Resetting the Modem/Radio Stack under Windows Mobile 5 - Windows Mobile Development and Hacking General

Under Pocket PC 2003, we found that there was a rare issue that arose with the devices and networks that meant that the only solution was to basically turn flight mode on and then off again (resetting the modem and radio stack in the process). The trick was to be able to do this programmatically so that the user did not have to manually do anything.
I tried several approaches to the problem but found very little help in the MS ConnectionManager and found that sending a reset command (ATZ) direct to the modem had a slightly erratic effect (sometimes working and other times not).
After a fair bit of research, I eventually found the solution to this to be the use of the DeviceIOControl command (detailed below - This code was available on the web, not created by me):
HANDLE hRil= CreateFile(L"RIL1:",GENERIC_READ|GENERIC_WRITE,0,0,OPEN_EXISTING,0,0);
if (hRil==NULL || hRil==INVALID_HANDLE_VALUE)
{
hRil= NULL;
return -1;
}
DWORD rildevresult=0,nReturned=0;
DeviceIoControl(hRil, 0x03000314L,0,0, &rildevresult, sizeof(DWORD), &nReturned,0);
HANDLE Ev=CreateEvent(NULL,TRUE,0,L"RILDrv_DataMode");
SetEvent(Ev);
rildevresult = 0;
DeviceIoControl(hRil, 0x03000318L,0,0, &rildevresult, sizeof(DWORD), &nReturned,0);
ResetEvent(Ev);
CloseHandle(Ev);
CloseHandle(hRil);
return 0;
Now for the problem: This series of commands does not work properly on WM5.
I do not have enough knowledge to know why, but the radio stack and modem get into a bit of a mess once this is run and the device has to be soft reset.
If anyone has another method of resetting the modem and is willing to share it, I would be most grateful.
Many thanks,
Graham.

I have been "playing" with this problem for a while now.
There are articles around that suggest that under Windows CE you need to unbind from NDS0: before you can power off an ethernet adapter (not entirely sure that this is what I want to do, but it does not seem to work anyway - probably a difference in the OS).
http://wiki.xda-developers.com/index.php?pagename=UniversalWM5Devices
shows the drivers for the Universal device (which is what I currently have in front of me). The RIL1: driver seems to be the correct one that I need to turn off, but it is definitely not working the way it should.
I believe that it might be a different IO control needs to be passed through (or possibly an extra one?) but I have so far completely failed to find out how to do this.
If anyone does have any information about this, I would appreciate it.
Further information regarding some of this can be found here:
http://rburdick.blogspot.com/2005/05/programatically-turning-pocket-pc-wlan.html
The problem here is that the code needed some adjustment before I could use it as a lot of the includes were missing and so forth. It did lead me to locate a lot of the IOCTL definitions in various include files, but RIL1 does not appear to use the standard codes.
Maimach posted this:
http://www.codecomments.com/archive421-2005-6-504006.html
I have seen this posted elsewhere but it does contain the code to turn flight mode on and off prior to WM5.
Graham.

/bump
Seemed editing my other post did not change the last post date.
Graham.

Graham - you're talking about flight mode, not wifi, so Robert Burdick's is not really what you're after, and in any event if you are interested in wifi, read his own follow up comments where he states that he's wrong with that code. It is in any event useful code, but it's not universally applicable wifi code.
The modem in the Universal is different to previous HTC devices AFAIK, and most of us have suffered some consternation getting the modem under control in WM5. It is possible, but the IOCTLs are very different now - try decompiling the wireless modem app to get a better idea.
However, this may all be, as Joey from Friends would say, a "moo point"
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
If you're merely trying to go into flight mode, why are you doing it like this? Does your app/problem work when you manually toggle flight mode (eg from the start bar at the top of the screen).
And if so, does VJVolublis's flight mode control work in the same way?
V

vijay555 said:
Graham - you're talking about flight mode, not wifi, so Robert Burdick's is not really what you're after, and in any event if you are interested in wifi, read his own follow up comments where he states that he's wrong with that code. It is in any event useful code, but it's not universally applicable wifi code.
The modem in the Universal is different to previous HTC devices AFAIK, and most of us have suffered some consternation getting the modem under control in WM5. It is possible, but the IOCTLs are very different now - try decompiling the wireless modem app to get a better idea.
However, this may all be, as Joey from Friends would say, a "moo point"
If you're merely trying to go into flight mode, why are you doing it like this? Does your app/problem work when you manually toggle flight mode (eg from the start bar at the top of the screen).
And if so, does VJVolublis's flight mode control work in the same way?
V
Click to expand...
Click to collapse
Thanks for the response.
I was aware that Robert Burdick's code was not meant for using to turn flight mode on and off, it was simply another source of investigation as I had hit a dead end (I thought it might inspire someone else somewhere, so I put in the link).
I have never decompiled an app before. Any pointers on where to start with that would be helpful as it may help provide an insight (and which wireless modem app too?)
Turning flight mode on/off was the only effective way of clearing the radio stack on the device when it was getting into a buggy situation where the device (and network it turns out after some investigation involving the network operators) thought that the device had a connection, but it was not transmitting any data. This problem may or may not have been resolved on the newer devices, but we are reluctant to take that risk and so we are trying to get this to work on the WM5 (Universal) device.
It works fine when done from the start bar, but not programmatically.
I have not come across "VJVolublis's flight mode control". A quick look on the web did not turn up anything either. If you have a link to this or some such, I would appreciate it.
Thanks for the help,
Graham.

