Hack a uim card for xv6800 - Mogul, XV6800 General

一个偶然的机会, mr7 在某二手手机卖场发现一台由美国电信运营商 verizon 订制的 XV6800 烧号一体机。由于广州玩 CDMA 烧号机的人不多,商家也不会改,于是抱着碰运气的心态把这台未经改卡的原装机买了回家看能不能改为插卡机。
同为美国电信运营商的 Sprint 公司订制的 XV6800 机身为浅灰色,外观十分有型!而 verizon 订制的 XV6800 外观则显得有点土,机身塑料质感明显!但在按键操作及力度反馈上 mr7 认为 verizon 版本优于 Sprint 版本。机子拿回家后马上刷了中文 ROM ,并出现“白三角”的正常现象,为何说“白三角”是正常现象?很简单, mr7 还没更新PRL和做 QPST 的设置。
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
看看两者机身背面, verizon 版 XV6800 背部的金属屏蔽片已经被商家拆除,估计不会改插卡所以放弃了,而 Sprint 版的 XV6800 则已被改好插卡。很多网友经常问 XV6800 哪个版本好,其实不管 A 版、 S 版、 V 版、 Q 版的 XV6800 ,内部硬件是一样的,都是由 HTC 这个厂家代工的,都有 WIFI 模块。只是表面外壳和 LOGO 不同而已。手机原来的开机 LOGO 、 ROM 都是特意为不同电信运营商定制的,而且需要写码烧号。这些手机拿到中国大陆后,很多商家通过硬件改造,在电路板上加入 UIM 卡座,然后修改 QPST, 使到这款机子可以在国内使用。早期 XV6800 的 ROM 是屏蔽了 GPS 功能的,后来新出的 ROM 解除了屏蔽。
为了方便广州地区的玩家讨论改装操作,可加入广州 CDMA 玩家群了解,以便在广州市内共同研究交流, QQ 群号: 51711332 (请注明是广州地区玩家)。 mr7 的 QQ : 510844822(请注明) 。
OK ,改插卡前先准备好梅花内六角螺丝批、充值卡或废旧 SIM 卡等塑料硬卡片用于拆机。假如 TF 卡槽内有 TF 记忆卡的话请先拔出。我们只须拆开手机底部外壳即可。
1 .扭开 XV6800 背面的 4 颗小螺丝。如图方框处。

2
2 .打开 XV6800 的滑盖,键盘按键朝上。把充值卡小心插入键盘与外壳之间的缝隙,如下图。 XV6800 键盘与外壳之间共有 6 个暗扣连接着,充值卡从顶部开始以顺时针方向慢慢划开键盘与外壳连接的暗扣。划开暗扣后可以轻轻翘起键盘直到外壳全部脱离向下翻开。
3 .暗扣的位置分别在下面 3 个地方,大家可以参考下面 3 张图片以便拆机。
A. 右侧
B. 顶部
C. 左侧

当外壳卸载后,就是通信部分的主板了。主板上要整改的地方为红蓝两个区域。
A .红色方框内必须用透明胶布贴好。主要原因是改区域为 XV6800 金属手写插入的地方,电路板上的触点都是外露的,金属笔插入后该处后很容易造成短路,短路后造成手机会不断重启的,因此必须贴上透明胶布以防短路。
B .蓝色区域则为焊接 UIM 卡座的地方。焊接卡座需要电烙铁,松香等。注意!焊接前先将电烙铁预热,然后拔掉电烙铁的电源插头利用余热来做焊接工作,这样可以防止静电或感应电窜入电路导致元件烧坏。
5 .准备好改装的材料,包括特制的 UIM 卡座和塑料底板。 XV6800 的 UIM 卡座跟普通的 SIM 或 UIM 卡座很不同, XV6800 卡座卡脚和触点是错位,而普通卡座是一一对应的,不能直接焊在 XV6800 电路板上使用。为了方便大家了解,作了大致示意图。
6 .除了焊接 UIM 卡座,还要焊接电路板上两处触点,如下图。图中的 A 与 B 两点焊接在一起使RST端口能连接到电路,同样将 C 与 D 两点也焊接在一起使CLK端口能连接到电路。顺便把 UIM 卡座各触点定义也标出来。
7 .这是焊接好 UIM 卡座后的特写, A 、 B 和 C 、 D 各触点也焊接好了。

8 .下图是贴上塑料底板并合上外壳后的效果图。基本完成硬件改造。
做完硬件改造后,下一步是用电脑做 QPST 的设置。做 QPST 前请先拔出 UIM 卡和 TF 卡。
首先安装微软的 Activesync 4.5 ,并测试电脑与 XV6800 的连接是否正常。安装 QPST 2.7 BUILD 215 , 215 是目前最好用的版本。安装驱动 Install_MSI_Sprint 。进入拨打电话界面,按 ##3434 然后拨号或按 ##3424# 进入 DM Router 模式,电脑认出硬件后手动找出驱动路径,当然也可以选用单独的 Modem 驱动。详细方法可参考其他网友的攻略。
进入 QPST 时会提示输入 SPC 码的,用算号器输入 ESN 码就得出 SPC 码。 QPST 设置的项目主要有:
1 . 1x/HDR Secruity 栏的 R-UIM 项改为 R-UIM Only 即只读 UIM 卡数据。
2 . M.IP 栏的 Mobile IP 项改为 Simple IP only 。
3 . gpsOne 栏左边的选项前面全打钩,右边的 PDE IP 项地址为 0.0.0 .0 , PDE Port 端口项为 0 , PDE 项选 DBM , Position 项选 PDE 。
4 . MMC填460,MNC填03
大概设置就是如此!写入手机即可,然后重启一下手机。
顺便把 PRL 、 RADIO 等刷为最新版本,开机后可显示 EV-DO连接(37号频点) 。接上 CDMA UIM 卡,拨打电话正常!通话优良。
以上图片均可放大查看。本文内容仅供参考,只代表mr7个人实际测试及建议。鉴于本人水平所限,如有不正之处敬请多多指教。
GO AHEAD! TRY IT…………………

So what exactly is the purpose of adding a sim card to the titan?

Well.. Viewing the pictures, looks great, but reading in chinese it's frustating, specially when I don't understand it... jejejejeje...
Anyway, seems to be a great way to use our Titans as GSM... Or that's what I think is this post to...
Any other language will be okey..
Thanx...

But I don't think the titan has functional GSM hardware/software. I don't think it has anything to do with missing a sim card. I translated the Chinese it kinda makes since in his steps.

Perhaps... I really don't know if this phone has those functionalities, but we can't denied the images... jejeje...
If there's another posts on the web about this, it really will come out soon..

RUIM uses cdma networks with all subscriber info on a sim card. Meaning in china, korea or india (where CDMA networks are used) you could theoretically pick up a prepaid sim and use your titan on a foreign network if you soldered a sim tray on it. (basic way of explaining it) There is another post in here in english if you care to search. Pretty cool stuff!
HERE is the thread from about a year ago or so.

Digital Roaming
Dear mr7mr7
the setting MMC 460,MNC 03 is it operator related ?
if the RUIM card i have is already prgramed which is i get from CDMA operator here in indonesia, do i still need to change the MMC and MNC setting ?
When i do the other setting (Change 1x/HDR to RUIM Only) and inserting my RUIM, my phone turn to digital roam.
is there any other setting needed ??
-- Tubbz --

google translate people:
A chance, mr7 second-hand mobile phone in a store by the United States found a verizon carriers ordered XV6800 No. burning machine. CDMA as a result of playing the Guangzhou No. burning of many people, businesses will not change, luck was with this mentality of Taiwan without the original card to buy a home machine and see if I can read card machine.
The same for the U.S. carrier Sprint Corporation XV6800 customized for the light gray body, appearance is very stylish! Verizon customized XV6800 and it appears that the appearance of a little soil, texture clear plastic body! However, operation and efforts in the feedback button on the verizon version mr7 that version is better than Sprint. Home immediately after the machine brushes the Chinese ROM, and a "white triangle" of a normal phenomenon, so why is "white triangle" is a normal phenomenon? Very simple, mr7 do not update the PRL and QPST settings.
Take a look at the back of the two fuselage, verizon version of the metal shield back XV6800 film business has been dismantled, it is estimated that there will not be given up to card, XV6800 and the Sprint version of the card has been improved. Many friends often ask which version XV6800 good, in fact, no matter A version, S versions, V Edition, Q version of the XV6800, the internal hardware is the same as all the manufacturers by HTC of Taiwan, have WIFI module. LOGO is a superficial shell and different. Mobile phone original boot LOGO, ROM are designed to customize the different carriers, but also burn No. need to write code. To get these phones in mainland China, many business transformation through the hardware, the circuit board to join in the UIM card connector, and then modify QPST, so this machine can be used. XV6800 early screening of the ROM is the GPS function, a new out later lifted the mask ROM.
Guangzhou in order to facilitate conversion of the players to discuss the operation, which may be included in Guangzhou CDMA base to understand players in order to study the exchange of the city of Guangzhou, QQ group number: 51711332 (Please specify player is in Guangzhou). mr7 the QQ: 510844822 (please specify).
OK, change card ready before Plum Hexagon screwdriver, recharge cards or SIM cards used hard plastic card used to拆机. TF card slot if there are TF memory card if you pull out. We need only to open the phone at the bottom of shell.
1. XV6800 turn on the back of the four small screws. Figure Box Office.
Attached Thumbnails
Click image for larger version Name: IMG_0013.JPG Views: 148 Size: 47.8 KB ID: 151171 Click image for larger version Name: IMG_0019.JPG Views: 146 Size: 36.0 KB ID: 151172 Click image for larger version Name: IMG_0021.JPG Views: 136 Size: 39.6 KB ID: 151173 Click image for larger version Name: IMG_0026.JPG Views: 137 Size: 46.3 KB ID: 151174 Click image for larger version Name: IMG_0034.JPG Views: 128 Size: 41.2 KB ID: 151175
Click image for larger version Name: IMG_0035.JPG Views: 129 Size: 34.7 KB ID: 151176 Click image for larger version Name: IMG_0036.JPG Views: 126 Size: 33.8 KB ID: 151177 Click image for larger version Name: IMG_0033.JPG Views: 130 Size: 35.6 KB ID: 151180
Reply With Quote Multi-Quote This Message Quick reply to this message
mr7mr7
View Public Profile
Send a private message to mr7mr7
Find all posts by mr7mr7
Add mr7mr7 to Your Contacts
Sponsored Links
# 2 Report Post
Old 28th January 2009, 05:27 AM
mr7mr7 mr7mr7 is offline
Junior Member
Join Date: Oct 2008
Posts: 4
Default 2
2. Slide open the XV6800, keyboard keys up. Insert the card carefully to recharge the keyboard and the gap between the shell, as Fig. XV6800 keyboard with a total of six between the shell buckle connected to the dark, recharge cards from the top clockwise slowly began to draw with the shell to connect the keyboard to open the secret button. Dark gash can hold gently tilt the keyboard down until the case all turned out.
3. Withholding the location of the dark in the following three areas, we can refer to the following three picture拆机.
A. right
B. at the top
C. left
Reply With Quote Multi-Quote This Message Quick reply to this message
mr7mr7
View Public Profile
Send a private message to mr7mr7
Find all posts by mr7mr7
Add mr7mr7 to Your Contacts
# 3 Report Post
Old 28th January 2009, 05:32 AM
mr7mr7 mr7mr7 is offline
Junior Member
Join Date: Oct 2008
Posts: 4
Default
When the shell after unloading, that is, the communication part of the motherboard. To reform the motherboard where the two regions for the red and blue.
A. Red box with a transparent adhesive tape must be affixed to good. The main reason is for the XV6800 to the region where the metal insert handwritten, circuit board contacts are exposed, metal pens on the premises after insertion is likely to result after the short circuit, short circuit caused by mobile phones will continue after the restart, it must be affixed transparent adhesive tape to prevent short circuit.
B. Blue region compared with the local welding UIM card connector. Electric iron deck welding needs, such as rosin. Attention! Before the first electric iron welding preheating, electric iron and then unplug the power plug to make use of heat welding, to prevent electrostatic or induction electric circuits lead to components窜入burned.
5. Ready modified materials, including specially designed holder and plastic floor UIM. UIM card connector with the XV6800 ordinary SIM or UIM card connector is very different, XV6800 card deck is the wrong foot and contacts, and general deck is one-to-one and can not directly solder circuit boards used in the XV6800. In order to facilitate understanding, were more or less schematic.
6. UIM card connector in addition to welding, but welding circuit two contacts on the board, as Fig. Figure A and B in two welded together to make RST port can connect to the circuit, the same C and D will be welded together to make two other points which can be connected to the CLK port circuit. Incidentally, the UIM card connector standard definition of the contacts out.
7. This is a good welding features after UIM card connector, A, B and C, D of the contact welding is also good.
Attached Thumbnails
Click image for larger version Name: IMG_0052.JPG Views: 124 Size: 41.3 KB ID: 151181 Click image for larger version Name: IMG_0056.JPG Views: 121 Size: 40.0 KB ID: 151182 Click image for larger version Name: IMG_0061.JPG Views: 123 Size: 32.0 KB ID: 151183 Click image for larger version Name: IMG_0070.JPG Views: 122 Size: 42.1 KB ID: 151184
Reply With Quote Multi-Quote This Message Quick reply to this message
mr7mr7
View Public Profile
Send a private message to mr7mr7
Find all posts by mr7mr7
Add mr7mr7 to Your Contacts
# 4 Report Post
Old 28th January 2009, 05:34 AM
mr7mr7 mr7mr7 is offline
Junior Member
Join Date: Oct 2008
Posts: 4
Default
8. The chart is pasted on the plastic shell plate after the combined effect of Fig. Complete transformation of the basic hardware.
After the hardware modified, the next step is to do with computer settings QPST. QPST do you pull out before the UIM card and TF card.
First of all installed Microsoft Activesync 4.5, and test computer and connection is the XV6800. Install QPST 2.7 BUILD 215, 215 is the best version. Install the driver Install_MSI_Sprint. Interface into the call, press # # 3434 then dial-up or press # # 3424 # to enter the DM Router mode, the computer recognized the drive hardware manual to find the path, of course, can choose to use a separate drive Modem. Detailed methodology for the other users can refer to the Raiders.
QPST will be prompted to enter the SPC code input and enter the ESN with算号器come SPC code on the code. QPST project settings are:
1. 1x/HDR Secruity column changed to R-UIM of R-UIM Only data that is read-only UIM card.
2. M. IP column replaced by the Mobile IP of Simple IP only.
3. gpsOne options in front of the left column打钩wide right of the PDE IP address 0.0.0 .0, PDE Port for the port of 0, PDE election of DBM, Position of selected PDE.
4. MMC fill 460, MNC fill 03
Set is probably the case! Can be written into the phone, and then click restart phone.
Incidentally, the PRL, RADIO brush and so on for the latest version of the boot can show EV-DO connection (37 frequency points). Access to the CDMA UIM card, make calls to normal! Good call.
The above picture can be enlarged view. This article is for information purposes only personally mr7 represent the actual testing and suggestions. Since I am limited by the level, if you is not correct at the exhibitions.
GO AHEAD! TRY IT ... ... ... ... ... ... ...

