AP-BP comms

[Patrick Roberts]

--- Florent THIERY <fthiery at gmail.com> wrote:

> Isn't it possible to "sniff" the AT commands sent by
> EZX phoning apps on the
> original motorola firmware? like destroying the
> /dev/tty, creating another
> one piping into our logger, and finally sending it
> back to the BP?
> 

  On my E2, selinux locks me out of creating nodes in
/dev (although I can create them in /tmp).

  I did a little RE on the libezxtapi.so, and the
user-land tapi client uses a pair of UDP sockets to
communicate with the BP (maybe indirectly?).  Am I
correct in assuming that the server software is
running on the AP as well, or could it be connecting
to something on the BP? 

  It may do some ioctl on three of the /dev/mux
devices.  Ioctl is imported and the data segment has
three /dev/mux devices.  I haven't found routines
where that's used yet.   (Interestingly, there's a
routine related to subsidy lock.)


> I'm getting a phone (normally) this week.
> 
> Regards
> 
> Florent
> 
> On 12/3/06, Patrick Roberts <proberts9999 at yahoo.com>
> wrote:
> >
> >
> >   This may not have been what you guys were
> looking
> > for, but I sent that AT+ command to all the tty
> (and
> > mux) devices on my phone and none returned
> anything
> > useful.  (was done with c open/write/read.)
> >
> >   I've started a little RE on the ezxtapi lib. 
> I'll
> > let you know if I find anything.
> >
> > -Pat
> >
> >
> >
> >
> >
> >
> >
> >
>
____________________________________________________________________________________
> > Cheap talk?
> > Check out Yahoo! Messenger's low PC-to-Phone call
> rates.
> > http://voice.yahoo.com
> >
> >
> 



 
____________________________________________________________________________________
Cheap talk?
Check out Yahoo! Messenger's low PC-to-Phone call rates.
http://voice.yahoo.com