ZXCLI
0bfb926892
- 逆向：Ghidra/IDA 全量反编译 CoreSDKLib.dll/ThermalSDK.dll/libthermalSDK.so/ libcoresdk.so(ARM64)/libmagcore.so，导出 analysis/ida/export/ - 解码官方渲染管线：DDT 校准表加载->快门端点选择->Q12 插值->ref(4x type1 帧 均值)->NUC 查表->盲元补偿->窗口->LUT1024 重建->2x 升采样->调色板 - 逐像素验证：NUC+盲元 0/19200、插值 0 误差、2x 0/76800、窗口一致 - demo3 v5：完整复刻官方管线（含 DDT 解析、FFC 状态机、快门温度驱动）， 修复 load_ddt 表错位导致的零像素问题 - 鬼影根因分析写入 analysis/reverse_20260813_full.md - 心跳/恢复机制：analysis/session_state.md + tools/resume_rev.ps1 - 新增 tsdk_pair3 增强采集工具；历史工具归档 csdk/tools/legacy/； 根目录抓帧残留删除，历史文档归档 analysis/history/ - csdk/README.md 完整使用文档；.gitignore/.gitattributes 补 LFS 规则
95 lines
3.6 KiB
C
95 lines
3.6 KiB
C
/* Probe: exact layout of the 0x81 stream as seen by our 2-read capture. */
|
|
#include <stdio.h>
|
|
#include <stdint.h>
|
|
#include <string.h>
|
|
#include <windows.h>
|
|
#include <libusb.h>
|
|
|
|
static libusb_context *g_ctx;
|
|
static libusb_device_handle *g_h;
|
|
|
|
static int sendcmd(unsigned magic, unsigned param, int len) {
|
|
unsigned char cmd[8] = {0};
|
|
cmd[0] = (unsigned char)(magic);
|
|
cmd[1] = (unsigned char)(magic >> 8);
|
|
cmd[2] = (unsigned char)(magic >> 16);
|
|
cmd[3] = (unsigned char)(magic >> 24);
|
|
if (len >= 8) {
|
|
cmd[4] = (unsigned char)(param);
|
|
cmd[5] = (unsigned char)(param >> 8);
|
|
cmd[6] = (unsigned char)(param >> 16);
|
|
cmd[7] = (unsigned char)(param >> 24);
|
|
}
|
|
int xfer = 0;
|
|
if (libusb_bulk_transfer(g_h, 0x03, cmd, len, &xfer, 2000)) return -1;
|
|
unsigned char resp[0x1000];
|
|
if (libusb_bulk_transfer(g_h, 0x82, resp, sizeof(resp), &xfer, 2000)) return -1;
|
|
return 0;
|
|
}
|
|
|
|
int main(void) {
|
|
libusb_init(&g_ctx);
|
|
libusb_device **list = NULL;
|
|
ssize_t cnt = libusb_get_device_list(g_ctx, &list);
|
|
for (ssize_t i = 0; i < cnt && !g_h; ++i) {
|
|
struct libusb_device_descriptor d;
|
|
libusb_get_device_descriptor(list[i], &d);
|
|
if (d.idVendor == 0x833c) libusb_open(list[i], &g_h);
|
|
}
|
|
libusb_free_device_list(list, 1);
|
|
if (!g_h) { printf("no device\n"); return 1; }
|
|
libusb_set_configuration(g_h, 2);
|
|
libusb_set_configuration(g_h, 1);
|
|
if (libusb_claim_interface(g_h, 0)) return 1;
|
|
sendcmd(0x6bb6b66b, 0, 4);
|
|
sendcmd(0x6bb6b66c, 0, 4);
|
|
sendcmd(0x6bb6b66f, 0, 4);
|
|
sendcmd(0x6bb6b672, 0, 8);
|
|
Sleep(100);
|
|
sendcmd(0x6bb6b672, 0, 8);
|
|
Sleep(300);
|
|
sendcmd(0x6bb6b673, 0, 4);
|
|
Sleep(700);
|
|
|
|
for (int n = 0; n < 8; ++n) {
|
|
unsigned char hdr[64];
|
|
int xfer = 0;
|
|
if (libusb_bulk_transfer(g_h, 0x81, hdr, sizeof(hdr), &xfer, 200) || xfer < 28) { Sleep(10); continue; }
|
|
unsigned m = (unsigned)hdr[0] | ((unsigned)hdr[1] << 8) |
|
|
((unsigned)hdr[2] << 16) | ((unsigned)hdr[3] << 24);
|
|
if (m != 0x1bb1b11b) { printf("read1: no magic (m=%08x, xfer=%d)\n", m, xfer); continue; }
|
|
printf("read1: xfer=%d magic ok type=%u len=%u\n", xfer, hdr[12],
|
|
(unsigned)hdr[8] | ((unsigned)hdr[9] << 8) | ((unsigned)hdr[10] << 16) | ((unsigned)hdr[11] << 24));
|
|
unsigned char buf[40000];
|
|
if (libusb_bulk_transfer(g_h, 0x81, buf, sizeof(buf), &xfer, 200)) { printf("read2 fail\n"); continue; }
|
|
printf("read2: xfer=%d\n", xfer);
|
|
printf(" buf[0..15] hex: ");
|
|
for (int i = 0; i < 16; ++i) printf("%02x ", buf[i]);
|
|
printf("\n");
|
|
/* search for trailer magic 1bb1b11c */
|
|
int found = -1;
|
|
for (int i = 0; i + 4 <= xfer; ++i) {
|
|
unsigned v = (unsigned)buf[i] | ((unsigned)buf[i+1] << 8) |
|
|
((unsigned)buf[i+2] << 16) | ((unsigned)buf[i+3] << 24);
|
|
if (v == 0x1bb1b11c) { found = i; break; }
|
|
}
|
|
printf(" trailer 1bb1b11c at buf+%d (xfer=%d)\n", found, xfer);
|
|
printf(" buf[found+4..found+11]: ");
|
|
for (int i = 0; i < 8 && found + 4 + i < xfer; ++i) printf("%02x ", buf[found + 4 + i]);
|
|
printf("\n");
|
|
/* dump u16 pixel candidates at 0 and 28 */
|
|
unsigned p0 = buf[0] | (buf[1] << 8);
|
|
unsigned p28 = buf[28] | (buf[29] << 8);
|
|
printf(" u16@0=%u u16@28=%u (background ~9500-11000)\n", p0, p28);
|
|
return 0;
|
|
}
|
|
printf("no frame seen\n");
|
|
Sleep(300);
|
|
libusb_clear_halt(g_h, 0x03);
|
|
libusb_clear_halt(g_h, 0x82);
|
|
sendcmd(0x6bb6b674, 0, 4);
|
|
libusb_close(g_h);
|
|
libusb_exit(g_ctx);
|
|
return 0;
|
|
}
|