LiveView reverse-engineering effort

[GottZ]

I'm sorry for being a noob again but what is OLV?
Can there be a rom for the LiveView in the coming years?
Is the LiveView open source?
+ can anyone provide me a detailed spec sheet of the LiveView... Like the processor and alll..

Sent from my ST25i using Tapatalk 2

1. OLV means: OpenLiveView wich is our project name (we have a custom android app that fully replaces sony's app)
2. a rom is currently in developement as you can see within this post.
3. the liveview itself is not opensource. our stuff however is.
4. i cannot provide you a detailed spec sheet right now but will do it when i have some time digging out that info.

so.. now to what i want to post:

current snapshot of my firmware folder in attachments.

current binary of the firmware is also in the attachments. (for thoose who just want to try it without compiling and know what they do)


how to use the firmware folder:
http://xdaforums.com/showpost.php?p=38341041&postcount=731

(yes, i suck at english. digg through it or wait till i explain it on http://openliveview.com)



stuff that is on my todo:

• display timeout (aprox 5 minutes to implement it)
• bluetooth (need help)
• write access to the internal storage (need help)
• access to the current battery charge info (need help)
• basic menu system (i'm on it)
• stopwatch (i'm on it after the menu)
• digital clock (will do it after i did the stopwatch)
• other stuff

 

[samsungerlive]

Answer Call

Hi,

is there a chance to implement a call answer funktion in OLV? I got the Problem that in my car i hear music with my device via Line-in and it would be nice to answer calls with liveview.

Thanks


Edit: I made it possible with tasker.

 

[toletum91zgz]

1. OLV means: OpenLiveView wich is our project name (we have a custom android app that fully replaces sony's app)
2. a rom is currently in developement as you can see within this post.
3. the liveview itself is not opensource. our stuff however is.
4. i cannot provide you a detailed spec sheet right now but will do it when i have some time digging out that info.

so.. now to what i want to post:

First of all, you're a genius. Thanks for your hard work on it, GottZ!!!

Sorry about the delay of replying this message, but I was at that Microsoft Event I told you and I found one friend that have the same clock. I told him about this OpenLiveView Project and it was amazed about it and told me that he'll search for that amazing smartwatch.

I carry this watch as clock because I don't have an Android smartphone (I sync the hour with my mother's one) and I'm looking forward for an open bluetooth transfer to use it with iOS and Windows Phone (I can help in the development around Windows Phone, but I don't know too much about transferring data via bluetooth).

This message is for push and for congrats your work. It's amazing how someone can do this in a 20€ smartwatch for making it more functional than Sony arranged

I will help you if it's possible for me

Thanks again, dude! Keep this way! :highfive:

 

[horacioxavier]

I've bougt this watch, and I'm really disapointed, the faecbook plug in do not work, and can't use alerts from whatsapp... allways disconect, and I can control just for a half of hour the music... it's a piece of sh.... sorry but I'm really really pist off. (sorry my bad english I'm learning) maybe whit that new firmware I can make the watch really work! thank you!

 

[vegaspete]

I've bougt this watch, and I'm really disapointed, the faecbook plug in do not work, and can't use alerts from whatsapp... allways disconect, and I can control just for a half of hour the music... it's a piece of sh.... sorry but I'm really really pist off. (sorry my bad english I'm learning) maybe whit that new firmware I can make the watch really work! thank you!

If OpenLiveView doesn't work on your phone, download the "CustomNotifier plugin" from the play store and give it permission settings->accessibility then choose the apps from which you want to receive notifications in the liveview plugin settings. It stops most of the disconnects and gives you notifications from everything. I keep checking this thread everyday hoping for an update that will work with my phone, but in the meantime, CustomNotifier has made my the LiveView work great.

 

[GottZ]

AW: LiveView reverse-engineering effort

First of all, you're a genius. Thanks for your hard work on it, GottZ!!!

lololol. thanks for the flowers but srsly... i think what exception13 has done is even more credible. he used a jtag to do hardware hacking to analyze how the watch communicates internaly with the display etc.
without him there would possibly be no custom firmware.

besides: you should read the posts that have been made after you anounced that you will be at that microsoft event.
renzenicolai gave you a link from wich you can see a pc implementation of the liveview protocol.


