想找个快捷入口

wise2008 · 发表于 2005-9-9 14:10:54

马上注册，结交更多好友，享用更多功能，让你轻松玩转社区。

您需要登录才可以下载或查看，没有帐号？注册会员

x

主菜单的快捷模式,但是找不到它的入口

47. Menu sequence found at file offset 0x36430C
  - Menu handler #1 : 0x000000
  - Menu handler #2 : 0x000000
  - Menu Item handler : 0x000000
  - Menu Item address : 0xD64196
  - Item handler addr : 0xD642C8
  - Number of item : 17

  01) 13B7 13B6 0000:0000 0003 053A ; goto_D6400A, ""
  02) 13BB 13BA 0000:0000 0003 053A ; goto_D6400E, ""
  03) 01A9 01A8 0000:0000 0003 03FF ; goto_D64012, "Calls dialled"
  04) 015D 015C 0000:0000 0003 03FD ; goto_D64016, "Calls missed"
  05) 02F6 02F5 0000:0000 0003 00E1 ; goto_D64030, "Voice message"
  06) 023E 023D 0000:0000 0003 04C6 ; goto_D6401A, "MP3 Player"
  07) 010B 010A 0000:0000 0003 00E2 ; goto_D64020, "Dictating mach."
  08) 01E0 01DF 0000:0000 0006 051E ; goto_D64024, "Calendar"
  09) 05E3 05E4 0000:0000 0003 012E ; goto_D6403A, "Div. unansw."
  10) 03F0 03F1 0000:0000 0003 00CB ; goto_D6403E, "Incoming Msgs"
  11) 0611 0612 0000:0000 0003 00CE ; goto_D64048, "New Message"
  12) 03F2 03F4 0000:0000 0003 03F2 ; goto_D6405E, "All serv. tones"
  13) 03F6 03F7 0000:0000 0003 006D ; goto_D64066, "Volume Calls"
  14) 03F8 03F9 0000:0000 0003 0074 ; goto_D6406A, "Melody a.Calls"
  15) 0294 0292 0000:0000 0003 053A ; goto_D6406E, "Profiles"
  16) 0228 0229 0000:0000 0003 053A ; goto_D64076, "Menu mode"
  17) 01AF 0341 0000:0000 0003 053A ; goto_F4BE32, "--------Help--------"

Xinshou · 发表于 2005-9-9 14:42:50

这个是没刷应用程序菜单之前的：

69. Menu sequence found at file offset 0x0DE4D6
  - Menu handler #1 : 0xDAB264
  - Menu handler #2 : 0x000000
  - Menu Item handler : 0xDAB1E6
  - Menu Item address : 0xADE3FA
  - Item handler addr : 0xADE4AE
  - Number of item : 10

  01) 0227 0228 02B9:3E6C 0006 053E ; goto_DAB192, "Menu mode"
  02) 032A 032B 02B9:3E60 0003 053A ; goto_DAB196, "Device"
  03) 02BC 02BD 02B9:3E60 0003 053F ; goto_DAB19E, "Security"
  04) 0247 0248 02B9:3E60 0003 0540 ; goto_DAB1A6, "Network"
  05) 01A5 01A6 02B9:3E60 0003 0541 ; goto_DAB1AE, "During a call"
  06) 0184 0185 02B9:3E60 0003 01FA ; goto_DAB1B6, "Fax/data mod."
  07) 02FA 02FB 02B9:3E64 0006 0388 ; goto_DAB1BE, "Headset"
  08) 01C4 01C5 02B9:3E60 0003 0385 ; goto_DAB1CE, "Car Use"
  09) 01D5 01D7 02B9:3E64 0006 03EA ; goto_DAB1D6, "IrDA"
  10) 01AF 0340 02B9:3E60 0003 0542 ; goto_F0FFD2, "------Help------"

Xinshou · 发表于 2005-9-9 14:54:34

刷应用程序菜单之后的：
04. Menu sequence found at file offset 0x27DE10
  - Menu handler #1 : 0x000000
  - Menu handler #2 : 0x000000
  - Menu Item handler : 0xC7DE66
  - Menu Item address : 0xBF0D80
  - Item handler addr : 0xBF0EB2
  - Number of item : 17

  01) 0228 0228 0000:0000 0006 0547 ; goto_D77B6A, "Menu mode"
  02) 0A18 0A18 0000:0000 0006 0547 ; goto_C7DE94, "<FE><A2><01><FE><99>(<95>SIM"

Xinshou · 发表于 2005-9-9 15:08:38

菜单模式是： DAD77B6A (可能 DAD76A7B)

[ 本帖最后由 Xinshou 于 2005-9-9 15:10 编辑 ]

Xinshou · 发表于 2005-9-9 16:00:00

发现有的菜单被西门子隐藏了。
大侠能否将这些隐藏菜单调出来，从而发掘新功能，举例：

47. Menu sequence found at file offset 0x35AB40
  - Menu handler #1 : 0xD5A9DA
  - Menu handler #2 : 0xD5A9FA
  - Menu Item handler : 0x000000
  - Menu Item address : 0xD5AA9E
  - Item handler addr : 0xD5AA7A
  - Number of item : 9

