From 8ecd50228a517a125168079d13b92fd77517b6e8 Mon Sep 17 00:00:00 2001 From: ZXCLI Date: Thu, 10 Sep 2026 02:01:26 +0800 Subject: [PATCH] android: match official libcoresdk handshake - 66f cali-info, 670+EP0x84 cali fetch w/ cache, drop legacy 66b/pre-start FFC --- .../com/mag160c/thermal/usb/IrSession.kt | 135 +++++++++++++++--- .../com/mag160c/thermal/usb/MagProtocol.kt | 14 +- .../com/mag160c/thermal/usb/UsbTransport.kt | 9 ++ build-artifacts/mag160c-app-debug.apk | 2 +- docs/android_app/session_state.md | 26 ++++ 5 files changed, 158 insertions(+), 28 deletions(-) diff --git a/android/app/src/main/kotlin/com/mag160c/thermal/usb/IrSession.kt b/android/app/src/main/kotlin/com/mag160c/thermal/usb/IrSession.kt index f472477..1c6b503 100644 --- a/android/app/src/main/kotlin/com/mag160c/thermal/usb/IrSession.kt +++ b/android/app/src/main/kotlin/com/mag160c/thermal/usb/IrSession.kt @@ -22,16 +22,19 @@ import java.util.concurrent.atomic.AtomicBoolean * stop: STOP(74) * Sustained FFC(0)/FFC(1) commands are emitted by [RenderPipeline.onFfc]. * - * Round-13/14 hardening from real-device logs (vivo V2509A, EP silence): - * - KEY FIX (round 14): Linux/Android usbfs marks an endpoint HALTED after - * a timed-out bulk transfer, and every later transfer then fails instantly - * with -1 until CLEAR_FEATURE(HALT). The first 500 ms stream read (the - * camera needs 1-2 s to start sending) therefore killed the whole stream. - * Now EVERY failed transfer is followed by get_status + clear_halt. - * - only ONE session may own the camera (a second claimInterface steals - * the interface from the first and both die); - * - init command reads are short (responses are advisory, as in C); - * - zero stream bytes for 5 s -> one START re-kick; 10 s -> UI notice. + * Round-15 BREAKTHROUGH (decompiled the OFFICIAL Android libcoresdk that + * streams on this very phone — CNetComm functions in analysis/ida/export): + * - the official connect flow is 66f (cali size/version) -> 670 + EP 0x84 + * bulk fetch of the calibration file when the local cache misses + * ("First running on new host...") -> reader thread -> 50 ms -> START; + * - it NEVER sends 66b/66c at connect (66b is PC-demo legacy and wedges + * this firmware: camera answers it once, then goes silent and watchdog- + * reboots ~25 s later — exactly what our logs showed); + * - no pre-start FFC either: RenderPipeline.onFfc drives the FFC cadence + * once frames flow. + * Plus round-13/14 hardening: single session owner, CLEAR_HALT after every + * failed transfer (usbfs marks endpoints halted after a timed-out transfer), + * 5 s START re-kick, DETACHED handling. */ class IrSession(context: Context) { data class CameraIdentity( @@ -62,6 +65,7 @@ class IrSession(context: Context) { } private val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO) + private val appContext: Context = context.applicationContext private val transport = UsbTransport(context) private var listener: Listener? = null private var pipeline: RenderPipeline? = null @@ -69,6 +73,10 @@ class IrSession(context: Context) { private var streaming = false private var identity = CameraIdentity(1, 0, 160, 120, 15) + /** Cali-file size/version reported by 66f/670 (0x5BB5B55E pair). */ + private var caliSize = 0L + private var caliVersion = 0L + fun setListener(l: Listener?) { listener = l } @@ -142,6 +150,10 @@ class IrSession(context: Context) { return } val (epOut, epResp, epStream) = transport.endpoints() + val ep84 = transport.endpointByAddress(UsbTransport.EP_BULK_IN) + if (ep84 != null) { + DebugLog.log("session", "cali endpoint 0x84 available") + } if (epOut == null || epResp == null || epStream == null) { transport.close() notify(State.ERROR, "no_endpoints") @@ -159,31 +171,97 @@ class IrSession(context: Context) { notify(State.ERROR, "ddt_fail") return } - DebugLog.log("session", "ddt loaded ${ddtBytes.size} bytes") + DebugLog.log("session", "ddt bundled ${ddtBytes.size} bytes") pipeline = pipe active = this - // prepare sequence (verified hardware: 4-byte commands; responses - // advisory — the C reference ignores them, so short reads here) - sendCmd(cmd4(MagProtocol.CMD_PREPARE1), epOut, epResp, "66b", 400) - sendCmd(cmd4(MagProtocol.CMD_PREPARE2), epOut, epResp, "66c", 400) - sendCmd(cmd4(MagProtocol.CMD_GET_INFO), epOut, epResp, "66f", 400) + // Startup sequence EXACTLY as the official Android libcoresdk does it + // (CNetComm decompilation — the code that streams on this phone): + // 1. 66f -> 0x5BB5B55E pair {cali size, version} (ReadCaliInfo) + // 2. cache missing -> 670 -> pair -> read the file from EP 0x84 + // ("First running on new host, it will cost some time ...") + // 3. reader thread -> 50 ms -> START(73). NO 66b (PC-demo legacy, + // it wedges this firmware), NO pre-start FFC (pipeline drives it). + val prep = sendCmd(cmd4(MagProtocol.CMD_GET_INFO), epOut, epResp, "66f cali-info", 1000) + DebugLog.log("session", "cali size=$caliSize version=$caliVersion ok=${prep.ok}") + val ddt = prepareDdtBytes(ep84, ddtBytes) + if (!pipe.loadDdt(ddt)) { + DebugLog.log("session", "ddt_fail size=${ddt.size}") + transport.close() + notify(State.ERROR, "ddt_fail") + return + } + DebugLog.log("session", "ddt loaded ${ddt.size} bytes") notify(State.STREAMING, null) notifyIdentity() DebugLog.log("session", "identity $identity") - // Startup sequence verified on hardware (csdk mag160c_ir.c): reader - // thread first, FFC(0) x2, 300 ms, then START(73). Without START the - // camera never streams (root cause of the round-11 black screen). running.set(true) Thread.sleep(50) - sendCmd(cmd8(MagProtocol.CMD_FFC, 0), epOut, epResp, "FFC(0) pre-start 1/2", 400) - sendCmd(cmd8(MagProtocol.CMD_FFC, 0), epOut, epResp, "FFC(0) pre-start 2/2", 400) - Thread.sleep(300) sendCmd(cmd4(MagProtocol.CMD_START), epOut, epResp, "START", 400) streamLoop(pipe, epStream, epOut, epResp) } + /** + * Official cali-file handshake: 66f reported size/version; if the local + * cache doesn't match, fetch the file from EP 0x84 (670 + bulk reads) and + * cache it. Returns the bytes to feed RenderPipeline.loadDdt — the + * camera's own calibration when available, else the bundled DDT. + */ + private fun prepareDdtBytes(ep84: UsbEndpoint?, bundled: ByteArray): ByteArray { + if (caliSize <= 0 || caliSize > 0x6400000L) { + DebugLog.log("session", "cali size invalid -> using bundled DDT") + return bundled + } + val conn = transport.connection() ?: return bundled + val cache = java.io.File( + java.io.File(appContext.filesDir, "cali"), + "magcore.cali.