reverse engineering onyx-sdk

[Ethran]

Neo Tools Drawing Process

This discussion is dedicated to discovering how the Onyx SDK works. These are just my notes; it might not make sense sometimes.

Neo Tools Drawing Process:

NeoFountainPen → drawStroke:

1. Compute stroke appearance:
   This is achieved using computeStrokePoints:

   public class NeoPen {
       private static native NeoRenderPoint[] nativeComputeRenderPoints(double[] dArr);
       public static NeoRenderPoint[] computeRenderPoints(List<TouchPoint> points) {
           return nativeComputeRenderPoints(PenUtils.getPointDoubleArray(points, a.maxTouchPressure));
       }
   }

2. Render stroke:
   Using the computed points, the rendering process proceeds with functions such as drawStrokeByPointSize.

---

nativeComputeRenderPoints:

This is implemented in libneo_pen.so (System.loadLibrary("neo_pen");) and relies on stylus events onPenDown, onPenMove, and onPenUp to determine the appearance of the stroke.

1. Pen Down

   • neopen_onPenDown is invoked when the pen contacts the surface.
   • Stores information about the pen position, pressure, tilt, etc.
   • Logs metadata for the stroke.
   • Initializes buffers for stroke data.

2. Pen Move

   • neopen_onPenMove processes intermediate pen positions while the pen moves.
   • Computes intermediate points for smooth transitions.
   • Captures pressure and velocity variations for dynamic rendering.
   • Updates the stroke buffer and provides instructions for rendering.

3. Pen Up

   • neopen_onPenUp is invoked when the pen lifts from the surface.
   • Finalizes the stroke and applies any necessary post-processing, like smoothing.
   • Logs final stroke metadata.
   • Outputs the stroke data to the rendering pipeline.

---

NeoFountainPen Example Process

How NeoFountainPen Works:

1. Initialization:

   • NeoFountainPen starts with an initial configuration in its constructor.
   • Parameters include:
     • param_1: Stroke width or thickness (e.g., param_1 is modified as (param_1 + 3.0) * 0.5).
   • Allocates memory for stroke data and sets parameters for rendering.

2. Rendering Events:

   • Relies on three primary events:
     • onDown: Triggered when the stroke starts. Clears previous state and initializes buffers to track the stroke path. Calls BrushStrokeRenderer::addPoint to register the first point.
     • onMove: Triggered while the stroke is in progress. Dynamically adds intermediate points using BrushStrokeRenderer::addPoint to ensure smooth transitions.
     • onUp: Triggered when the stroke ends. Finalizes the rendering path and invokes BrushStrokeRenderer methods to compute the output.

3. Stroke Smoothing:

   • The BrushStrokeRenderer::addPoint function determines how each touchpoint contributes to the overall stroke.
   • Uses weighted accumulation of recent points to smooth the stroke curve.
   • Dynamically adjusts the stroke's width using parameters like *(float *)(this + 0x40) and *(float *)(this + 0x44) (min and max width).

4. Intermediate Point Generation:

   • The strokeTo function calculates intermediate points for smooth rendering between two points.
   • Calls PenHelper::generateStrokePoints to compute intermediate curves for fine-grained rendering.
   • Uses pressure and velocity data to dynamically adjust thickness and opacity.

Key Features of NeoFountainPen:

• Dynamically adjusts stroke width, opacity, and blending based on pen input (position, pressure, tilt).
• Implements smoothing algorithms for realistic and artistic rendering.
• Handles initialization, dynamic updates, and finalization during the pen's lifecycle on the screen.

How setting stroke style works?

touchHelper.setStrokeStyle ultimately maps to a device-specific function. The device class (e.g., SDMDevice inheriting from BaseDevice) has createDevice() which reflectively fetches hidden/vendor methods.

• The stroke style setter is looked up directly on the (vendor‑patched) android.view.View:

  // in SDMDevice.createDevice()
  ReflectUtil.getMethodSafely(View.class, "setStrokeStyle", Integer.TYPE);

  This confirms setStrokeStyle(int) is a hidden Onyx-added method on android.view.View (not part of standard Android).

• Invocation uses:

  ReflectUtil.invokeMethodSafely(method, null, style);

  Passing null as receiver implies the method is static (or treated as such in Onyx’s framework). If reflection fails, the call is a no-op.

• Separately, android.onyx.ViewUpdateHelper is loaded via:

  Class<?> clsClassForName = ReflectUtil.classForName("android.onyx.ViewUpdateHelper");

  This class provides Onyx E‑Ink constants and helper methods (UI modes, masks, etc.), but it is not where setStrokeStyle resides. It’s used to fetch configuration values and other EPD-related helpers during createDevice().

  ---

--To know more I need to get root access to my device to fetch framework.jar or something similar.--

I managed to get the framework.jar:

adb shell cat /system/framework/framework.jar > framework.jar

See also: timschneeb/OnyxTweaks#11

[Ethran]

Framework.jar

Basically the same as what onyx-sdk provides, but a level lower.

