Hello experts,
I always wonder if there's any way that we can get the informations (id, phone signal strength, bcch ...) from all the surround cells in Windows mobile 6 (with C#/C++ on my HTC touch HD). With RIL, we can only extract the info of current cell, but not the neighbors.
I'm inspired by this thread which was created in the forum by binary64:
forum.xda-developers.com/showthread.php?t=610759
However without the code i still haven't figured how did he extract the values of the 6 towers...
Base on the research i've done, it seems impossible to get the real neighbors cell ID, however i'm really interested in the phone signal strength, bcch... that are possible to get. (as fieldtest.exe or what binary64 demonstrated)
Any idea would be precious to me, thank you very much
I think that the memory/registry approche seems to be the only solution
Does anyone know which part of the memory/registry in HTC contains the GSM informations ?
up thread
Sorry to spam, i just want to up my thread because i really want to have some answer
Progress
With RIL DevSpecific i've get to extract the values of Fieldtest, however i don't know the necessary parameters to get the source that fieldtest take as result.
Precisely, if i run fieldtest once, and use the devSpecific, i'll get the last result of fieldtest and always the same. If i run fieldtest again then use DevSpecific i'll get a new result (always latest result from Fieldtest).
Does anyone know where to find a document related to devSpecific ?
Thank you very much.
Well you could execute "fieldtest.exe" in the /windows/ folder; it's like the old Nokia's "Netmonitor" wich was for "engineering purposes"
MuratNL said:
Well you could execute "fieldtest.exe" in the /windows/ folder; it's like the old Nokia's "Netmonitor" wich was for "engineering purposes"
Click to expand...
Click to collapse
Thank you, my fieldtest.exe was always running ok, but in fact i'm trying to disassembly it with C++/C#. Do you (or anyone) know any source that we can buy the documents related to this subject ?
No, I'm sorry but i'm not a good coder so i have to dissapoint you...
Maybe someone here at XDA-DEV can help you?
AT Command
Does anyone know a specific AT Command that can be used to extract the network info ?
Thanks
A spam question : Is there any condition for a member to get the answers of the experts ? i don't think that no one has an idea ...
Hi Vietsuper,
This seems to be a more up to date thread, so I post this here as well.
I'm working on a HTC HD2, and I am trying to get pretty much the same info. neighbour BCCH carriers and their received signal strengths. Indeed, not only RIL does not offer info on the neighbour cells, but I keep getting ZEROs in all fields returned by RIL except the cellID, MCC, MNC and LAC.
I see that you found a way with RIL_DevSpecific. If you give me advice, directions or code pieces, I'd be interested to try it on my HD2.
Thanks
hi pc18,
Actually RIL_devSpecific allows you to extract the info of neighbor cells (ARFCN + RSSI) as the program fieldtest. However it just works along with fieldtest, without fieldtest you always get the same value not up to date. I think in fieldtest they add some more parameters that allow to refresh.
You can find some reference in the thread of binary64 of which the link i posted above.
( forum.xda-developers.com/showthread.php?t=610759 )
I'm searching for the document more specific about RIL_devSpecific, however i couldn't find. If you find it somewhere, i'll be very grateful if you can share.
Thanks.
vietsuper said:
hi pc18,
Actually RIL_devSpecific allows you to extract the info of neighbor cells (ARFCN + RSSI) as the program fieldtest. However it just works along with fieldtest, without fieldtest you always get the same value not up to date. I think in fieldtest they add some more parameters that allow to refresh.
You can find some reference in the thread of binary64 of which the link i posted above.
( forum.xda-developers.com/showthread.php?t=610759 )
I'm searching for the document more specific about RIL_devSpecific, however i couldn't find. If you find it somewhere, i'll be very grateful if you can share.
Thanks.
Click to expand...
Click to collapse
Hi vietsuper,
I've looked into the thread and got inspired by it. I think it is interesting. I also think it is very interesting that one can only get carrier information (attachment base and neighbours) via FieldTest. Unfortunately, using the code that I will paste below, I could only get a return value of -2147467263 which as far as I could see means E_NOTIMPL. Now, I could be wrong when building up the params to pass to RIL_DevSpecific(). Here it is:
Code:
hRes = RIL_Initialize(1, new RILRESULTCALLBACK(rilResultCallback), null, 0, 0, out hRil);
byte[] dev_command_buffer = new byte[] {84, 0, 0, 0, 0, 0, 0, 0, 0x9c, 0x9b};
int size = Marshal.SizeOf(dev_command_buffer[0]) * dev_command_buffer.Length;
IntPtr buffer_pointer = Marshal.AllocHGlobal(size);
try
{
Marshal.Copy(dev_command_buffer, 0, buffer_pointer, dev_command_buffer.Length);
hRes = RIL_DevSpecific(hRil, buffer_pointer, 10);
}
Where do you think is the problem?
