Hey folks,
ALDI brings the LifeTab P9514 to market.
What do you think?
Since i dont have 8 post i cant post the link here ^^
But a search on google with LifeTab P9514 should get enough results
Thanks
here is the link:
http://www.aldi-sued.de/de/html/offers/2827_30433.htm
What do you think? Is it good to buy?
or better a xoom?
I'm picking up 2 !!!!!
Even advertised on RTL News!
Chip Magazine great rating, best in price range, etc.
I do not think it is better than the Xoom, esp as MEDION stated on their Facebook page that the LifeTab won't have Gorillaglass and no IPS panel.
The pricetag is however most awesome, esp as you get 3g and everything in it plus extra headphones and a bag.
If they will have a unlockable bootloader, I'm all for it
what are the chances that the lifetab will be updated to ICS? that's really the only thing that keeps me from buying it at the moment.
MEDION said on their facebook page the update is coming, could not tell a time though.
Yeah i got one
They had like 7 pieces at store. And i got the first one
I will try to root it now and get CWM working
Androidpit posted a short Hands on Video:
http://www.androidpit.de/de/android...Tolles-Geraet-ab-heute-bei-Aldi-fuer-399-Euro (in German)
sounds pretty nice, but I think, I'll wait for the Transformer Prime.
JeanMo said:
Yeah i got one
They had like 7 pieces at store. And i got the first one
I will try to root it now and get CWM working
Click to expand...
Click to collapse
Tis what my group is doing (we're working on the 9.7" but close!)
Nice, we have a guinea-pig here!
Can you say something about the screen/glass?
Also, any chance to open the bootloader in adb? Medion wasn't too verbose on that point (they only said it's locked, but that's the case on the other tegra2 tablets too).
Oh, and on Facebook they say it hasnt 1GB ram? Could you verify that?
i didnt try to root it yet. But the tablet has Potential. Evrything runs smooth. The glass is a bit ugly and doesnt feels like an ipad or htc but its okay.
I am gonna try to root it now.. we will see what happens
Can you instann ConnectBot and just run "free" in a local shell? You should not need root for it.
Edith: meh, just tried on stock SE rom on an xperia -- no "free" :/
free doesnt work. Too bad.
Google doesnt show any technique how other people rooted a device at first.
So any tips? ^^
Could you install https://market.android.com/details?id=com.james.SmartTaskManagerLite or https://market.android.com/details?id=zausan.zdevicetest and look the RAM up?
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Thats what i got
first but problem -.- i cant connect to it via adb
it says no device found .. hmm
Code:
Bus 001 Device 007: ID 0408:b009 Quanta Computer, Inc.
Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
idVendor 0x0408 Quanta Computer, Inc.
idProduct 0xb009
bcdDevice 99.99
iManufacturer 1 Medion
iProduct 2 P9514
iSerial 3 37c618941209397
bNumConfigurations 1
Configuration Descriptor:
bLength 9
bDescriptorType 2
wTotalLength 85
bNumInterfaces 3
bConfigurationValue 1
iConfiguration 0
bmAttributes 0xc0
Self Powered
MaxPower 500mA
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 0
bAlternateSetting 0
bNumEndpoints 3
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 255 Vendor Specific Subclass
bInterfaceProtocol 0
iInterface 8 MTP
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x84 EP 4 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x05 EP 5 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x85 EP 5 IN
bmAttributes 3
Transfer Type Interrupt
Synch Type None
Usage Type Data
wMaxPacketSize 0x001c 1x 28 bytes
bInterval 6
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 1
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 255 Vendor Specific Class
bInterfaceSubClass 66
bInterfaceProtocol 1
iInterface 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x86 EP 6 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x06 EP 6 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Interface Descriptor:
bLength 9
bDescriptorType 4
bInterfaceNumber 2
bAlternateSetting 0
bNumEndpoints 2
bInterfaceClass 8 Mass Storage
bInterfaceSubClass 6 SCSI
bInterfaceProtocol 80 Bulk (Zip)
iInterface 9 Mass Storage
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x87 EP 7 IN
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 0
Endpoint Descriptor:
bLength 7
bDescriptorType 5
bEndpointAddress 0x07 EP 7 OUT
bmAttributes 2
Transfer Type Bulk
Synch Type None
Usage Type Data
wMaxPacketSize 0x0200 1x 512 bytes
bInterval 1
Device Qualifier (for other device speed):
bLength 10
bDescriptorType 6
bcdUSB 2.00
bDeviceClass 0 (Defined at Interface level)
bDeviceSubClass 0
bDeviceProtocol 0
bMaxPacketSize0 64
bNumConfigurations 1
Device Status: 0x0001
Self Powered
if someone is intrested in
lsusb looks like it supports mass storage, nice
for adb:
- did you enable usb debugging on the device?
