Hermes GPS - Technical Discussion, FACTS ONLY. W.I.P. - 8525, TyTN, MDA Vario II, JasJam Software Upgradin

[V speaking: PLEASE do not use this thread for rumour or ideas. This thread is for FACT only. Use this thread for ideas etc. Thanks!]
i know its not common practice to do this, but....
i hope this will be the place for the technical discussion of our journey to implement the gps module.
please no non-technical posts, only research here. use the other thread for theories about missing antennas and crippled chips..
this will be a moderated thread.. (sleuth ? ) from Sleuth: I'll make sure of it. PM me with posts you don't think belong here dutty
if you want to participate:
the dumped rgu( reg files ) can be found here:
http://forum.xda-developers.com/attachment.php?attachmentid=33852&d=1170260634
both hive files (default reg files) converted to ascii human readable format can be found here:
http://forum.xda-developers.com/attachment.php?attachmentid=33847&d=1170257783
my last post with information was:
bobstarina said:
dutty
I'm using Radio ROM 1.22.01.01.
I'm affraid of using 1.29 because of 1.008 loader in it.
Sleuth255
The situation with drivers is not good. It seems to me that we will need all of radio related DLLs from Trinity but at this moment my Hermes is not working propertly with Trinity's RILGSM.DLL.
Click to expand...
Click to collapse
bobstarina.. i have replaced the following dlls successfully (can be loaded and working properly):
-unimodem.dll
-gpsid.dll
-gpschannel.dll
-gpsapi.dll
-rilgsm.dll
-serialusbfn.dll
-serialUSBFnModem.dll
i tried to replace:
-ril.dll ( phone is unable to start, alot of services need to be started manually: sound, gsm codec etc. - they work properly but the phone is not working, i assume it depends on another dll or service )
-serial_cmd.dll ( can be loaded manually, crashes the device after a few minutes, probably depends on the ril.dll )
-cellcore.dll ( contains the entire API/OS functions related to the telephone. error: OS won't bootup, i assume the reason is that the replaced cellcore.dll hasn't got the proper signing so it would require a manual load but at that time a manual load is not possible )
unfortunately i still cant get the gps to respond... damn..
i have compiled this gps c# application.. it's from the wm5.0 sdk, it makes use of the wm5.0 intermediate gps drivers.. can somebody please test it on the trinity so we have a proper application as testing ground.
usage: unzip both files ( the dll+the exe ) into a directory on your ppc.
goodcompany.. thanks for the offer, can you still read output on the screen or is the device totally broken?
--- we really need the help of a trinity user.. we need to trace the whole process of an application talking to the gps module..
my first question to those (gps'd)trinity users that want to help would be:
whats the bootloader gps nmea output on your device??
grabbing the output is very simple, you won't loose any data on your device:
-put your device into bootloader mode (on the hermes it's left ok, powerbutton + stylus reset)
