[SingularSpartan]

I'm using QPST 2.7 Build 264.

[JRSCCivic98]

Originally Posted by SingularSpartan

I've got VZNav installed, and I get the following info running QPST:

PDE IP Address:
0.0.0.0
PDE Port Number
4911
PDE Transport:
IP
Position Calculation:
Blank (could choose either "Mobile" or "PDE", but none selected)

Same settings I had stock. Well, it looks like VZNav passes the PDE IP and Port itself as it runs. That's going to make it even harder to get the PDE.

Did you specifically "Read From Phone" while you had VZNav in the "Follow Me" map. Reason I ask is because there was a person that reported that if they have VZNav on that screen they could ALT+ESC and run Google Maps and it would locate them properly. However, if that's true, Google Maps must be just grabbing the already open network tunnel that VZNav opened up to the PDE.

[SingularSpartan]

Tried it while running the "Follow Me Map," but got the same results. I also can't get Google Maps to correctly spot me using Alt-Esc.

[dillyyo]

bump

[dagr8tim]

Originally Posted by dillyyo

bump

Rather than bump this thread once a week. Why not try to figure it out for yourself and report back with your findings?

[dillyyo]

Originally Posted by dagr8tim

Rather than bump this thread once a week. Why not try to figure it out for yourself and report back with your findings?

Because I am not technically savvy or educated enough to contribute, but also do not want it to die and be forgotten. Believe me, if I could contribute, I would.

[jsntrenkler]

Originally Posted by dagr8tim

Rather than bump this thread once a week. Why not try to figure it out for yourself and report back with your findings?

Perhaps you see Bumping a thread as a bad thing ....

Bump is forum speak for moving a thread to the top of a give forum (and hence being more likely to be noticed by other users).

For the most part a bump after a day or two of not getting much of a response is ok, but continual bumping is silly.

[dagr8tim]

Originally Posted by jsntrenkler

Perhaps you see Bumping a thread as a bad thing ....

Bump is forum speak for moving a thread to the top of a give forum (and hence being more likely to be noticed by other users).

For the most part a bump after a day or two of not getting much of a response is ok, but continual bumping is silly.

I am fully aware of how/why bumping works. My issue is when bumping is used to keep a dead thread from going where all dead threads go.

Now, rather than ruining what could be a very useful thread into a flame war. Why not tell me how to unsubscribe to this thread so I don't get topic replies when somebody bumps this thread.

[cohen]

I have been working on this a bit as well. A few interesting things that I have found lead me to believe that it might be very hard if not impossible to unblock the GPS functionality on the device.

Following Chernobyl's findings using QPST, I have tried to find the IP addresses of different PDE servers and load those to my phone with QPST. To be expected, this did not repair the GPS functionality, though I did get some interesting results.

The first time I changed the PDE settings, after rebooting the phone and running google maps, I was getting locations that were completely off - like 10 to 15 miles away from my actual location, and the location kept changing every few seconds (jumping distances of several miles) - I am located in Queens, NY and my location was showing up in Manhattan and even New Jersey. I had full reception on the phone and I was in a location that I had used with google maps before, and I was getting a reasonable estimation of my position before changing the PDE address. Anyway, after about 2 or 3 minutes this returned to normal and google maps estimated my location such that my actual position fell well within the 1700 meters tolerance. This may have just been a fluke, but it also might have had something to do with the PDE.

The other interesting, and perhaps more disturbing thing, I found when I examined the error log of the phone. You can get to the error log by holding down the alt key and then pressing L G L G. The two interesting errors I got were:

a System - CMM: GoogleMaps(3938) no sig from 0x33
and
a Location API - Application must set valid PDE IP and port to get location

I'm more interested in the first error than the second, because the chipset in the blackberry (the Qualcomm MSM6550 uses GpsOne, which is capable of autonomous operation, which means that we should be able to use GPS without a PDE - though if we could find the address for a valid one it would be convenient)

The first error deals with API signatures. The developers on this forum are likely familiar with the method by which RIM secures certiain J2ME APIs on the blackberry by means of digital certificates.

