[v6ak]

EDIT: I'm analysing pdh 2. (What does the number mean? See below.)

There are folders like:

0003  0005  0007  0009  000B  000D  000F  0013  0017  0019  001B  001D
0004  0006  0008  000A  000C  000E  0010  0016  0018  001A  001C  001E

In that folders are files like:

0000a  DEFS  MetaData  Offsets  V01

I studied* it. I have found something interetsing in 0000a only.
There are cert. links, jar links, b file (compiled classes - native code) links, RMS names <-> d files mapping. I've found no link to sec file.

I'll try to guess meaning of the directory names and exact structure of these files.

If you have an idea, write here, please.

EDIT:
There are numbers of analysed /tpa/pdh directory snapshots. They should have the same first number if and only if they have a common ancestor. /tpa/pdh in virgin FS is NOT a common ancestor.
Is term 'common ancestor' clear in this context?

• 1 - pdh prom my first FS on my G502 - originally from R1FB001 T-Mobile (abstract)
  
• 1.5 - pdh prom my first FS on my G502 - almost current version (cca 100 apps)
  
• 2 - pdh prom a temporary FS from my G502 (few apps: AccuWeather, Converter, Opera Mini, Opera mini, PIM Wallpaper, QuadraPop) I think that it is from F1RA031.

*) EDIT2: spelling correction: studies -> studied

This post has been edited by v6ak: 04 August 2009 - 06:35 AM

[Jinx13]

My idea is they are created at random depending when the game/app was installed
IE 0001 = was created when the first app was installed, 0002 was created when the second was installed and so on.
I found them following THIS guide but... If you did find a way to reveal which file points to which app that would be great

[v6ak]

// Note that path without leading '/' means path relative from /tpa/pdh - e.g. 0004/000c means /tpa/pdh/0004/000c .

Strings (all strings, I think) are stored in UTF-16/USC-2 encoding (often incorrectly named 'unicode').

Note that my files searcher cannot recognize UCS-2/UTF-16 strings that starts at the second byte. (If you're searching in text files, you would never need it, but if you are searching in binary files, it could be a problem.) Does anybody have an idea how to fix it?

I'm analysing my PDH 1.5 (Don't you know what does "1.5" mean? See it above!)

...\tpa\pdh>ls
0000  0002  0004  0006  0008  000A  000C  000E  0010  0012  0014  0016
0001  0003  0005  0007  0009  000B  000D  000F  0011  0013  0015  0017

No folder is after 0017. (I know that A2uploader's read function ignores empty directories, but they aren't there. I'm now exploring it via phone. I've a patch that allows to view 'Protected files' from activity menu. 'Protected files' means /tpa/.) So there aren't some folders, e.g. 001E.

Links to *.b files are in:

• 0004/0000c
  
• 0004/0001c
  
• 0004/0002c
  
• 0004/0003c

...\tpa\pdh\0004>ls
0000c  0001c  0002c  0003c  DEFS  DelEnts  MetaData  Offsets  V01

Perceptions:

• There are not only 0000a files. "Interesting" files have name according ^[0-9a-f]{5}$ (regular expression) - five hexa numbers.
  
• I think that large files are divided into more smaller files. (PDH 2 has one "interesting" file in 0004 only because there are few apps, I think.)
  
• All files in 0004 in PDH 1.5 contain link to at least one b file. (Same situation in PDH 2)
  
• The final letter of names of "interesting" files maybe depend on the parent folder name.
  
• The directory names are not "randomly" chosen. "Interesting" files in 0004 probably contains links to b files. (Same situation in PDH 2!)
  
• Files like DelEnts and Offsets specify structure of "interesting" files.

Links to d files (RMS "database" - data store for java apps):

• 000C/0000b
  
• 000C/0001b
  
• 000C/0002b
  
• 000C/0003b
  
• 000C/0004b
  
• 000C/0005b

...\tpa\pdh\000C>ls
0000b  0001b  0002b  0003b  0004b  0005b  DEFS  DelEnts  MetaData  Offsets

I compared it with PDH 2. There are similar perceptions.

Links to jar and possibly jad files:
They're together with b files. (Also in PDH 2.)

I think that:

• 0006 contains MIDlet class names. EDIT: It contains also MIDlet suite names, authors and icon links.
  
• 0012 contains some web links.
  
• EDIT: 0007 seems to be very interesting. It contains all FW versions I've had.
  
• EDIT: 0008 maybe contains info about CHAPI.
  
