this file was take from gnokii site here whole protocol is given
before this u must decide what u wanna use mbus or fbus
FOR FURTHER HELP U CAN MAIL ME AT
[email protected]
their frame header are given below:
$Id: nokia.txt,v 1.4 2004/01/24 15:35:28 uid68500 Exp $
Document describing protocol used in Nokia phones.
The data provided is for information purposes only.
Some of the frames might be hazardous to your phone. Be careful!!!
We do not take any responsibility or liability for damages, etc.
Last update 29.04.2003
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Assembled by
Balazs Nagy (
[email protected])
Alfred R. Nurnberger <
[email protected]>
Hugh Blemings <
[email protected]>
Mike Bradley <
[email protected]>
Odinokov Serge <
[email protected]>
Pavel Janik <
[email protected]>
Paweł Kot <
[email protected]>
Marcin Wiacek (
[email protected])
Jens Bennfors <
[email protected]>
Michael Hund <
[email protected]>
Jay Bertrand <
[email protected]>
<
[email protected]>
Andrew Kozin
Pavel Machek <
[email protected]>
Diego Betancor <
[email protected]>
Marcel Holtmann <
[email protected]>
... and other members of gnokii mailing list
and authors of some WWW pages.
NOTE: this information isn't (and can't be) complete. If you know anything
about features not listed here or you noticed a bug in this list, please
notify us via e-mail. Thank you.
Frame format for MBUS version 1:
Request from Computer/Answer from Phone:
{ DestDEV, SrcDEV, FrameLength, MsgType, {block}, id, ChkSum }
where DestDEV, SrcDEV: 0x00: phone
0xf8: PC (wakeup msg)
0xe4: PC (normal msg)
FrameLength: length of data frame. Maximal 0x78. Longer
frames are divided into smaller.
MsgType: see List
{block}: main frame
id: request identity number 1..n, incremented after
the request is accepted
ChkSum: XOR on frame's all numbers
Ack from Phone:
{ DestDEV, 0x00, FrameLength, MsgType, {block} , id, ChkSum }
where DestDEV: taken from original request packet
FrameLength: 0x7f, when DestDEV = 0xe4
0x7e, when DestDEV = 0xf8
MsgType: see List. Present only, when DestDEV = 0xf8
{block}: main frame. Present only, when DestDEV = 0xf8
id: request identity number 1..?, corresponding
to the original request packet id
the request is accepted
ChkSum: XOR on frame's all numbers
Update: description above according to the
http://www.gadgets.demon.co.uk/nokia21xx/protocol.html.
Pavel Machek <
[email protected]> wrote:
0x7e is actually registration acknowledge. Both have nothing to do
with DestDEV, except that special device needs to be used for
registration.
Ack from Computer:
{ 0x00, SrcDEV, 0x7f, id, ChkSum }
where SrcDEV: taken from response packet
id: request identity number 1..?, corresponding
to the response packet id
the request is accepted
ChkSum: XOR on frame's all numbers
Port settings:
Speed 9600 bps, Bits 8, ParityOdd, Stop Bits 1, DTR and RTS logic 0
In the MBUS bus, the phone has only one connector for transmition and
reception.
Because of this characteristics of the phone connector, every time that the
PC writes into the phone it is writing as well into its own Rx. So every
time the PC sends info into the phone it finds that same information in its
own Rx buffers, like a mirror copy. This should be discarded.
The communications is made like an old cb radio, only one
talking at a time. Many transmission are made this way:
<computer sends request>
<phone sends ack>
<phone sends response>
<computer sends ack>
Some frames are sent from phone without asking for them
You have to implement collision protocol. IE. you should listen for
what you are transmitting, and if it does not come back, you have
collision.
You should wait for bus to be free for 3 miliseconds before normal
message, and for 2.5 miliseconds before acknowledge. You should wait
for acknowledge for 200 miliseconds, then retransmit.
Frame format for FBUS version 1:
{ FrameID, FrameLength, MsgType, SeqNo, {block}, ChkSum }
where FrameID: 0x01 Command frame from computer to Nokia
0x02 ??? - Data call frame from computer to Nokia - ???
0x03 Data call frame from Nokia to computer
0x04 Command frame from Nokia to computer
FrameLength: {block} + 2
MsgType: see List
SeqNo: Sequence number of command in case where direction is
from ME to computer, the sequence number is
counting from 0x30 to 0x37 and resetting back to 0x30.
Also seqnos 0x00 to 0x07 have been spotted on some
3110s (but not all, maybe different firmware revs?).
When direction is from computer to ME,
sequence number counts from 0x08 to 0x0f and resets back to 0x08.
It may not be required to be this way.
Sequence numbers are used in acknowledging commands.