- did you start adb as root/sudo? you will have to kill all running adb instances to retry
Well i couldnt get i mounted yet but i dont care about it so far.
And yes i know how to use adb ^^
I hope i will find a clue soon :-\
Heh, just wanted to be sure
Let us know when you find something
Related
Currently running stock (for Canada) Gingerbread 2.3.3 rooted with Infused V1 Kernel with Voodoo Lagfix enabled.
I've overclocked pretty much every piece of technology that would allow me to, so I figured why not my phone.
I know rooting this was the first step, now I believe I have to install a Kernel that supports OC/UV.
Will any of these Kernels work the same on my Rogers Infuse as they would on an AT&T Infuse?
I know the rooting process was different, but I'm not completely sure why.
Maybe because of the version of Android? Froyo on AT&T vs Gingerbread on Rogers?
I'm hoping to get a stable clock of 1.5Ghz & Ideally I would like to keep my stock ROM. If anyone would advise against going as high as 1.5Ghz, please feel free to let me know.
Also...
Any suggestions on an Overlcocking tool?
I was looking at Voltage Control or SetCPU app to do the job, any recommendations?
Does overclocking the CPU improve GPU performance as well?
I believe it's all integrated into one chip, but I'm not sure if they have the same clock. If not, is there any current method of GPU overclocking?
Thanks in advance guys, have always appreciated this forum back since my Windows Mobile 6.1 days.
Any gingerbread kernel can be flashed on our phones, I recommend INFUSION-GB, which has different versions with different clock speed settings. You can go to 1.6 no problem, and even undervolt a bit! Also, use voltage control. Flashing a kernel won't change your rom, but even if you were to flash a different rom (such as infused, which is based on stock Rogers) you can always get back to stock easily.
Sent from my SAMSUNG-SGH-I997 using XDA App
Any idea on the GPU overclocking?
Will changing there kernel effect the rogers logo at boot? Or is that rom based?
I'm familiar with over volting on PCs to get higher clock speeds. What's the purpose of under volting?
Sent from my SAMSUNG-SGH-I997R using XDA App
Undervolting help please.
What is a stable undervolting setup that has been proven by multiple users on the Infuse? Not looking for anything extreme, just something effective.
Anyone have any knowledge on GPU overclocking options?
Here's my current setup...
Kernel: Infusion-GB Core-A
Rom: Stock Rogers Infuse
Gingerbread 2.3.3
w/ - Voodoo lagfix
- 30fps camera mod
Overclocked to 1600Mhz
w/ - No undervolting
SetCPU profiles...
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Info from SetCPU...
Kernel
Linux version 2.6.35.7-I997RUXKG3-CL366622 ([email protected]) (gcc version 4.4.1 (Sourcery G++ Lite 2009q3-68) ) #Infusion-GB-CoreA PREEMPT Tue Oct 11 23:31:36 CDT 2011
Battery
Battery Temp: 38.0° C (100.4° F)
Battery Level: 30%
CPU
Frequency: 200000 kHz
Load Average: 1.15 1.17 1.36 1/576 16860
Processor : ARMv7 Processor rev 2 (v7l)
BogoMIPS : 199.80
Features : swp half thumb fastmult vfp edsp thumbee neon vfpv3
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x2
CPU part : 0xc08
CPU revision : 2
Hardware : herring
Revision : 0030
Serial : 38314be08ee400ec
Time in State
1600000 362749
1200000 50032
800000 75224
400000 55332
200000 114986
100000 516004
Memory
MemTotal: 463188 kB
MemFree: 52260 kB
Buffers: 10072 kB
Cached: 151936 kB
SwapCached: 0 kB
Active: 253144 kB
Inactive: 94760 kB
Active(anon): 191056 kB
Inactive(anon): 2508 kB
Active(file): 62088 kB
Inactive(file): 92252 kB
Unevictable: 7004 kB
Mlocked: 0 kB
SwapTotal: 0 kB
SwapFree: 0 kB
Dirty: 76 kNo
Writeback: 0 kB
AnonPages: 192936 kB
Mapped: 55496 kB
Shmem: 664 kB
Slab: 13920 kB
SReclaimable: 4032 kB
SUnreclaim: 9888 kB
KernelStack: 4608 kB
PageTables: 12532 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 231592 kB
Committed_AS: 2093332 kB
VmallocTotal: 196608 kB
VmallocUsed: 83880 kB
VmallocChunk: 15188 kB
AnTuTu Benchmark Results...