@the other ones sticking to sony's crap app:

have you tried openliveview yet? its in the play store and rocks.
(dont forget who made that possible. around 70 pages within this thread are just about this app and i'm not the one who did it)


so again to make clear what i do here:
i run the server behind openliveview.com. i'm not the owner of that domain however.
i do firmware developement based on exception13's work wo gave us all we need to write a custom firmware.
i'm not related to the app developement of the android app. at first it was my goal to help with that but then exception13 gave me sugar.

there are alot of people who are credible for the hard work that have been put into the android app.
i would say that renzenicolai currently leads the app developement. he has some contributors as you can see when you click at "about" within the app or go to the google code page.
because i do not want to forget to mention a name i will forward you there.

Sent from my HTC Desire Z using xda-developers app

 

[horacioxavier]

If OpenLiveView doesn't work on your phone, download the "CustomNotifier plugin" from the play store and give it permission settings->accessibility then choose the apps from which you want to receive notifications in the liveview plugin settings. It stops most of the disconnects and gives you notifications from everything. I keep checking this thread everyday hoping for an update that will work with my phone, but in the meantime, CustomNotifier has made my the LiveView work great.

what version of android you have? because custom notifier never work to me I've reinstalled other version (now 4.1.2) but sill nothing :crying:

 

[GottZ]

what version of android you have? because custom notifier never work to me I've reinstalled other version (now 4.1.2) but sill nothing :crying:

4.1.x is known to have excessive bluetooth stack problems. (try it with a bluetooth headset or a car radio. it will most likely disconnect aswell)


we would be thankfull if you could post a logcat (while a openliveview disconnect happens)

through that we are able to tell you if that problem is related to the app or if it is related to your android rom.

 

[horacioxavier]

4.1.x is known to have excessive bluetooth stack problems. (try it with a bluetooth headset or a car radio. it will most likely disconnect aswell)


we would be thankfull if you could post a logcat (while a openliveview disconnect happens)

through that we are able to tell you if that problem is related to the app or if it is related to your android rom.

well... I don't have conection problems (well sometimes..) I was using live charm from store, but now I only using custom notifier enabling the permission in accsesibility and it's works better tan live charm, but still don't show me the notifications from whatsapp or facebook That I've selected on the plugin (thank you for the answer so fast) :laugh:

 

[kingstonxl]

Odp: LiveView reverse-engineering effort

4.1.x is known to have excessive bluetooth stack problems. (try it with a bluetooth headset or a car radio. it will most likely disconnect aswell)


we would be thankfull if you could post a logcat (while a openliveview disconnect happens)

through that we are able to tell you if that problem is related to the app or if it is related to your android rom.

As far as I know 4.2 had issues with Bluetooth stack not 4.1. I had problems with connecting on nexus 7 but on xperia T with 4.1.2 it works fine.

Sent from my Nexus 7 using xda app-developers app

 

[GottZ]

well... I don't have conection problems (well sometimes..) I was using live charm from store, but now I only using custom notifier enabling the permission in accsesibility and it's works better tan live charm, but still don't show me the notifications from whatsapp or facebook That I've selected on the plugin (thank you for the answer so fast) :laugh:

well this sounds like it has nothing to do with this thread. this thread is about olv and not the original app.

As far as I know 4.2 had issues with Bluetooth stack not 4.1. I had problems with connecting on nexus 7 but on xperia T with 4.1.2 it works fine.

Sent from my Nexus 7 using xda app-developers app

i have no problems in 4.2.1 so far.

beliefe it or not. logcats would still help us finding the problem.



anyways...

there is a code update in my attachments

have fun.

(no menu system yet but i cleaned the code up a little bit and added "hold to auto press over and over again" functionality)

 

[tonyv2]

Hi
have been looking at bluetooth the stlc2500 seems to need firmware uploaded to it :-
"Two files are released with this package which can be downloaded to the STLC2500 chip.
STLC2500_R5_03_A17.PTC patch File: it is a binary file containing a header part and the actual patches.
This is an AXF image built in a similar way as the STLC2500 FW.
STLC2500_R5_03_03_masterpcm_clkinvert.ssf: it contains product & application specific parameters
(values are defined by the customer) , as well as system parameters (for optimal BB/RF functionality).
These settings are valid for all STLC2500 chips"
from README.stlc2500-r5-03.txt ht tp://searchco.de/codesearch/view/27565361

This is utility to load firmware in bluez hciattach.c ht tp://gitorious.org/bluez/vudentzs-clone/blobs/3818459c887b86b48ea486e79cbe28e1ff01f11b/tools/hciattach.c

cant find ptc file r5_04_A9 as specified in orig firmware STLC2500 R5.4 A09 this format is same as in STLC2500_R5_03_A17.PTC so presumably the firmare patch is in the original firmware at that location. Finding beginning of ptc looks easy but end ? and location of ssf maybe jtag.The ptc file seems to be a aif format file, see ht tp://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0041c/ch13s03s03.html.

