UNLOCKING CDMA I910 GPS - please help us!

[Guest JASTECH]

I was asked for more information on the law suit against Verizon. Here it is boys/girls.

Thanks, JASTECH ô¿ô

Verizon_class_action_law_suit.pdf

[Guest somedude]

Okay, so lets say that we cant find a way to get the gps enabled.

Do you guys think theres anyway we could crack vz navigator without paying the monthly fee?

[Guest waraey]

Its a shame that the guy who cracked the gps(Skywing?) doesnt want to help us. I think hes the only one who can do it.

-Sigh-, i guess ill be buying a external bluetooth gps receiver.

The provided paper Skywing created is actually a great start. I do have a Masters in C.S. but, the document is very easy to read. All the necessary calls to the proper library's are mentioned and detailed. He even basically tells us how to calculate the authentication keys.

It seems like someone could start up an open source project for this and I bet it would progress quite quickly.

I have never developed for WinMo but I doubt it can be that hard to get an SDK for it.

If I had an omnia (may soon be getting one), I would certainly contribute to a project such as this.

[Guest QRULEZ]

The provided paper Skywing created is actually a great start. I do have a Masters in C.S. but, the document is very easy to read. All the necessary calls to the proper library's are mentioned and detailed. He even basically tells us how to calculate the authentication keys.

It seems like someone could start up an open source project for this and I bet it would progress quite quickly.

I have never developed for WinMo but I doubt it can be that hard to get an SDK for it.

If I had an omnia (may soon be getting one), I would certainly contribute to a project such as this.

I say we start a donation pool for Waraey so that he can get an Omnia and crack this thing. Do you have a paypal account Waraey? I got money on it if Waraey is in it to win it. Anyone else in?

[Guest Cixelyn]

It seems like someone could start up an open source project for this and I bet it would progress quite quickly.

I have never developed for WinMo but I doubt it can be that hard to get an SDK for it.

If I had an omnia (may soon be getting one), I would certainly contribute to a project such as this.

Ditto here. WinMo is hardly my area of expertise, but I wouldn't mind having a crack at it whenever I get both an omnia and some time.

@ waraey:

The SDK is freely available. Here are some links I quickly dug up

Windows Mobile 6 SDK

Microsoft Device Emulator 3.0

Windows Mobile MSDN Hub

You will need VS2005 Standard Edition or above to get everything to work though, which is annoying.

University students however can get access to VS2008 Professional for free through the Microsoft Dreamspark program. So anyone who's eligible should definitely check that out.

Cheers,

Cix

Edited December 9, 2008 by Cixelyn

[Guest somedude]

Ditto here. WinMo is hardly my area of expertise, but I wouldn't mind having a crack at it whenever I get both an omnia and some time.

@ waraey:

The SDK is freely available. Here are some links I quickly dug up

Windows Mobile 6 SDK

Microsoft Device Emulator 3.0

Windows Mobile MSDN Hub

You will need VS2005 Standard Edition or above to get everything to work though, which is annoying.

University students however can get access to VS2008 Professional for free through the Microsoft Dreamspark program. So anyone who's eligible should definitely check that out.

Cheers,

Cix

i have some programming experience, but none with the win mo sdk. I can take a look at it over christmas break but im not sure what i can do.

I want revenge on verizon so bad and hopefully that can drive me enough to figure this out!

Edited December 10, 2008 by somedude

[Guest Apo11on]

I was asked for more information on the law suit against Verizon. Here it is boys/girls.

Thanks, JASTECH ô¿ô

Thanks for the document, it's a great start for those like me, who consider seeking legal help against Verizon. This doc is about the exact same GPS issue, but unfortunately not about the same device - this lawsuit is for BlackBerry 8830, which according to the contents was advertised by Verizon as "unaltered" and with "built-in GPS". They have learned from their mistakes and if you go to Verizon's webpage about Samsung Omnia SCH-i910 you won't find anywhere "unaltered" and "built-in GPS" being mentioned. It does list VZ Navigator program for LBS "Location Based Services" in the list of available services. The only reference on to "built-in GPS" and "GPS Navigation" feature can be found on official Samsung Mobile USA website. I'm going to have to consult a lawyer and see how that could be useful, but the situation is definitly different from that lawsuit this time around.

