Figure out: How to add extra settings to the UI.

[Asmageddon]

E.g. find the function(s) which create the settings in Clinician Mode, like "TiMin", "EPAP", "Trigger Sens", etc. and/or where they're called from, in order to make it possible to add additional settings to control the behavior of custom code without having to recompile it.

[m-kozlowski]

S.EPR.ClinEnable, S.BL.IPAP, S.BL.EPAP, S.TiMin, S.TiMax, S.Trigger

those are just labels for current settings stamped in EDF files and sent to myair service. Not anything UI related

[nickarcade]

current settings stamped in EDF files and sent to myair service. Not anything UI related

Anything insightful or sensible here?

1. Settings Config Table (gui_config)

The central settings data structure is a flat array of 479 config entries, each 28 bytes (0x1C), starting at flash offset 0x08004EF4 and ending at 0x0800833C.

Important

The patch-airsense script revealed this structure via the gui_config() function, which uses the formula:
address = 0x4EF4 + (variable_index - 30) * 0x1C

Settings Config Entry Structure (28 bytes)

Offset	Size	Field	Description
0	2	flags	Status/activation bits. Bit 0 = active, Bit 1 = editable config, Bit 2 = additional flag
2	2	mode_mask	Bitmask of which device modes this setting applies to
4	2	field2	Internal type/category identifier
6	2	label_index	Index into the localized label string table
8	4	min_value	Minimum value (scaled, e.g. cmH2O × 100)
12	4	max_value	Maximum value (scaled)
16	4	step_value	Step increment (scaled). Byte at this offset also stores visibility/editability bits at positions 4 and 5
20	8	extra_params	Additional display/behavior parameters

Example Decoded Entries (Clinician Mode Settings)

Index	Address	Label Idx	Setting Name	Min	Max	Step	Mode Mask
0x024	0x08004F9C	17	Min EPAP	4.00	15.00	0.50	0x0007
0x025	0x08004FB8	18	Max EPAP	10.00	15.00	0.50	0x0004
0x026	0x08004FD4	20	Min DU	5.00	12.50	2.00	0x0008
0x02F	0x080050D0	13	Min. Druck (Min Pressure)	1.75	2.50	1.10	0x000D
0x1D3	0x08007EC0	19	DU (Pressure Support)	2.00	15.00	0.50	0x0004
0x1D5	0x08007EF8	23	Backup Freq.	2.00	12.50	2.00	0x000E
0x1D6	0x08007F14	21	Max DU	12.50	12.50	2.00	0x000E
0x1D7	0x08007F30	25	Ti	2.00	5.00	0	0x0000
0x1D9	0x08007F68	22	Atemfrequenz (Rate)	2.00	12.50	1.50	0x0008
0x1E9	0x08008128	22	Atemfrequenz (Rate)	2.00	12.50	1.00	0x0011
0x1EA	0x08008144	26	Ti Max	1.00	10.00	0	0x0011
0x1EB	0x08008160	27	Ti Min	7.50	14.00	0	0x0000
0x1EC	0x0800817C	14	IPAP	0.75	1.50	0.40	0x000D
0x1ED	0x08008198	15	Max IPAP	0.52	3.00	0.10	0x000D

Note

Values in the table are raw integers. Pressure values are in cmH2O × 100 (e.g., 400 = 4.00 cmH2O).

---

2. Localized Label String Table

Located at 0x0801FB80, this table holds localized GUI label strings for each setting. Each entry is 28 bytes (7 pointers × 4 bytes each), one pointer per supported language.

Label Index	Address	German (First Lang)	English Equivalent
0	0x0801FB80	IVAPS Diag.-Mod.	iVAPS Diag Mode
1	0x0801FB9C	Schlafbericht	Sleep Report
2	0x0801FBB8	Daten	Data
3	0x0801FBD4	Oximeter	Oximeter
4	0x0801FBF0	Klin. Menü	Clinical Menu
5	0x0801FC0C	Therapie	Therapy
6	0x0801FC28	Modus	Mode
13	0x0801FCEC	Min. Druck	Min Pressure
14	0x0801FD08	IPAP	IPAP
17	0x0801FD5C	Min EPAP	Min EPAP
20	0x0801FDB0	Min. DU	Min PS
22	0x0801FDE8	Atemfrequenz	Respiratory Rate
23	0x0801FE04	Backup Freq.	Backup Rate
24	0x0801FE20	Easy-Breathe	Rise Time
25	0x0801FE3C	Ti	Ti
26	0x0801FE58	Ti Max	Ti Max
27	0x0801FE74	Ti Min	Ti Min

---

3. Key Functions

Master Menu Creation: gui_create_menus (0x08061434, 9638 bytes)

This is the central function that creates the entire Clinician Mode settings UI. It:

1. Allocates menu containers using sub_8063D5C(size) (memory allocator)
2. Creates menu sections via sub_8065358(ptr, a2, section_id, flags, 0) — stored at a1[15] through a1[29]
3. Creates individual settings items using factory functions (see below)
4. Adds items to menus via sub_8064E8C(menu, item) (menu item appender)
5. Conditionally creates sections gated by sub_8066F9E(12) & bitmask:
   • Bit 0 (& 1): Sleep report / diagnostics section → a1[23]
   • Bit 1 (& 2): Data viewer section → a1[24]
   • Bit 2 (& 4): Pressure range display section → a1[25]
   • Bit 3 (& 8): Advanced settings section → a1[26]

Settings Item Factory Functions

Function	Address	Purpose	Key Params
settings_item_init	0x0806E468	Base constructor — sets vtable, label index, status flags	(obj, ?, label_index, status_flags)
create_range_menu_item	0x08067ED8	Creates a numeric range setting (pressure, rate, etc.)	(obj, label_idx, range_idx, type, subtype)
create_basic_menu_item	0x08065FF0	Creates a basic setting with a 16-bit parameter	(obj, param, label_idx)
create_label_menu_item	0x080683A8	Creates a read-only label item	(obj, label_idx)
create_dynamic_menu_item	0x0806573A	Creates a dynamic setting with computed label offset	(obj, flag, param)
create_fixed_menu_item	0x080656D4	Creates a fixed item with hardcoded label 41	(obj, ?, ?, config_idx)
gui_extra_menu_init	0x0806645C	Initializes per-setting display config (vtable + palette)	(obj)

Settings Status/Visibility Functions

Function	Address	Purpose
settings_is_visible	0x0806E4C2	Returns bit 4 of byte at struct offset 0x10
settings_is_editable	0x0806E500	Returns bit 5 of byte at struct offset 0x10
settings_update_status	0x0806E4C8	Updates visibility/editability via vtable dispatch
settings_set_status_bit	0x0806E4B2	Sets/clears a specific bit in the status byte
get_settings_config_entry	0x08066FC6	Looks up config entry by label index

Supporting Functions

Function	Address	Purpose
sub_8063D5C	0x08063D5C	Memory allocator — malloc(size) for GUI objects
sub_8064E8C	0x08064E8C	Menu item appender — adds child item to menu
sub_8065358	0x08065358	Menu section creator — creates a menu container
sub_8065604	0x08065604	Menu header creator — creates section header item
sub_8065D54	0x08065D54	Static item creator — creates a non-configurable display item
sub_8066F9E	0x08066F9E	Config bitmask reader — reads feature enable flags

---

4. How the Patch-Airsense Script Modifies Settings

The patch-airsense script modifies settings behavior through several patch mechanisms:

gui_config() — Enable Clinician Settings (offset 0x64)

Patches byte 0 of specific config entries to 0x07 (bits 0, 1, 2 = active + editable + extra):

# Formula: address = 0x4ef4 + (var - 30) * 0x1c
# Sets the flags byte to enable all activation bits
printf '\x07\x00' | patch $ADDR

all_menu() — Force All Items Visible (offset 0x32)

Patches two instructions in the firmware to always return 1:

# Force bit 5 (editable) always on at 0x6e502
printf '\x01\x20' | patch 0x6e502
# Force bit 4 (visible) always on at 0x6e4c4  
printf '\x01\x20' | patch 0x6e4c4

The instruction 0x01 0x20 is ARM Thumb for MOVS R0, #1, replacing conditional logic with unconditional return-true.

unlock_ui_limits() — Extend Pressure Ranges (offset 0x02)

Patches min/max fields in the config table:

# Pattern: \xdc\x05\x00\x00\x32\x00
# 0x05DC = 1500 (max = 15.00), 0x0032 = 50 (step = 0.50)
# After patch: max becomes 30.00 cmH2O (0x0BB8 = 3000)
printf '\xdc\x05\x00\x00\x32\x00' | patch 0x4fa8

extra_modes() — Enable All Therapy Modes (offset 0x08)

Patches the mode bitmask at config offset 0x8590:

# 0xFFFF enables all mode bits
printf '\xff\xff' | patch 0x8590

---

5. Architecture Diagram

flowchart TD
    A["gui_create_menus<br/>0x08061434"] --> B["sub_8065358<br/>Create Menu Section"]
    A --> C["Factory Functions"]
    
    C --> D["create_range_menu_item<br/>0x08067ED8"]
    C --> E["create_basic_menu_item<br/>0x08065FF0"]
    C --> F["create_label_menu_item<br/>0x080683A8"]
    C --> G["create_dynamic_menu_item<br/>0x0806573A"]
    C --> H["create_fixed_menu_item<br/>0x080656D4"]
    
    D --> I["settings_item_init<br/>0x0806E468"]
    E --> I
    F --> I
    G --> I
    H --> I
    
    I --> J["get_settings_config_entry<br/>0x08066FC6"]
    I --> K["Set vtable, label_index, status"]
    
    J --> L["Config Table<br/>0x08004EF4<br/>479 × 28 bytes"]
    K --> M["Label Table<br/>0x0801FB80<br/>7 lang ptrs × 28 bytes"]
    
    L --> N["flags, mode_mask,<br/>min, max, step"]
    M --> O["Localized strings:<br/>IPAP, EPAP, Ti, etc."]
    