(Up approx. 1000 over stock)
Sent from my SAMSUNG-SGH-I997R using XDA App
Just use voltage control and bump the voltage down, if it becomes unstable, turn it back up. Just don't set at boot until you're sure its stable and you'll be fine. Undervolting just saves battery. You can't damage the CPU from giving it less power, only more, so nothing to worry About.
Sent from my SAMSUNG-SGH-I997 using XDA App
It would seem to me that the Infuse, does not have a cpu temp sensor, just the battery temp sensor.
Please correct me if I'm wrong.
What type of max temps should I be looking for from the battery temp sensor?
Running Stability Test CPU+GPU I hit 52 degrees celsius after about 4 hours at 1600Mhz.
I am now undervolting...
I noticed that I can't undervolt the 1600Mhz, I would assume this is because the overclock needs at least the stock voltage, or something isn't being detected?
Without being able to undervolt the 1600Mhz. When running Stability Test to confirm the undervolting is working, should I be limiting the clock speed to 1200Mhz?
Sent from my SAMSUNG-SGH-I997R using XDA App
I used FakeFlashTest to test a card I had received, and would like some understanding of the results please...
This is the log: What is the actual usable space??
FAKEFLASHTEST v1.1.1 [SSi]
DRIVE 4 - 249.9GiB Generic- SD/MMC
FFT - Quick Size Test (destructive)
F: (no label) DRIVE 4 - 249.9GiB Generic- SD/MMC
Writing marker blocks to drive 4
5% complete - 103 min 14 sec remaining
10% complete - 97 min 39 sec remaining
15% complete - 92 min 17 sec remaining
20% complete - 86 min 52 sec remaining
25% complete - 81 min 24 sec remaining
30% complete - 75 min 57 sec remaining
35% complete - 70 min 31 sec remaining
40% complete - 65 min 8 sec remaining
45% complete - 59 min 42 sec remaining
50% complete - 54 min 16 sec remaining
55% complete - 48 min 51 sec remaining
60% complete - 43 min 25 sec remaining
65% complete - 38 min 0 sec remaining
70% complete - 32 min 35 sec remaining
75% complete - 27 min 9 sec remaining
80% complete - 21 min 44 sec remaining
85% complete - 16 min 18 sec remaining
90% complete - 10 min 52 sec remaining
95% complete - 5 min 26 sec remaining
100% complete - 0 min 1 sec remaining
Reading back marker blocks...
5% complete - 0 min 38 sec remaining
10% complete - 0 min 36 sec remaining
15% complete - 0 min 34 sec remaining
20% complete - 0 min 32 sec remaining
25% complete - 0 min 27 sec remaining
30% complete - 0 min 26 sec remaining
35% complete - 0 min 25 sec remaining
40% complete - 0 min 23 sec remaining
45% complete - 0 min 21 sec remaining
50% complete - 0 min 18 sec remaining
55% complete - 0 min 17 sec remaining
60% complete - 0 min 15 sec remaining
65% complete - 0 min 13 sec remaining
70% complete - 0 min 12 sec remaining
75% complete - 0 min 9 sec remaining
80% complete - 0 min 8 sec remaining
85% complete - 0 min 6 sec remaining
90% complete - 0 min 4 sec remaining
95% complete - 0 min 2 sec remaining
*** ERROR *** reading from drive 4 at Sector 14892474
Memory tested in blocks of 25600 sectors.
