yashsingh1/xdaforums huggingface dataset:
[Windows Mobile Software Development] schmeichler:
short: no, Rhodium not supported (yet?)

Read the last about three pages here - not all RDS-info is delivered from Rhodium FM (chip/driver?)
[Windows Mobile Software Development] mcflaytasche:
Hello,

at [APP] Power Radio - a FM player with RDS decoding for VGA and WVGA devices thread I have asked:

and got the answer:

Yesterday I have search this thread but I can't find something that could help me:(

Is there a chance to become Powerradio or better gfmapi work on Glofiish M800?
[Windows Mobile Software Development] flywhc:
The first post in this thread lists of all supported devices and devices may be supported.

Glofish M800 is not in the list so not supported.

If you can extract all fm radio related dll and exe from your phone and post here, I may find a way to support your device.

I don't have much time working on this project so I have little progress recently.
[Windows Mobile Software Development] Trykall8:
--> GFMAPI v2.0 for Rhodium??

Hello every1,

@flywhc

is there a way to support Rhodium in short time?? :confused:

How far you are in developing??

I'm waiting for NEW GFMAPI.DLL!!!!!!!!!!! :rolleyes::rolleyes:

Nice to have an answer! ;)

Bye

:cool::cool:
[Windows Mobile Software Development] mcflaytasche:
Don't stress you;)

Do you mean by name or the real programs:confused:
[Windows Mobile Software Development] flywhc:
Won't be in this month ;)

I am going to post source code of Rhodium and Artemis testing app.

I hope open source will progress the research.

Please upload FM*.dll and FM*.exe files under \Windows
[Windows Mobile Software Development] mcflaytasche:
Hello flywhc,

here are the files,

I hope that I found all;)

With FM_si4700.dll I had some problems while copying,

hope it will work.
[Windows Mobile Software Development] flywhc:
Low level driver FM_si4700.dll is corrupted. It is OK because we have a high level driver FM.DLL.

FMTuner uses LoadLibrary to load functions. And the way to write this app make it is difficult to reverse engineer.

Good news is FM.DLL definitely support RDS in a beautiful way:

Types of arguments are exported although it is not easy to get definition of ITmcxxx interfaces.

It is feasible to get it working but it takes time and also need somebody debug on this device using VC++.

Actually the best way is asking the manufacture. M800 has a such good FM driver should publish its API.
[Windows Mobile Software Development] flywhc:
Artemis Test

Artemis doesn't provide API interface. FM radio application directly calls DeviceIOControl communicating with FMT driver.

This test application is still very very basic and may be not working at all.

It doesn't support Seek method but you can set frequency property.

The first step is identifying all IOCTLs for DeviceIOControl.

If we are lucky, maybe we will find an IOCTL return RDS data. Maybe we have to deal with memory mapping etc.

SI47xx chip has some restrictions such as must set band before power on.

I don't know what are valid values for ChannelSpacing, frequency etc. You can get those value from registry on your device.

You will need Visual Studio.net + WM2006SDK to run attached ArtTest.

If you have IDA pro, you can find a virtual table in FMRadio.exe start from 0x02D41C to 0x2D4A8. most functions in this class use DeviceIOControl operate FMT driver.

Update: here is a newer version that fixed some problems
[Windows Mobile Software Development] flywhc:
Rhodium test

Most functions of Rhodium test should be working except events.

I still don't know event structure.

Basic RDS data should be correct but I don't know others.

Using debugger watch window/memory window you can guess format of event data.

I hope we can find an event with a structure containing a point to raw RDS data.

How to identify RDS data? search PI in memory. PI is a 16 bit number that should be repeated every 12 or 8 bytes.

Or you can search PS (station name) in two characters groups.

Note: you need a Visual Studio.net + wm2006 SDK

There is a mistake in the project file: Properties->Deployment->Additional files should be empty.

Log File:

\temp\temp.log

Log to UDP port: 0x10?

0x80000002, Software\Widcomm\BTConfig\Debug, LogIPAddr
[Windows Mobile Software Development] mcflaytasche:
To copy the FM_si4700.dll I must rename it,

because it is copy protected.

Take the time you need,

but what will I need to got VC++ on my device.

I'm not a developer or hacker but I'm happy to learn something.

