CIC screenshots

superwofy

Corporal
Jan 18, 2021
103
134
0
I figured out a way of taking screenshots.

It works through the process "layermanager". Unfortunately, its default config forbids screenshots with a line "disableSnapshots=1".
Since layermanager and its config are in the root-ifs, it's not easy to modify them. You'd have to dump the flash, modify the ifs and flash it back. Chances of a brick are high for something so trivial.

Instead I disassembled the layermanager, found where the check for that attribute is and then modified layermanager in memory.

The check happens in FUN_08057a24. If this function returns 1, we're not allowed to take screenshots. Thus, at 0x08057a46 we will change the instruction
"mov.l @(r0,r1),r0" to "mov #0x0,r0". This forces the function to return 0.


Copy the attached dd binary to somewhere r/w. Like /mnt/hbdebug for example. Plug a usb drive into USB1 and dump the memory:
Code:
dd if=/dev/mem of=/fs/usb0/cic-memory.bin bs=4096 count=32768
If the CIC crashes, it doesn't matter. layermanager will be in the same place because processes are started in the same order every time.

With the memory dump search for byte sequence "00 E0 04 91 1E 00 E3 6F 26 4F 0B 00 F6 6E 4C 01". Note the offset of "1E 00", this is the instruction to patch. Since the startup script is the same, your offset may be the same as mine.

Dump the two bytes of memory at that offset to double-check:
Code:
dd if=/dev/mem of=/fs/usb0/layer-dump.bin bs=1 skip=138934854 count=2

If the output was "1E 00" proceed to patch it:
Code:
dd if=/fs/usb0/patch.bin of=/dev/mem bs=1 seek=138934854 count=2


Finally, we can take an actual screenshot:
Code:
// 256 is the main screen. 513 is the split screen
echo d-shot 256 /fs/usb0/screenshot-d.png > /dev/layermanager

screenshot-d.png



E92 images to follow.
 

Attachments

  • dd.zip
    6.5 KB · Views: 9
  • patch.bin
    2 bytes · Views: 8
Last edited:
  • Like
Reactions: TiAgAu

Xantor

Private
Jan 3, 2023
36
3
0
That's awesome! What are some possible use cases for that?
Oh and that Eco Pro mode is just from instructions, right?

Edit: I still get nightmares when I see Assembler code
 

superwofy

Corporal
Jan 18, 2021
103
134
0
That's awesome! What are some possible use cases for that?
Oh and that Eco Pro mode is just from instructions, right?

Edit: I still get nightmares when I see Assembler code

 

Gahaka

New Member
Nov 22, 2023
1
0
0
The fusion of art and precision is palpable in the realm of quality stock photos. These images go beyond mere school vector representation; they capture the essence of expression with unparalleled precision. Working with such a collection allows for a seamless blend of creativity and technical finesse, resulting in projects that resonate with both emotion and accuracy.
 
Last edited:

superwofy

Corporal
Jan 18, 2021
103
134
0
E92 images
 

Attachments

  • brake-system-green.png
    brake-system-green.png
    223.8 KB · Views: 16
  • large-top-down.png
    large-top-down.png
    172.4 KB · Views: 12
  • main-black-tyres.png
    main-black-tyres.png
    244.5 KB · Views: 12
  • main-engine-oil-green.png
    main-engine-oil-green.png
    241 KB · Views: 14
  • main-tyres.png
    main-tyres.png
    229.7 KB · Views: 14
  • mini-lines-under.png
    mini-lines-under.png
    266.5 KB · Views: 15
  • mini-oil-red.png
    mini-oil-red.png
    227.9 KB · Views: 14
  • mini-right-image.png
    mini-right-image.png
    245.1 KB · Views: 14
  • mini-top-down.png
    mini-top-down.png
    133.8 KB · Views: 15
  • large-nobg.png
    large-nobg.png
    69.9 KB · Views: 13
  • main-black-tyres-nobg.png
    main-black-tyres-nobg.png
    69 KB · Views: 10
  • mini-nobg.png
    mini-nobg.png
    51.1 KB · Views: 10
  • Like
Reactions: Chpok