I'm hoping to start discussion on the internals of the bluetooth stack on the Blue Angel and possibly other devices!
There's two high-level elements to this:
- The Microsoft stuff
- The Widcomm (Broadcom) stuff
Knowing what software managed what part of the process would be useful . I'm starting to piece it together, but I might be wrong...
The headset (HS) sends commands to the PocketPC (known as an AG - audio gateway) using simple AT commands. For example, pushing the button twice on my Nokia HDW-3 causes last number redial, so I'm guessing that the HS sends AT+BLDN and the bluetooth app acts on this appropriately.
AT+BVRA is the command that I think we're interested in - this enables /disables voice dialing.
When I push and hold the HS button, the notification icon changes in the top bar, and it appears that I get noise through the headset (tho not the PocketPC output!), and that the mic is connected too (tho the phone mic, NOT the pocketPC mic - tried recording using voice notes, and didn't get anywhere from the headet). This indicates that the AT+BVRA is being received and processed, but no application is being kicked off.
I *think* that the hfpui.exe program is responsible for the icon, but I might be wrong. I've had a quick peek through the binary, and there's a lot of text in there which looks familiar, but it's a pain in the neck reading wide characters
What is so frustrating is that the push for voice dial is being recognised, but nothing is being kicked off.
The MS bluetooth registry settings (HKLM\SW\Microsoft\Bluetooth) has two interesting entries, both of which reference btagsvc.dll.
There's a load of stuff in HKLM\SW\Widcomm. Most interesting is probably the Plugin\Handsfree area, which autoloads \\windows\hfpui.exe, and provides a controlpanel (internal to the BT Manager) which is hfpcontrolpanel.dll. I assume this is
BTAGSVC has an entry in the HKLM\services key, as does "HandsFree". HandsFree uses the HandsFree_DLL.dll, apparently...
There *must* be a way to correct this. My guess is that we can either change something in the BTHFP dll, or the HFPUI, or one of the apps, we will be in good stead to move forward.
Anyone got any Cunning Ideas how to take this forward, or any more info on the workings of the stack to share?
Just had a resource editor on HFPUI.exe
It contains the notification icons for the top bar. Seems to point that it is responsible for processing the commands - or is that a wrong assumption?
Understand Architecture
I hope this goes, I cant be much help but am very interested. Keep it up
Hi ya all,
I am currently using a BT headset with CallerID (Jabra 800).
Since my contact DB is not in english lamguage, the headset which apprently does not contain hebrew font can show only the phon num of the caller.
I am seeking a way to hook/replace the w2003se handling.
I have thorughly serached the online help/internet for the details from where to start and it seems that it is related (ofcourse) to the "Audio Gateway Service" in a library called "Phone-Extension Component".
This library exports a function called "BthAGGetNameByPhoneNumber" and is in a dll file (Btagsvc.dll I think) which is oofcourse burnt in the ROM.
I am searching for a way to hook/replace this function in the DLL somehow.
I have done hooking in the past for windows message handler routines but to my understanding, this is not the case.
So here it is, how do hook or replace that dll code, (maybe in respect to Service.exe only)?
I do belive that any work here will be helpfull around the globe so I will happyly share everything when done.
Also if anyone has more information and/or corrections to the above - don't be shy
Keep up the good work poeple,
Micha
there is no function BthAGGetNameByPhoneNumber in any of the DLLs in Imate PDA2K 1.40 ROM
Guess you are right, I also did not see the Btagsvc.dll file.
I see now that the documentation I found is for WCE5.0, so it's pretty much irrelevent for WM2003SE
Any suggestions on how to proceed here from the big guns? :?
Hi michar,
i have the BT800 and PDA2K.
The contacts are in english but i still get on the Jabra the phone number displayed.
Do you think its possible to display the name of the contact ?
Cheers
Chris
Well, if I will find the function resposeable for querying the number->name, maybe I could also help you with it.
As of now, for lack of time I am stuck
I will update if the status will change.
Hellow all, as noticed in the thread
http://forum.xda-developers.com/showthread.php?t=284329
we have pledged to ghather some 500$ and give it to some developer/hacker that is willing to port for us the latest version of the Widcomm stack for the Hermes. The reason for this is basically that the MS one simply has way too many bugs and lacks a lot of functionality.
