Hacking the Dell SX2210T, part 2.

Tonight, i’ve tryed to analyse more the header part, and understand how data part work. And… found something !

Header part

After a long session of touching the screen, and dumping the first 32 bytes, here is the current header decomposition :

    Structure
    =========

    Idx Name            Values(hex)
    0   Format          5b
    1   Format          5d
    2   Request ID      *
    3   Unknown         1
    4   Unknown         c1,c3
    5   Unknown         1
    6   Unknown         0
    7   Unknown         1
    8   Unknown         *
    9   Unknown         *
    10  BufferType FL   [01][012]   00, 01, 02, 10, 11, 12 < order when no touch ?
    11  Unknown         0
    12  Unknown         1d,2b
    13  Unknown         1
    15  Unknown         bc,b6
    16  Unknown         [08][cd]    0 when touching ?
    17  Unknown         *           17/18 seem a value who stay the same in time
    18  Unknown         *           when touching (except changing them every 2s)
    19  Unknown         4*

    Special cases
    =============

    When len is 845, we always get same frame (32 bits):
    5b 5d b6 03 45 02 02 01 01 bc 01 15 00 6e 10 12
    02 01 10 13 02 01 10 11 03 01 10 14 03 01 10 15

    When len is :
        * 463 - 4(c7) - 10(10)
        * 471 - 4(c7) - 10(11)
        * 467 - 4(c7) - 10(12)
        * 457 - 4(c1) - 10(00)
        * 465 - 4(c1) - 10(01) 19(4d 4e)
        * 467 - 4(c1) - 10(01) 19(4c 4d)
        * 463 - 4(c1) - 10(01) 19(4d)
        * 465 - 4(c1) - 10(02)
        * 469 - 4(c7) - 10(12)

You might not understand at all the header, cause everything is Unknown (i don’t understand too.) But i’ve understand that the data part is changing from the byte 10. The 6 differents values represent a data channel :

Data part

And… to understand more the data part, i’ve tryed to draw the data part on a line (green = 0x01, blank = 0x02): X represent the index (starting from 20), Y value represent the byte at the index :

I’ve tryed to convert data to {unsigned|signed}{short,int,float}, without success.

And i’m stuck. I see thing changing fast, i see position of my finger on the data. Do i need signal analysis ? So, i’ve write to nextwindow, and ask more information about protocol part, and analysis part. I hope they will respond to me :)