| blob | bc3a976db75436ab1844b4d77f738eab31a98862 |
1 \r
2 Last update 04.07.2002\r
3 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r
4 \r
5 Assembled by\r
6 Balazs Nagy <js@iksz.hu>\r
7 Harri Yli-Torkko <hyt@surfeu.fi>\r
8 Alfred R. Nurnberger <arnu@flosys.com>\r
9 Hugh Blemings <Hugh.Blemings@vsb.com.au>\r
10 Mike Bradley <mike@trumpington.st>\r
11 Odinokov Serge <serge@takas.lt>\r
12 Pavel Janik <Pavel@Janik.cz>\r
13 BORBELY Zoltan <bozo@andrews.hu>\r
14 Pawel Kot <pkot@linuxnews.pl>\r
15 Marcin Wiacek <Marcin@MWiacek.com>\r
16 Walek <walek@pa98.opole.sdi.tpnet.pl>\r
17 ... and other members of gnokii mailing list\r
18 and authors of some WWW pages.\r
19 \r
20 The data provided is for information purposes only. \r
21 Some of the frames might be hazardous to your phone. Be careful!!! \r
22 We do not take any responsibility or liability for damages, etc.\r
23 \r
24 NOTE: this information isn't (and can't be) complete. If you know anything\r
25 about features not listed here or you noticed a bug in this list, please\r
26 notify us via e-mail. Thank you.\r
27 \r
28 Document describing frames used in\r
29 GSM/PCN Nokia 6110 and derivatives (Nokia 6130, 6150, 6190, 5110, 5130, 5150,\r
30 5190, 3210, 3310)\r
31 Correct format is FBUS version 2/Direct IRDA/MBUS version 2\r
32 (see nokia.txt for protocol details):\r
33 \r
34 List:\r
35 \r
36 0x00: Monitoring values\r
37 r monitoring value {+0x01, 0x01, block... }\r
38 where block: 0x5e, 0x05, 0x7a(?), 0xd0(?), 0x85(?), 0x02, percentHI, percentLO\r
39 Battery percent level\r
40 0x5e, 0x0c, 0x52(?), 0x4b(?), 0x6f(?), 0x02, voltageHI, voltageLO\r
41 Battery standby voltage\r
42 ............\r
43 0x01: Call Information\r
44 s Make call { 0x0001, "number", type, block }\r
45 where type:\r
46 0x01 - data call\r
47 0x05 - voice call\r
48 block:\r
49 data call (non digital lines):\r
50 0x02,0x01,0x05,0x81,0x01,0x00,0x00,0x01,0x02,0x0a,\r
51 0x07,0xa2,0x88,0x81,0x21,0x15,0x63,0xa8,0x00,0x00\r
52 data call (digital lines):\r
53 0x02,0x01,0x05,0x81,0x01,0x00,0x00,0x01,0x02,0x0a,\r
54 0x07,0xa1,0x88,0x89,0x21,0x15,0x63,0xa0,0x00,0x06,\r
55 0x88,0x90,0x21,0x48,0x40,0xbb\r
56 voice call:\r
57 0x01, 0x01, 0x05, 0x81/0x00, sendnum, 0x00, 0x00, 0x01\r
58 where:\r
59 sendnum (own number sending):\r
60 0x01: preset (depends on network)\r
61 0x03: on\r
62 0x02: off\r
63 r Call going msg { 0x0002 }\r
64 r Call in progress { 0x0003, seqnr }\r
65 r Remote end hang up { 0x0004, seqnr, ?, error (like in netmon in 39) }\r
66 r incoming call alert { 0x0005, seqnr, numlen, "number", namelen, "name" }\r
67 s Answer call part 2 { 0x0006, seqnr, 0x00 }\r
68 r answered call { 0x0007, seqnr }\r
69 s Hang up { 0x0008, seqnr, 0x85 }\r
70 r terminated call { 0x0009, seqnr }\r
71 r call msg { 0x000a, seqnr }\r
72 r call held { 0x0023, seqnr, 0x01 }\r
73 r call resumed { 0x0025, seqnr, 0x01 }\r
74 r Send DTMF/voice call { 0x0040}\r
75 s Answer call part 1 { 0x0042,0x05,0x01,0x07,0xa2,0x88,0x81,0x21,0x15,0x63,0xa8,0x00,0x00,\r
76 0x07,0xa3,0xb8,0x81,0x20,0x15,0x63,0x80 }\r
77 s Sent after issuing { 0x0042,0x05,0x81,0x07,0xa1,0x88,0x89,0x21,0x15,0x63,0xa0,0x00,0x06,\r
78 data call 0x88,0x90,0x21,0x48,0x40,0xbb,0x07,0xa3,\r
79 (digital lines) 0xb8,0x81,0x20,0x15,0x63,0x80 }\r
80 s Sent after issuing { 0x0042,0x05,0x01,0x07,0xa2,0xc8,0x81,0x21,0x15,0x63,0xa8,0x00,0x00,\r
81 data call 0x07,0xa3,0xb8,0x81,0x20,0x15,0x63,0x80,\r
82 (non digital lines) 0x01,0x60 }\r
83 s Send DTMF { 0x0050, length, {ascii codes for DTMF}, 0x01 }\r
84 \r
85 Note:\r
86 to make data call (non digital lines):\r
87 1.send "Make call" for non digital lines\r
88 2.send "Sent after issuing data call (non digital lines)"\r
89 to make data call (digital lines):\r
90 1.send "Answer call part 1"\r
91 2.send "Sent after issuing data call (digital lines)"\r
92 3.send "Make call" for digital lines\r
93 to answer call:\r
94 1.send "Answer call part 1"\r
95 2.send "Answer call part 2"\r
96 \r
97 0x02: SMS handling\r
98 s Send SMS message { 0x0001, 0x02, 0x00 (SEND REQUEST), ... }\r
99 r Message sent { 0x0002 }\r
100 r Send failed { 0x0003, ?, ?, error (like in netmon in 65)} \r
101 s Get SMS message { 0x0007, 0x02, location, 0x01, 0x64 }\r
102 s Initiate connection { 0x000d, 0x00, 0x00, 0x02 }\r
103 r Initiate ACK { 0x000e, 0x01 }\r
