GSM Triplets / RUN GSM ALGORITHM - Windows Mobile Development and Hacking General

I need the GSM Triplets for a project but haven't really got a clue how to get them. I tried with RIL_SendSimCmd but I don't know how to write the command nor how to read the answer. Unfortunately I didn't find some useful docs yet.
Does someone know more about this?

An idea? Anybody?
I think I know how to send the command now (see http://ftp.rz.tu-bs.de/pub/mirror/ccc_Chaos_Computer_Club/ftp.ccc.de/gsm/gsm_log_commented for an example), but I still get no answer at all, and my callback function isn't being used at all.
Is there noone who can help me getting this SRES and Kc?

Re: An idea? Anybody?
Dissem Faé said:
I think I know how to send the command now (see http://ftp.rz.tu-bs.de/pub/mirror/ccc_Chaos_Computer_Club/ftp.ccc.de/gsm/gsm_log_commented for an example), but I still get no answer at all, and my callback function isn't being used at all.
Is there noone who can help me getting this SRES and Kc?
Click to expand...
Click to collapse
I don't think it is possible, at least with my HTC Blueangel.
The required AT+CSIM (Generic SIMUICC access) command is missing in the command set.
There is only a AT+CRSM (Restricted SIMUICC access) command which only allows access to the SIMs filesystem.

Does this only mean that it won't work with AT commands or does it also mean that it will not work with RIL or even not at all?

Dissem Faé said:
Does this only mean that it won't work with AT commands or does it also mean that it will not work with RIL or even not at all?
Click to expand...
Click to collapse
AFAIK RIL uses AT commands to communicate with the gsm modem.

Just for completion: I checked with HTC and they say it's impossible with all their devices at this moment.

hiiiiiiiiii
i have problem in my phone
my mobile is (hp ipaq6315)
that it desnt work on my network
our network here at egypt is gsm
my phone can not worek on it

hiii
my mobile is hp ipaq
it was operating with tmobile network
now its in egypt & i need to make the mobile operat with both vodafone & mobinle network in egypt what i have to do to reciept its password