[Guest Apo11on]

Alright guys, there seem to be several fundamental misconceptions in this thread. From what I've read and gathered, this issue is not a simple registry hack, and monitoring the registry is not going to work at all. We may as well let that rest. The issue is much more complex and lies in a ) enabling the GPS driver, and b ) communicating properly with the GPS driver.

I'll give a brief overview of the problem here: from previous posters in the thread, running VZNav allows other applications to at least see the GPS device -- this is highly reminiscent of the problems on the x6800. The first problem is that the GPS starts off locked. It can be unlocked by sending a specific challenge-response sequence to the driver to initialize it. This must also be constantly sent back and forth every so often to ensure that the GPS remains unlocked. The next problem is that once the GPS is unlocked, it would be too easy for any other application to access the data (eg: you could just run vznav in the background and then pull up tomtom or something to that effect). So verizon has also encrypted the GPS output. This output needs to be decrypted in order to be used properly.

For us to use the GPS, what needs to happen is that a proxy dll needs to be written in order to intercept the various calls made by programs wanting to access the GPS. It would then translate those calls into ones that work with verizon's secret protocol. Then, the proxy needs also be able to receive location data from the gps and translate it back into something the applications can use.

If i recall correctly, in a previous post Skywing has even come out himself and told us that the methodology is the same, but some of the timings are different in the gps communications. I would imagine that if he is either not willing to help us or won't release his source code, then short of building a custom frankenstein zombie rom, some entrepreneurial individual will have to go in with a debugger, redo all the hard work themselves, and then build a proxy app for everyone to use. (Hey, look at it as a chance to practice your reverse engineering skills / build a little fame. B) )

I'd love to help out, but I don't have an Omnia.

For the more tech-oriented, I've attached the original x6800 exploit paper. For anyone with a computer science background, the steps necessary are laid out pretty clear. Hopefully someone can get something out of this.

Cheers,

Cix

there are several other Omnia's on the market now, including CDMA ones (2 korean and 1 japanese). As far as I know - none of them have GPS crippled and they have same GPS radio chip and running same OS. Instead of going through all that trouble of having to decode Verizon's encryption for GPS output, building proxy dll and custom application to interface between proxy and GPS software, which is one of the approaches to take - do you think it'd be possible to dump the radio firmware from both, Verizon's locked GPS and unlocked device, do some reversing and maybe isolate the modified part, where Verizon crippled the GPS, to be in locked state and require handshake authentication periodically? I dont think they had to modify the firmare that much to do what they did, they probably patched 3-4 routines in the radio firmware to remain in locked state unless specific token is sent to unlock it. I mean unlike x6800 we have an advantage here of having exact same devices hardware and OS wise, with unlocked GPS. Think about it - GSM model i900 has been out for half year since June - why would Samsung need to do any modifications for GPS radio firmware on sch-i910, if it runs on same hardware, same OS and offers the same functionality? If we could just isolate the GPS radio part and create standalone image for it from another model -this could be the trick...

[Guest aleis]

there are several other Omnia's on the market now, including CDMA ones (2 korean and 1 japanese). As far as I know - none of them have GPS crippled and they have same GPS radio chip and running same OS. Instead of going through all that trouble of having to decode Verizon's encryption for GPS output, building proxy dll and custom application to interface between proxy and GPS software, which is one of the approaches to take - do you think it'd be possible to dump the radio firmware from both, Verizon's locked GPS and unlocked device, do some reversing and maybe isolate the modified part, where Verizon crippled the GPS, to be in locked state and require handshake authentication periodically? I dont think they had to modify the firmare that much to do what they did, they probably patched 3-4 routines in the radio firmware to remain in locked state unless specific token is sent to unlock it. I mean unlike x6800 we have an advantage here of having exact same devices hardware and OS wise, with unlocked GPS. Think about it - GSM model i900 has been out for half year since June - why would Samsung need to do any modifications for GPS radio firmware on sch-i910, if it runs on same hardware, same OS and offers the same functionality? If we could just isolate the GPS radio part and create standalone image for it from another model -this could be the trick...

so what do we need to do?

get on korean sites and ask for there radios?

im open for that...

let me know and i`ll start tonight 12/9/08

[Guest paradizelost]

I'm speaking with verizon, and the techs seem to refuse to say that the GPS is locked down to VZNavigator, but they insist it's an issue with Google Maps and/or Microsoft Live search, that the GPS isn't working. what a load of crap.

[Guest paradizelost]

I would be willing to pony up a little $$ to get this working as well.