ChkSum1: CRC = 0;
for (i = 0; i < (2 + CMD_LEN); i++)
CRC ^= frame[i];
Frame format for FBUS version 2/Direct IRDA:
{ FrameID, DestDEV, SrcDEV, MsgType, 0x00, FrameLength, {block}, FramesToGo,
SeqNo, PaddingByte?, ChkSum1, ChkSum2 }
where FrameID: 0x1c: IR / FBUS
0x1e: Serial / FBUS
DestDev, SrcDev: 0x00: mobile phone
0x0c: TE (FBUS) [eg. PC]
MsgType: see List
FrameLength: {block} + 2 (+ 1 if PaddingByte exists)
FramesToGo: 0x01 means the last frame
SeqNo: [0xXY]
X: 4: first block
0: continuing block
Y: sequence number
PaddingByte: 0x00 if FrameLength would be an odd number
anyways it doesn't exists
ChkSum1: XOR on frame's odd numbers
ChkSum2?: XOR on frame's even numbers
Frame format for MBUS version 2:
{ FrameID, DestDEV, SrcDEV, MsgType, FrameLengthLO, FrameLengthHI, {block},
SeqNo, ChkSum }
where FrameID: 0x1f: Serial / M2BUS
DestDev, SrcDev: 0x00: mobile phone
0x1d: TE (M2BUS)
0x10: TE (M2BUS) (Service Software ?)
0x04: Carkit?
0x48: DLR3 cable?
0xF8: unknown target?
0xFF: global target?
MsgType: see List
FrameLength: {block}
SeqNo: sequence number
ChkSum: XOR on frame's all numbers
Please note that M2BUS has only one checksum: XOR on frame[FrameID..SeqNo]
Ack:
{ FrameID, DestDEV, SrcDEV, 0x7f, Id_SeqNo, ChkSum }
where Id_SeqNo: Is the sequence number that you are
acknowleging (from the other part).
Frame format for IrDA:
{ FrameID, DestDEV, SrcDEV, MsgType, FrameLengthLo, FrameLengthHi, {block} }
where FrameID: 0x14
DestDev, SrcDev: 0x00: mobile phone
0x0c: TE [eg. PC]
MsgType: see List
FrameLength: {block}
Frame format for Bluetooth:
{ FrameID, DestDEV, SrcDEV, MsgType, FrameLengthLo, FrameLengthHi, {block} }
where FrameID: 0x19
DestDev, SrcDev: 0x00: mobile phone
0x10: TE [eg. PC]
MsgType: see List
FrameLength: {block}
Frames list format:
hex: Short description
x msg desc { ... }
0xXX -> one byte
0xXXYY -> two bytes (== 0xXX, 0xYY)
where hex: message type
x: s=send (eg. to mobile), r=receive
{ ... }: data after 0x00, 0x01 header
{+... }: raw data (without header)
-------------------------------------------------------------------------------
Misc (about MBUS version 2):
0x4E commands:
(sent from a 5160i TDMA / 6160i TDMA / 6185 CDMA or 7110 GSM
phone to the uC in the DLR-3 cable)
DLR-3 req:
1F 48 00 4E 00 02 01 XX SQ CS
frame sent from the phone to the DLR-3 cable
(after 15kOhm resistor detected betw. XMIC (3) and DGND (9).)
DSR,DCD,CTS flow control data is coded into the 2nd databyte
XX: bit.0=/CTS
bit.1=/DCD
bit.2=CMD/DATA
bit.3=DSR
bit.4-7=0
0x78 / 0x79 commands:
(used by handsfree carkit) Works also on GSM phones (5110 / 6110 / etc)
These commands are used by the Nokia Carkits to switch the phone audio path to
XMiC and XEAR , turn the phone on/off according to the car ignition, and
control the PA loudspeaker amplifier in the carkit and the car radio mute
output which silences the car radio during a call
mute status tone:
1F 04 00 78 00 04 01 02 0E 00 SQ CS
status indication = disable carkit audio amplifier (no audio / no tone)
mute status tone:
1F 04 00 78 00 04 01 02 0E 03 SQ CS
status indication = enable carkit audio amplifier (audio / tone present)
mute status call:
1F 04 00 78 00 04 01 02 07 00 SQ CS
status indication = disable radio mute output (no call)
mute status call:
1F 04 00 78 00 04 01 02 07 01 SQ CS
status indication = enable radio mute output (call active)
enable ???:
1F 04 00 78 00 04 01 02 08 01 SQ CS
status indication = enable ??? sent to HFU-2 on power on
byte 9 (07,08,0E) seems to be a pointer to a memory location,
byte 10 is the data at this memeory location.
