yashsingh1/xdaforums huggingface dataset:
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] md288m:
Use the Hermes as an external GPS via Bluetooth?

Hi Guys,

I have been following along with this thread since the beginning Great work keep it up!!,

I was wondering if it would make any sense to try to setup the Hermes as an external Bluetooth GPS to another PDA, by using software like"Gps Gate" or "Gps Redirect".

from what i have read in the previous posts, it seems that most of the current problem is in getting the data output routed to the OS via the RIL. maybe by trying to route the GPS signal to the Herme's Bluetooth transmitter and then back to another device we might get some results... if this works it might give us some insight into this whole situation...

Just a thought....
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Olipro:
http://blogs.msdn.com/kitlfirst/
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Olipro:
here's a question; what file/dll (or whatever) loads the comport dll's? I added com16550.dll to my Hermes which is responsible for the infrared; the result is that my PDA white-screens as soon as I try to load it, meaning that the entry points on the functions is probably different; either way, it's likely the loader (the kernel file?) needs to be replaced.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] dutty:
i doubt that this si going into the right direction.

everything is already working as it should, gpsapp commincates with gps module over ril/virual comport. the problem is that the ril doesnt route the commands from the gpsmodule back to the com9 port... i.e. there is never any data to read. but written bytes will be forwarded to the at modem and interpreted correctly. do you understand what i mean?

there is one dll that has to handle the forwarding, i guess thats ril.dll or serial_cmd.dll
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Olipro:
well, the serial_cmd is there to address the COM Port too, as is com16550... if both are causing a white-screen, is it not logical to find out if we can replace the items that invoke them to hopefully prevent the crash.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] abubasim:
@dutty:

A checksum on ril.dll shows that it is identical in the RUU_Trinity_DOPODASIA_WWE_1.23.707.2_6275_1.29.00.11_108_Test and RUU_Hermes_HTC_WWE_2.05.255.1_6275_1.34.00.10_108_Test ROM images. serial_cmd.dll is not, though.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] dutty:
ok if you see if from that standpoint than that is okay.. by the way, i still don't see where you wanted to go with the kitl. i can't debug anything because there is no debug information in the dll files. besides that i guess as soon as the device hit the whitescreen teh remote debugger will disconnect... most important is without debug infos all we got is sm... and my arm asm skills suck even more than my x86 asm skills :P hell i dont even know any arm asm..
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] apokryphus:
just my 2 cents:

imho the gsm chip is the same in trinity and tytn, also bluetooth and cpu, probably wlan also - isn´t it?

well, maybe the graphic-chip is different i guess. so for me it seems logical that the ril.dll is the same, like the hashsum prooves. so maybe you should find the routines that calls the graphic-chip and fit it to he specs of the tytn.

well it is also feasable that it´s a function in the dll that causes any incompatibilities because there should be functions that are not implementet - like the nemea string .

Could you find out what dll´s are loaded when it crashes with kitl and compare it to the original one with http://winmerge.org/ ?
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Olipro:
ARM asm is no different from x86 asm (except for the OP codes... and neither of us are hot enough to be able to work in hex-codes)

I've been looking for something that can disassemble the serial_cmd.dll since I could toy with it then, so if you do find something, please link me!
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] pof:
You can use IDA Pro on windows or and radare + objdump crosscompiled for ARM on linux.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Bimboy:
Maybe this will help you?

http://xdaforums.com/showpost.php?p=788336&postcount=18
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Sleuth255:
IDA pro is your dll disassembly tool. The trial is free and full featured. The crippleware is that the unlicensed debugger slowly disables features as you use it and eventually closes. However, there's a generous timeframe allowed and you can easily get real work done. I used the trial version to develop the ptt crack.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Olipro:
stupid me... IDA...

also, can someone get me CEDDK and Coredll from the Trinity somehow?
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] superdave:
So far, I can open up the radio com port( com6 created by serial_cmd) under windows and at@startgps fine. I have not left it long enough to see if the sats start picking up or not. Problem is doing it that way rilgsm cant open since the port is in use.

The newer serial_cmd.dll starts up fine for me. Although, I am pushing it from kitl, I have not tried copying it to the device.

