Skip to content

Hacking the Dell SX2210T, part 2.

Tonight, i’ve tryed to analyse more the header part, and understand how data part work. And… found something !

Header part

After a long session of touching the screen, and dumping the first 32 bytes, here is the current header decomposition :

    Structure
    =========

    Idx Name            Values(hex)
    0   Format          5b
    1   Format          5d
    2   Request ID      *
    3   Unknown         1
    4   Unknown         c1,c3
    5   Unknown         1
    6   Unknown         0
    7   Unknown         1
    8   Unknown         *
    9   Unknown         *
    10  BufferType FL   [01][012]   00, 01, 02, 10, 11, 12 < order when no touch ?
    11  Unknown         0
    12  Unknown         1d,2b
    13  Unknown         1
    15  Unknown         bc,b6
    16  Unknown         [08][cd]    0 when touching ?
    17  Unknown         *           17/18 seem a value who stay the same in time
    18  Unknown         *           when touching (except changing them every 2s)
    19  Unknown         4*

    Special cases
    =============

    When len is 845, we always get same frame (32 bits):
    5b 5d b6 03 45 02 02 01 01 bc 01 15 00 6e 10 12
    02 01 10 13 02 01 10 11 03 01 10 14 03 01 10 15

    When len is :
        * 463 - 4(c7) - 10(10)
        * 471 - 4(c7) - 10(11)
        * 467 - 4(c7) - 10(12)
        * 457 - 4(c1) - 10(00)
        * 465 - 4(c1) - 10(01) 19(4d 4e)
        * 467 - 4(c1) - 10(01) 19(4c 4d)
        * 463 - 4(c1) - 10(01) 19(4d)
        * 465 - 4(c1) - 10(02)
        * 469 - 4(c7) - 10(12)

You might not understand at all the header, cause everything is Unknown (i don’t understand too.) But i’ve understand that the data part is changing from the byte 10. The 6 differents values represent a data channel :

  • 0x00: Unknown (maybe a sync signal ?)
  • 0x01: Sensor 1 signal
  • 0x02: Sensor 1 signal (nearly the same as 0x01, but not :/)
  • 0x10: Unknown (maybe a sync signal ?)
  • 0x11: Sensor 2 signal
  • 0x12: Sensor 2 signal (nearly the same as 0x11)

Data part

And… to understand more the data part, i’ve tryed to draw the data part on a line (green = 0x01, blank = 0x02): X represent the index (starting from 20), Y value represent the byte at the index :
2009-11-26-010549_1920x1080_scrot.png
2009-11-26-010459_1920x1080_scrot.png

I’ve tryed to convert data to {unsigned|signed}{short,int,float}, without success.

And i’m stuck. I see thing changing fast, i see position of my finger on the data. Do i need signal analysis ?
So, i’ve write to nextwindow, and ask more information about protocol part, and analysis part. I hope they will respond to me 🙂