Related
Can anyone help me remap the home key so it opens VC 1.6. Right now when I press it it opens voice speed dial not VC 1.6.
ch8 said:
Can anyone help me remap the home key so it opens VC 1.6. Right now when I press it it opens voice speed dial not VC 1.6.
Click to expand...
Click to collapse
Which ROM are you running on your device.....?
I am running the rogers WM6 rom
Remap
ch8 said:
I am running the rogers WM6 rom
Click to expand...
Click to collapse
Try to find this download {eT9 Excalibur.0409.Kmap}, I believe this is what you need! Just copy to the Windows folder..................!
Thanks I did d/l the file but I have no idea how to make voice command launch since they are using program codes here.
//
// N O T E: This file must be saved as Unicode
//
// This file contains the virtual keys mapping table for the
// Excalibur device. The mapping table is define as follow
//
// VK_TPOUND = 0x78
// VK_TSTAR = 0x77
// VK_TAB = 0x09
//
// We do not support escape value yet. So the key/char values should be
// entered explicitly or by encoding start with 0x
//
// Format:
// {VK VK' CH1 CH2}
// VK -> value from keyboard driver
// VK' -> printed on keys
// CH1 -> symbols produced by Fn + key
// CH2 -> symbols in 123 mode
// KeyIndex -> matched the kdb key index, 0xff -> no key index
{Q Q % % 0x00}
{1 W 1 1 0x01}
{2 E 2 2 0x02}
{3 R 3 3 0x03}
{T T + + 0x04}
{Y Y ( ( 0x05}
{U U ) ) 0x06}
{I I - - 0x07}
{O O _ _ 0x08}
{P P " " 0x09}
{0x78 A # # 0x0a} // VK_TPOUND maps to Device Button A
{4 S 4 4 0x0b}
{5 D 5 5 0x0c}
{6 F 6 6 0x0d}
{G G / / 0x0e}
{H H ? ? 0x0f}
{J J @ @ 0x10}
{K K $ $ 0x11}
{L L = = 0x12}
{0x77 Z * * 0x13} // VK_TSTAR maps to Z
{7 X 7 7 0x14}
{8 C 8 8 0x15}
{9 V 9 9 0x16}
{B B ' ' 0x17}
{N N & & 0x18}
{M M ! ! 0x19}
{0xBC , ; ; 0xff} // 0xBC = VK_COMMA
{0xBE . : : 0xff} // 0xBE = VK_PERIOD
{0 0x09 0 0 0xff} // 0x30 = VK_TAB
{0xE9 0xE9 0xC1 0xC1 0xff} // Launch Camera with Fn
Copy To The Windows Folder
Copy the download to the Windows folder,don't take the download out of the package leave the download in the package, just copy it to the Windows folder, soft reset the device.
Actually, this is an interesting topic in itself, i.e. remapping the long-press (aka. press-and-hold) functionality of the HOME key. For example, I'd like to change it to be something completely different (perhaps the VITO AudioNotes recorder, for example), and it doesn't look like this can be achieved from fiddling with the keymap (kmap) file.
On the some smartphones, the long press of the HOME key can be tweaked by simply replacing the default application that gets loaded by tweaking the appropriate registry key. For example, on the Motorola Q, the long-press of the HOME key brings up the quickapp.exe (i.e. the "quick list" that seems to come up on my T-Mobile Dash w/WM6 when I quickly press the Power button). So, if I had a Motorola Q, all I'd need to do was go to:
HKEY_LOCAL_MACHINE\Software\Microsoft\Shell\Rai\:MSQuickApp\1
and replace quickapp.exe with something else.
I just can't figure out the right place to tweak things for my Dash. All I know is that now when I press-and-hold the HOME key it brings up the Voice Recorder. I can't even find where the Voice Recorder program is stored... it's link file (.lnk) in the Start Menu contains:
22#:MSTNOTES?:notesapp
And I can't seem to find any reference to notesapp (either in the \Windows directory -- e.g. no notesapp.exe or notesapp.lnk, nor in the registry).
My only hint was to look under HKLM\Software\Microsoft\Shell\Rai\:MSTNOTES
but there I found that it was referencing ":MSPOUTLOOK notes"... Another mystery to me. It feels like I'm going through magic rabbit holes like Alice in Wonderland, that lead to nowhere...
Anyone with some further insights on this?
Remap Home key for Voice Command
Will the above keymap change the rest of my keys? I don't know how to read those things, so I can't just create my own keymap by changing that one line.
For me holding the Home key launches Voice Command. Do you have App3 selected as the voice Button? Do you have voice command enabled. I am using an s621 with the Rogers WM6 ROM.
Hello everybody,
I tried to get the GPS postion data o from the integrated GPS-Device of a HTC Artemis.
