A910 and CGs

Today I found the time to get back onto A910 modding. I managed to get to know some things, and after writing this I’ll go on with research.

First:
CG names differ from A910 to other devices, they are the same as on some A1200 (newer firmwares, if I got that right). For finding out things I had a look at “ilove3d-48p-ultimate” for E2, and compared the stuff I found there using the SBF-extraction tool you find over at freemod.net, results (compared to A910-R57_G_10.08.07R): CG34/CG37 contents seem to be nearly the same, but as there is no CG41, CG42 is what CG41 is on E2 and so on. That means, that quite important CG43 folder from backup(made with some backup tool for E2 from e2mod.com) (contains main file system…), is CG44 in firmware.
Unfortunately I wasn’t successfull yet on extracting files from E2-CG43/A910-CG44 – I’ll google on that, and I`m pretty sure that someday I might find out how to get this work.

Maybe you remember this:

CG42 contains /usr/setup/, and there is a file called “ezx_wlan.cfg”. Line 4 of this file contains the following text: “WiFiUIConnectUMAN = 1”

After my research today I know why changing this value to zero and flashing it only caused languages to disappear: I flashed it to the wrong position… Shame on me. Now I will have to try this out again.

An eMail with helpful information

As I haven’t posted here for nearly a month, I will now quote an email I got by a guy I contacted. All copyrights go to him, I haven’t had time to test his explanations, but maybe it helps somebody of you that want their A910 to connect to every wireless network.

I’ll try to make some explainations. We can discuss together in order to
improve the text and make a correct howto we can put on the web…
(contains and form (I’m an old vi dinosaur from 1994 ;) ) + the english,
as it’s not my mother language…)
4 parts: telnetd, swap, wifi and mackconnectivitypack/fake_dsm

1) Telnetd/login
Motorola didn’t install any telnetd nor login. (thanks, Moto :-)
Mount your phone as an usb mass storage, then edit
[path]/.system/javaCardRegistr

y
and set lines as follow (you can install a dummy java application then
adapt the values (IMEI, AppID,…) JavaId must be -1.
[1bf504e3-a1e3-d1e8-b96a-40f3a7f60087]
AppID = {1bf504e3-a1e3-d1e8-b96a-40f3a7f60087}
Args =
Attribute = 2
BigIcon = inetd.png
Daemon = 0
Directory = /mmc/mmca1/scripts
Eraseable = 1
Exec = inetd_start.lin
FixedAllPosition = 0
FixedPosition = 0
GroupID = ezx
IMEI = 353300010213731
Icon = inetd.png
InstalledDate = 2007/6/6
JavaId = -1
LockValue = 0
MassStorageStatus = 1
MpkgFile =
Name = Inetd_Start.lin
OsVersion = 1.0
Shared = 1
Size = 64K
Type = 2
UserID = ezx
Visible = 1

with /mmc/mmca1/scripts/inetd_start.lin
#!/bin/bash
export QTDIR=/usr/lib/ezx
export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/ezxlocal/sbin
export PATH=$PATH:/ezxlocal/sbin
my_alert=’/usr/SYSqtapp/phone/alertprocess’
my_mid1=’/ezxlocal/sbin/done.mid’
cp -f /mmc/mmca1/sbin/inetd.conf /tmp/inetd.conf
echo -n “Starting internet superserver:”
echo -n ” inetd” ; start-stop-daemon —start —quiet —chuid root
—pidfile /var/run/inetd.pid —exec /mmc/mmca1/sbin/inetd
$my_alert -playvol 1 -playfile $my_mid1

/mmc/mmca1/sbin/inetd.conf contains:
telnet stream tcp nowait root /mmc/mmca1/sbin/in.telnetd
in.telnetd -L /mmc/mmca1/sbin/login

for the in.telnetd daemon, login exec, those from my A780 are ok,
or google search Telnet_Samba_preload.rar on a russian moto site.
A780-AddOns.tgz is also very usefull for login and many more
(was available on the old motorolafan download section, but no more today)
(install without diska
sub-directory, into your mmc card)

Then after a A910 reboot, you see into games, a “Inetd_Start.lin” you
can activate (hear a sound).