  01) 022F 022F 0000:0000 0003 053A ; goto_D5A99A, "Microphone off"关mic
  02) 0231 0231 0000:0000 0003 053A ; goto_D5A99A, "Microphone on"开mic
  03) 0604 0604 0000:0000 0003 053A ; goto_D5A992, "Volume Control"音量控制
  04) 01E8 01E8 0000:0000 0003 0002 ; goto_D5FA36, "Conference"电话会议
  05) 0603 0603 0000:0000 0003 0003 ; goto_D5FAA6, "Time/Cost"时间/话费
  06) 0346 0346 0000:0000 0003 053A ; goto_D609E0, "Send DTMF tones"发送音频
  07) 029F 029F 0000:0000 0003 0001 ; goto_D5FA6E, "Call transfer"呼叫转移
  08) 01BE 01BE 0000:0000 0003 0004 ; goto_D5A98A, "Main Menu"主菜单
  09) 01A3 01A3 0000:0000 0003 053A ; goto_D5A9D6, "Call status"呼叫状态

84. Menu sequence found at file offset 0x522972
  - Menu handler #1 : 0x000000
  - Menu handler #2 : 0x000000
  - Menu Item handler : 0x000000
  - Menu Item address : 0xF228EE
  - Item handler addr : 0xF2295A
  - Number of item : 6

  01) 0057 0057 0000:0000 0003 053A ; goto_F2358E, "Edit"
  02) 0261 0261 0000:0000 0003 053A ; goto_F2354A, "New entry"
  03) 0203 0203 0000:0000 0003 053A ; goto_F235B4, "Delete"
  04) 004F 004F 0000:0000 0003 053A ; goto_F235D2, "Delete all"
  05) 0993 0993 0000:0000 0003 0537 ; goto_F235E4, "Java standard"java标准
  06) 01AF 01AF 0000:0000 0003 053A ; goto_F23542, "--------Help--------"

03. Menu sequence found at file offset 0x1A4FE8
  - Menu handler #1 : 0xBA516E
  - Menu handler #2 : 0xBA512A
  - Menu Item handler : 0x000000
  - Menu Item address : 0xBA4EEC
  - Item handler addr : 0xBA4EB4
  - Number of item : 14

  01) 0272 7FFF 0000:0000 0005 0537 ; goto_BA525E, "Open"
  02) 0265 7FFF 0000:0000 0005 0537 ; goto_BA52E0, "New folder"
  03) 0203 7FFF 0000:0000 0005 0537 ; goto_BA52F6, "Delete"
  04) 004F 7FFF 0000:0000 0005 0537 ; goto_BA5302, "Delete all"
  05) 034F 7FFF 0000:0000 0005 0537 ; goto_BA530E, "Rename"
  06) 035A 7FFF 0000:0000 0005 0537 ; goto_BADE96, "Move"
  07) 098A 7FFF 0000:0000 0005 0537 ; goto_BA5324, "Dial-in Access"拨入
  08) 098C 7FFF 0000:0000 0005 0537 ; goto_BA5330, "Reinstall"重安装
  09) 098D 7FFF 0000:0000 0005 0537 ; goto_BA5346, "Details"
  10) 02D8 7FFF 0000:0000 0005 0537 ; goto_BA5368, "Sort"
  11) 01F4 7FFF 0000:0000 0005 0537 ; goto_BADF9A, "View"
  12) 098B 7FFF 0000:0000 0005 0537 ; goto_BA5374, "More Info"
  13) 01AF 7FFF 0000:0000 0005 0537 ; goto_BA5480, "--------Help--------"
  14) 01AF 7FFF 0000:0000 0005 0537 ; goto_BA54A4, "--------Help--------"

Xinshou · 发表于 2005-9-10 09:08:57

能否调出被隐藏的第47项菜单？

Xinshou · 发表于 2005-9-10 11:38:14

多方通话就是电话会议吧。可以同时说给多人听，同时听多人讲话。
请考虑第47项菜单的功能！！

Xinshou · 发表于 2005-9-10 11:41:48

一般无绳电话就有电话会议功能。

chenwanli · 发表于 2005-9-10 14:57:33

wise用ultraedit找呀,就是有点烦哦.我找的几个和你的不一样,用的是天堂2.8改来得
48. Menu sequence found at file offset 0x36430C
  - Menu handler #1 : 0x000000
  - Menu handler #2 : 0x000000
  - Menu Item handler : 0x000000
  - Menu Item address : 0xD64196
  - Item handler addr : 0xD642C8
  - Number of item : 17

  01) 0BA7 0BA7 0000:0000 0003 053A ; goto_D37398, "“（入口3642c8)
  02) 13BB 13BA 0000:0000 0003 053A ; goto_D37398, ""(入口3642cc)
  03) 01A9 01A8 0000:0000 0003 03FF ; goto_D64012, "Calls dialled"(入口3642d0)
  04) 015D 015C 0000:0000 0003 03FD ; goto_D64016, "Calls missed"(入口3642d4)
  05) 02F6 02F5 0000:0000 0003 00E1 ; goto_D64030, "Voice message"(入口3642d8)
...................