-kill the activesync process on your windows xp computer ( kill wcsecomm.exe + rapimanager.exe via taskmanager )
-unzip mtty and start it, as connection select the usb driver.
-a terminal will open
-type: "rtask b" enter
-"ate1" enter
-"atv1" enter
then wait until you see output on your terminal. then type:
-"[email protected]" enter
grab some input, leave the device alone for a few minutes.. then save the output (file->save) from mtty and attach it to your post.
thank you!
edit:
second question, i really need a registry dump of a trinity gps device. could somebody please dump the whole registry - but please make sure that there is no personal information stored on the device.
---
okay i've just created my own registry dump from the *.hv files that are in the romdump thats floating around.. but it looks like this is from a test rom because the gps applet seems to be disabled:
"[HKEY_LOCAL_MACHINE\ControlPanel\GPS Settings]
"Hide"=dword:1
"
pof, was that dumped rom you pointed me to the current released dopod rom?
interesting, i have found those strings inside the rilgsm.dll using a hexeditor:
Code:
[D :: VIRSER_COM] [D :: SERIAL_CMD] [D :: FRONTLIGHT] [D :: LED] [D :: PSM ] [D :: GPS] [D :: RIL] [D :: SIR ] [D :: FIR] [D :: CF] [D :: SERIAL_BT] [D :: SERIAL] [D :: AUDIO] [D :: BACKPACK] [D :: WLAN] [D :: SD] [K :: KERNEL] [D :: SPI] [D :: BATTERY] [D :: TOUCHP] [D :: KEY] [D :: I2C] [D :: MISC] [D :: CAMERA] [D :: USB_HOST] [D :: USB_FUNCTION] [D :: Display]
this looks like devicedrivers and , i can find most of these in the registry i got
for example:
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\OEM_Misc]
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\RIL]
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\GPSChannel] (gps)
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\Serial] (serial_cmd.dll)
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\CIF]
etc. but i cannot find anything that's close to "virser_com" sounds like "Virtual serial" -> gps port??
maybe the reason i cant find it is that this is a preproduction dump...
Sleuth255 said:
@dutty: Trinity bootloaders don't have access to the radio command interpreter. The "rtask b" command is missing....
it's never easy damnit....
Click to expand...
Click to collapse
damnit....
pof, i assume that's the rom the trinity users are flashing to enable gps on their device.. is there a gps tool included in the ext rom?
yesterday night i've played around with the at debug feature of the hermes with all trinity dlls in place.. looks like there's really only one link missing check it out:
the communication between GPSAPP->GPSCHANNEL.DLL->RILGSM.DLL->RIL.DLL works without any problems, but the commincation from the ril to the gpsapp doesn't seem to work.. i don't know why.. yet:
check it out:
Code:
1:44:0 Rx:+CSQ: 6,99\r\n0\r
1:44:0 Rx:@HTCCSQ: 2\r\n
1:44:4 Tx:[email protected]=1,44,3,2007,1,31\r
1:44:4 Rx:0\r
1:44:10 Tx:AT+CSQ\r
1:44:10 Rx:+CSQ: 7,99\r\n0\r
1:44:20 Tx:AT+CSQ\r
1:44:20 Rx:+CSQ: 7,99\r\n0\r
1:44:21 Tx:[email protected]\r
1:44:21 Rx:0\r
1:44:23 Rx:NMEA$GPGSV,1,1,00*79\r\nNMEA$GPGGA,
1:44:23 Rx:,,,,,0,,,,,,,,*66\r\nNMEA$GPRMC,,V,
