yashsingh1/xdaforums huggingface dataset:
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Sleuth255:
because the internal one has been deliberately disabled. It's part of the 6250's antenna amplification circuit and the bias pin has been grounded.

To use it, the bias pin would need to be lifted.

Also, the GPSMix pins may have been connected together as this is what Qualcomm specifies if the GPS functions are to be disabled. Matching circuitry is required between the LNA output and the GPSMix_P/GPSMix_M. To reconnect, these pins may need to be lifted. Additionally, I believe that the matching circuit may require additional LNA. Not sure of this however.

Finally, the antenna/matching circuits would need to be placed outside the RF cage requiring their own shielding and a tiny 5 conductor coax routed inside the cage for connections to the RFR6250.

The key here is shutting off bias under the control of hermes software. Currently, the RFR6250 can be controlled in this manner using at@startgps & at@stopgps commands. This means that there must be some hardware signaling available that shuts off the internal GPS portions of the chip which the radio code can activate.

Unfortunately, it's not easy to lift the pins we need to utilize the RFR6250's internal LNA. Plus, the matching circuitry isn't trivial and 5 connections need to be made to a chip that measures 10mm square IIRC. It's tiny... out of the range of the average individual's skill. I myself don't have the equipment necessary to lift 3 pins on the chip.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] manou:
Sleuth, first thanx for the clearefications...

Personally I have done fixes and jobs do devices this size. Plus I have a lot of friends in my line of work who do a lot trickier things than this and would easily help me out if I needed it. I haven't managed to get my hands on a proper reference deisgn of the 6250 yet. If you have access to anything that can help me I'd appreciate it. Even if they are partial I have access to many RF EE friends who can help out.

Bottom line, the technical changes to the circuit don't bother me as long as I can be sure that SW will run on it properly once the changes are done.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] manou:
Sleuth I have a couple of questions, maybe you can help me out:

(1) What did you mean by: "At this point, it appears that the GPS LNA block is separate from the GPS MIX input on the chip (3 pins allocated: 2 input & 1 output) and has been deliberately disabled..."?

We already know GPS MIX input comes from the GPS Pre LNA output, whats the suprise here?

(2) You mentioned five pins: LNA In , LAN Out, GPS MIX p/m and LNA bias. Does this mean that the LNA In is to be connected to the GPS antenna (via a band pass filter), the GPS Out to the second BPF. But then who does the LNA bias drive the pre LNA or the main LNA? Also if the output of the pre LNA isn't differential then how come the input to the main LNA is differential?

I'm working on getting some sort of reference deisgn from somewhere in the far east. Since there are a number of different GPS antenna setups (at least this is what qualcomm state in their docs) I am hoping it is still relevant.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] jpogge:
In order to reduce noise the output of the first LNA is sent to a BPF, with a balun, this makes the signal differential in nature and immune to ground impurities as it enters the GPS MIX + / - inputs which is actually a second LNA pior to thae actual GPS Mixer which is also differential. The reason I dropped this was 3 fold, Sleuth is right it is not impossible but the purpose of the thread was to come up with a hardware hack that anybody with basic skills could do, obviously you are also realizing this takes special skills, The area the pins have to be lifted is partialy covered by the RF shield cage as it over hangs. This means the soldering not only has to be done on fine pitch ( I agree doable and not a problem if you have tools and skills) but the overhang of the RF shield walls pretty much requires that this to be removed atleast partially. As this means heating a wide area of a large thermal mass enough to remove an approx 3 x 4 mm solder lug in more than one place, there is a significant risk to the parts, and delaminating the board or layers if not done exactly right. Cutting the RF shield could adversly efffect the use of the GSM and other radios that relay on this shield. Patching any holes is out of the question, ask your RF buddies as I dont have time to go into here. In the end the bricking possibilities are endless, and the internal GPS has no WAAS. Also if you can personally get hold of the NDA protedted docs you will find out that the low power circuits monitor the LNA for current draw and if you try to use the BIAS for an external circuit, there is a possibility the low voltage protection will attempt to shut it back off. The reason for not accepting the 2.7 V LNA was not because of the availablepower, this LNA can swing very close to therails and the GPS MIX input has a sensitivity to being driven beyond VCC which is 1.5V I believe, so you will also have to place a protection circuit in between without damaging the RFR 6250 permanently andnot effecting the -80 to -100 db signals available on these pins. Have fun and good luck
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] waterzzz:
Hi, someone has try to replace serialusbfn.dll before?