104 r SMS message received { 0x0010, ...... } (whole message)\r
105 s Set CellBroadcast { 0x0020, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01 }\r
106 for enable cell broadcast ?\r
107 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }\r
108 for disable cell broadcast ?\r
109 r Set CellBroadcast OK { 0x0021, 0x01 }\r
110 r Read CellBroadcast { 0x0023, ?, ?, ?, channel, ?, message... } ?\r
111 s Set SMS center { 0x0030, 0x64, priority, checksum? ,0?, format,\r
112 validity, {DefaultRecipient no.}[12], \r
113 {SMScenter no.}[12], {SMSC name}, 0x00}\r
114 where tel.no.[12]: {len, type, {number(BCD)}}\r
115 type: 0x81: normal\r
116 0x91: + (international)\r
117 0xd0: alphanumeric\r
118 format: 0x00: text\r
119 0x22: fax\r
120 0x24: voice\r
121 0x25: ERMES\r
122 0x26: paging\r
123 0x31: X.400\r
124 0x32: email\r
125 validity: 0x0b: 1 hour\r
126 0x47: 6 hours\r
127 0xa7: 24 hours\r
128 0xa9: 72 hours\r
129 0xad: 1 week\r
130 0xff: max.time\r
131 r Set SMS center OK { 0x0031 }\r
132 r Set SMS center error { 0x0032, reason }\r
133 s Get SMS center { 0x0033, 0x64, priority }\r
134 r SMS center received { 0x0034, priority, checksum?, format, 0x00?,\r
135 validity, {DefaultRecipient no.}[12],\r
136 {SMScenter no.}[12], {SMSC name}, 0x00}\r
137 tel.no[12]: {len, type, {number(BCD)}} \r
138 where priority, checksum, type, validity,\r
139 tel.no.[12]: see 0x02/0x0030\r
140 r SMS center error recv { 0x0035, reason }\r
141 0x03: Phonebook functions\r
142 s Get mem location { 0x0001, memtype, location, 0 }\r
143 where memory:\r
144 0x01: telephone and SIM phonebook (in one)\r
145 0x02: telephone phonebook\r
146 0x03: SIM phonebook\r
147 0x04: SIM fixdialling-phonebook (?)\r
148 0x05: Own numbers\r
149 0x07: Dialled numbers\r
150 0x08: Missed calls\r
151 0x09: Received calls\r
152 0x0b: voice mailbox (location not important)\r
153 r mem location recvd { 0x0002, 0x00,namelen,"name",numlen,"number",groupID, 0x01?, yearLO, yearHI, month, day, hour, minute, sec. }\r
154 Note: in 3310 all entries have null name ("feature" of bug ?)\r
155 r mem loc error recvd { 0x0003, errtype }\r
156 where errtype:\r
157 0x7d: invalid memory type\r
158 0x74: empty location ?\r
159 0x8d: no PIN\r
160 s Set mem location { 0x0004, memtype,location,namelen,"Name",numlen,"number",groupID }\r
161 r mem set OK { 0x0005 }\r
162 r mem set error { 0x0006, errtype }\r
163 where errtype: 0x7d: name is too long\r
164 s Mem status request { 0x0007, memtype }\r
165 r Mem status recvd { 0x0008, memtype, free, used }\r
166 r Mem status error recv { 0x0009, errtype }\r
167 where errtype: 0x6f: mem status error\r
168 0x7d: invalid memory type\r
169 0x8d: waiting for pin\r
170 s Get caller group data { 0x0010, groupID }\r
171 r Get caller group data { 0x0011, groupID, size, "Name", ringtoneID, graphic_on?1:0, lenHI, lenLO, OTABitmap (72x14 logo) }\r
172 r Get call.group error { 0x0012, reason }\r
173 where reason: 0x7d: invalid location\r
174 s Set caller group data { 0x0013, groupID, size, "Name", ringtoneID, graphic_on?1:0, lenHI, lenLO, OTABitmap (72x14 logo) }\r
175 r Set caller group OK { 0x0014 }\r
176 r Set call.group error { 0x0015, reason }\r
177 where reason: 0x7d: invalid location\r
178 s Get speed dial { 0x0016, index(1-9) }\r
179 r Get speed dial OK { 0x0017, mem.type, location }\r
180 where mem.type: 0x02: ME (== 0 if not stored)\r
181 0x03: SIM\r
182 location: memory location (== 0 if not stored)\r
183 r Get speed dial error { 0x0018 }\r
184 s Set speed dial { 0x0019, index(1-9), mem.type, location }\r
185 r Set speed dial OK { 0x001a }\r
186 r Set speed dial error { 0x001b }\r
187 0x04: Phone Status\r
188 s Phone status { 0x0001 }\r
189 r Phone status { 0x0002, mode, signal str, ???, pwr, batt.level }\r
190 where mode: 1: registered within the network\r
191 2: call in progress\r
192 3: waiting for pin\r
193 4: powered off\r
194 pwr: 1: AC/DC\r
195 2: battery\r
196 s Request Phone ID { 0x0003 }\r
197 r RequestPhone ID { 0x0004, 0x01,"NOKIA""imei", 0, "model", 0, "prod.code", 0, "HW", 0, "firmware", 0x00, 0x01 }\r
198 0x05: Profile settings\r
199 s Set profile feature { 0x0010, 1, nr, feature, a, 1 }\r
200 where nr: see 0x05/0x0013\r
201 feature: see 0x05/0x0014\r
202 a: see 0x05/0x0014\r
203 r Set profile feat. OK { 0x0011, 1 }\r