Do you mean I should try to ask Eten about documentation?
[Windows Mobile Software Development] beemerTPPC:
I don't know it it could be useful for you flywhc, but searching inside BTMamager.exe of the rhodium for a solution to turning BT on and off, I've found that among the new Broadcomm messages in this stack is this one:

.rdata:00039B78 00000032 unicode WIDCOMM_WM_SET_FM_CONFIG

Maybe having the BT stack you could do something more. Unfortunately I don't have a Rhodium, but if you need it I have all the BT stack files and registry export.
[Windows Mobile Software Development] terta:
hello flywhc,

will try to get Studio + SDK working... and will get back to you :-)
[Windows Mobile Software Development] torpie13:
Hi there folks;

I've got a little suggestion/Question :

- Is it possible to preamp the FM signal with your driver ? ie what makes this application not working in some conditions it that the FM Signal is weak. So, that's why I'm just wodering if a function to preamps the signla with your driver is realistic.

Cheers
[Windows Mobile Software Development] derstandard:
hi, when i want to start xfmradio i get the error message: power on failed: err 31... anybody can help me about?!
[Windows Mobile Software Development] terta:
you could at least tell us on which device you're trying to do this...
[Windows Mobile Software Development] Bib_x:
I have a HTC Touch Cruise (Polaris) with pcarvalho WM 6.5 ROM.

I don´t get any RDS information.

Only Version 0.4b works on my device. With Version 0.4 i get no sound.
[Windows Mobile Software Development] mike2nl:
It is very still here. Is erevrybody on vakation?

Can the owner of the thread tell us something

about the HTC TP2 RDS and/or the TMC functions ;-).
[Windows Mobile Software Development] flywhc:
I don't think so.

Does 0.4B give you RDS data?

It is a timeout error. Device doesn't response to Power On function for 5 seconds. I don' know why but nobody else reported this problem?

Maybe a soft reset would solve the problem. otherwise please tell me more info about your device.

As you can see I 've provided test app for Rhodium, Artemis and even I could provide one for Eten M800. I can't make any progress without those devices, or someone has those device and debug my test app.

Nobody give me useful testing results yet.
[Windows Mobile Software Development] mcflaytasche:
I have a M800 and would like to do something.

What will I need to debug it on my device?

I'm a real beginer:(
[Windows Mobile Software Development] tommini:
@flywhc: Got my VS2008 instance with WM2006SDK running. I can power on the radio and set frequency (in debug mode) but don't know where to look for the above described event. Should it be somewhere arond the "OnFMEvents" function in FMRadioAPI.cpp?

I'm a C# developer so with a little push in the right direction I'll be able to supply you with the needed information to get this to work on the TP2
[Windows Mobile Software Development] smb_gaiden:
Great work fly. I am running the VC2005 w/ WMSDK 6 Pro and debugging over bluetooth. I recreated a a solution and project file for use on my version. May I bother with three minutia before I become productive here?

1. I got Rhodium test and its main src file is arttest.cpp is it right?

Seems to be, it compiles runs and triggers some OutputDebugStrings from lower layers.

2. Since I don't have an alternative device with FM aside from this Rhodium, may I know the expected value format for.tuning on brcm fm? Say 94.1 should it be 941, 9410, 94100, etc? I know the PI of 94.1 here so easier for me to debug with hard coding that freq

3. Anyone who has a functional brcm fm in a debugger, could you post the hex mem dump of the callback parameter structure during rds messages? Maybe the first 80-120 bytes in rows of 16 plus the addresses from the memory window? Should be a start for comparative purposes.

Thanks and sorry to enter with a flurry of questions, but I think it'll get me productive quicker.

Another approach I may take if available is to attach to the HTC FM Radio app and put a breakpoint in the register function of the dll to learn the callback addr and then a breakpoint in that CB, then read the asm. My last job was heavily involved in debugging and optimizing using arm asm, but that was arm7 so just a few new opcodes to learn.
[Windows Mobile Software Development] MurdockTheOne:
Hello,

(Old account not working anymore won't send me the lost password)

I have the rhodium and een externel royeltek gps/tmc reciever bluetooth.

If you want me to test someting just let me know.
[Windows Mobile Software Development] flywhc:
Thanks for participating the project.

Having VC++ skills is essential. At least you need to know how to open my project and run on the device. You will check watch and memory window and guess the data structure. Then modify c++ code to verify your assumptions.

I forgot saying that it is better to debug via bluetooth connection otherwise you have to see results from dialog on the screen (by using LogEx() function) and frequently modify code, deploy on the device, unplug usb and plug earphone...

smb_gaiden,

ArtTest.cpp contains dialog and control logic. FMRadioAPI.cpp contains hardware related functions. So you need to work on FMRadioAPI.cpp

Rhodium FM API FM_Register() function registers an callback function to receive all events. In the test app it is FMRadioAPI::OnFMEvents().