Thanks
pc18 said:
Hi vietsuper,
I've looked into the thread and got inspired by it. I think it is interesting. I also think it is very interesting that one can only get carrier information (attachment base and neighbours) via FieldTest. Unfortunately, using the code that I will paste below, I could only get a return value of -2147467263 which as far as I could see means E_NOTIMPL. Now, I could be wrong when building up the params to pass to RIL_DevSpecific(). Here it is:
Code:
hRes = RIL_Initialize(1, new RILRESULTCALLBACK(rilResultCallback), null, 0, 0, out hRil);
byte[] dev_command_buffer = new byte[] {84, 0, 0, 0, 0, 0, 0, 0, 0x9c, 0x9b};
int size = Marshal.SizeOf(dev_command_buffer[0]) * dev_command_buffer.Length;
IntPtr buffer_pointer = Marshal.AllocHGlobal(size);
try
{
Marshal.Copy(dev_command_buffer, 0, buffer_pointer, dev_command_buffer.Length);
hRes = RIL_DevSpecific(hRil, buffer_pointer, 10);
}
Where do you think is the problem?
Thanks
Click to expand...
Click to collapse
I remember u said u use HTC HD2, so i think the RIL standard functions are implemented, so if u have imported the functions i should work.
I once did in C# and the code just simple as below and it worked well:
Code:
[DllImport("ril.dll")]
private static extern IntPtr RIL_Initialize(...
[DllImport("ril.dll")]
private static extern IntPtr RIL_DevSpecific(IntPtr hRil, byte[] lpbParams, uint dwSize);
//in my function
byte[] param = new byte[] { 0x84, 0, 0, 0, 0, 0, 0, 0, 0x9C, 0x9B };
hRes = RIL_DevSpecific(hRil, param, 10);
you even just need {0x84,0,0,0} for the same result, because commandId=0x84 is enough.
If u still get E_NOTIMPL may be u need to create/copy ur own ril.dll somewhere, but i think it's unlikely because i think HTC HD (my phone) and HTC HD2 have the similar implementation for RIL.
Memory dump
I'm desperate to find the info directly in the memory. There's something a little bit interesting that i found out.
There's a sequence of responses to AT Command writing in ASCII:
@HTCCSQ:3
@HTCCSQ:4
@HTCCSQ:2
+CREG: 1,"000C","9F60" (here we has current LAC + Cell ID)
+CREG: 1,"000C","9BC7" (another LAC + Cell ID, i think it's the previous one)
+COPS: 0,2,"20820",3 (inside the "" are MCC MNC)
@HTCCSQ:3 .... (there's plenty of @HTCCSQ: coming next )
Look like some kind of log of the querries of RIL driver to the modem (i'm not sure), just sure that it wasn't my programs who send the command.
may be we can get to the other network info too. Any ideas ?
Thanks.
Thanks vietsuper for your help. I finally arrived at some result. Indeed, a hexdump of the data that's being received from ril_devspecific gives the last information that's displayed by fieldtest. With fieldtest running in the backgound one can get fresh information (ie with a new request every, say, 2 secs).
I see two problems at the moment:
1) does anyone know at this point how to turn the memory zone pointed to by the IntPtr into a struct? or will i have to parse the hexdump for the neighbour cell information (BCCH number and received signal strength)?
2) fieldtest will only return neighbour information when the telephone displays Edge available (GSM menu item); whenever the phone displays the 3G status icon, neighbor cell information is no longer available (ie NCell1 0 -99dbm); does anyone have any idea?
pc18 said:
Thanks vietsuper for your help. I finally arrived at some result. Indeed, a hexdump of the data that's being received from ril_devspecific gives the last information that's displayed by fieldtest. With fieldtest running in the backgound one can get fresh information (ie with a new request every, say, 2 secs).
I see two problems at the moment:
1) does anyone know at this point how to turn the memory zone pointed to by the IntPtr into a struct? or will i have to parse the hexdump for the neighbour cell information (BCCH number and received signal strength)?
2) fieldtest will only return neighbour information when the telephone displays Edge available (GSM menu item); whenever the phone displays the 3G status icon, neighbor cell information is no longer available (ie NCell1 0 -99dbm); does anyone have any idea?
Click to expand...
Click to collapse
1> In C#, you can use Marshal.PtrToStructure to copy the IntPtr to a structure/class u created. To dump memory you Marshal.Copy to a byte array and BitConverter.toString(array). I think if you want to read the full neighbor cell info, as what i wrote above you must do research in some memory zones or make a direct stream connection to the gsm modem and querry with AT Command.