Hi Graham!
Just search for VJVolublis, or check it out on my webpage (look in my sig).
Let me know if the flight mode control works in VJVolubilis; PM me to discuss.
V

Thanks for the assistance on this V.
After a certain amount of messing around it has become evident that the T-Mobile ROM needed upgrading for V's radio reset software to work correctly (so a nice little radio/rom error in there somewhere).
I upgraded the T-Mobile MDA Pro ROM from:
ROM - 1.20.32
Radio - 1.06.00
Protocol - 42.40.P8
Ext ROM - 1.20.120
to:
ROM - 1.30.114
Radio - 1.10.03
Protocol - 42.44.P8
Ext ROM - 1.30.232
and now V's reset works correctly. The download is available from the following link:
http://t-mobile.iris-global.com/download_manager_mda_pro.html
I have not tested the RIL version of the reset to see if it too is resolved, but frankly, V's reset is the better way to go, so I'll stick with that. I'm not posting details of V's reset here as it is his to give away if he decides to.
Graham.

Bah, Humbug
The code does not work
Initially, V's code appeared to work, but after a single radio off/on, any subsequent attempts jammed the device as before.
After some messing around, it appeared that the best solution was:
Turn radio off
Reset the RIL1 (as in OP)
Turn radio on
This too has turned out to be an erratic solution at best. I have managed to reset the modem up to 7 times in a row with this solution but sometimes I manage only 1 or 2, after which it jams the connection management. After jamming, the only solution is to soft reset the device.
V suggested looking at unloading the relevant device driver, which I also tried, but to no avail.
If anyone else has any thoughts on how this might be solved then please help.
Graham.
P.S. I have an XDA Exec coming soon as we want to check whether the issue is one specific to the T-Mobile devices.

Related

Preset wifi profiles on my Vario 2 = Free Hotspot access?

