Despite all the controversy regarding the widely commented issues of $ingular-AT&T disabling WiFi in the i607, I decided to do some research on my own, this is what I have found so far:
The first thing I have done is to get the internal pictures from the FCC, I have not disassembled the phone, but I am pretty sure some of you guys have done that and maybe with better definition pictures.
comparing the pictures with the schematic and block diagrams I have found here:
http://rapi .co...l_1221.pdf.html (you all know what the "+"s mean)
I came to the conclusion that the IC in the corner marked MOD205 in the I600 schematic (the WiFi module), also exists in the i607.
Then I had the need to try this hypothesis out. So looking for utilities I found wtestlauncher.exe in the ROM dumps for i600, you can grab a copy here:
Running the utility in the i607 does nothing when you select WiFi, however diagnoses your Bluetooth.
Nothing strange so far, if the WiFi module is there it may not have the device drivers in place. Next question is: What those device drivers are? Back to the schematic in the i600. According to it this module is labeled SWL-2560S, and the purpose of it is disclosed here:
Next I wanted to see what the firmware for i600 does in my i607, and I heard the stories of apocalypses narrated by other fellow members, I though the best way to deal with it is to get the utility that flashes the sections separately, you can grab a copy from here:
To get the individual pda ROM from the upgrade file for the latest i600 unbranded (XXGD1), I used an HEX editor, knowing the PDA ROM starts with HEX 4230303046460A0000 and the phone ROM starts with HEX 060000EA3B00EA3B00 … , when located these code boundaries I was able to practicate surgery and extract out the pda ROM, using the above utility I flashed just this portion in the i607
With this arrangement the phone works perfect, the boot loader remains intact, so you can re-flash back if you want.
There are some things that do not work:
- Vibrator motor
So I run the utility wtestlauncher.exe (this version of PDA ROM has it under the windows directory) and this is what came out:
Build:Oct 24 2006 18:46:27
UART path to PDA - 2
SEMCO Library binding failed
MAC ADDRESS : 000278f0f0f0
Port(COM2:38400) is inititialized
READY read command
Message log dump complete.
SEMCO stands for Samsung Electro Mechanics Co.
Now, guys: Where do you think the MAC address come from??? If there is no device this MAC address will never show! The utility has queried the MAC address via a device driver! A quick look at the first 3 octets at http://standards.iee...search?00-02-78 gives this info:
00-02-78 (hex) Samsung Electro-Mechanics Co., Ltd.
000278 (base 16) Samsung Electro-Mechanics Co., Ltd.
Suwon Suwon KOREA
KOREA, REPUBLIC OF
Any doubts now? This PDA ROM (i600) has a device driver, and the name is SWLD25SPT-T1710.dll. A look with pget from itsutils at http://wiki.xda-deve...gename=XdaUtils shows it is loaded in memory and the utility reports the library is not binding, probably to the protocol or the transport layer. It has dependencies to CEDDK.DLL, CCCORE.DLL, which are also present. Maybe is a problem of registry settings, I am trying to find. The same thing may happen to camera and vibrator. I will continue with this research and keep you posted. I invite all other forum members with WM SDK, programming and other skills to join this thread and help the Reverse Engineering process.
Edited by trinca, 17 July 2007 - 02:44 AM.