response from HFU:
1F 00 04 78 00 03 02 01 03 SQ CS
response message from HFU-2 (use unknown)
go HF and IGN on:
1F 00 04 79 00 05 02 01 01 63 00 SQ CS
enables carkit mode + turns phone on + req. mute status
go HF and IGN off:
1F 00 04 79 00 05 02 01 01 61 00 SQ CS
enables carkit mode + powers phone off (1 min delay) + req. mute status
ext. HS Offhk:
1F 00 04 79 00 05 02 01 01 23 00 SQ CS
enables carkit mode + external handset lifted (OFF-Hook)
ext. HS Onhk:
1F 00 04 79 00 05 02 01 01 63 00 SQ CS
enables carkit mode + external handset put back (ON-Hook)
Ignition and Hook are coded into one byte
bit.0 = 0:on power on 1:when in operation
bit.1 = IGNITION STATUS
bit.2 = x can be 1 or 0
bit.3 = 0
bit.4 = 0
bit.5 = 1
bit.6 = Hook (inverted)
bit.7 = 0
HFU-2 version:
1F 00 04 79 00 12 02 01 02 06 00 56 20 30 36 2E 30 30 0A 48 46 55 32 00 SQ CS
for HFU-2:
1F 04 00 DA 00 02 00 02 SQ CS
function unknown - sent from Nokia phone to HFU-2mute output (call active )
0xD0 commands:
init:
1F 00 1D D0 00 01 04 SQ CS
sent by the Service Software or HFU-2 on startup
init resp:
1F 1D 00 D0 00 01 05 SQ CS
response from phone to above frame
**********8
*******8***
8********
AFTER DECIDING THE PROTOCOL THE MESSAGES TO BE SEND IN THIS WAY
SUPPOS
$Id: nk6110.txt,v 1.22 2005/02/06 20:30:42 pkot Exp $
Assembled by
Balazs Nagy (
[email protected])
Alfred R. Nurnberger <
[email protected]>
Hugh Blemings <
[email protected]>
Mike Bradley <
[email protected]>
Odinokov Serge <
[email protected]>
Pavel Janik <
[email protected]>
Pawel Kot <
[email protected]>
Marcin Wiacek (
[email protected])
Harri Yli-Torkko <
[email protected]>
... and other members of gnokii mailing list
and authors of some WWW pages.
The data provided is for information purposes only.
Some of the frames might be hazardous to your phone. Be careful!!!
We do not take any responsibility or liability for damages, etc.
NOTE: this information isn't (and can't be) complete. If you know anything
about features not listed here or you noticed a bug in this list, please
notify us via e-mail. Thank you.
Document describing frames used in
GSM/PCN Nokia 6110 and derivatives (Nokia 6130, 6150, 6190, 5110, 5130, 5150,
5190, 3210, 3310)
Correct format is FBUS version 2/Direct IRDA/MBUS version 2
(see nokia.txt for protocol details):
List:
0x00: Monitoring values
r monitoring value {+0x01, 0x01, block... }
where block: 0x5e, 0x05, 0x7a(?), 0xd0(?), 0x85(?), 0x02, percentHI, percentLO
Battery percent level
0x5e, 0x0c, 0x52(?), 0x4b(?), 0x6f(?), 0x02, voltageHI, voltageLO
Battery standby voltage
............
0x01: Call Information
s Make call { 0x0001, "number", type, block }
where type:
0x01 - data call
0x05 - voice call
block:
data call (non digital lines):
0x02,0x01,0x05,0x81,0x01,0x00,0x00,0x01,0x02,0x0a,
0x07,0xa2,0x88,0x81,0x21,0x15,0x63,0xa8,0x00,0x00
data call (digital lines):
0x02,0x01,0x05,0x81,0x01,0x00,0x00,0x01,0x02,0x0a,
0x07,0xa1,0x88,0x89,0x21,0x15,0x63,0xa0,0x00,0x06,
0x88,0x90,0x21,0x48,0x40,0xbb
voice call:
0x01, 0x01, 0x05, 0x81/0x00, sendnum, 0x00, 0x00, 0x01
where:
sendnum (own number sending):
0x01: preset (depends on network)
0x03: on
0x02: off
r Call going msg { 0x0002 }
r Call in progress { 0x0003, seqnr }
r Remote end hang up { 0x0004, seqnr, ?, error (like in netmon in 39) }
r incoming call alert { 0x0005, seqnr, numlen, "number", namelen, "name" }
s Answer call part 2 { 0x0006, seqnr, 0x00 }
r answered call { 0x0007, seqnr }
s Hang up { 0x0008, seqnr, 0x85 }
r terminated call { 0x0009, seqnr }
r call msg { 0x000a, seqnr }