I was using my phone on my wifi connection earlier today, and I noticed in the Networks dialog there's a bunch of wifi connections already there (but I've not used the phone in town, and I've never even seen some of these wifi hotspot names before), so that got me thinking...
... Does the fact that I'm subscribed to Web 'n Walk as part of my tariff mean that I also have free access to any of the hotspots predefined in the list on my wifi networks screen?
Here's the full list:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Anybody have the faintest clue as to why these are already in my wifi networks list?
Yeah, I've got an idea. It's 2nd hand or ex-display. considering no-one else has reported having these hot-spots pre-configured on their Vario2s, it seems logical or at least likely that the device has been used before.
i.e. returned under the 14 day guarantee that if not satisfied with the product, they'll take it back and squash the contract. look under 'device information' and then call duration. If the call duration exceeds your actual usage, then that prooves it. If however it matches your call usage (see you call history), then maybe just maybe, T-Mobile have introduced this to their extended ROM in newer devices, but I doubt it.
All calls: 27min, 30sec.
This about tallies with the amount of calls I've made (mainly to customer services to get stuff like HSDPA set up) and a query about my account, plus a call to my Dad and a couple of mates...
I did notice during the customisation process that there was a cab containing 'June 2006' in its filename... Here's my ROM and hw stats:
ROM: 1.21.110.3
ROM date: 06/19/06
Radio: 1.05.05.00
Protocol ver: 32.36.7010.04H
My boot screen shows (in red)
M05
S04
B06
D1.21
at the lower left of the screen, and then my Radio and ROM versions show up fleetingly before the device shows the Windows Mobile splash screen. The device also had its protective screen cover on, which I had to peel off - and didn't look like the screen had been touched or used. Of course, they could clean it...
... I don't think this was a refurb though. Course, I could be wrong. I suppose I'll have to go find a wifi hotspot, or maybe ring up T-Mobile cust. services and ask :/
My Vario II also has lots of preconfigured wifi networks on it.
When I received the phone I did check the calls in/out and they were both 0 mins and the phone was immaculate (no scratches, fingerprints etc..) so I would be surprised if it was a return.
I have no idea if these wifi settings relate to free hotspots though or whether you would still have to buy a wifi key if you happened to be in range of one of them. I will give it a go next time I am in a larger town, where I live I don't think there are any public wifi hotspots.
I'm in Brum, so I'll go check it out (there's a T-Mobile hotspot in the bar just outside my uni building, which is actually a student bar too, so I'll have just go and have a couple of pints and investimagate
yeah, mine had all those preconfigured too. think it's standard.
christopherwoods said:
All calls: 27min, 30sec.
This about tallies with the amount of calls I've made (mainly to customer services to get stuff like HSDPA set up) and a query about my account, plus a call to my Dad and a couple of mates...
I did notice during the customisation process that there was a cab containing 'June 2006' in its filename... Here's my ROM and hw stats:
ROM: 1.21.110.3
ROM date: 06/19/06
Radio: 1.05.05.00
Protocol ver: 32.36.7010.04H
My boot screen shows (in red)
M05
S04
B06
D1.21
at the lower left of the screen, and then my Radio and ROM versions show up fleetingly before the device shows the Windows Mobile splash screen. The device also had its protective screen cover on, which I had to peel off - and didn't look like the screen had been touched or used. Of course, they could clean it...
... I don't think this was a refurb though. Course, I could be wrong. I suppose I'll have to go find a wifi hotspot, or maybe ring up T-Mobile cust. services and ask :/
Click to expand...
Click to collapse
Wow. Very interesting indeed. I'm glad to be wrong. I wonder what else you and the other guys have in your extended ROMs as this does indeed seem to be a part of Your ROM. Please let us know how you got on with the Hotspots investigation and beers.
My Vario2 came pre-loaded with eleventy million different wi-fi profiles and wondered about free hot-spot access myself but when I tried to access the hot spot at my local Starbucks it still asked me for a log on I'd & password - I tried the log on I have for My T-Mobile but it came back as invalid. My guess is you have to subscribe to hot spot access seperately.
I just noticed in my Programs list I have an Interactive menu (with the T Mobile logo superimposed over a picture of a SIM card)... Clicking it goes into an app called 'STK Service', which gives me an interactive menu.
I have the usual, Fun, Info, Music, Chat, Sports, Games, Text plus, Groups, Voicemail, t-zones (oh aye?) and Prepay topup...
So I click on t-zones, it shows a white screen with the text 't-zones' on it, and the soft keys turn into Yes and No. I click Yes, and it opens IE with a weird URL (all boxes, so in a character set I can't discern), then WM5 shows a dialog box with "Cannot connect with current connection settings. TO change your connection settings, tap Settings."
The plot thickens...
I have all of those access points as well. And mine is a brand new Vario II.
I emailed T-Mobile a while back asking this, and the other week I got a response:
Ross @ T-Mobile said:
Hi Christopher,
Thank you for your email about Wifi on your MDA.
The profiles on you phone are mostly T-Mobile related, there are some which are for T-Mobile in other countries, BT is also there as we have an agreement with them. The others are just large Wifi providers.
They are put on the phone just to make it easier for you to connect to them. They are not essential in any way to making your phone work and if you want to delete them it will not cause any problems.
I hope this answers your question, if you have any further queries please don't hesitate to contact us again.
Kind regards
RossT-Mobile
Click to expand...
Click to collapse
Just a bit of preferential configuration on their part Only takes a minute to remove though, so it's ok.
I have the exact same pre-configured Wifi profiles on mine. I just deleted them.
me2
Yeah, I got a response a while back from T-Mobile - they are purely 'to help you connect to one of our hotspots more easily' for want of a better way of putting it.
I did a more custom install this time round when I got my replacement Hermes, and didn't install the CAB which sets up the access point SSIDs in the Wifi Network profiles... They now don't appear.
The TM rep confirmed that I didn't have access to the networks, they were just there as, effectively, shortcuts.
Not true
mackaby007 said:
Yeah, I've got an idea. It's 2nd hand or ex-display. considering no-one else has reported having these hot-spots pre-configured on their Vario2s, it seems logical or at least likely that the device has been used before.
i.e. returned under the 14 day guarantee that if not satisfied with the product, they'll take it back and squash the contract. look under 'device information' and then call duration. If the call duration exceeds your actual usage, then that prooves it. If however it matches your call usage (see you call history), then maybe just maybe, T-Mobile have introduced this to their extended ROM in newer devices, but I doubt it.
Click to expand...
Click to collapse
Mine was brand new and sealed and came like this. There is another thread about it somewhere as I remember seeing it - it definately doesn;t mean it isn't new.
Totally brand-new Vario - and these (useful) profiles were included.
If you use BT's Total Broadband package (as I do) then you will have 500 free OpenZone minutes to use every month (something they do not advertise very much).
mackaby007 said:
Yeah, I've got an idea. It's 2nd hand or ex-display. considering no-one else has reported having these hot-spots pre-configured on their Vario2s, it seems logical or at least likely that the device has been used before.
i.e. returned under the 14 day guarantee that if not satisfied with the product, they'll take it back and squash the contract. look under 'device information' and then call duration. If the call duration exceeds your actual usage, then that prooves it. If however it matches your call usage (see you call history), then maybe just maybe, T-Mobile have introduced this to their extended ROM in newer devices, but I doubt it.
Click to expand...
Click to collapse
No, it's so not true. I broke the security seal on the package. There was not a single finger mark or anything, you don't need to be a genius to tell if a phone is ex-display or 2nd hand.

Rare problems on a Prophet (BT/Wifi/WLan doesn't work)

