rt-4d/docs/highlight-value-editor.md

RT-4D Menu Selection → Inverse-Video Highlight — RE Findings & Patch Spec

Firmware: rt4d_stock_v3.25_abs_0x08002800.bin (ARM Cortex-M4F Thumb, load base 0x08002800, size 155740 = 0x2605C). All addresses are virtual (vaddr). File offset = vaddr − 0x08002800.

---

1. Render pipeline (as reverse-engineered)

1.1 Text / glyph layer (confirmed, trusted)

• draw_string @0x08008A50. Signature: (r0=y_page, r1=x_pixel, r2=char*, r3=len, [sp,#0x28]=mode). The mode word at [sp,#0x28] is loaded (ldr r3,[sp,#0x28]) and passed as r3/r7 to the glyph blitters. Advance is +7px per ASCII char (adds r0,r6,#7).
• ASCII glyph blitter @0x08007FB8, CJK blitter @0x08008454. Both copy a 14-byte (7 cols × 2 pages, column-major, 8 vertical px/byte) glyph into a stack buffer via 0x08021828, then transform by mode (r7) before blitting:
  • mode 0 → glyph copied as-is → normal (black text on clear background).
  • mode 1 → mvns every byte (full invert) + edge masks: even byte &=0xFE, odd byte &=0x7F. → INVERSE VIDEO: the whole 7×16 cell becomes a white bar with the glyph punched black, leaving a 1px gap top+bottom for clean row separation. Verified by simulation: mode1(empty cell)=FE 7F FE 7F… (solid bar w/ 1px gaps); mode1(solid px)=00 (black). This is exactly a modern "highlight bar with readable text".
  • mode 2 → odd bytes |=0x80 → sets the bottom pixel of the top page → a thin underline / bottom rule (used for title bars / section headers), NOT a full highlight.
  • mode ≥3 → falls through to normal (mode 3/4 seen in the home screen = plain text).
• LCD framebuffer primitives (128×64 mono, ST7565/UC1701 class, page-addressed over SPI):
  • lcd_set_addr(r0=x, r1=y) @0x08014A7C — maps x → (0xB7−x), sets page/column.
  • lcd_write_col(r0=byte) @0x08014B28 — writes one 8-px vertical column, auto-advances.
  • lcd_flush() @0x08014CB8 — DMA/SPI blit of the composed frame (calls SPI 0x08004CE0).
  • Line geometry: 7px pitch → 18 chars per 128px line; y is a page index 0..7 (menu text is drawn at page/y=4).

1.2 Menu system architecture (retained-mode, staged buffers)

The settings menu (Basic Set, Key Define, Analog Set, Digital Set, Channel Set, Zone Set, Message, Device Name, … full descriptor/label table at 0x0801521C–0x08015440, [submenu/handler ptr][16-byte fixed label] records) is not drawn by a single visible row loop. Instead it is retained-mode:

• Widget-setup helpers stage a menu descriptor into RAM state struct @0x20000CE8 (fields: +1=widget type, +4/5=item count, +2=selected index, +6=sel, +7=flags) and label/value buffers @0x20000A83 (+0x15=current-item text, +0x27=next-item text, +0x17=inline-edit buffer, +0x2a=split/cursor position). Setup entry points: 0x08009C58 (generic selectable list), 0x0800B0B4 (numeric value), 0x0800B100, 0x0800B8D8, 0x08009D3C.
• List refresh 0x0801CB10 computes sel and (sel+1)%count, copies the selected item into the "current" slot (+0x15) and the following item into the "next" slot (+0x27) — i.e. a 2-line window with the selected item always in the top ("current") slot.
• Screen paint / blit happens in the home/menu render dispatcher 0x080142C0, which tbb-dispatches (@0x08014348, on mode byte [struct-1 +0x16], cases 0–6) to 7 small widget painters, all drawing at y=4:
  • case 0 → 0x08014074 (inline field / list-item painter) — see §2.
  • cases 1–6 → 0x080143A0 / 0x080143E6 / 0x08014442 / 0x080144DE / 0x08014514 / 0x0801435A (inline value editors: split a value into segments, draw the edited segment with mode 1 and the rest with mode 0).
• The big per-item value screen 0x08014E20 (called from 0x0800ABD0 / 0x0800B054) is the submenu value/edit dispatch; it feeds text through 0x08009C58 (×8) rather than drawing directly.

Menu-list RENDER routine answer (task item 1): the visible menu row/field is drawn by 0x08014074 (dispatched from the render loop 0x080142C0 via the tbb @0x08014348). 0x08014074 is the only function in the image that both references the menu text buffer (0x20000A83) and calls a glyph blitter — it is the concrete draw site to patch.