However, on RIMs developer website, it says that the location API is not secured, so I'm not entirely sure that it is the location API that generates this error message. But it is likely that it is the location API - most probably, Verizon had Blackberry secure this with a different developer key than is used to secure the other APIs.

If it is secured with a digital certificate, it will be very hard, and probably unpractical to unlock. Much of the prior work done regarding blackberry hacking has involved trying to circumvent the hash verification and crypto modules that are used to ensure firmware integrity and control access to secured APIs, and people have been entirely unsuccessful as far as I know.

Another interesting thing was the fact that the error was supressed. Somebody with more experience with this please correct me if I am wrong, but as far as I know, all errors regarding applications not having permission to access secured APIs usually pop up as dialog boxes on the screen, this was supressed and it only appears in the error log.

Anyway, within the next two weeks I will create a sourceforge project or maybe a wiki so that we will have some sort of central repository for information - as of now all of the research is split between a few different threads on here, crackberry and a few other forums.

I'd like to hear more about anything else others have done. For me, my next goal is to try to find a way to dump the memory on the BB, if we can find a way to get a complete image of the flash RAM, then we can look at the OS and the rest of memory. As far as I know, nobody has figured out how to do this yet - but if somebody knows how, please let me know.

Without being able to dump the memory, we are limited to examining only the OS files that we can download online, and whatever we can get with either Blackberry Desktop and QPST - but, as you know, this is far from a complete memory image - there are other parts of memory that we would need to examine, especially since, as people have reported, installing the sprint operating system doesn't enable anything, so there are other parts in memory that aren't touched when a new OS is installed.

So, if anybody knows how to access the memory and take an image, please let us know.

Looking forward to hearing more. Keep posting, or if you have more specific questions, send me an email.

[dagr8tim]

On a slightly side note, has anyone noticed that google maps uses cell triangulation? I installed google maps yesterday and discovered I can get to within 1700 meters (usually ALOT closer) of my actual location.

[Chernobyl]

Originally Posted by cohen

<snip>

The other interesting, and perhaps more disturbing thing, I found when I examined the error log of the phone. You can get to the error log by holding down the alt key and then pressing L G L G. The two interesting errors I got were:

a System - CMM: GoogleMaps(3938) no sig from 0x33
and
a Location API - Application must set valid PDE IP and port to get location

<snip>

Those "errors" are a red herring. I get the exact same entries on my fully GPS-functional 8830 anytime a call is made to the location API.

I know, it doesn't make any sense, but it is true. I get a position that is accurate to within 10 metres or so, after my device does its little "secret handshake" with the TELUS PDE. If I look in the event log afterwards - I see those two entries.

As for dumping the device memory, you can use the RIM JDE to attach to the device using the debugger and take control over the handheld. You can dump the Java VM "objects" to a file, but I don't see anywhere that you can do a raw memory dump.

[John Clark]

Originally Posted by dagr8tim

On a slightly side note, has anyone noticed that google maps uses cell triangulation? I installed google maps yesterday and discovered I can get to within 1700 meters (usually ALOT closer) of my actual location.

Yes. There is a Google Maps thread in the GPS & Mapping forum discussing the new features.

[cohen]

thats very interesting that those errors pop up even on GPS enabled phones with Google maps.

do they also pop up if you use BB maps for GPS?

I will fool around with debug mode in the JDE tonight and see what I can do, however, just dumping the jvm classes might not yield much.

[s4bill]

I thought I read somewhere that Verizon will enable the GPS for third party software by the end of the year.

We are at a new year and that doesn't appear to be the case.

Has anyone heard of this rumor?

[tarran]

I talked with a customer "support" person a couple of days ago and was told that they "do not allow programs that have not been shown to be safe for the verizon network". This was after I asked him if they would be able to unlock my gps if I paid them more money which he told me they would. At least I got an honest rep that admitted they'll give you access with their programs if you pay them more money. For now I'll use the triangulation and hope for someone to crack so I can use an included feature of this otherwise great phone.