does anyone think there is any potential here at all to possibly use the sim card slot to extend the titan/mogul memory.
just trying to think outside the box

SIM cards can store, at most, a few hundred K, and that's ROM space, not RAM. Not even remotely worth thinking about as an expansion.
If you're not planning to use your Titan on an Asian CDMA network that requires a SIM card, this information is completely useless to you.

i beg to differ...this article is from 2006
http://www.pdasnews.com/articles/2118/1/msystems-Announces-Availability-of-High-Capacity-SIM-Cards
get a decent programmer who can remap this as a vfs (virtual file system) and have direct access to the kernel
i know next to nothing in programming...and yes maybe they aren't capable of worthwhile access speeds
or maybe they are...
dont just talk negative...think of the possibilities...the website is solely devoted to not depending on the providers
"if they didn't offer it...its not possible" is a horrible way to think and even be posting on this website
i did find a new program that looks pretty baller
i have a trial copy of it
its called solfs
http://www.eldos.com/solfs/

Related

Changing the identety of wizard.

I wanted to know if its posible to change the identety of the wizard. I do not mean the the name, I mean the identety that the cellphone network picks it up as.
Is it posible or it has to do with the IMEI number?
u have a stolen one?
dont see why on earth should you want to do that if not to put a stolen into working...
I dont meam how to chanege the imei # and the phone is my. the thing that i want to change is want tells the network what kind of cell it is. like when you go to opera browser and on the settings it asks if you want to be identifide as a pc or handheld but for this i want to change for network identety (to show as a different tipy of phone like a moto or nokia)
if it involves changing the imei then i wont do it but could there be some other way or is it even posible?
They can detect your device type??! What makes you think they can detect your device type?
hanmin said:
They can detect your device type??! What makes you think they can detect your device type?
Click to expand...
Click to collapse
In the US, tmobile some how knows what device you have. when i check my service info on the internet it tells me that i own a wizard (tmobile MDA in US) but i then switch the sim to a differerent phone and it then tells me that i have that phone. to download stuff from tmobile u have to have a regular phone because they dont have content for the wizard. so if i could change the id of the wizard or maybe emulate a defferent id i can then download stuff.
Very interesting indeed. AFAIK, the telco is able to get the IMEI of your phone. So, if they were to have a database of all the phone, then probably they can tell what phone you are using by refering to the database.
Or else, try using a cheap old phone to see if they can detect it, thats to make sure that not the high tech phone that is transmitting the 'signal' to the telco for identification.
I have tried it with 4 other phones:1)an old nokia the big ones 2) another nokia small one with mono color screen 3)a cingular motorola v180 not that old but tmobile has released it too 4 months ago 4)a motorola razr V3 from cingular.
the v180 i had tried it before tmobile had theirs and would still come out as owning it and could download with it as the same with the razr but i just resently purchased it.
All would be detected
hanmin said:
They can detect your device type??! What makes you think they can detect your device type?
Click to expand...
Click to collapse
I've read this a looong time ago. An article that stated, that in your IMEI is encoded your phone manufacturer and model. Maybe sth. else, but not sure.. Can anyone correct me if I'm wrong?
BTW: In many countries changing your IMEI is against the law.. so beware
If only their was a way to emulate this but if its the imei then their is no way to do this legaly but posible at own risk
Your definetly right about being able to detect the type of phone. About 5 or 6 years ago we did a bit of development at work based around getting information to remote users via thier mobile. We had a gateway provided by Nokia that we tested which detected the type of phone and it's browser capability and subsequently redirected to the best suited format (WAP, Internet etc). I know this doesn't answer your question but at least your on the right track
ultraprimeomega said:
I wanted to know if its posible to change the identety of the wizard. I do not mean the the name, I mean the identety that the cellphone network picks it up as.
Is it posible or it has to do with the IMEI number?
Click to expand...
Click to collapse
I think you mean changing the "user agent" string ?
That usualy shows what kind of computer + os + browser that you are using
If you use IE then you have to change settings it in the registry
\HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\
I think the "Default" key in there is the most important.
Here is a short list of "user agent" strings : http://webcab.de/wapua.htm
you can check your current "user agent" on sites like this : http://www.schroepl.net/cgi-bin/http_trace.pl
Although its a bit messy on the tiny screen of a pda.
some more info found on wiki xda developers :
Change the 'user agent' identification of PIE
To change the 'user agent' identification of Pocket Internet Explorer, several fields need to be adjusted. The example shows how to identify as Internet Explorer 6 - desktop version
The standard compliance 'user-agent' string:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\(Default) = "Mozilla/4.0" (REG_SZ string, no quotes)
Defaults to "Mozilla/2.0" The application/version string:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Version = "MSIE 6.0" (REG_SZ string, no quotes)
Defaults to "MSIE 4.01" The host operating system string:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Platform = "Windows NT 5.0" (REG_SZ string, no quotes)
Defaults to "Windows CE" Please note that if you change the Platform string, PDA-friendly sites may stop sending you PDA-friendly content automatically. Leave this string set to "Windows CE" unless a site absolutely refuses to work, or you want the site to feed you its normal content.
Flexer said:
I've read this a looong time ago. An article that stated, that in your IMEI is encoded your phone manufacturer and model. Maybe sth. else, but not sure.. Can anyone correct me if I'm wrong?
BTW: In many countries changing your IMEI is against the law.. so beware
Click to expand...
Click to collapse
What T-Mobile USA is doing is most likely based on IMEI. I see 2 ways that they are doing this. 1) They have a database of IMEI's from all of their "branded phones" that they have sold and their corresponding device models. 2) The IMEI contains manufacturer and model info, just as the VIN on a car contains info on the year, make, model, engine, and country of origin. I am thinking more along the lines of option 1 because I have an unbranded QTEK 9100 on the T-Mobile USA network, and the website is unable to determine what phone I am using.
EDIT:
Actually I just logged into T-Mobile's site, and they are now correctly detecting my phone. So the IMEI most definately contains model info just as the VIN on a car. Here is what I am talking about for those of you that dont have T-Mobile USA
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
You can read a lot of info from IMEI number check yourself
http://www.numberingplans.com/?page=analysis&sub=imeinr
shamus said:
You can read a lot of info from IMEI number check yourself
http://www.numberingplans.com/?page=analysis&sub=imeinr
Click to expand...
Click to collapse
Well, that solved the mystery of how they are able to identify your phone. It got mine relatively accuratly (QTek 9100, while mine is a Vario) and enough to knwo whats your phone type.
Thanks for repliying to this and at first i was thinking that you needed to change the imei but i think ill try changing the user agent because this seems like what i was looking for more then how tmobile was knowing what cell i was using but good to know. hope it works
Thanks again.

