RT-4D: реверс прошивки, русификация, кастомный UI, флешеры

- Полный RE стока V3.25 (Cortex-M4F) + FM100B: карта памяти, протокол, codeplug, UI-архитектура
- Русификация: свой CP1251-шрифт + патч рендера, перевод меню и надписей, ребренд Ru-4D V3.25
- Блюпринт переделки UI + C-тулчейн (clang thumbv7em), доказан инъекцией
- Готовые флешеры: WebSerial .html и Windows .exe со вшитой прошивкой
- Дамп SPI рации, стоковая прошивка, инструменты сборки

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

research/probe9.py

@@ -0,0 +1,38 @@
+import io
+data = open(r"C:/Users/vikto/Documents/Claude/rt-4d/radio-spi-dump.bin","rb").read()
+out=io.open(r"C:/Users/vikto/Documents/Claude/rt-4d/analyze/out9.txt","w",encoding="utf-8")
+
+def hx(off,n=64):
+    s=""
+    for j in range(0,n,16):
+        ch=data[off+j:off+j+16]
+        s+="%08x  %s  %s\n"%(off+j,' '.join('%02x'%b for b in ch),''.join(chr(b) if 32<=b<127 else '.' for b in ch))
+    return s
+
+# BLOB1 exact end of pinyin table (first non-GB2312-valid pair)
+seg=data[0x198000:0x1a0000]
+end=None
+for i in range(0,len(seg)-1,2):
+    b0,b1=seg[i],seg[i+1]
+    if not(0xa1<=b0<=0xf7 and 0xa1<=b1<=0xfe):
+        end=0x198000+i; break
+out.write("BLOB1 pinyin table valid GB2312 until %s (len %#x = %d chars)\n\n"%(hex(end),end-0x198000,(end-0x198000)//2))
+out.write("At table end:\n"+hx(end-0x10,0x60)+"\n")
+
+# What's at 0x1c7xxx (the Z-runs)? that's inside zones region? No, zones=0x1c000..0x3c000
+# 0x1c78fe is within zones region (0x01C000+0x20000=0x3C000). So those Z runs belong to zones, not blob1.
+# Real blob1 data is only 0x198000..~0x19d170. Show 0x19c000..0x19e000
+out.write("0x19c000 area (after pinyin table+FF):\n"+hx(0x19c000,0x80)+"\n")
+out.write("0x19d000 area:\n"+hx(0x19d000,0x60)+"\n")
+
+# Is there anything between 0x19e000 and 0x242000 besides FF/00? sample a few
+for a in (0x1a0000,0x1c0000,0x200000,0x240000):
+    nonff=sum(1 for b in data[a:a+0x1000] if b not in (0xff,0x00))
+    out.write("page %#x nonFF/00 count=%d\n"%(a,nonff))
+
+# BLOB2: look for an index table of start offsets. Voice prompts often preceded by
+# a table of u32 offsets. Scan 0x350000-0x352000 region.
+out.write("\nBefore audio region 0x350000:\n"+hx(0x350000,0x80))
+out.write("\n0x351000:\n"+hx(0x351000,0x40))
+out.close()
+print("done")