RT-4D: реверс прошивки, русификация, кастомный UI, флешеры

- Полный RE стока V3.25 (Cortex-M4F) + FM100B: карта памяти, протокол, codeplug, UI-архитектура
- Русификация: свой CP1251-шрифт + патч рендера, перевод меню и надписей, ребренд Ru-4D V3.25
- Блюпринт переделки UI + C-тулчейн (clang thumbv7em), доказан инъекцией
- Готовые флешеры: WebSerial .html и Windows .exe со вшитой прошивкой
- Дамп SPI рации, стоковая прошивка, инструменты сборки

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

research/probe5.py

@@ -0,0 +1,35 @@
+data = open(r"C:/Users/vikto/Documents/Claude/rt-4d/radio-spi-dump.bin","rb").read()
+
+def hexdump(off, n=128):
+    for i in range(0, n, 16):
+        chunk = data[off+i:off+i+16]
+        h = ' '.join('%02x'%b for b in chunk)
+        a = ''.join(chr(b) if 32<=b<127 else '.' for b in chunk)
+        print('%08x  %-47s  %s'%(off+i, h, a))
+
+# The transition zones between 0x80 runs in BLOB2 - dump around a boundary
+print("### BLOB2 boundary at ~0x352845 (0x80 run ends here)")
+hexdump(0x352840-0x20, 0x120)
+
+print("\n### BLOB2 boundary at 0x353b25")
+hexdump(0x353b00, 0x80)
+
+# check byte histogram of a single 'record' 0x352000..0x353b25
+from collections import Counter
+c=Counter(data[0x352000:0x353b25])
+print("\nBLOB2 record0 (0x352000-0x353b25) len", 0x353b25-0x352000, "hist top:", c.most_common(10))
+
+# BLOB1 - the 14KB dense CJK. Check for structure: is it pure 2-byte GBK codes?
+print("\n### BLOB1 0x198000 first bytes stats")
+seg=data[0x198000:0x19b800]
+# count high-bit-set bytes
+hi=sum(1 for b in seg if b>=0x80)
+print("len",len(seg),"high-bit bytes",hi, "ratio", hi/len(seg))
+# Interpret as GB2312: pairs where b0 in 0xA1..0xF7
+pairs=0; valid=0
+for i in range(0,len(seg)-1,2):
+    b0,b1=seg[i],seg[i+1]
+    pairs+=1
+    if 0xa1<=b0<=0xf7 and 0xa1<=b1<=0xfe:
+        valid+=1
+print("2-byte pairs",pairs,"valid GB2312 lvl",valid, "ratio",valid/pairs)