[SFR TV] for Dream WITHOUT option full Internet XXX

Hello,
I want to view TV channel on my HTC Dream with my illimythics 3G (standard) contract.
SFR tell me it's impossible to do this with iPhone and Android, You must have the option "full Internet Or option iPhone".
I don't wan't to pay an option I have ALREADY have : If my SIM card is in my HTC Cruise Polaris (WM6) I have TV ...
I test if SFR take the hardware or software limitation : This is SOFTWARE limitation :
I am put my SIM card into my Dream G1, make a gateway 3G+ - Wifi, and coonect my cruise without SIM card to the adhoc of my dream and I can see my TV ....
I have also test with another User Agent, this is good results.
I search for an internet Browser with custumisable UA, and it can play the RTSP protocol with this option (for find codec !)
Code:
s=W9
i=RealSystem Broadcast Distribution
c=IN IP4 0.0.0.0
t=0 0
a=SdpplinVersion:1610641560
a=StreamCount:integer;2
a=control:*
a=LiveStream:integer;1
a=LatencyMode:integer;0
a=Title:buffer;"VzkA"
a=range:npt=0-
a=tool:sdpgen 0.1
m=audio 0 RTP/AVP 96
b=AS:12
b=TIAS:12000
b=RR:450
b=RS:150
a=maxprate:16.000000
a=control:streamid=0
a=range:npt=0-
a=length:npt=0
a=rtpmap:96 AMR/8000
a=fmtp:96 octet-align=1;
a=mimetype:string;"audio/AMR"
a=ForceRTP:integer;1
a=AvgBitRate:integer;12000
a=ASMRuleBook:string;"RTCPRule=0,TimestampDelivery=True,Marker=0,AverageBandwidth=12000;RTCPRule=1,TimestampDelivery=True,Marker=1;"
a=PayloadWirePacket:string;"rtp"
m=video 0 RTP/AVP 97
b=AS:100
b=TIAS:100000
b=RR:3750
b=RS:1250
a=maxprate:16.000000
a=control:streamid=1
a=range:npt=0-
a=length:npt=0
a=rtpmap:97 H263-2000/90000
a=fmtp:97
a=mimetype:string;"video/H263-2000"
a=ForceRTP:integer;1
a=AvgBitRate:integer;100000
a=Preroll:integer;1000
a=ASMRuleBook:string;"RTCPRule=0,TimestampDelivery=True,Marker=0,AverageBandwidth=100000;RTCPRule=1,TimestampDelivery=True,Marker=1;"
a=PayloadWirePacket:string;"rtp"
a=framesize:97 176-144
Thanks.