you can connect your linux box (A910 usb in modem mode)
usb 4-2: new full speed USB device using uhci_hcd and address 4
cdc_acm 4-2:1.0: ttyACM0: USB ACM device
usb 4-2: USB disconnect, address 4
usb 4-2: new full speed USB device using uhci_hcd and address 5
see http://www.courville.org/mediawiki/index.php/EZX

echo “AT+mode=13” > /dev/ttyACM0
echo “AT+mode=99” > /dev/ttyACM0
sometimes more than one time (why? :-), until you get something like
this in the kernel message (dmesg):
usb0: register usbnet at usb-0000:00:1d.2-2, pseudo-MDLM (BLAN) device,
12:ea:79:65:60:6f
usbcore: registered new driver usbnet

ifconfig usb0 192.168.1.1 netmask 255.255.255.0 mtu 900
telnet 192.168.1.2
Trying 192.168.1.2…
Connected to 192.168.1.2.
Escape character is ‘^]’.

MontaVista(R) Linux(R) Consumer Electronics Edition 3.1
Linux/armv5tel 2.4.20_mvlcee31-mainstone_pxa27x

(none) login: root

MontaVista(R) Linux(R) Consumer Electronics Edition 3.1

No directory /root!
Logging in with home = “/”.

I set a more convenient environment with
# /mmc/mmca1/root/start
root@a910 ~ 11:38:16 > cat /mmc/mmca1/root/start
#!/bin/sh
/etc/init.d/ezxenvr.sh
export PATH=$PATH:/mmc/mmca1/.system/bin:/mmc/mmca1/.system/sbin
export
LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$QTDIR/lib:/lib:/usr/lib:/usr/lib/ezx/lib:/mmc/mmca1/.system/lib
export EZX_RES_FONT_PATH=/usr/lib/ezx/lib/fonts
eval “`dircolors -b`”
alias ls=’ls —color=auto’
export HOME=/mmc/mmca1/root
cd $HOME
export COLUMNS=150
/mmc/mmca1/.system/bin/bash

root@a910 ~ 11:38:22 > cat .bashrc
export PROMPT_COMMAND=’echo -ne “33]0;root@910:${PWD/#$HOME/~}07”’
export PS1=”u@a910 w t > “
export HISTFILESIZE=100
export HISTSIZE=100
export HISTCONTROL=ignoreboth
export QTDIR=/usr/lib/ezx
export EZX_RES_FONT_PATH=/usr/lib/ezx/lib/fonts
eval “`dircolors -b`”
alias ls=’ls —color=auto’
export HOME=/mmc/mmca1/root
export COLUMNS=150
. /etc/init.d/ezxenvr.sh
export
LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$QTDIR/lib:/lib:/usr/lib:/usr/lib/ezx/lib:/mmc/mmca1/.system/lib
alias scp=’scp -S /mmc/mmca1/.system/bin/ssh -q’
alias sftp=’sftp -S /mmc/mmca1/.system/bin/ssh’
alias l=’ls -l’
alias ..=’cd ..’
alias cp=’cp -v’
alias la=’ls -la’
alias ll=’ls -lA’

Then, I changed the telnetd and login directory, moving from /mmc/mmca1
to /ezxlocal (11Mb internal A910 storage) so telnetd is no more
dependant of the removable microSD.

2) swapspace
I also set a swap space ( no more
available on motorolafan)
in /mmc/mmca1/.system/java/CardRegistry:
[793bffb3-96f9-d929-bfd7-84e623c514cf]
AniIcon =
AppID = {793bffb3-96f9-d929-bfd7-84e623c514cf}
Args =
Attribute = 4
BigIcon = swapon.png
Daemon = 0
Directory = /mmc/mmca1/.system/swap
Eraseable = 1
Exec = swapon.lin
FixedAllPosition = 0
FixedPosition = 0
GroupID = ezx
IMEI = 35330001*******
Icon = swapon.png
InstalledDate = 2007/6/13
JavaId = -1
MassStorageStatus = 0
MpkgFile =
Name = Swap_on_off.lin
OsVersion = 1.1
Shared = 2
Size = 386K
Type = 2
UserID = ezx
Visible = 1

root@a910 ~ 12:14:25 > cat /mmc/mmca1/.system/swap/swaponoff.sh
#!/bin/sh
SWAPDIR=/mmc/mmca1/.system/swap
SWAPFILE=$SWAPDIR/swapfile
if [ ! -f $SWAPFILE ]; then
gzip -c -d $SWAPFILE
fi
if ! grep $SWAPFILE /proc/swaps; then
swapon $SWAPFILE
rm $SWAPDIR/OFF
touch $SWAPDIR/ON
my_mid1=’/usr/data_resource/ringtone/rt_alert_2.mid’
else
rm $SWAPDIR/ON
swapoff $SWAPFILE
touch $SWAPDIR/OFF
my_mid1=’/usr/data_resource/ringtone/rt_alert_5.mid’
fi
my_alert=’/usr/SYSqtapp/phone/alertprocess’
$my_alert -playvol 1 -playfile $my_mid1

