I did promise more in depth review on the Samsung SGH-i530…

What happens was I spend ALOT of time to get things running on it, as this PalmOS smartphone has never been released to the public, other than the PDF file and the little booklet that came with the box, there is virtually no information about this phone…


So it turns out I have to hack my way thur….

Ok, get into the story!


Studies
I know the phone does support custom ringtone, in the sound setting screen, there is a selection box for user to select differnt ringtone, and the last option was “My Melody”, but there was actually no documentation on what format, where to place the file….

When you select the option “My Melody”, an user interface come up with nothing to select.


After a little bit of study, I found that the “My Melody” selection user interface was actually a part of the Messenger program, which was powered by a company call Jataayu, the program is call JMMS Messenger (version 1.0.0.42e), a bit googling shows that this program was a custom build for Samsung only, I was not able to find any other info on this program.

I suspect ringtone has to be sent to user by MMS, thats why the “My Melody” selection UI was a part of the messenger program, I also suspect that this is due to the so call copyright issue for preventing user to use/send/copy their own ringtone between phones….

Back to the studies, I found that the Samsung SGH-i530 actually support and uses MMF (SMAF) ringtone file format, which is quite common on Samsung phone that support poly-ringtone. (There was a little bit more story on this, as the phone does comes with file named like AMR encode/decode, I thought that it might use ARM file like Treo650, turns out it was used as a part of the Voice Memo App.)

All build-in ringtone was stored in the ROM as “MMF DB” Creater ATTT type MMFD, there are 250 entry of resources “tMMF”, starting from resource ID 2001 to 2250.


the MMF DB File in ROM (click to enlarge)

the MMF file in tMMF resources (click to enlarge)

Using tools for Palm PRC file format (PRCExplorer), MMF ringtone file can be found in each tMMF resource, with a header of the Ringtone name, and some other details that I am not able to identify yet, but MMF file header can easily be seen in binary.

Directions
My first approach was simple and direct, as the phone do have the user interface for selecting custom ringtone, and I already know what file format it support, so the direction goes to “Where to place the file?”.

With no documentation, I start reading dis-assembled 68K code of the messenger program, 20 parts of code segment, after few hours of reading and tracking turns out to be a waste of time because my 68K ASM wasn’t good enough, and btw it wasn’t a easy job anyway…..

So the approach turned the other way round, hacking the MMF Db file in the ROM….

There is actually no Flashing Tools for the Samsing SGH-i530, so I choose the overlay hacking technic.

Overlay was originally designed for a easy way to developer to apply multi-language to their appications, but as my experience, I think it also provide a great way for hackers to gain more access to the apps that was build into the ROM.


the Overlay file for MMF DB File with hacked header (click to enlarge)

Do the work
Using PRC2OVL tools from PalmSource, I was able to build an overlay for the “MMF DB” in the ROM, which only contain 1 single tMMF resource (I choose 2001 for convenience, but same rules applies to all others).
by using a hex editor, I first change the Ringtone name in the binary to my own Ringtone name, with a 00 at the end of the name (my selected ringtone name was shorter then the one in the file, “Numa Numa” vs “A Palyful Wit”), then I paste my selected MMF file in binary with header to the tMMF resources.

(I think it should be even easiler if I do these steps by breaking the overlay in binary first, work with a few lines of perl to inject the MMF into the binary, and rebuild the overlay file by build-prc…..lazy me…….)


At last I sync this MMF_enUS.prc file to the SGH-i530, reset the machine (as MMF DB has been open already on the phone, resetting the machine makes system reload MMF DB with the overlay), and my selected ringtone shows in the first selection of the build-in ringtone.

Reminder: If you have a large MMF ringtone, that is with the header, a single tMMF resource larger then 64kb, copy it to the SDcard first then copy it back to your phone, old hotsync problem, single resource file size are limited to 64kb…..

Conclusion
Before getting this phone I already know that I would have face a lot of problem, like lack of documentation, software support issue, no SDKs……

It is fun for getting things working in your own way, altho 7 hours spend on getting a custom ringtone seems a bit “expensive”, but as PUMBer wailly saids: “that was the fun part isn’t it?”

My feeling was:
It is the machine who drives you, not the other way round!

References
Overlay Tools – Palm

Whats next
Maybe the SMS part…. Chinese Chars cannot be shown in the Messenger program.and no other 3rd party SMS programs seems working in this smartphone…lets see what can be done….