Writings Photos Code Contact Resume
Coding and hacking

You are here

Reverse engineered libomap3camd header file for N9 and N950

Submitted by msameer on Sun, 17/02/2013 - 4:46pm

A short introduction about N9 camera stack:
Camera stack for N9 is built on top of V4L2 subdev and media controller interfaces.
A GStreamer source element called subdevsrc (And subdevsrc2 starting from PR 1.2) sits on top of the kernel interfaces.
A closed source component called libomap3camd (OMAP3 camera daemon library) contains all the 3A (Auto exposure, Auto white balance and Auto focus) algorithms in addition
to image capturing. It simply gathers statistics from hardware components such as ISP histpgram (And others) and controls the camera pipeline to adjust image quality.

What do we have?
Nokia was kind enough to provide a compiled binaries subdevsrc and libomap3camd to the MeeGo project. However they have not released the header files for libomap3camd.

This puts us (The community) in an unfavorable situation. We cannot easily manipulate our GStreamer stack, update or fix bugs in subdevsrc (Whose source code is publicly available).

How about the future?
You can obtain the code from its git repository.
Using the reverse engineered libomap3camd header, I managed to rebuild subdevsrc for NEMO
and got meego-handset camera to work and capture an image :-)

The code built is from this commit:

commit effd37efa3ba026221e0f84ef370d06f1a122b6c
Author: Tommi Myöhänen <tommi.myohanen@digia.com>
Date:   Thu Mar 17 12:38:40 2011 +0200

    Release gst-nokia-videosrc (0.57.0-1)

I failed to build the latest git master due to the old GStreamer photography interface available in Nemo/Mer.

How did all this happen?
It took a day or a bit more of a weekend.
I started by building subdevsrc and creating various enums and structures needed to get it to build (with dummy values).
I then started poking around using the latest nemo mobile release and ltrace.
GstSubdevSrc used 4 functions out of which, cam_set_feature is the most important one.
This approach didn't really work quite well. It seemed that the number of cam_feature_set calls found by ltrace doesn't match those in the code and it seemed that the code used to build the nemo subdevsrc isn't really available.

Here comes N9 to the picture. Thanks to the "beloved" AEGIS framework, ltrace didn't work.
I tried to mock a libomap3camd shared object and LD_PRELOAD it but that also didn't work.

I sat down and wrote a minimal application that would manipulate subdevsrc properties and observe the value of registers (r0 has the library handle but r1 and r2 are really interesting) when gdb breaks on cam_feature_set and I managed to get some values but that was clearly not enough. Even gdb sometimes doesn't break at all :(

The gem was the discovery of a subdevsrc package along with its debugging symbols:
gstreamer0.10-nokia-videosrc-dbg=0.52.19-1+0m6 and gstreamer0.10-nokia-videosrc=0.52.19-1+0m6.
Download and install them (Use inception) and wow! All data structures can be dumped easily using gdb ptype and all enum values can be printed using gdb print.
The only exception was maker_note_t which needed another hack.

And now?
I guess now we can easily update GSTreamer and subdevsrc to the latest and even fix any bugs that we find. I am not sure how crippled our libomap3camd is and whether we can get all subdevsrc working but we are at least in a better position.

Justin TV without flash!

Submitted by msameer on Sun, 11/03/2012 - 3:18pm

Justin TV is a streaming service that uses the broken flash concept in order to allow you to view channels.

Unfortunately it's the only source of Arabic movies, series and shows.

I wrote a GStreamer source that retrieves the channel information and uses libRTMP to connect to the Justin streaming server. The rest is handled by GStreamer ;-)

If you want to watch http://www.justin.tv/ammartv for example, you simply do

gst-launch-0.10 playbin uri=jtv://ammartv

The 2nd plugin is a Totem plugin that indirectly utilizes the GStreamer source.
Given a language code (ar or en or ...), it will download the list of channels in that language and shows them in Totem's side panel. One can then easily double click on a channel and simply watch it. I originally wanted to do the Totem plugin in python but the inability to do asynchronous callback based HTTP requests prevented me :-(

Be warned that the code is of course a bit buggy and needs a lot of cleanups, it's been years since I coded anything in Gtk and that Justin might find out and either block the source somehow or even change the protocol but let's wait until that happens ;-)

N9/N950 camera with zoom during video recording!