[Guest aleis]

I'm speaking with verizon, and the techs seem to refuse to say that the GPS is locked down to VZNavigator, but they insist it's an issue with Google Maps and/or Microsoft Live search, that the GPS isn't working. what a load of crap.

hmm...could we be barkin up the wrong tree??

i`ve actually heard this before...

besides, if we were to pester google and m$ maybe we could get some more information on the "lock/disablement" B)

[Guest cognos74]

also, we are able to now get the GPS settings icon to appear in settings B)

it just apparently is not giving us a GPS satelite lock.

starting to get nervous that the receiver chip is actually not present on the device B)

Hi, how were you able to get the gps settings icon to appear?

[Guest JASTECH]

I know this has sure put a lot of VZ customers at odds with them. I spoke to the attorney that has the Class Action Suit against VZ via the Blackberry 8830 and he can't add the Omnia to the ongoing case but is interested in the Omnia case and was asking a lot of questions. I think he will investigate it a bit and see if there is any legal grounds for us. He has my contact information. Anybody would like his then call the office on the pdf file I uploaded.

Thanks, JASTECH ô¿ô

[Guest raza1]

4th - Start TomTom OUTSIDE (under the clear sky) and within 20 - 30 secs the program catches the satellites (they show up on the configure screen). But not only that - after 1-2 minutes the software actually CONNECTS to the satellites (the satellites turn BLUE) and in the front screen it says - no route planned! Note: You Must Wait Until The Front Screen Says "No Rote Planned" and the map is in color (opposed to black and white) before you start setting your destination, otherwise it will keep on hanging and just showing you the satellites in grey without ever turning into blue.

Thanks, JASTECH ô¿ô

Tried it for 4 times but doesn't work for me with TomTom. But I heard it's a rom issue because other people managed to make it work this way.

My rom; i900 XKHG5/ARHG5 vodafone

But with GPSproxy it works like a charm. Put both programs under the soft buttons and I can prepare a new route within 30 seconds. I like it like this because I use it a lot as a courier!

Edited December 10, 2008 by raza1

[Guest rapcon]

Hi, how were you able to get the gps settings icon to appear?

The chip is there, it is just crippled for the moment. To answer you question about the settings. Using a registry editor find the following:

HKLM/ControlPanel/GpsSettings

Delete the "redirect" registry entry

Create a DWORD entry name "group" with a value of "2". (Do not use the quotes)

Reboot

[Guest paradizelost]

I got a reply from the verizon rep after she spoke with trainers and samsung. they are all unable to get GPS to work with Google maps, suggested talking to google, and otherwise, it could be that the GPS is locked to VZNavigator. I find it difficult to believe that no one there even knows for sure if it is locked or not.

[Guest mstnggt500kr]

I got a reply from the verizon rep after she spoke with trainers and samsung. they are all unable to get GPS to work with Google maps, suggested talking to google, and otherwise, it could be that the GPS is locked to VZNavigator. I find it difficult to believe that no one there even knows for sure if it is locked or not.

According to the mail I received, the GPS is locked to only work with VZNavigator.

Dear Nicholas Trujillo,

Thank you for contacting Verizon Wireless through our website. My name is Jeremiah and I will be happy to address your concerns regarding the GPS functionality on your Samsung Omnia.

New and emerging technologies, such as location-based services, provide great opportunities to increase efficiencies, decrease costs and simplify processes. Implementation of these new technologies and services can vary based on many factors including the strategy, goals and policies that drive the business.

At Verizon Wireless we value the security and privacy of our subscriber data and user information and we have taken this into account in the development of our location-based services, which include GPS (Global Positioning Services) functionality. To alleviate concerns regarding access to data by malicious applications and misuse of location information, Verizon Wireless' location-based services utilize a solution that requires each location request to be authenticated and accepted prior to a user's location being obtained through the network and used by authorized applications. This solution requires the use of a custom security API (Application Programming Interface) by authorized applications in order to minimize the potential for "man in the middle" attacks and misuse of information by "bad actors.”

Verizon Wireless is aggressively working to expand its suite of location-based services in a way that does not compromise our dedication to privacy and security while still offering value and flexibility to the customer.

Nicholas, I apologize for any inconvenience that this may cause you but assure you that we are working to expand the availability of GPS solutions on our devices. We appreciate your business and thank you for using Verizon Wireless products and services. Should you have additional questions or concerns, please reply to this e-mail.