[INFO] WaccoPedia - Sharing is Caring

Sharing is Caring - Caring is Helping - Helping is Sharing​
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Purpose of this thread is to share some useful basic information as gathered using my (rooted) HTC Desire HD, and is meant as non posting/replying reference only thread.
Thanks to all who've posted useful info, helped me with all my questions and contributed their knowledge and skills with the community.
Special thanks to Mike1986 and all ARHD team members for showing skills, respect, patience and humor.
and
BIG respect for all great people I've met on various forums and sites for making great Android ROMs, MODs Themes, Apps, Scripts etc. and for all the posts containing useful and friendly information.
Kernel: "abbreviations"
Governors:
Radio: Preferred Network types and info
RUU (ROM Upgrade Utility):
Android Partitions:
Android: Anatomy and Physiology
CID: Carrier ID (+ some codes)​
GLOSSARY
Code:
[B]2G[/B]
The second generation of mobile telephony systems uses digital encoding. 2G networks support high bit rate voice, limited data communications and different levels of encryption. 2G networks include GSM, D-AMPS (TDMA) and CDMA. 2G networks can support SMS applications.
2.5G
2.5G extends 2G systems, adding features such as packet-switched connection and enhanced data rates. 2.5G networks include EDGE and GPRS. These networks support WAP, MMS, SMS mobile games, and search and directory.
[B]3G[/B]
The third generation of mobile systems provides high-speed data transmissions of 144Kbps and higher. 3G will support multimedia applications such as full-motion video, video conferencing and Internet access.
[B]4G[/B]
As of the end of 2009 it was consensus that 4G would designate Mobile Network technologies beyond 3G and its extensions "3,5G" (HSPA) , "3,75G" (HSPA+). These would logically include WiMax and LTE. In the beginning of 2011 carriers in the US started to misuse the term, advertising their HSPA networks as 4G press coverage on thisismynext Officially, the term 4G has been defined by the ITU to include LTE-Advanced and WirelessMAN-Advanced (WiMax2), none of witch are deployed anywhere still. GSMA PR
802.1X
As the IEEE standard for access control for wireless and wired LANs, 802.1x provides a means of authenticating and authorizing devices to attach to a LAN port. This standard defines the Extensible Authentication Protocol (EAP), which uses a central authentication server to authenticate each user on the network.
802.11
The IEEE standard for wireless Local Area Networks. It uses three different physical layers, 802.11a, 802.11b and 802.11g.
802.11a
Operating in the 5 GHz band, 802.11a supports a maximum theoretical data rate of 54 Mbps, but more realistically it will achieve throughput somewhere between 20 Mbps to 25 Mbps in normal traffic conditions. In a typical office environment, its maximum range is 50 meters (150 feet) at the lowest speed, but at higher speed, the range is less than 25 meters (75 feet). 802.11a has four, eight, or more channels, depending on the country. WLAN products based on 802.11a technology are rapidly coming to market in 2003, making them more affordable and widely available.
802.11b
Most WLANs deployed today use 802.11b technology, which operates in the 2.4 GHz band and supports a maximum theoretical data rate of 11 Mbps, with average throughput falling in the 4 Mbps to 6 Mbps range. In a typical office environment, its maximum range is 75 meters (250 feet) at the lowest speed, but at higher speed its range is about 30 meters (100 feet). Bluetooth devices, 2.4 GHz cordless phones and even microwave ovens are sources of interference (and thus create poor performance) for 802.11b networks. Minimizing interference can be difficult because 802.11b uses only three non-overlapping channels. 802.11b products have been shipping in quantity for several years so you will find that products are plentiful and affordable.
802.11e
802.11e provides Quality of Service (QoS) support for LAN applications, which will be critical for delay-sensitive applications such as Voice over Wireless IP (VoWIP). The standard will provide classes of service with managed levels of QoS for data, voice, and video applications.
802.11g
The 802.11 task force is still developing 802.11g, and it is expected to be ratified as a standard by mid-2003. 802.11g offers the throughput of 802.11a with the backward compatibility of 802.11b. 802.11g will operate in the 2.4 GHz band but it will deliver data rates from 6 Mbps to 54 Mbps. Like 802.11b, it will have up to three non-overlapping channels. 802.11g uses orthogonal frequency-division multiplexing (OFDM) modulation as does 802.11a, but, for backward compatibility with 11b, it also supports complementary code keying (CCK) modulation and, as an option for faster link rates, allows packet binary convolutional coding (PBCC) modulation.
Its "backward compatibility" with 802.11b means that when a mobile 802.11b device joins an 802.11g access point, all connections on that access point slow down to 802.11b speeds.
802.11h
This standard is supplementary to the MAC layer to comply with European regulations for 5GHz WLANs. European radio regulations for the 5GHz band require products to have transmission power control (TPC) and dynamic frequency selection (DFS). TPC limits the transmitted power to the minimum needed to reach the furthest user. DFS selects the radio channel at the access point to minimize interference with other systems, particularly radar. Pan-European approval of 802.11h is not expected until the end of 2003.
802.15
This IEEE working group addresses the standard for WPANs. It has four active task groups.
802.15.1 had the job of delivering the standard for low-speed, low-cost WPANs and is based on the Bluetooth spec.
The 802.15.2 task group is developing the recommended practices on how 802.11 WLANs and 802.15 WPANs can co-exist in the 2.4 GHz band. It is mainly working on the interference problem between Bluetooth and 802.11.
The 802.15.3 task group is delivering a standard for higher speed WPANs from 10 Mbps to 55 Mbps at distances less than 10 meters.
The 802.15.4 task group is preparing a standard for simple, low-cost, low-speed WPANs. Data ranges from 2 Kbps to 200 Kbps and uses DSSS modulation in the 2.4 GHz and 915 MHz ranges.
.apk or APK's
An .apk file extension denotes an Android Package (APK) file, an .apk file can be opened and inspected using common archive tools
.tar
Similar to a zip file, a tar file archives multiple files into one file
.tgz
TGZ files are commonly used as install packages for Slackware Linux.
ActiveSync
This program by Microsoft is what we all use to connect to our computers at work or at home. It allows contacts, tasks, emails and Calendar events to be synchronised with Outlook as well as such things as media and favorites. In Windows Vista this has been replaced by the Windows Mobile Device Center. In addition ActiveSync allows browsing of the device in Windows Explorer and programs can be installed via an 'InstallShield' type package installer. AES - Advanced Encryption Standard.
Security issues are a major concern for wireless LANs. AES is the U.S. government's next-generation cryptography algorithm, which will replace DES and 3DES.
AKU
Adaptation Kit Update - Starting with Windows Mobile 5 Microsoft began a policy of updates similar to that of the desktop windows. Rather the replacing the whole OS some functionality may be added. For example AKU 2.0 introduced push mail. These updates are distributed through the OEMs and are given to the consumer in form of ROM updates. Note that OEM may choose not to create an update with the latest AKU for their devices. Getting an AKU for your phone is like getting the SP2 (Service Pack 2) for your Windows Xp.
AP - Access Point.
Wireless devices, such as laptops or PDAs, connect to a wired LAN via an AP, which is a hardware device or a computer's software that acts as a communication hub. APs provide heightened wireless security and extend the physical range of a wireless LAN.
Application Unlock
Most Windows Mobile phones only allow you to load applications that have an acceptable digital signature. If you try to edit the registry or load an application it will give you an error. Application Unlocking removes this barrier and allows you to install any application or edit the registry to your liking.
Bluetooth
A wireless technology developed by Ericsson, Intel, Nokia and Toshiba that specifies how mobile phones, computers and PDAs interconnect with each other, with computers, and with office or home phones. The technology enables data connections between electronic devices in the 2.4 GHz range. Bluetooth would replace cable or infrared connections for such devices.
Bootloader
The bootloader is the first thing to load once you turn on the device, this does the job of booting up the device hardware and loading various items into memory before the ROM starts in the device. The bootloader is also responsible for enabling the flashing of new ROMs and other components such as the Radio and the Ext_ROM. Two modified bootloaders for the Hermes are HardSPL and SSPL.
To enter the bootloader, press and hold the OK and POWER buttons while inserting the stylus into the reset hole on the bottom of the Hermes.
BREW - Binary Runtime Environment for Wireless
Developed by Qualcomm, BREW is an open source application development platform for wireless devices. BREW developers can create portable applications that work on any CDMA handset. Applications include SMS, e-mail, location positioning, games and Internet radio.
When first introduced, BREW was solely for CDMA handsets. BREW has since been enabled for GSM handsets and expects to add TDMA handsets. BREW and J2ME are competing head-to-head for the wireless application development market.
CDMA - Code Division Multiple Access
A digital wireless technology that uses a spread spectrum technique to scatter a radio signal across a wide range of frequencies. CDMA is a 2G technology. WCDMA, a 3G technology, is based on CDMA.
CDMA has multiple variants, including CDMA 1X, cdma2000, CDMA2000 1X, CDMA2000 1xEV-DO and cdmaOne.
CID
The CID (Carrier ID) of the device is a setting which determines which carrier ROMs should be allowed to run on the device. All bootloaders (apart from HardSPL and SSPL) will only allow a ROM with the correct CID to be flashed onto the device. A device which has been CID unlocked will have SuperCID which allows ANY ROM to be loaded onto the device, SuperCID also unlocks the Ext_ROM and allows it to be mounted.
CID Unlock
Load any carrier ROM (in any language) on the device.
CLDC - Connected Limited Device Configuration
CLDC outlines the basic set of libraries and Java virtual machine features that must be present in each implementation of a J2ME environment.
Cooked
Refers to ROMs which have been modified and optimised by users to offer better performance than a carrier ROM
CustomRUU
CustomRUU is an RUU (Rom Upgrade Utility) which has support for ALL SPL versions including HardSPL and SSPL.
Dalvik (cache)
Dalvik cache is a program cache area for the program dalvik. Dalvik is a java based virtual machine that is the bases for running your programs (the ones that have the .apk extension). In order to make access times faster (because there's not JIT (just in time) compiler installed by default), the dalvik-cache is the result of dalvik doing a optimization of the running program.
De-Odex
Android uses a a java based virtual machine as the bases for running programs. This virtual machine is called Dalvik. A .dex file contains the cache used by the Dalvik VM (called Dalvik-cache) for a program and is stored inside the .apk. A .odex file is an optimized version of the .dex file which gets stored next to the .apk as opposed to inside the .apk. This process is done by default to system apps. Deodexing is the process of converting the .odex files back into .dex to be stored inside the .apk so that things can be more easily modified. So a deodexed rom is one that has been through the deodexing process. Deodex can just as easily be called Unodex or any other pre-fix you wish to use.
EDGE - Enhanced Data GSM Environment
A 2.5G technology that enhances GSM. EDGE increases transmission speeds on GSM networks and enables the transmission of large amounts of data at 384Kbps. With EDGE, mobile operators can deliver multimedia and other broadband applications to mobile phones.
EPOC
EPOC is an operating system developed by Symbian for small, portable computer-telephones with wireless access to phone and other information services. EPOC is based on an earlier operating system from Psion, the first major manufacturer of personal digital assistants (PDAs). The term is no longer in use and is now referred to as Symbian OS.
Ext_ROM or ExtROM
The Ext_ROM (or Extended Rom) is a dedicated part of the ROM memory that is (by default) hidden to the user. This area typically includes cab files that are loaded upon Hard Reset. Also, if the author of a ROM wishes, the flashing process can preserve the Ext_Rom. This space is frequently used by carriers, or others creating ROMs, to store cabs that load settings onto the phone.
Firmware
This is a piece of software that is stored in a device to make it function. It is, unlike ordinary software, usually semi-permanent and resides in a non-volatile storage area which is unaffected by "hard resetting" a device. The term usually refers to low-level code that controls individual hardware components such as a radio rom.
Flash
Term meaning to write something (usually a ROM image) to a non-volatile chip. The term originates from original chip writers (EPROM blowers) which used to write to a chip by fusing tiny areas in the chip making individual links either short circuit or open circuit.
GPRS - General Packet Radio Service
GPRS is a radio technology for GSM networks that adds packet-switching protocols. As a 2.5G technology, GPRS enables high-speed wireless Internet and other data communications. GPRS networks can deliver SMS, MMS, email, games and WAP applications.
GPS
This stands for Global Positioning System. It is technology whereby your device communicates with satellites in orbit around the planet to determine your location within an error margin of a few meters.
GSM - Global System for Mobile communications
GSM, a 2G technology, is the de facto European standard for digital cellular telephone service, and it is also available in the Americas. GSM is the most widely used of the three digital wireless telephone technologies (TDMA, GSM and CDMA), and it supports voice, data, text messaging and cross-border roaming. The SIM (Subscriber Identification Module), a removable plastic card that contains a users data, is an essential element in a GSM network.
GSM operates in multiple frequency bands, GSM 900, GSM 1800, GSM 1900. When GSM is working on a radio frequency of 1800 MHz, it is sometimes referred to as DCS 1800, GSM1800 or PCN.
H.323
H.323 is the standard for interoperability in audio, video, and data transmissions, as well as Internet phone and Voice over IP. The standard addresses call control and management for point-to-point and multipoint conferences, as well as gateway administration of media traffic, bandwidth, and user participation.
HardSPL
This modified bootloader allows a much safer flashing process to take place since it reduces the chance of permenently bricking your HTC based device. It also removes the need to CID Unlock the device since it ALWAYS reports SuperCID when flashing.
Hard Reset
Similar to a soft reset, by performing a hard reset you completely wipe your device and restore it to the position it was in when you first turned the device on after it was purchased or after a new ROM is flashed.
HDML - Handheld Device Markup Language
Handheld Device Markup Language is used to format content for Web-enabled mobile phones. HDML allows Internet access from wireless devices and is derived from HTML. Openwave created this proprietary language, and it can only be viewed on mobile phones that use Openwave browsers.
