- baseband-devel - lists.osmocom.org

Re: Useful article on patching Nokia DCT4+ firmware
by msokolov＠ivan.Harhan.ORG 08 May '14

08 May '14

"E:V:A" <xdae3v3a(a)gmail.com> wrote: > That was indeed a very nice and entertaining find. Also the many links > within that document should let you find both useful code and > contacts. Furthermore, what is interesting is that it also provides > a historical perspective of the xgold modems, which should be useful in > paving the way to deeper studies in the more modern versions. Entertaining as it is, keep in mind that the fellow who did that hack and wrote the article about it got *paid* to make those Kosher phones for the religious customers in question. In the absence of such a paid arrangement, I don't really understand why someone would willingly waste her time trying to hack a "modern" phone, dealing with chips sans docs, tivoized bootloaders and firmware that only exists as binaries without source or even semi-src. The big question is: WHY would anyone willingly choose to suffer through that mess, when instead one can choose to use a phone based on the good old Calypso chipset, with full docs, full schematics for some models, and a published semi-src for TI's reference firmware version? Yes, Calypso is old. Ancient, to be more precise. But so what? It still works! If it ain't broke, don't fix it. Dismissing a perfectly working and usable solution merely because of its mature age is irrational. Yes, Calypso-based phones are no longer made, and every existing model that is still obtainable on ebay etc is crippled in one way or another. But so what? We can solve this problem by building our own Calypso- based "dumbphone", and making it exactly the way we like. Yes, Calypso chips themselves aren't made any more either. But what is the total number of people in the world who would want a "dumbphone" running their own free firmware? Is it greater or less than 100? If the number of people desiring such a phone is <= 100, I already have enough Calypso+etc chipsets for all 100 of us sitting in my desk drawer. If the number of interested persons is > 100, there should be more chips still available in the vast nation of China. Yes, the available surplus of Calypso/Iota/Rita chips won't last forever. But if there really are so many of us to exhaust that supply, then surely we could pay some Chinese chip fab to reverse-eng that old silicon and fab new verbatim clones in whatever quantity we need. I just posted an update to the other mailing list, showing where the free & usable Calypso dumbphone project currently stands and how it is progressing: http://lists.openmoko.org/pipermail/community/2014-May/069469.html VLR, SF

1 0

Error loading firmware onto Motorola C115.
by Ravi Sharan 08 May '14

08 May '14

Hi, I am trying out osmocom-bb with the Motorla C115. I have compiled libosmocore as a shared library and osmocom successfully. Also, I have compiled a "arm-none'eabi" cross toolchain from scratch. I get the following error: $ osmocon -p /dev/ttyUSB0 -m c123 ~/osmocom-bb/src/target/firmware/board/compal_e88/hello_world.compalram.bin got 1 bytes from modem, data looks like: 00 . got 2 bytes from modem, data looks like: 00 00 .. got 4 bytes from modem, data looks like: 1b f6 02 00 .... got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 01 . got 1 bytes from modem, data looks like: 40 @ Received PROMPT1 from phone, responding with CMD read_file(/home/ravi/osmocom-bb/src/target/firmware/board/compal_e88/hello_world.compalram.bin): file_size=25184, hdr_len=4, dnload_len=25191 got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 43 C Received PROMPT2 from phone, starting download handle_write(): 4096 bytes (4096/25191) handle_write(): 4096 bytes (8192/25191) handle_write(): 4096 bytes (12288/25191) handle_write(): 4096 bytes (16384/25191) handle_write(): 4096 bytes (20480/25191) handle_write(): 4096 bytes (24576/25191) handle_write(): 615 bytes (25191/25191) handle_write(): finished got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 45 E got 1 bytes from modem, data looks like: 53 S got 1 bytes from modem, data looks like: 16 . Received DOWNLOAD NACK from phone, something went wrong :( got 1 bytes from modem, data looks like: 66 f got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6d m got 1 bytes from modem, data looks like: 74 t got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 6c l Received FTMTOOL from phone, ramloader has aborted got 1 bytes from modem, data looks like: 65 e got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 6f o got 1 bytes from modem, data looks like: 72 r got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 00 Can the error be because of the toolchain ? Or can it be that my device is refusing connection with osmocon ? Thanks in advance. Ravi Sharan

2 2

Useful article on patching Nokia DCT4+ firmware
by Andrew Tipton 06 May '14

06 May '14

Hi folks, Came across this article in the latest PoC||GTFO journal describing (part of) the process for patching firmware on Nokia DCT4+ phones. The good stuff is pages 22-29 of this file: http://openwall.info/wiki/_media/people/solar/pocorgtfo03.pdf Alas, this does not appear to permit patching the first 1MB of firmware, so may not be helpful for OsmocomBB. But perhaps someone with more time on their hands can take this and run with it... Cheers, -Andrew

2 1

baseband-devel unsubscribe notification
by mailman-bounces＠lists.osmocom.org 05 May '14

05 May '14

rodrigo(a)chupelupe.com.ar has been removed from baseband-devel.

1 0

baseband-devel unsubscribe notification
by mailman-bounces＠lists.osmocom.org 28 Apr '14

28 Apr '14

lea_lss_bollnas(a)telia.com has been removed from baseband-devel.

