Google
 
Web www.howardforums.com
Pages: 1

Kyocera ke433 (aka K7 Rave) Carrier Logo

(Click here to view the original thread with full colors/images)

Posted by: steelbeak

Long story short, I've been able to change the carrier logo on my ke433. What I'm looking for is details.

What is the size of the carrier logo on the ke433? The manual that comes with the PST says something like 89x42 but that proved too small. A forum post here said 160x90 but that proved too large. It looks like the real value is somewhere around 102x68 or so. Does anyone know the exact size (or max size)?

Also, does anyone have any info on this BQR format that the ke433 (and others) use? Are there any apps out there that convert 4-bit greyscale bitmaps to 4-bit BQR's? The app that comes with the PST only understands (and converts) 1-bit bitmaps, but the original carrier logo on my ke433 clearly had more than 2 colors. I'd like to either get more info on the SQR format and write my own convertor or find an app that can do the conversion of 4-bit bitmaps.

Thanks,

-Sb


Posted by: steelbeak

Through a little bit of trial-and-error I've found that the max dimensions for the Kyocera KE433 (K7 Rave) is 104x67.

The UIREZ app that comes with the Kyocera PST is definately limited to 1-bit (b&w) bitmaps.

Anyone know of any apps that'll convert a 4+ color bitmap to this SQR format?


Posted by: steelbeak

The original VM logo was 104x60

I'll post my notes here as I try to reverse the BQR format.

I've been doing some work by converting all black and all white 2-bit bitmaps to BQR via the UIREZ app that comes with the PST.

It appears that BQR comes in at least 2-bit and 4-bit formats, although I'm sure it comes in 8-bit color as well for some of Kyocera's other phones/PDAs that support color.

I'll focus on 2-bit color images first.

Each pixel is stored as a single bit, so that means there's 8 pixels per byte of information. Each byte represents an 8 pixel vertical section of the image. The following byte of pixels are placed horizontall next to the previous 8 pixels from left to right. So the first 16 bits (2 bytes) of image data (after the header) is displayed onscreen in the following pattern:

01 09
02 10
03 11
04 12
05 13
06 14
07 15
08 16 ... and on it goes

Assuming W = width of the image in pixels, after W bytes (thus W 1x8 blocks of pixels), the next group of pixels is placed below the very first. So if we continue the with the data starting at byte W, the next 16 bits (2 bytes) of information appear on screen as:

W*8+01 W*8+09
W*8+02 W*8+10
W*8+03 W*8+11
W*8+04 W*8+12
W*8+05 W*8+13
W*8+06 W*8+14
W*8+07 W*8+15
W*8+08 W*8+16

After another W bytes, the first 16 bites of the third 8-pixel tall line would be:

W*2*8+01 W*2*8+09
W*2*8+02 W*2*8+10
W*2*8+03 W*2*8+11
W*2*8+04 W*2*8+12
W*2*8+05 W*2*8+13
W*2*8+06 W*2*8+14
W*2*8+07 W*2*8+15
W*2*8+08 W*2*8+16

So that's how 2-bit image data is stored. Now what happens if the height of the image isn't a multiple of 8? That I'll haven't checked yet, but I'm guessing it follows the same pattern, just x pixels tall rather than 8.

This matches up with what I've been seeing. But I haven't had time to explore this yet.

I'm also working on what the header structure is like. Obvious width and height fields are there, apparently 4 bytes wide on each field.

There's a footer at the end of the image that I'm not sure what to make of at the moment. I don't know if maybe that's a second copy of the header because some phones read in the image data differently or what.

Lots of trial-and-error stuff.

If anyone has any insight into this, or sees a similarity here with some known image format, I'd love to hear about it. I'm not much on reversing.


Posted by: AndrewSFM

I've been looking into trying to modify/create/edit these BQR images too.

The only thing I've been able to do is create a blank BQR file from editing the existing file downloaded from my Blade into a hex editor, and changing the values to make the image blank.


Posted by: steelbeak

Hey AndrewSFM, good to hear that there's someone other than me interested in this. Was the logo you blanked a 1 or 2 bit color logo?

Onto a followup from my previous post. What happens when the height of the BQR image is less than a multiple of 8?

