[Q] USSD and Gingerbread (2.3.x) - Streak 5 Q&A, Help & Troubleshooting

Problem solved: Look into http://forum.xda-developers.com/showthread.php?t=1558089
Hello,
this ussd problem with gingerbread-roms drives me nuts. Codes like *100# won't work. I have to stay on froyo to check my prepaid balance and recharge.
Thanks to nop who narrowed the problem down to libril-qc-1.so, I (s)traced rild and found the following difference:
2.2.2 rild:
[pid 138] writev(11, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril.c 2079] UI --- RIL_REQUEST_SEND_USSD (29) ---> RIL [token id 256, data len 4]\n\0"..., 86}], 3) = 93
[pid 138] writev(11, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_cm.c 14003] USSD string in UTF8 format = *100# length = 5\n\0"..., 66}], 3) = 73
[pid 138] writev(11, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_cm.c 14008] USSD string is in ASCII format, converting to 7BIT format\0"..., 78}], 3) = 85
[pid 138] writev(11, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_cm.c 14023] USSD string after conversion = *100# length = 5\n\0"..., 68}], 3) = 75
[pid 138] writev(11, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_reqlist.c 216] Not found ReqList entry waiting for CM_SUPS_EVENT_USS_IND (86035)\n\0"..., 89}], 3) = 96
[pid 138] writev(11, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_reqlist.c 169] Not found ReqList entry : token id 256\n\0"..., 62}], 3) = 69
[pid 138] writev(11, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_reqlist.c 400] Event RIL_REQUEST_SEND_USSD (29) pending receipt of CM_SUPS_EVENT_PROCESS_USS_CONF, token id 256 [0x2ae68]\n\0"..., 130}], 3) = 137
[pid 138] writev(11, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_reqlist.c 1065] ReqList entries : \n\0"..., 43}], 3) = 50
[pid 138] writev(11, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_reqlist.c 1071] RIL_REQUEST_SEND_USSD (29), token id 256\n\0"..., 69}], 3) = 76
[pid 138] write(17, "\n\0\1\200\0\0\0\0\375\1\0\0\0\0\0000C\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 40
[pid 138] write(24, "\0\0\1\375\0\0\0\0\0\0\0\0020\0\0\0\263\277\333\31\0\0\0C\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\27\0\2\256h\0\0\0\27\0\0\0\1\0\0\0\6\0\0\0\1\0\0\0\17\0\0\0\5\0\0\0\5*100#\0\0\0"..., 84) = 84
2.3.3 rild:
[pid 3372] writev(10, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril.c 2577] UI --- RIL_REQUEST_SEND_USSD (29) ---> RIL [RID 0, token id 59, data len 4]\n\0"..., 92}], 3) = 99
[pid 3372] writev(10, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_arb.c 1437] RID 0 voice srv: modem id=0, ma=Multimode(0), net_pref=GSM WCDMA preferred(0)\n\0"..., 98}], 3) = 105
[pid 3372] writev(10, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_cm.c 22350] USSD string in UTF8 format = *100# length = 5\n\0"..., 66}], 3) = 73
[pid 3372] writev(10, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_cm.c 22358] USSD string is in ASCII format, converting to 7BIT format\0"..., 78}], 3) = 85
[pid 3372] writev(10, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_cm.c 22375] USSD string after conversion = *100# length = 5\n\0"..., 68}], 3) = 75
[pid 3372] writev(10, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_reqlist.c 331] [RID 0] Not found ReqList entry waiting for CM_SUPS_EVENT_USS_IND (86035)\n\0"..., 97}], 3) = 104
[pid 3372] write(18, "\n\0\1\200\0\0\0\0\354\0\0\0\0\0\0000\201\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 40
[pid 3372] write(23, "\0\0\0\354\0\0\0\0\0\0\0\0020\0\0\0\263\277\333\31\0\0\0\201\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\4*100\0\0\0\4\0\0\0\1"..., 60) = 60
[pid 3372] futex(0x80317f74, FUTEX_WAIT_PRIVATE, -40, NULL <unfinished ...>
[pid 3377] <... select resumed> ) = 1 (in [23])
[pid 3377] rt_sigprocmask(SIG_SETMASK, [TRAP BUS FPE KILL SEGV USR2 PIPE ALRM TERM CHLD TTIN TTOU RTMIN], NULL, 4) = -1 EINVAL (Invalid argument)
[pid 3377] read(23, "\0\0\0\354\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\4*100\0\0\0\4\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 17408) = 84
Basically the rild on gingerbread 2.3.x isn't sending the last character '#' to end the ussd correctly. Ironically in "logcat -b radio" rild states that the ussd it will send is 5 chars long, but it sends only 4 chars over to the character device /dev/oncrpc/30000000:b3bfdb19
I think, this is done in libril-qc-1.so in function qcril_cm_supsvc_request_send_ussd but I was missing at school when they tought us arm-assembler, so I'm stuck reading objdump -d libril-qc-1.so.
So my first questions: Is this really a off by one bug? How can I circumvent it without the sourcecode of libril-qc-1? Is there a Qisda SDK out there for the austin baseband or libril?
On the other hand I read at http://code.google.com/p/synergy-evo3d/wiki/Radio and http://fabiensanglard.net/cellphoneModem/index2.php how to talk to the baseband without rild. And on a 2.3.x I got a positive result with
# cat /dev/smd0 &
# echo -e 'AT+CUSD=1,"*100#",15\r' >/dev/smd0
OK
+CUSD: 0," Aktuelles Guthaben: 20.10 EUR.",15
So ussd with /dev/smd0 works, but it seems libril-qc-1 doesn't use it at all. At least I can't find any AT-commands in it.
Second question: Is /dev/smd0 some obsolete way of communicating with the baseband-radio?
I appreciate any help, cause I'm somewhat stuck and can't find the loophole.
Reg. hunderteins