Currently i am developing an application which will use serialusbfn.dll(default windows mobile 5.0 driver) to communicate with my custom usb hardware. It is working. Now i want to replace serialusbfn.dll with my own "serialusbfn.dll", maybe i name it as "waterusb.dll". But it doesn't work.

I compiled my "waterusb.dll" using platform builder 5.0, by including the USB Function -serial into the OS design without any modification on the code. After completion, i rename "serialusbfn.dll" to "waterusb.dll". Then i copy "waterusb.dll" into the Fon. After that i modify the registry on the fon so that when communication using "Serial_Class" it will point to "waterusb.dll".

But it is not working.

Has anyone done this before? Please help.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Sleuth255:
@manau. Check high rez pics further back in this thread for what's been grounded and once you get any additional info on the chip you'll be able to figure out what I meant by "deliberately disabled". As I said before, LNA Bias is grounded and very likely GPSMix are connected together. All additional info is NDA material though. I would ask that you please protect any NDA material you may uncover.

Good luck making it work if you decide that you wish to attempt this.... it may well net you the first "Hermes-G" variant. Be sure to post pics of your adventure!
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] tembares:
Factsheet

Guys,

I was looking for a company repairing PDA's. I asked them is they could build in an antenne. They couldn't believe GPS was in the TyTN. I mailed him some links from xda-developers and called him a few days later.

He was interested in building in the antenne, but he is busy coming weeks.

I asked if he has a fact-sheet of the processor. He tol me he didn't have one, but he could get it.

I thought I read earlier this thread that the fact-sheet was needed. Do I have to ask for the sheet?

Temba
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] manou:
Sleuth/Jpogge, any chance you guys can make availble what you do know about the peripheral devices needed?
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Asukal:
http://asukal.net/blog/?p=301

this antena can connect to Hermes.(by my test)

and i will try to (read full thrad :P) and test GPRS function with this.

PLS wait..
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] walshieau:
Asukal,

Yes the antenna can be connected but the connector on the mainboard is not connected to the GPS lna input and output pins on the processor.....
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Asukal:
oh! i should read thread at 1st. :p thanks!
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] papasieg:
oke last time

guys,

gps chipset is not connected to antenna in hermes.

sorry to inform you haha:)
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] ionide:
Onder welke steen kom jij vandaan? Dat is al lang en breed besproken op dit forum :p
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] priyanshupatel:
guys i do have the service manual with all the parts description and top secret of hermes...

can thatwill help you to fixthe gps support?
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] jefem24:
google made at least agps possible on gmm now so its part of the way not that accurate but functional
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] laurent865:
hello

photo rfr6250 http://www.zimagez.com/zimage/ensemble14.php

photo general:http://www.zimagez.com/zimage/general1.php

Or to connect the antenna on the chip rfr6250 for one 9600

mail laurent865@hotmail.com
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] laurent865:
gps 9600 diagram

Hello, I thank you,

Would you have the diagram concerning the welding to carry out on the chip? For a small note to carry out this type of step

rfr6250 http://www.zimagez.com/zimage/ensemble14.php

general: http://www.zimagez.com/zimage/general1.php

mail laurent865@hotmail.com
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] LinoX:
GPS Antenna on sale?

There's something I can't understand.

Look at: http://cnn.cn/shop/8525tytnhermes-antenna-p-1615.html

They are selling the GPS antenna!!!