$caliVersion", + ) + if (cache.isFile && cache.length() == caliSize) { + DebugLog.log("session", "cali cache hit: ${cache.name} (${cache.length()} B)") + return try { + cache.readBytes() + } catch (e: Exception) { + DebugLog.log("session", "cache read failed -> bundled: $e") + bundled + } + } + if (ep84 == null) { + DebugLog.log("session", "EP 0x84 missing -> using bundled DDT") + return bundled + } + DebugLog.log( + "session", + "first run on this host: fetching cali file $caliSize B from EP 0x84", + ) + val out = ByteArray(caliSize.toInt()) + val buf = ByteArray(0x80000) + var got = 0 + while (got < out.size) { + val want = minOf(buf.size, out.size - got) + val n = conn.bulkTransfer(ep84, buf, want, 60000) + if (n <= 0) { + diagnoseEndpoint(conn, ep84.address, got) + DebugLog.log("session", "cali read failed at $got/${out.size} -> bundled DDT") + return bundled + } + System.arraycopy(buf, 0, out, got, n) + got += n + if (got % 0x100000L < 0x80000L) { + DebugLog.log("session", "cali fetch progress $got/${out.size}") + } + } + try { + cache.parentFile?.mkdirs() + cache.writeBytes(out) + DebugLog.log("session", "cali fetched+cached: ${cache.name} ($got B)") + } catch (e: Exception) { + DebugLog.log("session", "cali cache write failed (using bytes anyway): $e") + } + return out + } + private fun notify(state: State, message: String?) { DebugLog.log("session", "state -> $state msg=$message") listener?.onStateChanged(state, message) @@ -254,6 +332,14 @@ class IrSession(context: Context) { if (magic == MagProtocol.RSP_INFO_1 && n >= 0x3C) { lastInfo1 = buf.copyOfRange(4, 4 + 0x38) } + if (magic == MagProtocol.RSP_PAIR && n >= 20) { + // 0x5BB5B55E: {u64 cali size, u64 cali version} (DecodeCmd) + caliSize = (MagProtocol.u32(buf, 4).toLong() and 0xFFFFFFFFL) or + ((MagProtocol.u32(buf, 8).toLong() and 0xFFFFFFFFL) shl 32) + caliVersion = (MagProtocol.u32(buf, 12).toLong() and 0xFFFFFFFFL) or + ((MagProtocol.u32(buf, 16).toLong() and 0xFFFFFFFFL) shl 32) + DebugLog.log("cmd", "cali pair: size=$caliSize version=$caliVersion") + } if (magic == MagProtocol.RSP_INFO_0 && n >= 0x3C) { val payload = buf.copyOfRange(4, n) lastInfo0 = payload.copyOf(0x38) @@ -325,6 +411,11 @@ class IrSession(context: Context) { continue } readCount++ + // deferred camera-info fetch (MDT needs the 0x5BB5B55B block; the + // official Android sequence doesn't send 66b during connect) + if (readCount == 1 && lastInfo0 == null) { + sendCmd(cmd4(MagProtocol.CMD_PREPARE1), epOut, epResp, "66b info (deferred)", 400) + } if (firstReads < 3) { DebugLog.log( "stream", "first reads [$firstReads] n=$n head=%s".format( diff --git a/android/app/src/main/kotlin/com/mag160c/thermal/usb/MagProtocol.kt b/android/app/src/main/kotlin/com/mag160c/thermal/usb/MagProtocol.kt index ebacc5e..2652696 100644 --- a/android/app/src/main/kotlin/com/mag160c/thermal/usb/MagProtocol.kt +++ b/android/app/src/main/kotlin/com/mag160c/thermal/usb/MagProtocol.kt @@ -3,16 +3,20 @@ package com.mag160c.thermal.usb import java.nio.ByteBuffer /** - * Vendor command/response protocol, recovered in analysis/protocol_spec.md. - * Plain commands are 4-byte {magic}; FFC carries an 8-byte {magic, param}. - * Responses on EP 0x82: 0x5BB5B55B camera info (0x38), 0x5BB5B55C block 2, - * 0x5BB5B55E version pair (0x10). + * Vendor command/response protocol, recovered in analysis/protocol_spec.md + * + the official Android libcoresdk decompilation (CNetComm). + * Plain commands are 4-byte {magic}; FFC and parameter setters carry + * 8-byte {magic, param}. Responses on EP 0x82: + * 0x5BB5B55B camera info (0x38), 0x5BB5B55C parameter block (0x38), + * 0x5BB5B55E/55F pair {u64 cali size, u64 