---

hunderteins, +1
--
More, in radio log you will see "Rejected on protocol layer" message.
--
Heck, it actually works!
I'd give a 1000 thanks if i could!

---

I think now of following:
Why does USSD codes work on some provides?
What if we supply an extra char on USSD request on framework level?

---

_n0p_ said:
I think now of following:
Why does USSD codes work on some provides?
Click to expand...
Click to collapse
*135# is working here, too. I think *135 unambiguous. There is no code like *135#1# or something like that. Whereas *100#1# is a legal code, and the network-provider can just not know whether *100 is complete, for *135 it knows it is complete.
What if we supply an extra char on USSD request on framework level?
Click to expand...
Click to collapse
When you can do that, try it please. I'm looking for a wrapper for libril-qc-1.so to add an extra
#-char. At the end we can use the way that will circumvent the bug.

---

Too bad arm devices started to appear after i finished my reversing carrier. Just if it would be x86
--
It seems this part should be modded:
.method sendUssd(Ljava/lang/StringV
.registers 4
.parameter "ussdMessage"
.prologue
.line 897
const/4 v0, 0x1
iput-boolean v0, p0, Lcom/android/internal/telephony/gsm/GsmMmiCode;->isPendingUSSD:Z
.line 904
iget-object v0, p0, Lcom/android/internal/telephony/gsm/GsmMmiCode;->phone:Lcom/android/internal/telephony/gsm/GSMPhone;
iget-object v0, v0, Lcom/android/internal/telephony/PhoneBase;->mCM:Lcom/android/internal/telephony/CommandsInterface;
const/4 v1, 0x4
invoke-virtual {p0, v1, p0}, Lcom/android/internal/telephony/gsm/GsmMmiCode;->obtainMessage(ILjava/lang/ObjectLandroid/os/Message;
move-result-object v1
invoke-interface {v0, p1, v1}, Lcom/android/internal/telephony/CommandsInterface;->sendUSSD(Ljava/lang/String;Landroid/os/MessageV
.line 906
return-void
.end method

---

I got my wrapper libril ready. But I didn't work. I put in *100## and got again out *100
[pid 2818] clock_gettime(CLOCK_MONOTONIC, {2001, 359584848}) = 0
[pid 2818] read(37, "\0\0\0\30\35\0\0\0$\0\0\0\5\0\0\0*\0001\0000\0000\0#\0\0\0"..., 8196) = 28
[pid 2818] writev(9, [{"\5"..., 1}, {"RILW\0"..., 5}, {"onRequest: RIL_REQUEST_SEND_USSD: \"*100#\", LEN: 4\0"..., 50}], 3) = 56
[pid 2818] writev(9, [{"\5"..., 1}, {"RILW\0"..., 5}, {"onRequest: RIL_REQUEST_SEND_USSD: out \"*100##\", LEN: 5\0"..., 55}], 3) = 61
[pid 2818] writev(9, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril.c 2577] UI --- RIL_REQUEST_SEND_USSD (29) ---> RIL [RID 0, token id 36, data len 5]\n\0"..., 92}], 3) = 99
[pid 2818] writev(9, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_arb.c 1437] RID 0 voice srv: modem id=0, ma=Multimode(0), net_pref=GSM WCDMA preferred(0)\n\0"..., 98}], 3) = 105
[pid 2818] writev(9, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_cm.c 22350] USSD string in UTF8 format = *100## length = 6\n\0"..., 67}], 3) = 74
[pid 2818] writev(9, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_cm.c 22358] USSD string is in ASCII format, converting to 7BIT format\0"..., 78}], 3) = 85
[pid 2818] writev(9, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_cm.c 22375] USSD string after conversion = *100## length = 6\n\0"..., 69}], 3) = 76
[pid 2818] writev(9, [{"\3"..., 1}, {"QCRIL\0"..., 6}, {"[qcril_reqlist.c 331] [RID 0] Not found ReqList entry waiting for CM_SUPS_EVENT_USS_IND (86035)\n\0"..., 97}], 3) = 104
[pid 2818] write(18, "\n\0\1\200\0\0\0\0\252\0\0\0\0\0\0000\201\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 40) = 40
[pid 2818] write(23, "\0\0\0\252\0\0\0\0\0\0\0\0020\0\0\0\263\277\333\31\0\0\0\201\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\1\0\0\0\4*100\0\0\0\4\0\0\0\1"..., 60) = 60
I hate it, when that happens.