For this purpose, i used the Microsoft GPS intermediate Drivers
But now, i've got a problem. If i tried to get the Data with the following code
Code:
DegreesMinutesSeconds location;
location = GPSGeraet.GetPosition().LatitudeInDegreesMinutesSeconds;
int x = location.Degrees;
int y = location.Minutes;
double z = location.Seconds;
I get a zero in the Degree-variable, in the minutes-variable i get the degree-Value, in the seconds-variable the minutes-value, i can't find the second-Value
However, if i use:
Code:
GpsPosition GPSLoc = new GpsPosition();
GPSLoc = GPSGeraet.GetPosition();
double a = GPSLoc.dblLatitude;
the variable has the correct value. Instead of converting this value, i would like to use the original degree, minutes, seconds-variables.
Does anyone have an idea what is wrong?
Hi !
I'm trying to create an application based on location aware concept.
And I'm trying to do a simple query to update some records in my database but it isn't working..
I'm trying to do a simple query like "UPDATE markers set status = 0 WHERE id = 10"
This is giving me an error like this "[1,8,markers]". BUT WHAT THE HELL DOES THIS MEAN ?
If I try to run que query manually it does work ! So what i'm I doing wrong ? How can I activate a (MUCH) more verbose error information ?
This is my function :
Code:
Public Sub turnMarker(ByVal id As String, ByVal status As String)
cOpen()
Dim query As SqlCeCommand = myCon.CreateCommand
query.CommandText = "UPTADE markers set status = " + status + " WHERE id = " + id + ""
Try
'MsgBox(query.CommandText)
query.ExecuteNonQuery()
Catch ex As Exception
MsgBox("Error updating markers !" + query.CommandText + ex.Message)
End Try
cClose()
End Sub
thanks !
EDIT: Nevermind ... found out the problem.
Nevertheless, does anyone know how to make errors more verbose ?
Use SqlCeException as opposed to Exception, and then run through the errors collection....
strX = strX & ex.NativeError
For I = 0 To ex.Errors.Count - 1
strX = strX & "Index #" & I & vbCrLf & "Error:" & ex.Errors(I).ToString() & vbCrLf
Next
do a search for sr.dll. you need to deploy this as part of your app to be able to see exception data when debugging .net ce apps.
or go here -> http://forum.xda-developers.com/showpost.php?p=4862355&postcount=87 .That sample project has got a copy. you'll need to add it as part of whatever project you're making.
Us T-Mobile users cannot flash Roms at the minute because the download mode button combo has been disabled.
Maybe there is a way to do this programatically or use a resistor accross certain USB pins like the Galaxy S method.
What's your opinion on this?
Sent from my OMNIA7 using Board Express
Yesterday I wasted some time playing around with the USB diagnostic port (enable in the Diagnosis app, it's the third USB mode option). Both PSAS and QPST can connect to and mess with the phone, so I think if someone knows his way around, the phone can be kicked into Download Mode.
(I only managed to crash the phone in many different ways, but I was really just monkeying around.)
If this can be done it would be great as this is the first phone I have owned where I cannot flash firmware myself.
Might be worth while seeing if everyone with a tmobile uk branded omnia 7 has this issue?
FYI I have included my firmware versions etc so we can try and collate a list of working/non working ones to see what the differences are if any.
os version 7.0.7004.0
firmware revision number 2424.10.10.6
hardware revision number 3.15.0.4
radio software version 2424.10.10.6
radio hardware version 0.0.0.800
bootloader version 4.10.1.9
chip soc version 0.36.2.0
KarmaXXK said:
Yesterday I wasted some time playing around with the USB diagnostic port (enable in the Diagnosis app, it's the third USB mode option). Both PSAS and QPST can connect to and mess with the phone, so I think if someone knows his way around, the phone can be kicked into Download Mode.
(I only managed to crash the phone in many different ways, but I was really just monkeying around.)
Click to expand...
Click to collapse
Yes, I tried the *#7284# code and changed the USB Path Control to "Modem, USB Diag" and my phone was recognised by the ROM Downloader but the phone was not in download mode.
I have stumbled upon something which may be what we are looking for though, after reverse engineering the Samsung Diagnosis app I notice there are codes to access 'Operator Specific' Admin areas in the app. Take a look at the attached image.
Now as you can see, the values listed cannot be typed into the Diagnosis app as there is a formula to decipher them. I have the formula but cannot get it to work.
Code:
Private Overloads Function GetHashCode(ByVal str As String) As UInteger
Dim num As UInteger = 0
For i As Integer = 0 To str.Length - 1
[B]num = ((num << 5) + num) + str(i)[/B]
Next
Return num
End Function
Now the bit highlighted in bold is the bit I cant get to work.
It gives the following error:
Operator '+' is not defined for types 'UInteger' and 'Char'.
Once someone can help to get this working, reversing the formula should in theory show us the correct *#000# code combination for each area.
Fingers crossed you can crack it!
lyriquidperfection said:
Yes, I tried the *#7284# code and changed the USB Path Control to "Modem, USB Diag" and my phone was recognised by the ROM Downloader but the phone was not in download mode.
I have stumbled upon something which may be what we are looking for though, after reverse engineering the Samsung Diagnosis app I notice there are codes to access 'Operator Specific' Admin areas in the app. Take a look at the attached image.