s Get call status { 0x0020 }
r Get call status { 0x0021, num of calls, callinfo }
where callinfo: {0x64, blklen - 2 (0x17), seqnr,
channel (1-2), state, prevstate, ?, ?, ?, ?,
namelen, name (13 chars + 0x00) }
r call held { 0x0023, seqnr, 0x01 }
r call resumed { 0x0025, seqnr, 0x01 }
r call switch { 0x0027, 0xff, 0x01 }
r Send DTMF/voice call { 0x0040}
s Answer call part 1 { 0x0042,0x05,0x01,0x07,0xa2,0x88,0x81,0x21,0x15,0x63,0xa8,0x00,0x00,
0x07,0xa3,0xb8,0x81,0x20,0x15,0x63,0x80 }
s Sent after issuing { 0x0042,0x05,0x81,0x07,0xa1,0x88,0x89,0x21,0x15,0x63,0xa0,0x00,0x06,
data call 0x88,0x90,0x21,0x48,0x40,0xbb,0x07,0xa3,
(digital lines) 0xb8,0x81,0x20,0x15,0x63,0x80 }
s Sent after issuing { 0x0042,0x05,0x01,0x07,0xa2,0xc8,0x81,0x21,0x15,0x63,0xa8,0x00,0x00,
data call 0x07,0xa3,0xb8,0x81,0x20,0x15,0x63,0x80,
(non digital lines) 0x01,0x60 }
s Send DTMF { 0x0050, length, {ascii codes for DTMF}, 0x01 }
r Send DTMF ok { 0x0051 }
Note:
to make data call (non digital lines):
1.send "Make call" for non digital lines
2.send "Sent after issuing data call (non digital lines)"
to make data call (digital lines):
1.send "Answer call part 1"
2.send "Sent after issuing data call (digital lines)"
3.send "Make call" for digital lines
to answer call:
1.send "Answer call part 1"
2.send "Answer call part 2"
0x02: SMS handling
s Send SMS message { 0x0001, 0x02, 0x00 (SEND REQUEST), ... }
r Message sent { 0x0002 }
r Send failed { 0x0003, ?, ?, error (like in netmon in 65)}
s Get SMS message { 0x0007, 0x02, location, 0x01, 0x64 }
s Initiate connection { 0x000d, 0x00, 0x00, 0x02 }
r Initiate ACK { 0x000e, 0x01 }
r SMS message received { 0x0010, ...... } (whole message)
s Set CellBroadcast { 0x0020, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01 }
for enable cell broadcast ?
0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }
for disable cell broadcast ?
r Set CellBroadcast OK { 0x0021, 0x01 }
r Set CellBroadcast err { 0x0022, 0x01 } ???
r Read CellBroadcast { 0x0023, ?, ?, ?, channel, ?, message... } ?
s Set SMS center { 0x0030, 0x64, priority, checksum? ,0?, format,
validity, {DefaultRecipient no.}[12],
{SMScenter no.}[12], {SMSC name}, 0x00}
where tel.no.[12]: {len, type, {number(BCD)}}
type: 0x81: normal
0x91: + (international)
0xd0: alphanumeric
format: 0x00: text
0x22: fax
0x24: voice
0x25: ERMES
0x26: paging
0x31: X.400
0x32: email
validity: 0x0b: 1 hour
0x47: 6 hours
0xa7: 24 hours
0xa9: 72 hours
0xad: 1 week
0xff: max.time
r Set SMS center OK { 0x0031 }
r Set SMS center error { 0x0032, reason }
s Get SMS center { 0x0033, 0x64, priority }
[Nokia 3410 info: before the actual response unknown frame is returned:
0x01 0x0f 0x00 0xc9]
r SMS center received { 0x0034, priority, checksum?, format, 0x00?,
validity, {DefaultRecipient no.}[12],
{SMScenter no.}[12], {SMSC name}, 0x00}
tel.no[12]: {len, type, {number(BCD)}}
where priority, checksum, type, validity,
tel.no.[12]: see 0x02/0x0030
r SMS center error recv { 0x0035, reason }
0x03: Phonebook functions
s Get mem location { 0x0001, memtype, location, 0 }
where memory:
0x01: telephone and SIM phonebook (in one)
0x02: telephone phonebook
0x03: SIM phonebook
0x04: SIM fixdialling-phonebook (?)
0x05: Own numbers
0x07: Dialled numbers
0x08: Missed calls
0x09: Received calls
0x0b: voice mailbox (location not important)
r mem location recvd { 0x0002, 0x00,namelen,"name",numlen,"number",groupID, 0x01?, yearLO, yearHI, month, day, hour, minute, sec. }
Note: in 3310 all entries have null name ("feature" or bug ?)