BAD MEMORY from sector 14892474 (7,271.7158MiB) to sector 524281274 (255,996.7158Mib)
Test took 6717 seconds.
*** FAILED ***
DEVICE HAS DUPLICATE OR BAD BLOCKS!
Recommended maximum usable partition size: 7,259.2158Mib (approx. Last good Sector=14892474)
Unplug and re-connect the drive, then reformat it using Windows or RMPrepUSB.
This is the real capacity of your sd card: 7,259.2158 MiB
Download winsetupfromusb and format your sd with the RMPrepUSB option (put 7259 in size).
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
fakeflashtest stops at 95%writing blocks and goes no further.
I was recently given 3 usb flash drives and I have been trying to determine what they are. (no markings)
I ran fakeflashtest and when it gets to 95% writing, it stops. I have gone back hours later and it still goes nowhere.
Any ideas?
Thanks.
Paul
I am currently using a 'noname' 10/100Mbit Ethernet USB adapter to provide Ethernet access to my Sony Xperia Z1 Compact (D5503).
The adapter I have only provides approx 2Mbits when used directly connected to a D5503
If I connect the Ethernet adapter to a powered USB hub and then connect the D5503 to the USB hub, I can obtain approx 6Mbits.
I have tested the USB 10/100Mbit adapter on a Win8.1 PC and get the same 6Mbits on this 'noname' model.
This seems quite slow for a 10/100Mbit Ethernet Adapter, even considering a 480Mbit limit of USB2.0
What are other people using in the way of 10/100Mbit Ethernet adapters and what speed can be obtained.
How did you test the true speed?
nurunet said:
How did you test the true speed?
Click to expand...
Click to collapse
I use Google Play FTP Server and get/put a binary file to/from my 1Gbit LAN NAS(QNAP TS-253 Pro with 8GB memory and 7200rpm WD Red drives) and/or Speedtest.net where my normal ISP speed would be a constant 12Mbits to the local ISP Speedtest server.
Speedtest.net is no good for me over 12Mbits.. obviously.
The above ~results are just done via Speedtest.net as any meaningful speed/bandwidth speed at 1-2Mbits is mind numbingly painful..slow.....
Because you asked the question, I did a 6Mbyte file download/upload approx 1.23Mbits download/write and approx 3.9Mbits upload/read from Xperia Z1 compact using ftp where the Ethernet adapter was plugged directly into the Z1C (just a node on the LAN).
[/share/Public] # ftp lbp330-et.lan 2221
230 User logged in, proceed.
Remote system type is UNIX.
ftp> bin
200 Command TYPE okay.
ftp> put fz6.exe
local: fz6.exe remote: fz6.exe
200 Command PORT okay.
150 File status okay; about to open data connection.
226 Transfer complete.
6004615 bytes sent in 37.93 secs (154.6 kB/s)
ftp> get fz6.exe
local: fz6.exe remote: fz6.exe
200 Command PORT okay.
150 File status okay; about to open data connection.
226 Transfer complete.
6004615 bytes received in 11.99 secs (489.1 kB/s)
ftp> put fz6.exe
local: fz6.exe remote: fz6.exe
200 Command PORT okay.
150 File status okay; about to open data connection.
226 Transfer complete.
6004615 bytes sent in 37.70 secs (155.5 kB/s)
ftp> get fz6.exe
local: fz6.exe remote: fz6.exe
200 Command PORT okay.
150 File status okay; about to open data connection.
226 Transfer complete.
6004615 bytes received in 12.02 secs (488.0 kB/s)
ftp>
Xperia Z1 Comact Ethernet via powered USB hub.
Model: Xperia Z1 Compact
Android Version: 5.1.1
Firmware: Stock Sony with Locked Bootloader.
Ethernet down: ~6.5Mbits/sec
Ethernet up: ~1Mbits/sec (restricted by ADSL2 upload speed)
If you connect a supported USB/Ethernet adapter to a powered USB hub, you do get some improvement in Ethernet throughput.
It's still not fast, but you can do 'stuff' with ~6.5Mbits/sec
The Upload speed may be faster as I'm using a 12Mbit down /1Mbit up ADSL2 Internet connection.