First of all, thanks to readers. You'll end this post tired of me, but i'd be happy if you can!
directly to the party: I have an SPV M600 from Orange Spain (known here as Prophet) SIM unlocked.
It's a G4 model.
My "numbers" actually, are:
IPL/SPL: 2.21.0001
GSM: 2.61.21 (not last, previous, i tried with all available since 2.0x)
OS: 4.0.0.0 (WM6 PDA VIET 4.0.0.0.4)
My first uses with my prophet when i bought it, it didnt work PROPERLY (wifi) but at least (sometimes) detected wifis (when SSID broadcast was enabled on AP devices). Other times, it didnt detect nothing, but using manual configuraion of Wireless network, worked.
Since i upgraded to WM6 (so many different versions, searching for the one that matches my requisites), Bluetooth & Wifi have died.
I couldn't enable Bluetooth or Wireless on my prophet (both at the same time, strange!). When it boots (from a soft reset) it has ALWAYS the Bluetooth (on CommManager) as enabled(but doesnt work really). I can "disable" (remember its "enabled, but really is no working, so disabled internally) it, and then if i click on BT button again, nothings happen. It can't be enabled again unless I make a soft reset.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Explanation animation​
Well. In this point, i'vent tried nothing, so Lets go to Bluetooth - Add new device. What do i got? Problem with Bluetooth Hardware.
Explanation animation​ So at this time, Bluetooth died.
So lets go back to my Wifi troubles:
I can "enable" it on CommManager. And (as BT) sometimes icons changes to enabled (and the antena on upper taskbar appears) sometimes not. If BT icon is lighting, then i can't enable Wifi. If wifi is enabled, i cant enable BT (well, really, it doesn't depend on wifi. remember BT can't be "enabled" unless i've restarted from a soft reset).
An example after touching BT icon, of how "WLAN" kick my ass:
Explanation animation.​
Just take a sight on some other info regarding to my xda:
Other settings.​
IS THERE ANYTHING SUSPICIOUS?
Things i've tried:
Change GSM/Radio ROM: All availables tried. Some strange changes in Connections panel: early versions: WLAN icon. Newer version: Wi-Fi & WLAN icons. what for?
Other WM6 roms:
PDAViet 1.0
PDAViet 1.1
PDAViet 1.1 modified with some CommManager fixes from Franlov (great Spanish cooker).
Original Qtek 2.20.736 Rom.
ASERG 3.09
"Step1" PDAViet rom. As it was WM5, i tried to make work bt or wifi.No success
Always well done, guided by cooker instructions. Hard Resets always done after flashing, etc
Maybe there is something in my operator rom (cid locked!) that could create conflicts?
I'm really sad about this trouble. Because i'm 99% sure there isn't any HW problem related but i'm not able to solve it. This would be one of the few problems (tech related) that can beat me grr.
If someone gots any idea on what to do or what to test... help would be much appreciated.
Last step would be restore original Rom (test if it works... i don't think so) and send it to my operator to manage an RMA.
Note: Sorry for my english.
Hi,
I got exactly the same problems when I installed the new HTC Today plugin and AudioManager. Media Player backgrounds and windows cluthered together, only 5 seconds of every song is playing.
Yesterday I did a hard reset and everything is back to normal now, only no new Audio Manager.
Qtek S200
WM5
I have the same problem in Spain With an M600 from orange.
But also I cant use the phone. It does not find any network.
If find a Rom working fine with this please tell me where
BEst regards
Syquus said:
First of all, thanks to readers. You'll end this post tired of me, but i'd be happy if you can!
directly to the party: I have an SPV M600 from Orange Spain (known here as Prophet) SIM unlocked.
It's a G4 model.
My "numbers" actually, are:
IPL/SPL: 2.21.0001
GSM: 2.61.21 (not last, previous, i tried with all available since 2.0x)
OS: 4.0.0.0 (WM6 PDA VIET 4.0.0.0.4)
My first uses with my prophet when i bought it, it didnt work PROPERLY (wifi) but at least (sometimes) detected wifis (when SSID broadcast was enabled on AP devices). Other times, it didnt detect nothing, but using manual configuraion of Wireless network, worked.