I have contacted mikelspikel from aximsite and he agreed to try and help us. This will be the thread where we will discuss the porting efforts.
I will begin by posting mikelspikel's message :
"Hi!
I'd be delighted if I could help you but it's very difficult without having a device to test. I can give you some guidelines for you to test. You'll need a registry editor such as Resco Explorer registry add-in.
The package we built is completely oriented to the X50 / X51, but maybe it can be adapted to work with other devices easily, so I'd start installing our package. But be careful! Do it only if you don't mind having to hard-reset your device! You'll probaly need to.
The first thing we must make work is the communication between the main processor and the BT chip. This is done through a serial port. In the Axim, this port in COM5 and it's referenced in the registry in [HKLM\Drivers\BuitIn\BTUart]. This driver can be different in other devices, but usually it isn't difficult to figure it out from a [HKLM\Drivers\BuitIn\] branch registry dump (you can send me a dump of this branch if you want me to have it a look). Once we have the correct COM port, we have to modify [HKLM\Software\Widcomm\BTConfig\SerialTransport]. In Axim, as the BT port is COM5, we have to set Device=COM and Port=5.
The BT chip of our device defaults to a baudrate of 115200 bps, so we set BaudRate=115200. With ShiftSpeed and ShiftCommand we increase the port speed after connecting at 115200. In order to test safely in your device, i'd delete or rename these two keys and i'd keep BaudRate at 115200.
These two settings (COM port and BaudRate) are the two that use to make the stack startup fail with the out of memory message.
Other keys key I'd change at the beginning of the test process are, in [HKLM\Software\Widcomm\BTConfig\General], I'd delete or rename RadioInitLibrary and RadioInitPostLoadScript.
It's important to know that there's a log where we can find sometimes useful information about what's going on. This log is located in registry too, in [HKLM\Software\Widcomm\BTConfig\Debug\Log].
I think this is enough to start the tests. Let me know your results or any question you have. I'll try to do my best to help you. You can use my email if you prefer (*******@gmail.com).
Greetings,
Mikel"
I edited the e-mail as i rahter we post all our findings in this thread in order to avoid spamming him
So whoever feels brave enough to do some testing, go right ahead. I'm unfortunetly still busy these days but i'll be dropping by from time to time to hopfully post my findings.
Once again a BIG BIG thank you to mikelspikel for helping us and let the testing BEGIN!
Adi
I'm making some pretty good progress here.
I have the existing stack disabled and the widcomm stack enabled and discovery works fine.
I have the following profiles tested so far.
A2DP - works very good, much better then the ms stack.
Active Sync - works good.
File Transfer- works good.
Serial - works good.
These are just the ones I have tested so far, others probably work fine too. The main issue right now is the headset profile is not working. That is what I am focusing on. Once that is done I will just have to put a cab together.
,Dave
superdave said:
I'm making some pretty good progress here.
I have the existing stack disabled and the widcomm stack enabled and discovery works fine.
I have the following profiles tested so far.
A2DP - works very good, much better then the ms stack.
Active Sync - works good.
File Transfer- works good.
Serial - works good.
These are just the ones I have tested so far, others probably work fine too. The main issue right now is the headset profile is not working. That is what I am focusing on. Once that is done I will just have to put a cab together.
,Dave
Click to expand...
Click to collapse
Cool, what version of the stack are you testing ?
Also, you can download the Widcomm for Win CE (aka mobile) SDK and tools at http://www.broadcom.com/products/bluetooth_sdk.php for free.(registration required)
Adi
Let the hacking begin...... mwuahahahahahahahahahahahaaaa.
Ok, im getting ahead of myself now but this is good news thus far.
I am using 1.7, the same as the axim version.
,Dave
jasjamming said:
this is good news thus far.
Click to expand...
Click to collapse
Good? I'd say it's great! And I don't even have a TyTN yet.
superdave said:
I'm making some pretty good progress here.
I have the existing stack disabled and the widcomm stack enabled and discovery works fine.
I have the following profiles tested so far.
A2DP - works very good, much better then the ms stack.