Related

Unstable AT-command replies from GSM-radio

I'm programming on a program that uses cell broadcast messages to determine your position. (http://gknavigation.de) - It was a project at "youth research" this year.
It is based on an idea of W.Back...
Now I want to get rid of a external gsm phone at the position determination, because the new Pocket PC Phone Edition have a integrated radio functionality.
I've written a small terminal-prog. for the XDA (http://gknavigation.de/beta.htm), which let's you sent modem-command into the gsm and recieve replies.
On the XDA2 it is working well until the line "AT command interpreter ready" is displayed on the terminal. After that common AT-commands like "AT+CBC" won't work any longer, and result with an "ERROR".
The line (and the errors as result) seems to apear after a few seconds the port is open.
I think I have opened the port and initialized the shared use of the gsm serial communication well. :?
Check out that Sourcecode please:
The .DLL-file-project, which is written in C++ and opens/closes the port:
http://mcflown.net/eVC/XDAcom_func/
The visual basic project, which is for reading and writing operations, and user interface:
http://mcflown.net/eVB/XDAterm/
Greeting and sorry for the hopfully not thaaat bad englisch!
F. Wetzel[/url]
Hasn't really nobody any suggestions?
:?
Florian
Summary
Hi,
Just wanted to let you know that I will have alook and see what I can do
for you.
Have you got a break down of what you are trying to achieve
Click to expand...
Click to collapse
A summ ups are written in German, sorry!
But i will try to describe it briefly:
My prog recieves the messages of the cell broadcast channel 221 by a mobile
phone connected via any inteface. (Bluetooth, IrDA, RS-232)
In Germany this channel contents data about the position and sending
direction of the mobile (fix installed) stations. With some (or many) tricks
i'm able to determinate your own own position up to a 50 meters. (in best
case - depending on the number of installed stations)
This is drawn on a map.
The prog is running under PPC and PC, but the PC version is less
interesting, because the PPC is more portable.
Newerdays, the PPCs have a integrated GSM radio module, so that it should be
possible to recieve those CB-messages vie the internal modem.
By that the users of XDA/MDA/... in Germany would get an alternative to GPS
for navigation/orientation without buying new hardware!
Lateron this prog is perhaps compatible with Tomtom. - I'm checking how to
do it!
Greeting, and thanks in advance!
Florian
hey xda internal access
Hey man i must say i respect you , you have done great work !!!
I am currently working on xda2 as university project and i need to access internal modem of xda ... so might need ur help ... i would wanna help u too and i probly will ... just letting u know i'll try a bit on ur prob and get back to ya ...
any advice ou can give me to access the internal modem ??
great job ! talk soon
On the XDA2 it is working well until the line "AT command interpreter ready" is displayed on the terminal. After that common AT-commands like "AT+CBC" won't work any longer, and result with an "ERROR". Crying or Very sad
The line (and the errors as result) seems to apear after a few seconds the port is open.
I think I have opened the port and initialized the shared use of the gsm serial communication well. Confused
Check out that Sourcecode please:
Click to expand...
Click to collapse
after read your source, i think:
- set Sleep time between each other AT commands > 100ms for response time of GSM modem
- try to close the com port and re-open it before sending another AT-command.
- try to use only RIL port or COM2, don't open them and use them at the same time.
hey i read through the code its good but i dont see how u get "AT Interpreter Ready" in the VB app ... i looked hard !!! can anyone enlighten me ??
I guess "AT Interpreter Ready" is the answer from device.
AT Interpreter Ready is sent by device after radio resets itself. You should never see this reply.
ok - when i get "AT interpreter Ready" from my terminal it allows me to send an AT commands, so in a way i'm guessing that i should get it -
Indeed it happens when the GSM resets does anyone have more explanations on how it appears ???
i get "AT interpreter Ready", too.
Compile
Could someone compile the DLL and EXE and post them here in one zip? Would save me having to install Visual Studio !

RIL, GSM APIs, Cell ID and other

Hi folks.
I'm writing some lines of code to play with RIL and gsm embedded function of my XDAII. I have also XDAI and QTEK 1010 and 2020.
I tried to discover a method to retrieve CELL ID for the first test...
Without success (i played also with gknavigation.de's terminal beta program).
All people interested in this argument is asking about CELL-PROFILER. I think that this is a good software, but POCKET OOZ used work from xda-developers or from xs4all? If yes, please POCKET OOZ share your infos! If not, i apologize with POCKET OOZ and i want to work with this forum to resolve this nice problem.
i've tried to use DevSpecific 24 and 26 modifying tstril, but without success. GetCellTowerInfo returns negative value (error? not implemented?).
We have some news about this?
thanks
bye
davide
noxious said:
Hi folks.
I'm writing some lines of code to play with RIL and gsm embedded function of
thanks
bye
davide
Click to expand...
Click to collapse
Support ,I am writing now,make a friend.my MSN:[email protected]
CellID
Did you get anywhere with this?
Would be useful to retrieve CellID, LAC, BSIC and IMEI (of the SIM) all in one fell swoop. Then, post that data (including a timestamp) to a defined server / port config
If you get any code you want testing, do let me know - as I'm a professional applications and system infrastructure tester, should be a good fit
A bit late, but others might need this eventually.
There's this lib you can use for free and read the Cell ID for devices on GSM Networks:
http://teksoftco.com/index.php?section=press&cat=2009#090611