Xinshou · 发表于 2005-9-14 08:23:00

顶..................

Xinshou · 发表于 2005-9-14 10:33:31

学习一下菜单入口结构：

Siemens Entry Point (for Menu Items)

Author:RizaPN--------------------------------------------------------------------------------

Hi All,

I want to share this with all of you, who really like to read the Siemens full flash file. It is about to check the entry point for each menu items. Of course this is not the only or the best way, it just based on my experience, hope it is usefull for others.

1) Create your own language pack with its own index the beginning of each string. Refer to SkyLord software output (lgp file), modify all String xxx, "teks" to become String xxx, "xxx.teks". Use this as your menu language. Using this package, you will see, each menu items with their string index. Most of text-display function inside the flash use index as their parameter.

2) Take a look for a single menu. For example, Organiser menu (I use SL45v56 as an example). The sequence of their items index are : 014.Addressbook, 23B.SIM Location, 159.Calendar, 29C.Appointments ... 128. Help. These index are saved in the flash file in this format :
w00 w01 wIdx02 wIdx03 w04 w05 w06 w07 w08
w10 w11 wIdx12 wIdx13 w14 w15 w16 w17 w18

w00..w08 is data (word format, lo-byte,hi-byte) for the 1st menu item, w10..w18 for 2nd item ...

wIdx02 is the string index of menu item, 0014 (saved as 14 00 in the flash) for Addressbook, 023B for SIM Location, etc.

wIdx03 is the string index of menu item in Big Letter mode, 0013 for Addressbook, 080D for SIM Location, etc.

3) Search inside the flash file, the sequence of one wIdx2 and wIdx3 (index of menu item in normal mode and Big Letter mode). For example, search for 14 00 13 00 to find Addressbook menu item string index location.

4) The location of w00 of the 1st menu item (for ex. Addressbook in the Organiser menu), is saved in the flash together with the address of their function entry-point and the number of menu items.

For example, 14 00 13 00 for Addressbook is found at address 0x1A07E4 and the other format is match (wIdx12 wIdx13 are values 3B 02 0D 08 ...), it means the w00 address for Organiser menu is : 0x1A07E4 - 4 = 0x1A07E0

0x1A07E0 in the file is equal with the address 0xBA07E0 in the flash (base address for SL4x is 0xA00000), and recognized with this format : 02E8:07E0 ... 2E8 is BA07E0 div 4000 and 07E0 is BA07E0 mod 4000.

Search for that address (02E8:07E0 => E0 07 E8 02) in the location near the address of w00. The following 4 bytes (after those address bytes) are subroutines/functions address, and the word after that is the number of menu items.

Let's assume that we found : 94 08 E8 02 0A 00 as the bytes after those (E0 07 E8 02) bytes, then we know that : 02E8:0894 is the location of each subroutine, and 000A is the number of menu items.

5) Check the subroutine location, and we should found this format :
B03 B02 B01 B00 B13 B12 B11 B10 ...

B03..B00 is the address of the 1st menu item function/subroutine.
If it is : 3C EF DB 00 => then the entry point of that menu item is 00DBEF3C.

====================

6) Almost all string are called by their index. Sometimes, also usefull if we search their location in the flash by this byte sequence :

E6 F? ib2 ib1 ... => mov r?, ib1ib2

for example : E6 FC 14 00 for mov r12, 0014

7) Some of string are called indirectly. Their index is saved in the flash, and the function use that location as their parameter. Some of them use this format :

ib2 ib1 FF 7F

to save index ib1ib2 in the flash.

bailong213 · 发表于 2005-9-14 10:46:41

想跟着高手们学习学习......
可说实话....真的看不懂啊..

Xinshou · 发表于 2005-9-23 08:19:25

这里好像可发掘新功能............

Xinshou · 发表于 2005-10-10 08:40:55

既然移动提供免费的“来电等待”服务，发掘小8的“电话会议”功能是很好的！！

下午四点半 · 发表于 2005-10-10 09:34:00

小燕子贴的第8个是日历的
我想改成RM显示时间，然后放到左软键.........

Xinshou · 发表于 2005-10-13 08:59:30

顶............

05220621 · 发表于 2005-10-13 10:05:03

就是好象西门子隐藏了几个菜单。

比如说通话记录删除单项内容。（好象是画家吗，还是谁，以前提过）

可是，我只能看看帮不上什么忙。

.

songfoming · 发表于 2005-10-13 11:29:41

看不懂，但要顶。

帐号		自动登录	找回密码
密码			注册会员

[教程] 想找个快捷入口

马上注册，结交更多好友，享用更多功能，让你轻松玩转社区。

浏览过的版块