[Windows Mobile Software Development] smb_gaiden:
Well, good news. I could attach to the FMRadio.exe process and got some interesting outputdebugstring messages from the native player and or API layers. I paste some of it below, with the following three caveats

1. Don't judge me on the musical selection playing at the time. This has the best signal here with known RDS and TMC messaging in my region. The classic rock is the other TMC carrier, but it is far south east of where I am sitting.

2. I don't know why the Chinese is in there, it showed in VC2005 like that.

3. I am sporadically working on this, so just because you see me exploring it it will always help to have more eyes looking and making progress!

3a. Next step is for me to look back at the test app and examine memory regions. Then I Can also get the FM API preferred load addresses and symbol addresses, so I can re-attach to the native FM app and set some breakpoints on the API flow and walk through the native FM App disasm.

-=-=-=-=-=-=-

[FMRadio] 22:33:06(11837225472) thr 0x8BF968DE : Event ps_changed: psName = The , frequency = 94100	(MainFrame.cpp,558)

fmCallbackFromSDK, no cmd id (FM_ID_NULL), it would be RDS or RSSI notification, update here...

[FMRadio] 22:33:06(11837848448) thr 0x8BF968DE : PS changed to: The, length = 3	(MainFrame.cpp,574)

[FM_RDS] fmapp.rdsPty = 7

[FM_RDS] fmapp.rdsText = The

[FM_RDS] fmapp.rdsTextRT = Prince & The Revolution Let's Go Crazy Star 94.1

[FM_RDS] fmapp.rdsPtyN =

[FM_RDS] fmapp.htc_fm_event.p.ps_changed.psName = [桔⁥††]

[BT] FM API: receive from Audio Gateway; msg=BTAG_FMAPP_STATUS

CallbackToHTCThread, cmd id = FM_ID_GET_RSSI

fmCallbackFromSDK, cmd id = FM_ID_GET_RSSI, event = 0

[FMRadio] 22:33:07(11839904384) thr 0x8BF968DE : Event ps_changed: psName = The , frequency = 94100	(MainFrame.cpp,558)

fmCallbackFromSDK, no cmd id (FM_ID_NULL), it would be RDS or RSSI notification, update here...

[FMRadio] 22:33:07(11840475872) thr 0x8BF968DE : PS changed to: The, length = 3	(MainFrame.cpp,574)

[FM_RDS] fmapp.rdsPty = 7

[FM_RDS] fmapp.rdsText = The

[FM_RDS] fmapp.rdsTextRT = Prince & The Revolution Let's Go Crazy Star 94.1

[FM_RDS] fmapp.rdsPtyN =

[FM_RDS] fmapp.htc_fm_event.p.ps_changed.psName = [桔⁥††]

[BT] FM API: receive from Audio Gateway; msg=BTAG_FMAPP_STATUS

CallbackToHTCThread, cmd id = FM_ID_GET_RSSI

fmCallbackFromSDK, cmd id = FM_ID_GET_RSSI, event = 0

[FMRadio] 22:33:07(11842651552) thr 0x8BF968DE : Event ps_changed: psName = The , frequency = 94100	(MainFrame.cpp,558)

fmCallbackFromSDK, no cmd id (FM_ID_NULL), it would be RDS or RSSI notification, update here...

[FMRadio] 22:33:07(11843514368) thr 0x8BF968DE : PS changed to: The, length = 3	(MainFrame.cpp,574)

[FM_RDS] fmapp.rdsPty = 7

[FM_RDS] fmapp.rdsText = The

[FM_RDS] fmapp.rdsTextRT = Prince & The Revolution Let's Go Crazy Star 94.1

[FM_RDS] fmapp.rdsPtyN =

[FM_RDS] fmapp.htc_fm_event.p.ps_changed.psName = [桔⁥††]

[BT] FM API: receive from Audio Gateway; msg=BTAG_FMAPP_STATUS

CallbackToHTCThread, cmd id = FM_ID_GET_RSSI

fmCallbackFromSDK, cmd id = FM_ID_GET_RSSI, event = 0

[FMRadio] 22:33:07(11846187616) thr 0x8BF968DE : Event ps_changed: psName = The , frequency = 94100	(MainFrame.cpp,558)

fmCallbackFromSDK, no cmd id (FM_ID_NULL), it would be RDS or RSSI notification, update here...

[FMRadio] 22:33:07(11847081376) thr 0x8BF968DE : PS changed to: The, length = 3	(MainFrame.cpp,574)

[FM_RDS] fmapp.rdsPty = 7

[FM_RDS] fmapp.rdsText = Revoluti

[FM_RDS] fmapp.rdsTextRT = Prince & The Revolution Let's Go Crazy Star 94.1

[FM_RDS] fmapp.rdsPtyN =

-=-=-=-=-=-

Edit: Welp, battery now done and I need that port for charging. Either the battery is quick cuz the large screen, or I am using it a lot more than usual because it is new to me. At any rate it is on the charger and I have to give up until tomorrow or the next day. Damn HTC and their USB multiport...

As a side note, I had a breakpoint in the callback function as the RDS updates came in and a memory dump window showing through pointed at the incoming data struct lpInfo. I noticed things that look like fmap.rdsText and fmapp.rdsTextRT showing through in that memory screen rdsText might be like PS Scrolling feature of RDS. Also, It may be parsing the raw RDS at a lower layer and passing these structs up. I lost battery before I could confirm it, so you'll want to verify this before taking at word.

Last point that was interesting was the fact you mention about not knowing what lpData is. Another hunch, but unconfirmed is that you Register for FM with th eCB function and a 0 param. It passes this 0 back to you as user data. That's often a paradigm of callback functions so you can pass your interface pointer or the this pointer to callee who will then provide it back to you so you can have a reference to your interface from a static function. Another guess without verification due to the low battery...