Really just checking that Ethernet was still supported using Stock Sony Android 5.1.1 on the Z1C.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I have a D5503 too. Can u provide me a rom capable in ethernet?
I have a D5503 too.
Can u provide me a rom stock capable in ethernet to flash in twrp?
Thank you very much.
Hi everyone! This is a deep dev-related question, but I don't have permission to post into dev forums.
My goals are - implement Wifi monitor mode and enable FM Transmission capability. Since they are both related to one chip, I decided to put them into one post (sorry if this decision was wrong).
What do we have now:
The chip - general info
Is an ARM7-based SoC, combining features of it's ancestors: WLAN (MT5921), Bluetooth/FM (MT6616) and GPS (MT3326).
I've found the drivers for it in this repo: https://github.com/bq/aquaris-E5, wlan path: mediatek/kernel/drivers/combo/drv_wlan, fm path: mediatek/kernel/drivers/fmradio/mt6620.
There is an NVRAM map here: http://www.datasheet-pdf.com/datasheet-download.php?id=955336
And it's description (with pinout, block chart, but no specific details about it's ARM core): http://www.bluetooth.org/tpg/RefNotes/MT6620_RIN_Product_Brief_20101110.docx
Added: Found out that we cannot trust /system/build.prop for checking out a chip id. Drivers (lsmod) are not good indication either. You can use a built-in ioctl utility to issue a request directly to the chip like this:
Code:
ioctl -l 4 /dev/fm -1073416950
It doesn't parse a proper hex representation of the ioctl (0xС004f519) correctly, so I had to use this signed notation.
Turned out that Philips S388 has MT6627, which doesn't even have an FM Tx block in hardware: http://www.cnping.com/wp-content/uploads/2015/12/MT6627_Data_Sheet_v03a.pdf
Unluckily, my another device (PAP4044 Duo) has an MT6628 chip, which also doesn't support Tx: https://github.com/luckasfb/Develop...s/MT6628/MT6628T_external_datasheet_v1.2b.pdf
But curiously, it doesn't even have FM_IOCTL_TX_SUPPORT ioctl implemented, while S388 responds fine to it. You can check it for your device like this:
Code:
ioctl -l 4 /dev/fm -1073416935
If you get a "01 00 00 00" response, it would mean really good news - that your device supports TX and it is not disabled by the driver!
Wlan - low level packet reading/writing
libhardware_legacy.so on my Philips S388 enables wifi by calling "wifi_change_fw_path", which loads one of the 3 firmware (driver?) flavors: "STA", "STA+P2P" or "AP".
Firmware is located at /etc/firmware/WIFI_RAM_CODE, I attached it to the post.
According to "firmware_download" function, firmwares can be single-chunked (like this one) or have the header described by these structs:
Code:
typedef struct _FWDL_SECTION_INFO_T
{
UINT_32 u4Offset;
UINT_32 u4Reserved;
UINT_32 u4Length;
UINT_32 u4DestAddr;
} FWDL_SECTION_INFO_T;
typedef struct _FIRMWARE_DIVIDED_DOWNLOAD_T
{
UINT_32 u4Signature;
UINT_32 u4CRC; /* CRC calculated without first 8 bytes included */
UINT_32 u4NumOfEntries;
UINT_32 u4Reserved;
FWDL_SECTION_INFO_T arSection[];
} FIRMWARE_DIVIDED_DOWNLOAD_T;
u4Signature is "MTKW" for multi-chunk files. I've attached one of these multi-chunk firmwares also for you to see how they look like.
The chunks themselves look packed/encrypted, no visible headers. Doesn't look like a proper ARM code either.
And this part of code suggests some on-chip encryption (WTF?! It's not a smart-card or crypto chip):
Code:
prInitCmdDownloadBuf->u4DataMode = 0 | 0x1; // enable encryption
Added: Now I'm sure the stuff is encrypted. I've tried to figure out the cipher's specs and think it is either 8-byte block cipher or streaming cipher. Analyzing some datasheets and background info on Mediatek I've narrowed down possible candidates to RC4, DES, 3DES or some makeshift repeating key xor cipher.