r mem loc error recvd { 0x0003, errtype }
where errtype: 0x6f: SIM card not ready
0x74: invalid location
0x7d: invalid memory type
s Set mem location { 0x0004, memtype,location,namelen,"Name",numlen,"number",groupID }
r mem set OK { 0x0005 }
r mem set error { 0x0006, errtype }
where errtype: 0x7d: name is too long
s Mem status request { 0x0007, memtype }
r Mem status recvd { 0x0008, memtype, free, used }
r Mem status error recv { 0x0009, errtype }
where errtype: 0x6f: mem status error
0x7d: invalid memory type
0x8d: waiting for pin
s Get caller group data { 0x0010, groupID }
r Get caller group data { 0x0011, groupID, size, "Name", ringtoneID, graphic_on?1:0, lenHI, lenLO, OTABitmap (72x14 logo) }
r Get call.group error { 0x0012, reason }
where reason: 0x7d: invalid location
s Set caller group data { 0x0013, groupID, size, "Name", ringtoneID, graphic_on?1:0, lenHI, lenLO, OTABitmap (72x14 logo) }
r Set caller group OK { 0x0014 }
r Set call.group error { 0x0015, reason }
where reason: 0x7d: invalid location
s Get speed dial { 0x0016, index(1-9) }
r Get speed dial OK { 0x0017, mem.type, location }
where mem.type: 0x02: ME (== 0 if not stored)
0x03: SIM
location: memory location (== 0 if not stored)
r Get speed dial error { 0x0018 }
s Set speed dial { 0x0019, index(1-9), mem.type, location }
r Set speed dial OK { 0x001a }
r Set speed dial error { 0x001b }
0x04: Phone Status
s Phone status { 0x0001 }
r Phone status { 0x0002, mode, signal str, ???, pwr, batt.level }
where mode: 1: registered within the network
2: call in progress
3: waiting for pin
4: powered off
pwr: 1: AC/DC
2: battery
s Request Phone ID { 0x0003 }
r RequestPhone ID { 0x0004, 0x01,"NOKIA""imei", 0, "model", 0, "prod.code", 0, "HW", 0, "firmware", 0x00, 0x01 }
0x05: Profile settings
s Set profile feature { 0x0010, 1, nr, feature, a, 1 }
where nr: see 0x05/0x0013
feature: see 0x05/0x0014
a: see 0x05/0x0014
r Set profile feat. OK { 0x0011, 1 }
r Set profile feat. ERR { 0x0012, reason }
s Get profile feature { 0x0013, 1, nr, feature, 1 }
where nr is profile number (general=0, silent, meeting, outdoor, pager, car, headset=6)
feature: see 0x05/0x0014
r Get profile feature { 0x0014, 1, nr, feature, 4, a, b, c, d, 1 }
Features and answers (in a, b, c, d form):
0x00: keypad tones
xx, 1, 0, 2
xx: 0xff: off
0x00: level 1
0x01: level 2
0x02: level 3
0x01: lights (? only in car profile) (what number in Nokia 3310 ?)
xx, 0, 0, 1
xx: 0x00: off
0x??: on (maybe 0x01)
0x02: incoming call alert (in Nokia 3310/3330 feature 0x01)
xx, 1, 0, 7
xx: 1: ringing,
2: beep once,
3: unknown
4: off
5: ring once
6: ascending
7: caller groups (see feature #0x08)
0x03: ringing tone (in Nokia 3310/3330 feature 0x02)
xx, 0, 0, 0
xx: 0x12: ring ring
0x13: low
etc
0x04: ringing volume (in Nokia 3310/3330 feature 0x03)
xx, 0, 0, 0
xx: level 1 (0x06) - level 5 (0x0a)
0x05: message alert tone (in Nokia 3310/3330 feature 0x04)
xx, 1, 0, 4
xx: 0: no tone
1: standard
2: special
3: beep once
4: ascending
0x06: vibration (in Nokia 3310/3330 feature 0x05)
xx: 0: off
1: on
0x07: warning and game tones (in Nokia 3310/3330 feature 0x06 called warning tones)
xx, 4, 0, 4
xx: 0xff: off
0x04: on
0x07: screen saver - Nokia 3310/3330
xx: 1: on
0: off
0x08: incoming caller groups (what number in Nokia 3310 ?)
xx, 0, 0, 0
xx: 1: family
2: VIP
4: friends
8: collegues
16: other
0x09: automatic answer (what number in Nokia 3310 ?)
xx, 0, 0, 1
xx: 0x00: off
0x01: on
The following frames are valid only in Nokia 3330. Features for a <=
0x09 are separately set to each profile, other are common for all
profiles:
0x08 Screen saver -> Timeout:
0x00 = 5 sec
0x01 = 20 sec
0x09 Screen saver -> Screen saver:
0x00 ... 0x0d = Number of picture image
0x17 Phone book -> Options -> Memory in use:
0x00 = Phone
0x01 = SIM card
0x18 Settings -> Phone settings -> Network selection:
0x00 = Automatic
0x01 = Manual
0x19 Settings -> Call settings -> Automatic redial:
0x00 = Off
0x01 = On
0x1a Settings -> Call settings -> Speed dialling:
0x00 = Off
0x01 = On
0x1b Settings -> Call settings -> Own number sending:
0x00 = Set by network
0x01 = On
0x02 = Off
0x1c Settings -> Phone settings -> Cell info display:
0x00 = Off
0x1d Phone book -> Options -> Type of view:
0x00 = Name list
0x01 = Name, number
0x02 = Large font
0x1e Settings -> Phone settings -> Language:
0x00 = English
0x07 = Dansk
0x08 = Svenska
0x09 = Suomi
0x0c = Turcke
0x0e = Norsk
0x10 = Automatic
0x32 = Reboots ME
0x20 Messages -> Message settings -> Common -> Reply via same centre:
0x00 = No
0x01 = Yes
0x21 Messages -> Message settings -> Common -> Delivery reports:
0x00 = No
0x01 = Yes
0x22 Clock -> Clock settings -> Show/Hide clock:
0x00 = Show
0x01 = Hide
0x23 Clock -> Clock settings -> Time format:
0x00 = 24-hour
0x01 = 12-hour
0x24 Select profile:
0x00 = General
0x01 ... 0x05 = rest of them
0x26 Settings -> Phone settings -> Confirm SIM service actions:
0x00 = Not asked
0x01 = Asked
0x27 Messages -> Write messages -> Options -> Dictionary:
0x00 = Off
0x01 = English
0x0a = Suomi
0x28 Messages -> Message settings -> Common -> Character support:
0x00 = Automatic
0x01 = GSM alphabet
0x02 = Unicode
0x29 Startup logo settings:
0x00 = Your own uploaded logo
0x01 = Nokia
0x02 = Draft HUMAN technology(tm)
0x03 = Itineris
0x2d Clock -> Auto update of date and time:
0x00 = Off
0x01 = Confirm first
0x02 = On
The following frames are valid only in Nokia 6110
0x16 Anykey answer:
0x00 = Off
0x01 = On
0x17 ???
