[Windows Mobile Apps and Games] MikeKnoop:
Okay guys, so I've been working on the Rhodium canvas for the past week or so, and independently have gotten far however not far enough. Unfortunately I've scoured phcanhtc.dll and still am missing values which exist in there somewhere... so I'm going to open up my knowledge base to the community and let you guys take a look if you want (specifically, nd4spd or l3v5y?)

As I said, this is a work in progress for a modified rhodium port from qvga to vga. No reason we can't eventually get topaz to work if we can find all the values here.

Essentially, there are TWO things I cannot locate. If you can find the values to modify to change either of these two things, I can probably get the rest done:

1. Slide2Answer draw routine (the actual drawing mechanism to display the slider in the incoming call screen)

2. The in-call button display routine values

Now you might ask yourself what I'm contributing here that is more than what we already have: I found locations for editing X,Y coords for incoming contact picture, name, text, background. Found and fixed the "Save to contacts" screen. Identified a lot of important routines in the phone canvas.

I've found the values for most all the other incoming call and in-call stuff. Here's my raw notes.txt:

sub_1001B264 - incoming contact picture drawing routine (search aDwawincomingco)
see also: sub_1001AC3C(?)
SLIDE TO ANSWER: sub_1001D940
contact-border: sub_10002284
sub_10057764

sub_1001D940 - slide to answer text

sub_10042B08 - save new contact drawing routine, only difference between VGA exists past loc_10042C24 (search aDoYouWantToSav)

a_Htcincomingdl - search for the rest of the incoming call screen from here

a_Htcmtslider_c - search below this string for other slider functions

sub_1004322C

*** SETRECT is what you want to be looking for

sub_10005794 in contactassistdll.dll handles the "new contact" screen maybe...

===========================================

phcanhtc.dll
Save Contacts
-----

// For the 3 text buttons
42108 (7E 20 85 E3) -> (F3 20 A0 E3) // moV R2, F3
420EC (05 2D A0 E3) -> (30 20 85 E3) // ORR R2, R5, 0x30
42124 (6F 2F A0 E3) -> (5C 2F A0 E3) // MOV R2, 1BC

// For the checkbox and overlay
4219C (82 2F A0 E3) -> (B7 20 85 E3) // ORR R2, R5, 0xB7
421B8 (82 2F A0 E3) -> (B7 20 85 E3) // ORR R2, R5, 0xB7

Incoming call
----

// Y position of name
1A348 (C2 20 80 E0) -> (5C 2F A0 E3) // MOV R2, 0x00

// contact picture
1AB14 (01 30 44 E0) -> (90 30 A0 E3) // R4 controls HORIZONTAL WIDTH stretchblt
1AAF0 (04 20 96 E5) -> (20 20 A0 E3) // R2 CONTOLS Y POSITION
1AAF8 (00 10 96 E5) -> (50 10 A0 E3) // R1 is X POSITION
1AAF4 (0C 30 96 E5) -> (90 30 A0 E3) // R3 controls height stretchblt

// Slide to answer/ignore TEXT
1CEC8 (04 20 9A E5) -> (00 20 A0 E3) // R2 Slide to answer/ignore text

3C9B8 (0B 20 A0 E1) -> (00 20 A0 E3) *nothin
3CB38 (04 20 97 E5) -> (50 20 A0 E3) *nothin
3D2A0 (04 20 94 E5) -> (00 20 A0 E3) *nothin
3EEC4 (0E 20 A0 E1) -> (FF 20 A0 E3) *nothin
3EF70 (04 20 83 E0) -> (FF 20 A0 E3) *nothin
3F02C (00 20 82 E0) -> (FF 20 A0 E3) *progresscontrolpaint
3F100 (05 20 82 E0) -> (FF 20 A0 E3) *progresscontrolpaint
4246C (06 20 82 E0) -> (00 20 A0 E3) *save to contact pos values (txt, num)
423A4 (06 20 82 E0) -> (00 20 A0 E3) *""
424D8 (05 20 83 E0) -> (00 20 A0 E3) *""
42544 (05 20 82 E0) -> (00 20 A0 E3) *""
68DE8 (14 20 89 E2) -> (00 20 A0 E3) *nothin

// loc_100028E8 controls white behind contact rectangle
01D38 (04 20 A0 11) -> (00 20 A0 E3) *no color, R2 color?
01D1C (50 00 8D E2) -> (00 00 A0 E3) *no color
01CF8 (04 20 96 E5) -> (FF 20 96 E5) ?