204 s Get profile feature { 0x0013, 1, nr, feature, 1 }\r
205 where nr is profile number (general=0, silent, meeting, outdoor, pager, car, headset=6)\r
206 feature: see 0x05/0x0014\r
207 r Get profile feature { 0x0014, 1, nr, feature, 4, a, b, c, d, 1 }\r
208 \r
209 Note: Settings num 0x00 .. 0x09 can be assigned\r
210 separately to each profile (0x00 .. 0x05), but rest are common\r
211 to all profiles.\r
212 \r
213 6110\r
214 \r
215 Feature Description Value\r
216 ------- ------------------- -----------------\r
217 0x00 keypad notes 0xff=off, 0x00=level 1, 0x01=level 2, 0x02=level 3\r
218 0x01 lights (? only in car profile) 0x00=off, 0x??=on (maybe 0x01)\r
219 0x02 incoming call alert 1=ringing, 2=beep once, 3=unknown, 4=off, 5=ring once,\r
220 6=ascending, 7=caller groups (see feature #0x08)\r
221 0x03 ringing tone ID for original 6110: 0x12=ring ring, 0x13=low, etc.\r
222 0x04 ringing volume level 1 (0x06) - level 5 (0x0a)\r
223 0x05 message alert tone 0=no tone, 1=standard, 2=special, 3=beep once, 4=ascending\r
224 0x06 vibration 0=off, 1=on\r
225 0x07 warning and game tones 0xff=off, 0x04=on\r
226 0x08 incoming caller groups 1=family, 2=VIP, 4=friends, 8=collegues, 16=other\r
227 0x09 automatic answer 0x00=off, 0x01=on \r
228 -------------------------\r
229 0x16 Anykey answer 0x00=Off, 0x01=On\r
230 0x17 ??? 0x00 | 0x01\r
231 0x18 Memory in use 0x00=Phone, 0x01=SIM card\r
232 0x19 Network selection 0x00=Automatic, 0x01=Manual\r
233 0x1a Automatic redial 0x00=Off, 0x01=On\r
234 0x1b ??? 0x00 | 0x01\r
235 0x1c ??? 0x00...0x18\r
236 0x1d Speed dialling 0x00=Off, 0x01=On\r
237 0x1e Own number sending 0x00=Preset, 0x01=On, 0x02=Off\r
238 0x1f Cell info display 0x00=Off, 0x01=On\r
239 0x21 Language 0x00=English\r
240 0x01=Deutsch\r
241 0x02=Francais\r
242 0x03=Italiano\r
243 0x06=Nederlands\r
244 0x07=Dansk\r
245 0x08=Svenska\r
246 0x09=Suomi\r
247 0x0e=Norsk\r
248 0x10=Automatic\r
249 0x26 Reply via same centre 0x00=No, 0x01=Yes\r
250 0x27 Delivery reports 0x00=No, 0x01=Yes\r
251 0x28 Hide clock 0x00=Show clock, 0x01=Hide clock\r
252 0x29 Time format 0x00=24-hour, 0x01=12-hour\r
253 0x2a Selected profile 0x00=General, 0x01.. the rest\r
254 \r
255 33x0\r
256 \r
257 Feature Description Value\r
258 ------- ------------------- -----------------\r
259 0x00 keypad notes 0xff=off, 0x00=level 1, 0x01=level 2, 0x02=level 3\r
260 0x01 incoming call alert 1=ringing, 2=beep once, 3=unknown, 4=off, 5=ring once,\r
261 6=ascending\r
262 0x02 ringing tone ID \r
263 0x03 ringing volume level 1 (0x06) - level 5 (0x0a)\r
264 0x04 message alert tone 0=no tone, 1=standard, 2=special, 3=beep once, 4=ascending\r
265 0x05 vibration 0=off, 1=on, 2=vibrate first\r
266 0x06 warning tones 0xff=off, 0x04=on\r
267 0x07 screen saver 1=on, 0=off\r
268 0x08 Screen saver -> Timeout 0x00=5 sec, 0x01=20 sec,....\r
269 0x09 Screen saver -> Screen saver 0x00 ... 0x0d = Number of picture image\r
270 -------------------------\r
271 0x0a: ???:\r
272 ...: ???:\r
273 0x15: ???: Read only?\r
274 -------------------------\r
275 0x16: ???: 0x00=??? 0x01=???\r
276 0x17: Memory in use (Nokia 3330): 0x00=Phone, 0x01=SIM card\r
277 0x18: Network selection: 0x00=Automatic, 0x01=Manual\r
278 0x19: Automatic redial: 0x00=Off, 0x01=On\r
279 0x1a: Speed dialling: 0x00=Off, 0x01=On\r
280 0x1b: Own number sending: 0x00=Set by network, 0x01=On, 0x02=Off\r
281 0x1c: Cell info display: 0x00=Off\r
282 0x1d: Type of view: 0x00=Name list,0x01=Name, number,0x02=Large font\r
283 0x1e: Language: 0x00=English\r
284 0x07=Dansk\r
285 0x08=Svenska\r
286 0x09=Suomi\r
287 0x0c=Turcke\r
288 0x0e=Norsk\r
289 0x10=Automatic\r
290 0x32: Reboots ME (3330)\r
291 0x1f: ???: Read only? (3330)\r
292 0x20: Reply via same centre: 0x00=No, 0x01=Yes\r
293 0x21: Delivery reports: 0x00=No, 0x01=Yes \r
294 0x22: Show/Hide clock: 0x00=Show, 0x01=Hide\r
295 0x23: Time format: 0x00=24-hour, 0x01=12-hour\r
296 0x24: Select profile: 0x00=General, 0x01 ... 0x05=rest of them\r
297 0x25: ???: Read only? (N3330)\r
298 0x26: Confirm SIM service actions: 0x00=Not asked, 0x01=Asked\r
299 0x27: T9 Dictionary: 0x00=Off, 0x01=English, 0x0a=Suomi\r
300 0x28: Messages -> Character support: 0x00=Automatic, 0x01=GSM alphabet, 0x02=Unicode\r
301 0x29: Startup logo settings: 0x00=Your own uploaded logo,0x01=Nokia\r
