cyrozap / mct-usb-display-adapter-re

Notes and utilities for reverse engineering the Magic Control Technology (MCT) "Trigger" USB display adapter protocol.
BSD Zero Clause License
12 stars 0 forks source link

How to get uncompressed captures? #2

Open JingYenLoh opened 12 months ago

JingYenLoh commented 12 months ago

Hi there, I am trying to implement a Linux driver for Trigger6, I was wondering how you are able to get uncompressed captures. I have tried playing with different resolutions but the session remains a JPEG session.

cyrozap commented 12 months ago

I was able to capture uncompressed frames by plugging in a 4K HDMI dummy plug/display emulator (I used this one, but any cheap one should work, and it should be possible to find them on AliExpress and other merchants). While using this dongle won't cause the driver to transmit all image data uncompressed, some of it will be, and it's possible to identify that uncompressed data in the packet capture.

To that end, I've just pushed the t6-dissector-experiments branch, which contains some of my work-in-progress Trigger 6 dissector code. With that code, you can use the filter trigger6.video.format == 0x00000006 to select packets with uncompressed NV12 image data (this array contains all the image formats I know the driver uses). After exporting the reassembled image data (from the trigger6.video.data field), the uncompressed image can be converted to a PNG using ffmpeg: ffmpeg -f rawvideo -s 3840x2160 -pix_fmt nv12 -i image.nv12 image.png

JingYenLoh commented 12 months ago

Ah, unfortunately I don't have one of those dongles at hand.

With that code, you can use the filter trigger6.video.format == 0x00000006 to select packets with uncompressed NV12 image data

Oh, I see! Unfortunately I haven't been able to make any progress despite fuzzing this (and several other) fields - all I'm able to do is display a completely green screen =/

If it's not too much trouble, are you able to send a packet capture containing uncompressed packets :sweat_smile: ? From there I can try to replicate the packets sent and hopefully figure out what fields I'm setting wrongly. BGR24 packets would be very helpful too, I suspect it might be more straightforward to implement.

cyrozap commented 11 months ago

I've just added to the repository all the captures I have that contain uncompressed image data. The files can be found here. You can find packets with uncompressed NV12 or BGR24 image data using the following Wireshark filter: trigger6.video.format != 0x0000000d

Please note that in frame 3586 of trace-JCD543-20220514T1928-win10-plug-in-dongle-with-hdmi-disconnected-then-connect-4k-edid.pcapng.gz, the video header appears to indicate that it contains BGR24 data, but the data is actually in NV12 format. All other packets marked BGR24 contain BGR24 data. I assume this discrepancy is the result of a bug in the proprietary driver, since everywhere else the format field is consistent with the actual format of the packet data, but I don't yet know that for certain.