Using kitl, i can see the gpschannel.dll start up. The status is

262253 PID:237b1442 TID:235ca52 GPS_Init

268260 PID:237b1442 TID:235ca52 GPS_INIT fail

268264 PID:237b1442 TID:422287aa PPN:GPS CANNEL

Modfying the gpschannel it appears it is failing trying to open up COM6. Which makes no sense, since I can open it up and startgps fine, as long as rilgsm is shut down. It appears gpschannel may be a layer between rilgsm and the radio port. That is just a guess since theres a deviceioctl call from gpschannel to ril1:

If we cannot get this working, we could always write are own layer in between.

,Dave
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] superdave:
Found the problem with the open. The version of serial_cmd posted wasnt actually the newer one. Using the right serial_cmd i get

1194401 PID:437b0442 TID:a25a62c6 GPS_Init

1194402 PID:437b0442 TID:a25a62c6 [GPS]ComOpenThread:bInitDone = TRUE

,Dave
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] superdave:
it definilty needs serial_cmd. GPSchannel starts right up normally with it. The problem is with rilgsm it cannot open the radio correctly for some reason and resets it

RIL:ResetGSMHardware:PPN TRUE

188023 PID:e37ad442 TID:623a02d2 <RIL>1:37:49 +SwitchRadioOff

188027 PID:e37ad442 TID:623a02d2 <RIL>-SwitchRadioOff

188028 PID:e37ad442 TID:623a02d2 <RIL>Radio ON:PPN TRUE

188030 PID:e37ad442 TID:623a02d2 <RIL>1:37:49 +SwitchRadioOn

When it does that the screen freaks out. Not sure why yet.

,Dave
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] superdave:
This appears to be the problem

<RIL>-SwitchRadioOff

251517 PID:c37ad482 TID:31f5fd6 <RIL>Radio ON:PPN TRUE

251519 PID:c37ad482 TID:31f5fd6 <RIL>1:54:28 +SwitchRadioOn

251640 PID:c37ad482 TID:83585dfe @@@@@@@@@@ HUB state changes now @@@@@@@@@@

251642 PID:c37ad482 TID:83585dfe [HCD]HubStatusChangeThread:PPN TRUE

251744 PID:c37ad482 TID:83585dfe [HCD]HubStatusChangeThread:PPN FALSE

251952 PID:c37ad482 TID:31f5fd6 <RIL>-SwitchRadioOn

251954 PID:c37ad482 TID:31f5fd6 RIL:ResetGSMHardware:PPN FALSE

257465 PID:c37ad482 TID:31f5f62 <RIL>COM returned EV_ERR

Using the gps serial_cmd regardless of whether use the new or old rilgsm/ril thats what you get. Although with the old rilgms/ril it doesnt crash. Just keeps trying.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] superdave:
Last post for the night.

The problem is the new serial_cmd is not talking to the radio. I have the new and old dlls decompiled and I am going through them now. Could take a bit though. If we can get the new dll to talk to the radio everything else should work. If not we can always use the old radio and write a custom layer.

,Dave
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] dutty:
nice to see somebody else tap in.. great progress.. can't continue to do anything as my device is currently flashed with my original operator rom.. will get a new one soon..

but i could write the custom layer if you can be specific about the functions we need to import/export.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] spiritofseth:
anyone ever wonder if some of the HTC guys watch this forum and laugh at us, like maybe were looking in the wrong places and they think its funny.

anyways, I was cruzing through the new cingular AKU 3.3 rom and found this key

hklm\drivers\active\54\

take a look it says gps but Im thinking its just a blank port.

anyone find it suspiscious that all of a sudden our access to the radio has been cut off in newer roms?
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] trion:
I know some of you wanted to try the AT commands on the Trinity, but it was impossible to do this from the bootloader in the Trinity.

I found this program on the net:

http://www.wm-soft.com/products/bluezard

It's called bluezard and it should allow sending AT commands to another phone trough bluetooth, maybe this should help figure things out.