HDML was created before a WAP standard was defined. It uses Openwave's Handheld Device Transport Protocol (HDTP) instead of WAP. HDTP - Handheld Device Transport Protocol.
This protocol is optimized for HDML. It presents the HDML to the HDML interpreter in an appropriate format.
Heimdall
is a cross-platform open-source tool suite used to flash firmware (aka ROMs) onto Samsung Galaxy S device
IDEN
A specialized mobile radio network technology that combines two-way radio, telephone, text messaging and data transmission into one network.
IPL
Initial program load - usually paired with Secondary Program Load (SPL), is the boot loader of your phone, much like the BIOS is the boot loader for your PC. Note: IPL/SPL are highly hardware dependent, flashing the wrong IPL/SPL is much more serious than a flashing the wrong ROM. It may be noted that, sometimes a ROM package also contains the IPL/SPL which will be flashed into your phone. Hence be extra careful what you are flashing.
J2ME - Java 2 Micro Edition.
Java 2 Platform, Micro Edition (J2ME) is the edition of the Java platform that is targeted at small, standalone or connectable consumer and embedded devices, such as cellular phones and personal digital assistants (PDAs). The J2ME technology consists of a virtual machine and a set of APIs suitable for tailored runtime environments for these devices. The J2ME technology has two primary kinds of components--configurations and profiles.
Java
Industry standard object-oriented language and virtual machine, invented by Sun Microsystems and formally released in 1996. Some phones support downloading of Java applications over the WAP connection. Sun's Java specifications include many Java APIs and platforms, including the JavaPhone API and PersonalJava platform.
Kang
The process of creating a code based of someone else's code or reapplying code that someone else created into your own code (e.g. git cherry-pick)
Kernel
The central or core software component of most operating systems. Its responsibilities include managing the system's resources (the communication between hardware and software components) and can provide the lowest-level abstraction layer for resources (especially memory, processors, and I/O devices).
Messaging
SMS (Short Message Service) is a feature available with some wireless phones that allows users to send and/or receive short alphanumeric messages.
Picture Messaging allows users to send and receive picture messages along with text. Users can choose from several preset and/or received pictures stored in their phones. Some phones also contain a picture editor.
Chat Messaging lets users "talk" using SMS messages.
MMS (Multimedia Messaging Service) is a new standard that is being defined for use in advanced wireless terminals. The service allows for non-real-time transmission of various kinds of multimedia content, such as images, audio, and video clips.
MexE - Mobile Station Application Execution Environment.
Mobile Station Application Execution Environment is a framework to ensure a predictable environment for third-party applications in GSM or UMTS handsets. MExE does this by defining different technology requirements called "classmarks." MExE classmark 1 is based on WAP, classmark 2 on PersonalJava and JavaPhone, and classmark 3 on J2ME CLDC and MIDP. Other classmarks may be defined in the future. MExE specifies additional requirements for all classmarks, for instance a security environment, capability and content negotiation, a user profile, user interface personalization, management of services and virtual home environment. A handset can support multiple classmarks.
Microbrowser
Also called a mini-browser. Software built into a wireless device that allows users to access and display specially formatted Internet content, such as stock reports, news, and sports scores using a handset device.
Mobile Information Device Profile (MIDP)
Set of Java APIs that is generally implemented on the Connected Limited Device Configuration (CLDC). It provides a basic J2ME application runtime environment targeted at mobile information devices, such as mobile phones and two-way pagers. The MIDP specification addresses issues such as user interface, persistent storage, networking, and application model.
Nandroid or Nandroid Backup:
A file typically created in the custom recovery program, such as 4EXT Recovery, that is a carbon copy of whatever state your phone is in. The file is typically stored on the SD card for later use in case something should go wrong in a ROM or Update, or a Boot Loop occurs
.NET Compact Framework
The .NET Compact framework is a smaller version of the .NET Common Language Runtime, optimized for the deployment of mobile applications running on resource-constrained devices such as PDAs. .NET CF supports only devices running Microsoft operating systems-specifically, Windows CE 3.0 (used in Pocket PC 2000 and Pocket PC 2002 platforms).
OBEX - Object Exchange
Object Exchange is a set of protocols allowing objects such as vCard contact information and vCalendar schedule entries to be exchanged using either IrDA or Bluetooth. Symbian OS implements IrDA for exchange of vCards, for example between a Nokia 9210 Communicator and an Ericsson R380 Smartphone, and vCalendar.
OS
Operating System - the platform software for your phone, much like Windows 7 for your PC. Upgrading the OS is like, in PC terms upgrading from Windows Vista to Windows 7.
OC - OverClocking
Overclocking is the process of running a computer component at a higher clock rate (more clock cycles per second) than it was designed for or was specified by the manufacturer
PAN - Personal Area Network
Allows devices to work together and share information and services. Using technologies such as Bluetooth, Personal Area Networks can be created in public places, in the home, in the office, in a car. This network enables everyday devices to communicate wirelessly. For example, a PAN allows users the ability to wirelessly synchronize with a desktop device to access e-mail or the Internet.
Protocol
Similar to `Radio`. Both terms refer to the radio protocol stack, which is the software which handles communications with the mobile network.
QoS - Quality of Service
Quality of Service is a measure of network performance that reflects the network's transmission quality and service availability. QoS can come in the form of traffic policy in which the transmission rates are limited, thereby guaranteeing a certain amount of bandwidth will be available to applications. Or QoS may take the form of traffic shaping, which are techniques to reserve bandwidth for applications but not guarantee its availability.
Radio
The radio stack is responsible for the phone functionality of the device. This includes GPRS, GSM, UMTS, and GPS operations. The version you use depends on who your carrier is as users have reported versions working better on one carrier than the other.
ROM - Read Only Memory
The ROM holds the Operating system and other components such as the bluetooth and wifi stacks. The ROM is accompanied by the Radio, Ext_ROM, SPL and IPL. Carriers such as T-mobile or Vodaphone taylor the ROM to their specifications and version numbers do not carry the same meaning across different carriers. IF the carrier you use supports the device well they will usually release regular ROM updates.
Root
Common word associated with giving a user "super user" access to their phones programming and other various asspects that would normaly not be possible.
RTM
Release to manufacturing or Ready to market.
RUU
The RUU (Rom Upgrade Utility) is the program which runs on the pc when a new ROM is flashed.
Sense
HTC Sense is a user interface, based on the TouchFlo 3D user interface, developed by HTC for mobile devices running Android and Windows Mobile. HTC Sense is a “design experience, an architecture that is all about how people use the device, making their content personal to how they use the device.” However, HTC has confused the issue by calling HTC Sense a user interface in press releases about the launch of the HTC Hero in India. Announced June 24, 2009, the first phone running Android to feature HTC Sense was the HTC Hero, and the first Windows Phone to feature HTC Sense (an updated TouchFlo) was the HTC HD2, announced October 6, 2009.
SIM - Subscriber Identity Module
Cellular systems using GSM technology employ SIM modules to store user provisioning information. Non-volitale storage for contact information is also available on these modules. This is also commonly used in the form `SIM unlock`. Some phones are locked to the specific telco from which you purchase your phone, eg you can't use a locked O2 phone using a Vodaphone SIM/smart card. To use SIM card from other telco, you need to SIM unlock your phone. Note: In general, the phrase 'unlock your phone' usually refers to SIM-unlock, not CID unlock.
SIM Unlock
Use any carrier's SIM in the device.
SIP - Session Initiation Protocol
SIP is the real-time communication protocol for Voice over IP (VoIP), and it has been expanded to support video and instant-messaging applications. SIP performs basic call-control tasks, such as session set up and tear down and signaling for features such as hold, caller ID and call transferring. Its functions are similar to Signaling System 7 (SS7) in standard telephony and H.323 or Media Gateway Control Protocol in IP telephony.
With SIP, most of the intelligence for call setup and features resides on the SIP device or user agent, such as an IP phone or a PC with voice or instant-messaging software. In contrast, traditional telephony or H.323-based telephony uses a model of intelligent, centralized phone switches with dumb phones.
SOAP - Simple Object Access Protocol
SOAP is a way for a program running in one kind of operating system to communicate with a program in the same or another kind of an operating system using HTTP and XML.
Soft Reset
Soft resetting the device will lose all the data currently in RAM and any unsaved information, much like pressing the reset button on your pc. A soft reset is the first thing to try if your device has stopped responding.
SPL
Secondary Program Loader. Refer to `IPL` or `Bootloader` for further information.
SU
"Super user", or root permissions
SuperCID
By CID unlocking your device the value of the CID is changed to 'SuperCID'. This allows the flashing of ANY ROM to the device regardless of the carrier and also unlocks the read/write capability of the Ext_ROM.
UMTS - Universal Mobile Telecommunications System
The 3G mobile telephone standard in Europe, standardized by ETSI. It supports a theoretical data throughput of up to 2 Mbps. Initial trials began in 2001, and it should be rolled out in most of the world by 2005.
UV - UnderVolting
Undervolting is the process of lowering the voltage supplied to the processor in order to achieve lower temperatures and/or saving battery
VoIP - Voice Over IP
VoIP is a set of technologies that enables voice to be sent over a packet network. While few corporations use VoIP today, its usage for messaging is expected to explode in the coming two years.
Users can communicate using VoIP as easily as they do with today's PBXes and public phone network. By leveraging the existing data network, companies can save significant amounts of money by using VoIP for toll-bypass, which is particularly important for multinational corporations. VoIP will also speed the adoption of unified messaging by transmitting voice, fax and e-mail messages. VoIP is also known as IP telephony.
Over the next several years, companies will deploy VoIP in conjunction with 802.11 wireless LANs, enabling workers to have WLAN-based mobile phones when in the office.
VoWIP - Voice over Wireless IP
Combining VoIP with 802.11 wireless LANs to create a wireless telephone system for offices is an emerging market segment. VoWIP enables businesses to leverage their wireless LANs to add voice communications, enabling companies to deploy and manage voice and data over a single wireless backbone.
From a network perspective, VoWIP applications require some reservation of bandwidth to support the real-time nature of voice. Proprietary standards like Spectralink Voice Priority (SVP) are today's solution; however, the IEEE is developing the 802.11e standard for quality of service as a long-term solution.
NOTE:
Thread is under construction, so please accept my appologies regarding not finished/updated posts or typo's
No claims can be made regarding content that I share. Consider this thread as "my private reference"
Kernel: "abbreviations"
A kernel is a layer of code that allows the OS and applications to interface with your phone's hardware. The degree in which you can access your phone's hardware features depends on the quality of code in the kernel. The homebrew (rooting) community for HTC has made several kernel code improvements that give us additional features from our hardware that the stock kernel does not. When you flash a custom ROM, you automatically get a kernel. But you can also flash a standalone kernel on top of the existing one, effectively overwriting it.
A quick and brief overview of some kernel "abbreviations" I've found ..
OC 1.6 - Over Clock max 1,6GHz
OC+1.9 - Over Clock max 1,9GHz
2WCR - Two Way Call Recording support - now you can record incoming and outgoing calls (takes the audio direct from the chipset line in/out)
NCR - No Call Recording support
BFS - Brain **** Scheduler is a task scheduler - major performance increase over stock CFS (Completely Fair Scheduler) -> is not recommended for ROM with Sense
VIO - V(r) Input/Output scheduler - controls data input and output (memory card, disk, etc..) - stock kernel has CFQ
SLQB - a low level memory allocator/manager
MIUI - kernel for MIUI ROM
CFS - Completely Fair Scheduler
CIFS - Common Internet File System (is a virtual file system for Linux to allow access to servers and storage appliances compliant with the SNIA CIFS Specification)
TUN - VPN support
VR - I/O scheduler (better than NOOP)
NOOP - The NOOP scheduler is the simplest I/O scheduler for the Linux kernel.
VDD - Voltage Drain Drain (refers to the positive operating voltage of a field effect semiconductor device.)
NLS - National Language Support
Governors:
CPU governors control exactly how the CPU scales between your "max" and "min" set frequencies.
- ondemand -> Available in most kernels, and the default governor in most kernels.
When the CPU load reaches a certain point, ondemand will rapidly scale the CPU up to meet demand, then gradually scale the CPU down when it isn't needed.
- conservative -> Available in some kernels. It is similar to the ondemand governor, but will scale the CPU up more gradually to better fit demand.
Conservative provides a less responsive experience than ondemand, but can save battery.
- performance -> Available in most kernels. It will keep the CPU running at the "max" set value at all times.
This is a bit more efficient than simply setting "max" and "min" to the same value and using ondemand because the system will not waste resources scanning for the CPU load. This governor is recommended for stable benchmarking.
- powersave -> Available in some kernels. It will keep the CPU running at the "min" set value at all times.
- userspace -> This lets programs that runs on the OS decide the CPU frequency.
- interactive -> The 'interactive' governor has a different approach. Instead of sampling the cpu at a specified rate, the governor will scale the cpu frequency up when coming out of idle.
When the cpu comes out of idle, a timer is configured to fire within 1-2 ticks. If the cpu is 100% busy from exiting idle to when the timer fires then we assume the cpu is underpowered and ramp to MAX speed.
If the cpu was not 100% busy, then the governor evaluates the cpu load over the last 'min_sample_rate' (default 50000 uS) to determine the cpu speed to ramp down to.
- smartass -> Is an improved version of interactive governor (Best explanation i've found paraphrases to: based on interactive, but better.)