Now as you can see, the values listed cannot be typed into the Diagnosis app as there is a formula to decipher them. I have the formula but cannot get it to work.
Code:
Private Overloads Function GetHashCode(ByVal str As String) As UInteger
Dim num As UInteger = 0
For i As Integer = 0 To str.Length - 1
[B]num = ((num << 5) + num) + str(i)[/B]
Next
Return num
End Function
Now the bit highlighted in bold is the bit I cant get to work.
It gives the following error:
Operator '+' is not defined for types 'UInteger' and 'Char'.
Once someone can help to get this working, reversing the formula should in theory show us the correct *#000# code combination for each area.
Click to expand...
Click to collapse
I worked on this few days ago, I couldn't reverse the hash function but we had some brilliant ideas how to do it (see the stackoverflow thread about it http://stackoverflow.com/questions/4523553/reversing-a-hash-function)
but I used brute force and extracted some 60 diagnosis codes that you can find here http://www.martani.net/2010/12/windows-7-hacks-all-diagnosis-codes-you.html
and here http://www.martani.net/2010/12/windows-7-hacks-all-diagnosis-codes-you_26.html
This is great stuff martani if there is any way to decipher these ones, they may be worth looking at:
g_ADMIN_GENERIC = 3370684588
g_ADMIN_TMOBILE = 469486183
g_ADMIN_VODAFONE = 474092301
These ones indeed look very interesting and may offer a way to enable ADC or even the Download Mode some people like me have been looking for.
lyriquidperfection said:
This is great stuff martani if there is any way to decipher these ones, they may be worth looking at:
g_ADMIN_GENERIC = 3370684588
g_ADMIN_TMOBILE = 469486183
g_ADMIN_VODAFONE = 474092301
These ones indeed look very interesting and may offer a way to enable ADC or even the Download Mode some people like me have been looking for.
Click to expand...
Click to collapse
Actually the code is a little misleading, if you see closely, the enum HashCodeTable is used nowhere.
The app waits for user input, after each "tap" on a number it calls the function ParseDial() that hashes the input with GetHashCode then calls the function GetEnumFromList() on this hashed value.
In GetEnumFromList, there is no use of HashCodeTable and even the codes you provided are not hard-coded in this function. I am not sure why they are there but as far as I can tell, to access these parts of the diagnosis app, you need another method than dialing a code it seems
martani said:
Actually the code is a little misleading, if you see closely, the enum HashCodeTable is used nowhere.
The app waits for user input, after each "tap" on a number it calls the function ParseDial() that hashes the input with GetHashCode then calls the function GetEnumFromList() on this hashed value.
In GetEnumFromList, there is no use of HashCodeTable and even the codes you provided are not hard-coded in this function. I am not sure why they are there but as far as I can tell, to access these parts of the diagnosis app, you need another method than dialing a code it seems
Click to expand...
Click to collapse
Damn it! Looks like we are back to square one!
Have you seen also on the Samsung Galaxy S the Download mode is disabled on some devices, but some users made a jig where you bridge 2 pins with a certain resistor and it knocks the phone into download mode. Maybe this would work on the Omnia 7 also????
I am hoping for a software based fix rather than hacking together something.
**ALL** diagnostic codes for SAMSUNG devices
I reverse engineered the Diagnostic Menu Application. It contains a list of configuration "Titles" with corresponding hash-codes. I made a tool to reverse the hash-codes to dial-codes. The dial-codes may not be the same as some codes that were already known, but the dial-codes are absolutely correct for these menu. Differences are due to hash-collisions (same hash-code may have multiple possible dial-codes). I just used the shortest dial-codes for every menu.
The list of menu's is very long and I discovered that not all menu-codes were not actually implemented. I guess this list of codes is used for all Samsung devices (possibly also for Galaxy S and older Windows Mobile devices). So not all dial-codes may actually work on your device.
WARNING!! The menu's can configure low-level settings of your phone. And if you don't know what you're doing you may brick your device or maybe hard-reset the device and loose all your data and settings. Or you may faulty calibrate your sensors. Be very, very careful with experimenting!! I will not take any responsibility for damaging your device in any way.
I would personally be very interested if anyone finds a way to get the device in download-mode by using these menu's (I have a bad bootloader which does not let my Samsung Omnia 7 go into download-mode to flash it to a newer firmware).