Since i upgraded to WM6 (so many different versions, searching for the one that matches my requisites), Bluetooth & Wifi have died.
I couldn't enable Bluetooth or Wireless on my prophet (both at the same time, strange!). When it boots (from a soft reset) it has ALWAYS the Bluetooth (on CommManager) as enabled(but doesnt work really). I can "disable" (remember its "enabled, but really is no working, so disabled internally) it, and then if i click on BT button again, nothings happen. It can't be enabled again unless I make a soft reset.
Explanation animation​
Well. In this point, i'vent tried nothing, so Lets go to Bluetooth - Add new device. What do i got? Problem with Bluetooth Hardware.
Explanation animation​ So at this time, Bluetooth died.
So lets go back to my Wifi troubles:
I can "enable" it on CommManager. And (as BT) sometimes icons changes to enabled (and the antena on upper taskbar appears) sometimes not. If BT icon is lighting, then i can't enable Wifi. If wifi is enabled, i cant enable BT (well, really, it doesn't depend on wifi. remember BT can't be "enabled" unless i've restarted from a soft reset).
An example after touching BT icon, of how "WLAN" kick my ass:
Explanation animation.​
Just take a sight on some other info regarding to my xda:
Other settings.​
IS THERE ANYTHING SUSPICIOUS?
Things i've tried:
Change GSM/Radio ROM: All availables tried. Some strange changes in Connections panel: early versions: WLAN icon. Newer version: Wi-Fi & WLAN icons. what for?
Other WM6 roms:
PDAViet 1.0
PDAViet 1.1
PDAViet 1.1 modified with some CommManager fixes from Franlov (great Spanish cooker).
Original Qtek 2.20.736 Rom.
ASERG 3.09
"Step1" PDAViet rom. As it was WM5, i tried to make work bt or wifi.No success
Always well done, guided by cooker instructions. Hard Resets always done after flashing, etc
Maybe there is something in my operator rom (cid locked!) that could create conflicts?
I'm really sad about this trouble. Because i'm 99% sure there isn't any HW problem related but i'm not able to solve it. This would be one of the few problems (tech related) that can beat me grr.
If someone gots any idea on what to do or what to test... help would be much appreciated.
Last step would be restore original Rom (test if it works... i don't think so) and send it to my operator to manage an RMA.
Note: Sorry for my english.
Click to expand...
Click to collapse
i have the same problem with the nbd v7.4 not with the wm6 business edition.
So i think its a software problem.
Anyone a solution?
Hello again. I've solved my problem: Buy a new Prophet .
Other one was broken. Maybe because of a failed flashing stage (i remember some errors...).
Now i've it working perfetcly. No misfunction. BT or wifi can work correctly. I've upgraded OS Rom without any problem.
Note: I have NOT upgraded Radio ROM. I've read there are people with problems when upgrading to latest versions. For example i remember two guys that had problems with their prophet when using a RadioRom newer than x.19.x
That is my version, and i repeat, IF:
Same Prophet User
Same knowledges
Same software (programs & OS rom)
Different Prophet <---------- The problem was Hardware!
Maybe software conflicts can cause same issues than my first post in this thread. Mine was a HW problem.
Good luck guys.
Not HW problem
This doesn't seem to be a hardware problem. But i do like you homescreen background where did you get it or IAW, do you have it for me at PM?
For sure: It was a hardware problem. (If you understand an unstable rom memory as Software, ok, then it's software). I dunno understand "IAW"....
Cheers
Same for me with PDAVIET 4.0.0.0.6
I dont think it is a HW problem because somtimes WIFI works, sometimes it plays dead with me
BT stays dead with the PDAVIET 4.0.0.0.6 ROM :'(
Tried a lot, so some help would be great !!
By the way, it has the 6 button HTC_Home_Plugin and 8 button comm manager, maybe changing that can help?
xetro said:
I dont think it is a HW problem because somtimes WIFI works, sometimes it plays dead with me
BT stays dead with the PDAVIET 4.0.0.0.6 ROM :'(
Tried a lot, so some help would be great !!
By the way, it has the 6 button HTC_Home_Plugin and 8 button comm manager, maybe changing that can help?
Click to expand...
Click to collapse
Hear me: Change your prophet