I created struct STATUS0 based on assumptions from reading existing assembly code. many things are missing. you need to find out what are each variables in this struct. They may be different for different events depends on dwEventID (see EFMEventType). And I don't know what is lpData, maybe it is useless.

It is a good point that what is the format of data. You have to guess. It is easy to know the format of frequency, Call FM_SeekStation, it should fire event ID=3, STATUS0.dw0x04Param1 should be the frequency.

PI is a 16 bits unique id for a station. You may find this number from website somewhere. I can tell you PI for stations in the UK. If somebody in same country as you and has older HTC phones can run xFMRadio 1.2 and set verbose to 3, xFMRadio will display raw data. Then I can tell you what is PI from that raw data.

You can see a recurrent patten in memory such as C7 88 ... C7 88 .... C7 88 ... and mix with RDS text, station names that splitted to two letters such as MA .. GI... C (MAGIC). In the UK, 0xC788 is PI for MAGIC station.

Format of RDS data frame:

http://xdaforums.com/showpost.php?p=3560477&postcount=34

Example of raw binary data:

http://xdaforums.com/showpost.php?p=3535640&postcount=18

http://xdaforums.com/showpost.php?p=3536178&postcount=20

Analysis:

http://xdaforums.com/showpost.php?p=3565741&postcount=42

Note that this is for HTC Raphael, every 12 bytes have a repeat PI. Rhodium may be different. Such as checkword is longer or no checkword at all.

terta extracted binaries of Rhodium FMRadio drivers and application:

http://xdaforums.com/showpost.php?p=4158675&postcount=675

FmRadioSdk.dll is the FM radio driver, which communicate with bluetooth driver and wav1 driver.

BTFM.exe is a FM radio player directly uses this driver.

FMSDKWrapper.dll is a FM radio driver that simulate old Touch Pro driver. It actually communicates with FmRadioSdk.dll.

I used IDA pro to disassemble them. Unfortunately application and the driver doesn't process raw RDS data. It is too difficult to understand FmRadioSdk.dll, at least for me. My ARM skills is not that strong.
[Windows Mobile Software Development] Rookie69:
Hi flywhc

Sorry for my bad english, but I will do my very best. :o

I have the same problems as Bib_X. I use a XDA Orbit 2 (=HTC Touch Cruise, Polaris) with Olio v4.79v4 M2D Full German ROM (WM6.1) and Polaris_Radio_1.59.46.12.

xFM Radio v0.4B works fine. I get station-name, radiotext, everything is OK.

But GFMAPI (1.6) makes problems. I tested PowerRadio and API-Test.

Most times API-Test says: FMpoweron: on error 31

If this error occures, no RDS-Data is available.

In very very rare cases, FMpoweron is OK and everything works fine. So I think it`s a timing problem??

PowerRadio doesn`t show an error message, but the behaviour is similar. In very very rare cases RDS-Data is shown.

htc fm radio 1.5 shows stationname.

I hope you can help us (with a new GFMAPI-release).

Greetings from Wiesbaden, Germany

Rookie69
[Windows Mobile Software Development] flywhc:
smb_gaiden, do you have IDA pro? It will be much more clear if you read assembly code of drivers and applications from ida pro.

In BTFM.EXE. address 00013244 is the event procedure.

FMSDKWrapper, address 10001F2 is same.

in FMradiosdk.dll, address 1001847C is the address of procedure passed by caller (such as BTFM or FMSDKWrapper), also 10003B4C is pointed to this address.

If load them into VC and debug it, address should be same.

I hope that event procedure provide raw RDS data, like other HTC devices. However if it is not, we have to analyze FMRADIOSDK.DLL and write our own driver! that will be a big job.

Rookie69, sounds like a bug of GFMAPI. Driver on your Polaris behave different from other devices (slower i guess). I will fix it.
[Windows Mobile Software Development] flywhc:
That was very good work smb_gaiden.

If you can get IDA Pro.

IDA pro would tell you function names, addresses of modules and functions.

You will need a ROM kitchen for your phone in order to load binaries in ROM.

If the ROM Kitchen for Rhodium is not available, you can also try other kitchen such as Raphael Kitchen etc.

PS is a 8 characters length string. And RT is a 64 characters fixed length string, maybe 32 characters. They are not zero terminated so parser replaces 0x00 to 0x20.

I guess it may have two ways to load RDS data:

1. have a timer in a polling thread. Periodically Read RDS data from low level Bluetooth driver.

2. wait for an event object and wait for a I2C interrupt was triggered, then load RDS data from low level Bluetooth.

Trying different value for FM_SetRdsMode is also a good attempt.

Maybe that 0xf000aebc is in BtCECommon.dll.