Sincerely,

Jeremiah

Verizon Wireless

Customer Service

If you have received this e-mail in error or are not the intended recipient, please notify us immediately by replying to this e-mail and deleting it and all copies and backups thereof. If you are the intended recipient and are a Verizon Wireless customer, this response is subject to the terms of your Customer Agreement.

[Guest paradizelost]

well thats a bunch of crap. give me a choice. ask me "do you want to allow this 3rd party unauthorized software to access your gps data" don't just block it GRRRR

[Guest Nvious]

"Nicholas, I apologize for any inconvenience that this may cause you but assure you that we are working to expand the availability of GPS solutions on our devices."

This is the second verizon rep I have seen confirm that they are actually working to unlock/expand for other applications. Another forum I stumbled across had a member say that his "friend" working for verizon said they were working at unlocking it and there would be an update soon [i will try to find the link]. I would be willing to bet my omnia that we aren't the only one harassing them over this and companies like TomTom and other gps programs have contacted verizon about this.

While this is frustrating to have these features locked and controlled closely they are not wrong in doing so. Verizon does contract quite a large portion of government phones and are very careful with their security on all phones.

P.S. I am happy to call this place my new winmo forum home, by far the best and most supportive of all the forums I have frequented since I purchased my Omnia. B) /wave

Edited December 10, 2008 by Nvious

[Guest Apo11on]

While this is frustrating to have these features locked and controlled closely they are not wrong in doing so. Verizon does contract quite a large portion of government phones and are very careful with their security on all phones.

I believe security has little to do with locking the GPS radio in this case. You have to understand there are 2 GPS methods involved here:

1) Regular global positioning system through satellite, which does NOT require a carrier nor data connection - same way regular standalone GPS units work - you dont have to connect it to phone service for it to work

2) Enhanced GPS aka A-GPS, which uses cell tower triangulation method and locates your phone through satellite towers, to get a faster lock on your current location - this one does require being connected to a carrier and uses data.

You have to understand without A-GPS your TomTom or whatever you use will work fine, it's just that a lock on your location would take 25-30 seconds in most cases, while A-GPS only speeds that up by approximately 3x factor.

My point is - if Verizon wasn't greedy and didnt have money as main reason to lock the GPS radio - they could have just disabled A-GPS, while leaving regular GPS working and by that they would be cutting off any security bridges, as regular GPS would not require a carrier and has nothing to do with their data connection

[Guest Nvious]

Roger that Apo11on. Verizon is more than likely both fearful of a loophole being found in the Agps and it being exploited as well as being greedy sob's. B)

Heres a link to another site where someone mentioned talking to a rep about the gps being locked.

"I spoke with a Verizon rep who said that a software update was going to come out in the next few weeks to unlock the both the GPS on the Touch Pro & the Omnia!" Dated 12/8/08

Last Post - http://www.howardforums.com/showthread.php?t=1464054

I hope this isn't just hearsay but with 3 seperate accounts of people talking to Verizon reps and hearing that they are working towards an unlock it could very well be in the works.

/crosses fingers

Edited December 10, 2008 by Nvious

[Guest somedude]

thats right, lets keep harassing verizon. Maybe we will get lucky with a new firmware update. I think im going to send emails and call every day. IF everyone in this forum can do the same maybe they will change their policy.

keep emailing this guy!

[email protected]

[Guest krelvinaz]

At Verizon Wireless we value the security and privacy of our subscriber data and user information and we have taken this into account in the development of our location-based services, which include GPS (Global Positioning Services) functionality. To alleviate concerns regarding access to data by malicious applications and misuse of location information, ...

Doesn't Verizon sell their subscriber lists to 3rd parties unless you happen to know you need to opt out? With the Opt out info basically a well kept secret unless you happen to have heard about it else where.

Seems like a double standard spoken in double speak.

When I played with VZNavigator, it did ask for authorization for a period of time, but the application was a POS. Anytime it had an issue it basically said an error occurred and just shutdown. It failed to work the first couple days after I had "subscribed" and then when it did work, the interface was nothing like one would be used to using Google Maps or Live Search.

Imagine some of the other real navigation programs doing that... opps, we lost the GPS signal, Crash...

Poorly constructed and implemented and if the security was really the issue, wouldn't they like publish that somewhere is plain sight so people know what their "Policy" was.

[Guest aleis]

TO GET YOU ALL MORE SIKED:

google mobile now has street view!

update at google.com/gmm B) B)