This guy has ported BTstack to bibios and STM32F4DISCOVERY ht tps://github.com/byly/uubt.

I managed to break my liveview (tore lcd flex connector) trying to take it apart will buy another one after seeing that exception13 , GottZ etc managed to write own firmware (great work) might try to jtag whats left of it if i can find it.

Question is the main chip a stm32103fc6 seems to be doubt as orig firmware image is 244kBytes.
Maybe this thread should be forked ie seperate firmware development thread from thread about apps to talk to original firmware.

Cheers
tony

 

[GottZ]

Hi
have been looking at bluetooth the stlc2500 seems to need firmware uploaded to it :-
"Two files are released with this package which can be downloaded to the STLC2500 chip.
STLC2500_R5_03_A17.PTC patch File: it is a binary file containing a header part and the actual patches.
This is an AXF image built in a similar way as the STLC2500 FW.
STLC2500_R5_03_03_masterpcm_clkinvert.ssf: it contains product & application specific parameters
(values are defined by the customer) , as well as system parameters (for optimal BB/RF functionality).
These settings are valid for all STLC2500 chips"
from README.stlc2500-r5-03.txt http://searchco.de/codesearch/view/27565361

This is utility to load firmware in bluez hciattach.c http://gitorious.org/bluez/vudentzs...6b48ea486e79cbe28e1ff01f11b/tools/hciattach.c

cant find ptc file r5_04_A9 as specified in orig firmware STLC2500 R5.4 A09 this format is same as in STLC2500_R5_03_A17.PTC so presumably the firmare patch is in the original firmware at that location. Finding beginning of ptc looks easy but end ? and location of ssf maybe jtag.The ptc file seems to be a aif format file, see http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0041c/ch13s03s03.html.

This guy has ported BTstack to bibios and STM32F4DISCOVERY https://github.com/byly/uubt.

I managed to break my liveview (tore lcd flex connector) trying to take it apart will buy another one after seeing that exception13 , GottZ etc managed to write own firmware (great work) might try to jtag whats left of it if i can find it.

Question is the main chip a stm32103fc6 seems to be doubt as orig firmware image is 244kBytes.
Maybe this thread should be forked ie seperate firmware development thread from thread about apps to talk to original firmware.

Cheers
tony

woah.. srsly.. awesome.


just to note:

starting at offset 0x3B800 of firmware.bin, there is the serial number and bt address.
i currently print it like this: (since its not NULL terminated)

for (i = 0; i < 43; i++) {
    chprintf(chp, "%c", ((char*)0x0803E800)[i]);
}

this means, we have 243712 bytes to write the firmware to (unless we want to destroy that info)


there is one big thing i do not know how to do.
= write access to the internal memory =

it would be epic if we could use all that space behind the bluetooth id and serial number to store info like.. analog clock or digital clock, 12 hour clock or 24 hour clock, image caching, display timeout setting, system language, date format, offline font caching for characters that did not fit into the firmware but have been send by the phone, etc.

this i really would call a top priority that in my eyes has a higher priority than bluetooth.

another thing is that i'm not able to read the battery charge info yet.


i've received a small info from exception13:
the internal ram (64kb) is currently split into two 32kb areas.
the first is for usual ram usage, the second stores the framebuffer he added.

the display's ic however has its own framebuffer but the communication between the cpu and that ic is too slow to use it for reading / writing single pixels.

 

[ox141jf]

help

hey guys, i have been reading your thread for a while and could not meake heads or tails on whats going on.

Firstly what are you guys trying to achieve?Are you completely remaking the LiveView's OS
If so where can us non tech people download the OS and how do we implement it.

Regards

 

[GottZ]

AW: LiveView reverse-engineering effort

hey guys, i have been reading your thread for a while and could not meake heads or tails on whats going on.

Firstly what are you guys trying to achieve?Are you completely remaking the LiveView's OS
If so where can us non tech people download the OS and how do we implement it.