By the way: the admin menu's are NOT implemented on the Omnia 7 :-(
This is the list with menu-titles, dial-codes and their hashcode:
Code:
FTAMain = 15 (0x686)
QUALCOMM TEST = *09# (0x17DB96)
TMOServiceMenu = *74*# (0x31710C2)
SMDINFO = *#03# (0x30C0953)
SIMPLE FUNCTION TEST = *#05# (0x30C0995)
IMEI NUMBER = *#06# (0x30C09B6)
VIEWHISTORYNW = *#07# (0x30C09D7)
LCDTEST = *#0*# (0x30C082A)
QWERTYTEST = *#1*# (0x30C0C6B)
BATT TEST = *#2*# (0x30C10AC)
BRIGHTNESS TEST = *#3*# (0x30C14ED)
TouchDelta 80 = *#80# (0x30C2AF8)
LIGHTTEST = *#12*# (0x648DBCDD)
BTLOGDUMP = *#232# (0x648E4E87)
WIFI FACTORY TEST = *#526# (0x648FEFED)
RILNETLOG = *#638# (0x649080D1)
RILDUMP = *#745# (0x64911110)
VPHONE770 = *#770# (0x64911D2E)
VPHONE771 = *#771# (0x64911D4F)
VPHONE772 = *#772# (0x64911D70)
VPHONE773 = *#773# (0x64911D91)
VPHONE774 = *#774# (0x64911DB2)
VPHONE775 = *#775# (0x64911DD3)
VPHONE776 = *#776# (0x64911DF4)
VPHONE777 = *#777# (0x64911E15)
VPHONE778 = *#778# (0x64911E36)
VPHONE779 = *#779# (0x64911E57)
SR TEST = *#780# (0x6491216F)
VT DUMP = *#938# (0x649225F4)
Disable Testbed = #12358# (0xFC28BE89)
Enable Testbed = *12358# (0x170067D0)
DEBUGMODE1 = *#0011# (0xF63246F2)
BATTERYINFO = *#0228# (0xF63364DC)
PHONELOOPBACKTEST = *#0283# (0xF6337DBD)
AUDIOTEST2 = *#0289# (0xF6337E83)
FMRADIORX = *#0368# (0xF6340241)
LIGHTSENSORTEST = *#0589# (0xF63523A6)
RRCVERSION = *#0599# (0xF63527E7)
AUDIOTEST = *#0673# (0xF635AB00)
SOUNDTEST = *#0675# (0xF635AB42)
RTC = *#0782# (0xF6363B81)
DEVICETEST = *#0842# (0xF636B6DE)
ILLUMINATIONTEST = *#0843# (0xF636B6FF)
MultiTouch = *#0987# (0xF63754E8)
SWversionFTA = *#1111# (0xF644EBD4)
MOUSETEST = *#121*# (0xF645774E)
SWversionEx = *#1234# (0xF645811A)
MOUSECAL = *#123*# (0xF6457FD0)
MOUSECAL06 = *#126*# (0xF6458C93)
GPSTEST = *#1575# (0xF6473762)
MICROUSB TEST = *#1793# (0xF6485864)
HWversionFTA = *#2222# (0xF6579518)
BANDSELECTION = *#2263# (0xF657A63D)
PHONEDUMP = *#2454# (0xF658BADF)
CAMERAUPDATE = *#2470# (0xF658C2DD)
CAMERADISABLE = *#2480# (0xF658C71E)
NAVIKEY TEST = *#2486# (0xF658C7E4)
INTEGRITY = *#2580# (0xF659537F)
TouchFirmare 2663 = *#2663# (0xF659D7C1)
TouchDelta 2664 = *#2664# (0xF659D7E2)
TouchDelta 2665 = *#2665# (0xF659D803)
RILNETLOG OFF = *#6380# (0xF6A09CC1)
RILNETLOG ON = *#6381# (0xF6A09CE2)
NETLOCK NETWORK = *#6955# (0xF6A3DAE9)
USBPATHCHANGE = *#7284# (0xF6B22965)
POWERONATTACH = *#7298# (0xF6B22E2A)
SELF DIAGNOSTIC MODE = *#7353# (0xF6B2A8E2)
DebugOption = *#7450# (0xF6B334E0)
ERROR REPORT ON = *#7451# (0xF6B33501)
ERROR REPORT VERIFY = *#7452# (0xF6B33522)
NETLOCK SERVICE = *#7755# (0xF6B4DAA8)
VPHONE DISABLED = *#77*0# (0xF6B4AB38)
VPHONE ENABLED = *#77*1# (0xF6B4AB59)
UARTCHANGER = *#9090# (0xF6D54562)
DEBUGDUMP = *#9900# (0xF6DA0E82)
PILEDUMP = *#9901# (0xF6DA0EA3)
NETLOG LOG START = *#9905# (0xF6DA0F27)
DEBUG RIL DUMP = *#9906# (0xF6DA0F48)
ERRORREPCAB INSTALL = *#9907# (0xF6DA0F69)
GUMITEST3G CAB INSTALL = *#9908# (0xF6DA0F8A)
SUWON3G CAB INSTALL = *#9909# (0xF6DA0FAB)
UARTPATH = *#9910# (0xF6DA12C3)
BATTERYMONITOR = *#9911# (0xF6DA12E4)
CONNECTION SETTING = *#9920# (0xF6DA1704)
VERIFYCOMPARE = *#9990# (0xF6DA34CB)
YSSHINTEST = *#9999# (0xF6DA35F4)
VersionScript = 19104#2* (0xD21FC43E)
BLUETOOTH LOG DISABLE = 20652609 (0x1598F3DE)
BLUETOOTH LOG ENABLE = 20652619 (0x1598F3FF)
BT SSPDEbugModeEnable = 20652629 (0x1598F420)
BT SSPDEbugModeDisable = 20652639 (0x1598F441)
OMADMCLIENT LOG DISABLE = 20653609 (0x1599803F)