3) Wifi
The WIFI connection tool /usr/SYSqtapp/wsp/wlanapp fails everytime (UMA
stuff? Orange or BT limitation? Grrr…) so the solution is to kill the
process when we are connected and continue with normal dhcp request:
see the awful script setwifidhcp.lin:
#!/bin/sh
/etc/init.d/ezxenvr.sh
export PATH=$PATH:/mmc/mmca1/.system/bin:/mmc/mmca1/.system/sbin
export
LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$QTDIR/lib:/lib:/usr/lib:/usr/lib/ezx/lib:/mmc/mmca1/.system/lib
export EZX_RES_FONT_PATH=/usr/lib/ezx/lib/fonts
/usr/SYSqtapp/wsp/wlanapp >/ezxlocal/wlanapp.log 2>&1 &
pid=`find /proc/ -name exe -ls 2> /dev/null|grep wlanapp|cut -d/ -f3`
connected=0
while [ ${connected} -eq 0 ]; do
sleep 2
connected=`grep “Successfully connected to AP”
/ezxlocal/wlanapp.log |wc -l`
done
kill $pid
kill `cat /ram/tmp/dhcpcd-eth0.pid`
rm /ram/tmp/dhcpcd-eth0.pid
dhcpcd eth0
my_alert=’/usr/SYSqtapp/phone/alertprocess’
my_mid1=’/ezxlocal/sbin/done.mid’
$my_alert -playvol 1 -playfile $my_mid1

Now, the problem is the setting of the dnsproxy process:
cat /etc/dnsproxy.conf
include /ram/tmp/dsmdns.conf
include /ram/tmp/pppdns.conf

Even when I fix a proper value into /ram/tmp/dsmdns.conf, It’s not taken
into account.
By mounting a writable /etc, I can set a working /etc/resolv.conf
http://www.courville.org/mediawiki/index.php/EZX#Make_.2Fetc_editable_.26_change_root_passwd_.28more_secure_telnet.29

5) mackconnectivitypack/fake_dsm
When the wifi link is ok (see iwconfig eth0) I can access internet with
native application
(ping, telnet,…) but not with web browser, nor native opera nor java
opera-mini.
The solution would be to set a fake_dsm route but I did’nt succeed…
I used the dsm_spy from clovisKKK to adapt the fake_dsm code, as
suggested in the thread
http://www.motorolafans.com/forums/viewtopic.php?t=9096&postdays=0&postorder=asc&start=0

B******

As you can easily see, there is still a lot of work to do, and I have to say, I’d prefer to modify the firmware and flash it into the device to get things working without lots of dirty hacks not everybody is able to perform.

Motorola A910 – Checking out firmware

[Introduction: Motorola A910 is a linux phone which has got Wlan for UMA purposes. The problem with this Wlan is, that it only works with certain networks. As (most) software for Motorola E2 works, I checked out lots of sites to learn about modifying firmware.]

Yesterday I started to work on A910 again, after I was off for a week, meeting parents and grandparents. As I luckily found someone, who gave me some firmware files for A910, I extracted the codegroups and had a look at them on linux. The probably most interesting one is CG43, as it contains the main file system, /bin/, /lib/, SYSqtapp – but I’ll get back to this in some days, when I have my phone flashed to an own firmware, which I want to include some of the modifications some freaks made for Motorola ROKR E2. But this might take some time, as I have to prepare for some exams at university.

CG42 contains /usr/setup/, and there is a file called “ezx_wlan.cfg”. Line 4 of this file contains the following text:

WiFiUIConnectUMAN = 1

Maybe changing the value here is an easy way to full wlan-connectivity. I’ll try, as soon as I am sure how to do that without killing the handset.

Hello World!

This is my first post – I am a german guy, who likes linux-powered mobile phones a lot and due to this, some of these phones will be the subject here.

I had a blog over at some other place before, but it is gone now, unfortunately. If the hoster sends me my old texts, I will import them in here.