Submitted by msameer on Thu, 10/11/2011 - 12:17pm

If you are using PR 1.1 then you can simply enable zoom during video recording.

Just create a file /etc/camera.conf and add the following lines:

recording-zoom = true

restart camera, enjoy and send postcards to the Harmattan camera team :)

I hope someone will create an Ovi store app for that ;)

Increase the font size of the N9 conversation view.

Submitted by msameer on Wed, 02/11/2011 - 10:42pm

If you care about the readability more than you care about the eye candy then that's for you ;-)

1) You need to enable developer mode and ssh to the N9.

2) # mkdir -p /usr/share/themes/blanco/meegotouch/libmessagingwidgets0/style/

3) # vi /usr/share/themes/blanco/meegotouch/libmessagingwidgets0/style/libmessagingwidgets0.css

4) Insert the following lines:

BubbleItem MLabelStyle#BubbleItemMessageIncoming {
font: $FONT_FAMILY 32px;

BubbleItem MLabelStyle#BubbleItemMessageOutgoing {
font: $FONT_FAMILY 32px;

BubbleItem MLabelStyle#BubbleTimeStampLabelOutgoing {
font: $FONT_FAMILY light 32px;

BubbleItem MLabelStyle#BubbleTimeStampLabelIncoming {
font: $FONT_FAMILY light 32px;

5) # su - user
6) $ killall -KILL messaging-ui
7) Enjoy :-)

Introducing vcamera, a virtual V4L2 camera.

Submitted by msameer on Mon, 20/06/2011 - 5:03pm

This is a kernel module I cooked in a couple of days. The idea is to expose a v4l device that gets its data from user space.

I had 2 use cases in mind:
1) Educational purpose for myself (I'm really a kernel noob).
2) Streaming movies over skype, google talk, ... etc.

The idea could be good or completely rubbish but hey ? Learning can only be done with stupid ideas!

The code is highly unstable. It shouldn't oops the kernel but I'm not responsible. I've been developing and testing it inside qemu.

Clone it from the git repository via:

git clone git@gitorious.org:vcamera/vcamera.git

Here are a few missing bits off the top of my head:

* I'm not following the kernel coding style yet ;-)
* I'm sure my locking, unlocking and concurrency handling is flawed.
* The code is a bit fragile.
* It'd be nice to implement mmap support for the character device. This should eliminate data copies.
* Perhaps expose the character device all the time and generate "fake" frames when streaming starts ? Problem now is one has to be very fast in feeding data to the module otherwise select() on the v4l device will timeout.
* Many more...

If someone finds this idea useful, please drop me a line.
Comments, use cases, ideas and tips are really welcomed!

If I see a lot of interest, I might try to push it to the kernel tree one day ;-)

Update: Seems vloopback already exists and renders my code useless. I might still do something with it as my idea seems a bit simpler but whatever.

Update 2: There's also v4l2loopback and its fork.

Prayer timetable parser for Helsinki (2011)

Submitted by msameer on Sat, 08/01/2011 - 10:12pm

One of the local mosques here used to publish the prayer timetable for the whole year in HTML format. That was fine for me because I had the ability to add a bookmark to the current month to my N900 desktop.

In 2011, some brilliant person decided to publish them only in PDF. The idea itself is not that bad, I just lost the ability to add the bookmark to the desktop. Combine that with the not so great PDF reader for the N900 and my dislike for PDF files in general and you shall understand why I was really annoyed.

I decided to try to convert the PDF to html. htmltopdf is a great tool but the HTML output was horrible and almost impossible to properly cleanup. Each cell was represented by an HTML div that had an absolute position!

At the end, I decided to write a very crude parser that can parse the XML generated from pdftohtml and dump the data to a set of HTML files that I can use and bookmark.

The parser is not a nice piece of code but it works. The HTML files are ugly too but they are fine for me.

The code can be obtained from my SVN repository (C++/Qt). The generated HTML files are in this tarball.

The original PDF can be downloaded from the mosque website.

Warning: I take no responsibility if the generated times are incorrect. You have been warned!