It may be helpful if we can find the programming sheet for Broadcomm BCM4325 (I guess this is the one on Rhodium?) Maybe Broadcomm provided that driver to HTC.
[Windows Mobile Software Development] Rookie69:
Great. Let me know if you need a beta-tester. :)
[Windows Mobile Software Development] Bib_x:
Same to me. Could also be a beta-tester for you.
[Windows Mobile Software Development] idealforyou:
The HGPS-client from Post #342 will not startet on WM5 on Orbit/Artemis. HyperGPS only programmed for WM6?
[Windows Mobile Software Development] smb_gaiden:
FM_SetRdsMode didn't seem to change the data in the callback when I used from 0 to 5 as the first parameter.

BTW, the load addresses for future reference, on my device in my sw configuration, on the original firmware, of undetermined version. May be different for others, but useful to check the load addr and function jump addr vs dumpbin /exports.

Q: Anyone know how I can dumpbin /exports on the files I am unable to copy off the device via ActiveSync? I guess some ROM files like coredll.dll and the likes.

Using Remote process Viewer when the FM test app is active yields the following data.

fmradiosdk.dll	0x7A420000

et9dictionary.dll	0x78B40000

et9disinput.dll	0x014a0000

shutil.dll	0x033FE000

htmlview.dll	0x03C8E000

et9ime.dll	0x78800000

commctrl.dll.0409.mui	0x7FF80000

commctrl.dll	0x0323F000

aygshell.dll	0x037A3000

checkime.dll	0x016B0000

ossvcs.dll	0x0301E000

oleaut32.dll	0x03062000

btcecommon.dll	0x78040000

ws2.dll	0x02EE6000

coredll.dll.0409.mui	0x7FFE0000

ole32.dll	0x03091000

coredll.dll	0x03F4A000

What we have above is that the BTCECOMMON is the one who is the top of the call stack when the callback is invoked and loops. Very likely that they are running it in a thread with WaitFor**Object...

However, none of these addresses map to that funky 0xF000xxxx address which I could not jump into. As far as I know it is not a co-processor jump, bx is a plan ole jump. Must be some protected MMU memory region. Based on the above table, the jump comes from coredll.dll. I might not need to be aware of what is behind that jump, if I can dumpbin coredll.dll and see what the function being called is named and what it does.

-=-=-=-=-=-=-

EDIT: lookign back at the main loop that kicks off the copy RT, PTY, and PS data there's a comment where the branch leads to a all to that 0xF000xxxx function. Well the symbol for that branch is:

354 161 0000E17C ?ReadMessage@MsgQueueUtils@@QAAHPAXPAKK@Z

Based on 0x78040000 being BTCECOMMON.dll load address and the address of the bl intruction.

I know coredll.dll has these functions:

CloseMsgQueue

CreateMsgQueue

GetMsgQueueInfo

OpenMsgQueue

ReadMsgQueue

WriteMsgQueue

I guess BTCECOMMON has some wrapper around the CE coredll message functions. Either way, the data is sent over some messagequeue and even replacing that would get the same data. Still fishy on the SetRdsMode and hoping it isn't something as simplistic as setting RDS vs. RDBS. Walking the function quickly without trying to understand it, it certainly seemed more complex than that. That's my next pathway, since I need to alter what is written to the messagequeue and tracing backwards from the callback is only enough to read what has been written.
[Windows Mobile Software Development] flywhc:
Please read the first post of this thread. Or search.

I read some posts and wiki pages in the forum before to discuss how to do this.

I haven't done this my self as I always download ROM kitchen made by others.

Roughly you need to:

1. dump ROM from your device

http://xdaforums.com/showthread.php?t=419036

2. covert raw files to NBH and NB files etc.

3. extract files from NB files

maybe extra steps to extract files in kernel

You don't need to do this. I saw Rhodium FM driver are almost perfectly linked to files in the Raphael kitchen in IDA pro.

Have you tried IDA pro? In embedded world, static analysis is sometimes better than debugging.

It is a must have for mobile phone software crackers.

I remember this when I read IDA pro.

The driver create a message queue thread without a window.

BT stack sends message to that queue.

Update:

If we cannot find raw RDS data from the event handler, we have to use IDA pro to do ARM code static analysis.

Because VC++ doesn't support debugging device driver.

It would be very helpful if we have Broadcomm programming sheet
[Windows Mobile Software Development] mhemart:
Hello Flywhc,

I'm back again after a long silence.