I've managed to compile cryptophone for PocketPC 2003

I've build a version of crypto phone for PocketPC 2003. ( unsing the sources from www.cryptophone.de ),
with some workarrounds for license test.
I don't have two phone to test it yet. If anyone can test it please send feedback.
As i see it use data call as link layer so your provider must suport it.
PS: Who's testing it , please send feedback.
I've tested in my Qtek 2020, (XDA II, MDA II…).
Is it working? I was able to compile it too, but it died on exchanging keys.
mamaich said:
Is it working? I was able to compile it too, but it died on exchanging keys.
Click to expand...
Click to collapse
Don't work. :-(
I have programmed 2 xda 1 with wm2003 and the crypto, it works perfectly. The only bug is the "file" bar vanishes after a call is placed or received, other than that its great. 8)
Can you post what you changed in the source file in order we could reply your compiled code?
The idea is simple, if we can have access to the original source code and can do the changes you documented, generating the same code as you, with the same hash value for the encrypted code, we can assure that your code have the same security of cryptophone.
dumb ?
what is cryptophone?
Hi,
i am very interested in this (or a similar) software for
the Wallaby or Himalaya platform.
Anyone here who has a working & easy too install binary?
(Or are there any real free & opensource applications like cryptophone?).
kind regards,
Ben
Has anyone managed to get cryptophone working on the XDA ??
... or find a similar program ??
Regards
There are several similar commercial projects. Just wait some time for their announcements.
mamaich said:
There are several similar commercial projects. Just wait some time for their announcements.
Click to expand...
Click to collapse
Hi mamaich,
thnx for that prompt reply
I know about cryptophone.de, raseac.com.br & caspertech.com
Are there any others I have missed ??
Regards
John
2-3 russian companies are also working on similar projects. I don't know their sites.
cryptophone Somebody to compiled? for motorola smartphone mpx220 :?
one more company.
http://www.securegsm.com
and question - where is source download page on http://www.cryptophone.de ?
in general "cryptophone" application isn't difficult
- good vocoder
- some crypto
- good realtime data transfer - CSD for GSM network
- some audio components like AEC
could some one point me to good ARM implementation of vocoder with 2.4-4.8kbitps bitrate? ARM9(v5) PXAxxx ~100MIPS.
Free is preferable, but reasonable commertial offers are welcome too.
just a question,
isn`t it possible with the sourcecode of this software and the sdk for windows mobile 2003 smartphones to make a installer?
is very interesting, or?
is there any other software for ppc or smartphone avalable?
a free wm5 client for this should be awesome! coders go compile now!
is the encryption limited to "only" this version of application ?
- or is there some sort of standard ?
ryhor said:
one more company.
http://www.securegsm.com
and question - where is source download page on http://www.cryptophone.de ?
in general "cryptophone" application isn't difficult
- good vocoder
- some crypto
- good realtime data transfer - CSD for GSM network
- some audio components like AEC
could some one point me to good ARM implementation of vocoder with 2.4-4.8kbitps bitrate? ARM9(v5) PXAxxx ~100MIPS.
Free is preferable, but reasonable commertial offers are welcome too.
Click to expand...
Click to collapse
here
http://www.cryptophone.de/support/downloads/downloads.html
Lord Ashmedai said:
I've tested in my Qtek 2020, (XDA II, MDA II…).
Click to expand...
Click to collapse
Hi, did you manage to get it to work?
I tried on my O2 xda... it hung on the key exchange part...
It concerns me that this program starts two processs, spcore.exe and ui2003.exe. I have not looked over the code, but can you tell me why it must use two. Furthermore once they are going there is no way to stop the spcore.exe. My guess is that if that process contains the thread that is waiting for tapi events, its stopping mechanism has not been implemented properly. If you want to make a thread that is waiting for the event for line state then when the user wants to stop the thread/process, the event interest needs to be reset. eg SetCommMask(hSerialHandle,0); ,but it must be done from the ui thread not the waiting thread because obviously the waiting thread cant do anything. Once it is set to 0 (as apposed to EV_RXCHAR for example) the waiting thread will finish waiting imeadiately.
I tried sending a message to destroy the window with no effect, I then tried using terminatethread to stop it but that did not work so it must be in an api call (such as waiting).
On my mini it starts up ok, and dose not interfear with the phone. I could not test the functionality because the only other phone I had with me was my xda and it dose not install corectly on that. No error messages on intalation but the icon in the program files is not shown properly and it fails when I try to start it.