• EDIT: 0009 maybe contains some accosiations, it is also related to CHAPI.
  
• EDIT: 000D maybe contains info about CHAPI.
  
• EDIT: 000E maybe contains info about CHAPI.
  
• EDIT: 000F contains some delete questions. (Java app can have special delete question.)
  
• EDIT: 0010 contains all identifers of java apps.
  
• EDIT: 0014 contains some info about Push Registry (autostarts).
  
• EDIT: 0017 contains install notifyes.

This post has been edited by v6ak: 03 August 2009 - 01:24 PM

[v6ak]

I'll maybe print my PDH 2 and read it while travelling by bus. However, I don't know any app that simply allows print (or generate something printable, e.g. PDF) a folder with files using hexa view. I'd like to can see positions.

[Jinx13]

So what does all this mean

[v6ak]

Jinx13, on 2009-08-04 01:05, said:

So what does all this mean

What don't you understand?

[Boysie]

v6ak, on 2009-08-04 06:53, said:

What don't you understand?

All of it!!

[v6ak]

Well, this topic is about research, not about well-known facts. I've posted two research posts in this topic:

• A quick overview - It is also post you're replying to.
  
• Meaning of some directories in /tpa/pdh

Don't you understand only the first one (the topic you're replying to) or to both of them?

[Jinx13]

Basically I want to no if we can work out which folder is for which game/application

[v6ak]

Jinx13, on 2009-08-04 13:20, said:

Basically I want to no if we can work out which folder is for which game/application

You don't understand the system. For example: /tpa/pdh/0004 contains links to b files, jar files and possibly jads file for all java apps.
I think that the names of the folders are obfuscated. It don't represent order like "first cluster, second cluster, ...".
Folder /tpa/pdh is like a simple database. The folders represents "tables" without names (=with obfusced names). Files in these folders are like parts of the tables (first cluster, second cluster, index of deleted entries, ...).

[Jinx13]

Hmm ok don't think I do understand the system

[v6ak]

I've analyzed something on some papers. Unfortunately, I don't know where they are.

However, I can remember something:
string format
I wrote that strings are stored in UTF-16/UCS-2. It is not exact. The format it:
* 2 bytes - string length in bytes (x) This number has to be even because of string encoding.
* x bytes - string data in UTF-16/UCS-2 (I don't know exactly.)

Note that I haven't seen 256B string or longer so the first byte can have another sense. However, I don't think it.

format of some tables
Some (maybe all) tables (including important table 0004) have simple format. The table is probably repeated records only. The record can have variable length, but fixed format. The length may vary e.g. because of different string length. I didn't recognize all bytes in all analyzed tables. There are some bytes with unknown sense. (Well, I didn't analyze them for a long time. Comparing bytes for normal apps and for special apps will maybe solve it.) However, it is not difficult to know their length. So it is simple to skip them when analyzing the table.

[v6ak]

I've found the papers so I can write the notes here soon

I'll maybe implement a simple analyser as a school project in C.

[v6ak]

So /tpa/pdh/0004 format is there:
There are some files, for example:
* 0000a
* 0001a
* 0002a
* 0003a
* 0004a
* 0005a
* DEFS
* DelEnts
* MetaData
* Offsets
* V01

Note that type String means string described above and format byte[n] means n bytes.

The format of ????a files is obvious: repeated structures with following format in following order:
* byte[0x09] unknownBytes1
* String midletName
* byte[0x15] unknownBytes2
* String midletVersion
* String midletVendor
* String certificateFile
* String applicationId
* String iconFile
* String jadFile (it is empty if the application has no jad file)
* empty String or byte[0x02] (I really don't know the meaning)
* String jarFile
* byte[0x19] unknownBytes3
* byte[unknownBytes3[0x19-1]/*the last byte*/] unknownBytes6
* String aotCacheFile // see http://en.wikipedia....ki/AOT_compiler
* byte[0x1D] unknownBytes4
* String internetConnection
* byte[0x1C] unknownBytes5

// EDIT: some size fixes; internetConnection and unknownBytes5 added
There is maybe a mistake.

// EDIT2: added: unknownBytes6; Should I share parsing code?

// EDIT3: there is my definition + new notes:

// EDIT4:

There is some scratchy code: http://github.com/v6ak/pdh-analyzer
/tpa/pdh/0004 format: http://github.com/v6...h004Record.java

It is more up to date than comments in this topic.

This post has been edited by v6ak: 18 January 2010 - 06:22 PM