Twitter OAuth Proxy

Submitted by msameer on Tue, 14/09/2010 - 8:55pm

I'm using Twitter plugin for Contacts and Conversations to twitter on my N900.

Twitter recently moved to OAuth. Problem is the Maemo package is outdated and seems to be unmaintained.

I did some research and came across a blog entry about exploring OAuth-protected APIs and some code. Nice idea but not usable for me.

I ended up sitting down and writing a small python script that will re-route your HTTP requests to api.twitter.com after adding all the OAuth bills and whistles, read the reply from twitter and send it back. Neat ? :-)

There's also supertweet.net which I've discovered after I finished writing my script but seems they don't support all of the twitter API call while my script does that.

The script is simple without much error checking but it's been working for me for a few days already.

Last thing, I'm not interested in running a service like supertweet. I'll not be implementing the full OAuth protocol. Need to use it ? Register your own application.

Get the code while hot!

git clone git@gitorious.org:twitter-proxy/twitter-proxy.git

Next step: Thinking of maintaining the twitter plugin for Maemo. I already compiled the latest code and it sort of works fine :-)

QTestLib tip

Submitted by msameer on Fri, 20/08/2010 - 1:52pm

If you are doing a data driven test using QTestLib, make sure the column names you define in the data function matches the variable name you pass to QFETCH()

void Test::foo_data() {
void Test::foo() {
  QFETCH(QString, foo);

I previously thought the order is enough but I lately spent a day and a half trying to understand why QTestLib refuses to fetch my variables.

ISI specifications for Nokia modems.

Submitted by msameer on Sun, 25/04/2010 - 9:48pm

A serious limitation of the N900 connectivity subsystem IMHO is the inability to create multiple connections. One can only have one connection at a time. This was a problem when I started investigating MMS support for N900.

Of course one can use some undocumented API like fMMS to have more than one GPRS connection. There's only 1 problem with that approach. You can end up with IP/subnet clash.

I've been thinking about a kind of hacky solution for the MMS problem: Let's have a tun interface with a known IP such as or 192.0.2.x. We force all of our traffic through that interface and "something" sits in the middle to route the data between tun and the GPRS modem.

Sounds easy but not that easy.

The only information available about ISI modems and GPRS manipulation is some patches adding GPRS support to Ofono.

I've been playing with them for a few days. I managed to get a PDP context which fails to activate.

Hmmm, Googling a bit revealed the Symbian Modem Adaptation project. The code is there but it wasn't enough.

What I didn't notice initially was a semi-hidden link to the wireless modem API server. There I found not only complete documentation for ISI; but also header files with al the constants. More than the ones available from the GPRS patches.

Now manipulating the modem is just the matter of reading the documentation (READ the license aggrement first before you get them), creating a bunch of phonet sockets, using sendmsg() and recvfrom() and parsing the output.

Now I wont wonder why does my phonet packet:

23:19:10.543792 Out ethertype Unknown (0x00f5), length 47:
        0x0000:  006c 3100 1a00 6a37 0600 2100 0000 0205  .l1...j7..!.....
        0x0010:  0e08 696e 7465 726e 6574 0040 0190 04    ..internet.@...

look different than the one sent by the connection manager:

23:16:58.296905 Out ethertype Unknown (0x00f5), length 47:
        0x0000:  006c 3100 1a00 6800 0600 2100 0000 0205  .l1...h...!.....
        0x0010:  0c08 696e 7465 726e 6574 0090 0402 00    ..internet.....

I'm using 0x0e while they use 0x0c

There'a also a hidden excel (DUH!) sheet showing which ISI API is mandatory and which is not.

Happy hacking!

P.S. This might be old information but I've just discovered it.

MMS support development to be suspended until the end of February.

Submitted by msameer on Wed, 03/02/2010 - 6:11pm

The gitorious repository now contains a broken mms-manager, a non functional mms-ui (because I changed the DBus interface ;-)), a preliminary mms viewer and a broken network connection manager. How pretty is that ? ;-)

I've been redesigning the DBus interfaces and I think I reached something. The UI can be easily adapted after that.

However, I'll be on vacation until the end of February. I can't work on mms until I'm back.

I'll try to commit and push the code I have on my laptop but the stuff will still be broken.

This is just a quick status.

Good wishes for the newly married couple ;-)