---

hunderteins, that's fast!
So it seems not the bug, but intended symbol strip proc.

---

_n0p_ said:
hunderteins, that's fast!
Click to expand...
Click to collapse
it has been done before. I even tried to implement RIL_REQUEST_SEND_USSD by talking to /dev/smd0. There I must have missed some message-send/receive mechanism. I attached the wrapper for interessted uses.
So it seems not the bug, but intended symbol strip proc.
Click to expand...
Click to collapse
that brings me to my initial questions.

---

I've decided to take a shortcut right now:
http://forum.xda-developers.com/showpost.php?p=23607014&postcount=3234

---

_n0p_ said:
I've decided to take a shortcut right now:
http://forum.xda-developers.com/showpost.php?p=23607014&postcount=3234
Click to expand...
Click to collapse
efficient one. But you need root to do that and no other ussd-app from the market will run. At least it solves the problem for the end-user.
The guess with that off-by-one-bug was wrong. I tried *101*123456789# ( a code that is used to recharge) and guess what the libril-qc-1.so sends? Only the first 4 bytes. The length of the message is hardcoded to 4 bytes! So my new guess is, that someone used sizeof(data) instead of strlen(data).

---

root is actually not needed, just a correct permissions.
Say, this kind of bug shouldn't pass unnoticed or there's no QA at all in Quisda.
--
I also cannot seem to update dialog text in consequent updates, i'm not a Java coder anyway.
--
I'm lookin through code via IDA, dunno if i'll succeed.
--
Actually, setting 666 to /dev/smd0 opens a security hole, so i decided DSC USSD to requre root and set permissions itself and after request restore to 644.

---

Thanks to both of you.... Done a great Job!!!!!

---

/dev/smd7, qmi and radiooptions
_n0p_ said:
I've decided to take a shortcut right now:
http://forum.xda-developers.com/showpost.php?p=23607014&postcount=3234
Click to expand...
Click to collapse
I got a little step further: http://blogs.gnome.org/dcbw/2010/04/15/mobile-broadband-and-qualcomm-proprietary-protocols/ tells me, that there are multiple ways to talk to the radio.
The AT-commands port /dev/smd0 you use for the ussd workaround. And a proprietary protocol named qmi that works via shared memory. I guess our proprietary libril-qc-1.so uses this protocol and the kernel-process qmi is the other end of the communication.
The article talks about a second AT-Command port most cdma modems have, and indeed the streak 5 has that one in /dev/smd7.
sh-4.1# cat /dev/smd7 &
4729
sh-4.1# echo -e 'ATI\r' > /dev/smd7
sh-4.1# ATI
Manufacturer: Qisda Corporation
Model: Streak
Revision: GAUSB1A1406214 1 [Aug 18 2010 04:00:00]
IMEI: xxxxxxxxxxxxxxx
+GCAP: +CGSM,+DS,+ES
OK
So if /dev/smd0 is locked, use /dev/smd7 I'm now working, how this shared memory communication will look like.
There is a program in the gingerbread sources called radiooptions. That talks to the debug-api of the rild in /dev/socket/rild-debug. Users in the system group can trigger some radio related events with it:
Usage: radiooptions [option] [extra_socket_args]
0 - RADIO_RESET,
1 - RADIO_OFF,
2 - UNSOL_NETWORK_STATE_CHANGE,
3 - QXDM_ENABLE,
4 - QXDM_DISABLE,
5 - RADIO_ON,
6 apn- SETUP_PDP apn,
7 - DEACTIVE_PDP,
8 number - DIAL_CALL number,
9 - ANSWER_CALL,
10 - END_CALL
It was included in older dell roms, but not any more. I wonder why.

---

thanks to hunderteins for USSD patch..

---

Gingerbread and USSD QuD fix
Hello!
My name is noob, and since I can't post reply in the DEV threads, I'm trying here, in order to get some help;
I recently installed the stock 407 ROM and bumped into this USSD issue; following the threads in this forum i got to the USSD QuD fix and tried to install it via the Custom Recovery boot mode... where I'm currently stuck as the update process halts on the following error messages:
"E:failed to verify whole-file signature
E:signature verification failed"
Can anyone give me a push!? thanx!

---

Help
I'm new member here. I already fix the USSD problem but I have new problem that is I can't receive any SMS from Bank that sending me TAC code. The Bank will send SMS using short number (I don't know what to call) example 66628 to my number. Before upgrade I can receive the SMS from Bank. Thanks for help.