thermal-printer/reverse_engineering/NOTES.md

MAGIC VALUE: 0x51 78
```js
function getHex(){return Array.from(new Uint8Array(arguments)).map(e=>e.toString(16).padStart(2, '0').toUpperCase()).join(' ');}
```

0. Inspo (cat printer) i motivaciq
1. Sniff s ESP32 i nrF connect
2. TestGen.py, Gledane samo na dannite
    - 0x5178 100% e magic value kato header
    - packetitie zavurshvat na 0xFF
    - `ggVGgJ:%s/5178/^V^M5178/g^MggddG:s/0*$/^M:%s/\(\w\w\)\(\w\w\)/\1 \2/g^M:%&g^M` for data parsing
    - 2ta scripta za visualizirane, ne bqh zabelqzal, che e B/W dithered, a ne grayscale, ochakvah da pop outne kartinkata
    - dataToBin.py, da go gledam s hex editor => do nikude
3. zabivane v PrintPreviewActivity.java
    - printBtn
    - printData
    - nedecompiliraniq handler, emptyMessage-5 => emptyMessage-4
4. Zabivane v activityType (LABEL, OFFICE, ...)
    - predpolagam label, produljavam
5. PrintModelUtils i PrinterModel => x6.java, izvadq argumentite
    - legendarno vim macro:
        `0f(l"ddt,xxj0f(ldw"edt,xxjvi{:s/<C-R>e;/<C-R>d;<CR>?{k0`
6. naj-nakraq v pravilnata posoka: `BitmapToData()` v `PrintDataUtils.java`
7. status byte-ovete rediscovernati: 0x`51 78 A3 00 01 00 00 00 FF` obratno v PrintData (PrintPreviewActivity)
8. v BitmapToData se vika eachLinePixTo...B, no to ne e decomp, zatova gledam eachLine...Gray, sigurno e sushtoto
    - zashto tf raw byte-ovete na dithera se zavirat direktno v packeta, bez packet (0x`51 78 ... FF`).
9. bluskam si glavata, no vednaga vijdam, che v `eachLineP...B` ne e sushtoto, oshte v purvite redove se getva
    width / 8, ochevidno e razlichno.
10. buildvame packeta:
    - enerAgy packet 0x`51 78 AF 00 02 00 <nrg_low> <nrg_high> <crc> FF`
    - printType packet 0x`51 78 BE 00 01 00 <type> <crc> FF`
        Type: `00` - image, `01` - text, `02` - tattoo, `03` - label
    - feedPaper packet 0x`51 78 BD 00 01 00 <textSpeed> <crc> FF` 
11. obratno v BitmapToData:
    - blackeningPacket 0x`51 78 A4 00 01 00 33 99 FF` (quality 3 (51) (0x33) - vinagi za moq printer e tova quality)
        te sa ot 1 do 5 (ot 49 do 53)
    - feedPaper 0x`51 78 BD 00 01 00 0F <crc> FF` - feedPaper(15)
12. obratno v `eachLinePixToCmdB`: polzvam nqkolko regexa, ne pomagat osobeno mn
    - zagrqvam, che DataTrim() vzima (runLenght, byte, arrayList), i byte-a legit e 0x00 ili 0x01
        vseki byte, kojto pravi e `<1b: stojnost na byte-a, 0 ili 1><7b: duljina na run-length(do 127)>`
    - run-length encoding, ako e po-zle ot bitpacking, togava bit-packvame
    - L_0x02fb dataTrim-vame 0, ako izobshto nishto ne sme imali
    - v L_0x0328: stranni kriterii dali sme kompresirali:
        ne sme kompresirali, ako: 1. purviq byte e 0xFF, 2. byte-ovete ne sa width/8 + 1
    - 0x`51 78` + -94(0x`A2`) ako ne sme kompresirali, -65(0x`BF`), ako sme kompresirali
    - 0x`51 78 <A2 | BF> 0 <datalen_low> <datalen_high | 00> <dannite, run-lenghtnati ili bitpack-nati> <crc> FF`
        - da se izfukam, che kompresiqta q nqma v originalniq writeup
12. naj-nakraq q svurshih, obratno v BitmapToData
    - paper packet, ot BluetoothOrder 0x`51 78 A1 00 02 00 30 00 F9 FF`, sled vseki PrintBean, kojto ima .isAddWhite()
    - maj nqma takiva
13. finalna naredba na komandite
14. decode.py, bachka s probite (primeri)
15. kakvo e energy-to?
    - gledam v koda: (concentration-a - Code.DEFCONCENTRATION(4))\*0.15\*d + d, trqbva da e 0x7B2A(=10875), zashtoto tova poluchavam
    - osuznavam, che concentration sigurno e print depth, zashtoto defaulta e 4 ot 1 do 7 (DEF _\[ault\]_ CONCENTRATION = 4)
    - az polzvam 7, znachi (7-4)*0.15.d+d = 10875 => d = 7500, no moderateConcentration-a na X6 e 8000.....
    - moqt printer e x6_n or PrinterModelUtils.java, vse pak ne obqsnqva zashto isCanPrintLabel qvno e false
    - hipoteza: energy = (printDepth - 4)\*0.15\*7500 + 7500, shte testvam
    - hipoteza 2: textEnergy=> energy da e =0 pri textov rejim
16. kakuv e print type-a
    - probvam da send-na snimka kato text, image; text kato text,image; opitam se da dokaram label
17. textSpeed-a e model.textSpeed(10) za text(0x`01`), model.imgSpeed(30) za image(0x`00`) i label(0x`03`)
    - probvajki prednoto, sledq feedPaper-a
18. Da probvam:
    1. da dokaram print type: label
    2. da dokaram print type: text
        - vidq dali energy == 0
    3. probvam pone 2 drugi energy-ta, da vidq dali scale-va pravilno
    4. probvam da sendna snimka kato text, obratnoto, sledq feedPaper-a
19. Findings:
    - kogato printiram document, type: img, printType-a se meni, no nikoga nqma energy i textSpeed = 10
    - energyto naistina e po onazi formula
    - tova s documenta e izkluchenie, sus image i text:
        1. pri image ima energy po formulata, BD=00, textSpeed=30
        2. pri text nqma energy, BD=01, textSpeed=10
    - label-a se durji tochno kato chist image, samo BD=03; nezavisimo dali type-a e setnat na Text ili Image
    - kato mu dam poveche kopiq apparently ne sa otdelni bean-ove, poneje ima blackening pred vsqko i dopulnitelen
    feedPaper(25) sled vsqko => probvam s multiple beans
20. Recreate in script
    - crc-to, deleted59 => gledam lipsvashtoto sus xor na vsichki ostanali, razbiram che e `0x3d`
    - printImage.py -> uspeshno generira commandi
21. Make script actually send BLE packets
    - reading what printer sends back, the 4th byte is 0x00 if phone->printer and 0x01 if printer->phone
21. status (0x`A3`) response (length 3)
    1. status, ends with:
        - =0: ok,
        - 0b1: out of paper, 
        - 0b10: compartment open,
        - 0b100: overheated,
        - 0b1000: low battery,
        - 0b10000: currently charging,
        - 0b10000000: currently printing
    2. labelNum, kakvoto i da e tova
    3. battery level, po nqkakva skala?
22. Bachka
23. Kakvo ostana?
    - kakvo pravi 0xBD FeedPaper?
24. Look back
    - ako imah akul i bqh zabelqzal, che e cherno-bql, mojeshe samo ot protocol capturi-te
no nqmashe da imam compressiq, da znam za type-ove, za energy i t.n.