1:44:23 Rx:,,,,,,,,,N*53\r\nNMEA$GPGSA,A,1,,,,
1:44:23 Rx:,,,,,,,,,,,,*32\r\nNMEA$GPVTG,,T,,M
1:44:23 Rx:,,N,,K*4E\r\n
1:44:24 Rx:NMEA$GPGSV,1,1,00*79\r\nNMEA$GPGGA,
1:44:24 Rx:,,,,,0,,,,,,,,*66\r\nNMEA$GPRMC,,V,
1:44:24 Rx:,,,,,,,,,N*53\r\nNMEA$GPGSA,A,1,,,,
1:44:24 Rx:,,,,,,,,,,,,*32\r\nNMEA$GPVTG,,T,,M
1:44:24 Rx:,,N,,K*4E\r\n
1:44:25 Rx:NMEA$GPGSV,1,1,00*79\r\n
1:44:25 Rx:NMEA$GPGGA,,,,,,0,,,,,,,,*66\r\nNME
1:44:25 Rx:A$GPRMC,,V,,,,,,,,,,N*53\r\nNMEA$GP
1:44:25 Rx:GSA,A,1,,,,,,,,,,,,,,,,*32\r\nNMEA$
1:44:25 Rx:GPVTG,,T,,M,,N,,K*4E\r\n
1:44:26 Rx:NMEA$GPGSV,1,1,00*79\r\nNMEA$GPGGA,
1:44:26 Rx:,,,,,0,,,,,,,,*66\r\nNMEA$GPRMC,,V,
1:44:26 Rx:,,,,,,,,,N*53\r\nNMEA$GPGSA,A,1,,,,
1:44:26 Rx:,,,,,,,,,,,,*32\r\nNMEA$GPVTG,,T,,M
1:44:26 Rx:,,N,,K*4E\r\n
1:44:27 Rx:NMEA$GPGSV,1,1,00*79\r\nNMEA$GPGGA,
1:44:27 Rx:,,,,,0,,,,,,,,*66\r\nNMEA$GPRMC,,V,
1:44:27 Rx:,,,,,,,,,N*53\r\nNMEA$GPGSA,A,1,,,,
1:44:27 Rx:,,,,,,,,,,,,*32\r\nNMEA$GPVTG,,T,,M,,N,,K*4E\r\n
1:44:28 Rx:NMEA$GPGSV,1,1,00*79\r\nNMEA$GPGGA,
1:44:28 Rx:,,,,,0,,,,,,,,*66\r\nNMEA$GPRMC,,V,
1:44:28 Rx:,,,,,,,,,N*53\r\nNMEA$GPGSA,A,1,,,,,,,,,,,,,,,,*32\r\nNMEA$GPVTG,,T,,
1:44:28 Rx:M,,N,,K*4E\r\n
1:44:29 Tx:AT+CSQ\r
1:44:29 Rx:+CSQ: 7,99\r\n0\r
1:44:29 Rx:NMEA$GPGSV,1,1,00*79\r\nNMEA$GPGGA,
1:44:29 Rx:,,,,,0,,,,,,,,*66\r\nNMEA$GPRMC,,V,
1:44:29 Rx:,,,,,,,,,N*53\r\nNMEA$GPGSA,A,1,,,,
1:44:29 Rx:,,,,,,,,,,,,*32\r\nNMEA$GPVTG,,T,,M
1:44:29 Rx:,,N,,K*4E\r\n
1:44:30 Rx:NMEA$GPGSV,1,1,00*79\r\nNMEA$GPGGA,
1:44:30 Rx:,,,,,0,,,,,,,,*66\r\nNMEA$GPRMC,,V,
1:44:30 Rx:,,,,,,,,,N*53\r\nNMEA$GPGSA,A,1,,,,
1:44:30 Rx:,,,,,,,,,,,,*32\r\nNMEA$GPVTG,,T,,M
1:44:30 Rx:,,N,,K*4E\r\n
1:44:31 Rx:NMEA$GPGSV,1,1,00*79\r\nNMEA$GPGGA,
1:44:31 Rx:,,,,,0,,,,,,,,*66\r\nNMEA$GPRMC,,V,
1:44:31 Rx:,,,,,,,,,N*53\r\nNMEA$GPGSA,A,1,,,,
1:44:31 Rx:,,,,,,,,,,,,*32\r\nNMEA$GPVTG,,T,,M
1:44:31 Rx:,,N,,K*4E\r\n
1:44:32 Tx:[email protected]\r
1:44:32 Rx:[WCDMA] GPS: END\r\n
1:44:32 Rx:0\r
1:44:32 Tx:[email protected]\r
1:44:32 Rx:0\r
1:44:34 Rx:NMEA$GPGSV,1,1,00*79\r\nNMEA$GPGGA,
1:44:34 Rx:,,,,,0,,,,,,,,*66\r\nNMEA$GPRMC,,V,
1:44:34 Rx:,,,,,,,,,N*53\r\nNMEA$GPGSA,A,1,,,,
1:44:34 Rx:,,,,,,,,,,,,*32\r\nNMEA$GPVTG,,T,,M
1:44:34 Rx:,,N,,K*4E\r\n
1:44:35 Rx:NMEA$GPGSV,1,1,00*79\r\nNMEA$GPGGA,
1:44:35 Rx:,,,,,0,,,,,,,,*66\r\nNMEA$GPRMC,,V,
1:44:35 Rx:,,,,,,,,,N*53\r\nNMEA$GPGSA,A,1,,,,
1:44:35 Rx:,,,,,,,,,,,,*32\r\nNMEA$GPVTG,,T,,M
1:44:35 Rx:,,N,,K*4E\r\n
1:44:36 Rx:NMEA$GPGSV,1,1,00*79\r\nNMEA$GPGGA,
1:44:36 Rx:,,,,,0,,,,,,,,*66\r\nNMEA$GPRMC,,V,
1:44:36 Rx:,,,,,,,,,N*53\r\nNMEA$GPGSA,A,1,,,,
1:44:36 Rx:,,,,,,,,,,,,*32\r\nNMEA$GPVTG,,T,,M
1:44:36 Rx:,,N,,K*4E\r\n
1:44:37 Tx:AT+CSQ\r
1:44:37 Rx:+CSQ: 7,99\r\n0\r
1:44:37 Tx:[email protected]\r
1:44:37 Rx:[WCDMA] GPS: END\r\n
1:44:37 Rx:0\r
1:44:47 Tx:AT+CSQ\r
1:44:47 Rx:+CSQ: 7,99\r\n0\r
1:44:57 Tx:AT+CSQ\r
1:44:57 Rx:+CSQ: 7,99\r\n0\r
1:45:3 Tx:[email protected]=1,45,3,2007,1,31\r
1:45:3 Rx:0\r
Click to expand...
Click to collapse
lets get back here..
i noticed that my device crashes when its low on battery and the rilgsm.dll is loaded... we really need to figure out all depending drivers, services and other dlls...