0x18 Memory in use:
0x00 = Phone
0x01 = SIM card
0x19 Network selection:
0x00 = Automatic
0x01 = Manual
0x1a Automatic redial:
0x00 = Off
0x01 = On
0x1b ???
0x1c ???
0x1d Speed dialling:
0x00 = Off
0x01 = On
0x1e Own number sending:
0x00 = Preset
0x01 = On
0x02 = Off
0x1f Cell info display:
0x00 = Off
0x01 = On
0x21 Language:
0x00 = English
0x01 = Deutsch
0x02 = Francais
0x03 = Italiano
0x06 = Nederlands
0x07 = Dansk
0x08 = Svenska
0x09 = Suomi
0x0e = Norsk
0x10 = Automatic
0x26 Reply via same centre:
0x00 = No
0x01 = Yes
0x27 Delivery reports:
0x00 = No
0x01 = Yes
0x28 Hide clock:
0x00 = Show clock
0x01 = Hide clock
0x29 Time format:
0x00 = 24-hour
0x01 = 12-hour
0x2a Selected profile:
see "Get profile feature"
s Get welcome message { 0x0016 }
r Get welcome message { 0x0017, no.of blocks, { block } * }
where block: { id, {blockspecific} }
id: 1: startup logo { y, x, picture (coding?) }
2: welcome note { len, "message" }
3: operator msg { len, "message" }
s Set welcome message { 0x0018, no.of blocks, { block } * }
where block: see 0x05/0x0017
r Set welcome OK { 0x0019, 0x01 }
s Get profile name { 0x001a, nr }
where nr: see 0x05/0x0013
r Profile name { 0x001b, 1, 1, 3, flen, nr, len, {text} }
where nr: see 0x05/0x0013
len: text length
flen len + len(nr, len) = len + 2
Note: in Nokia 3310 name is in Unicode
s ??? { 0x001c }
r ??? { 0x001d, 0x93 }
s Set oplogo { 0x0030, location, MCC1, MCC2, MNC, lenhi=0x00, lenlo=0x82, OTABitmap }
r Set oplogo OK { 0x0031 }
r Set oplogo error { 0x0032, reason }
where reason: 0x7d invalid location
s Get oplogo { 0x0033, location }
where location: 1 (doesn't seem to matter)
r Get oplogo { 0x0034, location, MCC1, MCC2, MNC, lenhi=0x00, lenlo=0x82, OTABitmap }
[Nokia 3410 info: before OTABitmap we have 2 extra octets -- 0x00 0x1e]
r Get oplogo error { 0x0035, reason }
where reason: 0x7d invalid location
s Set ringtone { 0x0036, location,0x00,0x78, ringtone packed according to SM2.0}
r Set ringtone OK { 0x0037 }
r Set ringtone error { 0x0038, reason }
where reason=0x7d, when not supported location
s Get services settings { 0x0080, setting (2 bytes) }
where: setting: 0x02,0x00=Nokia access number 1
0x02,0x01=Operator access number 1
0x01,0x00=Personal bookmark 1 settings (name only ?)
0x01,0x01=?
0x02,0x02=?
r Get services sett.OK { 0x0081, .... }
r Get services sett.err { 0x0082, 0x7b }
0x06: Calling line restriction/Call forwarding etc
s Set call divert { 0x0001, 0x03, 0x00, divtype, calltype, 0x01, number(packed like in SMS), 0x00, 0x00...,timeout}
NOTE: msglen=0x37
where timeout:
0x00: not set ?
0x05: 5 second
0x0a: 10 second
0x0f: 15 second
0x14: 20 second
0x19: 25 second
0x1e: 30 second
where divtype:
0x02: all diverts for all call types ?
