As I wrote I'm testing on devices with integrated traffic receiver. Maybe function work different on different devices. I have found suspicious 0:/.system/fm_sub.bin . I see that firmware is encrypted/scrambled and reading it with decompiler is unpossible any advices from old hands?