[dillyyo]

Originally Posted by cohen

I have been working on this a bit as well. A few interesting things that I have found lead me to believe that it might be very hard if not impossible to unblock the GPS functionality on the device.

Following Chernobyl's findings using QPST, I have tried to find the IP addresses of different PDE servers and load those to my phone with QPST. To be expected, this did not repair the GPS functionality, though I did get some interesting results.

The first time I changed the PDE settings, after rebooting the phone and running google maps, I was getting locations that were completely off - like 10 to 15 miles away from my actual location, and the location kept changing every few seconds (jumping distances of several miles) - I am located in Queens, NY and my location was showing up in Manhattan and even New Jersey. I had full reception on the phone and I was in a location that I had used with google maps before, and I was getting a reasonable estimation of my position before changing the PDE address. Anyway, after about 2 or 3 minutes this returned to normal and google maps estimated my location such that my actual position fell well within the 1700 meters tolerance. This may have just been a fluke, but it also might have had something to do with the PDE.

The other interesting, and perhaps more disturbing thing, I found when I examined the error log of the phone. You can get to the error log by holding down the alt key and then pressing L G L G. The two interesting errors I got were:

a System - CMM: GoogleMaps(3938) no sig from 0x33
and
a Location API - Application must set valid PDE IP and port to get location

I'm more interested in the first error than the second, because the chipset in the blackberry (the Qualcomm MSM6550 uses GpsOne, which is capable of autonomous operation, which means that we should be able to use GPS without a PDE - though if we could find the address for a valid one it would be convenient)

The first error deals with API signatures. The developers on this forum are likely familiar with the method by which RIM secures certiain J2ME APIs on the blackberry by means of digital certificates.

However, on RIMs developer website, it says that the location API is not secured, so I'm not entirely sure that it is the location API that generates this error message. But it is likely that it is the location API - most probably, Verizon had Blackberry secure this with a different developer key than is used to secure the other APIs.

If it is secured with a digital certificate, it will be very hard, and probably unpractical to unlock. Much of the prior work done regarding blackberry hacking has involved trying to circumvent the hash verification and crypto modules that are used to ensure firmware integrity and control access to secured APIs, and people have been entirely unsuccessful as far as I know.

Another interesting thing was the fact that the error was supressed. Somebody with more experience with this please correct me if I am wrong, but as far as I know, all errors regarding applications not having permission to access secured APIs usually pop up as dialog boxes on the screen, this was supressed and it only appears in the error log.

Anyway, within the next two weeks I will create a sourceforge project or maybe a wiki so that we will have some sort of central repository for information - as of now all of the research is split between a few different threads on here, crackberry and a few other forums.

I'd like to hear more about anything else others have done. For me, my next goal is to try to find a way to dump the memory on the BB, if we can find a way to get a complete image of the flash RAM, then we can look at the OS and the rest of memory. As far as I know, nobody has figured out how to do this yet - but if somebody knows how, please let me know.

Without being able to dump the memory, we are limited to examining only the OS files that we can download online, and whatever we can get with either Blackberry Desktop and QPST - but, as you know, this is far from a complete memory image - there are other parts of memory that we would need to examine, especially since, as people have reported, installing the sprint operating system doesn't enable anything, so there are other parts in memory that aren't touched when a new OS is installed.

So, if anybody knows how to access the memory and take an image, please let us know.

Looking forward to hearing more. Keep posting, or if you have more specific questions, send me an email.

Would you kindly tell me where or the names of these threads as I would like to read through them. Although not programming adept, I still like to learn.

[cohen]

sorry, ive been super duper busy. hopefully ill get around to it within the next few days.

you can check out crackberry, howardforums and pinstack to start though.

