OESF Portal | OESF Forum | OESF Wiki | LinuxPDA | #planetgemini chat on matrix.org | #gemini-pda chat on Freenode | #zaurus and #alarmz chat on Freenode | ELSI (coming soon) | Ibiblio

IPB

Welcome Guest ( Log In | Register )

Profile
Personal Photo
Options
Options
Personal Statement
Ninji doesn't have a personal statement currently.
Personal Info
Ninji
Age Unknown
Gender Not Set
Location Unknown
Birthday Unknown
Interests
No Information
Statistics
Joined: 28-November 19
Profile Views: 200*
Last Seen: Today, 10:50 AM
Local Time: Jan 26 2020, 11:36 PM
28 posts (0 per day)
Contact Information
AIM No Information
Yahoo No Information
ICQ No Information
MSN No Information
Contact Private
* Profile views updated each hour

Ninji

Members


Topics
Posts
Comments
Friends
My Content
18 Jan 2020
Planet have finally released the promised multi-boot option. Unfortunately, using their Recovery, you cannot reformat the Cosmo without losing all your existing data. I didn't want to wipe my Android install, so...

How it works

Stock, the Cosmo's partition map includes a very large userdata partition (combined Android /data and /sdcard) at number 38, followed by otp (39) and flashinfo (40).

When you partition the Cosmo, the userdata partition is deleted and replaced by these, in this order:
- 38: 32MB EMPTY_RECOVERY_BOOT_2
- 41: 32MB EMPTY_NORMAL_BOOT_3
- 42: 32MB EMPTY_NORMAL_BOOT_4
- 43: 30/60/90GB linux
- 44: 30/60/90GB userdata (Android)

The tricky thing is that the userdata partition is encrypted using Android's FDE system (using some metadata stored in the 'metadata' partition); getting access to this from recovery mode is quite a pain.

Also, to match the Cosmo's 'intended' configuration, your userdata partition needs to be physically located after the other partitions. I have not done this; I've left userdata where it started. The partition numbers and names are correct, but the exact sector boundaries are different. Hopefully this won't cause issues!

Planet's 60GB Linux/60GB Android split is defined as follows (start sector number, end sector number):
- 38: 10158080 - 10223615 (65536 sectors)
- 41: 10223616 - 10289151 (65536 sectors)
- 42: 10289152 - 10354687 (65536 sectors)
- 43: 10354688 - 127542188 (117187501 sectors / 55.87GB)
- 44: 127543296 - 244164543 (116621248 sectors / 55.6GB)

I have defined mine as follows, to keep userdata (44) starting at the same original position:
- 38: 126779328 - 126844863 (65536 sectors)
- 41: 126844864 - 126910399 (65536 sectors)
- 42: 126910400 - 126975935 (65536 sectors)
- 43: 126976000 - 244163436 (117187437 sectors / 55.87GB)
- 44: 10158080 - 126779327 (116621248 sectors / 55.6GB)

How to do it

Caution: This is extremely experimental; try it at your own risk!

First, you will need my build of TWRP installed: https://www.oesf.org/forum/index.php?showtopic=35988
You will also need ADB set up, and easy access to a hex editor of some kind.

- Boot into TWRP and run 'adb shell' to get a shell on the Cosmo.
- Run ls /data/ to check that userdata has been decrypted successfully: you should see some stuff in there.
- Tap Mount on the TWRP main menu and uncheck Data.
- Run mount to view mounted filesystems: /dev/block/dm-0 should NOT be mounted and should not show up in the list in any form.
- Use ADB to push parted_static (from the official Cosmo recovery) to /tmp: https://wuffs.org/files/parted_static
- Run chmod +x /tmp/parted_static

You are now ready to re-partition your Cosmo.

