The NDA document from OEM is still not enough to know the whole chip design. Since the current RTLSDR is using "debug mode", this is not original purpose for TV. I was working in MediaTek this company (In Taiwan, going to IC company is the best choices for us such as MediaTek, RealTek, Nova and MStar). Now I am in USA using GNURadio + SDR to design communication device for HCI or communication purpose. Why it's hard to get those document from RTK (RealTek) is those document you are asking for will have the person name whoever access it. So if the document is compromised, the person who give you will get in trouble. In addition, not all RTL engineer can access that document. Only the engineers in that DTV, small size TV group can access those core documents. So even I have lots of classmate in there and I am still hard to get those information. Back to this topic, one thing I concern is the crystal part. Since different dongle will use individual crystal, the sampling period and time duration between each sample will degrade the performance. Light speed is very fast such that for any non sycn sampling period may result in the error range up to 1~10KM. Even you use the additional GPS signal to assist the sample allocation, the problem still exist. The reason is the time period between each sample is not constant( There is deviation for the time duration between each sample decided by crystal stability). Then, different dongle will have different time duration between each sample. Hence, it is very hard to put together. My suggestion is using a TCXO as clock source to supply all dongles as coherent receiver where there sampling time period will be from the same clock source. Another suggestion is you can also search SDR from other famous communication conference Sigcomm, MobiCom, NSDI and so on. There are lots of people in those conference trying to design wireless system for "Localization/Tracking" problem through ToA/DTOA approach. You can see how they achieve this goal.