1 0

Frame Structure and Multiframe questions
by R M 26 Apr '14

26 Apr '14

Hi, I am trying to understand the Multiframe structure in GSM. Here is my question: Lets say that in a particular cell, only two GSM frequencies are available to cater to all the traffic. FB is the frequency of the beacon channel and FT is the frequency of the traffic channel. FBT0 is having the following configuration FCCH + SCH + BCCH + CCCH. Now a phone which is in this cell, gets paged for an incoming SMS. The phone responds to the paging request and gets an immediate assignment. The immediate assignment assigns it a channel with the following configuration: FTT2 and channel multiplexing is SDCCH/8 + SACCH/8. Now how does the phone know the multiframe structure of FTT2 ? In other words how does the phone know how long it has to wait, so that it can transmit in the right time-slot ? The same question applies to the BTS if we are talking about down-link ? Is there a relation between the multiframe structure of FBT0 and FTT2 ? Thanks and Regards, R M

2 1

Re: strange crashes in current main branch
by Christophe Devine 24 Apr '14

24 Apr '14

Quick heads up: I finally ended up using a LM 317T to lower the output voltage to ~4V, using R1=220, R2=550 and a 1uF capacitor, plus a OTB battery pcb. The phone doesn't get as hot as before, and the "battery" powers without delay. https://drive.google.com/file/d/0ByHQWL5Q6bSwTWo3ZnBHTS1KeXc/edit?usp=shari… https://drive.google.com/file/d/0ByHQWL5Q6bSwM1FPeS1iVlBYX3M/edit?usp=shari…

1 0

Re: strange crashes in current main branch
by Christophe Devine 23 Apr '14

23 Apr '14

Tim, Following your advice, I disassembled a battery, and directly connected the output of a 3.6v motorola charger to gnd and positive side of the charging pcb (of course the lithium cell is completely disconnected). See pictures below, gnd is the middle pad whereas the positive pad is on the left. When doing so be careful not to heat or pierce the lithium battery, and afterwards put some tape to ensure electrical isolation: https://drive.google.com/file/d/0ByHQWL5Q6bSwOHVPNlV5T2ZyZndLZmwtMF9JQ2V0eH… https://drive.google.com/file/d/0ByHQWL5Q6bSwTGNfeUFOVFM5cldPNFZ3djMyMmlSNV… https://drive.google.com/file/d/0ByHQWL5Q6bSwUm9XUnBOcU5SRFg4T3VpNEFZOUFHaU… The result appears to work although strangely sometimes after unplugging the charger for some time and replugging it the microcontroller on the pcb will not wake up. However it does immediately wake up if I measure the current between the + and - output with a basic multimeter, but with the black probe on the + and the red probe on the - (other way does not work). There's probably something I'm missing here, but it's not that big a deal. Maybe this is caused by a quirk in the microcontroller, as I've tried the same procedure on a new compatible battery (branded "OTB", see http://pmcdn.priceminister.com/photo/926610349.jpg) and it doesn't have this problem, the microcontroller wakes up immediately and powers the phone. The voltage might be a bit too high, but the phone seems to work fine (firmware reports a full battery - also it gets slightly hotter). On Wed, Apr 23, 2014 at 3:05 PM, Christophe Devine < devinechristophe(a)gmail.com> wrote: > Tim, > > Following your advice, I disassembled a battery, and directly connected > the output of a 3.6v motorola charger to gnd and positive side of the > charging pcb (of course the lithium cell is completely disconnected). See > pictures below, gnd is the middle pad whereas the positive pad is on the > left. When doing so be careful not to heat or pierce the lithium battery, > and afterwards put some tape to ensure electrical isolation. > > The result appears to work although strangely sometimes after unplugging > the charger for some time and replugging it the microcontroller on the pcb > will not wake up. However it does immediately wake up if I measure the > current between the + and - output with a basic multimeter, but with the > black probe on the + and the red probe on the - (other way does not work). > There's probably something I'm missing here, but it's not that big a deal. > > Maybe this is caused by a quirk in the microcontroller, as I've tried the > same procedure on a new compatible battery (branded "OTB", see > http://pmcdn.priceminister.com/photo/926610349.jpg) and it doesn't have > this problem, the microcontroller wakes up immediately and powers the > phone. The voltage might be a bit too high, but the phone seems to work > fine (firmware reports a full battery). > > Christophe > > > On Thu, Apr 10, 2014 at 8:44 PM, Tim Ehlers <osmocom(a)ehlers.info> wrote: > >> On Thu, 10 Apr 2014, Max.Suraev(a)fairwaves.co wrote: >> >> I modified the mobile battery, removing the battery itself, and >>>> replacing it with a >>>> 3.7V AC-Adapter, so that I don't need the charging. >>>> >>> >>> Interesting - can you describe those modifications in more details? >>> Which adapter have you used? How did you connect it exactly? Some pics? >>> >> >> ohh, this is no "advanced" modification. I just read on the battery, that >> it outputs 3.7V, then I found for an ACDC-adapter, outputing 3.3V DC (this >> is enough, but the phone tells you that the battery is nearly empty if you >> boot the original firmware; but we use osmocom :). >> >> I openened the white plastic cover (or more correct, opened the sticker >> around the battery), removed the Li-ION battery from the little electronic >> parts and soldered the DC-adapter there instead. >> >> Cheers >> >> Tim >> >> >

1 0

Mobile app crashing while making call
by Akib Sayyed 17 Apr '14

17 Apr '14

Guys I am trying to make call using mobile app but when i try to call it crashes here is report http://pastebin.com/nsdxLvPg -- Akib Sayyed Matrix-Shell akibsayyed(a)gmail.com akibsayyed(a)matrixshell.com Mob:- +91-966-514-2243

3 3

arm-elf-gcc
by Ahmad Jan 15 Apr '14

15 Apr '14

While installing osmocom-bb, i came across the "building the source" section. It says in later part that: " If your GCC binary that produces ARM code is not called *arm-elf-gcc* you will need to invoke the following statement and provide the basename of the toolchain with the ending *-*" cd src make -e CROSS_TOOL_PREFIX=arm-OTHER_NAME- How can i find out that my GCC binary is called as *arm-elf-gcc *or something else?

2 3