (wink, wink, nudge, nudge ).
I also have what I *think* is a dump of the firmware but it seems either compressed or encrypted. Binwalk didn't find anything in it. If someone would be kind enough to take apart the software updater, we might figure out what's running on the actual device as well.
Overall, I'm just starting but so far it's looking good (got time syncing working! it's at least a watch, if nothing else! ).
Any help would be greatly appreciated (pull requests are more than welcome! )
thinking of doing something similar with one of my gadgets.
What did you use to reverse-engineer the Bluetooth protocol, just wireshark and a bluetooth dongle
Neither Did it from disassembly of the manager - much easier than sniffing and guessing.
If you don't have that option and said gadget connects to an Android phone, put on a decent ROM with the full BlueZ stack (e.g., Cyanogen) and use hcidump. It's really, really useful!
Come to think of it, Wireshark might be good enough - the only thing I found useful about hcidump was the SCO audio dump.
Nice effort. I've already forked your work on github, might have a look at it soon, I got some geeky ideas for myself as well, and I think integrating this functionality natively on CyanogenMod or even a custom app to replace the SE's one would be great to have as well.
Nice,
i'm was disapointed by the liveview manager myself, i hope something good emerges from your work
I've also decompiled the APK, and it seems that everything that displays on screen comes from the application, which means everything could be costumized. Seems like SE is using a PNG lib LodePNG to convert images and pushing them to the phone. Also, when it comes to strings, I've found some useful references in JerryProtocol that might indicate how the correct text encoding (not that we can push it right now, but just for the record):
Code:
private static final String mEncoding = "iso-8859-1";
private static final char cCarriageReturn = '\r';
private static final char cLineFeed = '\n';
Controlling the led seems quite simple to, it seems message's data is divided in 3 parts:
[RGB] [DELAY = Integer Number] [ON STATE = 0|1]
[old]although I've not figured out the ID of the LED control yet[/old].
LED request ID is 40 and LED response ID is 41. Hope this is enough for you to get started on that one too
I've not yet tested the app, but I've read your code and gave a shot at decompiling trying to see what I could dig up, will try it later (not very used to running python scripts though, will have to see how to install pyserial first and all that)
pedrodh said:
it seems that everything that displays on screen comes from the application
Click to expand...
Click to collapse
Yup, the main stuff is on the phone - the state machine is clearly isolated (on a side note, the manager is rather well-written, thankfully). On the other hand, I'm somewhat confused by all the constants - it almost feels as if the device has native navigation or icon cache or something.
pedrodh said:
Controlling the led seems quite simple to, it seems message's data is divided in 3 parts:
[RGB] [DELAY = Integer Number] [ON STATE = 0|1]
LED request ID is 40 and LED response ID is 41. Hope this is enough for you to get started on that one too
Click to expand...
Click to collapse
Thanks for the interest and the tip, I'll look into it soon - I need to figure out a good way to send commands from stdin. It seems that I'll need to figure out non-blocking reading in Python anyway (good news for you - I might drop pyserial! )
In any case, I'll add it to protocol.txt, unless you beat me to it!
Lastly, the only reason it's in Python is 'cause I'm productive in it *and* it has good, fast bindings (I try to stay away from gobject in C!). Whatever comes out of this effort would be running on the phone, surely
Edit: You *did* beat me to it!
Edit: Implemented LED, vibration, and a pretty good scheme for sending commands from the CLI
Nice work, saw quite a few commits in a small amount of time.
I've not yet been able to run it sucefully, I (think) have installed pyserial correctly, but maybe the problem is that the bluez that comes with my ubuntu is somewhat newer than the one you used, anyway here's as far as I got http://pastebin.com/uVRdr5T3 if you by chance know just by looking at it what it is would be great .
I've started an Android applicatoin Project in hopes of porting this to an Android application as well, but I'm somewhat new to Bluetooth handling on Android, still working it out. I'm already able to connect and pair with device (noob stuff), but it fails to READ from it. I've used java's DataOutputStream and DataInputStream since they deal with data in a big-endian notation, but I haven't understood yet how the initialization process goes. I've looked to your code, I get some parts but not the whole thing yet. Do you have to wait for the LiveView to tell something back, or you can just start to send commands at random? Also, does the script act as a bluetooth server or client (it seems that they are distinct when coding in Android, I've choosen to Connect as a Client, and yes I used the same UUID that you got from decompiling so at least that part I guess to be correct) ?
Anyway is just a bunch of very ugly code at the moment, after I get it to do something usefull I'll clean up the project and host it on github as well.