Did I miss something?
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] ultramag69:
looks like an external reciever. you would have to have a 3rd party app to run gps. Looked at getting one awhile back but bluetooth seemed a better idea to me. Connects through the external antenna port. Cheers
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] LinoX:
It seems a standard antenna, not an external receiver...
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] apokryphus:
I am wondering about the two possible ways (afaik):

1. Soldering the external connector to the Chipset

2. Soldering the internal antenna to the Chipset

So both would be possible right?

My garantee is already exhausted - so i would try it to solder the antenna to the receiver since i am working for a company that has the technical stuff (soldering station, ...) for it.

maybe we can reanimate the programm for a while?
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] ArSa:
can anyone did this and if working can we get all in one HOWTOdoooo
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] nettcom:
this work??

this bosster work? or is fraud?

Item #:

Name:HTC 8525/TyTN/Hermes GPS antenna

Stock: In Stock

Description:

HTC 8525/TyTN/Hermes/9000 GPS antenna 5m/16ft long

The antenna is merely a booster to stabilize you GPS reception. It works with the existing software on your phone

The base includes a magnet to attach to your car's exterior

http://cnn.cn/shop/8525tytnhermes-antenna-p-1615.html
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] freddan101:
They must mean TyTN II which has an integrated GPS.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] vecken:
is this still being developed? i have an HTC TyTn (8525 Hermes) as well and i would love to know if there is any way i can get this working on my phone. i looked at the files posted but i do not know how to go about making this work on my phone. im currently running Sleuth's WM6 rom right now. please let me know if this is even possible because i thought i read that some people got the GPS receiver to work.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] pda2renew:
Anyone compared internal gps wiring in TyTN II (ATT 8925) and TyTN(Cingular 8525)? Are they using same RF/GPS chip?
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] dutty:
if you fix the batch processing, please include a readme with the changelog and repost including all necessary signature so we will have it easier in the future with porting applications and maybe operatingsystems from other devices.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] bobstarina:
dutty

I did it!

There is no problems with your batch file.

It was the problem with your method of putting the sertificate to WM5.

The way used by you (install of CER certificate directly) is wrong.

I've made a CAB with this certificate. Just install it on Hermes and all will work fine.

Please attach in this topic all other Trinity DLLs you extracted.

I'm not so familiar with extracting files from Trinity ROM.

Here is the CAB:
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] dutty:
great.. we should put it into one zip file so it will be useful for future project..

just came home from my business exam, didnt sleep all night.. so ill take a nap now and work on it when i'm up again.. by the way, there's a trinity dump flying around on the forum. but i'm just too tired to serach for it.. but i'm sure pof will pop up every second with a link ;)
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] bobstarina:
I'm attaching SIGNED

gpschannel.dll

gpsapi.dll

gpsid.dll

rilgsm.dll

and neccessary REG files for them from Trinity.

That's all what I have now. It's not enough and I'm still waiting for other DLLs from dutty.

If somebody want to play our games please install first the CAB file with certificate posted here earlier.

Then using RESCO File Explorer copy these DLLs to \Windows directory (WM5 will warn you of copying over ROM files).

Install REG files and make a soft-reset.

WARNING! Do it only if you understand what are you doing. These are not all neccessary files! With them I loose the ability to use GPRS.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] nunomax:
Dumped ROM it's here ftp://xda:xda@ftp.xda-developers.com/Trinity/Dumped_ROMs/DOPOD_1.23.707.2_WWE_Dumped_OS.rar
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Olipro:
I don't know what certificate you signed those DLL's with, but surely you need to have the secret key to a certificate to do that, and have the cert installed on your PDA.

if you can get the Security Manager working, it makes a life a lot easier since it deploys the dev cert to it for you
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] bobstarina:
OK. Added to mentioned before 4 DLLs another SIGNED ones:

ril.dll

unimodem.dll

serialusbfn.dll

serialUSBFnModem.dll

cellcore.dll

Hermes is still stable and all drivers are started automatically.

But I still cannot attach GPRS (it's weird) and still NO DATA FROM COM9.

Warning! Do not try to put serial_cmd.dll from Trinity to Hermes. HARD RESET GARANTIED!

