One of the most interesting and most discussed features for the WDTV HD are GUI / OSD modifications. There are already a lot of modifications out there, several icon sets (WDTVForum Thread) and some themes (e.g. from reaverxai or here ) which give the WDTV GUI a complete new feeling. But current available mods only focus on static content, e.g. do not display context sensitive information for the current Folder / Movie.
In order to produce great GUI features like the ones from MovieJukebox we need an event mechanism that allows you to generate the GUI description (XML + images) on the fly for the current directory.
As it turns out its not that easy. Our first idea was to modify the OSD XML files the moment the dmaosd process (GUI program for the WDTV) access the directory. With a custom filesystem where you control everything this is no problem as you get notified when someone accesses your directory. Unluckily the dmaosd process first reads the OSD XML files and after that access the directory. So you always end up one directory short when you want to modify the files on the fly.
The next tries were all going in the direction to monitor what the dmaosd process does. There are several access points for this: The dmaosd process outputs lots of information to the console, including sometimes the access directory. But this output comes too late, i.e. also after the XML files are loaded. So no luck there.
AirSeb over at the WDTV Forum tried the same things and also hacked a clever solution that works and uses several elements. He monitors the dmaosd output to get the current directory, then, to get the selected directory, he monitors the infrared commands. So basically he counts the ups and downs and page up / downs and then calculates the next directory when the user hits “Enter” on the remote. He also has this working to create a cool GUI, see the first post in the thread.
However, the IR hack IMHO poses some problems when deployed to a wider user base:
- when the theme changes the number of displayed items may change, so page up/down can be interpreted wrongly
- the OSD skips when you hold the up/down key pressed some pages, i.e. scrolls faster, maybe hard to track this
- when the directory content changes during the navigations, the results may be inaccurate (e.g. in a torrent incoming folder)
So, I got hacking on a solution and what follows are the adventures through the depths of the dmaosd process’ memory. The first part was to access the memory at the correct point in time, so just before the dmaosd process loads the XML files. To get this information I wrote a simple FUSE overlay based on fusexmp that intercepts all file system level calls to the /osd directory. So on the file open call for the basic_browse.xml I performend an analysis on the dmaosd process’ heap and stack memory. There were several occurrences of the current directory in the heap without any pattern or information if they were still used or just freed memory. So, I added the stack memory to the analysis and did a reverse lookup for all addresses of all strings I found in the memory, tracking back and searching for pointers to the strings. After an analysis of different memory images for different folders I found the common base address that was always the same. With this information it was easy to write a program that accesses the specific memory address and follows the pointer to the directory string.
The analysis itself is not very fast and takes several seconds (because the memory is searched dozens of times to find all pointer references), but since the pointer location in the stack memory is fixed the pure lookup is not noticeable.
Anyone who wants to take a closer look at the memory analysis tools because he wants to see if there is other information in the memory that may be useful can find the source code in the Subversion.
The next step is to combine the tool that performs the lookup (get_path.c) with an OSD overlay that executes a script every time a directory is reloaded. This way its easy for other’s to use this mechanism to produce context / directory sensitive GUI. Stay tuned.