Add Bluetooth Audio Input Unlock (HiBy R1)

[japq7s]

Thanks for the great mod - small addition if it's useful.

What this does

HiBy R1 natively supports "Bluetooth audio input" (Bluetooth DAC/Sink mode) in the firmware (as seen in R3 Pro II and others), but the option is explicitly hidden from the Bluetooth settings menu, and its view group is soft-blocked by the UI manager. This patch unblocks the view and dynamically injects the missing menu item into the Bluetooth settings list without replacing or breaking any existing options. The UI back button and disconnect dialog work flawlessly.

The change

Two changes are required in hiby_player:

1. Bypass the View Blocker:
   hiby_player has a blocklist routine (FUN_004f7220) that checks against vg_bt_input_hiby and prevents it from opening.
   We shift the pointer by 1 byte so it checks against g_bt_input_hiby instead, ensuring the block is bypassed while keeping the original string intact so event handlers (like the Back button) can still bind to the view.

   addiu s1, s1, LOW(vg_addr) -> addiu s1, s1, LOW(vg_addr) + 1

2. Inject the Menu Item:
   The menu builder loop calls lg_listview_add_item for each item. We overwrite the volume_sync addition with a jump (j) to a code cave (40 bytes of 0x00 in .rodata).
   In the code cave, we execute the original volume_sync addition, followed by the newly injected bt_input addition, and then jump back.

   lui a1, HIGH(bt_in_addr)
   move a0, s2
   jal add_item_func
   addiu a1, a1, LOW(bt_in_addr)

Contents

• README section documenting the logic + patch offsets, similarly to other mods.
  Offsets (for sorting variant): Blocklist 0xf723c, Menu jump 0xad034, Cave 0x36f7f8.
• patch_bt_input.py — optional helper that locates the blocklist addiu, menu builder signatures, and a suitable code cave dynamically. This ensures it works reliably across different community binary variants (stock, sorting patch, etc.) without hardcoded offsets.

Tested

Applied to the Sorting-patch hiby_player (HiBy R1 fw 1.6) from this mod, repacked and flashed via SD.
Verified that the "Bluetooth audio input" option appears natively under Bluetooth settings, activates Sink mode correctly, and the UI back button exits the mode seamlessly without leaving dead screens.