I've seen some weird patterns in data like these, enforcing the latter idea:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
But xor'ing different parts together does not break data uniformity. Also a Hamming distance analysis doesn't apply here - it gives a key length of 36 bytes, which doesn't make sense.
If someone's good with crypto, I desperately need your advice.
Added2: I've effectively excluded RC4 as it doesn't produce repeating patterns and 95% sure it is 3DES in EDE mode like this:
Code:
openssl des -e -nosalt -des-ede3 -in plaintext -out 3des.cyp
Also using test mode MCR (MCU Register?) functions, I've managed to dump around 4 megs of something (attached as "something.zip"), which, according to the driver sources, could contain the decrypted firmware at offset 0x60000. And it does, judging by the size of the block and location of some characteristic zero-gaps, but despite of being non-packed and non-crypted, still doesn't make sense as an ARM code.
FM Transmission
Driver contains ioctls for TX mode:
Code:
#define FM_IOCTL_TX_SUPPORT _IOWR(FM_IOC_MAGIC, 25, int32_t*)
#define FM_IOCTL_RDSTX_SUPPORT _IOWR(FM_IOC_MAGIC, 26, int32_t*)
#define FM_IOCTL_RDSTX_ENABLE _IOWR(FM_IOC_MAGIC, 27, int32_t*)
#define FM_IOCTL_TX_SCAN _IOWR(FM_IOC_MAGIC, 28, struct fm_tx_scan_parm*)
And their implementation:
Code:
/*****tx function****/
ops->bi.tx_support = mt6620_Tx_Support;
ops->bi.pwrupseq_tx = mt6620_PowerUpTx;
ops->bi.tune_tx = MT6620_SetFreq_Tx;
ops->bi.pwrdownseq_tx = mt6620_PowerDownTx;
ops->bi.tx_scan = mt6620_TxScan;
Don't worry about TX_SUPPORT, the support availability seems to be out of the question:
Code:
static fm_s32 mt6620_Tx_Support(fm_s32 *sup)
{
*sup=1;
return 0;
}
However, I cannot guarantee the TX is not disabled by firmware (see above). Didn't dig well into this, since this feature is my 2-nd priority.
This is a tough stuff to pull off alone, so I'm looking for those who's interested and willing to join the effort.
ogurets said:
Hi everyone! This is a deep dev-related question, but I don't have permission to post into dev forums.
My goals are - implement Wifi monitor mode and enable FM Transmission capability. Since they are both related to one chip, I decided to put them into one post (sorry if this decision was wrong).
What do we have now:
The chip
Is an ARM7-based SoC, combining features of it's ancestors: WLAN (MT5921), Bluetooth/FM (MT6616) and GPS (MT3326).
I've found the drivers for it in this repo: github.com /bq/aquaris-E5, wlan path: mediatek/kernel/drivers/combo/drv_wlan, fm path: mediatek/kernel/drivers/fmradio/mt6620.
There is an NVRAM map here: datasheet-pdf.com /datasheet-download.php?id=955336
And it's description (with pinout, block chart, but no specific details about it's ARM core): bluetooth.org /tpg/RefNotes/MT6620_RIN_Product_Brief_20101110.docx
Wlan
libhardware_legacy.so on my Philips S388 enables wifi by calling "wifi_change_fw_path", which loads one of the 3 firmware (driver?) flavors: "STA", "STA+P2P" or "AP".
Firmware is located at /etc/firmware/WIFI_RAM_CODE, I attached it to the post.
According to "firmware_download" function, firmwares can be single-chunked (like this one) or have the header described by these structs:
Code:
typedef struct _FWDL_SECTION_INFO_T
{
UINT_32 u4Offset;
UINT_32 u4Reserved;
UINT_32 u4Length;
UINT_32 u4DestAddr;
} FWDL_SECTION_INFO_T;
typedef struct _FIRMWARE_DIVIDED_DOWNLOAD_T
{
UINT_32 u4Signature;
UINT_32 u4CRC; /* CRC calculated without first 8 bytes included */
UINT_32 u4NumOfEntries;
UINT_32 u4Reserved;
FWDL_SECTION_INFO_T arSection[];
} FIRMWARE_DIVIDED_DOWNLOAD_T;
u4Signature is "MTKW" for multi-chunk files. I've attached one of these multi-chunk firmwares also for you to see how they look like.