cali version}. + * 0x6BB6B670 (GetCaliFile) makes the camera push its calibration file on + * EP 0x84 ("First running on new host, it will cost some time..."). */ object MagProtocol { const val CMD_PREPARE1 = 0x6BB6B66B const val CMD_PREPARE2 = 0x6BB6B66C const val CMD_GET_INFO = 0x6BB6B66F - const val CMD_GET_VERSION = 0x6BB6B670 + const val CMD_GET_CALI = 0x6BB6B670 const val CMD_FFC = 0x6BB6B672 const val CMD_START = 0x6BB6B673 const val CMD_STOP = 0x6BB6B674 diff --git a/android/app/src/main/kotlin/com/mag160c/thermal/usb/UsbTransport.kt b/android/app/src/main/kotlin/com/mag160c/thermal/usb/UsbTransport.kt index adaca34..9fe4e48 100644 --- a/android/app/src/main/kotlin/com/mag160c/thermal/usb/UsbTransport.kt +++ b/android/app/src/main/kotlin/com/mag160c/thermal/usb/UsbTransport.kt @@ -151,6 +151,15 @@ class UsbTransport(private val context: Context) { return Triple(out, resp, stream) } + /** Any endpoint by address (e.g. EP 0x84 for the calibration file). */ + fun endpointByAddress(addr: Int): UsbEndpoint? { + val intf = claimedInterface ?: return null + for (i in 0 until intf.endpointCount) { + if (intf.getEndpoint(i).address == addr) return intf.getEndpoint(i) + } + return null + } + fun isOpen(): Boolean = connection != null /** Raw connection handle for bulk transfers. */ diff --git a/build-artifacts/mag160c-app-debug.apk b/build-artifacts/mag160c-app-debug.apk index 123a250..539292c 100644 --- a/build-artifacts/mag160c-app-debug.apk +++ b/build-artifacts/mag160c-app-debug.apk @@ -1,3 +1,3 @@ version https://git-lfs.github.com/spec/v1 -oid sha256:4b67eee1946a2bf410958939d938a9b9e28a3ba48adc8d96afca18a86e93070a +oid sha256:292326ef3bf190a49296a58a6361649555f8e3078d3c527e24f300e98f545e2a size 11873652 diff --git a/docs/android_app/session_state.md b/docs/android_app/session_state.md index bc93330..0e901a5 100644 --- a/docs/android_app/session_state.md +++ b/docs/android_app/session_state.md @@ -290,6 +290,32 @@ - 预期：本轮装上后，日志应出现 `first reads [0] n=...` 与递增的 frames/rendered， 画面出图。若 timeouts 持续上涨且 reads=0，再看 5s re-kick 与 halted 状态。 +## 用户反馈修复 第十五轮（2026-09-10，BREAKTHROUGH：逆向官方 libcoresdk 找到缺失握手） + +- [x] **用户回传第三轮日志**：clear_halt 修复已生效（0x81 每 500ms 健康轮询 25s + 无遗漏），但相机确实 0 字节；66b 仅在相机上电后响应一次，随后对一切命令 + 沉默，~27s 后相机掉线重启。**官方 App 在同一手机正常** → 排除供电/硬件。 +- [x] **逆向 analysis/ida/export 的 libcoresdk(arm64) 反编译（官方在用的库）**： + - `CNetComm` 命令层全貌：66f=ReadCaliInfo（响应 0x5BB5B55E pair={u64 标定 + 文件大小, u64 版本}）；**670=GetCaliFile**（响应带大小 → 从 **EP 0x84** + 按 ≤512KB 块、60s 超时读回标定文件；日志串 "First running on new host, + it will cost some time for initializing..."）；672=FFC；673=START； + 674=STOP；676/677=省电参数（AutoPowerSave，非图像传输）。 + - **官方安卓连接序列根本不发 66b/66c**（66b 是 PC libmagcore 旧演示遗留）， + 也不发预启动 FFC；序列 = 66f →（缓存缺失）670+0x84 拉取 → 读线程 → + 50ms → START。FFC 由帧驱动（pipeline onFfc）。 + - 推断：我们一直发的 66b 把该固件带入旧式握手模式并卡死（66b 有响应、 + 之后全哑、看门狗 ~25s 重启）——与全部日志吻合。 +- [x] **IrSession 按官方序列重写连接**：66f（1000ms 读，解析 pair）→ 缓存 + `files/cali/magcore.cali.` 命中则直接用 → 否则 670 + EP 0x84 + 拉取（60s/块，进度日志，成功后写缓存）→ loadDdt（拉取文件优先，失败回退 + 内置 DDT）→ 50ms → START。删除 66b/66c/预启动 FFC×2；首帧后补发一次 + 66b 拿 info 块（MDT 用）。UsbTransport 加 endpointByAddress()。 +- [x] 构建+单测全过；APK 已更新（11.87MB）。 +- 预期日志特征：`66f cali-info ok` + `cali pair: size=1856416...` → + `first run on this host: fetching cali file...` → `cali fetched+cached` → + `first reads [0] n=...` → frames 递增 → 出图。 + ## 待办 - 真机USB实测（温度绝对值标定、FFC/录像/MDT保存端到端）——进行中：