(smartass is a "double" governor (near interactive - awake mode, near conservative (but not the same) - sleep mode), so when you use it in sleep mode, actually you use only a "half" of it.
- smoothass -> (improved smartass)
- brazilianwax -> Very agresive version of smartass
- interactiveX -> Tweaked Interactive governor by Imoseyon by adding more features like suspend/wake profile
- ondemandX -> Tweaked and ported from 2.6.38 base Ondemand governor by Imoseyon by adding more features like suspend/wake profile
It's got its own sleep profile built in, so it doesn't play well with the OC daemon ..!
- smartassV2 -> smartassV2 is generally based on the implementation of interactive with some major changes and the addition of a built in sleep profile (behaves a bit differently when screen is off vs. on).
The smartassV2 improves the very naive scheme which the first smartass had.
- lagfree -> lag free, but not that battery friendly as ondemand
Note: as far as I could find it, smartass2 = smoothass. Original it was called smartass2, but the name has been changed into smoothass.
* wake_min_freq = setting -> minimal frequency for device while it's awake
* wake_max_freq = setting -> maximal frequency for device while it's awake
* sleep_min_freq = setting -> minimal frequency for device while it's sleeping
* sleep_max_freq = setting -> maximal frequency for device while it's sleeping
* wake_governor = governor for device while it's awake
* sleep_governor = governor for device while it's sleeping
Radio: Preferred Network types and info
GSM => GSM(2G), GPRS(2.5G), EDGE(2.75G), UMTS(3G), WCDMA(3G), HSDPA(3.5G/3G+) HSUPA(3.75G) {Cell Carrier examples: AT&T and T-Mobile}
CDMA => CDMA(2/3G) EV-DO(3G) WiMax(3/4G) {Cell Carrier examples: Verizon and Sprint}
HSPA+ Evolved High Speed Packet Access (84 Mbit/s in the downlink and 22 Mbit/s in the uplink)
H: HSDPA High Speed Downlink Packet Access (Category 8 - 7.2 / Category 10 - 14,0 Mbit/s in the downlink)
H: HSUPA High Speed Uplink Packet Access (Category 6 - 5.76 Mbit/s in the uplink)
3G: UMTS Universal Mobile Telecommunications System (384 kbit/s -> (max 2 Mbit)
E: EDGE Enhanced Data Rates for GSM Evolution (384 kbit/s)
G: GPRS General Packet Radio Service (52 kbit/s)
GSM Global System for Mobile Communications (14.4 kbit/s)
Remark:
The ROM has a file called "build.prop" with various important settings in it.
One of these settings is "ro.ril.hsxpa=2", this means you (might) have/use a HSDPA/HSUPA network (also called "HSPA") with high speed downloads and uploads, and this setting gives you the "U" in the radio name found in "Settings - About phone - Software information - More - (Baseband version)"
Code:
ro.ril.hsxpa indicates hsxpa support of the target network:
#
# Network parameters
#
#ro.ril.hsxpa : inidcates hsxpa support of target network :
# 0 - UMTS r99
# 1 - HSDPA
# 2 - HSDPA/HSUPA
#
#ro.ril.gprsclass : inidcates GPRS class of target network :
# Class 2 : 3 slots : 8 - 12 kbps upload / 16 - 24 kbps download
# Class 4 : 4 slots : 8 - 12 kbps upload / 24 - 36 kbps download
# Class 6 : 4 slots : 24 - 36 kbps upload / 24 - 36 kbps download
# Class 8 : 5 slots : 8 - 12 kbps upload / 32 - 40 kbps download
# Class 10 : 5 slots : 16 - 24 kbps upload / 32 - 48 kbps download
# Class 12 : 5 slots : 32 - 48 kbps upload / 32 - 48 kbps download
#
#ro.ril.hsdpa.category :
# Cat 1 = 1.2 Mbit/s
# Cat 2 = 1.2 Mbit/s
# Cat 3 = 1.8 Mbit/s
# Cat 4 = 1.8 Mbit/s
# Cat 5 = 3.6 Mbit/s
# Cat 6 = 3.6 Mbit/s
# Cat 7 = 7.2 Mbit/s
# Cat 8 = 7.2 Mbit/s
# Cat 9 = 10.1 Mbit/s
# Cat 10 = 14.0 Mbit/s
# Cat 11 = 0.9 Mbit/s
# Cat 12 = 1.8 Mbit/s
# Cat 13 = 17.6 Mbit/s
# Cat 14 = 21.1 Mbit/s
# Cat 15 = 23.4 Mbit/s
# Cat 16 = 27.9 Mbit/s
# Cat 19 = 35.3 Mbit/s
# Cat 20 = 42.2 Mbit/s
# Cat 21 = 23.4 Mbit/s
# Cat 22 = 27.9 Mbit/s
# Cat 23 = 35.3 Mbit/s
# Cat 24 = 42.2 Mbit/s
# Cat 25 = 46.8 Mbit/s
# Cat 26 = 55.9 Mbit/s
# Cat 27 = 70.6 Mbit/s
# Cat 28 = 84.4 Mbit/s
#
#ro.ril.hsupa.category :
# Cat 1 = 0.73 Mbit/s
# Cat 2 = 1.46 Mbit/s
# Cat 3 = 1.46 Mbit/s
# Cat 4 = 2.93 Mbit/s
# Cat 5 = 2.00 Mbit/s
# Cat 6 = 5.76 Mbit/s
# Cat 7 = 11.5 Mbit/s
#
#Not speed related, but still nice to have :
#ro.ril.enable.3g.prefix : adds the 3G prefix to the operator name.
# ro.ril.enable.dtm : Only set this to 1 if your network allows simultaneous
# transfer of Circuit switched (CS) voice and Packet switched
# (PS) data over the same radio channel (ARFCN).
Preferred Network types:
WCDMA preferred - Automatically switches between G/E/3G/H based on the best/strongest signal available and is supported by all providers.
Has high battery usage since it constantly scans the network for the strongest signal to switch.
GSM only - Only uses G/E and never switches to 3G/H. Should have minimal battery usage.
(there is a problem with GSM only on some older networks... so if data is used, you can miss calls, thus GSM auto (PRL) is the safest setting)
WCDMA only - The GSM phone is capable of using only 3G data communication. When the 3G signal is too low you get nothing at all.
Only uses HSDPA and will not switch to G/E/3G even if the HSPDA signal is too low. Use this only if you use your phone in a area with good coverage. Should have moderate battery usage.
GSM auto (PRL) - Automatically switches between G/E/3G/H based on the PRL (Preferred Roaming List) for a provider on your phone.
Not supported by all providers and may not be supported in certain regions. Should have moderate battery usage since it uses a predefined list to switch.
CDMA auto (PRL) - The CDMA phone is capable of using both 2G and 3G data communication and when signal strength is low 2G is favored more.
CDMA only - The CDMA phone is capable of using only 2G data communication. When the 2G signal is too low you get nothing at all.
EvDo only - The CDMA phone is capable of using only 3G data communication. When the 3G signal is too low you get nothing at all.
GSM/CDMA auto (PRL) - Some phones are equipped with both GSM and CDMA capabilities. This setting appears to just have the phone attempt to stay connected to the data communication type that works the best.
Unknown - If none of the above fit or the phone is acting weird as far as connecting to the carrier, you will see your preferred network type is set to this
General NOTE:
If not known how to get a preferred network type, dial *#*#4636#*#* , this brings you in the "Testing" menu, select "Phone information" and scroll down to "Set preferred network type: "
Always be careful with switching to "PRL" as device issues might occur if "PRL" is not supported by your network provider !!
RUU (ROM Upgrade Utility):
A) RUU Update - Flashing Android RUU Update Using HBoot
- First you need the RUU.exe that you intend to install.
- Run the RUU as Administrator.
- Tick the 'I understand the caution indicated above...' box, and click next.
- At this point do not go any further!
- Navigate to C:\Users\xxxxx\AppData\Local\Temp (xxxxx is your user name , and ... AppData is a hidden folder)
- You should see one or two folders like this example: {E328FA5C-81C2-4B70-96AE-D5418A9A5B75}
- Go into the folder with "dotnetinstaller.exe".
- Open the next folder. (like this example: {50F2F878-636A-496F-A7CB-544C067E0C4B}
- Copy "rom.zip" into another folder (outside of temp).
- At this point just Cancel and quit the ROM Update Utility.
- Rename the "rom.zip" to "PD98IMG.zip" and put it on to the root directory of your MicroSD card in your phone.
- Shut down the phone.
- Press the Power button + Volume down button at the same time and hold them untill you get to HBOOT (white screen with skateboarding android).
- Wait for the HBOOT to parse the zip file.
- Follow the on-screen instructions and boot into newly flashed device.
B) RUU Update - Install through PC
Download and install the latest HTC Sync and restart your computer.
- Download and run the 1.15.405.1 Test RUU as Administrator. (This one is known to find the Android DHD)
- Get to the "1. Connect the Smartphone to the USB Cable" step. (but no further !!!!)
- Go to the C:\Users\xxxxx\AppData\Local\Temp directory, and find the folder with dotnetinstaller.exe and inside the next folder find the rom.zip
- Delete this "rom.zip" (which is the 1.15 version !!) and replace it with the "rom.zip" copied out earlier!!! -> See A) RUU Update - Flashing Android RUU Update Using HBoot !!!
Back to the RUU installer ...
- Now click through the next buttons.
- The RUU Utility should now be set to update. You will see the version number of the rom at the final step.
- Click update...
Android Partitions:
Android uses several partitions to organize files and folders on the device. Each of these partitions has a distinct role in the functionality of the device.
Standard internal memory partitions on Android phones and tablets:
/boot
/system
/recovery
/data
/cache
/misc
Hardware specific partitions:
(They are tied to the hardware of the phone, but the kernel may have code allowing Android to interact with said hardware.)
/radio
/wimax
SD card partitions:
/sdcard
/sd-ext
Note that only /sdcard is found in all Android devices and the rest are present only in select devices.
Purpose and contents of each of these partitions:
/boot
This is the partition that enables the phone to boot, as the name suggests. It includes the bootloader and the kernel. Without this partition, the device will simply not be able to boot.
Wiping this partition from recovery should only be done if absolutely required and once done, the device must NOT be rebooted before installing a new one, which can be done by installing a ROM that includes a /boot partition.
/system
This partition basically contains the entire operating system, other than the kernel and the bootloader. This includes the Android user interface as well as all the system applications that come pre-installed on the device. (Sense, boot animation, busybox, etc)
Wiping this partition will remove Android from the device without rendering it unbootable, and you will still be able to put the phone into recovery or bootloader mode to install a new ROM.
/recovery
The recovery partition can be considered as an alternative boot partition that lets you boot the device into a recovery console for performing advanced recovery and maintenance operations on it.
/data
Also called userdata, the data partition contains the user’s data – this is where your contacts, messages, settings and apps that you have installed go. Wiping this partition essentially performs a factory reset on your device, restoring it to the way it was when you first booted it, or the way it was after the last official or custom ROM installation. When you perform a wipe data/factory reset from recovery, it is this partition that you are wiping.
/cache
This is the partition where Android stores frequently accessed data and app components. Wiping the cache doesn’t effect your personal data but simply gets rid of the existing data there, which gets automatically rebuilt as you continue using the device.
/misc
This partition contains miscellaneous system settings in form of on/off switches. These settings may include CID (Carrier or Region ID), USB configuration and certain hardware settings etc. This is an important partition and if it is corrupt or missing, several of the device’s features will will not function normally.
/radio
The phone's radio firmware, controls cellular, data, GPS, bluetooth.
/wimax
Firmware for Sprint's flavor of 4G, WiMax.
/sdcard
This is not a partition on the internal memory of the device but rather the SD card. In terms of usage, this is your storage space to use as you see fit, to store your media, documents, ROMs etc. on it. Wiping it is perfectly safe as long as you backup all the data you require from it, to your computer first. Though several user-installed apps save their data and settings on the SD card and wiping this partition will make you lose all that data.
On devices with both an internal and an external SD card – devices like the Samsung Galaxy S and several tablets – the /sdcard partition is always used to refer to the internal SD card. For the external SD card – if present – an alternative partition is used, which differs from device to device. In case of Samsung Galaxy S series devices, it is /sdcard/sd while in many other devices, it is /sdcard2. Unlike /sdcard, no system or app data whatsoever is stored automatically on this external SD card and everything present on it has been added there by the user. You can safely wipe it after backing up any data from it that you need to save.
/sd-ext
This is not a standard Android partition. It is basically an additional partition on your SD card that acts as the /data partition when used with certain ROMs that have special features called APP2SD+ or data2ext enabled. It is especially useful on devices with little internal memory allotted to the /data partition. Thus, users who want to install more programs than the internal memory allows can make this partition and use it with a custom ROM that supports this feature, to get additional storage for installing their apps. Wiping this partition is essentially the same as wiping the /data partition – you lose your contacts, SMS, market apps and settings.
Android: Anatomy and Physiology
Google IO's "Android: Anatomy and Physiology" .pdf​
CID: Carrier ID (+ some codes)
CID lock (aka vendor lock): Carrier Id - put on your device by the manufacturer to prevent installation of a ROM not released by them. Commonly used in the form `CID-Unlocking`. If you purchase your phone (example) from Vodafone (Vodafone is the ‘carrier’), your phone will only accept Vodafone ROMs (the carrier’s ROMs). If you want to flash ROMs from other carrier, you’ll need to CID-unlock your phone, so that your phone will accept other ROMs. All bootloaders (apart from HardSPL and SSPL) will only allow a ROM with the correct CID to be flashed onto the device. A device which has been CID unlocked will have ‘SuperCID’ which allows ANY ROM to be loaded onto the device, SuperCID also unlocks the Ext_ROM and allows it to be mounted. Note: In general, the phrase ‘unlock your phone’ usually refers to SIM-unlock, not CID unlock.
Code:
SuperCID 11111111
Asia-HK-CHT HTC__622
ATT CWS__001
BM BM___001
Bouygues-Telecom BOUYG201
Brightstar-PTB BSTAR502
Brightstar-SPA BSTAR301
Chunghwa-Taiwan CHT__601
CT HTCCN702
CU HTCCN703
DCM DOCOM801
DOPOD DOPOD701
Era T-MOB009
Fastweb-IT FASTW401
GOOGLE GOOGL001
H3G-DAN H3G__F05
H3G-Italy H3G__402
H3G-ROI H3G__003
H3G-SWE H3G__G04
H3G-UK H3G__001
HTC-Asia-SEA HTC__037
HTC-Asia-SEA-WWE HTC__044
HTC-Australia HTC__023
HTC-BE HTC__E41
HTC-Czech HTC__C24
HTC-Denmark HTC__F08
HTC-Dutch HTC__E11
HTC-EastEurope HTC__032
HTC-ELL HTC__N34
HTC-FRA HTC__203
HTC-FRA-Bouygues HTC__247
HTC-GCC HTC__J15
HTC-GER HTC__102
HTC-India HTC__038
HTC-ITA HTC__405
HTC-Nor HTC__Y13
HTC-Norway HTC__H10
HTC-Poland HTC__B25
HTC-PTG HTC__506
HTC-Russia HTC__A07
HTC-Singapore ????????
HTC-SPA HTC__304
HTC-Sweden HTC__G09
HTC-Turkey HTC__M27
HTC-WWE HTC__001
Hutch-Australia HUTCH001
O2-DE O2___102
O2-UK O2___001
Open-Channel HTCCN701
Optus-Australia OPTUS001
ORANGE-AT ORANG113
ORANGE-BE ORANG012
ORANGE-CH-FRA ORANG203
ORANGE-CH-GER ORANG104
ORANGE-ES ORANG309
ORANGE-French ORANG202
ORANGE-PL ORANGB10
ORANGE-PO ORANG008
ORANGE-SK ORANG006
ORANGE-UK ORANG001
Rogers ROGER001
SMC-Voda-HK SMCVD001
StarHub-Singapore ????????
TELEF-Spain TELEF301
Telstra TELST001
TELUS TELUS001
TIM-Italy TIM__401
TMA T-MOB102
TMCZ T-MOB004
TMD T-MOB101
TMH T-MOB007
TMHR T-MOB006
TMMK T-MOBL11
TMNL T-MOB003
TMSK T-MOB008
TMUK T-MOB005
TMUS T-MOB010
TWM-TW HTC__621
VIRGIN-UK VIRGI001
VODA-Africa-South HTC__016
VODA-Australia VODAP021
VODA-Germany VODAP102
VODA-Greece VODAP006
VODA-Ireland VODAP019
VODA-Italy VODAP405
VODA-Mobilkom VODAP120
VODA-Netherland VODAPE17
VODA-New-Zealand VODAP022
VODA-Portugal VODAPD18
VODA-Proximus VODAP024
VODA-SA VODAP026
VODA-SFR VODAP203
VODA-Spain VODAP304
VODA-Swisscom-DE VODAP110
VODA-Swisscom-FR VODAP212
VODA-Swisscom-IT VODAP416
VODA-Swisscom-WWE VODAP015
VODA-TR VODAPM27
VODA-UK VODAP001
reserved for future usage 8
reserved for future usage 9
reserved for future usage 10
No questions, No comments Please
This is a refference only thread.
Thanks