I've already got one. Whitening of the screen during boot looks amazing :eek:

New version of ZIP archive which includes:

1. SIGNED DLLs mentioned in this post

2. CAB with Privileged Certificate
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] ?Glitch:
From:GSM610.ASM

gsm610.dll ACM_Close ACM_Deinit ACM_IOControl ACM_Init ACM_Open DriverProc

Any thoughts?
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Olipro:
serial_cmd.dll requires ceddk.dll and coredll.dll, however, it would appear this can only be garnered from a running Trinity; can someone please post both these DLL's (unsigned please, I'll deal with that :) )

note: the files can only be found by using Resco on your trinity to copy the files to your My Documents folder then copying them to your computer from there

EDIT: scratch that... they appear un-copyable

just an addition: looking at the dependencies of the gps DLL's, they require cxport.dll too, so I'd heartily recommend putting that on!
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] fm01:
IT seems that the ceddk.dll has something to do with the LCD display:

http://users.ece.gatech.edu/~hamblen/489X/projects/LCDpanel/page2.html

Hmm, I was a bit fast there. here is some more info about the dll:

http://msdn2.microsoft.com/en-us/library/ms898217.aspx
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] :
It would be a good idea for cxport.dll to be signed and placed on someone's Hermes; this file is required by the GPS Dll's
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] TRJS:
Moved here from "the other" thread: As SecureGSM pointed out there are these GPS-related AT-commands in radio rom 1.29 and also 1.22:

at@cleargps

at@clearhot

at@clearall (doesn't seem to exist in radio 1.22)

at@setgps:

at@setgps? gives me the following values: 1,7,50,0,0

Accepted are the following values: at@setgps=[0-255],[0-255],[0-65535],[0-255],[0]

But I found out that the first value must be 1 or 2, otherwise at@startgps won't start. So the following values seem to be working: at@setgps=[1,2],[0-255],[0-65535],[0-255],[0]

I didn't notice a significant change in the GPS data-output, though, no matter what values I set (I'm using the 1.22-radio-rom).

at@startgps:

at@startgps? gives three values: As dutty pointed out the first value is either 0 (GPS not active) or 1 (GPS active); the second value seems to be a counter which is set back to 0 with each re-starting of the GPS and which is increasing rapidly when GPS is active; the third value seems to be always "EDD12DD8"

at@startgps activates the GPS

at@startgps=1,x makes a "GPS Cold-Start Test"

at@startgps=2,x makes a "GPS Warm-Start Test"

(If values are added then there have to be at least two (up to 13) values)

at@stopgps

And finally the quote SecureGSM was refering to (a list of the improvements in Breeze's radio 1.29):
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Olipro:
I have the feeling that HTC could potentially have added a startup application to the Trinity that initialises the GPS to start talking to the OS.

Therefore, could someone with a trinity please take a look at what files are getting executed when their PDA starts up.

Just had an additional thought: GPSChannel.DLL acts as an abstraction layer for the Radio; now that interface is provided by Serial_cmd.dll but we can't get that working... I think this is the crucial step in getting it working.

Update: having just examined the Serial_cmd.dll; the string "NMEA" exists in that file... looks like we've found our missing link!
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Bimboy:
Forgive me if this has been said, and I missed it, but there if you change

[HKEY_LOCAL_MACHINE\ControlPanel\GPS Settings] "Hide"=1

to

[HKEY_LOCAL_MACHINE\ControlPanel\GPS Settings] "Hide"=0

You get the GPS app showing in Start>Settings>System (after shutdown/restart)

In that built in app, you can choose which port your GPS Program should look to, and which GPS port your hardware is.

Again, forgive me if you already knew that. I hadn't seen this in all of the two threads, but I thought it might be a "known".
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Olipro:
yes, I did; but anyway, I know for a *FACT* the Serial_cmd.dll is crucial in getting the GPS working... just need someone with debug tools to find out why it crashes the PDA
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] dutty:
i got debug tool but i don't think its possible to debug serial_cmd.dll properly without debug informations in it..

i guess the reason the device dies like that is a buffer overflow..

by the way, i just tried copying rilgsm.dll out of the windows directory of my aku 3.3 swe rom, but i can't copy it. not with resco, not with as4.0.. damn
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] suineg:
So did someone check for serial_cmd.dll in the newest AKU 3.3 rom?

