Please remember to add a category to the bottom of each page that you create.
See categories help for further details, but most will probably be [[Category:HTC ModelName]].


From XDA-Developers
Jump to: navigation, search


A realtime look at TraceLogger output

Wouldn't it be nice to be able to have a really detailed and close-up look at what goes inside the GSM/GPRS module inside your XDA? Using the built-in TraceLogger and our TraceLogView realtime viewing utility, you can.

The XDA-developers built TraceLogView, a utility which, working together with the TraceLogger utility that is factory-installed on your device, will display a human-readable event log, on the screen of the device itself, in realtime.

Some of the output is very clear, but other parts are mysterious. Now that our readers can see the events coming from the GSM/GPRS module, we hope a distibuted interpretation effort will get underway.


Some of the readers may be familiar with an application called TraceLogger that comes with your XDA. TraceLogger is a Pocket PC application that logs various aspects of the GSM module operation to files. If you start TraceLogger (located in \Windows on your device), you will be prompted for a password. It would have been nice if this password had been hard to guess, so we could boast to have cracked it using debuggers and other high-tech wizardry.

As it is, the password is "htc", and it was found by someone posting to our forum. The warning in the password entry window speaks of "damage to your device". We have played with TraceLogger quite a bit, and we haven't yet discovered how to do damage with it. It would seem it only logs to file what happens in the GSM/GPRS module. But we're high-tech daredevils, living life on the edge. So if you screw up your device, don't blame us.


TraceLogger logs two different levels of activity. One is called 'L1', the other is 'G23'. Once you enter the password to TraceLogger, you'll see the L1 logging window(right), with two other tabs underneath.

On this first window you can enter a file to log to, a 'flag', as well as a 'string pattern'. We haven't played with this much yet, but many other values for flag seem to inhibit operation of L1 logging. The string value is probably a filter, although this needs further testing. If you press the start button, TraceLogger starts logging 'L1' events to the file indicated. If logging is stopped and then restarted, the logfile is overwritten.

The thing with TraceLogger is that it logs events to files which are not immediately human-readable. Although some of the information contained is in ASCII, they also contain non-printable characters which confuse the built-in text-viewing applications on the XDA. So in order to analyse the files, we had to move them to a PC and view them in a hex-editor.

The structure of these files was a little harder to figure out than it seemed at first. The L1 logfile was easy though: records start with bytes 0x02 0x12 and end with 0x0A 0x0D 0x02 and consist of ASCII text. The record starts with a record type (right-padded to 6 characters with spaces) then a decimal counter value, a space and then the rest of the record. Sometimes extra information is provided on the next line, after indenting 6 spaces.

The fact that it was easy to figure out how the data is structured does not mean it's easy to figure out what it says. The L1 output mostly consists on long strings of numbers, and making sense of these numbers is probably going to take quite a bit of time.


G23 is the product name of the GSM software that runs inside the GSM/GPRS module. (More information on the general design of the GSM/GPRS module is here.) The G23 logging window is shown on the left. Again you can select a file to log to. The checkbox marked 'continous' changes the file name to swap1.txt and pops up a dialog which asks you to input a 'Max. Swap file Size', and suggests 1MB. We haven't played with the continous option much.

The upper list box on the left allows selection of a command you'd like to log. The 'Option' checkboxes to the right of that let you select which class of events related to this event you want to log. If you select a command and an option (for instance 'GMM' and 'All'), you can press the little down arrow between the upper and lower list boxes to add "GMM+ALL" to the list of commands being logged.

If you select a command which is being logged from the lower box and press the little 'up' arrow between the list boxes, you remove it from the list of commands to be logged. The 'Cmd' tab, shown on the right here, will allow entry and deletion of commands to and from the list of commands available on the 'G23' tab.

The structure of the 'G23' files was much harder to figure out completely: Records start with 0x02 0x13 and end with 0x00 0x02. A record first contains an ASCII 'T', followed by a 4 byte counter value, as 8 ASCII hex digits. Then, directly following the hex digits, is the command (4 characters, right-padded with spaces). Then there's the string 'PCO ', followed by the record data. If the data begins with a percent sign, the following two bytes are binary and represent a 16 bit value. If, after such a value, the remaining data ends with an extra 0x00 (not the one that is part of the end-of-record symbol) or 0x0F, then the rest of the record is to be interpreted as binary data, otherwise it is ASCII text.

To make things more complicated, this stream of records described above can be interrupted at any point by the sequence 0x00 0xC8 0xFF 0xFF optionally followed by a sequence made up of bytes from the following collection: 0x2C, 0x3C, 0xF6, 0x9, 0x2E, 0x7C, 0x8F or 4 times 0x00.


  • Download TraceLogView binary: tlv.exe|
  • Download TraceLogView source:|
  • browse TraceLogView source: [ viewcvs|]
  • Install it on your device by running the exe
  • Start TraceLogger as described above
  • Start both logs to their default files
  • (\Temp\L1.txt and \Temp\G23.txt)
  • Now hit the little windows symbol and run TraceLogView, without ever pressing 'ok' in TraceLogger, as this stops it.

You may want to log only a few G23 commands at first, as you will otherwise be unable to keep up with the output. As you can see, TraceLogView displays records from both logfiles in real-time. TraceLogView is written in eMbedded Visual Basic, which means it's slow, rather large, but finished before the programmer had to get back to his day-job. If you press the select box left of the word L1 or G23, you'll turn off display for that particular logfile. This makes display for the other logfile use the whole screen and become faster.

The box marked 'lag' will display how far the display is lagging behind the actual events. If you select the box, it will say 'skip to keep up', and the program will skip when it falls behind more than 4 kilobytes. It will display a record that says '---TLV skipped---' to indicate this has taken place. The timer checkbox allows displaying the, rather boring, timer values which we normally do not display to save space on the display. Pause pauses that particular window so you can conveniently scroll back to see what happened.

In the G23 window, the bytes following the weird interruption marker (see above) are marked 'Bytes:' and are displayed after the record that was interrupted. The value after the % sign is displayed in hex and between braces.

In order to use this tool you need the eMbedded Visual Basic Runtime Libary.

Now it's your turn

May we suggest y'all whip out your other GSM's, put them in monitor mode, and start comparing values. We've seen measurements of loudest neighbour cells, lots of interaction between TAPI and the phone and many other potentially interesting things.

Happy hunting....