Help sniffing GPS data from a gsm tracker - Page 1
Forum section: electronics / projects

author: Erwin Ried
author_rank: Regular Contributor
timestamp: December 19, 2013, 11:20:51 pm
content: Hello everyone, I need to sniff the GPS data from this device (so I can add a little display):I tried a lot of things but I am not getting anywhere, so maybe someone already tried this. I know there are some models that have explicit serial 9600 connections, but in this case the RX,TX pins don't do anything, it seems everything has to be controlled via SMS/GSM.Attempt 1: Internal GPS_TX, GPS_RX padsNo valid data detected. But there is some pulses (3V) every 1 second:I also tested probing here:Just to be sure, I cutted these traces and soldered some wires directly to the gps module. When they are unlinked from the mcu, the gps does not send data every 1sec, but I can see other pulses:After that, I tried to find a valid serial port configuration (without fragmentations errors in at least 5 seconds) in the serial data thru an ftdi:No luck, the GPS hangs on some bauds,bitstop, parity, etc configurations.Then, probing with a digital analizer:The digital analizer says the data is using 960000 (no way my early little app could detect that rate because I never thought it was so high, but it seems correct because there are no fragmented data using 960000 bauds).So now, using 960000, I can see "data" in the terminal:http://screencast.com/t/7MvNLylk<- very far away from NMEA strings!And trying to find some valid pattern (0x13,0x12 nearby, looking for the date 2013-12), I can find something, but without any valid looking format, like with the hour nearby that changes (reception occurs every 4 secs):Help to solve this mystery? Thanks!

author: imjosh
author_rank: Contributor
timestamp: December 20, 2013, 02:23:08 am
content: Did your unit come with software? A manual? What's the brand/model?What's on the green TX wire? Try 9600, 38400 and 57600 baud.

author: Erwin Ried
author_rank: Regular Contributor
timestamp: December 20, 2013, 03:42:04 am
content: hey! I was testing what you said about testing the green cable again, and exactly as before, no output or anything, but! if I set 115200 as speed :O and if I send garbage I receive my garbage back, and on power on:It is "unbranded" but it says GT06. I don't have the manuals, I have a small booklet but in chinglish and pretty primitive (layouts, and general data, no serial info)

author: amyk
author_rank: Super Contributor
timestamp: December 20, 2013, 03:44:10 am
content: Mediatek binary protocol.http://microchip.ua/simcom/GPS/SIM68V/SIM28&SIM68R&SIM68V%20EPO-II_Protocol_V1.00.pdfThere's not much info out there on the actual commands (which seem to be in the FFxx range) - but the way to switch between binary and NMEA is documented. Or you could try to reverse-engineer the format (since I'd guess most of the fields are just mapped to an NMEA sentence).

author: Erwin Ried
author_rank: Regular Contributor
timestamp: December 20, 2013, 04:59:16 am
content: Quote from: amyk on December 20, 2013, 03:44:10 amSPOT ON! thanks a lot!, thanks to imjosh too! because I have at least access to the time now:http://f.cl.ly/items/2C273f3w3G24122B1j38/Image%202013-12-20%20at%201.57.24%20AM.pngBut I think the position isn't reported by AT commands (AT_IGPS? returns error). I am not sure if a simple mcu will be able to extract the data from the mediatek protocol (since it is too high frequency):

author: amyk
author_rank: Super Contributor
timestamp: December 20, 2013, 12:32:53 pm
content: There should be a command to set the baud rate, you need to communicate with the GPS directly to set it. Although 8-bit MCU would probably have trouble keeping up with a continuous stream of data at 960Kbaud the GPS isn't sending a continuous stream so it should be OK with some buffering.

author: Erwin Ried
author_rank: Regular Contributor
timestamp: December 20, 2013, 03:41:12 pm
content: Quote from: amyk on December 20, 2013, 12:32:53 pmI don't think so, because that vias are used from the mcu (gsm board) to talk with the gps chipset. I think the best option is to find another tracker :/

author: imjosh
author_rank: Contributor
timestamp: December 20, 2013, 06:25:38 pm
content: Are you sure your mcu can't handle that baud rate? Apparently an arduino can. I know I have a project with an Attiny84 with no crystal that really doesn't like to go over 9600 baud, but an Atmega with a 16 or 20mhz crystal may work just fine. I say just try it out. These cheap gps units all seem to be very quirky so it might take buying several before you find one with "no" issues. There are models that probably have quite good serial controls but they are a lot more expensive. I'm assuming you actually need the gsm feature of these trackers,because a standalone gps module that spits out NMEA strings would be a lot easier to use.cheers

author: Erwin Ried
author_rank: Regular Contributor
timestamp: December 20, 2013, 07:35:07 pm
content: Well, I wanted to use the lovely attiny85 without clock hahaI am not sure if Arduino can handle 960000 bauds with 20 mhz clock, I have to test, but for now 115200 is not so away from what arduino is capable

author: imjosh
author_rank: Contributor
timestamp: December 20, 2013, 09:46:31 pm
content: Yeah, doing software serial without a clock is going to be tricky at normal speeds and impossible at 115200 I'm guessing.But it looks like you could use an Attiny87 (has a UART) with a crystal. I found this page to help find a good xtal value:http://www.wormfood.net/avrbaudcalc.php(haven't used it before, just found it now, so ymmv)

author: amyk
author_rank: Super Contributor
timestamp: December 21, 2013, 11:35:02 am
content: ATTiny85 could do it, if run at the right clock speed. After all, it can do software USB (which is a much more complex protocol) at 1.5Mbaud so 960KBaud serial should be perfectly doable.

author: Erwin Ried
author_rank: Regular Contributor
timestamp: December 21, 2013, 06:32:11 pm
content: BTW, I thought the tiny85 had an internal 8 mhz clock, so it is not like "running without cristal/clock"I never used an external oscilator for the tiny (of course I had to mess with calibrations)Thanks a lot! the mysterious case is closed O0