Incall Screen
-----
3CB38 (04 20 97 E5) -> (50 20 A0 E3) *nothin
02E04 (83 40 83 E3) -> (00 40 83 E3) *nothin
420D0 (4F 20 85 E3) -> (00 20 85 E3) *moves "dont show again"

775A4 (01 4C A0 E3) -> (00 40 A0 E3) *nothin
7763C (01 4C A0 E3) -> (00 40 A0 E3) *nothin

==== BITBLT =====
sub_10002284 - drawing to incoming call screen
01A30 (44 20 9D E5) -> (00 20 A0 E3) *R2 height of bitmap?
01A40 (01 30 46 E0) -> (00 30 A0 E3) *R3 dissappearing slider
01A5C (09 00 A0 E1) -> (00 00 A0 E3) *R2 dissappearing slider
01A28 (40 10 9D E5) -> (00 10 A0 E3) *R1 bitmap height?
01A4C (02 40 45 E0) -> (00 40 A0 E3) *R4
01A60 (10 50 8D E5) -> (00 50 A0 E3) *R5 bitmap height?
01A44 (33 67 A0 E3) -> (00 60 A0 E3) *R6 no...
01A6C (00 40 8D E5) -> (00 40 A0 E3)

021D4 (05 20 A0 E1) -> (00 20 A0 E3) *nothin (CHANGE BACK!!)
02564 (0A 20 A0 E1) -> (00 20 A0 E3) *nothin
0258C (0A 20 A0 E1) -> (00 20 A0 E3) *nothin
07A20 (05 20 A0 E1) -> (00 20 A0 E3) *nothin
0830C (02 80 A0 E1) -> (00 80 A0 E3) *tpcntl affects phone status bmps
09BBC (C3 20 80 E0) -> (00 20 A0 E3) *nothin
126A0 (20 20 9D E5) -> (00 20 A0 E3) *nothin

16810 (0A 20 A0 E1) -> (00 20 A0 E3) *call timer text (not inital draw though)
1AA80 (C3 20 8E E0) -> (00 20 A0 E3) *nothin
23654 (18 20 9D E5) -> (00 20 A0 E3) *nothin
3CB0C (C2 20 84 E0) -> (00 20 A0 E3) *nothin
41CA4 (00 20 8D E5) -> (FF 20 A0 E3) *nothin
41E48 (00 20 A0 E3) -> (FF 20 A0 E3) *nothin
42B94 (0C 20 81 E2) -> (00 20 A0 E3) *nothin

55A9C (C3 20 8E E0) -> (00 20 A0 E3) *nothin
56480 (00 20 A0 E3) -> (FF 20 A0 E3) *nothin
5675C (24 20 0D E5) -> (00 20 A0 E3) *nothin

=== vals at bottom ===

===========================================

Things to keep in mind if you want to take a stab at this:

Bitblt copies bitmaps to the screen, R2 is the register which controls the top-left Y-coordinate. (R1 does x coord).

StretchBlt is used to stretch the contact image to the right size for display. There are a couple instances in the file and I only messed around with one of them, I know at least one other controls the INCALL contact picture. Registers defined above.

SetRect is used several times to set the location of button controls (again, R2 is y-coord, R1 is x-coord, see above notes on the "Save to contacts" screen).

DrawText functions use the same register notation, and gernally are used to print all the text stuff to screen.

You'll notice how I was replacing everything with "00 20 A0 E3" or similiar. That translates to MOV 00 into the R2 register (20 for R2 in this case, 10 for R1, etc). The first 00 indicates a hex value 0x00. NOTE: This can only be raised to 255 (0xFF). If you need to go any higher, you'll have to either add the value or "ORR" the value ontop of another 0xFF value (see again, save to contacts). Its probably best when trying to find locations of draw routines to find R2 registers you think might do something, then harddcode them to zero using the above line. This will tell you if that R2 is useful or not.

Also, you do NOT need to resign the phcanhtc.dll file when you modify it with a hex editor for whatever reason. Oh, and on that note, all edits will have to be done with a HEX editor, save the file, then copy to your /windows/ directory ontop of your cab installation to test it.

You might be tempted to think the values at the bottom of the phcanhtc.dll file are relevant, but I've zero'd them all out and tested and nothing changed so they are apparently irrelevant.

Here's my workflow for QUICK iteration testing:

IDA Pro open, Hex editor open, OEM installed on phone, phcanhtc.dll also was copied to the flash memory in /Internal Storage/canvas/phcanhtc.dll. Phone plugged in as Disk Drive. Hex editor opens this file from the Disk Drive mode on PC and keeps it open.

I identify a potential location to edit in IDA Pro, then find its matching HEX address in the IDA PRO's hex window. Switch to my actual hex editor and go to this location. Then I make the change and save. Now that my phones /canvas/phcanthtc.dll is updated, I unplug the phone and open up TaskManager and kill cprog.exe (IMPORTANT!).

Then, open up Total Commander and copy the file from /Internal Storage/canvas/ to the /windows/ directory and say okay to overwrite. Then soft-reset my phone with the reset button on back of phone. After the phone resets, I play around with the canvas location I was trying to edit (usually make a test call, receive a test call to see if anything changed). Now plug phone back in, and in your hex editor change the value back if nothing apparently changed.

Okay, so sorry for the huge data dump but I'm hoping someone can use this knowledge and run with it. I'm a bit exausted from the canvas and as we do have a working Tachi canvas already, it seems moot. You might ask what the difference is, and I was hoping this canvas would solve a lot of the bugs people were having with the Tachi, and it also has that sweet conference call thing in it.

This is NOT meant to be installed by a normal person and the graphics are everywhere. As such there isn't a cab, only OEM files. Finally, none of the confirmed edits I noted in notes.txt edit in the OEM phcanhtc.dll file. It's a CLEAN FILE WITH NO EDITS. I figure it'll give you some experience to edit those yourself if you're willing to take the challenge :)

Here's the zip of OEM and notes.txt:

Download ZIP

Good luck,

-Mike