Run the following commands:

CODE
resize2fs /dev/block/dm-0 116621248s
/tmp/parted_static /dev/block/mmcblk0 rm 38
/tmp/parted_static /dev/block/mmcblk0 u s mkpart primary 126779328 126844863
/tmp/parted_static /dev/block/mmcblk0 name 38 EMPTY_RECOVERY_BOOT_2
/tmp/parted_static /dev/block/mmcblk0 toggle 38 msftdata
/tmp/parted_static /dev/block/mmcblk0 u s mkpart primary 126844928 126910463
/tmp/parted_static /dev/block/mmcblk0 name 41 EMPTY_NORMAL_BOOT_3
/tmp/parted_static /dev/block/mmcblk0 toggle 41 msftdata
/tmp/parted_static /dev/block/mmcblk0 u s mkpart primary 126910464 126975999
/tmp/parted_static /dev/block/mmcblk0 name 42 EMPTY_NORMAL_BOOT_4
/tmp/parted_static /dev/block/mmcblk0 toggle 42 msftdata
/tmp/parted_static /dev/block/mmcblk0 u s mkpart primary 126976000 244163436
/tmp/parted_static /dev/block/mmcblk0 name 43 linux
/tmp/parted_static /dev/block/mmcblk0 toggle 43 msftdata
/tmp/parted_static /dev/block/mmcblk0 u s mkpart primary 10158080 126779327
/tmp/parted_static /dev/block/mmcblk0 name 44 userdata
/tmp/parted_static /dev/block/mmcblk0 toggle 44 msftdata


Do not paste the entire block in at once; do one command at a time. You may receive warnings from parted about the partition being in use, since devicemapper keeps it open - type I and press enter to ignore these.

Once all these commands have been run, your Cosmo has been re-partitioned.
You may wish to check your resulting partition table against what I received:
CODE
# /tmp/parted_static /dev/block/mmcblk0 u s p
Model: MMC hDEaP3 (sd/mmc)
Disk /dev/block/mmcblk0: 244285440s
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags:

Number  Start       End         Size        File system  Name                   Flags
1      64s         2111s       2048s                    boot_para              msftdata
2      2112s       67647s      65536s                   recovery               msftdata
3      67648s      68671s      1024s                    para                   msftdata
4      68672s      109631s     40960s                   expdb                  msftdata
5      109632s     111679s     2048s                    frp                    msftdata
6      111680s     177215s     65536s      ext4         nvcfg                  msftdata
7      177216s     308287s     131072s     ext4         nvdata                 msftdata
8      308288s     373823s     65536s                   metadata               msftdata
9      373824s     390207s     16384s      ext4         protect1               msftdata
10      390208s     409599s     19392s      ext4         protect2               msftdata
11      409600s     425983s     16384s                   seccfg                 msftdata
12      425984s     524287s     98304s      ext4         persist                msftdata
13      524288s     528383s     4096s                    sec1                   msftdata
14      528384s     534527s     6144s                    proinfo                msftdata
15      534528s     739327s     204800s                  md1img                 msftdata
16      739328s     772095s     32768s                   md1dsp                 msftdata
17      772096s     774143s     2048s                    spmfw                  msftdata
18      774144s     786431s     12288s                   scp1                   msftdata
19      786432s     798719s     12288s                   scp2                   msftdata
20      798720s     800767s     2048s                    sspm_1                 msftdata
21      800768s     802815s     2048s                    sspm_2                 msftdata
22      802816s     833535s     30720s                   cam_vpu1               msftdata
23      833536s     864255s     30720s                   cam_vpu2               msftdata
24      864256s     894975s     30720s                   cam_vpu3               msftdata
25      894976s     927743s     32768s                   gz1                    msftdata
26      927744s     960511s     32768s                   gz2                    msftdata
27      960512s     1091583s    131072s                  nvram                  msftdata
28      1091584s    1093631s    2048s                    lk                     msftdata
29      1093632s    1095679s    2048s                    lk2                    msftdata
30      1095680s    1161215s    65536s                   boot                   msftdata
31      1161216s    1177599s    16384s                   logo                   msftdata
32      1177600s    1193983s    16384s                   dtbo                   msftdata
33      1193984s    1204223s    10240s                   tee1                   msftdata
34      1204224s    1228799s    24576s                   tee2                   msftdata
35      1228800s    2981887s    1753088s    ext2         vendor                 msftdata
36      2981888s    9273343s    6291456s    ext2         system                 msftdata
37      9273344s    10158079s   884736s     ext4         cache                  msftdata
44      10158080s   126779327s  116621248s               userdata               msftdata
38      126779328s  126844863s  65536s                   EMPTY_RECOVERY_BOOT_2  msftdata
41      126844864s  126910399s  65536s                   EMPTY_NORMAL_BOOT_3    msftdata
42      126910400s  126975935s  65536s                   EMPTY_NORMAL_BOOT_4    msftdata
43      126976000s  244163436s  117187437s               linux                  msftdata
39      244164544s  244252607s  88064s                   otp                    msftdata
40      244252608s  244285375s  32768s                   flashinfo              msftdata


