the omap gsm part

the omap based phones are easiest to experiment with, the xda-1 and xda-2 are predecessors which are somewhat different, but use a similar code base. both gsm stacks were created by condat/TI. source code of an old version of the gsm stack can be found in the .iso file on this page ( or google for plabs+gsm ) from that source code i could find the locations of many interesting internal data structures in memory. on the omap phones the gsm uses a shared memory area with the windows ce part to communicate, and load code. so you can modify code and data while the device is running. some tips for reverse engineering the gsm rom