Any software that shows GSM information?

I need at least Cell ID, operator's code. A list of recent Cell IDs would be good. Cell IDs of all the towers visible around would be just great! Signal level would be useful as well.
FieldTest does not work with my ROM
Phonealarm collects that info. Operator can be shown on the scroller, if you choose a skin with a scroller. The cell ids are shown in the location service.
Lurker0 said:
I need at least Cell ID, operator's code. A list of recent Cell IDs would be good. Cell IDs of all the towers visible around would be just great! Signal level would be useful as well.
FieldTest does not work with my ROM
Click to expand...
Click to collapse
FieldTest is almost perfect - almost, because it shows nearly all, besides one, most crucial bit of information: CellID! anyway, i was trying to send AT+CREG? command to internal serial ports of Hermes (COM1-COM9), unfortunately, non of these worked. so i guess internal hardware modem is located under different COM-port, or there is some other way to collect network data... well, if FieldTest is able to get that data, then other app would be able too - matter of finding appropiate API, i think.
eva_d said:
i was trying to send AT+CREG? command to internal serial ports of Hermes (COM1-COM9), unfortunately, non of these worked.
Click to expand...
Click to collapse
I don't think this is exactly what you want... but may help you if you are debugging someting in OS side:
Go in bootloader mode, and type the command 'rtask b' to enter radio bootloader, then type 'rtask 7' to go into the AT command interface and then type the AT commands you want... to exit the radio bootloader type 'retuoR'.
gprs software
what about spb gprs monitor ! i know that O2 Germany gives that software out with their HTC's !
pof said:
I don't think this is exactly what you want... but may help you if you are debugging someting in OS side:
Go in bootloader mode, and type the command 'rtask b' to enter radio bootloader, then type 'rtask 7' to go into the AT command interface and then type the AT commands you want... to exit the radio bootloader type 'retuoR'.
Click to expand...
Click to collapse
thanks for a hint, but as far as i'm concerned, device in bootloader mode does not use GSM/UMTS network, so it would be useless for my/our needs...
wodur12355 said:
what about spb gprs monitor ! i know that O2 Germany gives that software out with their HTC's !
Click to expand...
Click to collapse
SPB GPRS Monitor is not that kind of 'monitor' application, which we are talking about. thanks anyway for your concern
eva_d said:
thanks for a hint, but as far as i'm concerned, device in bootloader mode does not use GSM/UMTS network, so it would be useless for my/our needs...
Click to expand...
Click to collapse
As long as you can enter AT commands, you can make the device register to the network and even make a call from the AT cmd debugging in bootloader mode... but won't be able to hear the call
Tried phoneAlarm, and yes, it shows CellID, but it does too much in addition
Lurker0 said:
Tried phoneAlarm, and yes, it shows CellID, but it does too much in addition
Click to expand...
Click to collapse
did you try in on TyTN/Hermes actually? interesting is how this CellID is obtained. through AT commands, or some other way...
eva_d said:
did you try in on TyTN/Hermes actually? interesting is how this CellID is obtained. through AT commands, or some other way...
Click to expand...
Click to collapse
Of course, as I said, I tried.
They may work via RIL, like here:
http://nah6.com/~itsme/cvs-xdadevtools/itsutils/rilhook/
I looked into phoneAlarm binaries and it is clear from them that they use RIL_GetSerialPortHandle and then AT commands. The link above contains sources that explain how to use it in details.
How to enter into the bootloader mode of an Imate Jam
How to enter into the bootloader mode of an Imate Jam,I actually want to send AT command to my Imate Jam device

TyTN cellid?