Active Sync - works good.
File Transfer- works good.
Serial - works good.
These are just the ones I have tested so far, others probably work fine too. The main issue right now is the headset profile is not working. That is what I am focusing on. Once that is done I will just have to put a cab together.
,Dave
Click to expand...
Click to collapse
Is it possible to enable and disable Wdcomm bluetooth from commManager?
And it supports PAN profile, doesn't it?
great, looking forward in the progress of this hack.
Hi!
Glad of the progress so far! Superdave, are you interested in sharing your settings/progress?
In the Axim, one of the most difficult tasks was making HFP and HSP work. They need some vendor specific HCI commands to be sent to the BT chip (Texas Instruments BRF6150 in the Axim). Does anybody know which is the BT chip in the Hermes? Maybe we can get some info about HSP/HFP from the documentation of that chip.
BTW, Dave, have you tested BT and WiFi toghether? Does it work? That was another problem we found in the Axim. It requires some vendor specific commands too.
The Hermes uses the same BRF6150 chip.
Cool! Nice you see you here mikelspikel
Menneisyys said:
Cool! Nice you see you here mikelspikel
Click to expand...
Click to collapse
I meet you everywhere! How is this possible?
Sleuth255 said:
The Hermes uses the same BRF6150 chip.
Click to expand...
Click to collapse
That's very good! In Aximsite we got the proper HCI commands to enable WiFi and BT coexistence and audio routing to enable HFP/HSP in the BRF6150. If Superdave posts information about the state of his development, maybe we can use some of these commands to make HFP/HSP work.
Moreover, I developed a bts (Bluetooth Script) parser that can be used to get the responses from the BRF6150 when initialization commands are sent. For the Axim, we built a file called MkSpk100.bts that enables both coexistence and audio routing. Maybe this file can be used directly or slightly modified in the Hermes.
Superdave, did you start working with the Aximsite package or did you start from scratch? If the first is the case, could you please post what modifications you did to the original package?
Yeah, I started with the Axim package. Your script and dll mods do connect the HS but audio is not routing. The only mods needed to get the axim package installing is to remove the ms stack and change the com port to 7 the baud to 921600 and flow to 0, I also removed the shifts. Also the stack uses com 7/8 by default for the serial ports, that needs to be changed to com0/8.
Im intersted in your bts parser and the mods you made. I see the mods you made in the dll, MOV R0, #0x79 to MOV, R0 #0x75 before the IO CTL, but, not sure exactly what your doing there yet.
Thanks,
Dave
Quickly tested the stack & the hack instructions on the Universal; no success so far, no matter how I teaked the parameters. I will also test this on my HTC Wizard.
Anyone with these devices?
superdave said:
I'm making some pretty good progress here.
I have the existing stack disabled and the widcomm stack enabled and discovery works fine.
I have the following profiles tested so far.
A2DP - works very good, much better then the ms stack.
Active Sync - works good.
File Transfer- works good.
Serial - works good.
These are just the ones I have tested so far, others probably work fine too. The main issue right now is the headset profile is not working. That is what I am focusing on. Once that is done I will just have to put a cab together.
,Dave
Click to expand...
Click to collapse
Awesome dude!!
this sounds great guys so far. I wish I could contribute but my knowledge on software is fairly limited.
I myself am an electrical/electronics engineer with a PhD where I specialize in 3G-4G basaband hardware (microelectroncis). Soon we will see UWB (ultra wideband) communications on PDA's where we can stream HD video to our LCD TV's etc as well HD music to our digital receivers. Also, I have a student working on gyro's for PDA's where it will enable you to, for e.g., dial a number by just writing the number in thin air with the PDA (there are more benefits besides this)
Its good to see a device like the hermes offering so much, but from I know about bluetooth (having designed baseband components for bluetooth 1.1 back in the day (in 2001) ), I know it "shouldn't" operate the way M$ configures it to via its firmware/software.
So the progress made so far sounds excellent. Once all the profiles work and reg hacks made etc.... will this be made available in a CAB or EXE for us software "lay" people to install with ease?