The chunks themselves look packed/encrypted, no visible headers. Doesn't look like a proper ARM code either.
And this part of code suggests some on-chip encryption (WTF?! It's not a smart-card or crypto chip):
Code:
prInitCmdDownloadBuf->u4DataMode = 0 | 0x1; // enable encryption
FM
Driver contains ioctls for TX mode:
Code:
#define FM_IOCTL_TX_SUPPORT _IOWR(FM_IOC_MAGIC, 25, int32_t*)
#define FM_IOCTL_RDSTX_SUPPORT _IOWR(FM_IOC_MAGIC, 26, int32_t*)
#define FM_IOCTL_RDSTX_ENABLE _IOWR(FM_IOC_MAGIC, 27, int32_t*)
#define FM_IOCTL_TX_SCAN _IOWR(FM_IOC_MAGIC, 28, struct fm_tx_scan_parm*)
And their implementation:
Code:
/*****tx function****/
ops->bi.tx_support = mt6620_Tx_Support;
ops->bi.pwrupseq_tx = mt6620_PowerUpTx;
ops->bi.tune_tx = MT6620_SetFreq_Tx;
ops->bi.pwrdownseq_tx = mt6620_PowerDownTx;
ops->bi.tx_scan = mt6620_TxScan;
Don't worry about TX_SUPPORT, the support availability seems to be out of the question:
Code:
static fm_s32 mt6620_Tx_Support(fm_s32 *sup)
{
*sup=1;
return 0;
}
However, I cannot guarantee the TX is not disabled by firmware (see above). Didn't dig well into this, since this feature is my 2-nd priority.
This is a tough stuff to pull off alone, so I'm looking for those who's interested and willing to join the effort.
Click to expand...
Click to collapse
I'll move it to android development for you unless you'd prefer it to stay in general
Regards
Sawdoctor
Found an interesting test mode in the driver and built a utility from the sources found in public repos around (source code for S388 attached).
It actually sends packets! I were able to capture them with another wifi card, so it's not some internal emulation, it is real.
The capture file is with the sources attached (forum does not allow me to upload .pcap file directly). Contents seem random, but if there is a way to specify a payload, there would be no need to decipher the firmware.
This is how an attached dump were made (used speed setting to confirm those are really my packets, not just random neighborhood traffic):
Code:
# ./wifitesttool -t 0 -s 0 -R 11
(success) Set central channel number to 1
(success) Set Rx default antenna to main
(success) Set bandwidth to BW20
(success) Set Tx power gain to 10 dBm
(success) Set Tx payload to 1024 bytes..
(success) Set frame interval to 20 TU
(success) Set frame count to 10
(success) Set SHORT preamble
(success) Set Tx mode to 11a/b/g, tx rate RATE_48MBPS
no cw mode configuration.
(success) TX test started..
Tx test is running! wait for 10s...
[0] Tx total/good count: 0/0
[1] Tx total/good count: 10/10
[2] Tx total/good count: 10/10
[3] Tx total/good count: 10/10
[4] Tx total/good count: 10/10
[5] Tx total/good count: 10/10
[6] Tx total/good count: 10/10
[7] Tx total/good count: 10/10
[8] Tx total/good count: 10/10
[9] Tx total/good count: 10/10
[10] Tx total/good count: 10/10
Stop Tx test!
Added: This AT command looks promising for setting a payload: RF_AT_FUNCID_PKTCONTENT
Nice
What you are trying to do?
I saw WIFI_RAM_CODE on my mediatek device it's not encrypted
Strings are still in plain text
[email protected] said:
What you are trying to do?
I saw WIFI_RAM_CODE on my mediatek device it's not encrypted
Strings are still in plain text
Click to expand...
Click to collapse
I'm trying to implement a non-associated wireless protocol using the widely available consumer hardware.
Could you post your WIFI_RAM_CODE file and the model of your Wifi chip or device?
Do you mean enabling monitor mode?(or something like that?)
My device has mt6755 WiFi chipset
ogurets said:
I'm trying to implement a non-associated wireless protocol using the widely available consumer hardware.