1.1. Style Configuration (Java Framework)

Stylus configuration begins in:

android.onyx.optimization.screennote.handler.BaseHandler.applyStrokeParam()

This method extracts stroke properties from an EACStrokeStyle object:

• Stroke color
• Stroke width
• Stroke style ID
• Extra brush parameters (float[] strokeExtraArgs)

It then sends these values to the native layer through:

ViewUpdateHelper.setStrokeColor(...)
ViewUpdateHelper.setStrokeStyle(...)
ViewUpdateHelper.setStrokeWidth(...)
ViewUpdateHelper.setStrokeParameters(styleId, extraArgs)

Only configuration happens here; no actual drawing is performed at this point.

---

1.2. Stylus Data Transmission (Java → SurfaceFlinger)

When the stylus moves, the app sends stroke data using:

startStroke(...)
addStrokePoint(...)
finishStroke(...)

All three call the same IPC bridge:

transactData(int code, float baseWidth, float x, float y, float pressure, float size, float time)

transactData():

• Looks up the SurfaceFlinger binder service
• Packs stroke data into a Parcel
• Sends a Binder transaction (START_STROKE, ADD_STROKE_POINT, FINISH_STROKE)
• Reads back a float (usually updated stroke width)
• Recycles Parcel objects

[Ethran]

EpdController - Electronic Paper Display Controller

What can be controlled by RK32XXDevice

Here’s a structured list of everything this method retrieves via reflection, grouped by the target class and call type. I’m listing the exact field and method names as used in the reflection calls.

Classes loaded via ReflectUtil.classForName:

• android.onyx.ViewUpdateHelper
• android.onyx.optimization.Constant
• android.onyx.hardware.DeviceController
• EACReflectUtils.EINK_HELPER_CLS_NAME (string constant evaluated elsewhere)
• android.onyx.AndroidSettingsHelper
• android.onyx.utils.ApplicationFreezeHelper
• android.onyx.utils.ActivityManagerHelper
• android.onyx.utils.FontsUtils
• android.app.ActivityManagerNative

Static int fields retrieved (getStaticIntFieldSafely):

From android.onyx.ViewUpdateHelper:

• EINK_ONYX_AUTO_MASK
• EINK_ONYX_GC_MASK
• EINK_AUTO_MODE_REGIONAL
• EINK_WAIT_MODE_NOWAIT
• EINK_WAVEFORM_MODE_ANIM
• EINK_WAVEform_MODE_REAGL
• EINK_REAGL_MODE_REAGLD
• EINK_UPDATE_MODE_PARTIAL
• UI_DU_MODE
• UI_DU_QUALITY_MODE
• UI_GU_MODE
• UI_GC_MODE
• UI_DEEP_GC_MODE
• UI_A2_QUALITY_MODE
• UI_MONO_A2_MODE
• UI_X_A2_MODE
• UI_GC4_MODE
• UI_REGAL_MODE
• UI_DEFAULT_MODE
• HAND_WRITING_REPAINT_MODE

From android.onyx.optimization.Constant:

• UPDATE_MODE_DEFAULT
• UPDATE_MODE_DU
• UPDATE_MODE_A2
• UPDATE_MODE_REGAL
• UPDATE_MODE_X

Reflected methods (getMethodSafely or getDeclaredMethodSafely), grouped by class:

android.onyx.hardware.DeviceController:

• openFrontLight(Context)
• openFrontLight(int)
• closeFrontLight(Context)
• closeFrontLight(int)
• getFrontLightValue(Context)
• setFrontLightValue(Context, int)
• getFrontLightConfigValue(Context)
• setFrontLightConfigValue(Context, int)
• hasFLBrightness(Context)
• hasCTMBrightness(Context)
• writeValueToFile(String, int) [declared method]
• led(boolean)
• setLedColor(String, int)
• setVCom(Context, int, String)
• getVCom(String)
• updateWaveform(String, String)
• readSystemConfig(String)
• saveSystemConfig(String, String)
• updateMetadataDB(String, String)
• powerCTP(boolean)
• powerEMTP(boolean)
• isCTPPowerOn()
• isEMTPPowerOn()
• getSystemProperties(String)
• setSystemProperties(String, String)
• getStandbyTimeout()
• setStandbyTimeout(int)
• getPowerOffTimeout()
• setPowerOffTimeout(int)
• setTextShowPassword(boolean)
• isTextShowPasswordOn()
• isSupportWidecg(Context)
• getCTMBrightnessValues(Context)
• getFLBrightnessValues(Context)
• setWarmLightDeviceValue(Context, int)
• setColdLightDeviceValue(Context, int)
• getBrightnessConfig(Context, int)
• increaseBrightness(Context, int)
• decreaseBrightness(Context, int)
• isLightOn(int)
• getSystemConfigPrefix(Context)
• isHallControlEnable()
• enableHallControl(boolean)

android.view.View:

• postInvalidate(int)
• refreshScreen(int)
• refreshScreen(int, int, int, int, int)
• screenshot(int, String)
• byPass(int)
• setStrokeColor(int)
• setStrokeStyle(int)
• setLineWidth(float)
• setPainterStyle(boolean, Paint.Style, Paint.Join, Paint.Cap)
• supportRegal()
• enableRegal(boolean)
• moveTo(float, float, float)
• lineTo(float, float, int)
• quadTo(float, float, int)
• penUp()
• moveTo(View, float, float, float)
• lineTo(View, float, float, int)
• quadTo(View, float, float, int)
• getTouchWidth()
• getTouchHeight()
• getMaxTouchPressure()
• getEpdWidth()
• getEpdHeight()
• mapToView(View, float[], float[])
• mapToEpd(View, float[], float[])
• mapFromRawTouchPoint(View, float[], float[])
• mapToRawTouchPoint(View, float[], float[])
• enablePost(int)
• resetEpdPost()
• isValidPenState()
• getPenState()
• setScreenHandWritingPenState(int)
• setScreenHandWritingRegionLimit(View, int[])
• setScreenHandWritingRegionMode(int)
• setScreenHandWritingRegionExclude(View, int[])
• applyGammaCorrection(boolean, int)
• applyColorFilter(int)
• startStroke(float, float, float, float, float, float)
• addStrokePoint(float, float, float, float, float, float)
• finishStroke(float, float, float, float, float, float)
• invalidate(int)
• invalidate(int, int, int, int, int)
• setDefaultUpdateMode(int)
• getDefaultUpdateMode()
• resetUpdateMode()
• getGlobalUpdateMode()
• setGlobalUpdateMode(int)
• setFirstDrawUpdateMode(int)
• applySysScopeUpdate(int, int, int)
• clearSysScopeUpdate()
• applyAppScopeUpdate(String, boolean, boolean)
• applyAppScopeUpdate(String, boolean, boolean, int, int)
• clearAppScopeUpdate(boolean)
• applyTransientUpdate(int)
• clearTransientUpdate(boolean)
• enableScreenUpdate(boolean)
• setDisplayScheme(int)
• waitForUpdateFinished()
• setUpdListSize(int)
• inSystemFastMode()
• repaintEverything(int)
• switchToA2Mode()
• applySFDebug(boolean)
• useGCForNewSurface(boolean)
• isInSystemFastMode()
• isInAppFastMode()
• isInFastMode()
• enableA2()
• disableA2()
• switchToA2Mode() [also retrieved later as H1]
• toggleA2Mode()
• applyGCOnce()
• setTrigger(int)
• setEnablePenSideButton(boolean)
• getStrokeParameters(int)
• setStrokeParameters(int, float[])
• getEpdToViewMatrix()

android.webkit.WebView:

• setCssInjectEnabled(boolean)

android.os.Environment:

• getStorageRootDirectory()
• getRemovableSDCardDirectory()
• getRemovableSDCardDirs()

android.view.InputManager (SDK >= 16):

• setAppCTPDisableRegion(int[], int[])
• isCTPDisableRegion()
• appResetCTPDisableRegion()
• isEMTPDisabled()
• isKeyboardDisabled()
• setEMTPDisabled(boolean)
• setKeyboardDisabled(boolean)
• dumpInfo()

android.app.ActivityManager:

• forceStopPackageWithoutPermissionCheck(String)
• getRunningTasksWithoutPermissionCheck(int)
• isSystemInMultiWindowMode()
• getCurrentMultiScreenMode()
• isPrimaryTaskInMultiWindowMode(int)

android.onyx.AndroidSettingsHelper:

• getDefaultIpAddresses(Context)
• isPowerSavedMode(Context)
• enablePowerSavedMode(Context, Boolean)
• loadCACertificate()
• loadUserCertificate()

android.onyx.utils.ApplicationFreezeHelper:

• disableAppByPkgName(Context, String)
• enableAppByPkgName(Context, String)
• disableGooglePlay(Context)
• enableGooglePlay(Context)
• isGoogleAppsEnabled(Context)
• isGoogleAppsExists(Context)

android.onyx.utils.ActivityManagerHelper:

• getCurrentTopComponent(Context)

android.onyx.utils.FontsUtils:

• getFontPathMap()

android.app.Activity:

• isInMultiWindowMode()

android.app.ActivityManagerNative:

• getDefault()
• updatePersistentConfiguration(Configuration)
• getConfiguration()

EACReflectUtils.EINK_HELPER_CLS_NAME (class name resolved elsewhere):

• setSystemRefreshMode(int)
• getSystemRefreshMode()

android.onyx.ViewUpdateHelper (method, static context):

• repaintEverything() [retrieved as a1]

Notes:

• The code also accesses BaseDevice.UPDATE_MODE_* fields, but those assignments use values retrieved via reflection from android.onyx.optimization.Constant rather than reflecting on BaseDevice itself.
• Some methods on View like switchToA2Mode are retrieved more than once under different local variable names (e.g., H1 and earlier b1), but they reference the same signature.