It's the same as before, 1 byte for every 8 1x8 (vertical) block of pixels. If the image isn't a multiple of eight, those extra bits are essentially ignored, but the UIRez app sets them to 0 (equivalent of white on the phone's screen).

So let's say we have a 4x4 pixel, solid black image. That's 4 bytes of data. 1 byte for each single pixel horizontally and 8 pixels vertically. But we've only got 4 pixels being used vertically. The other 4 bits in each byte are going to be set to 0 and ignored by the cell phone when displaying the logo.

If we look at the individual bits, it would look something like this, where 1 = black and 0 = white

1 1 1 1
1 1 1 1
1 1 1 1
1 1 1 1
0 0 0 0 (ignored)
0 0 0 0 (ignored)
0 0 0 0 (ignored)
0 0 0 0 (ignored)

or 0x0F 0x0F 0x0F 0x0F.


2-bit color seems to be setup very similar, except instead of 8 pixels per byte there are 4. The 2-bit pixel images seem to have a larger header, though, and with no program to learn from on how they're made, I'll have to continue focusing on figuring out the 1-bit header structure and try to match up as much as I can with the 2-bit images.

Those looking to get into mucking with this sillyness only need a copy of the UIRez app from the Kyocera PST (any version seems to work fine) and a hex editor. That's all I've been using.

-Sb


Posted by: steelbeak

Here's a piece of C code describing the structure of the header and footer of the BQR image file format.

I'm guessing a and b variables could/should be combined into a single 4-byte in value.

Everything in parentheses are guesses on how the value for that variable is formed.

Using the default values and the formulas given in the parentheses for each field, there should be enough here to build a valid 1-bit BQR image.

2-bit BQR images seem to follow this structure as well, although there are a couple curiosities that I'm trying to look into by having others e-mail me their carrier logo.

It would appear that the presence of a header and footer, as well as some guessing being made on my part, would indicate that BQR is meant to be read both backwards and forwards. So perhaps some versions of Kyocera phones read the files backwards while others read them forwards... I'm not sure.

I'll have to do some tests. Maybe fill the footer with junk and put it on my phone and see if the logo still renders properly. Then fill the header with junk and do the same.

For now I'm just trying to keep track of what progress I'm making.

Any suggestions, insight, or help is greatly appreciated.

-Sb

Code:

typedef struct STRUCT_BQR_HEADER
{
	short	a;		// 0x0010
	short	b;		// 0x0002
	int	c;		// 0x00000002
	int	d;		// 0x00000020
	int	e;		//		( ? bytes used for image data + 16 )
	int	f;		//		( ? e + 32 or offset at which footer exists )
	int	g;		// 0x00000030	( ? size of header or offset at which image data begins )
	int	h;		// 		( ? filesize in bytes - 8 )
	int	i;		// 0x00000001
	int	width;		// width in pixels
	int	height;		// height in pixels
	int	l;		// 0x00000010 for 1-bit , 0x00000014 for 2-bit ( ? flags )
	int	m;		// 0x00000001 for 1-bit , ( ? 0x00000203 for 2-bit )
} t_HBQR;	// 48 bytes

tyepdef struct STRUCT_BQR_FOOTER
{
	int	n;		// 0x00000020	( ? same as d )
	int	o;		//		( ? same as e )
	int	p;		//		( ? same as f )
	int	q;		// 0x00000030	( ? same as g )
	int	r;		//		( ? same as h )
	int	s;		// 0x00000001	( ? same as i )
	int	t;		// 0x00010000
	int	u;		// 0x00000020
	int	v;		// 0x00000006	( correlates to BITMAP value in bmp2bqr )
	int	w;		// 0x00000008
	int	x;		// 0x000000D3	( correlates to UIBM_CARRIERLOGO or other value passed to BITMAP() in bmp2bqr )
	int	y;		// 0x00000000
	int	z;		// 0x00000020
	int	aa;		// 		( ? same as f )
} t_FBQR;	// 56 bytes



Posted by: steelbeak

Here's a table comparing various BQR image sizes and the values of each field in the header.

Rows are header fields, columns are the image size.

xlogo is the 2-bit color carrier logo from my phone.

