N900 GPS Reverse Engineering

2014-08-21T11:53:54Z

62.210.148.132: /* Key */

acquire packets like:
strace -p $(pidof location-daemon) -e read=6 2>&1|grep '| 000'

alternatively you can capture them from the network interface, but this will include other modem information:
tcpdump -i phonet0 -s 0 -w phonet.cap

== Packet Graph ==

| 00000 00 92 01 00 00 00 00 xx 05 00 00 00 09 03 00 10
S------------------- T4 DL S-------------------
| 00010 07 da 07 15 00 xx xx 00 xx xx 00 00 09 02 00 1c
S------------- TL TS -- S----------------
| 00020 xx xx xx xx xx xx xx xx 00 00 xx xx 00 00 08 8b
DL--- DL--- TS S---- S---- ^eph^
| 00030 xx 00 xx xx xx xx xx xx 09 04 00 14 62 7e xx xx
S- DL TS--- DL MS S---------- track SS---
| 00040 xx xx 00 xx xx xx 00 xx 00 xx 00 00 09 05 00 74
DL--- S- TL S- DS S- DS S------------- DL
| 00050 09 00 00 00 00 02 xx xx 00 xx xx xx xx xx 00 00
DL S---------- T4--- MS S- TS--- I TS MI S----
| 00060 00 04 xx xx xx xx xx xx xx xx 00 00 00 xx xx xx
S- T4 T3 TS S- TL TS MS TS MD S------- T4 TS---
| 00070 00 xx xx xx xx xx 00 00 00 xx xx xx 00 03 xx xx
S- TS--- I TS MS S-------- T3 MS MS S- DL TS MS
| 00080 xx xx 00 00 00 xx xx xx 00 xx xx xx xx xx 00 00
TS MD S------- T3 TS MS S- TS--- MS TS MI S----
| 00090 00 xx xx xx 00 03 xx xx xx xx 00 00 00 xx xx xx
S- TS------ S- DL TS MD TS MS S------- TS SS+TS
| 000a0 00 xx xx xx xx xx 00 00 00 xx xx xx 00 xx xx xx
S- TL TS MS TS MD S-------- TS------ S- TL TS MI
| 000b0 xx xx 00 00 00 xx xx xx 00 xx xx xx xx xx 00 00
TS--- S------- TS--- MS S- TS--- MI TS MS S----
| 000c0 09 08 00 0c xx xx xx xx xx xx xx xx
DL----------------------------------

comment2, http://fawanbydaba.jimdo.com achat cialis allemagne, 8]]], http://peaarepelth.soup.io/ achat cialis canada, :OOO, http://adullact.net/tracker/download.php/169/755/7506/2886/how-can-i-get-my-boyfriend-to-last-longer-in-bed-how-can-i-last-longer-during-intercourse-how-can-i-last-longer-sexually-how-can-i-make-my-boyfriend-last-longer-in-bed-how-can-i-prevent-premature-ejaculation.html how can i get my boyfriend to last longer in bed, >:-PPP, http://adullact.net/tracker/download.php/169/755/7507/2888/how-do-you-make-yourself-last-longer-in-bed-how-last-longer-in-bed-naturally-how-long-average-man-last-in-bed-how-long-can-a-girl-last-in-bed-how-long-do-guys-usually-last-in-bed.html how long do guys usually last in bed, 243571, http://beaateshric.jimdo.com commander cialis 20mg, 991660, http://mineaegodrva.eklablog.com acheter cialis canada, hjztlz, http://adullact.net/tracker/download.php/169/755/7513/2921/how-to-get-your-man-to-last-longer-how-to-help-a-man-last-longer-in-bed-how-to-help-him-last-longer-how-to-last-longer-havingsex-how-to-last-longer-in.html how to help him last longer, 8-DDD, http://odeatelotem.eklablog.com acheter cialis moins cher, 5152, http://sabargodina.eklablog.com vente cialis generique, %-), http://adullact.net/tracker/download.php/169/755/7513/2920/how-to-combat-premature-ejaculation-how-to-control-premature-ejaculation-video-how-to-delay-ejaculation-in-men-naturally-how-to-fix-premature-ejaculation-naturally-how-to-get-him-to-last-longer.html how to combat premature ejaculation, 98738, http://gwyanhitnew.jimdo.com cialis original prix, dxtlea, http://adullact.net/tracker/download.php/169/755/7510/2902/premature-ejaculation-program-premature-ejaculation-statistics-premature-ejaculation-stop-premature-ejaculation-test-premature-ejaculation-trainer.html premature ejaculation test, iuqkwa, http://beaateshric.jimdo.com commander cialis achat, tqxo, http://adullact.net/tracker/download.php/169/755/7510/2906/what-causes-premature-ejaculation-in-young-men-what-condoms-make-you-last-longer-what-is-premature-ejaculation-yahoo-what-to-eat-to-last-longer-in-bed-why-cant-i-last-longer-in-bed.html why cant i last longer in bed, ynrytj, http://traacghtyfi.jimdo.com cialis pilule bleue, 817946, http://adullact.net/tracker/download.php/169/755/7511/2908/can-you-get-pregnant-from-premature-ejaculation-does-weed-make-you-last-longer-in-bed-does-working-out-help-you-last-longer-in-bed-does-xanax-make-you-last-longer-in-bed-don%27t-last-long-in-bed.html does working out help you last longer in bed, vkm,