302 0x02=Draft HUMAN technology(tm),0x03=Itineris\r
303 0x2a: ???: 0x00=??? 0x01=???\r
304 0x2b: ???: 0x00=??? 0x01=???\r
305 0x2c: ???: Read only? (N3330)\r
306 0x2d: Auto update of date and time: 0x00=Off,0x01=Confirm first,0x02=On\r
307 \r
308 s Get welcome message { 0x0016 }\r
309 r Get welcome message { 0x0017, no.of blocks, { block } * }\r
310 where block: { id, {blockspecific} }\r
311 id: 1: startup logo { y, x, picture (coding?) }\r
312 2: welcome note { len, "message" }\r
313 3: operator msg { len, "message" }\r
314 s Set welcome message { 0x0018, no.of blocks, { block } * }\r
315 where block: see 0x05/0x0017\r
316 r Set welcome OK { 0x0019, 0x01 }\r
317 s Get profile name { 0x001a, nr }\r
318 where nr: see 0x05/0x0013\r
319 r Profile name { 0x001b, 1, 1, 3, flen, nr, len, {text} }\r
320 where nr: see 0x05/0x0013\r
321 len: text length \r
322 flen len + len(nr, len) = len + 2\r
323 Note: in Nokia 3310 name is in Unicode\r
324 s ??? { 0x001c }\r
325 r ??? { 0x001d, 0x93 }\r
326 s Set oplogo { 0x0030, location, MCC1, MCC2, MNC, lenhi=0x00, lenlo=0x82, OTABitmap }\r
327 r Set oplogo OK { 0x0031 }\r
328 r Set oplogo error { 0x0032, reason }\r
329 where reason: 0x7d invalid location\r
330 s Get oplogo { 0x0033, location }\r
331 where location: 1 (doesn't seem to matter)\r
332 r Get oplogo { 0x0034, location, MCC1, MCC2, MNC, lenhi=0x00, lenlo=0x82, OTABitmap }\r
333 r Get oplogo error { 0x0035, reason }\r
334 where reason: 0x7d invalid location\r
335 s Set ringtone { 0x0036, location,0x00,0x78, ringtone packed according to SM2.0}\r
336 r Set ringtone OK { 0x0037 }\r
337 r Set ringtone error { 0x0038, reason }\r
338 where reason=0x7d, when not supported location\r
339 s Get services settings { 0x0080, setting (2 bytes) }\r
340 where: setting: 0x02,0x00=Nokia access number 1\r
341 0x02,0x01=Operator access number 1\r
342 0x01,0x00=Personal bookmark 1 settings (name only ?)\r
343 0x01,0x01=?\r
344 0x02,0x02=?\r
345 r Get services sett.OK { 0x0081, .... }\r
346 r Get services sett.err { 0x0082, 0x7b }\r
347 0x06: Calling line restriction/Call forwarding etc\r
348 r Get call divert { 0x0001, 0x02, x, 0x00, divtype, 0x02, calltype, y, z, 0x0b, number, 0x00...0x00, timeout (byte 45) }\r
349 s Set call divert { 0x0001, 0x03, 0x00, divtype, calltype, 0x01, number(packed like in SMS), 0x00 ... 0x00,\r
350 length of number (byte 29), 0x00 ... 0x00, timeout (byte 52), 0x00, 0x00, 0x00}\r
351 NOTE: msglen=0x37\r
352 where timeout:\r
353 0x00: not set ?\r
354 0x05: 5 second\r
355 0x0a: 10 second\r
356 0x0f: 15 second\r
357 0x14: 20 second\r
358 0x19: 25 second\r
359 0x1e: 30 second\r
360 where divtype:\r
361 0x02: all diverts for all call types ?\r
362 Found only, when deactivate all diverts for all call types (with call type 0x00)\r
363 0x15: all calls\r
364 0x43: when busy\r
365 0x3d: when not answered\r
366 0x3e: if not reached\r
367 calltype:\r
368 0x00: all calls (data, voice, fax)\r
369 0x0b: voice calls\r
370 0x0d: fax calla\r
371 0x19: data calls\r
372 s Deactivate calldiverts{ 0x0001, 0x04, 0x00, divtype, calltype, 0x00 }\r
373 where divtype, calltype: see above\r
374 r Deactivate calldiverts{ 0x0002, 0x04, 0x00, divtype, 0x02, calltype, data }\r
375 s Get call diverts { 0x0001, 0x05, 0x00, divtype, calltype, 0x00 }\r
376 where divtype, calltype: see above\r
377 r Get call diverts ok { 0x0002, 0x05, 0x00, divtype, 0x02, calltype, data }\r
378 where divtype, calltype: see above\r
379 data: { 0x01, 0x00 } - isn't active\r
380 { 0x02, 0x01, number(packed like in SMS), 0x00, 0x00..., timeout }\r
381 r Get prepaid(?) info { 0x0005, ?,?,?,length,message(packed like in 7bit SMS)}\r
382 r Call diverts active { 0x0006, ??? }\r
383 0x07:\r
384 s ??? { 0x0022, ? (1&2 sounds OK) }\r
385 r ??? OK { 0x0023, ?,?,? }\r
386 r ??? error { 0x0024, reason }\r
387 s ??? { 0x0025, ??? }\r
388 r ??? OK { 0x0026, ??? }\r
389 r ??? error { 0x0027, reason }\r
390 0x08: Security codes\r
391 s Change code { 0x0004, code, "current", 0x00, "new", 0x00 }\r
392 where code: 1: security code (5 chars)\r
393 2: PIN (4 chars)\r
394 3: PIN2 (4 chars)\r
395 4: PUK (8 chars)\r
396 5: PUK2 (8 chars)\r
397 s Status request { 0x0007, 0x01 }\r
398 r pin recvd { 0x0008, accepted }\r
399 where accepted: 0x0c (or 0x06): OK\r
400 code: waiting for (0x08/0x0004) code\r