2> Fieldtest can show different kind of info depending on the option you choose in the "group" menu. The neighbor cell info are only available for gsm option, so if your phone has the 3G status, means that it connect to a 3G tower, the gsm info in Fieldtest is no longer available, you must choose other options for 3G.
If you have any progress in any way that i mentioned (AT Command / Memory dump), please share to me too, thanks.
vietsuper said:
1> In C#, you can use Marshal.PtrToStructure to copy the IntPtr to a structure/class u created. To dump memory you Marshal.Copy to a byte array and BitConverter.toString(array). I think if you want to read the full neighbor cell info, as what i wrote above you must do research in some memory zones or make a direct stream connection to the gsm modem and querry with AT Command.
2> Fieldtest can show different kind of info depending on the option you choose in the "group" menu. The neighbor cell info are only available for gsm option, so if your phone has the 3G status, means that it connect to a 3G tower, the gsm info in Fieldtest is no longer available, you must choose other options for 3G.
If you have any progress in any way that i mentioned (AT Command / Memory dump), please share to me too, thanks.
Click to expand...
Click to collapse
Thanks. This is valuable info. I am looking into the directions you pointed out to.
Memory dump
I've found something else by dumping the memory, this time it isn't some AT Command log but a fixed structure :
00 00 ... 00 [4 bytes LAC][4 bytes Cell ID][3 chars MCC][2 chars MNC] 01(unknown byte) 00 ... 00 00
I think there'll be other memory blocs that contain neighbor cell info, however i haven't found.
Hope someone can share ...
Fieldtest rssi
Does any one know why the RSSI shown in Fieldtest have a distance of 15-20 dB compare to the value of GetSignalQuality ?
In my opinion:
- GetSignalQuality shows the initial signal strength captured by the phone (Rx), because the value is calculated from the response AT+CSQ of the Radio modem.
- In Fieldtest / RIL_DevSpecific we have a weaker strength (-10 -20 db), may be it counts some other loss factors of device.
Any ideas ?
Thanks
Help using RIL_DevSpecific
Hi, guys would you share code to get that information. I work for a telecommunication company and I am also working on my MS degree project related to cellular networks. I will use the information to compare with cell database I have access to.
Thanks
I'm having a issue with the Asus Music app which is when I'm in other apps it likes to stop randomly where I have to press play again until twenty seconds later to a another stop. I have a ZenFone 2e flashed with stock ZenFone 2 118 firmware.
Any help is welcome.
Sent from my Z00D using XDA Free mobile app
Any help is welcomed and if anyone wants to, I used Advanced Logcat Viewer to make a logcat log.
Also, I took a look and these few lines are from start of Chipzel's Courtesy and then into ManDoPony's -Just Gold- song, stopped with a buzz connected to my laptop in mic port on listen to this device, how I'm trying to debug this.
Code:
V/AsusMusicService.Player(12194): [AsusPlayer] Play: chipzel---courtesy-(a.-aaa)
E/NetlinkEvent(252): NetlinkEvent::FindParam(): Parameter 'TIME_NS' not found
E/MediaPlayer(856): Should have subtitle controller already set
E/NetdConnector(699): RCV <- {613 IfaceClass idle (null)}
D/Ringtone(856): Successfully created local player
E/NetdConnector(699): Error handling '613 IfaceClass idle (null)': java.lang.NumberFormatException: Invalid int: "(null)"
D/NuPlayerDriver(248): reset(0xb080c220)
V/AlarmManager(699): triggered: act=com.android.internal.telephony.data-stall Pkg: com.android.phone
D/NuPlayerDriver(248): notifyResetComplete(0xb080c220)
D/PowerManagerNotifier(699): onWakeLockAcquired: flags=1, tag="*alarm*", packageName=android, ownerUid=1000, ownerPid=699, workSource=WorkSource{1001}
D/NuPlayerDriver(248): reset(0xb080c220)
D/PowerManagerNotifier(699): onWakeLockReleased: flags=1, tag="*alarm*", packageName=android, ownerUid=1000, ownerPid=699, workSource=WorkSource{1001}
V/AudioFlinger(248): acquiring 290 from 856, for -1
D/PowerManagerService(699): updateIsPoweredLocked: wasPowered=true, mIsPowered=true, oldPlugType=2, mPlugType=2, mBatteryLevel=73
V/AudioFlinger(248): added new entry for 290
W/BatteryStatsImpl(699): Couldn't get kernel wake lock stats
V/AudioFlinger(248): releasing 289 from 856 for -1
D/PowerUI (856): dismiss Low BatteryWarning level: 73
V/AudioFlinger(248): decremented refcount to 0
D/PowerUI (856): show_hot_plug_dialog: true
V/AudioFlinger(248): purging stale effects