When I get some spare time I am going to flash the radio for this and give it a shot to catch up with people but someone did mention that it might be an AKU issue.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] dutty:
okay.. replaced all dlls on my devices with the ones we got signed... i still can't get the ril to route my gps commands back to the applications.. but my application can send commands to the modem and activate the gps.. but the modem wont route the response back to the application..

at_debuglog shows that the gps module has been activated!

man it feels like i'm an inch away of the goal..
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] fm01:
I've extracted the rilgsm.dll and serial_cmd.dll from the Swedish 3.3 rom using the imgfs tools if you need them.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] tpf:
aku 3.3?

dutty, not sure if I'm on the right track here but I was just able to copy rilgsm.dll out of the windows dir.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] fireball2k:
dutty: great effort :)

Now that GPS is activated from OS, did you notice any change in GPS debug output in Bootloader? Maybe the OS does some additional initialization we didn't know about yet.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] dutty:
thanks. i will take a look at it.. i'm curios wheter 3.3 implements the at@startgps commands nativly.

edit: nope still no at@startgps natively in 3.3 rilgsm.. but i think tha tmight not be necessary to start gps.. since we just need a comport that sends commands to the modem... damn it would be easy to implement that if we would know how to take control of the comport (serach for cellid in development forum) the iocontrol call doesnt work under wm5
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Olipro:
I've had a look at serial_cmd.dll (from the Hermes) in a hex editor; and whereas with the trinity one there is the string NMEA in there; this is non-existent in the Hermes one :(... fingers crossed that we either get it working, find something in the new AKU, or consider finding a way of getting in touch with a techie at HTC who can give us either unofficial support, or sneak us the DLL out the back door.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] dutty:
ok.. then it must be serial_Cmd! if there is a string with *nmea* then maybe it passes all nmea output to the owner of the call... damnit

try to make a search in serial_cmd for anything ".dll"
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] inic18:
COREDLL.dll CEDDK.dll ser2410.dll ?

first message for me!! hi everybody!!! Thanks for your work!!!
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Olipro:
I've used DependencyWalker on the DLL and it requires CEDDK.dll and Coredll.dll
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] dutty:
íirc you cant copy ceddk... but its worth a shot, maybe the trinity architecture is 1:1 with the hermes architecture..

http://msdn2.microsoft.com/en-us/library/ms894814.aspx
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Olipro:
Inside the serial_cmd.dll of the trinity, there's a string that mentions it's a Trinity; in fact, you would best do to look at it with a hex editor yourself to see.

Either way... a working serial_cmd.dll is certainly paramount.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] dutty:
just to get this right, a signed serial_CMD.dll results in whitescreen?
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Olipro:
it would appear so... can you KITL it?
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] ?Glitch:
May be a shot in the dark...

Anyone think the white screen on boot may be that there is configuration data specific to the chipset the file is looking for in the registry or a cfg file somewhere, we seem to have focused on the registry specific to GPS DLL's and not OS serial dependancy DLL's in the registry. Maybe dumping both system registrys and running beyond compare on them, this with the added support of AKU 3.3 just might be the ticket to supporting GPS.

IOCTL_BUS_GET_CONFIGURE_DATA This IOCTL reads from the configuration space of a subordinate driver specified by the bus name. Different buses have different configuration space names.

For a PCI bus, PCI_WHICHSPACE_CONFIG is supported.

For a PC CARD bus, these names are supported:

For 32-bit PC Card card:

PCCARD_PCI_CONFIGURATION_SPACE

For a 16-bit PC Card card:

PCCARD_ATTRIBUTE_MEMORY

PCCARD_COMMON_MEMORY

PCCARD_ATTRIBUTE_MEMORY_INDIRECT

PCCARD_COMMON_MEMORY_INDIRECT
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] dutty:
care to explain KTL?