401 s entering code { 0x000a, code, "code", 0x00 }\r
402 where code: see 0x08/0x0004\r
403 0x09: SIM login\r
404 r login { 0x0080 }\r
405 r logout { 0x0081 }\r
406 0x0a: Network status\r
407 s Key duplication on/off{ 0x0044, on? 0x01: 0x02 }\r
408 s get used network { 0x0070 }\r
409 r network registration { 0x0071, ?,?,?,length,netstatus,netsel,cellIDH,cellIDL,lacH,lacL,netcode,netcode,netcode }\r
410 0x0c: Keys\r
411 s Get key assignments { 0x0040, 0x01 }\r
412 r Get key assignments { 0x0041, {key '1'}, 0x00, {key '2'} ... {key '0'}, 0,0,0, {symbols}, 0 }\r
413 where {key '0'} => ' ', '0'\r
414 s Press key { 0x0042, press: 0x01; release: 0x02, button, 0x01 }\r
415 where button: 0x01 - 0x09: 1-9\r
416 0x0a: 0\r
417 0x0b: #\r
418 0x0c: *\r
419 0x0d: Power\r
420 0x0e: Pick up phone\r
421 0x0f: Hang\r
422 0x10: Volume +\r
423 0x11: Volume -\r
424 0x17: Up\r
425 0x18: Down\r
426 0x19: Menu\r
427 0x1a: Names\r
428 0x1B onwards: don't know but they do produce\r
429 a beep and light up the keypad as if\r
430 a key had been pressed. \r
431 r Press key ack { 0x0043, press/release/error(0x05) }\r
432 s ??? { 0x0044 }\r
433 r ??? ack { 0x0045, 0x01 }\r
434 0x0d: Status\r
435 r Display { 0x0050, 0x01, y, x, len, "string"(unicode) }\r
436 s Status request { 0x0051 }\r
437 r Status { 0x0052, no. of byte pairs, {byte pair} }\r
438 where {byte pair}: {cmd, 1:off 2:on}\r
439 cmd: 1: call in progress\r
440 2: ???\r
441 3: have unread sms\r
442 4: voice call active\r
443 5: fax call active\r
444 6: data call active\r
445 7: key lock active\r
446 8: is SMS storage full\r
447 s Display status { 0x0053, 1:on 2:off }\r
448 (will send displayed messages with x,y coordinates)\r
449 r Display status ack { 0x0054, 1 }\r
450 0x11: Phone clock & alarm\r
451 s set date and time { 0x0060, 1,1,7,yearh,yearl,month,mday,hour,min,0x00 }\r
452 r date and time set { 0x0061 }\r
453 s get date and time { 0x0062 }\r
454 r date and time recvd { 0x0063,date_set?,time_set?,?,?,yearh,yearl,month,mday,hour,min,second }\r
455 where: date_set & time_set==0x01 - set\r
456 0x00 - not set, ?,?,yearh,yearl,month,mday,hour,min,second\r
457 not available in frame\r
458 s set alarm { 0x006b, 1,32,3,0x02(on-off),hour,min,0x00 }\r
459 r alarm set { 0x006c }\r
460 s get alarm { 0x006d }\r
461 r alarm received { 0x006e,?,?,?,?,alrm(==2:on),hour,min }\r
462 0x12: Connect to NBS port (61xx only ?)\r
463 s Send {+0x0c, 0x01, UDH header, data}\r
464 (without 0,1 header -- for oplogo, cli, ringtone etc upload)\r
465 where: UDH header = 0x06, 0x05, 0x04,destporth,destportl,srcporth,srcportl\r
466 0x13: Calendar notes\r
467 s Write calendar note { 0x0064, 0x01, 0x10, length, type, yearH, yearL, month, day, hour, timezone,\r
468 alarm?(alarm yearH, yearL, month, day, hour, timezone): (0,0,0,0,0,0),\r
469 textlen, "text" }\r
470 r Write cal.note report { 0x0065, return }\r
471 where return: 0x01: ok\r
472 0x73: failure\r
473 0x81: calendar functions busy. Exit Calendar menu and try again\r
474 s Calendar notes set { 0x0066... }\r
475 r Calendar note recvd { 0x0067, 0x01, ?, length, type, yrH,yrL,mon,day,hr,tz,alrm yrH,yrL,mon,day,hr,tz,textlen, "text" }\r
476 r Cal.note recvd error { 0x0067, err }\r
477 where err: 0x93: not available\r
478 (0x01: OK)\r
479 other: error\r
480 s Delete cal.note { 0x0068, location }\r
481 r Del. cal.note report { 0x0069, err }\r
482 where err: 0x01: OK\r
483 0x93: cannot delete\r
484 0x14: SMS funcs\r
485 s Write SMS to SIM { 0x0004, .... }\r
486 s Mark SMS as read { 0x0007, 0x02, location, 0x00, 0x64 }\r
487 r SMS message frame rcv { 0x0008,subtype,?,num,?,BCD(smscenter)...} 20->type, 22->status\r
488 where type: 0x06: delivery report \r
489 status: 0x00: delivered\r
490 0x30: pending\r
491 0x46: failed\r
492 0x09: reading failed\r
493 subtype: 0x02: invalid mem type\r
494 0x07: empty SMS location\r
495 0x0c: no access to memory (no PIN in card, etc.)\r
496 s Delete SMS message { 0x000a, 0x02, location }\r
497 r Delete OK { 0x000b }\r
498 s SMS status request { 0x0036, 0x64 }\r
499 r SMS status { 0x0037,?,?,?,?,?,?,msgnumber,unread }\r
500 r SMS status error { 0x0038 }\r
501 0x3f: WAP \r
502 s Enable WAP frames { 0x0000}\r
503 r Enable WAP frames { 0x0002, 0x01}\r
504 \r
505 s ?? { 0x0003}\r
506 r ?? { 0x0004}\r
507 \r