OMADMCLIENT LOG ENABLE = 20653619 (0x15998060)
CELOG LOG DISABLE = 20654609 (0x159A0CA0)
CELOG LOG ENABLE = 20654619 (0x159A0CC1)
TOTALCALLTIME = 2934331* (0xC35403F3)
RESET CUSTOM = 35180948 (0x77496B66)
RESET FACTORY = 35190718 (0x775B7B02)
ERASE IMEIITEM = 35190728 (0x775B7B23)
IMEI ADJUST = 35190738 (0x775B7B44)
BLUETOOTH RF TEST = 3##65*88 (0xECE73A9E)
BLUETOOTH AUDIO TEST = 3##65*98 (0xECE73ABF)
AutoSimSetting = 40*047#3 (0xD1C556DF)
PVKKey = 40*549#3 (0xD21FD9E6)
RESET FACTORY WITHDEFAULTLANGUAGE = 76264513 (0x777E1362)
NONSLEEPCALL OFF = *#069*0# (0xBCEBFF49)
NONSLEEPCALL ON = *#069*1# (0xBCEBFF6A)
LEDTEST = *#14789# (0xBF1C1ADD)
DMSessionInit = *#15428# (0xBF2C7494)
CIPHERING = *#32489# (0xC3A095FA)
CAMERAUPDATESVC = *#32589# (0xC3A1225B)
LOGDUMPMGR = *#33284# (0xC3B19514)
SR DISABLED = *#780*0# (0xCD5F5D49)
SR ENABLED = *#780*1# (0xCD5F5D6A)
NETLOCK SUBSET = *#78255# (0xCD60A57B)
LAUNCH UAEDIT = *#92782# (0xD1A12DFC)
PdaBuildTime = *#99820# (0xD2204C1C)
VersionTime = *#99821# (0xD2204C3D)
WIFI TEST = 0373385#6 (0xECE73BA6)
EN LOCK NW = 074578132 (0xBBF27D35)
GCFTESTMODE ENTER = 086#58023 (0x1807BAE3)
FILE SYSTEM TEST = 089559715 (0x28F3F681)
AUDIOGAINCONTROL = 08#766104 (0x902D68E3)
DIS LOCK SUB NW = 17#991#3* (0x1D45A6AE)
PVKFileName = 18*357#25 (0x161B193C)
EN LOCK SUB NW = 193582504 (0xBC073A15)
GPSTESTTOOL = 1#8865#55 (0xF61EC09C)
EN LOCK CORP = 1*0273411 (0xF62C007D)
EN LOCK SVC = 1*0278411 (0xF62EBE62)
DIS LOCK NW = 20789802* (0x1D30E9CE)
SellOutSMS = 2615#0922 (0xD04CA8DE)
TFlashUnPairing = 30334*733 (0x51B892C4)
DIS LOCK SVC = 38025*93# (0xCA957BDB)
GPSTESTTOOL2 = 400#40*08 (0xB9F6D60D)
GPSTESTXTRA = 400#40*18 (0xB9F6D62E)
SerialNumber = 5317*0648 (0x6E256D8C)
EN LOCK SIM = 5494585*3 (0xBC051995)
SERVERURL = 553378683 (0xD8389060)
SLIDECOUNT = 584644021 (0xF0BF3052)
SellOutSMSTestMode = 597#*224# (0x96E7B26D)
APPSLAUNCHER = 5**6244*3 (0x33B0B76)
SLOGSERIAL M2 = 66#6757#1 (0x7050E07C)
AutoReceive Enable = 7160*5088 (0xEF2C5E0D)
TESTMODE = 718071#49 (0x8A09ACC8)
RESET SERVICE = 72673#00# (0xEC5B4BEF)
ReactivateSellOutSMS = 74201#086 (0x807DB65F)
AUDIOCODEC = 7#16#1#37 (0x902D68C2)
ADMIN GENERIC = 838*5448* (0xC8E890AC)
SLOGSERIAL ALL ON = 8644*3081 (0x705107AC)
VT MANUALSETTING = 8802*7*5# (0x104384B5)
DISLOCK SIM = 98217*243 (0x1D43862E)
DMTESTMENU = 9#7357764 (0x414D9633)
SLOGSERIAL ALL OFF = #22#6214# (0x7050E03A)
SLOGSERIAL M1 = #22#6215# (0x7050E05B)
SLOGSERIAL M3 = #22#6217# (0x7050E09D)
SLOGSERIAL M4 = #22#6218# (0x7050E0BE)
SLOGSERIAL M5 = #22#6219# (0x7050E0DF)
ADMIN VODAFONE = #75471648 (0x1C42130D)
DisableSellOutSMS = *4587*676 (0x903477AF)
BLUETOOTH SEARCH TEST = *#232333# (0xECE73AE0)
RANDOM BT MAC = *#232336# (0xECE73B43)
BLUETOOTH MAC VIEWER = *#232337# (0xECE73B64)
WIFI MAC VIEWER = *#232338# (0xECE73B85)
PRECONFIGURATION = *#638738# (0x213EF313)
SELF DIAGNOSTIC MODE DISABLE = *#7353*0# (0x6E008D7C)
SLOGSERIAL M6 = *#745*06# (0x7050E100)
DIS LOCK CORP = 00*2*2#524 (0xCA92BDF6)
ADMIN TMOBILE = 0612824763 (0x1BFBCA67)
AutoReceive Disable = 09925572#3 (0xD4B8217D)
SWversionIn = 1309653522 (0xECB23FC4)
GPSTTFFTESTTOOL = 154*068271 (0xF61EBC7C)
SellOutSMSProductionMode = 1#3341#5#0 (0x96D7C68A)
LOCK STATUS INFO = 28##**23*0 (0x7D8C72E3)
SWversionNewIn = 32456464#7 (0xFD58D7FC)
Heathcliff74 said:
I reverse engineered the Diagnostic Menu Application. It contains a list of configuration "Titles" with corresponding hash-codes. I made a tool to reverse the hash-codes to dial-codes. The dial-codes may not be the same as some codes that were already known, but the dial-codes are absolutely correct for these menu. Differences are due to hash-collisions (same hash-code may have multiple possible dial-codes). I just used the shortest dial-codes for every menu.
Click to expand...
Click to collapse
Can you share how did you reverse the hash function? I worked on this some time ago but finally just brute forced it to extract the keys.
I would also like to know how he reversed the hash codes! I tried for hours and had no luck!
Haha.. Well, I first tried to calculate the original dial-codes, but that seems to work only for dialcodes shorter than 8 digits (5 bits per digit, 32 bits hash-code = 32 / 5 = 7 digits + 1 digit for the extra add):
Code:
uint hash = 0; // enter hash here
string DialCode = "";
while (hash > 0)
{
uint digit = (hash % 33) + 33;
if (digit > hash)
hash = 0;
else
hash = (hash - digit) / 33;
DialCode = Convert.ToChar(digit) + DialCode;
}
return DialCode;
But this does not work for long dial-codes. So after that I just made a little program to brute-force it. I copied the enum with menu-titles and hash-codes to my project. Then I used reflection to populate a sortedlist. Then I started to brute-force and check all dialcodes for their hashcode and see if it exists in the list. If it exists, I add it to a textbox and remove the item from the list. That's it. So it is not really reversed, but my program took about an hour to get dial-codes for all the hashcodes in the enum.
Code:
SortedList<uint, string> hashCodes = new SortedList<uint, string>();
int l = typeof(HashCodeTable).GetEnumNames().Length;
string[] menunames = typeof(HashCodeTable).GetEnumNames();
for (int i = 0; i < l; i++)
{
try
{
hashCodes.Add(Convert.ToUInt32(Enum.Parse(typeof(HashCodeTable), menunames[i])), menunames[i].Substring(2).Replace('_', ' '));
}
catch { }
}
char[] chars = { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '#', '*' };
for (int length = 1; length <= 20; length++)
{
ushort[] digits = new ushort[length];
for (int i = 0; i < length; i++) digits[i] = 0;
while (true)
{
// calc hash
uint hashCode = 0;
for (int i = 0; i < length; i++)
{
hashCode = ((hashCode << 5) + hashCode) + chars[digits[i]];
}
if (hashCodes.ContainsKey(hashCode))
{
int m = hashCodes.IndexOfKey(hashCode);
string str = "";
for (int j = 0; j < length; j++)
str = str + chars[digits[j]];
textBox1.Text = textBox1.Text + hashCodes.Values[m] + " = " + str + " (0x" + hashCode.ToString("X") + ")" + Environment.NewLine;
hashCodes.RemoveAt(m);
}
// increase
digits[length - 1]++;
for (int k = length - 1; k >= 0; k--)
{
if (digits[k] >= 12)
{
if (k == 0)
break;
else
{
digits[k] -= 12;
digits[k - 1]++;
}
}
}
if ((digits[0] >= 12) || (hashCodes.Count == 0)) break;
}
if (hashCodes.Count == 0) break;
}
Excellent stuff! Thank you for this very interesting code snippit!
WP7 diag codes
martani said:
Actually the code is a little misleading, if you see closely, the enum HashCodeTable is used nowhere.
Click to expand...
Click to collapse
This is because the compiler optimized out the switch statement and compiled the constants into the IL code for the hash codes.
Within the main switch statement where keypad entries are evaluated there are ~112 codes and I've reversed all of them. Writing hash algorithms is not straightforward and it's quite a simple one, since my app captured 2-3-4 variants of keycodes for the same hash value.