[XMM6260][X-GOLD 626] Modem Specification / Documentation / Hack-Pack

Intel / Infineon XMM6260 & X-GOLD 626 Modem Hack-Pack Release!
After several unsuccessful months of trying to get my phone (application) to
talk AT-commands with the baseband processor (BP), I've had to learn a lot of
hardware and internal Android and OEM based tricks and secrets. Although this
have not been enough to make anything of practical use, it is definitely worth
sharing. If not at least some more talented people may be able to continue
where I have left of...
Now, it should be immediately stated that there is nothing revolutionary
in here, apart the Infineon manual for tuning your GSM modem, using the
AT CLI and GTI sequencer. This is something that could potentially be very
useful for better understanding the advanced features that the modem
platform incorporates. However, it is also a sure way of making a an
expensive brick out of your phone! You have been warned...
Brief Modem Description
The XMM6260 is the "platform" that consists of:
The X-GOLD 626 baseband processor
The SMARTi UE2 RF-transceiver DSP
The 3GPP Release 7 HSPA+ protocol stack with:
Downlink: Category 14, Uplink: Category 7
The X-GOLD 626 baseband processor (labelled "PMB 9811") is communicating
with the DSP RF-tranceiver chip called SMARTi-UE2 (labelled "PBM 5712 A1"),
using a communication interface that corresponds to the MIPI DigRF-3G
(V.3.09) standard. Through this protocol the BP can control some or all
aspects of the RF DSP.
Alternative Names
Infineon IFX6260
Intel IMC6260
Intel XMM626
Some other devices using this platform:
Code:
- Lava XOLO X900 [Phone] FCC ID: ???
- Lenovo K800 [Tablet/Pad] FCC ID: ???
- LG-P920 (LG ?) [Phone] FCC ID: BEJP920
- LG-P925 (LG Optimus 3D?) [Phone] FCC ID: BEJP925
- Huawei E369 (3G Hi-Universe) [USB 3G Modem] FCC ID: QISE369 (Russian distrubutor: Merlion)
- Huawei MU733/MU739 [PC/CE Module] FCC ID: QISMU739
- Samsung Galaxy Nexus (I9200) [Phone] FCC ID: ???
Other devices that may (!?) also contain the X-GOLD 626:
---------------------------------------------------------
- LG Optimus 4X HD [Phone] FCC ID: ???
- HTC One X [Phone] FCC ID: ???
- Huawei Ascend D Quad [Phone] FCC ID: QIS ???
- Huawei E392 (E392u-511) [LTE Multi-mode USB stick] FCC ID: QISE392U-511
- Huawei E353 (E352s-6) [HSPA+ USB stick] FCC ID: QIS ???
Hack-Pack Content
Code:
- Pictures/Diagrams:
- XMM6260 colored pinout map
- XMM6260 mounted in a Samsung Galaxy S2
- SMARTi UE DSP RF-tranceiver chip mounted in the SGS-2
- IPC xxxxxx stuff
- Infineon PhoneTools testing program
- Raw 1byte greyscale PNG of modem.bin from XXKI1
- PDF files/documents:
- ITA-RF-Adjustment-GSM (XMM6260 Specification)
- Infineon MIPI-HSI Product Brief
- X-GOLD 616 Product Brief
- Fairchild FSA9280/88A USB/UART switch/MUX datasheet
- Similar Modem AT sets/documents:
- AT_Command_Set_3GPP-TS-27007-940.pdf
- AT_Command_Set_AMOD_HSPA.pdf
- AT_Command_Set_Gobi.pdf
- AT_Command_Set_Motorola_XM7200S.pdf
- AT_Command_Set_Teltonika_TM3.pdf
- AT_Command_Set_iWOW_TR-900.pdf
- Text Files:
- 3GPP 27.007 AT-list
- XMM6260 official AT-set
- XMM6260 internal AT-set
- XMM6260 homebrew specifications
+ X-GOLD 626 Modem pinouts
+ MUX pinouts
+ AP connections (SGS2)
+ AP relevant info
- Strings of modem.bin (stock firmware image: [B]XXKI1[/B])
- Strings of drexe
- Strings of rild
- Strings of libril.so
- Strings of libsec-ril.so
- GT-I9100 stock (GB 2.3.4) binary files:
(Taken from: PDA:[B]XWKI4[/B], Phone:[B]XXKI1[/B])
- libKiesDataRouter.so
- libril.so
- libsec-ril.so
- libsecril-client.so
- drexe
- rild
- Android hardware hacking binaries (tools):
- dbus-monitor
- dbus-send
- hciconfig
- hcidump
- hcitool
- i2cdetect
- i2cdump
- i2cget
- i2cset
- ipcfilter
- ipcdump
- ipctool
- procmem
- showmap
- showslab
- strace
- tcpdump
- viewmem
+ various other content
Download Here! (57.72 MB)
The modem firmware referred to and studied can be
found here (Modem.bin.7z) or here, under "XXKI1".​-------------------------------------------------------------------------------
DISCLAIMER:
All the material in this collection was found on internet by
appropriate Google-Fu and/or by laborious manual creation.
Nothing is stolen or reversed, so I am not held responsible
for the origin or problems affiliated with the use of these
documents, programs or other binaries.
-------------------------------------------------------------------------------
​If you are a developer or other corporate official of Intel or Infineon:
Please contact your superiors and ask them to release the proper
datasheets and documentation of these products to the public.
Why? Because:
It would significantly increase the sales of your hardware, by promoting
a much more open approach to hardware development. There are currently
more than 10 open-sourced and open-hardware smartphone projects around
the world, who would benefit from the use of a more modern baseband than
what is currently and openly available.
.
It would significantly promote your hardware in front of your competitors,
as your company would be the first one to open up your documentation to the
public. Thus increasing public technical knowledge of your hardware, which
would ultimately lead to you having an easier time to find qualified
developers that cost you less!
.
It would significantly reduce the cost and time for firmware development,
while increasing the firmware code-quality and compatibility, as you
would be able to benefit from the large community and knowledge from
other professional developers as well as hardware-hackers.
(Yes, there are several bugs found in your firmware, but since there is
no way to report and discuss these with your developers, they will
continue to cost you money and head-scratching for all developers
having to deal with your platform.)
.
Your competitive advantage due to 1-3, would promote new and better
future hardware developments, that would not only benefit your
company/business but also society as a whole.
.
Its simply the right thing to do!
The thread where all this become crisply relevant is this one:
[A][SGS2][Serial] How to talk to the Modem with AT commands
There you will find all documents which I have found to date, which
is essentially none. At least nothing that can be of ANY practical use.
UPDATE: [2012-04-17]
As soon as I get a chance I'll update the HackPack (HP) with new data regarding the MUX
and some other hardware used in the SGS2. This data, as presented within HP, is simply wrong!​
Reserved 2 me 3
Awesome info I was also thinking looking at the ServiceMode application in the SGS2 could provide interesting information. BTW, do you know if the X-GOLD has a diagnostic mode similar to the one usually found in Qualcomm modems?
xd.bx said:
Awesome info I was also thinking looking at the ServiceMode application in the SGS2 could provide interesting information. BTW, do you know if the X-GOLD has a diagnostic mode similar to the one usually found in Qualcomm modems?
Click to expand...
Click to collapse
Thanks! The ServiceMode app is mostly interesting because its code actually reside inside the Modem firmware, where the java app is acting as a wrapper. I'm not familiar with the Qualcomm modems, could you elaborate on what that "diagnostic mode" does? (The x-gold firmware is FULL of various modes. Just depends on what you want to do, and to get the proper documentation on how to use it!)
Just found ... a bit older, but still very interesting
http://hwplatform.googlecode.com/svn/trunk/Infineon/
RNC States from libsec-ril.so
Hi
Very valuable information! Does anyone have an idea about how to get the information displayed from serviceMode programatically? Looks like most of it is being polled directly to the libsec-ril.so. In my case I'm interested in obtaining information about the RNC states on the handset
Thanks for this information
Thanks for the info E:V:A. I did quite some figuring out about the Radio/DSP unit of the Nokia DCT3 back in the day and also the GSM protocol (anyone remember Project Blacksphere / OpenGPA?).
Things have likely come a long way since then. One thing that is clearly different is that the baseband processor is completely isolated from the application processor. In the DCT3 there was one ARM processor that drove both the user interface and parts of the GSM protocol, and connected to a DSP for the low-level radio stuff.
I wonder how other things have changed with 3G. I may get back in the game. This will give me an headstart
Memory map and boot process
It appears that modem.bin consists of multiple partitions that are loaded separately at bootup of the device, reflecting the modem boot up sequence in libsec-ril.so:
Code:
Offset Size Address Description
0x000000 0x00f000 0x00800000 PSI
0x00f000 0x019000 0x60000000? EBL
0x028000 0x9d8000 0x60300000 Main image
0x9ff800 0x000800 Used for verification (buliding ReqSecStart command)?
0xa00000 0x200000 0x60e80000 NV data (file contains default data)
0xc00000 0x000200 Unused?
Offset is offset in file, address is flash/ram offset on device. Whereabouts about the EBL are a bit unknown, address 0x60000000 is based on a guess the others are sure.
Also I did an attempt at constructing the run-time memory map of the device, based on static analysis but as I've not found a way yet to actually probe it there are quite a few question marks.
Code:
Device memory map:
0x00000000 RAM/ROM? (what is here?)
0x00080000 PSI bootloader *RAM*
0x40000000 Flash (what is flashed here?)
0x60000000? Code (EBL)
0x60100000 Flash
0x60300000 Code (Flash)
0x60e80000 NVram data (Flash)
0xe0000000 Peripheral mapping for memory-mapped I/O (256MB)
0xffff0000 Memory (initial stack)
As for I/O devices in peripheral mapping, my understanding is still very limited and based on the bootloader only. I have a longer list of addresses from static analysis, but as I can't yet label anything it is pointless to publish. As usual, the upper bits (how many? 8?) select which peripheral, the lower bits (20?) select a port within that peripheral.
Code:
0xe4d00164 ? status bits
0xe4d00384 ? status bits
0xe8000070 ? status bits
Entry points:
Code:
Offset Address Description
0x000000 0x00080000 Boot loader
0x00f400 0x60000000? EBL
0x1a8000 0x60480000 Main stack
I'm trying to run this in QEMU and created a basic environment, but as my understanding of ARM kernel space (interrupt handling, timers, etc) is very limited, it currently gets stuck in a loop waiting for some other thread (or interrupt handler) to update an address.
just thought it might be of interest and help - http---en.samaanet.com/?p=2390
direct link:
http://en.samaanet.com/?p=2390
Polarfuchs said:
direct link:
http://en.samaanet.com/?p=2390
Click to expand...
Click to collapse
That's a direct rip-off of my XDA thread!
Any more posts with such links will be removed!
How should I know, I just posted the link as "service" because the user above me could't post links.
I've been informed that the download link doesn't work. i will upload again as soon as I have time...
Really interesting stuff you have got here.
One thing I've been searching for a while now: I own a Galaxy Nexus, which has a XMM6260 modem. Samsung had on their stock ROM a feature in service mode where you can check the power modes of the 3G data connection. Since the Galaxy S2 has the same modem, thus it should be possible to get that feature.
I'm interested in this stuff because my Galaxy Nexus likes to drain like crazy on the 3G network that I use and I suspect that it has to do with the 3G data power modes. 3G+wifi is extremely efficient in power use but 3G+mobile date is al big battery hog.
I hope you post a working link soon, than I can start reading this stuff.
Seems like this might be the best place to ask this... I also asked in the "fun with AT commands" thread so my apologies up front for the spam.
I'm looking for a fastboot friendly radio baseband I can flash with a 4.2.1 friendly RIL. This may be more than what I actually need but I've got a full telephony build of the Nexus 7 3G going and while SMS and MMS are fully functional I'm getting a CME ERROR: 4 when I try to do voice dialing and don't see anything coming in via logcat on an inbound call.
The mobile plan I'm using is full voice capable and verified as functional.
Doing a strings of the included RIL (libxgold-ril.so) shows all the necessary voice functions listed (although I guess this could be a false positive if it is interface based).
The modem mounts up on /dev/ttyACM0 and I'm able to do all the basics with radiooptions, except voice dialing and answering of course.
Any pointers / advice / direction would be greatly appreciated... coming up to speed real quick in this area.
XGold626 One X Pinout
I have removed my BB CPU and here is the pinout if it helps anyone
How to start?
I'm a rookie so is anyone can provide a step-by-step tutorial about how to send AT commands to the baseband processor directly? Right now I only can use i2cdetect to list i2c channels, but how to do next?
Thanks,
Andong
XGold 626 Reversing
witchspace said:
It appears that modem.bin consists of multiple partitions that are loaded separately at bootup of the device, reflecting the modem boot up sequence in libsec-ril.so:
[snip]
Click to expand...
Click to collapse
Hi!
Nice work. I'm working on reversing the xgold626 baseband as well. Specifically, I'm looking at the NELK2 baseband for my GT-i9300.
Perhaps we could join forces? Anyone else working on reversing the xgold626 baseband is welcome to contact me as well.
I'm reachable at: je at clevcode.org, or on my ircd (irc.clevcode.org, port 7000, SSL, nick je).
Cheers,
Joel
witchspace said:
It appears that modem.bin consists of multiple partitions that are loaded separately at bootup of the device, reflecting the modem boot up sequence in libsec-ril.so:...
I'm trying to run this in QEMU and created a basic environment, but as my understanding of ARM kernel space (interrupt handling, timers, etc) is very limited, it currently gets stuck in a loop waiting for some other thread (or interrupt handler) to update an address.
Click to expand...
Click to collapse
clevcoder said:
Specifically, I'm looking at the NELK2 baseband for my GT-i9300. Perhaps we could join forces? Anyone else working on reversing the xgold626 baseband is welcome to contact me as well.
Click to expand...
Click to collapse
Yep, that is very interesting. Send me PM if there are more interest in pursuing this further! What's the primary interest of doing this?

