Add Bluetooth Audio Input Unlock (HiBy R1)

[japq7s]

Thanks for the great mod - small addition if it's useful.

What this does

HiBy R1 natively supports "Bluetooth audio input" (Bluetooth DAC/Sink mode) in the firmware (as seen in R3 Pro II and others), but the option is explicitly hidden from the Bluetooth settings menu, and its view group is soft-blocked by the UI manager. This patch unblocks the view and dynamically injects the missing menu item into the Bluetooth settings list without replacing or breaking any existing options. The UI back button and disconnect dialog work flawlessly.

The change

Two changes are required in hiby_player:

1. Bypass the View Blocker:
   hiby_player has a blocklist routine (FUN_004f7220) that checks against vg_bt_input_hiby and prevents it from opening.
   We shift the pointer by 1 byte so it checks against g_bt_input_hiby instead, ensuring the block is bypassed while keeping the original string intact so event handlers (like the Back button) can still bind to the view.

   addiu s1, s1, LOW(vg_addr) -> addiu s1, s1, LOW(vg_addr) + 1

2. Inject the Menu Item:
   The menu builder loop calls lg_listview_add_item for each item. We overwrite the volume_sync addition with a jump (j) to a code cave (40 bytes of 0x00 in .rodata).
   In the code cave, we execute the original volume_sync addition, followed by the newly injected bt_input addition, and then jump back.

   lui a1, HIGH(bt_in_addr)
   move a0, s2
   jal add_item_func
   addiu a1, a1, LOW(bt_in_addr)

Contents

• README section documenting the logic + patch offsets, similarly to other mods.
  Offsets (for sorting variant): Blocklist 0xf723c, Menu jump 0xad034, Cave 0x36f7f8.
• patch_bt_input.py — optional helper that locates the blocklist addiu, menu builder signatures, and a suitable code cave dynamically. This ensures it works reliably across different community binary variants (stock, sorting patch, etc.) without hardcoded offsets.

Tested

Applied to the Sorting-patch hiby_player (HiBy R1 fw 1.6) from this mod, repacked and flashed via SD.
Verified that the "Bluetooth audio input" option appears natively under Bluetooth settings, activates Sink mode correctly, and the UI back button exits the mode seamlessly without leaving dead screens.

[Tartarus6]

This looks really cool! Very clever to just offset the read by 1 byte. I don't have an R1, so I can't verify, unfortunately.

Hope this gets merged soon though.

[endgame47]

@japq7s I tried your python script on a clean 1.6 firmware and I get this:

[+] Found vg_bt_input_hiby at 0x75ffbc
[+] Found volume_sync at 0x780904
[+] Found bt_input at 0x76008c
[+] Found blocklist instruction at file offset 0xec51c. Bypassing blocklist...
Error: Menu builder sequence mismatch. Has it already been patched with a code cave?

I get the same issue on the version from https://github.com/bidhata/Hiby-R1-Mod/releases/tag/DAC

[japq7s]

@endgame47 Thank you for checking my script!

This is a bug on line 73 — the jal opcode check was 0x0c instead of 0x03 (jal is 000011 binary = 0x03 after >> 26). The wrong constant always fails the check.

It worked on my test because I tested on the sorting-patch variant where the offsets differ. The bug only shows up on certain builds. Fixed in the latest push, also added 4-byte alignment for the code cave.

Tested now on clean 1.6 and latest mod release, now it works.

[japq7s]

Sorry for this force push mess, I accidentally pushed my new changes for UI

For perfect input mode layout we need to scale dark_theme bluetooth icon and change alignment for codec icon
It can be done as on ef5f601 but this code was not clean so i reverted these changes with push --force
Without UI changes, bluetooth icon will be misaligned and codec icon will be doubled, it's small bug but can be solved