Regarding the most interesting entries at the top of the enum the ADMIN_ entries...those hash values are not handled by the application, maybe Samsung has another diag app or a different app which is using the same method.
The other thing I can think of is there are APIs in the diag app which one is sending the hash of a keycode to the given driver...I tried that but the ADMIN stuff did not worked that way either :-((
If anyone is interested I can post the resolved codes, but not sure if I can post it in the forum or not ;-)
Regsitry entry to enable SLDR mode
I found this definition in B44C7A84-5068-4b43-A1E5-F870A80F6FF8.rgu:
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\UsbFn]
...
"OsMode"=dword:0 ; 0 for Main OS, 1 for SLDR
....
Is the download mode == SLDR mode?
Since maybe we can set this entry "somehow", and upon next reboot we will get into download mode so we can flash the device?
So the question is, what is SLDR mode? Secure Loader mode? I don't know this, a more pro in this area should help out ;-)
UPDATE
I was able to read the value (0) and write it back (0). Did not tried to write 1 there
Hey guys. I know this thread is about programmatically enter downloadmode, but I wanted to try the 301k resistor trick and I can confirm it works on Samsung Omnia 7.
I used this guide. If you're gonna do that too, then you should pay attention to these things:
- The guide refers to pin 4 and 5 being closest to the headphone socket. But on the omnia 7, the headphone and micro-usb sockets are the other way around if you compare it to the Galaxy S. The guide is for the Galaxy S, so you should really pay attention to which pins you solder the resistor(s). This is the best picture on how you should solder the resistor(s).
- Many micro-usb cables have no wire for pin 4. Some connectors don't even have a pin 4. You should first verify that your connector has all 5 pins. If you only have 4 wires, then you have to dismantle the connector and solder directly on the back of the connector.
I switched off my Omnia 7. I plugged in my jig and it went to downloadmode immediately.
It's late now, so I will see tomorrow what I will be going to flash on it. There quite a few roms and I'm not sure which one I should use. I have to figure that out first.
If anyone has questions about how to make a jig, just ask. I know how to make one now.
You should post pictures, how to make such a cable. Thanks
FromOuterSpace said:
You should post pictures, how to make such a cable. Thanks
Click to expand...
Click to collapse
The picture I linked to in my previous post look pretty clear to me. It shows what pins you have to use. The guide I linked to contain all the other necessary details. If you have any specific questions about something that is still not clear, you can ask me.
I am trying to map the recent apps and applications key on samsung bluetooth keyboard to teh recnet apps and apps buttons, just like the app_switch capactive button. The Home button and back button the the physical keyboard already work. Following the below guide, one would modify /system/usr/keylayout/Generic.kl with relevant scan codes
Code:
#http://www.thriveforums.org/forum/toshiba-thrive-development/9626-how-create-customized-keylayout-any-usb-bluetooth-keyboard-rooted.html
#/system/usr/keylayout/Generic.kl
key 704 RECENTAPPS
key 705 APPLICATION
and save the file as /system/usr/keylayout/Vendor_04e8_Product_a006.kl, where the keyboard's vendor and product id are found by
Code:
cat /proc/bus/input/devices
; on my device this gets the following
I: Bus=0005 Vendor=04e8 Product=a006 Version=0001
N: Name="Samsung Bluetooth Keyboard EJ-CT800"
P: Phys=
S: Sysfs=/devices/virtual/misc/uhid/input11
U: Uniq=
H: Handlers=sysrq event11 sec_debug
B: PROP=0
B: EV=12001b
B: KEY=147 0 0 0 0 0 0 0 0 0 0 0 0 0 0 10003 2010007 ff9f317a c14057ff febeffdf ffefffff ffffffff fffffffe
B: ABS=ffffff00 0
B: MSC=10
B: LED=1f
However, this does not work; niether does copying the appropriate keylayout file Vendor_04e8_Product_a006.kl directly from samsung stock rom, which shows the key scancoes above. Instead, it seems some people got it working by changing the source code related to whievever key code you desire and compile android.policy.jar ike this:
evilisto said:
platform/frameworks/base/policy/src/com/android/internal/policy/impl/PhoneWindowManager.java
from :
Code:
} else if (keyCode == KeyEvent.KEYCODE_APP_SWITCH) {
if (down && repeatCount == 0) {
showOrHideRecentAppsDialog(RECENT_APPS_BEHAVIOR_SHOW_OR_DISMISS);
}
return -1;
}
to :
Code:
} else if (keyCode == KeyEvent.KEYCODE_APP_SWITCH) {
if (down && repeatCount == 0 && !keyguardOn) {
try {
mStatusBarService.toggleRecentApps();
} catch (RemoteException e) {
Slog.e(TAG, "RemoteException when showing recent apps", e);
}
}
return -1;
}
Click to expand...
