[Windows Mobile Software Development] flywhc:
Progress on Rhodium and Leo

Eventually I found functions FmRadioSDK send and receive data.

Send request:

.text:10001208 MOV R12, SP
...
.text:10001220 LDR R3, =__0MsgQueueUtils__QAA_XZ
.text:10001224 LDR R3, [R3]
.text:10001228 MOV LR, PC
.text:1000122C MOV PC, R3 ; create MsgQueueUtils()
....
.text:100012A8 LDR LR, =_Create_MsgQueueUtils__QAAXPA_W_N1KKK_Z
.text:100012AC LDR R4, [LR]
.text:100012B0 MOV LR, PC
.text:100012B4 MOV PC, R4 ; pMsgQ->MsgQueueUtils::Create(L"BTAgProfileQueue",0, 0, 2, 0x14, 0x800)

It uses MsgQueueUtils class sends requests.

Receive events:

sub_100014E8
branch loc_10001644

It calls sub_100059B4 three times for PS, RT and PTN.
However look at sub_100059B4:
sub_100059B4
.text:100059B4 MOV R12, SP
.text:100059B8 STMFD SP!, {R0-R3}
...
.text:100059EC BL InitRDSBuf

then it is a loop, doesn't have raw RDS parsing logic.

It parses an internal data structure from BTAG (Bluetooth Audio Gateway?).

I have to look into BTAG driver to see if it handles raw RDS. So many bluetooth related DLLs... I guess it is btagsvc.dll?

I don't understand why HTC or Broadcomm make this FM driver so complicated. waste CPU, battery, storage... I guess it is Broadcomm provided those drivers to HTC to restrict capabilities of this chipset, just like HTC didn't have proper MSM graphics driver before.

I can't find file btagext.dll, which is loaded by a btagsvc.dll. anyone have this file? Maybe it is not important to us.

It sends message to a window with class name "WCE_BTTRAY" during initialization.

Update: I just found BTTrayCE.exe has string "WCE_BTTRAY" and "BTAgProfileQueue". It is a big exe file!

MsgQueueUtils is imported from BtCECommon.dll - I can't find this file. Anyone who has this device can upload BT*.*?

Global messages, such as registerwindowmessage(L"WIDCOMM_WM_REG_PROF_EVENT")

