Log in

View Full Version : Palm Reversing


Will
July 6th, 2004, 12:31
I just ordered (and received...woohoo!) a Symbol SPT1800 (palm os device w/ barcode scanner). The problem is that it didn't come with any software. Symbol does offer an sdk though....pretty much just a couple of libs and headers and a few examples of using the libs.

The problem with that is that I'm not all that into warez and I'm not going to spend $400 on the metrowerks codewarrior software. The only palm development that I've done is with pila, but that doesn't offer any way (that I've found) of linking an external library. There is a new version of pila out as well that looks nice but it doesn't have that capability either.

The good news is that I've managed to disassemble the one lib that I need and have ripped a couple of functions out of it and transported them to my pila source. The ripped functions work great except for the ones that reference global variables. I don't know how to debug symbol-specific palm apps. I can't seem to find any roms for pose. Is there a way to debug the apps while they're running on the symbol with it in the cradle?

(The global --looks like just one so far-- looks like an initialized variable. I can't find anywhere where it gets a return value or any other data moved into it. The only way that I can think of to see what's going on at runtime is to debug it. I guess I could patch the app to display the contents of that variable but in the end I'll need a way to debug the symbol apps anyways.)

thanks,
will

sgdt
July 13th, 2004, 17:06
I've done a lot of work on the Symbols, both Palm style and PowerPC.

For Palm, you should get CodeWarior, you won't regret it. GCC will work, I guess, but IMHO, CodeWarior is much nicer and SDKs are built for it.

The SDK is pretty simple, set your scan conversions, and all will be good.

That unit's pretty expensive, this isn't a hobby, is it?

Will
July 21st, 2004, 16:28
Well it is a hobby actually, but it's also work related. I develop a lot of little software projects that make my work easier. I'm not a professional software developer. I'm in Telecom, and we've recently integrated Cisco VoIP into our more traditional TDM PBX voice network. I convinced my boss to order a Symbol unit to help me inventory our Cisco phones, but also because I've been wanting to play with one for the longest time. He wasn't too thrilled when it shipped without software, but I was delighted.

I'm actually quite fond of PILA, although it's almost beta quality. I'd like to play with Pila 2 but I'm not messing with cygwin to do it. I've used a trial version of Code Warrior, but there's no way that I'm paying $400 for it. I would if I used it professionally, but I'm a telecom geek by trade. I only program as a source of enjoyment.

My real question was how do you debug symbol apps? I vaguely remember reading/hearing something about debugging palm apps while the palm was in the cradle, but I don't remember anything concrete and can't seem to find it again. It seems that you'd need some sort of conduit, with a debugger running on the computer that it's attached to. How do you debug your symbol apps?

cheers,
will

sgdt
July 23rd, 2004, 13:02
Actually, I used the emulator for most of my debugging. The Palm emulator is actually quite accurate (vs. the PocketPC emulator, which is very inaccurate!).

The next thing I did was create a dummy symbol library for debugging, producing random scan codes. The reason is the emulator emulates Palm, not Symbol. This allowed for much faster debugging than thru the cradle.

Last, I ditched the cradle, and went to a strait cable for debugging of live Symbol units. Scanning while holding the unit in it's cradle, hoping it doesn't come loose crashing your debugger, was too much of a pain, and a cable was only a few bucks at best buy. But, 95% of all debugging took place on the emulator.

When writing for Symbols PocketPC line, I tried the same method, but I got bitten. The PocketPC emulator isn't very accurate, and will actually allow you to do unaligned memory accesses. Run on a real Symbol PocketPC, and BOOM, bad things happen. Also, I was unable to get a regular cable for Symbol's PocketPC. It was propriatary, so it was stuck on the cradle.

Will
July 23rd, 2004, 14:33
I've seen those cables, but never really needed one before. It sounds like it'd be better suited for debugging then the cradle though. Thanks for pointing that out.

I figured that maybe there was some sort of 'magic' symbol rom for pose. But it sounds like you sort of created your own by using a dummy symbol library. That's probably the closest thing to a symbol rom I guess.

I have a few questions that maybe you'll be able to answer if you have the time.

1) How are palm libraries statically linked at link time?
It seems that the 68k binary code is sort of cut/pasted into the 68k binary code of your app which makes perfect sense. However I was going through a dead listing from one of the examples in the symbol sdk which calls some functions from one of the symbol libs, and noticed a couple of strange looking trap calls. Forgive me as I don't have it in front of me right now, but I remember it looking like the 68k equivalent of calls to the win32 LoadLibrary, and related api calls...as if it were loading an external library. Do have any information on that?

2) Differences between deadlistings of different disassemblers.
I'm not big on warez, but I wanted to try IDA with palm apps but I don't like it one bit. It misreports the number of locals. There were a couple of other things that I didn't like but I don't really remember them at the moment. Anyways, this isn't about tool-bashing. The disassembly output from IDA, palmdemon, and pildis are slightly different. I haven't figured out if it's just that some opcodes are interpreted differently, or if it's some anti-disassembler stuff or what. I was just curious if you'd seen anything like that.

3) How exactly do you do the serial debugging?
The more that I think about it, the more I think that I saw that in the debugger that comes with the palm sdk (although the last one that I have is for 3.5 I believe). Is there a pose setting to attach to the serial port? (again, I don't have pose on this machine)

4) a5 relative globals
Globals are represented by positive offsets from a5 right? What's represented by negative offsets from a5? While we're on it, are all variables defined outside of procs but within the code section, represented as positive offsets from a2?

cheers,
will

Will
July 25th, 2004, 12:54
I've figured out how to do the serial debugging. You're absolutely right about using the cradle for debugging though. It sucks.