Found only, when deactivate all diverts for all call types (with call type 0x00)
0x15: all calls
0x43: when busy
0x3d: when not answered
0x3e: if not reached
calltype:
0x00: all calls (data, voice, fax)
0x0b: voice calls
0x0d: fax calla
0x19: data calls
s Deactivate calldiverts{ 0x0001, 0x04, 0x00, divtype, calltype, 0x00 }
where divtype, calltype: see above
r Deactivate calldiverts{ 0x0002, 0x04, 0x00, divtype, 0x02, calltype, data }
s Get call diverts { 0x0001, 0x05, 0x00, divtype, calltype, 0x00 }
where divtype, calltype: see above
r Get call diverts ok { 0x0002, 0x05, 0x00, divtype, 0x02, calltype, data }
where divtype, calltype: see above
data: { 0x01, 0x00 } - isn't active
{ 0x02, 0x01, number(packed like in SMS), 0x00, 0x00..., timeout }
r Get prepaid(?) info { 0x0005, ?,?,?,length,message(packed like in 7bit SMS)}
r Call diverts active { 0x0006, ??? }
0x07:
s ??? { 0x0022, ? (1&2 sounds OK) }
r ??? OK { 0x0023, ?,?,? }
r ??? error { 0x0024, reason }
s ??? { 0x0025, ??? }
r ??? OK { 0x0026, ??? }
r ??? error { 0x0027, reason }
0x08: Security codes
s Change code { 0x0004, code, "current", 0x00, "new", 0x00 }
where code: 1: security code (5 chars)
2: PIN (4 chars)
3: PIN2 (4 chars)
4: PUK (8 chars)
5: PUK2 (8 chars)
r Change code ok { 0x0005 }
r Change code err { 0x0006, reason }
where reason: 0x88: current code wrong
s Status request { 0x0007, 0x01 }
r pin recvd { 0x0008, accepted }
where accepted: 0x0c (or 0x06): OK
code: waiting for (0x08/0x0004) code
s entering code { 0x000a, code, "code", 0x00 }
where code: see 0x08/0x0004
0x09: SIM login
r login { 0x0080 }
r logout { 0x0081 }
0x0a: Network status
s Key duplication on/off{ 0x0044, on? 0x01: 0x02 }
s get used network { 0x0070 }
r network registration { 0x0071, ?,?,?,length,netstatus,netsel,cellIDH,cellIDL,lacH,lacL,netcode,netcode,netcode }
where netstatus: 0x00: home network
0x01: roaming network
0x02: no service searching
0x03: no service not searching
0x04: no service no sim
netsel: 0x00: manual
0x01: automatic
0xff: unknown
0x0c: Keys (Nokia 3310 seems to not respond to these frames)
s Get key assignments { 0x0040, 0x01 }
r Get key assignments { 0x0041, {key '1'}, 0x00, {key '2'} ... {key '0'}, 0,0,0, {symbols}, 0 }
where {key '0'} => ' ', '0'
s Press key { 0x0042, press: 0x01; release: 0x02, button, 0x01 }
where button: 0x01 - 0x09: 1-9
0x0a: 0
0x0b: #
0x0c: *
0x0d: Power
0x0e: Pick up phone
0x0f: Hang
0x10: Volume +
0x11: Volume -
0x17: Up
0x18: Down
0x19: Menu
0x1a: Names
0x1B onwards: don't know but they do produce
a beep and light up the keypad as if
a key had been pressed.
r Press key ack { 0x0043, press/release/error(0x05) }
s ??? { 0x0044 }
r ??? ack { 0x0045, 0x01 }
0x0d: Status
r Display { 0x0050, 0x01, y, x, len, "string"(unicode) }
s Status request { 0x0051 }
r Status { 0x0052, no. of byte pairs, {byte pair} }
where {byte pair}: {cmd, 1:off 2:on}
cmd: 1: call in progress
2: ???
3: have unread sms
4: voice call active
5: fax call active
6: data call active
7: key lock active
8: is SMS storage full
s Display status { 0x0053, 1:on 2:off }
(will send displayed messages with x,y coordinates)
r Display status ack { 0x0054, 1 }
0x11: Phone clock & alarm
s set date and time { 0x0060, 1,1,7,yearh,yearl,month,mday,hour,min,0x00 }
r date and time set { 0x0061 }
s get date and time { 0x0062 }
r date and time recvd { 0x0063,date_set?,time_set?,?,?,yearh,yearl,month,mday,hour,min,second }
where: date_set & time_set==0x01 - set
0x00 - not set, ?,?,yearh,yearl,month,mday,hour,min,second
not available in frame
s set alarm { 0x006b, 1,32,3,0x02(on-off),hour,min,0x00 }
r alarm set { 0x006c }
s get alarm { 0x006d } [Not supported by Nokia 3410]
r alarm received { 0x006e,?,?,?,?,alrm(==2:on),hour,min }
0x12: Connect to NBS port (61xx only ?)
s Send {+0x0c, 0x01, UDH header, data}
(without 0,1 header -- for oplogo, cli, ringtone etc upload)
where: UDH header = 0x06, 0x05, 0x04,destporth,destportl,srcporth,srcportl
Seems not to work in MBUS!