I finally downloaded VS2008 and WM SDK for trying your test application but it's really new to me and I don't really know how to compile the application for the artemis. I always have error of compilation. Any advice for configuring VSC++ for mobile application ?
[Windows Mobile Software Development] kull:
Is there a way to "boost" the FM signals since some channels don't come on the HTC Polaris. Thanks.
[Windows Mobile Software Development] flywhc:
Have you installed Windows Mobile 6 Professional SDK? and VS2008 standard or professional or team edition? VS2008 express doesn't support smart device development.

I tried compiling that project and found no compiling errors.

only problem I found is in project properties->Deployment->Additional files should be empty otherwise you may see deployment warning.

what error messages you got?

try to make an antenna?

see here:

http://xdaforums.com/showthread.php?t=535358
[Windows Mobile Software Development] kull:
Thanks for that . Don't think will be able to make this one. Hope its available for purchase somewhere!
[Windows Mobile Software Development] nitin_ko:
flywhc, can u make fm work on cdma p3051

i do not want to flash a new rom since my handset is under warranty
[Windows Mobile Software Development] mhemart:
Hello Flywhc,

Thank you for solving the problem. I've installed the team edition of VS2008 and WM6 Pro SDK but I was unable to deploy the project. I didn't know why.

Now, the project is compiled and sent to my mobile. Can you explain the next step ? I started the program and tried to power on/off FM but no success (invalid parameter). I also tried to Get Prop for every parameter but invalid parameter too (I think it's normal, power is off...).

Please tell me how to proceed next..

PS : Do I need a GFMAPI.dll for the test app or is it just for your other WM configurations ?
[Windows Mobile Software Development] flywhc:
nitin_ko, sorry I can't. I guess it doesn't support FM radio at all even if burn a customized ROM.

mhemart,

The code had some mistakes and I fixed them in the attachment.

Assume you know how to set a breakpoint, step in/out/over using debug menu/toolbar.

In watch window you can see value of variables.

You can also open a memory window to check a memory block.

Set a breakpoint on bRet = DeviceIOControl(...) in ArtFMAPI.cpp, FMOpen function.

Start debug and wait, it should stop at that line.

hFMDevice should have a non-zero value.

step over that line bRet should be non-zero.

Seek is not implemented but you can try set a frequency.
[Windows Mobile Software Development] mhemart:
Thanks for your answer Fly,

I'll try to "play" with you work tonight and I'll give you my results as soon as possible.
[Windows Mobile Software Development] schmeichler:
Hey flywhc,

are you keeping an eye on the 'no tmc while charging'-issue?

I actually have not tried and have not been using / experimenting myself for a while but this might be interesting.

thx
[Windows Mobile Software Development] UMH:
Rhodium - MDA Vario V - Touch Pro 2

Hi flywhc,

I attached a ZIP-file with the FM radio related files from a MDA Vario V german stock rom

ROM-Version: 1.14.111.2 (50207) GER

ROM-Date: 05/07/09

Radio-Version: 3.44.25.27

Protokoll-Version: 61.25t.25.19U

Very interesting is the FM Radio-application (BTFM.exe) with RDS support from Widcomm in the Windows folder.

Maybe you can use the files and get some information for RDS/TMC support of the Rhodium.

Good job so far.

Regards, UMH
[Windows Mobile Software Development] f21270:
thanks for this great proggi!

i´ve installed on tp2, but i don´t can listen the music! the rds information works. where´s the problem?
[Windows Mobile Software Development] UMH:
I forgot to mention that there is no sound.

The reason for posting the files is to support flywhc, maybe he can disassemble or debug this programs.

Regards, UMH
[Windows Mobile Software Development] btje:
Hi.

for those of who do not have a radio it would be nice to connect to the internet and download the tmc data from a website or get other traffic info from a website.

In the netherlands this is a good source http://www.verkeersinformatiedienst.nl/

what do you think of this?
[Windows Mobile Software Development] flywhc:
Somebody posted those files before.

Thanks anyway.

This application calls FMRadioSDK.dll. FMRadioSDK.dll seems not provide raw RDS data. I guess it gets raw RDS data from Broadcomm/Widcomm Bluetooth Audio Gateway driver (BTAG).

I don't have this BTAG driver. Could you extract it from your device and upload it?

I suspect that Broadcomm provides standard driver and SDK for the FM/BT radio chip. Everything would be very easy if anyone can fine this SDK or document.

That is a good idea.

Difficulty is lack of documents/specs such as how to translate map data to RDS.
[Windows Mobile Software Development] MurdockTheOne:
Hello how is it going with te rhodium touch pro 2 ?

Are there still people working on it.

I hope it works soon.

can someone give a status?

By the way fm radio from htc works with rds i see station info enz. whe does't tmc works than?