Everything on the Lumia 520 (AT&T GoPhone edition)

I just picked one of these that I intend to keep as a spare WP8 device. My 928 will still be my permanent device, but I just needed one with all of AT&T's apps. I paid $79.99 for one of these for a colored back and a free 8GB microSD along with a USB nub and a charger (sans usb-adapter) from a local RadioShack. Nothing has really been unpackaged, but I'm still drudging through. I just took a few screenshots, but more soon. The first thing I'm testing will be the dial codes WITHOUT updates.
Model Number:
RM-915
Product Code:
059T7N4
Variant name:
RM-915 VAR US ATT PAYG RADIO SHACK SL 8G
Current Software Verizon:
3043.0000.1324.0001
Pinned Tiles:
View attachment 2397894View attachment 2397895View attachment 2397896
Installed Apps:
View attachment 2397899View attachment 2397900View attachment 2397901View attachment 2397902
Default Lockscreen:
View attachment 2397905
About Page:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
extras+info before update:
extras+info after store update:
network+
audio
Shipped APPS
SETTINGS APPS
extras+info
storage check
display+touch
network+
audio
feedback to Nokia
Nokia account
accessories
AT&T APPS
ATT Address Book
http://www.windowsphone.com/s?appid=f5374978-12f0-4637-9563-d80a08c5f113
ATT Navigator
http://www.windowsphone.com/s?appid=b2d00458-5fbc-df11-9eae-00237de2db9e
ATT Radio
http://www.windowsphone.com/s?appid=602ad54d-60bc-df11-9eae-00237de2db9e
Mobile TV
http://www.windowsphone.com/s?appid=7e7cc86e-e1c0-476a-ac88-db3c9fffabb
YPmobile
http://www.windowsphone.com/s?appid=b46a3af4-2aae-e011-a53c-78e7d1fa76fa
NOKIA APPS
Nokia Cinemagraph
Nokia Creative Studio
ESPN Hub
HERE Drive
HERE Maps
HERE Transit
Nokia Music
Nokia Panorama
PhotoBeamer
SmartShoot
Weather
List of not installed ATT apps
AT&T Locker
http://www.windowsphone.com/s?appid=4c158c11-0c27-4def-ba1f-83231a3e83d4
AT&T Digital Life
http://www.windowsphone.com/s?appid=da241917-db50-486a-955c-0e5910142550
AT&T FamilyMap
http://www.windowsphone.com/s?appid=6f3edd9b-5cbc-df11-9eae-00237de2db9e
AT&T Code Scanner
http://www.windowsphone.com/s?appid=58446560-f027-e011-854c-00237de2db9e
myAT&T
http://www.windowsphone.com/s?appid=4cc12d74-5ebc-df11-9eae-00237de2db9e
Dial Codes:
Codes that work without the need of the Native Toast Launcher:
Code:
<Component ComponentName="Partner App Support">
<SettingsGroup>
[B] <Setting Name="Partner NonImmediate Dial Strings" Value="##3282;##7820"/>
<Setting Name="Partner Immediate Dial Strings" Value="##3282#;##634#;##4678255#;*#07#;##07#;##7820#"/>[/B]
<Setting Name="Partner App Task URI" Value="app://2377fe1b-c10f-47da-92f3-fc517345a3c0/_default#/Launcher;component/MainPage.xaml"/>
<Setting Name="Partner App Provisioning File Path" Value="app://2377fe1b-c10f-47da-92f3-fc517345a3c0/_default#/Launcher;component/MainPage.xaml"/>
</SettingsGroup>
</Component>
Codes that need the Native Toast Launcher:
778 - Product Support Tool/Service Tools (Possibly its just CDMA tools)
Code:
app://2377fe1b-c10f-47da-92f3-fc517345a3c0/_default#/Launcher;component/MainPage.xaml?DialString=778
Nokia Product Support Tool for Store - Phone information
Basic info
Product Code - 059T7N4
Imei - [Redacted]
Software Version - RM915 3042.0000.9200.10327 240706 2013/06/05 //collins_engine_8227/PRx_engine_integration
Extended Info
Module Code - 0205437
PSN Number - [Redacted]
Hardware Version - 1601
Bluetooth Id - [Redacted]
Public Id - [Redacted]
Wlan Mac Address - [Redacted]
Label App Version - Security LabelSW 06.28.00.22753
Hardware Info
MAIN ASIC
Main Asic Version - 1.2
POWER ASIC
Pmic Model - 3
Pmic Number - 0
Pmic Revision - 2
NFC
DISPLAY
Manufacturer - 0xE3
Display Type - 0x85
Display Consecutive Number - 0xC0
Display Horizontal Resolution In Pixels - 480
Display Vertical Resolution In Pixels - 800
MAIN CAMERA
Model Id - 955
Revision - 3.1
Serial Number - 1606190100000000
Manufacture Id - 10
Sensor Id - 0A03BB03
FRONT CAMERA
CAMERA FLASH
ACCELEROMETER
Manufacturer - KIONIX
Model - KXTNK-1000
ALS
Manufacturer - LITEON
Model - LTR-554ALS-02
PROXIMITY
Manufacturer - LITEON
Model - LTR-554ALS-02
Okay, I've finally dumped everything I've got at the moment. I still need to obtain a rom, and that will be a few weeks from now. (I hate this metered ISP we have to use...)
The Factory ROM is now in my possession and I'm playing around with it a tad. I can compare it with a few different things, but NCS doesn't have a formal image of the RM-915 and the tests don't work right, so I guess I'll have to wait until Nokia updates NCS again....
thals1992 said:
The Factory ROM is now in my possession and I'm playing around with it a tad. I can compare it with a few different things, but NCS doesn't have a formal image of the RM-915 and the tests don't work right, so I guess I'll have to wait until Nokia updates NCS again....
Click to expand...
Click to collapse
NCS doesn't Support Care Suite External to sign in in new versions .
have you any method to solve it ?
can't we use NSU to flash ROMs?
ngame said:
NCS doesn't Support Care Suite External to sign in in new versions .
have you any method to solve it ?
can't we use NSU to flash ROMs?
Click to expand...
Click to collapse
Check out: http://forum.xda-developers.com/showthread.php?t=2515453
the instructions tell you how to re- enable CareSuite_External
You just need an edited user configuration file. Its available just about everywhere and you can also just use the one that comes with the Nokia Service Updater for Retail. I'm just saying it doesn't have a pic of the device just something that looks like it was created in paint.
(The device isn't fully supported in yet so we'll see....)
thals1992 said:
You just need an edited user configuration file. Its available just about everywhere and you can also just use the one that comes with the Nokia Service Updater for Retail. I'm just saying it doesn't have a pic of the device just something that looks like it was created in paint.
(The device isn't fully supported in yet so we'll see....)
Click to expand...
Click to collapse
haha got it .
You need PCX paint file
Amazon Deals! This device is even cheaper now! Its only $40!
Sent from my RM-860 using Tapatalk
Is this device unlockable? and can you let us know how its done?
I should do the same for my Lumia 521 (T-Mobile) I picked it up for $34 at Target when the goofed up the price on their website
Apparently you can get it unlocked in ~60 hours....
bardell3600 said:
Thought it would be good to pass on my experience.
Microsoft Store (online too, with free shipping) has the Lumia 520 on sale for $59. It is part of their 12 days of Christmas sales event and extended a month (12/13 to 1/12.) AND they just extended it into February.
So I ordered one. Went to the AT&T Store and picked up a SIM. The day it arrived I put the SIM in. One hour later I used their online Unlock Request Form (http://www.att.com/deviceunlock/) and 60 hours later received via email the Unlock Code (yes, the code unlocked it just fine.) Note that when you fill out the form, you need to put the IMEI number in first. If you put the phone number in first it errors out because the number has not been in service long enough to allow unlock.
The "rules" are an establish customer needs to have a 100% owned phone connected to the AT&T network for 60 days and for a pay-as-you-go customer the wait time is 6 months. Apparently because I bought directly from Microsoft who is buying Nokia (bought directly from the manufacturer) those times were waved. My phone had been connected to the AT&T network for less than 72 hours.
FYI, I am an established customer and added the SIM to an existing account. So someone else will have to try with a goPhone SIM and see if it works as well.
Click to expand...
Click to collapse

Categories

Resources