508 s Get WAP bookmark { 0x0006, 0x00, location}\r
509 where location: 0 - 14\r
510 r Get WAP bookmark { 0x0007, 0x00, name_len, name(unicode),\r
511 url_len, url(unicode), 0x01,0x80,0x00[7]}\r
512 r Get WAP bookmark err { 0x0008, error }\r
513 where error:\r
514 0x00(?)invalid position\r
515 0x01 user inside "Bookmarks" menu. Must leave it\r
516 0x02 invalid/too high/empty location\r
517 \r
518 s Set WAP bookmark { 0x0009, 0xff, 0xff, name_len, name(unicode),\r
519 url_len, url(unicode), 0x01,0x80,0x00[7] }\r
520 Note: bookmark is added to the first free location.\r
521 r Set WAP bookmark OK {+0x01, 0x36, 0x0a, block }\r
522 where block:\r
523 0x0a, location_of_just_written_bookmark(?),\r
524 0x00, next_free_location(?)\r
525 r Set WAP bookmark err {+0x01, 0x36, 0x0b, error }\r
526 where error:\r
527 0x04 - memory is full\r
528 0x01 - we are in the bookmark menu\r
529 0x00 - unknown reason for now ;(\r
530 \r
531 ? s Delete WAP bookmark { 0x000c, 0x00, location }\r
532 where: location = 0-14\r
533 ? r Delete WAR bookmark OK{ 0x000d }\r
534 ? r Delete WAPbookmark err{ 0x000e, 0x02 }\r
535 \r
536 s ?? { 0x000F}\r
537 r ?? { 0x0010, 0x00}\r
538 \r
539 s Get WAP settings 1 { 0x0015, location}\r
540 where location: 0x00 - 0x05\r
541 r Get WAP settings 1 OK { 0x0016, title length, title (Unicode), URL length, URL(Unicode),con_type, ???[6 bytes],location, ???[5 bytes],security,...}\r
542 where:\r
543 con_type: 0x00 - temporary\r
544 0x01 - continuous\r
545 location: when use "Get WAP settings 2 frame", must give it\r
546 security: 0x00 = no, 0x01 = yes\r
547 r Get WAP settings 1 err{ 0x0017, error }\r
548 where error:\r
549 0x01 user inside "Settings" menu. Must leave it\r
550 0x02 invalid/too high/empty location\r
551 \r
552 s Get WAP settings 2 { 0x001b, location}\r
553 where location: 0x00 - 0x1d (you get it in "Get WAP settings 1" frame)\r
554 r Get WAP settings 2 OK { 0x001c, 0x01, type, frame...}\r
555 where type : 0x00 - SMS bearer\r
556 frame:\r
557 service_num_len, service_num (Unicode), server_num_len, server_num(Unicode)\r
558 0x01 - data bearer\r
559 frame:\r
560 auth, call_type, call_speed, ?, IP len, IP (Unicode), dialup len, dialup (Unicode),\r
561 user len, user (Unicode), password len, password (Unicode)\r
562 where auth: 0x00 - normal, 0x01 - secure\r
563 call_type: 0x00 - analogue, 0x01 - ISDN\r
564 call_speed: 0x00 - 9600, 0x01 - 14400\r
565 0x02 - USSD bearer\r
566 frame: type, service number len/IP len,service num (Unicode)/IP (Unicode),service code len,\r
567 service code (Unicode)\r
568 where type: 0x01 - service number, 0x00 - IP\r
569 r Get WAP settings 2 err{ 0x001d,error}\r
570 where: error=0x05 \r
571 0x40: Security commands\r
572 s ??? {+0x00, 0x00, 0x07, 0x11, 0x00, 0x10, 0x00, 0x00}\r
573 This frame hangs phone (N3310 4.02). Meaning unknown !\r
574 s Open simlock 1 { 0x02, 0x03, 0x1f, 0x11, 0x01, 0x01, 0x10, 0x00}\r
575 r Open simlock 1 { 0x02 }\r
576 s ???(N6150) { 0x08, 0x00 }\r
577 r ???(N6150) { 0x08 }\r
578 s Enable extended cmds { 0x64, cmd }\r
579 where cmd: 0x00: off\r
580 0x01: on\r
581 0x02: enter service mode ?\r
582 0x03: reset (doesn't ask for PIN again)\r
583 0x04: reset (PIN is requested)\r
584 In 5110 makes reset without PIN\r
585 0x06: CONTACT SERVICE!!! Don't try it!\r
586 s Reset phone settings { 0x65, value, 0x00 }\r
587 where value: 0x08 - reset UI (User Interface) settings\r
588 0x38 - reset UI, SCM and call counters\r
589 0x40 - reset test 36 in netmonitor\r
590 r Reset phone settings { 0x65, 0x00 }\r
591 s Get IMEI { 0x66 }\r
592 r Get IMEI { 0x66, 0x01, IMEI, 0x00}\r
593 s (ACD Readings)?(N6150 { 0x68 }\r
594 r (ACD Readings)?(N6150 { 0x68, ... }\r
595 s Get Product Profile\r
596 Settings { 0x6a}\r
597 r Get Product Profile\r
598 Settings { 0x6a, 4bytes with Product Profile Settings }\r
599 s Set Product Profile\r
600 Settings { 0x6b, 4bytes with Product Profile Settings }\r
601 r Set Product Profile\r
602 Settings OK ? { 0x6b }\r
603 s Get code { 0x6e, code }\r
604 where code: see 0x08/0x0004 (only sec.code is allowed)\r
605 r Get code { 0x6e, code, allowed, allowed? (sec code (text)) }\r
606 where code: see 0x08/0x0004\r
607 allowed: 0: no\r
608 1: yes\r
609 s Set code { 0x6f, code, sec code(text), 0x00 }\r
610 where code: see 0x08/0x0004\r
611 s Start monitoring { 0x70, block }\r