Hmm, that error is rather suspicious. Looking at the docs, Connect() is not even supposed to throw org.bluez.Failed, let alone with that message. And service discovery supposedly finished successfully..
Was the device in pairing mode (with the arrows/circle turning)? Was the computer the last thing it paired with (once you pair with the computer, the phone shouldn't be able to connect to it, since the device only remembers the last authorization)?
Install d-feet, the DBus browser, go under System bus, org.bluez, find the device, verify that it has the org.bluez.Serial interface and try calling Connect() with the proper UUID from there. Other than that, I've really no idea what it's on about.. Do you have more than one LiveView device by any chance (weird things might happen then)?
I don't actually think it's the difference in bluez versions (the Serial interface hasn't changed in the past 2 and something years) but it might be a (driver) bug you're hitting. I *think* I'm doing everything right as far as communication with BlueZ is concerned. Try running `hciconfig hci0 reset`.
Sorry I couldn't be more helpful..
Regarding your Java effort, if I recall my Bluetooth terminology correctly, you are a client, since the server is the thing advertising the service. You should *not* be reading immediately from the device. The phone/computer sends the first message - in my case, my first message is always STANDBY. Then and only then can you start reading back.
Lastly, I hope Android abstracts the whole RFCOMM pipe thing, 'cause it's a pain to use (and the reason I still need pyserial) - select() would sporadically tell me it has data to read and when I try to read it, I get ERRIO :/ I suspect RTS triggers select()..
Make sure you're only reading as many bytes as you know are in the next packet (take a look at consume() - it returns the number of bytes it expects next) and not more than that - it would either block or throw an exception. I've not done any Bluetooth work on Android, so that's as much as I can help, I'm afraid.
Lastly, as big as the temptation is, do not under any circumstances reuse code from the official manager. "Sony" is in the name of the company after all. I'm half-expecting a Cease & Desist any moment now
Edit: Implemented Display Properties Request and Clear Display Request (doesn't do anything). I think I'm out of low-hanging fruit
Really interesting work, guys. The Liveview is a fantastic idea and is almost brilliant - if only it worked properly! If you could get the basics working properly so we don't have to use the Sony software that would be fantastic, it's got so much potential.
Cheers,
Tim
So, I had a brilliant idea today. You know how the LiveView Manager app is full of debug messages. Turns out, they are disabled by means of a constant in ElaineUtils. My idea was to change that constant, put the apk back on my phone and rejoice from all the extra info I'd have.
Turns out, that's not how it works. I changed the constant (bumped it to 0x100 - literally a single bit change) and re-signed the apk. I got some output out of it but not all, and none of the useful ELEMENT_ID_* messages
Any help on that front would massively speed up the reverse-engineering effort.
EDIT: Scratch that, I'm stupid. I forgot that the .field annotations are not executable code - I was changing the wrong bit so to speak. Changed the value in <cinit> and voila, proper logcat!
EDIT: Here's some food for thought - http://pastebin.ca/2099804 - it's the log from startup + a bit of moving around and opening/closing the mediaplayer control.
Very cool project.
I believe, for the damn thing to be usable, focusing on improving Bluetooth performance would be quite good. By "performance" I mean "power consumption." Having to give up on the watch after two hours of light use is really unacceptable.
I would love it if you got this thing working efficiently like SmartWatchm/OpenWatch did for my MBW-150. I ordered my LiveView from the UK when it first released there instead of waiting for the US release. The darn thing disappointed the hell out of me and has been sitting in my garage for almost a year now.
Hopefully you get something going on with this.
archivator said:
So, I had a brilliant idea today. You know how the LiveView Manager app is full of debug messages. Turns out, they are disabled by means of a constant in ElaineUtils. My idea was to change that constant, put the apk back on my phone and rejoice from all the extra info I'd have.
Turns out, that's not how it works. I changed the constant (bumped it to 0x100 - literally a single bit change) and re-signed the apk. I got some output out of it but not all, and none of the useful ELEMENT_ID_* messages
Any help on that front would massively speed up the reverse-engineering effort.
EDIT: Scratch that, I'm stupid. I forgot that the .field annotations are not executable code - I was changing the wrong bit so to speak. Changed the value in <cinit> and voila, proper logcat!
EDIT: Here's some food for thought - http://pastebin.ca/2099804 - it's the log from startup + a bit of moving around and opening/closing the mediaplayer control.
Click to expand...