At least you can check the AT command on the trinity and watch the response :)

--> Control remote-device by sending AT-commands. It has built-in terminal.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] blerk:
Dll diffs

Dropping in with a small contribution:

I had a quick session with Winmerge, comparing the Aku 3.3 Trinity and Hermes rom dumps on all DLL's mentioned in this thread so far:

- unimodem.dll:	identical

- gpsid.dll:	identical

- gpschannel.dll:	identical

- gpsapi.dll:	identical

- serialusbfn.dll:	identical

- serialUSBFnModem.dll:	identical

- ril.dll:	identical

- cellcore.dll:	identical

- ceddk.dll:	not found in both ROM images

- coredll.dll:	not found in both ROM images

- cxport.dll:	identical

- rilgsm.dll:	different!

- serial_cmd.dll:	different!

- QCTUSB.dll:	missing on Hermes

(Trinity_DopodAsia_WWE_1.23.707.4_6275_1.33.00.11_108 and RUU_Hermes_HTC_WWE_2.05.255.1_6275_1.34.00.10_108_Test)

I'll try to check the changes in serial_cmd.dll with IDA Pro later. It has been a while since I did asm coding, but hey...

Interesting note: the Trinity Rom seems to have quite a few other changes as well (including Camera and .NET CF 2.0)

Cheers guys, and keep up the good work!
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] apokryphus:
Big Up!

Good job; so some *.dll needs not be touched while reverse engineering the stuff...
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] abubasim:
Apologies if I am bringing up old news but did anyone notice that the SPL of the Trinity ROM could play part in the GPS activation? A string search on the SPL.nb in the ROM shows the familiar AT@startgps.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] dutty:
no.. thats new, and its interesting!
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] apokryphus:
i thought that too, that is why it could be interessting if somebody from the trintiy comunity could provide the information from the at@startgps output.

but till now nobody can give this information because of the bootloader is bigger than 1.04.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] dutty:
by the way, with des's tool we can jump start into any SPL even one we specify ourselves.. so just try to jumpstart the trinity spl with des's tool and see if that works.. if it works we might try to flash it.

i'm still busy with exams so i cant try it myself
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] blerk:
Weird:

While trying to reproduce Dutty's situation (NMEA output in AtDbgLog), I did need to replace all dll's from signed1.zip before getting any NMEA output, instead of only replacing rilgsm.dll. Am I missing something here?
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] apokryphus:
how you could prevent the white screen issue, i would tap in, if it is possible to prevent this...

maybe the need of the dll´s in package depends on the:

- ceddk.dll: not found in both ROM images

- coredll.dll: not found in both ROM images

because they are in the package...

maybe you can kitl the load of it, to get further?
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Sleuth255:
those two dlls are in the XIP area. You need to extract with dumprom.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] apokryphus:
what is this area about? could you explain me, please!
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Sleuth255:
xip stands for eXecute In Place. Heavily used dll's are there. The above two dlls contain fundamental WinCE exports and are, in fact, part of the WinCE kernel.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Pyranwolf:
Just as a thing, don't suppose it had the parameters after startgps?

(Yeah, I should look myself really...)
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] abubasim:
Actually, the SPL in the AKU 3.3 Test ROM for Hermes includes the same string. But there is one more difference though: "Start GPS" does appear in Trinity's while it's absent in Hermes'.

Are the Hermes and Trinity similar enough to allow flashing of a Trinity SPL onto a Hermes? The risk is of course so much higher; a broken SPL means that you have the neighborhoods fanciest paper weight.

(Sorry for not volunteering myself but I paid USD850+ for my SIM-free JASJAM and I like my phone.)
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] superdave:
I've managed to get a driver sitting between the radio serial port and the ril stack. It starts up gps fine and currently dumps all data out to a flat file. When in the middle of my house I can see 1 sat and at the window it sees 4. I am hopeful outdoors it will get better. I think we will need to find a way to feed it startup location, since right now its a cold start every time. The radio stack and os function fine with the driver running so there should be no issues there. Next step is to have the second port so other apps can connect in. Should have something ready soon.

I looked into the serial_cmd issue, the files are very different and it could take a while to step through the code. This driver is doing the same thing, so it seems like an easier route.