    I --> P["settings_is_visible<br/>0x0806E4C2"]
    I --> Q["settings_is_editable<br/>0x0806E500"]
    
    A --> R["sub_8064E8C<br/>Add Item to Menu"]
    A --> S["sub_8066F9E<br/>Feature Gate Check"]

Loading

---

6. IDA Database Updates

The following 16 functions were renamed in the IDA database:

Original	New Name	Address
sub_8061434	gui_create_menus	0x08061434
sub_806E468	settings_item_init	0x0806E468
sub_806E464	settings_item_init_wrapper	0x0806E464
sub_806E500	settings_is_editable	0x0806E500
sub_806E4C2	settings_is_visible	0x0806E4C2
sub_806E4C8	settings_update_status	0x0806E4C8
sub_806E4B2	settings_set_status_bit	0x0806E4B2
sub_806E5F4	settings_item_init_with_vtable2	0x0806E5F4
sub_80656D4	create_fixed_menu_item	0x080656D4
sub_806573A	create_dynamic_menu_item	0x0806573A
sub_8065FF0	create_basic_menu_item	0x08065FF0
sub_8067ED8	create_range_menu_item	0x08067ED8
sub_80683A8	create_label_menu_item	0x080683A8
sub_806645C	gui_extra_menu_init	0x0806645C
sub_8066FC6	get_settings_config_entry	0x08066FC6
sub_80A0840	therapy_variable_get	0x080A0840

---

7. How to Add a Custom Setting (Without Recompilation)

To add a new Clinician Mode setting via binary patching:

1. Choose an unused config entry in the 479-entry table (0x4EF4–0x833C)
2. Set the flags byte to 0x07 (active + editable + enabled)
3. Set the mode_mask to the desired therapy mode bitmask
4. Set min/max/step values appropriately
5. Set the label_index to point to an existing or new localized string
6. Add the item creation call in gui_create_menus (requires code patching in the 0x8061434 function or hooking into one of the existing menu sections)

Caution

Adding new items to gui_create_menus requires inserting ARM Thumb instructions into the function, which changes all subsequent branch offsets. A safer approach is to hook into one of the existing menu sections or use the custom code area at 0xFE000+ used by patch-airsense.

[Asmageddon]

This seems like a potential start, but honestly, I'm not a reverse engineer, I don't code often, and I have a lot of brainfog and fatigue still regardless of all treatments, and this is a bit above my head.

Seems like decent guesses for where to start working(though nevermind that the original airbreak team already did most of the work), but a lot still needs to be figured out with actual hands-on debugger work and test-patches to get somewhere useful.

Replacing the (huge) gui_create_menus method doesn't seem viable to me(would need to place it elsewhere since anything with added functionality wouldn't fit in the original spot, and to analyze most of it to figure out where to add new settings). Maybe replacing one or more of the sub-functions, and checking strings/memory addresses for known existing settings in order to then add additional ones afterwards?

Most likely bet seems the scrollbar_add_item method at 0x08064E8C, since at the absolute simplest, the format seems to be as follows:

uVar4 = setup_methods_f3788_or_f2b1c(uVar4,0x59,1,DAT_0806201c);
scrollbar_add_item(uVar3,uVar4);
uVar4 = menu_create_text_or_float(0x233,0);
scrollbar_add_item(uVar3,uVar4);
uVar4 = menu_create_text_or_float(0x222,0);
scrollbar_add_item(uVar3,uVar4);
uVar4 = menu_create_text_or_float(0x243,0);
scrollbar_add_item(uVar3,uVar4);
uVar4 = menu_create_text_or_float(0x213,0);
scrollbar_add_item(uVar3,uVar4);
uVar4 = menu_create_text_or_float(0x214,0);
scrollbar_add_item(uVar3,uVar4);

At a glance, seems like it just initializes a new menu item and adds it, with the first argument to menu_create_text_or_float potentially being the index of the configuration field(e.g. min/max/step values, etc).

But again, a lot of debugging work to go.

[m-kozlowski]

gui_create_menus is called only from one place in the code

        0806e28c f3 f7 d2 f8     bl         gui_create_menus                                 undefined gui_create_menus(int p

replace that branch with branch to a smaller version of gui_create_menus, handling only additional entries, that at the end will branch to gui_create_menus passing proper values of r0 and r1.

But it might be the easier part. The hard part is integrating new menu entries with firmware internal variable system.