Finally an Update for BELL htc touch GPS/WM6.1

check htc's website for the update...
everything works great....google maps, tomtom....sats catch in seconds....awesome
lol....bell late as usual
amad99
I tried to download, link states 3.08.666.1
The downloaded file seems to be 1.19.666.1 (same as what is on my ROM)
What File did you get?
http://www.htc.com/us/FAQ_Detail.aspx?p_id=70&act=sd
go almost to the bottom and click the link for
Download HTC Touch (Bell) Update - Version 3.08.666.1
its under the gray box thats says
WARNING: During the upgrade process, do not attempt to make/receive calls, press any buttons on your device or disconnect the device from the USB cable as this will stop the update and your device will be rendered inoperable! Please be aware that your device may reset up to 4 times after the provisioning as your device updates.
This radio kicks ass. After I flashed it, I flashed NFSFan's ROM, works like a charm.
Does this work better than any of the other rom updates that we already have?
this rom works amazing and the gps locks in under 10 secs for me where it used to take like 8 mins
Bell wants to charges us for GPS
Not suprisingly, Bell wants to charges us for using the GPS functionnality of our "Plenty features that you better not use because we are wating to charge you all kinds of fees PDA phones"
My bill went higher than 400$ in 3 minutes by using the WModem, fortunately they credit me because it was the first time, and they told me to never use this pretty usefull feature again.
The new Bell rom Laucher has new icon, GPS NAV wich bring to this:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Is anyone of you was charged for using the GPS?
If I use AstroGPSLauncher, will Bell know that I am using GPS and charge me crazy money?
Thanks in advance
I'm using AstroGPSLauncher but I cant' get a valid GPS signal. It might be because Bell is charging everyone for the GPS use...
Will a custom ROM defeat this stupid, stupid fee?
it doesn't cost to use gps.....that new program is by bell which is supposed to be like 3d navigation such as tomtom....
for example....if u use google maps with gps...you shouldn't get charged...
I still can't get any signal. It waits for a valid signal forever.
link2009 said:
I still can't get any signal. It waits for a valid signal forever.
Click to expand...
Click to collapse
These steps should work with googlemaps
1 - Go outside
2 - Start Google Maps
3 - Open menu -> Hit the use GPS
4 - Open menu again -> Hit My Location
It sould lock in les than 10 seconds
Aha, okay, I'll try that.
How about TomTom?
EDIT: I unfortunately do not have a data plan thus Google Maps will not work for me. But I did try your suggestion and when I hit 'My Location' it said My Location (Beta) is not supported on this handheld.
link2009 said:
... when I hit 'My Location' it said My Location (Beta) is not supported on this handheld.
Click to expand...
Click to collapse
I also get this message, However it still finds my location very accurately ... as you said, you need data connection to get the maps from google.
I did not tried TomTom yet.
Well I hooked my phone to my comp to get the data but it still won't grab any satellites..
Seeking GPS satelleties (0) ...
HTCGlow said:
Not suprisingly, Bell wants to charges us for using the GPS functionnality of our "Plenty features that you better not use because we are wating to charge you all kinds of fees PDA phones"
Click to expand...
Click to collapse
I’m not trying to pick a fight here but it’s these kind of statements that make us look silly when we do have a legitimate beef with the wireless industry. Why do people get so upset when cellphone companies try to make money?!?!?!?!?
HTCGlow said:
My bill went higher than 400$ in 3 minutes by using the WModem, fortunately they credit me because it was the first time, and they told me to never use this pretty usefull feature again.
Click to expand...
Click to collapse
I am no fan of the wireless industry in North America (especially in Canada) but really… unlimited mobile browser isn’t the same as “unlimited high-speed internet everywhere on whatever device you can connect this thing to” for obvious reasons. It is precisely for these kinds of reasons the wireless industry has been so slow coming out with unlimited data plans on these devices. Why not buy a nice server from Dell and run a website out of my garage over my cellphone using my “unlimited” data plan?
All that being said, no you do not need to use the GPS app that Bell has bundled with the new ROM. You can use Google maps or any other GPS capable application. Personally I feel this is a very fair way for Bell to introduce this kind of a feature. Don’t try charging us to use something that is free (GPS) but bundle an app that adds value to the equation and if it’s really worth it people will use it and pay for it. What bugs us is when you try charging us for something without adding value to the equation. Ignore the Bell GPS app (unless you want to try it). You don’t need it for GPS functionality.
link2009 said:
Well I hooked my phone to my comp to get the data but it still won't grab any satellites.....
Click to expand...
Click to collapse
Are you on Bell??? Get the unlimited data feature for $7/month. This package is quite simply the best value in the wireless industry.
This ROM from Bell is top-notch. Easily the BEST one I have seen. A few weeks ago I got tired of waiting for Bell and broke down and flashed the Sprint ROM and then tried various custom ROM’s. None of the custom ROM’s came anywhere CLOSE to locking as fast or as accurately as this ROM from Bell. They might be late but they have the best ROM for GPS.
Talking about complaining….
How come we all complain about stuff like charges for data but no one seems to complain about the oldest ripoff in the books – “long distance”. Really!?!? I mean get real. Long distance used to cost more because involved operators plugging lines into a patch panel. Why does it still cost more? Especially when I am calling a place that I could drive to in 20 minutes. Really?!?!?! Long distance charges are a joke.
Fortunately my local calling radius is substantially larger on my cell phone then my home phone.
Oh, and talking about land-lines, what’s with dialing 1 before the area code? Has anyone ever stopped to consider what a backwards throwback that is? In the era of 10-digit dialing its more then a little annoying to hang up and dial again just because you weren’t sure if it was long distance or not.
The Fish
So do we get charged for using the GPS?
And I also didn't know about the $7/month for unlimited data, I'll check into that.
link2009 said:
So do we get charged for using the GPS?
Click to expand...
Click to collapse
No, you do not. You will get charged if you use the GPSNav application that Bell has included in this ROM.
To use the GPS feature for free download an app that is able to take advantage of it (for example Google Maps).
link2009 said:
And I also didn't know about the $7/month for unlimited data, I'll check into that.
Click to expand...
Click to collapse
The $7/month data package from Bell is what makes the Touch such a hot device. Only avalible on the Touch.