[kocoman]

What is the IP Address? 216.198.139.113 According to Telus's site..

client care / PCS / how to use network features / navigator - getting started - TELUS Mobility

is that a proxy address for blackberry or its PDE IP Address?

"Bell PDE and LSB servers. You need a special IP address to access PDE"

What is the special IP address?

[hanhao]

anybody tried this? will it work?

the GPS won't communicate with PDE server then. thus a stand-alone mode?

PDE IP = 0.0.0.0
PDE Port number = null
PDE Transport = DBM
Position Calculation = PDE/Mobile

[hanhao]

Originally Posted by cohen

I have been working on this a bit as well. A few interesting things that I have found lead me to believe that it might be very hard if not impossible to unblock the GPS functionality on the device.

Following Chernobyl's findings using QPST, I have tried to find the IP addresses of different PDE servers and load those to my phone with QPST. To be expected, this did not repair the GPS functionality, though I did get some interesting results.

The first time I changed the PDE settings, after rebooting the phone and running google maps, I was getting locations that were completely off - like 10 to 15 miles away from my actual location, and the location kept changing every few seconds (jumping distances of several miles) - I am located in Queens, NY and my location was showing up in Manhattan and even New Jersey. I had full reception on the phone and I was in a location that I had used with google maps before, and I was getting a reasonable estimation of my position before changing the PDE address. Anyway, after about 2 or 3 minutes this returned to normal and google maps estimated my location such that my actual position fell well within the 1700 meters tolerance. This may have just been a fluke, but it also might have had something to do with the PDE.

The other interesting, and perhaps more disturbing thing, I found when I examined the error log of the phone. You can get to the error log by holding down the alt key and then pressing L G L G. The two interesting errors I got were:

a System - CMM: GoogleMaps(3938) no sig from 0x33
and
a Location API - Application must set valid PDE IP and port to get location

I'm more interested in the first error than the second, because the chipset in the blackberry (the Qualcomm MSM6550 uses GpsOne, which is capable of autonomous operation, which means that we should be able to use GPS without a PDE - though if we could find the address for a valid one it would be convenient)

The first error deals with API signatures. The developers on this forum are likely familiar with the method by which RIM secures certiain J2ME APIs on the blackberry by means of digital certificates.

However, on RIMs developer website, it says that the location API is not secured, so I'm not entirely sure that it is the location API that generates this error message. But it is likely that it is the location API - most probably, Verizon had Blackberry secure this with a different developer key than is used to secure the other APIs.

If it is secured with a digital certificate, it will be very hard, and probably unpractical to unlock. Much of the prior work done regarding blackberry hacking has involved trying to circumvent the hash verification and crypto modules that are used to ensure firmware integrity and control access to secured APIs, and people have been entirely unsuccessful as far as I know.

Another interesting thing was the fact that the error was supressed. Somebody with more experience with this please correct me if I am wrong, but as far as I know, all errors regarding applications not having permission to access secured APIs usually pop up as dialog boxes on the screen, this was supressed and it only appears in the error log.

Anyway, within the next two weeks I will create a sourceforge project or maybe a wiki so that we will have some sort of central repository for information - as of now all of the research is split between a few different threads on here, crackberry and a few other forums.

I'd like to hear more about anything else others have done. For me, my next goal is to try to find a way to dump the memory on the BB, if we can find a way to get a complete image of the flash RAM, then we can look at the OS and the rest of memory. As far as I know, nobody has figured out how to do this yet - but if somebody knows how, please let me know.

Without being able to dump the memory, we are limited to examining only the OS files that we can download online, and whatever we can get with either Blackberry Desktop and QPST - but, as you know, this is far from a complete memory image - there are other parts of memory that we would need to examine, especially since, as people have reported, installing the sprint operating system doesn't enable anything, so there are other parts in memory that aren't touched when a new OS is installed.

So, if anybody knows how to access the memory and take an image, please let us know.

Looking forward to hearing more. Keep posting, or if you have more specific questions, send me an email.

to access the memory, use UNICDMA