---

2. How the current selection is drawn (task item 2)

0x08014074 (reads state struct 0x20000A83; L = [+0x2a] = split/caret position 0..0x10; buf = +0x17 = 17-char item text buffer). All draws at y=4. Decoded:

if [+0x2a] >= 0x11:                      ; buffer full — no caret
    draw_string(y=4, x=1, buf, len=0x11, mode=0)          ; whole line, normal
else:
    draw_string(y=4, x=1,        buf,       len=L,        mode=0)  ; text BEFORE the cursor  (normal)
    draw_string(y=4, x=L*7+1,    buf+L,     len=1,        mode=1)  ; the SELECTED char       (INVERSE)  ← cursor
    draw_string(y=4, x=L*7+8,    buf+L+1,   len=0x10-L,   mode=0)  ; text AFTER the cursor   (normal)

So today the "cursor / selection indicator" is a single character rendered in mode-1 inverse video (a 1-char-wide highlight caret), positioned at column L. The special treatment of the selected index is the middle draw_string call with len=1, mode=1 (instruction sequence: movs r0,#1 ; str r0,[sp] sets mode=1; movs r3,#1 sets len=1). The inline value-editor widgets (cases 1–6 of 0x080142C0) work the same way, inverting the segment currently being edited.

There is no >/triangle glyph and no separate arrow bitmap — the "arrow/left-cursor" the UI shows is this inverse caret block. (The only bitmap-cursor-like helper, 0x08008224, is the battery/RSSI icon drawer, unrelated.) So "remove the arrow" = "stop drawing the 1-char inverse caret and instead inverse the entire selected line".

---

3. Cleanest way to a full-width inverse highlight (task item 3)

Two mechanisms exist; mode-1 is the right one (mode 2 is only an underline):

• (a) Draw the selected row's full text with mode 1 and pad the string to the full 18-col line width so the highlight bar spans edge-to-edge. Because mode-1 inverts each cell (including the space glyph → solid bar with 1px gaps), a right-padded string already yields a full-width readable highlight bar — no separate rectangle-fill routine is required.
• (b) Fill/invert-rect helper: the image has no general "invert rectangle" routine; the only rect-ish primitive is the icon column-writer 0x08008300/0x08008224 (fixed 14-col templates). Re-purposing it is more invasive than (a). So approach (a) is chosen.

For the settings-list specifically the item text is staged into buffers padded with spaces already (buffers are memset-filled to 0x10 with 0x20/blanks by 0x080062EC before the label copy), so a mode-1 draw of the current-slot buffer paints the whole row as a bar.

---

4. Concrete patch (task item 4)

Approach: minimal, in-place, length-safe — switch the selected row's whole draw to mode 1

The selected line is the top / "current" slot of 0x08014074. Replace the 3-segment (normal | inverse-caret | normal) draw with one full-width mode-1 draw of the whole buffer. This makes the entire selected line an inverse highlight bar and eliminates the 1-char caret.

0x08014074 prologue+body bytes (for reference, from offset 0x11874):

0x08014074: 38 b5 22 48 90 f8 2a 00 11 28 09 db 00 20 11 23   ; push; ldr r0,=struct; ldrb r0,[r0,#0x2a]; cmp #0x11; blt; movs r0,#0; movs r3,#0x11
0x08014084: 1e 4a 17 32 01 21 00 90 04 20 f4 f7 df fc 34 e0   ; ldr r2,=struct; adds r2,#0x17; movs r1,#1; str r0,[sp]; movs r0,#4; bl draw_string; b .+
0x08014094: 00 20 00 90 19 48 90 f8 2a 30 00 f1 17 02 01 21   ; movs r0,#0; str r0,[sp](mode=0); ...; movs r1,#1
0x080140a4: 04 20 f4 f7 d3 fc 01 20 00 90 14 48 90 f8 2a 30   ; movs r0,#4; bl draw_string; movs r0,#1; str r0,[sp](mode=1)  ← caret
...

The blt at 0x0801407E (11 28 09 db: cmp r0,#0x11 / blt) already selects between the "full buffer" branch (0x08014080, draws the whole 17-char buffer at x=1,y=4) and the "3-segment caret" branch (0x08014094). The simplest robust change is: make the whole-buffer branch use mode 1, and force execution down that branch always (skip the caret path). That gives a full-line inverse highlight for the item and removes the caret entirely.

Patch — 2 sites, 4 bytes total, no code cave, no length change.

The full-buffer branch at 0x08014080 draws draw_string(y=4, x=1, buf, len=0x11, mode=[sp]). We (P1) force that branch to always run and (P2) make its mode = 1.