0x13: Calendar notes
s Write calendar note { 0x0064, 0x01, 0x10, length, type, yearH, yearL, month, day, hour, timezone,
alarm?(alarm yearH, yearL, month, day, hour, timezone): (0,0,0,0,0,0),
textlen, "text" }
r Write cal.note report { 0x0065, return }
where return: 0x01: ok
0x73: failure
0x81: calendar functions busy. Exit Calendar menu and try again
s Calendar notes set { 0x0066... }
r Calendar note recvd { 0x0067, 0x01, ?, length, type, yrH,yrL,mon,day,hr,tz,alrm yrH,yrL,mon,day,hr,tz,textlen,"text"}
[Nokia 3410 info:
The year given by the phone is incorrect -- subtract 90 to get the real value
The text field starts with character 0x01. This is apparently a value for
the type of encoding for the rest of the text field.]
r Cal.note recvd error { 0x0067, err }
where err: 0x93: empty location
(0x01: OK)
other: error
s Delete cal.note { 0x0068, location }
r Del. cal.note report { 0x0069, err }
where err: 0x01: OK
0x93: empty location
0x81: calendar functions busy. Exit Calendar menu and try again
0x14: SMS funcs
s Write SMS to SIM { 0x0004, .... }
s Mark SMS as read { 0x0007, 0x02, location, 0x00, 0x64 }
r SMS message frame rcv { 0x0008,subtype,?,num,?,BCD(smscenter)...} 20->type, 22->status
where type: 0x06: delivery report
status: 0x00: delivered
0x30: pending
0x46: failed
0x09: reading failed
subtype: 0x02: invalid mem type
0x07: empty SMS location
0x0c: no access to memory (no PIN in card, etc.)
r SMS read error { 0x0009, errcode }
where errcode: 0x00: unknown reason
0x02: invalid location
0x06: SIM card not ready
0x07: empty location
s Delete SMS message { 0x000a, 0x02, location }
r Delete OK { 0x000b }
s SMS status request { 0x0036, 0x64 }
r SMS status { 0x0037,?,?,?,?,?,?,msgnumber,unread }
r SMS status error { 0x0038 }
0x3f: WAP
s Enable WAP frames { 0x0000}
r Enable WAP frames { 0x0002, 0x01}
s ?? { 0x0003}
r ?? { 0x0004}
s Get WAP bookmark { 0x0006, 0x00, location}
where location: 0 - 14
r Get WAP bookmark { 0x0007, 0x00, name_len, name(unicode),
url_len, url(unicode), 0x01,0x80,0x00[7]}
r Get WAP bookmark err { 0x0008, error }
where error:
0x00(?)invalid position
0x01 user inside "Bookmarks" menu. Must leave it
0x02 invalid/too high/empty location
s Set WAP bookmark { 0x0009, 0xff, 0xff, name_len, name(unicode),
url_len, url(unicode), 0x01,0x80,0x00[7] }
Note: bookmark is added to the first free location.
r Set WAP bookmark OK {+0x01, 0x36, 0x0a, block }
where block:
0x0a, location_of_just_written_bookmark(?),
0x00, next_free_location(?)
r Set WAP bookmark err {+0x01, 0x36, 0x0b, error }
where error:
0x04 - memory is full
0x01 - we are in the bookmark menu
0x00 - unknown reason for now ;(
? s Delete WAP bookmark { 0x000c, 0x00, location }
where: location = 0-14
? r Delete WAR bookmark OK{ 0x000d }
? r Delete WAPbookmark err{ 0x000e, 0x02 }
s ?? { 0x000F}
r ?? { 0x0010, 0x00}
s Get WAP settings 1 { 0x0015, location}
where location: 0x00 - 0x05
r Get WAP settings 1 OK { 0x0016, title length, title (Unicode), URL length, URL(Unicode),con_type, ???[6 bytes],location, ???[5 bytes],security,...}
where:
con_type: 0x00 - temporary
0x01 - continuous
location: when use "Get WAP settings 2 frame", must give it
security: 0x00 = no, 0x01 = yes
r Get WAP settings 1 err{ 0x0017, error }
where error:
0x01 user inside "Settings" menu. Must leave it
0x02 invalid/too high/empty location
s Get WAP settings 2 { 0x001b, location}
where location: 0x00 - 0x1d (you get it in "Get WAP settings 1" frame)
r Get WAP settings 2 OK { 0x001c, 0x01, type, frame...}
where type : 0x00 - SMS bearer
frame:
service_num_len, service_num (Unicode), server_num_len, server_num(Unicode)
0x01 - data bearer
frame:
auth, call_type, call_speed, ?, IP len, IP (Unicode), dialup len, dialup (Unicode),
user len, user (Unicode), password len, password (Unicode)
where auth: 0x00 - normal, 0x01 - secure
call_type: 0x00 - analogue, 0x01 - ISDN
call_speed: 0x00 - 9600, 0x01 - 14400
0x02 - USSD bearer
frame: type, service number len/IP len,service num (Unicode)/IP (Unicode),service code len,
service code (Unicode)
where type: 0x01 - service number, 0x00 - IP
r Get WAP settings 2 err{ 0x001d,error}
where: error=0x05
this docment is incomplete ask me or gnokii for complete