Hi. I am writing a freeware social networking application based on location services ( http://www.fightersoft.ro/mts/index.htm ). Although many devices are supported, it seems that the HTC TyTN isn't. To that end I acquired one and now I am on the quest on getting the cellid in my application.
The approach that should of worked was the COM port. However, no matter what COM port I open, I get a create file error. I am guessing that maybe the internal modem uses a weird port name such as COM550 or other letters instead of COM. I know that another way of getting the cellid is by using ril.dll (or even getting the handle to the gsm modem com port). However, in WM5 this is not documented at all on msdn.com - BUT for WM6 there is documentation.
Firstly, I want to ask anyone if they have extra information about this issue and secondly if by upgrading to WM6, the using the COM port approach works from the box (usually COM9)?
hi, I tryed many programs, which have actually support for cellid information, but no one work on herm, no matter if it was WM5 or WM6. on all phones, I had before it worked correctly... phone alarm also have this functionality, but shown only something like 00-00...
This is so frustrating. Every mobile device with GSM capabilities has a GSM modem insinde. That modem SHOULD be accesible from the OS by the means of COM ports. My guess is that this port is hidden or under a different name than the rest of the HTC devices where it resides on COM9.
CommMgrPro shows Cell Id and Location Area Code correctly on TyNT
I started this thread in the hopes that people will contribute with ideas towards getting this task done. Can you reveal any technical information on how you get the cellid information?
stargatesg1 said:
I started this thread in the hopes that people will contribute with ideas towards getting this task done. Can you reveal any technical information on how you get the cellid information?
Click to expand...
Click to collapse
Sure. Ril.dll gives you access to this information and works properly in WM5-WM6. And technically is easier than manager serial drivers......
Documentation isnt included in WM5 so it isnt "official" but realky It is included. The only problem for "not official" issue is you wont get support from microsoft....
Ask me what you want...
stargatesg1, if you have searched the forum, you'd already have the answer. For instance, this thread:
http://forum.xda-developers.com/showthread.php?t=280476&highlight=cellid
has a reference to RIL API. And I do remember I told you this some months ago in your another thread...
Here it is:
http://forum.xda-developers.com/showpost.php?p=1040464&postcount=27
It was at October 26 last year!
Basically I only need the cellid and the lac. I found that msdn.com offers documentation for ril.dll for WM6. This also works for WM5?
From what I learned from msdn.com is that I should do a ril.initialize first and then I should get the cell info using a fuction that I can't remember right now. Is this approach correct?
Lurker0, I know about this approach (I have mentioned it in my first post) however, I need more information because c++ native is not my primary envoirement for developing. That's why I kept searching for a way of getting the lac-cid from com ports so that I could do it directly from managed code.
stargatesg1 said:
Basically I only need the cellid and the lac. I found that msdn.com offers documentation for ril.dll for WM6. This also works for WM5?
From what I learned from msdn.com is that I should do a ril.initialize first and then I should get the cell info using a fuction that I can't remember right now. Is this approach correct?
Click to expand...
Click to collapse
Exactly. I downloaded Platform builder to have includes and libraries.
1) Initialize Ril
2.a) Request Position explicitally using a RIL_gettowerinfo
2.b) When you initializa Ril you can pass a callback to be notified upon location changes....
Did you read the source code for RIL interface that I pointed you to?
danielherrero, I see. Regarding the callback function is not neccessary in my app - the user or the app set on auto mode searches for changes in location. Thank you very much for your info.
Lurker0, yes I did, but like I said, I am not a very experienced c++ programmer and I need some documentation to get me started. I am also very greatful for your help and I am sure that I will use information from rilclass.cpp.
Thank you both, I will post back with the results as soon as I will have any.
Good luck
Hi StargateSG,
Did you succeeded in getting MTS working on Tytn?
Rgds
I had to leave the country on a business trip. I'll get back in a few days and I will start working on the problem.
danielherrero said:
CommMgrPro shows Cell Id and Location Area Code correctly on TyNT
Click to expand...
Click to collapse
Does nothing on the Blue Angel.

Categories

Resources