When compiling a BQR image you get a message saying something like "data utilization N% ( X of Y)" where X and Y are, (i assume), some number of bytes.

Y seems to always be the filesize. X seems to be related to the size of the image data. For xlogo, I couldn't know for certain what these values are since I can't compile 2-bit BQR images (yet!) but I can sure guess at those values.

-Sb

Code:

+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+
|        | 104x63 | 104x64 | 104x65 | 104x66 | 104x67 | 105x63 | 105x64 | 105x65 | 105x66 | 105x67 | xlogo  |
+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+
| a      |     16 |     16 |     16 |     16 |     16 |     16 |     16 |     16 |     16 |     16 |     16 |
+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+
| b      |      2 |      2 |      2 |      2 |      2 |      2 |      2 |      2 |      2 |      2 |      2 |
+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+
| c      |      2 |      2 |      2 |      2 |      2 |      2 |      2 |      2 |      2 |      2 |      2 |
+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+
| d      |     32 |     32 |     32 |     32 |     32 |     32 |     32 |     32 |     32 |     32 |     32 |
+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+
| e      |    848 |    848 |    952 |    952 |    952 |    856 |    856 |    961 |    961 |    961 |   1580 |
+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+
| f      |    880 |    880 |    984 |    984 |    984 |    888 |    888 |    996 |    996 |    996 |   1612 |
+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+
| g      |     48 |     48 |     48 |     48 |     48 |     48 |     48 |     48 |     48 |     48 |     48 |
+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+
| h      |    928 |    928 |   1032 |   1032 |   1032 |    936 |    936 |   1044 |   1044 |   1044 |   1660 |
+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+
| i      |      1 |      1 |      1 |      1 |      1 |      1 |      1 |      1 |      1 |      1 |      1 |
+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+
| width  |    104 |    104 |    104 |    104 |    104 |    105 |    105 |    105 |    105 |    105 |    104 |
+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+
| height |     63 |     64 |     65 |     66 |     67 |     63 |     64 |     65 |     66 |     67 |     60 |
+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+
| l      |     16 |     16 |     16 |     16 |     16 |     16 |     16 |     16 |     16 |     16 |     20 |
+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+
| m      |      1 |      1 |      1 |      1 |      1 |      1 |      1 |      1 |      1 |      1 |    515 |
+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+
| X      |    848 |    848 |    952 |    952 |    952 |    856 |    856 |    961 |    961 |    961 | ? 1580 |
+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+
| Y      |    936 |    936 |   1040 |   1040 |   1040 |    944 |    944 |   1052 |   1052 |   1052 | ? 1668 |
+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+
| size   |    936 |    936 |   1040 |   1040 |   1040 |    944 |    944 |   1052 |   1052 |   1052 |   1668 |
+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+--------+



Posted by: AndrewSFM

Quote:
Originally posted by steelbeak
Hey AndrewSFM, good to hear that there's someone other than me interested in this. Was the logo you blanked a 1 or 2 bit color logo?


It was a black and white image, that I hex edited to make all white. I've emailed them to you like you requested in your other thread.


Posted by: realgt

i'm in on this too...but i'll wait till you guys program a quick converter app to change my bmps to bqrs... j/k lol

you both ought to be commended for documenting your progress into this obscure interest...this is why forums are great


Posted by: steelbeak

Quote:
I've emailed them to you like you requested in your other thread


Thanks! I got them.

I'm spending the next couple of days workin on a simple bitmap library. At least enough of a library for the purposes of converting 1 and 4 bit BMPs to BQRs.

I'll update as things progress.


Posted by: steelbeak

I've got an app that's taking 1-bit bitmaps and outputting the BQR image data.

So it's a relatively short jump (faking the header/footer of the BQR) to produce an app that's going to take 1-bit BMPs and make them 1-bit BQRs.

Right now I want to reverse the bmp2bqr function so I can do bqr2bmp conversion and test to make sure my guess on the 2-bit BQR image structure is correct.

Then I'll have to write a function that'll convert 4-bit BMP data into an interim 2-bit grayscale data format that the bmp2bqr function will work with. I may have it that only the first 4 colors in the BMP color table get used, and leave it up to the user to make sure they have only 4 colors in their 4-bit bmps. or I may do something else that'll pick the top 4 colors used... eventually develop something that averages the 4-bit color table into 2-bit values. I dunno.