Now, in order to make the smaller userdata partition decrypt correctly, you'll need to modify the size inside the metadata partition. Run this on the Cosmo:
CODE
dd bs=512 count=32 if=/dev/block/by-name/metadata of=/tmp/meta.bin

Use adb pull /tmp/meta.bin to pull the metadata partition out and open it in a hex editor. The file will begin as follows...
CODE
C4 B1 B5 D0 01 00 03 00 30 09 00 00 00 00 00 00
10 00 00 00 01 00 00 00 C0 A7 F2 0D 00 00 00 00
                        ^^ ^^ ^^ ^^ ^^ ^^ ^^ ^^

The eight bytes highlighted above, C0 A7 F2 0D 00 00 00 00, are what you need to change - these must match the little-endian encoding of the userdata size. For my size of 116621248, these are: C0 7F F3 06 00 00 00 00. Replace these and save the file. Then, use adb push meta.bin /tmp/ to send it back to the Cosmo, and run this on it:
CODE
dd if=/tmp/meta.bin of=/dev/block/by-name/metadata

You can now exit the shell and reboot your Cosmo. You should receive the bootloader menu and all your Android data should be there.
14 Dec 2019
Hey folks,

I've been experimenting over the past few days with trying to compile TWRP for the Cosmo so I can mess around with updates a bit more easily. Ultimately this may be a bit of a fruitless endeavour if Planet ends up releasing their own, but perhaps this will be useful for some reason or other anyway?

Source code on GitHub: https://github.com/Treeki/unofficial-twrp-cosmo
Initial flashable release: https://github.com/Treeki/unofficial-twrp-cosmo/releases

This is a fairly standard TWRP port with one exception - the Cosmo's userdata partition is encrypted, and getting TWRP to decrypt it is an adventure. I finally got it working after importing a bunch of blobs from Planet's vendor partition so that TWRP can start up the TrustKernel TEE, obtain the correct key and decrypt everything.

I've confirmed that the following features work on my Cosmo:
- Flashing partition images
- Creating backups
- adb while in recovery mode

Android hackery is still a very new thing for me and there's probably ways I could have made this better, but I did what I could with my lack of skills.

Unfortunately the Planet OTA doesn't seem to be flashable from TWRP - it complains about the build fingerprint being different, and even after commenting out that check in the updater script it fails to update the system partition. I think I may have to resort to manually flashing the updated partitions one-by-one.
29 Nov 2019
I've been using my Cosmo for a few days now and something that's irked me a lot has been the inability to customise the Fn mappings. Some keys like Fn+S and Fn+Z have nothing mapped to them at all, and others like Fn+F are mapped to actions that I rarely need - not enough to justify a keyboard shortcut, anyway. And, Alt is forcibly mapped to the Planet App Bar which I would much rather replace with something more interesting.

There are two sets of mappings. The first is used for plain old character inputs, mostly the stuff on the number row and the right hand of the keyboard: |#\€<>[]{}+-=_@;:` and Home/PgUp/PgDn/End. I haven't messed with these myself just yet, but this thread in the Gemini subforum says they are specified through .kcm files contained in the Planet Keyboard app.

The second one, more interesting to myself, defines the handling of the Alt key (toggling the Planet AppBar) and all the Fn shortcuts with special actions: screenshot, mute, volume, brightness, home, app switcher, etc. This is part of Planet's modifications to Android itself. First, a bit of technical background.

