Reversing new Audio, how to use I2c?

Started by 1%, August 28, 2013, 08:04:54 PM

Previous topic - Next topic

0 Members and 1 Guest are viewing this topic.

1%

Investigating EOSM, I found the datasheet matches the AK4950 more or less like 650D.

Datasheet: http://www.qfpost.com/file/d?g=EzOHAZuIw

Audio IC read/write is a bit different now, not sure how to use it. I took some logs and tried a bit.
There is i2c_read, i2c_write and locali2c_read/write

NSTUB(0xFF339490, i2c_write)

#NSTUB(0xFF3463F8, i2c_read) //"normal" write
NSTUB(0xFF346230, i2c_read) // "local" write

The normal one just calls the former and reading reg 00, which is the power reg returns 390... but only to DM log.. if I try int something = local_i2c_write(0x00) I get a big fat 0 and 390 in the dm log.

The commands also change like this.


From the log:
PowerMicAmp
I2C > [2c] 14
localI2C_Write : 301
I2C_Write retry 2c 1 89

So writing 14 to 2C somehow becomes 301 and the retry command doesn't make sense to me either. There are some wrappers for read/write too but they haven't produced much better results.

:PEOSM produces the most coherent logs so a good target for analysis, 650D probably too... 6D is more obfuscated.

SetAudioALCVolumeIn
I2C > [02] 08
I2C done 1
I2C > [20] cd

SetFilterRecOn - bunch of EQs
I2C > [83] 0f 7e 29
I2C > [84] f0 81 d8
I2C > [86] 0e fc 53
I2C > [89] 09 97 5f
I2C > [8a] 09 97 5f
I2C > [8c] fc d1 42
I2C > [8f] 01 b1 d2
I2C > [90] 01 b1 d2
I2C > [91] 00 00 00
I2C > [92] 09 3c d4
I2C > [93] 00 00 00
I2C > [99] 11 93 19
I2C > [9a] f5 da 73
I2C > [9b] 00 00 00
I2C > [9c] 0c 46 f9
I2C > [9d] 00 00 00
I2C > [a0] 10 34 a9
I2C > [a1] e1 5f a3
I2C > [a2] 0e f7 19
I2C > [a3] 1e a0 5e
I2C > [a4] f0 d4 3f
I2C > [a5] 1e a0 5f

Random commands... so 83 = 390?
I2C > [0b] 07
I2C > [2c] 17
I2C > [2d] 09
I2C > [2e] 0e
I2C done 39
I2C > [00] 83
I2C done 1

locali2c_read makes while recording:
localI2C_Read : 390
localI2C_Read : 364