PLEASE NOTE: These instructions are for Intel XMM based devices only!
Lats night I tried to get some GSM variables out of my I9100, by installing xgoldmon (2b-as)
following the README info there. Unfortunately that info is lacking in detail for my I9100, so I can't get anything out of it. What Am I missing here? Has anyone got this to work? Please explain.
1) The GT-I9100 is a rooted stock GB 2.3.4. Yes, that is ancient, but you'd be surprised how many such ancient
devices are around! I will try to keep my BB related development on ancient devices until people stop using them. When I say ancient
, I refer to the AOS API level. Many AP/BP FW updates remove and patch BB access. This is a way to avoid this. In other cases, access is simplified, i.e. in the later Qualcomm Snapdragon series. We'll always be able to make more fun additions to newer devices, once the basics is done.
2) I'm also running this on an ancient but fully updated Cygwin/Windows box.
I have successfully compiled libosmocore
, following the instructions there.
This is how you do it:
git clone git://git.osmocom.org/libosmocore.git
sudo make install
Take note of the pkgconfig installation path. You will need to set this
to the PKG_CONFIG_PATH
environment variable in the next step.
Unfortunately, the xgoldmon.git
by Tobias Engel
has not been updated/patched to fix a GSMTAP message copy/paste error.
Everything still works, but you get the wrong message in Wireshark
The bug details can be found HERE
has forked this project
and applied the patch,
so we will use his.
git clone git://github.com/harpreet-s/xgoldmon.git
You will now have an executable called: xgoldmon.exe
So far, so good.
Now tricky part, the instructions say:
Before running xgoldmon
To enable the logging mode ("diag mode") on the S2, S3 and Note2:
- Go to the Phone application, enter *#9900# and set "Debug Level
Enabled" to "HIGH". The phone will reboot.
- Go to the Phone application again, enter *#7284# and set "USB" to
"MODEM" and tap "SAVE and RESET". The phone will reboot again.
The Galaxy Nexus has to be rooted first to activate diag mode! Then:
- In the adb shell, as root, enter:
echo MODEM > /sys/devices/tuna_otg/usb_sel
- Connect to the first of the serial devices (e.g. /dev/ttyACM0) with
a terminal emulator and enter
When connecting the phone via USB to the computer, several new
pseudo-tty devices should be created. The one with the second lowest
number should be the logging port. So for example on Linux, if you
have no other ttyACM* devices, it should be /dev/ttyACM1.
xgoldmon tries to set proper serial attributes on the device if the
"-s" option is specified. If that fails, you might have to do that
yourself with something like
stty 115200 pass8 raw -noflsh -F /dev/ttyACM1
xgoldmon -t s3 -l /dev/ttyACM1
usage: ./xgoldmon [-t <phone type>] [-l] [-s] [-i <ip address>] [-v] <logfile or device>
-t: select 's4', 's3', 'gnex', 's2' or 'note2' (default: 's3')
-l: print baseband log messages
-s: set proper serial device attributes
-i: send gsmtap packets to given ip address (default: 'localhost')
-v: show debugging messages (more than once for more messages)
In some situations, the phone might close the device, causing xgoldmon
to exit. If you want to do some unsupervised logging, it might be a
good idea to put the call to xgoldmon in a loop.
Watching the radio messages in Wireshark
xgoldmon uses libosmocore to send the radio messages in GSMTAP format
(http://bb.osmocom.org/trac/wiki/GSMTAP) to UDP port 4729 on the local
host. In order to monitor the packages with Wireshark, something has
to listen on that port, e.g.
nc -u -l 4729
Then, in Wireshark, start a capture on the loopback interface. To see
only the GSMTAP messages, set this filter:
GSM messages will be decoded out-of-the box in Wireshark. For UMTS/RRC
messages, you need a recent development version of Wireshark (at least
revision 47792), which you most likely will have to build yourself.
If everything works, it should look a bit like the
It contains a screenshot of Wireshark that shows an S3 receiving a
text message while in a call. (Lots of messages filtered out to show
the more relevant messages)
This create problems for people not using Linux and on older API's.
1) On my I9100, there is no "Debug Level Enabled" to "HIGH" in the *#9900# menu, but many other options.
2) The phone does not
reboot after changing anything in there.
3) There is no "SAVE and RESET" button in the *#7284# menu, and therefore no reboot. But regardless, the phone recognize the changes when unplugged and plugged in again.
4) When reconnecting phone, I'm asked for 7 CDC drivers. I remember wrestling with this 2-3 years ago, unfortunately I don't remember if I found the drivers or hacked them and uninstalled them since, or just abandon that problem.
It is possible it's using Infineon's COMNEON drivers... but I can't seem find them on my computer at the moment... looking.
5) Thus no new pseudo TTY's for me to connect and look at.
I'd very much appreciate if someone can provide a solution or more info on this.
I have found some more details, but I still have to collect and try...