Failed: Customizing iPhone "Now Playing" Controls

This is the interface I use several times a day - the "Now Playing" section of the iPhone's lockscreen. Whenever someone talks to me, I have to pause the playback on my phone - and in lack of an expensive pair of headphones, this is a four-step process:

• Pulling the phone out of my pocket
• triple-press the home button (the first one turns the screen on)
• press the "pause" button
• curse silently because I accidentally pressed the "previous" button, losing the current position of the podcast/music track.

My (seemingly) simple approach was to find the interface definition file of the "now playing" screen and pull the controls further apart. After all, there's plenty of room on both sides, isn't there?

As it turned out, Apple left some room for the (usually invisible) AirPlay button on the right side. So, I would have to move this one somewhere else, or it would be buried underneath the "next" button.

The first step was to find the button itself. As for the third-most intuitive place, I found it under System/Library/CoreServices/SpringBoard.app/nexttrack~iphone.png.

Second, where is the interface definition file? A long, long garden path followed with the .nib files in iPodOut (as the name suggests, this app is only responsible for external displays). As it turns out, the nib2objc project doesn't actually work on those files. Just when I almost decided to hack around with TextEdit, I finally found the correct code fragments: the PNG is used by the NSButton "nextButton". Much to my dismay, it is hard-coded into the springboard binary - and there is no separate .nib for the lockscreen.

Disassembly was suggested to be near-impossible, so I cracked open the file with a hex editor. (Is there any good hex editor for a Mac? I ended up with WinHex I had lying around since 1996 or so) After a quick measurement with Photoshop, the button turned out to be drawn at the coordinates 418,160. WinHex assumed that "418" would be coded in unsigned 16-bit, and searched for A201. There were only 2 useful occurences, and both didn't have "160" (A0) in the close vicinity. I replaced them anyway (with "546") and replaced the binary on my phone. After the reboot, I wondered why it didn't crash (maybe the replacing process didn't work while SpringBoard was running?) - but the controls hadn't moved, either. I closed WinHex and called it a day.

The day after, I still felt like I was almost at the finish line - just finding the correct "418" would be enough to complete this project. But I started out with a more generic search term, and found a much easier solution: Assigning the home button to the iPod Play/Pause key.

The tool Activator allows an assignment exclusively for the lockscreen, where the home button hasn't had any function before.

Now, my four-step workflow is reduced to this:

• Push the home button twice quickly (without even looking) to pause playback