George Zhu’s BLOG

UPDATE: this patch will not modify a single byte of your current SpringBoard binary, it just interposes a library to override a method named operatorIconForName:, which is the method to retrieve the carrier logo. This patch can be applied to a patched or un-patched SpringBoard, it will not affect anything except will allow you to add/remove/change carriers and logos, it also enables the multipage scrolling which is disabled by Apple by default.

I’ve finally managed to let SpringBoard display customized carrier logo without patching the binary. The method is known as interposing, the basic idea is to load a dynamic shared library along with the SpringBoard (before any other libraries being loaded), and override the logo retrieving method to implement my own checking algo.

The method described in this article is tested on iPhone 1.1.1 (UPDATE: also tested on 1.1.2 with a slightly different source because a required method has changed interface). The benefits of this method include but not limited to:

- No need to patch SpringBoard binary, have no side effects (shows correct logo while roaming)
- Easy to add new carriers, no limits on number of carriers
- Same trick works on other applications/libraries

How To Use

To apply the patch, you need to take the following steps (NOTICE: all plist files need to be in Mac proper list binary format or UNIX text file format):

1. Upload the extSpringBoard.dylib library file to a folder on iPhone, eg. /usr/lib, then make it executable:

chmod 755 /usr/lib/extSpringBoard.dylib

2. Create a carrier definition file:

/System/Library/CoreServices/SpringBoard.app/Carriers.plist

This file is a standard XML file, it defines all the carrier names and their logos. The <key></key> defines the carrier name, the <string></string> defines the carrier logo name (without the prefix and suffix). You may put in as many items as you want, of course, too many items may slow down the reading process. Here’s an example:

[sourcecode language='xml']

ChinaMobile
CARRIER_CHINAMOBILE
CHINAUNICOM
CARRIER_CHINAUNICOM
at&t
CARRIER_ATT
cingular
CARRIER_CINGULAR
t-mobile
CARRIER_TMOBILE
vodafone
CARRIER_VODAFONE
orangeF
CARRIER_Orange F
o2-uk
CARRIER_O2-UK
TIM
CARRIER_TIM
[/sourcecode]

3. Edit the launch daemon file (NOTICE: this file is in Mac binary format, if you want to convert it to plain text, read This Post to learn how to do it):

/System/Library/LaunchDaemons/com.apple.SpringBoard.plist

The file is similar to the following:

[sourcecode language="xml"]

MachServices

com.apple.springboard.migserver

Label
com.apple.SpringBoard
OnDemand
ProgramArguments

/System/Library/CoreServices/SpringBoard.app/SpringBoard

ServiceIPC

[/sourcecode]

Now insert the following lines right under the first <dict> line:

[sourcecode language="xml"]EnvironmentVariables

DYLD_INSERT_LIBRARIES
/usr/lib/extSpringBoard.dylib
[/sourcecode]

So that the file looks like this:

[sourcecode language="xml"]

EnvironmentVariables

DYLD_INSERT_LIBRARIES
/usr/lib/extSpringBoard.dylib

MachServices

com.apple.springboard.migserver

Label
com.apple.SpringBoard
OnDemand

ProgramArguments

/System/Library/CoreServices/SpringBoard.app/SpringBoard

ServiceIPC

[/sourcecode]

NOTE: if there has already been a <key>DYLD_INSERT_LIBRARIES</key> there (eg. the SummerBoard and iCosta also interpose libraries), then simply insert the /usr/lib/extSpringBoard.dylib into the <string></string> and use a colon (:) to seperate it from other libraries.

UPDATE: if you wanna use SummerBoard’s ‘Skip Last Row’ feature, please put the extSpringBoard.dylib AFTER SummerBoard.dylib, as both this patch and SummerBoard override a same method, whichever comes first will take control.

4. Restart the SpringBoard and you’re done!

Oh wait! You need to create logos for your carrier :) If the logo name in your Carriers.plist file is MY_LOGO, then you need to make two PNG files, named Default_MY_LOGO.png and FSO_MY_LOGO.png. The FSO_ one is used when the status bar is dark, while the Default_ one is used in other situations.

How to Know the Active Carrier Name

It’s in your Settings -> Carrier. NOTE: The carrier name is case-sensitive, and you must remove any spaces, e.g. for “China Mobile”, use “ChinaMobile”.

What If Something’s Wrong

Check your /var/log/syslog (NOTE: If there isn’t such a file, you need to redirect the syslogd output, read the article Redirect Syslogd Output to a File), the patch logs some info in syslog, if it finds the matched carrier logo, it writes the following lines to syslog:

>>> Carrier is China Mobile
>>> Logo is CARRIER_CHINAMOBILE

If it can’t find the appropriate logo, the logged info is like this:

>>> Carrier is China Mobile
>>> No associated logo

Then you can add a new item into your Carriers.plist for the carrier “China Mobile”. NOTICE: you must remove the spaces from carrier names, or it’ll not be recognized. So in my case, the “China Mobile” becomes “ChinaMobile”.

UPDATE: I think this string comparison behavior can be changed by overriding the _operatorName:isEqualToName: method.

UPDATE: Another way is to look at the carrier name displayed on the status bar. In case there’s no logo for the active carrier, SpringBoard will display the carrier name in text on the status bar, be careful to record the full name (if carrier name is too long to fit, SpringBoard will animate the full name for once, then will only display the truncated part).

Acknowledgement

Thanks Arnaldo who showed me various valuable tips.

Attachment

UPDATE: the patch has been reworked, and it now offers both the SpringBoard multipage scrolling as well as the customized carrier logo features. You can download the new patch here:

1.1.1 SpringBoard Scrolling and Carrier Logo Patch (Interposing Library) Binary Only
1.1.2 SpringBoard Scrolling and Carrier Logo Patch (Interposing Library) Binary Only

If you’d like to build the library by yourself, please contact me to get the source, modify the Makefile to reflect your own toolchain’s path, then simply type make to build it.

NOTE: The carrier name comparing method is slightly different in 1.1.1 (_operatorName:isEqualToName:) and in 1.1.2 (_operatorName:isEqualToName:allowPrefixMatch:), so we have to write two different versions. If you really want to use the same source, you may write your own method to compare the carrier names.