== Packet Analysis ==
*??? = mode: The mode of the fix
*??? = fields: A bitfield representing which items of this tuple contain valid data
*00 = ISI sequence ID (seems to be always 0 for GPS)
*01 = GPS Data Opcode (0x92)
*10,11 = time year
*12 = time month
*13 = time day
*15 = time hour
*16 = time minute
*18,19 = time seconds and milliseconds (in milliseconds)
*1a,1b = *probably* ept: Time accuracy, but *always* 0, so no way to verify
*20,21,22,23 = latitude / 360 * 256*256*256*256
*24,25,26,27 = longitude / 360 * 256*256*256*256
*28 =
*2b,2c = 0590-12a9 (hex)
*2e,2f = eph (cm)
*30 =
*32,33,,36,37 = altitude; ((p32;33) - (p36;37)) / 2 = meters
*(34?,)35 = (double epv: Vertical position accuracy) * 2
*3c,3d = track: Direction of motion in hundredths of a degree
*3e,3f = epd: Track accuracy (in hundredths?)
*42,43 = speed, in centimetres per second
*44,45 = eps: speed accuracy, in centimetres per second
*46,47 = climb: Current rate of climb in cm/s
*48,4a = epc: Climb accuracy, in cm/s

== Protocol Details ==

NOTE: I am counting octets based on zero.

The actual packets are comprised of "sub-packets".
The overall packet has a 12 byte header.
The number of sub-packets is located at octet 8 (and possibly little-endian extended to octet 11).

Each subpacket has a 4 byte header:
* Octet 0 is always 9
* Octet 1 is the subpacket type
* Octet 2 is always 0
* Octet 3 is the length of the subpacket (which includes the subpacket header itself)

Subpacket 2 contains position information:
* Octets 0-3 are the latitude
* Octets 4-7 are the longitude
* Octets 12-15 are "eph" (in centimetres)
* Octets 18-23 are the altitude (and accuracy information)

Subpacket 3 contains date and time information:
* Octets 0-1 are the year
* Octet 2 is the month
* Octet 3 is the day of month
* Octet 5 is the hour
* Octet 6 is the minute
* Octets 8-9 are milliseconds (including seconds)
* Octets 10-11 are the time accuracy

Subpacket 4 contains information on track, speed, and climb:
* Octets 0-1 are track (direction of motion) in cm/sec
* Octets 2-3 are the track accuracy
* Octets 6-7 are the speed in cm/sec
* Octets 8-9 are speed accuracy
* Octets 8-11 are climb in cm/sec
* Octets 12-13 are climb accuracy

Subpacket 5 contains satellite information:
* Octet 0 is the number of sats visible
* Beginning with octet 8, there are series of 12-octet info for each sat visible:
** Octet 1 is the PRN
** Octet 2 is 1 if the sat is being used, and 0 otherwise
** Octets 3-4 are the signal strength
** Octets 6-7 are the elevation
** Octets 8-9 are the azimuth

Subpacket 7 contains information on the GSM cellular network:
** Octets 0-1 contain the Mobile Country Code
** Octets 2-3 contain the Mobile Network Code
** Octets 4-5 contain the Location Area Code
** Octets 6-7 contain the Cell ID

Subpacket 8 contains information on the WCDMA cellular network:
** Octets 0-1 contain the Mobile Country Code
** Octets 2-3 contain the Mobile Network Code
** Octets 4-7 contain the UC ID

== Wireshark ==

[[User:sre|Sebastian Reichel]] writes a lowlevel library to access the N900's modem features and a wireshark plugin to analyze the packages. The information from above is currently only included in the Wireshark Plugin:

* [http://elektranox.org/n900/images/wireshark/04.png Screenshot]
* [https://git.ring0.de/isi-wireshark-plugin/ Plugin]

[http://maemo.org/profile/view/luke-jr Luke Dashjr] wrote small program in C which show GPS data from phonet modem stack.

* [http://luke.dashjr.org/tmp/code/gps2.c gps2.c]

[[Category:N900 Hardware]]

Maemo Wiki Mirror - User contributions [en]

N900 GPS Reverse Engineering