Reverse engineering HTC Desire capacitive touschscreen / Projects / Forums

Forums

4hv.org :: Forums :: Projects

« Previous topic | Next topic »

Reverse engineering HTC Desire capacitive touschscreen

Move Thread

LAN_403

Linas

Tue Oct 22 2013, 05:14PM

Registered Member #1143 Joined: Sun Nov 25 2007, 04:55PM
Location: Vilnius, Lithuania
Posts: 721

Hello.
Not that long ago, i wanted to reverse engineer my old phone capacitive touchscreen, because resistive touchscreen is just pain to work, and it is very unstable at low pressure.

Inspired by MikeElectronicStuff video about reverse engineering ipod screen, i ordered connector for TP, and also connector for phone, so i can hook my MSO2024B on I2C bus so i can decode it.

For tp init (at power-up ), it sends 6 packets containing 16b of data like this:
[(80).<FF>,<10>]
[(80).<41>,<04>]
[(80).<44>,<0C>]
[(80).<FF>,<04>]
[(80).<F0>,<81>]
[(80).<F1>,<01>]

80 is address, and it writing (8 bit is zero) "[" is i2c start condition, and "]" is stop condition
ok, so i next, i need to read coordinates from TP. It is capable of tracking two fingers at the same time, so x0,y0,p0 and x1,y1,p1 are variables ( well, as far as i know ). x and y is just coordinates (screen is 800x480 so x and y should be inside this limit) and p is pressure , so but in phone is represented p as float value between 0.0 and 2.0 ( i get around 1,5 )

To get data from screen, TP controller have IRQ line, when IRQ goes low i have data in TP, easy.

Now comes the tricky part, in where i need your help

. Yes, it is data decode.

Packet to get data looks like this:

[(80,<00>[(81) ,<XX>,<XX>,<XX>,<XX>,<XX>,<XX>,<XX>,<XX>,<XX>,<XX> ,<XX>,<XX>,<40>]
As you can see, it has two start condition, and 81 is address 80 with read bit. After that, follows 12 packets of data about coordinates (+ additional data ? who knows, no pdf for controller

), and burst always ends with 41 or 40 (it is always toggles from 41 to 40, first packet always is 41, second 40, then 41, then 40, I bet it is static data.

Now, any one have any idea how to decode message (12 char long, i know only one thing, that last 4 packets is for x1,y1,p1, since if i hold only one finger, data is zero in last 4 packets )

And yes, i already have this controller working with STM32F4, with interrupt enabled, so only decoding in software is left.

Example of packet for singe touch:

Now i will make a list for packet data and coordinates for singe and double touch, so some one could help me decode it.

what will be same x y for singe and double touch, same x and different y for multitouch and so on.

Andy

Tue Oct 22 2013, 06:43PM

Registered Member #4266 Joined: Fri Dec 16 2011, 03:15AM
Location:
Posts: 874

It could be a 64bit cipher, with 4bytes crc, I'm guessing it would be a simple xor cipher, probable byte or word long.

Maybe..

Linas

Tue Oct 22 2013, 07:00PM

Registered Member #1143 Joined: Sun Nov 25 2007, 04:55PM
Location: Vilnius, Lithuania
Posts: 721

Hm, problem. it looks that data is not that stable, while x,y,p is stable,i2c data jitters in some packets. So it looks that it has some sort ADC output, since data should be dead stable,but it's not.

So right now trying to make a table with correct data for decoding protocol :(

controller is Synaptics T1007A2, and no datasheet or anything. Can some one extract data from HTC desire SDK ?

Linas

Tue Oct 22 2013, 10:01PM

Registered Member #1143 Joined: Sun Nov 25 2007, 04:55PM
Location: Vilnius, Lithuania
Posts: 721

If some one is good in programing, i find c file for Synapics, since HTC Desire has source files for developers. (txt attached)

init functions looks exactly like mine, good start
tatic int synaptics_init_panel(struct synaptics_ts_data *ts)
{
int ret;

ret = i2c_smbus_write_byte_data(ts->client, 0xff, 0x10); /* page select = 0x10 */
if (ret < 0) {
printk(KERN_ERR "i2c_smbus_write_byte_data failed for page select\n");
goto err_page_select_failed;
}
ret = i2c_smbus_write_byte_data(ts->client, 0x41, 0x04); /* Set "No Clip Z" */
if (ret < 0)
printk(KERN_ERR "i2c_smbus_write_byte_data failed for No Clip Z\n");

ret = i2c_smbus_write_byte_data(ts->client, 0x44,
ts->sensitivity_adjust);
if (ret < 0)
pr_err("synaptics_ts: failed to set Sensitivity Adjust\n");

err_page_select_failed:
ret = i2c_smbus_write_byte_data(ts->client, 0xff, 0x04); /* page select = 0x04 */
if (ret < 0)
printk(KERN_ERR "i2c_smbus_write_byte_data failed for page select\n");
ret = i2c_smbus_write_byte_data(ts->client, 0xf0, 0x81); /* normal operation, 80 reports per second */
if (ret < 0)
printk(KERN_ERR "synaptics_ts_resume: i2c_smbus_write_byte_data failed\n");
return ret;
}

]synaptics_i2c_rmi.txt[/file]

radhoo

Wed Oct 23 2013, 07:15AM

Registered Member #1938 Joined: Sun Jan 25 2009, 12:44PM
Location: Romania
Posts: 701

The touchscreen in Android, is linked in software using the Linux input event files. These are located under /dev/input/eventX where X is an index attributed to each input device.

The format accepted by these input event node files is:

struct input_event {
struct timeval time;
unsigned short type;
unsigned short code;
unsigned int value;
};

Most likely the data you've intercepted is in this format already. I already wrote a code library to handle these (both reading and injecting events) , so it would be a good start point for what you are doing. I can't post it here as it's big and with lots of details, but you can read more here:

Also if there is anything else I can do to help, let me know. I'd say you already did the hard part by making the hardware interface work, the rest is just putting the data in the right format.

Linas

Wed Oct 23 2013, 08:18AM

Registered Member #1143 Joined: Sun Nov 25 2007, 04:55PM
Location: Vilnius, Lithuania
Posts: 721

well, i need to be able decode 12 packets from I2C bus. in attached file is all information about TP data conversion to X and Y and P parameters, but i just don't know where. Maybe you can spot it ?

ok, from static void synaptics_ts_work_func(struct work_struct *work) function, i get something like this:
int x = buf[3] | (uint16_t)(buf[2] & 0x1f) << 8;
int y = buf[5] | (uint16_t)(buf[4] & 0x1f) << 8;
int z = buf[1];
int w = buf[0] >> 4;
int finger = buf[0] & 7;

and

int x2 = buf[3+6] | (uint16_t)(buf[2+6] & 0x1f) << 8;
int y2 = buf[5+6] | (uint16_t)(buf[4+6] & 0x1f) << 8;
int z2 = buf[1+6];
int w2 = buf[0+6] >> 4;
int finger2 = buf[0+6] & 7;

i will try that later, but still something here is missing, like screen size or something

Hey, it does work. I only needed to calculate scaling coefficients, and it spot on. (kx+b=data)

Moderator(s): Chris Russell, Noelle, Alex, Tesladownunder, Dave Marshall, Dave Billington, Bjørn, Steve Conner, Wolfram, Kizmo, Mads Barnkob