612 where block(N6150):\r
613 0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,\r
614 0xff,0xff,0xff,0xff,0xff,0xf9,0x76,0x65,0x20,0x00,\r
615 0x00,0x00,0x00,0x00,0x18,0x26,0x15,0x7d,0x0a,0x00,\r
616 0xf5,0x82,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,\r
617 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xf0,0x77,0x80,\r
618 0x77,0x80,0xf2,0x82,0x20,0x20,0x20,0x20,0x20,0x20,\r
619 0x20,0x20,0x20,0x20\r
620 This block enables probably all possible monitorred parameters.\r
621 After it phone sends 0x00 message type values\r
622 s Break monitoring { 0x71 }\r
623 r Break monitoring { 0x71 }\r
624 ? s ???? { 0x74, 0x01, 0x01, 0x0e }\r
625 ? r ???? { 0x74 }\r
626 s Call commands { 0x7c, block }\r
627 where where: command, (values)\r
628 command: 0x01\r
629 values: number(ASCII), 0x00 - makes voice call\r
630 command: 0x02 - answer call\r
631 command: 0x03 - release call\r
632 r Call commands { 0x7c, command }\r
633 s Netmonitor { 0x7e, field }\r
634 where: field: 00: next\r
635 F0: reset\r
636 F1: off\r
637 F2: field test menus\r
638 F3: developer menus\r
639 s Open simlock 2 { 0x81, 0x01, locknumber, 0x10, 0x10, 0x10, 0x10, 0x10 }\r
640 Note: sets simlock type to factory?\r
641 where locknumber: 1,2,4,8\r
642 s Open simlock 2 { 0x81, 0x01, locknumber }\r
643 where locknumber: 1,2,4,8\r
644 s Close simlock { 0x82, 0x01, locknumber, 0x00, 0x00, locksinfo(lock1,4,2,3), 0x00 }\r
645 where locknumber: 1,2,4,8\r
646 r Close simlock { 0x82, the rest like in 0x40/0x8a }\r
647 s Get simlock info { 0x8a, 0x00}\r
648 r Get simlock info { 0x8a, 0x00, 0x01, lockstype, locksclosed, 0x00, 0x00, locksinfo(lock1,4,2,3), counter1,counter2,counter4,counter4,0x00 }\r
649 where: lockstype: bit1,bit2,bit3,bit4 - if set, selected lock is user lock\r
650 locksclosed: bit1,bit2,bit3,bit4 - if set, selected lock is closed\r
651 counter1 - counter4: counters for locks\r
652 s Set downloaded OpName { 0x8b, 0x00, MCC1, MCC2, MNC, Name, 0x00 }\r
653 r SetdownloadedOpNameOK?{ 0x8b, 0x00, 0x01 }\r
654 s Get downloaded OpName { 0x8c, 0x00 }\r
655 r Get downloaded OpName { 0x8c, 0x00, 0x01, MCC1, MCC2, MNC, Name, 0x00,...}\r
656 s Buzzer pitch { 0x8f, volume, hzLO, hzHI }\r
657 if volume and hz is 0, it's off\r
658 r Buzzer pitch { 0x8f}\r
659 s ACD Readings ? { 0x91, parameter?(0x02,0x03,0x04,0x05,0x07) }\r
660 r ACD Readings ? { 0x91, parameter?, value? }\r
661 s Sleep mode test { 0x92, 0x00, 0x00, howlong(2 bytes), enable }\r
662 where: enable == 0x01 - enable after test\r
663 0x00 - don't enable after test\r
664 howlong (ms) = 0x07, 0xd0 = 2000\r
665 s ???(N6150) { 0x98, 0x00 }\r
666 r ???(N6150) { 0x98, 0x00, 0x04 }\r
667 s Get bin ringtone { 0x9e, location }\r
668 where: location=0,1,etc.\r
669 r Get bin ringtone { 0x9e, location, error, contents... }\r
670 where location=0,1,etc.\r
671 error=0x0a, ringtone NOT available\r
672 0x00, OK\r
673 s Set bin ringtone { 0xa0, location, 0x00, contenst... }\r
674 where: location=0,1,etc.\r
675 r Set bin ringtone { 0xa0, location, error }\r
676 where location=0,1,etc.\r
677 error=0x0a, ringtone NOT set\r
678 0x00, ringtone set OK\r
679 r Get MSid { 0xb5, 0x01, 0x2f, msid, 0x25 }\r
680 s Get info about phone { 0xc8, 0x01 }\r
681 r Get info about phone { 0xc8, 0x01, 0x00, "V ", "firmware", 0x0a, "firmware date", 0x0a, "model", 0x0a, "(c) NMP.", 0x00 }\r
682 s Get MCU SW Checksum { 0xc8, 0x02 }\r
683 r Get MCU SW Checksum { 0xc8, 0x02, 0x00, checksum (4 bytes),0x00 }\r
684 s DPS External SW { 0xc7, 0x03 }\r
685 r DSP External SW { 0xc7, 0x03, 0x00, string,0x00 }\r
686 s Get HW { 0xc8, 0x05 }\r
687 r Get HW { 0xc8, 0x05, 0x00, HW version (4 bytes), 0x00 }\r
688 s Get "Made" Date { 0xc8, 0x05 }\r
689 r Get "Made" Date { 0xc8, 0x05, 0x00, date(4 bytes), 0x00 }\r
690 s Get DSP Internal SW { 0xc8, 0x09 }\r
691 r Get DSP Internal SW { 0xc8, 0x09, 0x00, version (1 bytes), 0x00 }\r
692 s Get PCI version { 0xc8, 0x0b }\r
693 r Get PCI version { 0xc8, 0x0b, 0x00, version, 0x00 }\r
694 s Get system ASIC { 0xc8, 0x0c }\r
695 r Get system ASIC { 0xc8, 0x0c, 0x00, string, 0x00 }\r
696 s Get COBBA { 0xc8, 0x0d }\r
697 r Get COBBA { 0xc8, 0x0d, 0x00, string, 0x00 }\r
698 s Get PLUSSA { 0xc8, 0x0e }\r
699 r Get PLUSSA { 0xc8, 0x0e, available, 0x00 }\r
700 where available: 0x01: not available\r