---

Temporarily stickied.
V

---

dutty
Now I'm deep inside the RGU files from Trinity.
Some interesting findings:
1. HKLM\Comm\Security\SystemCertificates\Privileged Execution Trust Authorities - maybe we can put needed certificates into this branch for an automatic start of Trinity DLLs (another choice is to find the differences between RGU file and Hermes registry - who knows maybe there are some special certificates in Trinity's testing ROM?) I will check it later.
2. In RGU file there is the registry branch HKLM\Drivers\RegisteredDevice\BTD_COM9. I cannot find it in registry of my Hermes. I will try to add it and will see what happens next.
Added: After adding this entry and soft reset I'm able to start COM9 manually (as you remember I was not able to start it during last 2 days) !!!
3. \HKLM\Drivers\BuiltIn\QCTUSB_PCD9
In Hermes registry I have this branch empty.
In Trinity RGU file there are some keys inside this branch:
Dll="QCTUSB.DLL"
Prefix="PCD"
Index=9
DeviceArrayIndex=5
Tsp="Unimodem.dll"
Order=3
DeviceType=0
FriendlyName="Virtual PCD9"
DevConfig=20,00,00,00,05,00,00,00,10,01,00,00,00,4B,00,00,00,00,08,00,00,00,00,00,00
And SOMETHING INTERESTING:
\HKLM\Software\Microsoft\RIL\DataPort="PCD9:"
(In Hermes registry this key refers to "PCD1:")
Maybe this is what we looking for?
It looks like "virser_port" that you are looking...

---

In the registry of my Herm200 (Vario II, T-Mobile radio ROM, no Trinity radio flashed),
HKLM\Drivers\RegisteredDevice\BTD_COM9 points to btd.dll, flags =0, index=9, pefix is COM.
On my Hermes, \HKLM\Drivers\BuiltIn\QCTUSB_PCD9 has the same values as you found in the Trinity RGU file.
\HKLM\Software\Microsoft\RIL\DataPort="PCD9:" is indeed pointing to PCD1 on my Hermes.
It seems to me that the first two reg keys are identical to the original ones on my Hermes, only the contents of the .dll files may or may not differ between Trinity and Hermes.
edit: I did a search in my registry and found this in HKLM\Drivers\Active\63
HND=Dword 305664 decimal
Key=System/CurrentControlset/GPSIntermediateDriver/Multiplexer/ActiveDevice. Does this key point to the GPS Driver that works between the GPS and the OS? How is this in the trinity reg dump? Hmmm, I looked at it, it points to the GPSID.dll file. not much help I am afraid. let me know if I can help in any way.

---

is there anyone with a trinity who can post more Registry data pertaining to the COM9 port?
particularly what's in their QCTUSB_PCD9

---

Olipro said:
is there anyone with a trinity who can post more Registry data pertaining to the COM9 port?
particularly what's in their QCTUSB_PCD9
Click to expand...
Click to collapse
From the dumped trinity reg from the other thread (post 390)
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\QCTUSB_PCD9]
"DevConfig"=hex:20,00,00,00,05,00,00,00,10,01,00,00,00,4B,00,00,00,00,08,00,00,00,00,00,00
"FriendlyName"="Virtual PCD9"
"DeviceType"=dword:0
"Order"=dword:3
"Tsp"="Unimodem.dll"
"DeviceArrayIndex"=dword:5
"Index"=dword:9
"Prefix"="PCD"
"Dll"="QCTUSB.DLL"
Click to expand...
Click to collapse

---

cheers, and also; is there anything about COM9 (or the GPS) in HKLM\Comm

---

Olipro said:
cheers, and also; is there anything about COM9 (or the GPS) in HKLM\Comm
Click to expand...
Click to collapse
Nothing specific to COM9, port 9, virtual ports, or GPS. Only mention of generic USB Serial linkage which must be for synching.
If you need to, you can see the reg dump file @ http://forum.xda-developers.com/showpost.php?p=1121468&postcount=390

---

just another mention; but I have installed the privileged developer certificates on my Hermes and have signed the rilgsm dll with that signature; after doing this, the dll starts *AUTOMATICALLY*!
UPDATE2: GPS DLL's are signed; GPS device now starts automatically
UPDATE3: signed unimodem.dll and cellcore.dll; phone still functions with these installed
UPDATE4: signed serial_cmd.dll; this makes my device white-out and die... can someone find out what DLL's this one depends on so I can load it without crashing

---

Dear Olipro,
Could you put these signed files in this topic?
All other people involved in research will be very much grateful to you.

