-
Notifications
You must be signed in to change notification settings - Fork 1
/
CallerId_200_final.pbp
82 lines (69 loc) · 2 KB
/
CallerId_200_final.pbp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
; This is a patch to fix iOS CallerID bug
; It works by fixing HandsFreeProtocol initialization procedure
; asking iPhone to send us data in UTF-8 charset
; instead of default 7bit.
#ver 200
; This patch should work with most firmware versions,
; because it only changes Bluetopia library code
; and places its own code instead of unused function
; to the end of firmware binary.
2D E9 FF 4F 85 B0 83 46 15 00 99 46 7E D0 {
proc HFRE_send
; args: R0 = stackId,
; R1 = [port+8],
; R2 = nDataLen,
; R3 = pszData
}
; in beginning of HFRE_handle_OK
2D E9 F0 43 04 46 90 F8 23 00 @ 91 B0 80 1E {
; replacing:
; SUB SP,SP,0x44
; SUB R0,R0,2
B.W my_code
global continue ; global label
}
; in middle of HFRE_handle_OK
; At last stage of init, it places 0x6 state code. (UPD: actually unused)
; We instead place 64 (0x40) (which is ignored by proc's main code) and handle it ourselves.
;84 F8 44 51 1D E0 @ 06 20 {
; MOV R0, 64 ; instead of 6
;}
; also 64 instead of 5 - send CSCS instead of CHLD (which actually doesn't get send anyway)
78 B9 @ 05 20 2A E0 94 F8 2C 00 {
MOV R0, 64 ; instead of 5
}
; in middle of HFRE_handle_OK
; This is its init-handler part
; WARNING: don't currently use it!
; Because it requires registers set in proc's prologue
; which we omit.
;D8 B1 @ D4 E9 01 01 ?4 84 F8 23 60 {
; proc init_error
;}
; place this to empty block, or append to the end of fw
{
proc my_code
CMP R0, 64 ; only handle our specific code
BNE ret
MOV R5, R0 ; save
; write state-code 6 (but R0/R5 still have 64,
; so after returning Switch op will just finish proc for now)
MOV R0, 6
db 84 F8 23 00 ; STRB.W R0, [R4, 0x23]
; send CSCS
db D4 E9 01 01 ; LDRD.W R0, R1, [R4, 4]
MOV R2, 0x10 ; string length
ADR R3, szCommand
BL HFRE_send
; here we could check return code, but will not do this (see above for reason)
MOV R0, R5 ; restore
ret:
; re-execute overriten operations
db 91 B0 ; SUB SP, SP, 0x44
db 80 1E ; SUB R0, R0, 2
B.W continue
; data block:
ALIGN 4
szCommand:
DCB "AT+CSCS=\"UTF-8\"\r" 00
}