P1 — force the full-buffer / highlight branch. Remove the blt that would otherwise divert to the 3-segment caret path, so the full-buffer draw at 0x08014080 always executes:

• vaddr 0x0801407E: original 09 DB (blt #0x08014094) → new 00 BF (nop). (2 bytes)

P2 — make that draw inverse. The branch sets its mode via movs r0,#0 ; str r0,[sp]:

• vaddr 0x08014080: original 00 20 (movs r0,#0) → new 01 20 (movs r0,#1). (2 bytes)

Verified patched disassembly: cmp r0,#0x11 ; nop ; movs r0,#1 ; movs r3,#0x11 ; ldr r2,=buf ; adds r2,#0x17 ; movs r1,#1 ; str r0,[sp] ; movs r0,#4 ; bl draw_string → draws the full 17-char (space-padded) buffer at x=1,y=4 in mode 1; the caret path at 0x08014094 is now dead code.

Result: whenever this widget paints, it draws the full 17-char (space-padded to 18-col line) buffer at x=1, y=4 in mode 1 = full-width inverse-video highlight bar, and the old single-char inverse caret path (0x08014094…) is never reached → arrow/caret removed.

Final patch list — (vaddr, file_offset, original_bytes, new_bytes):

0x0801407E  (off 0x1187E)  : 09 DB  ->  00 BF     ; blt 0x8014094  ->  nop
0x08014080  (off 0x11880)  : 00 20  ->  01 20     ; movs r0,#0     ->  movs r0,#1  (mode 0 -> 1)

Bytes are shown in stored (file) order. Total change: 4 bytes, in place, no length change.

Optional wider fix (cases 1–6 / other menus)

The same 1-char-inverse→full-line-inverse idea applies to the inline value-editor widgets 0x080143A0…0x08014514 and the list refresh 0x0801CB10. Those are out of scope for a minimal, low-risk patch (each edits distinct value fields where a per-segment caret is actually desirable). Recommend shipping only the 0x08014074 change first, verify on-radio, then decide whether the value-editors should also flip.

Alternative (code-cave) approach, if per-row control is wanted

If you later want the highlight on a scrolling multi-row list (rather than the single current-item slot), a code cave is available:

• 0xFF-erased cave: 0x08024AD2, 320 bytes free.
• 0x00 cave: 0x08024778, 336 bytes free. A small Thumb helper could loop rows, calling draw_string(y=row_page, x=1, row_text, 18, mode = (row==sel)?1:0), then hook it in place of the bl 0x08014074. Not needed for the minimal fix above.

---

5. Residual risks & on-radio verification

Risks

1. Buffer padding: the full-line branch draws len = the buffer count. If the item text isn't space-padded to the full 18 columns in every menu that reaches 0x08014074, the highlight bar will only span the text, not the whole line. Mitigation: the setup helpers memset the buffers to blanks (0x20) to width 0x10 before copying the label, so padding is generally present; confirm visually. If a bar is short, extend the draw len to 18 and ensure trailing spaces.
2. Shared painter: 0x08014074 (case 0) may also render non-list inline fields (e.g. a name/DTMF entry field) where the single-char caret was intentional. Forcing full-line inverse there removes the per-char caret — acceptable for a "selected line" look but check text-entry screens remain usable (you lose the char-position caret). If that regresses a text-entry screen, gate the change on the widget-type byte instead of nop-ing the blt.
3. 1px row gaps: mode-1 edge masks leave 1px clear at top and bottom of the cell — this is desirable (separates rows) and matches modern radios; no action needed.
4. Checksum/signature: if the loader validates a firmware CRC/signature, patched bytes must be re-CRC'd. v3.25 is an absolute image at 0x08002800 — verify whether the bootloader checks an appended checksum before flashing.

Verification on-radio

1. Flash patched image. Enter Menu. The currently-highlighted item should show as a solid inverse bar (white background, black text) spanning the line width; the old 1-char arrow/inverse caret should be gone.
2. Scroll up/down: the highlight bar must follow the selection (top "current" slot) and text stays readable at every position.
3. Enter a submenu with a numeric value (e.g. Backlight / Light Timer) — confirm value screens still render (those go through 0x08014E20, unaffected).
4. Open a text-entry screen (Device Name / Message) — confirm it's still operable (risk #2). If the editing caret is needed there, switch to the type-gated variant.
5. Watch for any garbled top line at boot/home screen (shared render dispatcher 0x080142C0) — the patch only alters case-0 widget, home layout should be unchanged.

---

Address quick-reference

what	vaddr
draw_string	0x08008A50
ASCII glyph blitter (mode in r7)	0x08007FB8
CJK glyph blitter	0x08008454
lcd_set_addr / lcd_write_col / lcd_flush	0x08014A7C / 0x08014B28 / 0x08014CB8
menu descriptor/label table	0x0801521C–0x08015440
list-widget setup (generic)	0x08009C58
list refresh (current/next slot)	0x0801CB10
screen render dispatcher (tbb)	0x080142C0 (tbb @0x08014348)
selected-row painter (PATCH SITE)	0x08014074
menu state struct / text buffers (RAM)	0x20000CE8 / 0x20000A83
code caves	0x08024AD2 (320B, 0xFF) / 0x08024778 (336B, 0x00)