Cheers and great work.
superdave said:
Yeah, I started with the Axim package. Your script and dll mods do connect the HS but audio is not routing. The only mods needed to get the axim package installing is to remove the ms stack and change the com port to 7 the baud to 921600 and flow to 0, I also removed the shifts. Also the stack uses com 7/8 by default for the serial ports, that needs to be changed to com0/8.
Im intersted in your bts parser and the mods you made. I see the mods you made in the dll, MOV R0, #0x79 to MOV, R0 #0x75 before the IO CTL, but, not sure exactly what your doing there yet.
Thanks,
Dave
Click to expand...
Click to collapse
Good! It's curious the BT chip works by default at 921600.
Well, the MkSpk_PCM_Routing.dll is, as you noticed, a modified version of the original HTC_PCM_Routing.dll. We were working with several versions of the files, some from an Axim X50 WM2003 and some from an iPaq hx4700.
In the X50 version, the file TIBinaryParser.dll has a function called SetAudioRouting. This function basically has a call to a DeviceIoControl of device WAV1. Running such a IOCTL from a C++ program mutes or activates the integrated audio of the Axim.
In the iPaq, the SetAudioRouting function is located in HTC_PCM_Routing.dll instead of in TIBinaryParser.dll. Moreover, the IOCTL has a different parameter (0x79 instead of 0x75), so we patched the original HTC_PCM_Routing.dll to be compatible with the IOCTL that works in the Axim. Have you tried with the original HTC_PCM_Routing.dll? You have to reference it in [HKLM\Software\WIDCOMM\Plugin\HandsFree\AudioSetupDll].
You should also check if the default audio device of the Hermes is called WAV1 too. If it isn't, the IOCTL won't work.
Maybe we can figure out the correct IOCTL building a C++ program. The code I used is:
Code:
HANDLE l_File;
char l_cmd[]={0,0,0,0,0x75,0,0,0,0,0,0,0,0/*1*/,0,0,0,0,0,0,0};
char l_cmd3[]={0,0,0,0,0x74,0,0,0,0,0,0,0,0/*1*/,0,0,0,0,0,0,0};
char l_cmd2[20];
DWORD l_br;
long l_res;
int i;
for (i=0;i<20;i++)
{
l_cmd2[i]=0;
}
l_File=CreateFile(_T("WAV1:"),GENERIC_READ | GENERIC_WRITE, 3, NULL,3,0,0);
if (l_File==0)
{
MessageBox(_T("Error opening WAV1:"));
return;
}
l_res=DeviceIoControl(l_File,0x1D000C,l_cmd,20,l_cmd2,20,&l_br,0);
if (l_res==0)
{
MessageBox(_T("IOCTL1 Error"));
return;
}
/* l_res=DeviceIoControl(l_File,0x1D000C,l_cmd3,20,l_cmd2,20,&l_br,0);
if (l_res==0)
{
MessageBox(_T("IOCTL2 Error"));
return;
}*/
If I remember OK, in the Axim, l_cmd mutes internal Audio and l_cmd3 enables it. The parameters we changed in the DLL were the 0x75 and 0x74 of these two buffers.
Find attached the BTS parser eVC++ 4 source code. It's a too quickly developed app to send bts files to the BT chip and trace the responses. You'll need to change some code, at least the comport the chip is connected to. Let me know if you need some help about it. The code is properly uncommented but it's very simple.
Hey Mikelspikel,
Thanks for your input to this project. It is greatly appreciated. I look forward to the progress made to a complete widcomm solution to the hermes..
great that you guys are working on this. the ms bluetooth is one of the largest fun killers with the hermes. thumbs up! and good luck for the patch...
Application is designed to control BAG (Bluetooth Audio Control) service state on Windows Mobile systems. It can enable/disable audio/microphone routing to Bluetooth headset, set volume and microphone gain, enable/disable voice command launch application.
Writing this little piece of code was inspired by inability of AGEphone Mobile (ver 2.71) to collaborate with Bluetooth headset.
Really it can be used for other purposes as well. You can make some useful shortcuts or use it in some scripting language.
It is “command line” application (no GUI). Command line switches controls application behavior.
There are two working modes: “keep resident” (default: able to save and restore all settings) and “on fly” - for quick change.