# Vim commands for easier decompiling
1. `:v/L_0x....:/norm A;^[`
2. `:%s/\(\d\+\)(0x.*)/\1/g`

3. `:%s/\(.* \)\?r\(\d\+\) = \(.*\);$\n\t\(.* \)r\2 = \(.*\);$/\=("\t".submatch(4)."r".submatch(2)." = ".substitute(submatch(5),"r".submatch(2),submatch(3),"")."; \/\/ rule 1")/g`
4. `:%s/\(.* \)\?r\(\d\+\) = \(.*\);$\n\tr\2 = \(.*\);$/\=("\t".submatch(1)."r".submatch(2)." = ".substitute(submatch(4),"r".submatch(2),submatch(3),"")."; \/\/ rule 2")/g`
5. `:%s/int r\(\d\+\) = r\1 \([+-\*\/]\) \(.\+\);/r\1 \2= \3; \/\/ rule 3/g`
6. `:v/r\(\d\+\) = \(\-\?\d\+\);\n.*r\1 \?=.*/ s/r\(\d\+\) = \(\-\?\d\+\);$\n\t\(.*[ (]\)r\1\(.*\)/r\1 = \2;^M\t\3\2\4 \/\/ rule 4/g`
7. `:%s/boolean r\(\d\+\) = \(.*\);\n\tif (r\1\(.*\)$/if ((r\1 = \2\)\3 \/\/ rule XXX/g`
8. `:%s/if (\(.*\)) goto \(L_0x....\);\n\tif (\(.*\)) goto \2;/if ((\1) || (\3)) goto \2; \/\/ rule 6/g`

- broken but still cool: `:%s/if \(.*\) goto \(L_0x....\);$\n\(^\t.*$\n\)\+\tgoto \(L_0x....\);\n\2:$\n\(^\t.*$\n\)\+\4:/if \1 { \/\/ rule 5^M\5\t} else {^M\3\t}/g`

# command order

1. blackening /// ne za vseki bean
2. vsichkite komandi ot EachLinePixToCmdB
    1. enerAgy
    2. printType
    3. feedPaper(textSpeed)
    4. draw
3. paper (ako bean-a ima addWhite)
4. feedPaper(25)
5. paper x2
    bi trqbvalo da gi nqma, poneje X6 e isCanPrintLabel.
6. feedPaper(25) /// ne za vseki bean
7. ne poluchavam devInfo (0x`51 78 A8 00 01 00 00 00 FF`), nz zashto
    i tuk i pri dvata `paper`-a se durji, sqkash X6 ne e isCanPrintLabel

# todo
- [X] writeup
- [ ] grammar check writeup