Once I get something I'm happy with I'll attach the source and an executable.

-Sb


Posted by: steelbeak

One more thing.

I ran an app I made that spits out the header structure of BQR files, at least as I think the BQR header is structured.

The 1-bit BQRs I have, and the single 2-bit BQR that came off my phone worked fine.

The logos AndrewSFM sent me don't. Most of the default header values that I'd guessed on are there and in the right place, but the width and height values aren't correct.

So I'm going to need to work some more on the BQR header structure. :\


Posted by: AndrewSFM

I would love to help you develop the program to convert from one format to the other, but I haven't the slightest clue when it comes to programming. Sorry.

Any additional info I can provide you with?
I'm willing to help out any way I can.


Posted by: steelbeak

Just took a break to work on a few other projects of mine.

First thing worth noting is that it appears that the default value for padded bits is the value for the first entry in the bitmap's color table. So a b&w bitmap with white as the first of two colors in the color table will have all padded (unused) bits set to 1. Whereas a bitmap with black first has 0 for the padded bits. In reality, it shouldn't matter what is used, but at least this now explains why I've been seeing different values for padding.

AndrewSFM sent along copies of his carrier logo BQRs. My guess at the footer's structure holds up exactly with his logos, but the header is different for his than the carrier logo on my KE433 and those generated by the UIRez app that comes with Kyocera's PST.

The difference is that it appears width and height values are stored as short (two byte) values rather than int (four byte) values. This means the 4 bytes used to hold just the width (according to the header structure I outlined before) now has both the width and height. The 4 bytes used to normally hold the height value have a value of 0x00000003.

This gives me dimensions of 104x68 for AndrewSFM's logos. That's the same size for the logos that came with my phone.

I'm not sure what to make of this. The rest of the header, except for the last two values after width/height, match up to everything I've seen thus far. I see no flag or other means to inidicate there would be a difference in the structure of the header.

Maybe the last two values in the header (l and m in the header structure defined previously) contain flags to indicate this.

l definately appears to be a flag holder. the three values i've seen in this field are 28, 28 and 16 which, when you break down into bits, you see these values break down nicely into bit flags.

m I have no idea what to make of it. the 1-bit BQRs UIRez makes sets this value to 1 always. The logos with my KE433 set this value to 515 and AndrewSFM's logos have the value 3148.

I think I'll start diving into this and try making some 4-bit images and toss those into my KE433 and see what happens.

If anyone else has the ability to grab the carrier logos from their phones and e-mail them to me at: steel_beak @ hotmail . com I would greatly appreciate it. Thanks.


Posted by: steelbeak

just wanted to fix an incorrect supposition in my last post.

the 'l' field is not flag related.

I've started doing some real tests on the fields i'm unsure of. L seems to act as some kind of memory pointer. When set to 0x10 the start of image data shown on screen starts at the start of image data inside the BQR. When set to 0x14 the first 4 bytes of image data in the BQR are not displayed on screen.

field M is definately where the flags are.

Setting the bit at 0x0200 tells the phone whether to invert the colors or not.

The first 4, maybe 8 bits appear to determine color depth.

I'm also thinking that all fields are actually 2 bytes in size, or at least most of them are. but without any understanding of what does what, it won't really matter much.

The program I'm putting together will just have a default header and footer blocks that will be copied, modified with those fields I do know about, and then written to the file.

I'm not sure of it yet, but I think there may be a field that determines how long the carrier logo is displayed at startup.

Also worth noting, when you have an invalid carrier logo file, the phone boots up with the words "carrier logo" in some script displayed on screen. So there's a backup BQR in the phone's firmware somewhere.

Cool.

-Sb


Posted by: steelbeak

It's working!

I've got an app that's building 1 and 2-bit (2 and 4 colors, respectively) BQRs.

Attached is a ZIP with the application and the source. I'm calling this version 0.1 since there's quite a lot of the bqr headers that I don't understand and there's always room for improvement.