Could you post your WIFI_RAM_CODE file and the model of your Wifi chip or device?
Click to expand...
Click to collapse
So, can we inject packets?
Can you upload wifitest binary for mt6628?
Is there a way to read fm audio data from mt6627?
Hello, i am on Android 10 DerpFest Offical Rom April 07/04/20, Carrier : Jio
I am facing a very weird issue.
Wifi calling works for me when connected on all wifi network except my home one.
So when i connect to my home's wifi it never works but on other wifi network it works...
Here's the interesting Part:
When i connect to my home's wifi from my pc and make a hotspot for my home's wifi to tether it and connect my phone to that hotspot then it works but why doesn't it directly work with my home wifi..
any way i can debug this or provide logs for this issue? Or any solutions?
I have wifi calling enabled and "prefer Wifi" enabled too.. any ideas?
I have two wifi connections (Max and Demonetix)
Demonetix -> My Router
Max is -> My Pc's hotspot connected to Demonetix -> Router
when i connect to Demontix it doesn't work but when i connect to Max it works
Here's the logs:
On wifi "Max" where it works (see highlighted lines:-
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
On wifi "Demonetix" - Where it doesn't work
Notice there is no
`[MOBILE (IWLAN) - 101] EVENT_NETWORK_INFO_CHANGED, going from CONNECTED to CONNECTED`
Is there any particular wifi router config i need?
Go to WiFi settings -> 'Your home network' -> Advanced -> Network Usage -> Treat as unmetered
Hope this helps
srinath05 said:
Go to WiFi settings -> 'Your home network' -> Advanced -> Network Usage -> Treat as unmetered
Hope this helps
Click to expand...
Click to collapse
Thanks for your suggestion but this doesn't seem to help much :/
Here are a few details i have found:
I have two wifi connections (Max and Demonetix)
Demonetix -> My Router
Max is -> My Pc's hotspot connected to Demonetix -> Router
when i connect to Demontix it doesn't work but when i connect to Max it works
Here's the logs:
On wifi "Max" where it works (see highlighted lines:-
On wifi "Demonetix" - Where it doesn't work
Notice there is no
`[MOBILE (IWLAN) - 101] EVENT_NETWORK_INFO_CHANGED, going from CONNECTED to CONNECTED`
After enabling Metered connection:
Code:
04-12 20:22:36.507 1917 2101 D ConnectivityService: NetworkAgentInfo [MOBILE (LTE) - 101] EVENT_NETWORK_INFO_CHANGED, going from CONNECTED to CONNECTED
04-12 20:22:36.572 1917 2101 D ConnectivityService: NetworkAgentInfo [MOBILE (LTE) - 101] EVENT_NETWORK_INFO_CHANGED, going from CONNECTED to CONNECTED
04-12 20:22:46.720 1917 2101 D ConnectivityService: NetworkAgentInfo [MOBILE (IWLAN) - 105] EVENT_NETWORK_INFO_CHANGED, going from CONNECTED to CONNECTED
04-12 20:22:46.728 1917 2101 D ConnectivityService: NetworkAgentInfo [MOBILE (IWLAN) - 101] EVENT_NETWORK_INFO_CHANGED, going from CONNECTED to CONNECTED
04-12 20:23:03.261 1917 2101 D ConnectivityService: handleLingerComplete for NetworkAgentInfo [MOBILE (IWLAN) - 105]
04-12 20:23:03.276 1917 2101 D ConnectivityService: NetworkAgentInfo [MOBILE (IWLAN) - 105] got DISCONNECTED, was satisfying 14
04-12 20:23:16.691 1917 3556 D ConnectivityService: ConnectivityService NetworkRequestInfo binderDied(NetworkRequest [ TRACK_DEFAULT id=70, [ Capabilities: INTERNET&NOT_RESTRICTED&TRUSTED Uid: 10140] ], [email protected])
04-12 20:23:16.692 1917 2101 D ConnectivityService: releasing NetworkRequest [ TRACK_DEFAULT id=70, [ Capabilities: INTERNET&NOT_RESTRICTED&TRUSTED Uid: 10140] ] (release
Seems like it got insta disconnected.. idk
Anyone?
Still having the issue
bump
bump