.rdata:100147F8 aWidcomm_wm_stack_loa unicode 0, <WIDCOMM_WM_STACK_LOAD>,0
.rdata:100147F8 ; CODE XREF: sub_100131F0+24j
.rdata:100147F8 ; DATA XREF: .text:off_1001321Co
.rdata:10014824 aWidcomm_wm_stack_unl unicode 0, <WIDCOMM_WM_STACK_UNLOAD>,0
.rdata:10014824 ; CODE XREF: sub_10013220+24j
.rdata:10014824 ; DATA XREF: .text:off_1001324Co
.rdata:10014854 aWidcomm_wm_getstacks unicode 0, <WIDCOMM_WM_GETSTACKSTATUS>,0
.rdata:10014854 ; CODE XREF: sub_10013250+24j
.rdata:10014854 ; DATA XREF: .text:off_1001327Co
.rdata:10014888 aWidcomm_wm_setstackc unicode 0, <WIDCOMM_WM_SETSTACKCONFIG>,0
.rdata:10014888 ; CODE XREF: sub_10013280+24j
.rdata:10014888 ; DATA XREF: .text:off_100132ACo
.rdata:100148BC aWidcomm_wm_btradio_o unicode 0, <WIDCOMM_WM_BTRADIO_OFF>,0
.rdata:100148BC ; CODE XREF: sub_100132B0+24j
.rdata:100148BC ; DATA XREF: .text:off_100132DCo
.rdata:100148EA DCW 0
.rdata:100148EC aWidcomm_wm_btradio_0 unicode 0, <WIDCOMM_WM_BTRADIO_ON>,0
.rdata:100148EC ; CODE XREF: sub_100132E0+24j
.rdata:100148EC ; DATA XREF: .text:off_1001330Co
.rdata:10014918 aWidcomm_wm_visible1 unicode 0, <WIDCOMM_WM_VISIBLE1>,0
.rdata:10014918 ; CODE XREF: sub_10013310+24j
.rdata:10014918 ; DATA XREF: .text:off_1001333Co
.rdata:10014940 aWidcomm_wm_reg_prof_ unicode 0, <WIDCOMM_WM_REG_PROF_NOTIF>,0
.rdata:10014940 ; CODE XREF: sub_10013340+24j
.rdata:10014940 ; DATA XREF: .text:off_1001336Co
.rdata:10014974 aWidcomm_wm_reg_pro_0 unicode 0, <WIDCOMM_WM_REG_PROF_EVENT>,0
.rdata:10014974 ; CODE XREF: RegWidcommProfEventMsg+24j
.rdata:10014974 ; DATA XREF: .text:off_1001339Co
.rdata:100149A8 aWidcomm_wm_activesyn unicode 0, <WIDCOMM_WM_ACTIVESYNC>,0
.rdata:100149A8 ; CODE XREF: sub_100133A0+24j
.rdata:100149A8 ; DATA XREF: .text:off_100133CCo
.rdata:100149D4 aWidcomm_wm_isvisibil unicode 0, <WIDCOMM_WM_ISVISIBILITYTIMER>,0
.rdata:100149D4 ; CODE XREF: sub_100133D0+24j
.rdata:100149D4 ; DATA XREF: .text:off_100133FCo
.rdata:10014A0E DCW 0
.rdata:10014A10 aWidcomm_wm_ident_cha unicode 0, <WIDCOMM_WM_IDENT_CHANGE>,0
.rdata:10014A10 ; CODE XREF: sub_10013400+24j
.rdata:10014A10 ; DATA XREF: .text:off_1001342Co
.rdata:10014A40 aWidcomm_wm_post_stac unicode 0, <WIDCOMM_WM_POST_STACK_LOAD>,0
.rdata:10014A40 ; CODE XREF: sub_10013430+24j
.rdata:10014A40 ; DATA XREF: .text:off_1001345Co
.rdata:10014A76 DCW 0
.rdata:10014A78 aWidcomm_wm_update_st unicode 0, <WIDCOMM_WM_UPDATE_STATUS>,0
.rdata:10014A78 ; CODE XREF: sub_10013460+24j
.rdata:10014A78 ; DATA XREF: .text:off_1001348Co
.rdata:10014AAA DCD 0
.rdata:10014AAE DCW 0
.rdata:10014AB0 aWidcomm_wm_kill_visi unicode 0, <WIDCOMM_WM_KILL_VISIBILITYTIMER>,0
.rdata:10014AB0 ; CODE XREF: sub_10013490+24j
.rdata:10014AB0 ; DATA XREF: .text:off_100134BCo
.rdata:10014AF0 aWidcomm_wm_set_fm_co unicode 0, <WIDCOMM_WM_SET_FM_CONFIG>,0
.rdata:10014AF0 ; CODE XREF: sub_100134C0+24j
.rdata:10014AF0 ; DATA XREF: .text:off_100134ECo
.rdata:10014B22 DCW 0
.rdata:10014B24 aWidcomm_wm_prof_chan unicode 0, <WIDCOMM_WM_PROF_CHANGE_EVENT>,0
.rdata:10014B24 ; CODE XREF: sub_100134F0+24j
.rdata:10014B24 ; DATA XREF: .text:off_1001351Co
.rdata:10014B5E DCW 0
.rdata:10014B60 aWidcomm_wm_stackload unicode 0, <WIDCOMM_WM_STACKLOADED>,0
.rdata:10014B60 ; CODE XREF: sub_10013520+24j
.rdata:10014B60 ; DATA XREF: .text:off_1001354Co
.rdata:10014B8E DCW 0
.rdata:10014B90 aWidcomm_wm_stackunlo unicode 0, <WIDCOMM_WM_STACKUNLOADED>,0
.rdata:10014B90 ; CODE XREF: sub_10013550+24j
.rdata:10014B90 ; DATA XREF: .text:off_1001357Co
.rdata:10014BC2 DCB 0
.rdata:10014BC3 DCB 0
.rdata:10014BC4 aWidcomm_wm_trayunloa unicode 0, <WIDCOMM_WM_TRAYUNLOADED>,0
.rdata:10014BC4 ; CODE XREF: sub_10013580+24j
.rdata:10014BC4 ; DATA XREF: .text:off_100135ACo
.rdata:10014BF4 aWidcomm_wm_activate unicode 0, <WIDCOMM_WM_ACTIVATE>,0
.rdata:10014BF4 ; CODE XREF: sub_100135B0+24j
.rdata:10014BF4 ; DATA XREF: .text:off_100135DCo
.rdata:10014BF4 ; END OF FUNCTION CHUNK FOR sub_100131F0