[Windows Mobile Development and Hacking General] Drakoola:
hi

I've been writing code to access the gsm modem of PPCs and SPs. I found these posts http://xdaforums.com/showthread.php?t=220396 and http://xdaforums.com/showthread.php?t=268809 and this one too http://www.nicecuppa.net/nicetrack.asp to name a few.

here is a sample

PDACELLID_API long fnGetCell(LPTSTR outData)
{
HANDLE hCom;
char * xpos;
char rsltstr[5];
DWORD CellId;
int bufpos;
DCB dcb;
COMMTIMEOUTS to;
DWORD nWritten;
DWORD event;
DWORD nRead;
char outbuf[20], buf[256];

BYTE comdevcmd[2]= {0x84, 0x00};

hCom= CreateFile(L"COM2:",GENERIC_READ|GENERIC_WRITE,0,0,OPEN_EXISTING,0,0);
if (hCom==NULL || hCom==INVALID_HANDLE_VALUE)
{
hCom= NULL;
return -1;
}

if (!GetCommState(hCom, &dcb))
{
return -2;
}

dcb.BaudRate= CBR_115200;
dcb.ByteSize= 8;
dcb.fParity= false;
dcb.StopBits= ONESTOPBIT;

if (!SetCommState(hCom, &dcb))
{
return -3;
}

if (!EscapeCommFunction(hCom, SETDTR))
{
return -4;
}

if (!GetCommTimeouts(hCom, &to))
{
return -6;
}
to.ReadIntervalTimeout= 0;
to.ReadTotalTimeoutConstant= 200;
to.ReadTotalTimeoutMultiplier= 0;
to.WriteTotalTimeoutConstant= 20000;
to.WriteTotalTimeoutMultiplier= 0;
if (!SetCommTimeouts(hCom, &to))
{
return -7;
}

if (!SetCommMask(hCom, EV_RXCHAR))
{
return -8;
}

if (!DeviceIoControl (hCom,0xAAAA5679L, comdevcmd, sizeof(comdevcmd),0,0,0,0))
{
return -9;
}

bufpos = 0;

strcpy(outbuf,"AT+creg=2\r");

if (!WriteFile(hCom, outbuf, 10, &nWritten, NULL))
{
return -10;
}

if (nWritten != 10)
{
return -11;
}

if (!WaitCommEvent(hCom, &event, NULL))
{
return -12;
}

while(1)
{
if (!ReadFile(hCom, buf+bufpos, 256 - bufpos, &nRead, NULL))
{
return -13;
}

if (nRead == 0)
break;

bufpos += nRead;

if (bufpos >= 256)
break;

}

strcpy(outbuf,"AT+creg?\r");

if (!WriteFile(hCom, outbuf, 9, &nWritten, NULL))
{
return -14;
}

if (nWritten != 9)
{
return -15;
}

if (!WaitCommEvent(hCom, &event, NULL))
{
return -16;
}

while(1)
{
if (!ReadFile(hCom, buf+bufpos, 256 - bufpos, &nRead, NULL))
{
return -17;
}

if (nRead == 0)
break;

bufpos += nRead;

if (bufpos >= 256)
break;
}

buf[bufpos] = 0;

mbstowcs(outData,buf,bufpos+1);

if ((xpos = strstr(buf,"CREG")) == NULL)
{
CellId = -19;
}
else
{
memcpy(rsltstr,xpos+18,4);
rsltstr[4] = 0;
if (sscanf(rsltstr,"%X",&CellId) != 1)
{
CellId = -20;
}
}

if (hCom!=NULL)
{
CloseHandle(hCom);
hCom= NULL;
}

return CellId;

}

Some of these posts assume that I already know the com port of the gsm modem, Others tell you to get the com port handle by either:

1- TAPI's lineGetID - which only gets a valid handle if I originate a voice call (not data call). In my case I only query information from the network so I don't need to make a voice call and that is why I'll never get a com port handle.

2- Silent the RIL and open the com port manually as in here

http://xdaforums.com/showpost.php?p=963262&postcount=1

which apparetnly turns on the flight mode and shuts down the phone on WM2005.

3- I tried to detect the right com port using the registry key HKLM\Drivers\BuiltIn\Serial which doesn't give the right result on every device.

In the HTC universal (i-mate jasjar) there is no "known" way to open the GSM com port. Even nicetrack couldn't detect the gsm modem port.

There is definitely a way to get the com port handle but it may involve reverse engineering which i'm not good at. I leave that to the pros