GSM signal dropping and then disappearing?

I have had my HD2 since March 2011. It is unlocked, HSPL 2.08 and radio 2.15.50.14. Apart from the known issues with the Phone Canvas with later WM6.5 builds it has been fine. I have been cooking ROMs since my Wizard and then the Blackstone so I am reasonably experienced. I currently have my own custom build installed based on 5.2.23568.
For about a week now it seems to have developed a fault in that the GSM signal just drops off and then goes 'searching'. If I soft-reset the phone it will usually come back and then start to drop off again. If I disable the GSM radio and then re-enable it sometimes it won't enable immediately and might take three goes at the slider going green and then it asking for my PIN.
I have hard-reset, installed various different radios and recently re-flashed but the issue remains. I have also taken the case off the phone and ensured the 'touch' connecters are making contact with the antenna in the case housing. I ahave also reflashed te stock ROM and still the issue remains.
I have now reverted back to my Blackstone as it has become intolerable.
At the moment I have the Blackstone and the HD2 sat next to each other (both with Vodafone SIM cards installed) and the Blackstone has all 4-bars displayed and the HD2 has the 'Martini glass' searching symbol displayed.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Its an eBay purchase but is more or less immaculate - it isn't something I can get my carrier to repair if it is a hardware fault.....
Any ideas
First (not trying to be rude) have you swopped sim cards to ensure its not a sim issue?
Next (I read on you trying different roms) task 29 and reinstall a stock win mo rom, its been known that on occasions failures are resolved by doing this, if it works they put your rom back on.
sadly thats the best I can offer
Like above check sim card fully & network for issues.
I had a very similar issue on my old Touch Pro, signal would go weak & sometimes overnight would loose conection & I would need to toggle flight mode & then all would be ok.
I started think that was likely hardware after calling network & tech support was convinced my device, well turned out was network prob & only linked to that one sim & how it registered to tower !
So check it out well.
Also you could try padding the back of the sim with some tape in case it is a sim contact issue ... & perhaps flash a stock ROM from SD so everwrite HSPL,Radio & also rilphone.dll will all be paired as should be !
All long shots but not much else left ... Good luck ...
I have similar problem. The phone has weak signal and it looses signal on weaker spots where other phones have full signal.
I have HD2 from US and I am in Europe. Maybe I should put some Europe RAdio?
Also sound is very low.
hrga said:
I have similar problem. The phone has weak signal and it looses signal on weaker spots where other phones have full signal.
I have HD2 from US and I am in Europe. Maybe I should put some Europe RAdio?
Also sound is very low.
Click to expand...
Click to collapse
Take CARE when flashing radios as non compatible versions on a US T-Mobile HD2 could result in HD2 paperweight.
My HD2 seems on par with other devices I have compared it for reception strength & I use it in some weak areas without issues.
Have seen a few posts on weak reception so it is either a particular SPL Radio & ROM combo is to blame or hardware issue if unlucky ...
Thanks for the replies it's much appreciated.
Firstly I have swapped SIM cards around (Vodafone Contract SIM & Vodafone Pay&Go SIM) and the fault follows the HD2. I think it has to be hardware or somthing 'unique' with my IMEI number and it registering?
It seems bizzare as I can sit here and watch the signal bars gradually drop off and then it go to 'searching' whilst the Blackstone just sits there happily with 3-bars and never budges.
I am unsure how to approach Vodafone about it as its my own phone (not supplied on a contract) and I think they would be able to give me some technical information as to what's happening with the registrations.
Andy
ADB100 said:
Thanks for the replies it's much appreciated.
Firstly I have swapped SIM cards around (Vodafone Contract SIM & Vodafone Pay&Go SIM) and the fault follows the HD2. I think it has to be hardware or somthing 'unique' with my IMEI number and it registering?
It seems bizzare as I can sit here and watch the signal bars gradually drop off and then it goe to 'searching' whilst the Blackstone just sits there happily with 3-bars and never budges.
I am unsure how to approach Vodafone about it as its my own phone (not supplied on a contract) and I think they would be able to give me some technical information as to what's happening with the registrations.
Andy
Click to expand...
Click to collapse
I would recommend try other network sims or a foreign sim & you can then connect to various networks (roaming) & test signal reception.
That is how I got evidence that it was my network (DTAC) at fault, luckily my network main Office is near my work office so I turned up & pushed the issue until they produced a technical individual with the required knowledge & gumption to help resolve the issue.
The Phone Techies are useless unless you get lucky & we are talking national lottery lucky here.
Chances of hardware are quite high too as a few threads along same issue as yours are around on HD2 reception.
It gets more bizzare - Since the Leo is just better than the Blackstone I decided to take both with me and keep the Blackstone as 'fallback'. Tuesday & Wednesday I worked in Hull and the Leo worked just fine. Went out to the pub last night and the Leo just wouldn't register. Over a period of about 15-minutes I tried soft resetting, taking the battery out etc but nothing. I gave up and left the phone on the bar whilst I was talking to someone and then 5-minutes later I get a text - check the phone and its got 3-bars of signal? I sent a text reply and then the phone seemed to be OK.
Today the phone has been in the same position at home where I took the photo above and its not lost connection all day (so far).
I don't know what to think but I still believe it isn't fixed....
Andy

Raw android GSM radio modem access (text/call intercept)