,Dave
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] apokryphus:
]

Seems not, check the other gps thread

@ Dave:

Great!

So i can put the dll on my device, boot it and than it will show me the sats?

Sorry but my english isnt good enough to understand all right.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] :
the at@startgps function is present in spl 1.04 (and 1.01 for that matter) too although I would say that chances are this is in the bootloader for debugging purposes as opposed to directly talking with the GPS.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] neo_com_3:
Hi m8...

Do you have to change you rom to use this driver or you can use it with any radio or bootroader version?

If you can get 4 sats at your window you are fine...

Keep up the good work!
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] blerk:
Just a quick thought: if the Trinity has a AtDbgLog feature as well, we might be able to capture the actual at@startgps and related commands.

I'm not sure if the Trinity has such as feature by default or whether it can be enabled. Checking the registry dump did not reveal the proper keys so I guess we're out of luck.

Any thoughts on this? I'll repost in the Trinity Forum as well.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] bobstarina:
It should be very easy.

In registry:

\HKLM\Software\HTC\ATDebugLog\Enable=1 for logging

\HKLM\Software\HTC\ATDebugLog\LogMode=1 for logging into file
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] stinger32:
Could any1 put together a package with everything thats needed to get the gps up and running so every1 can test and help out? maby in this way we can solve this faster. As it seems now we have 3-4 people deep involved and a couple of hundred maby thousands that only follows this thread. Maby we wont be able to dissamle dll-files or rewrite a new layer but hopefully test something so you that can concentrate on more important things
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] blerk:
While driving to work this morning I had the GPS enabled, capturing NMEA output for about 30 minutes in the AtDbgLog. The results were not really hopeful; I got the same results as indoors (maximum of 4 satellites)
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] stinger32:
4 sats Inside your car, do you get more sats outside in open sky? or is 4 sats the max you can get no matter where you are?
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] dutty:
as said before.. forget about the # of sats.. i get up to 7 sats on the roof/6th floor..

i really dont like to see that this is going circles, by the way this is techincal discussion and not gossip. thanks

there is nothing to test at the moment. so the answer is short, no.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] neo_com_3:
Can a mod delete the last 3 posts?

Yes I do... What I don't get is your nasty behavior...

In order to satisfy Olipro, can a mod delete the last 3 posts - including this one?

Tnx...
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Sleuth255:
I've deleted a few non-technical posts. i'm running mobile now so my oversight ability is somewhat limited. dutty: if you see any more here that I missed, pm me.

folks who aren't contributing technical info: use the other thread. I will delete non relevant stuff here as promised in post 1.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Olipro:
sorry... I best respond to this; no, I'm not being nasty; just politely irate
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Lurker0:
I'm afraid if a DLL is in the XIP area, it can't be just copied over existing one in another ROM. It should be put to a ROM image into the XIP area and then flashed. Even in a case of a success copy over, there is a big chance that the original (old) DLL will be loaded during the boot process.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] jpogge:
It is possible to get some signals without an antenna, especially with -155dbm sensitivity, a lock is more dificult however, At least I think the actual GPS circuit is identified, I would appreciate some other opinions.
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] apokryphus:
check this: http://xdaforums.com/showthread.php?t=291181&page=60

there are up to 4 satellites in the view.

No fix then and after all the lost of the view - is this loosing caused by the absence of an antenna?

It is possible that we are "chasing ghosts caused by a goofy signal"?

weird..
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Bimboy:
Okay, I bit the bullet and disassembled the Hermes to get better pics for you, all in the name of GPS advancement. I took a side and front on Macro view. It's 1000% clearer than the FCC pics. Hope it helps clear up what that jack is. :)
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] dutty:
jpogge, serious reading there!

your input is really important for this project. please stay on course with us.

what is the minimum signal db required for a gps fix?
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] jixxie:
Reply to jpogge

Hello, I'm replying to jpogge's last post. Since it is too much text to quote, I'll comment his points:

1) You are talking about RTR6250, but imho it has nothing to do about (satellite-) GPS. It's actually the RFR6250 which does. In Hermes there are all three chips, which are mentioned in Qualcomm's promotion brochure (RTR6250, RFR6250 and RFR6220), and the one you are referring to in the pictures is the RTR6250 not RFR6250. On the page 7/22 the RFR6250 is the most-right-bottom chip. There is no close-up picture of RFR6250 in the FCC documents.