---

Olipro said:
just another mention; but I have installed the privileged developer certificates on my Hermes and have signed the rilgsm dll with that signature; after doing this, the dll starts *AUTOMATICALLY*!
UPDATE2: GPS DLL's are signed; GPS device now starts automatically
UPDATE3: signed unimodem.dll and cellcore.dll; phone still functions with these installed
UPDATE4: signed serial_cmd.dll; this makes my device white-out and die... can someone find out what DLL's this one depends on so I can load it without crashing
Click to expand...
Click to collapse
can you explain how you have signed those files with the developer certificate?? i have tried it myself with several different method (sign package from mamaich) and security configuration manager.. i just can't sign those beasts..
i think serial_cmd.dll depends on ril.dll but there is another missing dll...
edit: I did a search in my registry and found this in HKLM\Drivers\Active\63
HND=Dword 305664 decimal
Key=System/CurrentControlset/GPSIntermediateDriver/Multiplexer/ActiveDevice. Does this key point to the GPS Driver that works between the GPS and the OS? How is this in the trinity reg dump? Hmmm, I looked at it, it points to the GPSID.dll file. not much help I am afraid. let me know if I can help in any way.
Click to expand...
Click to collapse
yes the hermes implements the gps intermediate driver, with some small adjustments you can keep those entries.. not sure what they were, i have to check.. gpsid is the driver that implements the microsoft gpsapis that oyu can use in .net for example (check the tool i compiled in c#)
from the looks of everything, it really looks like they just crippled out some functions to make the hermes a non gps device.. i'm sure there were some protoypes with gps enabled..

---

elementary my dear friend
You might recall I posted something that allows you to disable the security on your PDA; this application also allows you to provision developer certificates on your PDA as well.
Basically, I provisioned the certs onto it, and then used signtool.exe (if you go to the file menu on the security program then it'll show you what folder it needs to be in) to sign the DLL files and plopped them on my PDA with Resco.
seems to be a massive breakthrough since ril.dll (and pretty much everything else) works perfectly and automatically though this method.
P.S: get the signtool.exe off Google; there's a Codeproject website that has it.

---

Olipro said:
elementary my dear friend
You might recall I posted something that allows you to disable the security on your PDA; this application also allows you to provision developer certificates on your PDA as well.
Basically, I provisioned the certs onto it, and then used signtool.exe (if you go to the file menu on the security program then it'll show you what folder it needs to be in) to sign the DLL files and plopped them on my PDA with Resco.
seems to be a massive breakthrough since ril.dll (and pretty much everything else) works perfectly and automatically though this method.
P.S: get the signtool.exe off Google; there's a Codeproject website that has it.
Click to expand...
Click to collapse
yeah.. thats the "security configuration manager".. it just wont work for me .. weird..
i have attached a file package, can you check if you can sign files with this? it even contains the proper certificate, copy it to your wince device and execute the cert.

---

dutty said:
yeah.. thats the "security configuration manager".. it just wont work for me .. weird..
i have attached a file package, can you check if you can sign files with this? it even contains the proper certificate, copy it to your wince device and execute the cert.
Click to expand...
Click to collapse
Yeah... it won't work till you get the Signtool.exe

---

Olipro said:
Yeah... it won't work till you get the Signtool.exe
Click to expand...
Click to collapse
care to attach ? i couldn't the file besides on msdn.. can you attach signtool.exe + your dev certificate?

---

dutty
Your tool is working for me. Successfully signed files with warning message "No timestamp".
You could attach other files you got from Trinity rom If this tool is not working for you.
I will sign all of them and attach them back.

---

bobstarina said:
dutty
Your tool is working for me. Successfully signed files with warning message "No timestamp".
You could attach other files you got from Trinity rom If this tool is not working for you.
I will sign all of them and attach them back.
Click to expand...
Click to collapse
yes i can sign them with it too, same warning but WCE does not accept the files as signed

---

Checked it right now. The same problem with me.
I found a problem in your signing tool.
For an option "-spc" in the BAT file you should use SPC certificate (not CER).
There is a tool in MS SDK for converting CER to SPC:
"cert2spc cert1.cer [cert2.cer … certN.cer] outputSPCfile.spc"
Do you have this tool? Can you post it here?

---

bobstarina said:
Checked it right now. The same problem with me.
I found a problem in your signing tool.
For an option "-spc" in the BAT file you should use SPC certificate (not CER).
There is a tool in MS SDK for converting CER to SPC:
"cert2spc cert1.cer [cert2.cer … certN.cer] outputSPCfile.spc"
Do you have this tool? Can you post it here?
Click to expand...
Click to collapse
http://www.codeproject.com/useritems/signcode.asp
when you try and sign a file with the Security tool, it shows the path it's looking in to find Signtool.exe; put it in there

---

bobstarina said:
There is a tool in MS SDK for converting CER to SPC:
"cert2spc cert1.cer [cert2.cer … certN.cer] outputSPCfile.spc"
Do you have this tool? Can you post it here?
Click to expand...
Click to collapse
cert2spc.exe is included in Microsoft .NET Framework SDK 1.1
C:/Program Files/Microsoft.NET/SDK/v1.1/Bin/cert2spc.exe