I'll attach my example BQRs and their BMP originals in a follow-up due to the attachment limitations on the board. (Had the attachment limit been set to 20k I would have been able to fit it all in a single zip).

Right now this is only doing 1 and 2 bit BQRs. You can pass it up to an 8-bit color BMP and it'll (do a rather crude job of) grayscale and downsample the image to 4 colors.

This absolutely works on my Kyocera KE433 which has a small 104x67 grayscale screen. I have no idea how this will work on other phones with color displays, although it should work fine, in theory anyways.

Anyone brave enough to give this a shot, let me know if it works for you. And remember to backup your existing carrier logo first!!!

And don't worry, you can't kill your phone with a bad BQR. (at least... I don't THINK you can...) so no worries.

w00!

-Sb


Posted by: steelbeak

Attached is a zip with 2 sample BQRs created with the bmp2bqr app I posted. The zip also includes the original bitmaps they were created from.

It's just a pic of Ed from Cowboy Bebop.

-Sb


Posted by: AndrewSFM

Reading through your posts, one said a size of 104x67 and another said 104x68. Which one is what you meant to say?

I created my own 104x68 and 104x67 size 1-bit bmp files and converted it using your program and loaded it into my phone. Neither showed when I started my phone. It was just blank both times. When I tried to use either as my web logo, it showed the "Carrier WebLogo" message from the firmware both times.

I then tried to use your example 1-bit BQR logo on my phone, for the carrier logo, and again, it did not show. I then loaded the same BQR for my web logo, and tried to turn my phone on, and now I'm getting some error message, and my phone will not start.

It shows the hourglass and then says "Undef Inst Exception lr=0003A80A tk=01071AFC" and will not power off unless I take out the battery.

Time to spend the rest of the night trying to figure out how I get it to work again, before maybe having to go get my phone repaired.


Posted by: realgt

just for comparison purposes, maybe you would be interested in seeing the weblogo bqr for a kyocera slider...resolution is 128x116


Posted by: steelbeak

AndrewSFM: sorry to hear about the phone. is it still down?

It's 104x67 (for my ke433 anyways) but I've found images larger than the screen size will still work, just only the first 104x67 block of that image will be displayed.

realgt: the headers say 128x128. looks like its 8-bit color, but there's no color table so I'm not sure how RGB values are determined. what's the background color of that image, realgt?

The UIRez app that comes with the PST that I have definately doesn't support whatever this alternate BQR header structure is. there's a field in the footer that hold an ID for the target phone model and the value in that BQR isn't one supported by the UIRez app I've got.

Maybe I'll try to find a used slider on ebay or something so that I can experiment.

-Sb


Posted by: AndrewSFM

Quote:
Originally posted by steelbeak
AndrewSFM: sorry to hear about the phone. is it still down?


I actually got it up and running again. Luckily the phone lets me put it into programming mode with the phone powered off, if it's on the charger.

I loaded back my original BQR images and then restarted the phone, and it's back to normal.

*WHEW*

I really was scared there for a while. I've done all sorts of stuff to my phone, including direct modification of the flash memory (i.e. ESN changing among other hex mods to regions of the memory) but never had I run into a problem like I did when I loaded those BQR files.

I'd be willing to try it again though.
Luckily it's still under warranty for another month or so.

Why not modify your app to require a source BMP and an optional BQR file, and the program would read the BQR file the user provided (i.e. size, header, footer, etc) and create a new BQR file based on that for the final output. Understand what I mean?

I'm wondering if I can take a BQR made from a BMP using your program, and take the guts from it, and paste it into the middle of the header and footer of a BQR from my phone. Maybe you could try the same thing too.


Posted by: steelbeak

AndrewSFM: that's great news!

Your idea to use an existing BQR, passed to the program at runtime as a template, is an excellent idea.

I'll work on that over this weekend.

-Sb


Posted by: AndrewSFM

How's it coming along?


Posted by: Celucom

Were u able to convert an 8-bit color BMP to color BQR ???


Posted by: islandintheSUN

where can i get the tool to open a bqr file? and check the image? Thanks.




vBulletin Copyright ©2000 - 2008, Jelsoft Enterprises Limited.
vB Easy Archive Final ©2000 - 2008 - Created by Stefan "Xenon" Kaeser