701 s Get CCONT { 0xc8, 0x0f }\r
702 r Get CCONT { 0xc8, 0x0f, available, 0x00 }\r
703 where available: 0x01: not available\r
704 s Get PPM version { 0xc8, 0x10 }\r
705 r Get PPM version { 0xc8, 0x10, 0x00, "V ", "firmware", 0x0a, "firmware date", 0x0a, "model", 0x0a, "(c) NMP.", 0x00 }\r
706 s Get PPM info { 0xc8, 0x12 }\r
707 r Get PPM info { 0xc8, 0x12, 0x00, PPM version ("B", "C", etc.), 0x00 }\r
708 s Set HW version { 0xc9, 0x05, version, 0x00 }\r
709 s Get Product Code { 0xca, 0x01 }\r
710 r Get Product Code { 0xca, 0x01, 0x00, number, 0x00 }\r
711 s Get Order Number { 0xca, 0x02 }\r
712 r Get Order Number { 0xca, 0x02, 0x00, string, 0x00 }\r
713 s Get Prod.Ser.Number { 0xca, 0x03 }\r
714 r Get Prod.Ser.Number { 0xca, 0x03, 0x00, number, 0x00 }\r
715 s Get Basic Prod.Code { 0xca, 0x04 }\r
716 r Get Basic Prod.Code { 0xca, 0x04, 0x00, number, 0x00 }\r
717 s Set Product Code { 0xcb, 0x01, product code, 0x00 }\r
718 s Set Order Number { 0xcb, 0x02, number, 0x00 }\r
719 s Set Prod.Ser.Number { 0xcb, 0x03, number, 0x00 }\r
720 s Get (original ?)IMEI { 0xcc, 0x01 }\r
721 r Get (original ?)IMEI { 0xcc, 0x01, IMEI, 0x00 }\r
722 s Get Manufacture Month { 0xcc, 0x02 }\r
723 r Get Manufacture Month { 0xcc, 0x02, 0x00, string, 0x00 }\r
724 s Get Purchare date { 0xcc, 0x04 }\r
725 r Get Purchare date { 0xcc, 0x04, 0x00, string, 0x00 }\r
726 s Set "Made" date { 0xcd, 0x02, string, 0x00 }\r
727 s Make "all" phone tests{ 0xce,0x1d,0xfe,0x23,0x00,0x00}\r
728 s Make one phone test { 0xce,0x1d,num1,num2,num3,num4}\r
729 Where num1-num4: 0x02,0x00,0x00,0x00;\r
730 0x04,0x00,0x00,0x00;\r
731 0x08,0x00,0x00,0x00;\r
732 0x10,0x00,0x00,0x00;\r
733 0x20,0x00,0x00,0x00;\r
734 0x40,0x00,0x00,0x00;\r
735 0x80,0x00,0x00,0x00;\r
736 0x00,0x01,0x00,0x00;\r
737 0x00,0x02,0x00,0x00;\r
738 0x00,0x04,0x00,0x00; - "Power off"\r
739 No test for "Security data"\r
740 0x00,0x10,0x00,0x00;\r
741 0x00,0x20,0x00,0x00;\r
742 0x00,0x40,0x00,0x00;\r
743 0x00,0x80,0x00,0x00;\r
744 0x00,0x00,0x01,0x00;\r
745 ....\r
746 0x00,0x00,0x10,0x00;\r
747 s Result of phone tests { 0xcf }\r
748 r Result of phone tests { 0xcf, number of tests, results of next tests }\r
749 s ??? { 0xd1 }\r
750 r ???(N5110) { 0xd1, 0x00, 0x1d, 0x00, 0x01, 0x08, 0x00 }\r
751 s LCD Test { 0xd3, value }\r
752 where value: 0x03, 0x02 - 1'st test\r
753 0x03, 0x01 - 2'nd test\r
754 0x02, 0x03 - clears screen\r
755 s ACD Readings(N6150)? { 0xd4, 0x02, 0x00, 0x02, 0x00, 0x0e, 0x01}\r
756 r ACD Readings(N6150)? { 0xd4, 0x02, 0x00, 0x02, 0x00, 0x0e, 0x01, ?}\r
757 s Get EEPROM { 0xd4, 0x02, 0x00, 0xa0, locationLo, locationHi, numofbytes }\r
758 where: numofbytes - how many bytes to read\r
759 Note: Works ONLY in MBUS\r
760 r Get EEPROM { 0xd4, 0x02, 0x00, 0xa0, locationLo, locationHi, numofbytes, contest... }\r
761 where numofbytes - how many bytes available\r
762 contest - bytes with contests (if numofbytes != 0)\r
763 0x41: Snake game ?\r
764 0x47:\r
765 s Get Picture Image { 0x0001, location }\r
766 r Get Picture Image when contains sender number\r
767 { 0x0002, location, number(like in SMS), 0x00, len, text, 0x00, width, height, 0x01, bitmap }\r
768 NOTE:\r
769 Supports only 0x81 and 0x91 coding (NOT alphanumeric numbers!)\r
770 in sender without sender number\r
771 { 0x0002, location, 0x00, 0x00, 0x00, len, text, 0x00, width, height, 0x01, bitmap }\r
772 s Set Picture Image { 0x0003, frame...}\r
773 where frame: see 0x47/0x0002\r
774 r Get/Set PictureImageOK{ 0x0004 }\r
775 r Set Picture Image err { 0x0005, error? }\r
776 where error=0x74 - wrong location ?\r
777 0x64:\r
778 s Phone ID request { 0x0010 }\r
779 r Phone ID recvd { 0x0011, "NOKIA", "imei", 0, "model", 0, "prod.code", 0, "HW", 0, "firmware", magic bytes x 4 ... }\r
780 s Accessory connection { 0x0012, 16x0x00, 'NOKIA&NOKIA accessory', 3x0x00 } (45 bytes)\r
781 0x7f: Acknowledge(FBUS/IRDA){+type, seq }\r
782 Acknowledge(MBUS)...\r
783 0xd0: \r
784 s Power on message seq1 {+04 }\r
785 r Power on message seq1 {+05 }\r
786 0xd1:\r
787 s Get HW&SW version { 0x0003, 0x00 }\r
788 0xd2:\r
789 r Get HW&SW version { 0x0003 "V " "firmware\n" "firmware date\n"\r
790 "model\n" "(c) NMP." }\r
791 0xda: ? (during playing 2 player snake)\r
792 0xf0:\r
793 s Send RLP frame {+0x00, 0xd9, ... }\r
794 0xf4: Power on message seq 2\r