Regards

its mostly described on http://openliveview.com and post 781

we fully replaced sony's smart management crap / liveview manager with
a custom android app you can find within the play store by searching for openliveview.
its still in developement so certain features of the original app are not yet implemented (plugin support as example)

secondly we work on a custom os for the watch itself.
when it reaches a state in wich non tech people can make use of it, we will care about making it easy to flash to the watch.

currently the battery does not last longer than 3 hours even though it just waits for pressing the power button and the screen is off.
it seems like the display itself does not consume much energy. its mostly the cpu itself while it is not in deepsleep.


let us know if you need further description.
(i have a strange feeling the firmware srsly should switch into a new thread)

Sent from my HTC Desire Z using xda-developers app

 

[kingstonxl]

Odp: LiveView reverse-engineering effort

Is there any way for notifications to show newest on top (like in LVM)?

Sent from my LT30p using xda app-developers app

 

[tonyv2]

Hi
I have been looking at the S6E63D6 pdf (nearest oled controller) it seems to have scroll and windowed read and write.
The fact that the connector to the controller has aprox 41 lines seems to imply that the parallel interface is connected to the stm32 i'm guessing its a (read from my liveview 32F103C6 8N KM1 93 SGP 042 Z) is a stm32F103(family)Z(144pins)H(bga)C(256kbytes)6(indust temp) see CD0191185.pdf.
High density (f103 256kB) and above parts have a peripheral called a FSMC (flexible static memory controller) which can be used to interace to lcd /oled controller using 8080 or 6800 interface 8/9/16/18 wide data bus plus 1 adress line (chip select) plus 3 other control lines plus few extra for setting mode of S6E13B3 (guessing same as S6E63D6) ie spi or 8080 or 6800 .There is a st application note an2790 about implentating of FSMC lcd inteface from stm32 for another controller .I could not find software on st site but found it here (ht tp://portablescopedesign.googlecode.com/svn/trunk/) .
There are some examples of using the FSMC in chibios gfx for lcd controllers but above seems clearer.
The gpio pins that can be remapped to fsmc are fixed for data bus (assume 16 bit as max for fsmc) and 3 control for 8080 or 6800 the one adress line seems to be one of 25 unluckly depending how many io banks there are (hence knowing actual stm32 would be damn useful) .
The FSMC setup registers are at 0xA000 0000 - 0xA000 0FFF but i don't seem to find it in disassembled firmware.
My hopeful assumption is that the boot code uses spi to display dfu mode and main firmware uses 8080 or 6800 mode.This of course might not be the case.But if it was we can have fast acess to framebuffer in on glass oled controller and can do without internal framebuffer saving 32kbytes.The commands are the same for spi or parallel.I need to get jtag going to have alook if any acess to 0xA000 0000 - 0xA000 0FFF and FSMC banks see p38 CD0191185.pdf .Should try jtag but having broken my screen i'm not sure it will get to that point dfu works however.

cheers
Tony

 

[cfaure]

firmware compilation

Hi,
Thanks for this big work! :good:

Now i'am trying to compile your firmware with ChibiOS, (v2.5.2 unstable)

[SIZE="2"]In file included from ../chibios/ext/gfx/src/gdisp/gdisp.c:30:0:
../chibios/ext/gfx/include/gfx.h:33:21: fatal error: gfxconf.h: No such file or directory[/SIZE]

It seem that i need a missing file: "gfxconf.h"
Can someone guide me where find it?
The gfx extension provide one as example, but seem not configured for our display

Thanks

 

[GottZ]