Click to collapse
It seems simple enough, but i am not compilng yet; it would be useful to have this for cm roms, but not sure about compatibility with different rom versions (i.e., cm-11, 12, 13, 14); if someone builds this, perhaps comment on this... thanks
would someone like to compile this and try, as i'm sure a lot of people have this keyboard? :laugh:
err, found my error with the recentapps button; making it app_switch instead of recentapps makes it work, so it only remains to make the application button, which opens the app drawer. i ohpe this interests somebody, but if not whatever
I have the same issue. I guess it's a rom compatibility thing. My Samsung Bluetooth keyboard works fine except for recent apps key (F2) then F3 and F4 don't work as in when you hit those keys, nothing happens at all. I hope we can find a workaround for this.
Same issue here as well.
I am using as well the Original keyboard of tab s (EC-JT800) with aicp ROM 7.1. (preatty good i would say) but there are several issues with the hardware keyboard like:
change between 2-3 languages (no keyboard mapping)
app switching (F2) and app drawer (F3) buttons are not working
caps lock light not turn on
lang does nothing
etc.
I have tried another ROM which is based on the samsung stock firmware: IronRom V3.2 ( https://forum.xda-developers.com/galaxy-tab-s/development/prerooted-stock-touchwiz-rom-t2973107) and i noticed that the keyboard is fully working as expected. Therefore i assume that the keyboard layout is the original from samsung incorporated into the ROM. If we copy this layout it will work on a 7.* ROM version ?
Update: Searching inside the above mentioned ROM i found the file Vendor_04e8_Product_a006.kl which i am planning to copy over. The thing is that the system filesystem is read only.
Any Idea ?
---------- Post added at 15:07 ---------- Previous post was at 14:33 ----------
I research and it seems that ssome of the mapping missings are :
key 368 LANG
# F2 F3 F4
key 704 RECENTAPPS
key 705 APPLICATION
key 706 SIP_ON_OFF
# LEDs
led 0x01 CAPS_LOCK
Will copy the file over from the other ROM and update about the results.
I'm trying to do the same here, with Lineage OS on an SM-T800.
As already said, the stock keylayout, which includes something like this:
Code:
key 704 RECENTAPPS
key 705 APPLICATION
key 706 SIP_ON_OFF
key 707 VOICESEARCH
key 708 QPANEL_ON_OFF
key 710 SFINDER
key 712 MULTI_WINDOW
does not work on non-stock ROMs. I can also verify that setting scancode 704 to keycode APP_SWITCH, does work.
Indeed, these keycodes (RECENTAPPS, etc) are not mentioned in the KeyEvent android developers page, nor can I find a substitute for the missing ones.
For the language switch, I tried running inside an adb shell the command
Code:
input keyevent LANGUAGE_SWITCH
and sure enough, I was able to switch language on my keyboard.
I then checked to see what is emitted when I press the "LANG" key on the keyboard, and it seems that it's just SHIFT+SPACE. So I went ahead and defined a keychar file (/system/user/keychars/Vendor_04e8_Product_a006.kcm) where I asked for Shift+Space to send the LANGUAGE_SWITCH keycode. No luck
As a temporary solution, I've mapped the "keyboard" key (just right of the Function key) to LANGUAGE_SWITCH, and that is working fine.
So my keylayout for now includes:
Code:
key 704 APP_SWITCH
key 706 LANGUAGE_SWITCH
Last (but not least), I have no clue how to drive the led for caps-lock. I tried all led numbers from 0x00 to 0x1f in the keylayout file, nothing seems to be doing the trick. I also cannot find any proper documentation on that, to understand how it works.
I'll keep digging. I really don't get why the key character map file didn't work for setting the language. At least that part should be feasible.
Quite strange.
I have installed the IronRom V3.2 (https://forum.xda-developers.com/galaxy-tab-s/development/prerooted-stock-touchwiz-rom-t297310 ) and the keyboard layout is working fine !!! Functions keys, language key and the caps lock led are all working. Keep in mind that this ROM is based on stock and is running android 6.0.1
I wonder if a copy of the files /system/user/keychars/* to a newer android version might work. I also noticed on other nougat versions (AICP, LIneage) that the keyboard settings are completely different that Marshmallow.
ale_kons said:
Quite strange.
I have installed the IronRom V3.2 (https://forum.xda-developers.com/galaxy-tab-s/development/prerooted-stock-touchwiz-rom-t297310 ) and the keyboard layout is working fine !!! Functions keys, language key and the caps lock led are all working. Keep in mind that this ROM is based on stock and is running android 6.0.1
I wonder if a copy of the files /system/user/keychars/* to a newer android version might work. I also noticed on other nougat versions (AICP, LIneage) that the keyboard settings are completely different that Marshmallow.
Click to expand...
Click to collapse
Your link seems to be wrong.
If this ROM is based on samsung stock, then my guess would be that this is what makes it work with the keyboard, not necessarily the android version. Did you use the ROM with the stock kernel or the "ironstock" kernel?
I guess I have the stock kernel, have to check though
My kernel version is: 3.4.113-IronStock_SM-T800_V3.2
Current ROM: IronRom V3.2_T800
As mentioned above the keyboard is working as it was supposed too.