Hello,
DISCLAIMER: This post is solely for academic purposes. Do not try to intercept a text or call as it is generally illegal in most if not all countries. Don't play with the licensed radio frequencies.
The question is: Can we use an Android phone, without any external radio receiver, to intercept a GSM call or text not destined to our phone? How?
Overview: GSM calls and texts use mostly insecure networks, protocols and encryption algorithms, all over the air.
This means that calls and texts can be intercepted and deciphered. This has been demonstrated at various security conferences and it is documented carrier-by-carrier at gsmmap.org.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Source: Decrypting GSM phone calls (Karsten Nohl)
Prequisites: To hack GSM call or text we need:
1. Processing power to run the A5/1 cracking software.
I don't know if there is any port on Android(ARM) platforms but that's probably not a real issue.
2. A programmable radio receiver to have raw access to GSM uplink and downlink frequencies digital data. That's where we DON'T want to use an external radio module, and use the phone built-in radio module.
Let's have a look at the different issues behind this question:
A. Can the phone GSM modem listen to the uplinks (phone to GSM network) of other phones?
It is normally built to listen to the GSM downlinks. But whatever, we can already intercept much with the downlink.
Moreover, antennas may use some sort of beamforming that may require the hacker phone to be in a specific zone, if using a passive intercept technique.
B. What piece of software "filters" the GSM data not destined to the phone ?
First, we need to understand how the radio data is accessed on Android.
Source: Radio Layer Interface (Android Open Source Project, Kandroid)
The GSM filtering (in terms of frequency selection or data dismiss) should either occur at the baseband level or at the RIL level. Otherwise, that would mean it's handled directly in the radio chipset (and I don't think we can do much in this latter case...).
The RIL communicates with the baseband with AT commands (specs here). These AT commands seem too be to high level commands to treat raw data streams.
So I guess the suspect is the baseband firmware but I may be wrong.
C. Can we hack the baseband to access raw GSM data not destined to the phone?
Technically, yes, it's a file flashable with ODIN. (The RIL can be flashed too).
But I've not seen on this forum any special activity on custom baseband development (it's always official baseband firmware).
The issue is that the baseband is hardware-specific and it is closed-source: "Every mobile device that is connected to a cellular network runs some kind of baseband processor with highly proprietary and closed-source firmware." (source).
Attempts to hack official baseband firmwares to develop custom baseband firmwares is still only an emerging concept, at the specification study level.
Regarding open-source software, note that "Airprobe has, for most users, since been replaced by the cheaper Osmocom phones". OsmocomBB is an Free Software / Open Source GSM Baseband software implementation. It intends to completely replace the need for a proprietary GSM baseband software". However the list of OsmocomBB compatible phones is very limited.
The help and knowledge of xda community would be much appreciated to progress on this topic :highfive:
[EDIT] Interesting links:
Decompiling baseband firmware?
HackRF external transceiver (~300$)
[FAQ] The Baseband (Optimus 2x) by sudden36
Monitor mode for Broadcom WiFi Chipsets by Omri Ildis, Yuval Ofir and Ruby Feinstein (check their RECon PPTX presentation with footnotes to see how they reverse engineered the WiFi chipset firmware based on ARM)
First of all, this thread should be moved to "Security Discussions".
Second, you'll have quite some additional reading to do...
Then you'll have to realize that the firmware on the baseband is on the order of 60 MB for Qualcomm and 12 MB for Intel (XMM) BP's.
Whats you propose is certainly possible, if not already done with some NSA devices. (Check out their product catalog!) And they a have help from QCOM and Intel etc.
Also, much of the BB code running in QCOMs modem devices, are for Hexagon cores, which are harder to decompile, because of proprietary reasons. But the type of interception you're talking about seem very difficult if you don't know PhD loads of GSM and other mobile phone technology.
Ha?!
E:V:A said:
First of all, this thread should be moved to "Security Discussions".
Second, you'll have quite some additional reading to do...
Then you'll have to realize that the firmware on the baseband is on the order of 60 MB for Qualcomm and 12 MB for Intel (XMM) BP's.
Whats you propose is certainly possible, if not already done with some NSA devices. (Check out their product catalog!) And they a have help from QCOM and Intel etc.
Also, much of the BB code running in QCOMs modem devices, are for Hexagon cores, which are harder to decompile, because of proprietary reasons. But the type of interception you're talking about seem very difficult if you don't know PhD loads of GSM and other mobile phone technology.
Click to expand...
Click to collapse
Hi E:V:A,
Thanks for the information. I've been investigating on how bcmon team performed their hack of the Broadcom 4329/4330 chipset on Galaxy S1.
I'm trying to check if we can apply something similar for the GSM radio.
WiFi monitor mode is just achieved by bypassing some checks on the DSP firmware like "is this packet for me?" (indeed they enable the built-in monitor mode flag of the firmware) and transfers all the received traffic on the MMC bus, on a test channel. The patched firmware is applied on the chipset by simply using Broadcom driver write functions that writes to the Wi-Fi chipset RAM (there are no signature check, and there are also some mechanisms to "overwrite" functions of the chipset ROM code).
Something similar may be achieved with the baseband. It will be more difficult as the RIL is closed-source. Stil, I think Replicant provides an open-source alternative, I have to check libsamsung-IPC and Samsung-RIL.
On Galaxy S1, the baseband is a XMM6160 as you pointed out in some thread. Lucky enough, this phone's too old to have a Snapgragon chipset with Hexagon DSP.
Decompiling the /radio/modem.bin in ARM mode makes me think it's indeed ARM and that we may be able to do something.
Despite I've very bad ARM decompilation skills, some parts of the code seem meaningful when decompiled using ARM archtiecture.
Here's some extract (reverse engineering is allowed to this extent under my country law):
Code:
ROM:0050FF0C aOemPsdPsd_utac DCB "[OEM PSD] PSD_UtaCallPsSetReqQos2gReq",0
ROM:005AFED0 aMifNjfAmfLimit DCB "i`j`m`Limit over:150charsline",0
ROM:005AFEF4 aSmsErrorInInit DCB "[SMS]Error in initialising SMS",0
ROM:007DA718 aCatTraceSta_36 DCB " CAT TRACE:: status IND cause = MS_PAGING_PENDING at Line:%u Fil"
ROM:007DA718 DCB "e: ",0x22,"%s",0x22," Func: ",0x22,"%s( )",0x22," ",0
ROM:0081A921 aT_resel_intra_ DCB "t_resel_intra_freq_high_mob",0
Baseband "modem.bin" ARM decompilation result (from what I understand, blue is successfully decompiled code, white is blank space and undecoded code, red is decompiled code with issues like references to ROM code that are indeed not part of the modem file):
By the way, this proprietary stuff (baseband + RIL) has a "backdoor" (the modem chipset actually have root access to the phone data, but that doesn't mean there's a GSM backdor in the actual baseband code).
[EDIT] After reviewing the GSM specs, SMS are carried over "Dedicate Control Channels" (between the base station and the mobile device), that the phone in certainly not going to listen to naturally. Moreover this channel, as effect of TDMA, is hopping between frequencies. As the baseband is closed-source, it's not going to be a simple hack to just read the raw radio-fraquency data and guess the next frequency hop; that's merely impossible practically without programmable standard hardware chipset or better, a dedicated hardware that sniffs all channels simultaneously. HackRF should be useful for that, but still not small-factor enough to use it as a mobile phone peripheral.

Categories

Resources