Application itself and documentation with samples in attached file.
Thanks alot i'm downloading now!
gui in next ver?
Thank you very much for writing this! Your utility goes alone perfectly with AGEphone Mobile and is perfect for anyone who wants to use a BT headset AND voice command - highly recommended vs. the standard "BTAudioToggle" !
I'm trying to get this to launch via startup to see if it will work with my bt headset and voice command.
I'm just using "\Windows\bagctrl.exe /O"
as my shortcut link but it gives me an error the app isnt signed..I assume I'm probably just an idiot and not making my shortcut right..Can anyone help me please?
vidmabal said:
Application is designed to control BAG (Bluetooth Audio Control) service state on Windows Mobile systems. It can enable/disable audio/microphone routing to Bluetooth headset, set volume and microphone gain, enable/disable voice command launch application.
Writing this little piece of code was inspired by inability of AGEphone Mobile (ver 2.71) to collaborate with Bluetooth headset.
Really it can be used for other purposes as well. You can make some useful shortcuts or use it in some scripting language.
It is “command line” application (no GUI). Command line switches controls application behavior.
There are two working modes: “keep resident” (default: able to save and restore all settings) and “on fly” - for quick change.
Application itself and documentation with samples in attached file.
Click to expand...
Click to collapse
Many thanks, vidmabal - it works like a dream and does exactly what I was looking for!
MrDSL said:
I'm trying to get this to launch via startup to see if it will work with my bt headset and voice command.
I'm just using "\Windows\bagctrl.exe /O"
as my shortcut link but it gives me an error the app isnt signed..I assume I'm probably just an idiot and not making my shortcut right..Can anyone help me please?
Click to expand...
Click to collapse
Yes, application is not digitally signed.
If you want to use it you first must enable not signed applications (but there are plenty of them around).
To do this you can use "Advanced Config" or alternatively set registry value with some registry editor. "Total Commander" or "Resco explorer" can help you performing this task.
Registry key is "HKLM\Security\Policies\Policies" value name is "0000101a" (if not exists create new DWORD value) and must be set to 1.
P.s. I really don't know why you want to run it on startup and expecially with /O key
eazy2001x said:
gui in next ver?
Click to expand...
Click to collapse
Really not.
Application is designed to run without user intervention.
That’s why even all errors are silently ignored: no MessageBox for invalid keys or some other errors.
Even I don't see what GUI can be helpful. Except maybe for microphone gain changing. Volume normally has control keys on Bluetooth device itself.
Of course you can use it with Mortscript or some other scripting language and make some interface in here. Error codes returned (not present in attached document)
0 - No error (all OK)
128 (0x80) - Error redirecting audio (normally occurs if Bluetooth device is not connected)
129 (0x81) - BAG0: device not found
130 (0x82) - Invalid command line parameters
since u coded this, ive got a small question. do u think there is any chance to disable a remote microphone and use the internal one instead?
im asking this because the mic from my car radio totaly fails its job (JVC KD-BT11) and the internal from my phone (x1) is far supirior to it.
Nice work man, just find my bt headset behind the microwave oven (my girlfriend didn't know anything)
I'm going to write a small mortscript to controll the commnd line.
vidmabal said:
Yes, application is not digitally signed.
If you want to use it you first must enable not signed applications (but there are plenty of them around).
To do this you can use "Advanced Config" or alternatively set registry value with some registry editor. "Total Commander" or "Resco explorer" can help you performing this task.
Registry key is "HKLM\Security\Policies\Policies" value name is "0000101a" (if not exists create new DWORD value) and must be set to 1.
P.s. I really don't know why you want to run it on startup and expecially with /O key
Click to expand...
Click to collapse
I'll have to look into it more but I already have advanc config to run unsigned apps..
achmed20 said:
since u coded this, ive got a small question. do u think there is any chance to disable a remote microphone and use the internal one instead?
im asking this because the mic from my car radio totaly fails its job (JVC KD-BT11) and the internal from my phone (x1) is far supirior to it.
Click to expand...
Click to collapse
The application has nothing common with Bluetooth transport. Really it only send control codes to BAG service (Bluetooth Audio Gateway). This one is coded by Microsoft. I think other BT stack providers (for compatibility reasons) also supports such service.