--

On the Cosmo ROM these are handled in com.android.server.policy.PhoneWindowManager; specifically in the interceptKeyBeforeQueueing method (original AOSP code). If you want to look at this yourself you can use adb to pull /system/framework from your Cosmo and examine the services package (I used vdexExtractor's deodex script to get .dex files out of everything, and then jadx and Ghidra to analyse services.dex).

Planet's interceptKeyBeforeQueueing is hard to follow (jadx fails to decompile it, so I had to use Ghidra), but here is a summary of the interesting bits:
- redirects Volume Up/Volume Down (fingerprint sensor buttons) to accept or reject an incoming call iff the Cosmo is closed
- detects keycode 0x8D (F11) as the Cosmo having been closed
- detects keycode 0x8E (F12) as the Cosmo having been opened
- *on Cosmo open, jumps to the Home Screen and/or opens the AppBar depending on what is configured in Cosmo Settings
- detects keycode 0x131, and sends the CoDi command 0x1f,1 iff the Cosmo is closed
- detects Volume Up/Volume Down, keycodes 0xf9-0xfd and 0x12c-0x30, and sends them to the CoDi with command 0x15
- **detects Back and closes AppBar if it was opened with Alt
- detects Alt key-up and opens AppBar
- **detects Esc, Left/Up/Right/Down and Enter and redirects them to AppBar if it was opened with Alt
- **detects Fn, hijacks the press and sets a flag
- **redirects all keys pressed while Fn is held to the fnAction method (entirely a Planet addition, not in AOSP)
- handles Call/EndCall buttons (not sure if Cosmo uses this or if it's a holdover from generic Mediatek modifications to Android)
- toggles Caps Lock light
- *on Cosmo close, broadcasts com.iwrist.action.HALLCLOSE, notifies Planet VoiceAssistant, sends CoDi command 5,0, sleeps PowerManager
- *on Cosmo open, broadcasts com.iwrist.action.HALLOPEN, notifies Planet VoiceAssistant, sends CoDi command 5,1, wakes up PowerManager
- detects USB port connections using special keys F14-F17

--

So how does this help us?

We can probably use EdXposed to write a module that hooks interceptKeyBeforeQueueing and fnAction, and replaces how specific keys are handled. This gives us full control but requires more effort (I will probably do this myself over the coming days -- if I do, it will be open sourced on GitHub) and of course also requires rooting.

There is another way though. Note that some of the things above are marked with * and **. The Cosmo (at least, in the out-of-the-box Android 9 build) allows these to be disabled -- without root!

The ones marked with * can be disabled using the following shell command (e.g. via adb shell): settings put system AEON_HALL_TEST 1. Use 0 instead of 1 to revert to normal.
This is slightly interesting but not practical -- it stops the Cosmo from locking on close (and unlocking on open), and stops the CoDi from changing states. Instead of these behaviours, the OS broadcasts com.eastaeon.action.HALLCLOSE on close and com.eastaeon.action.HALLOPEN on open.

For keymapping, the far more interesting command is: settings put system AEON_KEY_TEST 1 which disables the ones marked with **. Use 0 instead of 1 to revert to normal.

With this in play, Fn is now freed up and regular Android applications can detect it! I'm currently using Key Mapper (F-Droid, Play Store) to map Fn+stuff to the actions I want, both replicating the stock Cosmo actions like home and screenshot, and also adding new ones.

Unfortunately, this trick does not allow the Alt key to be replaced (unless someone can think of a crafty way to let us supply our own com.Pripla.Floating package exposing a com.Pripla.Floating.FloatingWindow service, without Android complaining about it having the same package ID as the Planet AppBar which is a system app). Still, it's a start and already exposes lots more possibilities.
Last Visitors


24 Jan 2020 - 15:24


6 Jan 2020 - 3:44


5 Jan 2020 - 17:02


5 Jan 2020 - 11:57


31 Dec 2019 - 1:20

Comments
Other users have left no comments for Ninji.

Friends
There are no friends to display.
RSS Lo-Fi Version Time is now: 26th January 2020 - 03:36 PM