Bimboy, if you still have your Hermes open, make more photos of the PCB please - especially the part around RFR6250 (which is unfortunately covered by the shielding - but once you're in, taking the shielding off can't hurt your warranty any more ;)

2) Those two TI chips in the shielding below the GSM SMB connector (page 7/22, upper picture, upper part) are for WiFi, not Bluetooth. BT chipset is on the other side of the PCB (page 14/22, upper picture, right side), what you think is GPS LNA... By Google, B6150E1 stands for TI BRF6150 which is a BT1.2 chip.

You are also referring to four RF jacks on the motherboard. But there are only three: one big gold for GSM on the back side, one small silver for WiFi below and one small silver on the front side of the PCB for BT. I can't see the fourth one :/

I have no doubts about labelling of BT and WiFi antennas in FCC docs. Both are the same size = same frequency, guessing 1/8 of wavelength, and situated near relevant chips. As jpogge is saying, GPS antenna has to have a narrow field of view, so it can't be placed nowhere else than on the top or front side of the unit. On the front side there is not an inch of free space, so we only have the top - in the other words, the GSM antenna, which could be connected to GPS. But I think this is, because of pictures of that unrecognised specific grill antenna in Trinity (which is placed in the top-left corner = on the two sides at once, which supports the fact, that Trinity can operate as a navigation unit also in landscape mode), quite unpredictable :(

Sorry for the bad news, I truly hope I'm wrong.. otherwise it's another nail to gps-in-tytn coffin...
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] kockie:
dutty: Should be about -146db for 'in use' and about -150db for tracking a satelite.

After getting the almanach and ephemerisdata, 3 satelites should be enough for a 2D-fix (4 for a 3D-fix).

Gx
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] jpogge:
Damn, it s hard to evaluate from pictures, are there any of the RFR circuit.

I will look these over again.

Dutty- Kockie is correct -140 to -150db in the newer chipsets track, after aquiring both almanac and ephemeris
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Bimboy:
Site's really hanging today. Must've hit send twice. :rolleyes:
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] Bimboy:
That would likely render my Hermes inoperable, looking at the way you'd have to rip the shields off. I bet it would mess up quite a few tracers on the PCB.

I voided warranty by opening it, but I'm not really willing to destroy the phone since it's working fine still. Maybe somebody with a permanently bricked TyTN would want to dismantle the device?
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] reynhalt:
140 to -150db ...

we only get 10-30 db on hermes, it's too bad
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] jpogge:
Bummer I just looked over the Trinity photos, and recognized the GPS antenna, it is a version that I first saw in a korean device from sys on corp. I think, could be wrong there there was no label at the time... Also a matching network and test RF jack just below it. looks like we are missing the antenna, possibly the filter, I cant tell from the trinity photos, they mostly focused on the antenna. Either way darned impressive to actually see the satelites with no antenna, a bit more signal and you might get a fix...
[8525, TyTN, MDA Vario II, JasJam Software Upgradin] jpogge:
I found a ceramic chip antenna, from Johannson Dielectrics, 10 mm x 3 mm

it would need a matching network, two components, but if we could identify the pin for the pre LNA on a trinity GPS, we could make a very thin highly sensitive antenna which will fit in the Hermes. It would have a micro coax lead the outer conductor can be soldered onto any ground nearby, the shield for instance, and the center to the pin or more hoefully the resitor of the band pass, I say hopefully because a missing band pass could explain why the GPS repeater also failed. Let me know if anybody can provide trinity pictures with detail of the antenna assem, and the RFR6250 in particular.

One word of warning, using an Ohm meter may be a bad idea, most ohm meters measure by injecting a small dc current, this could potentially destroy the LNA if it is not internally protected from DC spikes, unlikely but with no actual data sheet a real possibility, it is best to do a visual from the GPS antenna assembly instead....