Hi
I have been looking at the S6E63D6 pdf (nearest oled controller) it seems to have scroll and windowed read and write.
The fact that the connector to the controller has aprox 41 lines seems to imply that the parallel interface is connected to the stm32 i'm guessing its a (read from my liveview 32F103C6 8N KM1 93 SGP 042 Z) is a stm32F103(family)Z(144pins)H(bga)C(256kbytes)6(indust temp) see CD0191185.pdf.
High density (f103 256kB) and above parts have a peripheral called a FSMC (flexible static memory controller) which can be used to interace to lcd /oled controller using 8080 or 6800 interface 8/9/16/18 wide data bus plus 1 adress line (chip select) plus 3 other control lines plus few extra for setting mode of S6E13B3 (guessing same as S6E63D6) ie spi or 8080 or 6800 .There is a st application note an2790 about implentating of FSMC lcd inteface from stm32 for another controller .I could not find software on st site but found it here (http://portablescopedesign.googlecode.com/svn/trunk/) .
There are some examples of using the FSMC in chibios gfx for lcd controllers but above seems clearer.
The gpio pins that can be remapped to fsmc are fixed for data bus (assume 16 bit as max for fsmc) and 3 control for 8080 or 6800 the one adress line seems to be one of 25 unluckly depending how many io banks there are (hence knowing actual stm32 would be damn useful) .
The FSMC setup registers are at 0xA000 0000 - 0xA000 0FFF but i don't seem to find it in disassembled firmware.
My hopeful assumption is that the boot code uses spi to display dfu mode and main firmware uses 8080 or 6800 mode.This of course might not be the case.But if it was we can have fast acess to framebuffer in on glass oled controller and can do without internal framebuffer saving 32kbytes.The commands are the same for spi or parallel.I need to get jtag going to have alook if any acess to 0xA000 0000 - 0xA000 0FFF and FSMC banks see p38 CD0191185.pdf .Should try jtag but having broken my screen i'm not sure it will get to that point dfu works however.

cheers
Tony

have you got paypal so i could give you a new liveview?
where are you from? whats it worth at your country?

your findings are awesome. i wish i had that knowledge.

you should take a look at the gpio.txt file within the docs folder in the firmware snapshot.
also hardware.h.
they both contain exception13's research.

there are also some other files you may find interesting. in the gfx folder for example.

Hi,
Thanks for this big work! :good:

Now i'am trying to compile your firmware with ChibiOS, (v2.5.2 unstable)

[SIZE="2"]In file included from ../chibios/ext/gfx/src/gdisp/gdisp.c:30:0:
../chibios/ext/gfx/include/gfx.h:33:21: fatal error: gfxconf.h: No such file or directory[/SIZE]

It seem that i need a missing file: "gfxconf.h"
Can someone guide me where find it?
The gfx extension provide one as example, but seem not configured for our display

Thanks

are you using the latest chibios gfx?

they changed certain things so it would not compile without changing alot.

i will upload my kitchen now.


olvfirmware_kitchen_20130319.tar.gz contains an empty firmware, original and gcc-arm-none-eabi-4_7-2012q4 folder.

the firmware folder shall be filled with the content in firmware_20130319.tar.gz

the original folder will be filled when you type make dump (as described in howto.txt within the kitchen file)
and will be used when you use make orig

the gcc-arm-none-eabi-4_7-2012q4 folder shall be filled as described in howto.txt


the firmware contains the following changes:


the menu key must be pressed after you turned the liveview on.
when you did, you can set the time and use the menu key as "ctrl" key to have a second button layer for the 4 way keys.
when you turn it off and on again, you need to press the menu key again to do changes to the time.

the framebuffer will only be uploaded into the vram in case you really did a change to it.
by this i mean.. write a black pixel onto a black pixel and it will be ignored.

for people who just want to see how it currently looks, there is just the binary in olvfwp.bin_20130319.tar.gz

for people who want to have exception13's last firmware tarball, its also in my attachments.


have fun.
GottZ

 

[cfaure]

firmware compilation

are you using the latest chibios gfx?
they changed certain things so it would not compile without changing alot.
i will upload my kitchen now.
olvfirmware_kitchen_20130319.tar.gz contains an empty firmware, original and gcc-arm-none-eabi-4_7-2012q4 folder.
the firmware folder shall be filled with the content in firmware_20130319.tar.gz
the original folder will be filled when you type make dump (as described in howto.txt within the kitchen file)
and will be used when you use make orig
the gcc-arm-none-eabi-4_7-2012q4 folder shall be filled as described in howto.txt
the firmware contains the following changes:
the menu key must be pressed after you turned the liveview on.
when you did, you can set the time and use the menu key as "ctrl" key to have a second button layer for the 4 way keys.
when you turn it off and on again, you need to press the menu key again to do changes to the time.
the framebuffer will only be uploaded into the vram in case you really did a change to it.
by this i mean.. write a black pixel onto a black pixel and it will be ignored.
for people who just want to see how it currently looks, there is just the binary in olvfwp.bin_20130319.tar.gz
for people who want to have exception13's last firmware tarball, its also in my attachments.

have fun.
GottZ

Thanks! it compile fine!!!