Click to collapse
Wow, that's very useful thank you. I've been very occupied and did not work more with the Android Side application since my last post, I intend to return to it soon enough though, that output is very welcome when it comes to understanding then the icons are sent and the whole mechanism itself.
I've been doing a bit of reverse engineering work on the liveview as well, and I think I have a complete (although i fear possibly slightly corrupt) firmware dump!
I have been able to extract was some PNG images from the firmware (Thanks to their rather distinctive %PNG Header and ending with IEND).
It would appear that the menus and stuff are in fact definitively transferred over bluetooth!
I've attached the images I've extracted if anyone's interested in seeing them!
I'm currently trying to work through it in IDA to disassemble it, which is a pain in the arse!
Is anyone else also interested in completely rewriting the firmware?
@aj256, nice work! I thought I had a dump as well but mine looked compressed :\ Mind uploading yours somewhere for all to see? (edit: sorry, saw it in the archive)
aj256 said:
It would appear that the menus and stuff are in fact definitively transferred over bluetooth!
Click to expand...
Click to collapse
That's correct - I almost have that part of the protocol figured out but I'm low on spare time.
aj256 said:
Is anyone else also interested in completely rewriting the firmware?
Click to expand...
Click to collapse
Well.. I'd be interested in modifying it and isolating the Bluetooth stack but don't really have the time OR the chops to write the whole firmware from datasheets and disassembly.
As for where I'm standing, I know what I need to decompile next (renderShowUi) but it's a couple of thousand lines of smali. There are so many branches, it's easy to get lost. I need to write better tools for decompiling smali first
Just bought a Live View! I know it may not be the best but I got it cheap and mainly want the Caller ID portion of it. I hope this reverse engineering pays off. Once I get mine I may start poking around and see if I can help out! Thanks for the post OP!
Hi,
do you guys have some irc channel or anything else? Just got my LiveView and want to help you with this...
I've quickly put together a project website at openliveview (dot) com (apparently I don't have enough posts for an external link!) with some forums as well to help to document peoples progress!
I've done a quick writeup on my progress so far (which isn't very much!)
@archivator, glad you found the firmware in the zip, I was just about to reply that it was there!
aj256 said:
I've quickly put together a project website at openliveview (dot) com (apparently I don't have enough posts for an external link!) with some forums as well to help to document peoples progress!
I've done a quick writeup on my progress so far (which isn't very much!)
@archivator, glad you found the firmware in the zip, I was just about to reply that it was there!
Click to expand...
Click to collapse
Nice. I've been on your website and the documentation is getting in good shape. When I got some free time I'll try and read it more carefully and complement the Android project.
Talking about that, I've uploaded my progress so far to github: https://github.com/pedronveloso/OpenLiveView
bare in mind that apart from pairing with the Device not much is actually working by now, contributions are welcome of course

Rasp pi + HTC desire 500 screen

Hello,
what i'm trying to do has been discussed quite a few times before in many forums but i never found a concrete answer. also most threads i found on the topic are old, so here i start a new one with the hope i will find what i need.
i have a HTC desire 500 phone which is not used anymore. it only has minor touch problem. i want to take the screen out of the phone and put it together with a raspberry pi 1 B. getting the touch option is not needed, mainly want to use it as a non-touch display.
help needed list:
1. (little bit off topic/forum) where can i find what specific model of screen was used in htc desire 500(or any smartphone), who made it and spec-sheet/details about it?
2. it will be great if i can use the gpio pins for the screen, or else hdmi. what are the steps to make it happen?
3. list of hardware i will be needing, i want to make it handheld, it would be nice if i can connect the screen directly to pi.
note: please don't suggest setting up VNC in phone, or to buy a screen that made for/work with pi. that is not the point.
here are some links i found:
*what i finally want to make - https://www.raspberrypi.org/forums/viewtopic.php?f=40&t=169419
*something that works but its not connected to pi directly, also couldn't find my screen in their supported list - http://hackaday.com/2014/11/02/using-cell-phone-screens-with-any-hdmi-interface/
*an unfinished thread -https://www.reddit.com/r/raspberry_pi/comments/42ttf0/hooking_up_the_raspberry_pi_with_a_mobile_phone/
*says its possible but didnt go any further - https://raspberrypi.stackexchange.com/questions/8861/use-cellphone-screen-as-monitor
*rasp pi official forum - https://www.raspberrypi.org/forums/viewtopic.php?f=44&t=59834
*from this forum - https://forum.xda-developers.com/showthread.php?t=2233796
thank you for taking time to read this post.

Categories

Resources