According to documentation there is no such control code to enable only audio and leave microphone untouched. (Maybe there is, but undocumented, as M$ like to do).
Also it depends on BT profiles your device support. Maybe it has some "stereo headset" without mic?
Here i made a mortscript gui for this tool:
just extract to \Program Files\BTAGC
all files are included
Now make a shortcut of config.mscr in your start menu
vidmabal said:
The application has nothing common with Bluetooth transport. Really it only send control codes to BAG service (Bluetooth Audio Gateway). This one is coded by Microsoft. I think other BT stack providers (for compatibility reasons) also supports such service.
According to documentation there is no such control code to enable only audio and leave microphone untouched. (Maybe there is, but undocumented, as M$ like to do).
Also it depends on BT profiles your device support. Maybe it has some "stereo headset" without mic?
Click to expand...
Click to collapse
The radio itself offers "Bluetooth Headset" and "freespeech".
i tried to disable the freespeech (bluetooth settings in winmo) but somehow my phone still uses the radio as microphone.
guess i have to get my soldering iron and make some hardware mods to my radio. looks like disabling a bluetooth mic isnt going to work.
PS: but thx
old post i know, but do you know if there is a way to display the error msgs on screen somehow ? I think im getting errors.
Pytte said:
old post i know, but do you know if there is a way to display the error msgs on screen somehow ? I think im getting errors.
Click to expand...
Click to collapse
Really there is no much error processing here. But you can try to start app from say Mortscript and examine return code. See message #8 for return codes.
Thanks for your effort put into this.
Could you please confirm if/how is it possible to do just one thing:
1. Cyberon Voice Speed Dialer installed on phone.
2. BT button does not invoke it (audio route opened, and dialer screen opened, but no Speed Dialer. Reg Key exists)
3. Can this program help do it? (which mode resident/on fly, which extension to exe file and how to launch it (start-up or something else))
Many thanks in advance!
Thanks
Thanks a lot vidmabal, this is what I was looking for.
Cheers
Will this program work on an HD2 which i think uses a widcomm bluetooth stack??
dino_Donis said:
Will this program work on an HD2 which i think uses a widcomm bluetooth stack??
Click to expand...
Click to collapse
Really I don't know.
I am operating with service "BAG0:" ("Bluetooth Audio Gateway") - you can check if it is present in your system.
1. Launch Fdsoft Task Manager
2. Go into "Services" page.
3. Check that you have started service BAG0:
Alternatively you can check it in registry:
HKEY_LOCAL_MACHINE\Services\BTAGSVC
(Service name can differ, but "Prefix" value must be "BAG" and "Index" must be 0, "IsEnabled" value must be 1)
Hi, I'm new to XDA Developers but have been using as a valuable resource over the past few months.
We have a HTC Touch Pro 2 device (WM6.5) that we provide support for to a number of personnel. The client have requested that we change the device settings so that photos have the timestamp applied and secondly that it not be possible to take it off again.
Since we have somewhere in the region of 600 devices to update, we'll need to do this via a registry change through our updates service. Try as I might though, I can not find the setting to do either of these. I have searched on here and google and can't find the answer. Has anyone done this before?
Thanks in advance.
I've been doing some digging on this and found a registry key under
HKEY_Local_Machine\SOFTWARE\HTC\Camera\Image
called 'enableStamp'. However, when I change this on Visual Studio 2005 remote registry tool, it doesn't seem to make any difference on the phone, the menu option stays the same. Likewise, the menu doesn't seem to change the registry which leads me to think it's another setting someplace or the settings are stored elsewhere.
Thanks in advance for any help.
I've finally made a breakthrough on this. I had to export the entire registry, change the value, export the registry again and compare the files. I found that this value
HKEY_CURRENT_USER\Software\HTC\Camera\6.16\Preferences
contains a large Hex value string and found that change a value that was 48 (timestamp off) to C8 (timestamp on) was reflected on the device. This string seems to have a lot of values so I'm assuming they are all to do with options selected in the camera menu. I just hope one of them is to disable the timestamp option now. I've posted this here in the hope it helps someone else.