2 Last update 23.02.2002
\r
3 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
\r
6 Balazs Nagy (js@lsc.hu)
\r
7 Harri Yli-Torkko (hyt@surfeu.fi)
\r
8 Alfred R. Nurnberger <arnu@flosys.com>
\r
9 Hugh Blemings <Hugh.Blemings@vsb.com.au>
\r
10 Mike Bradley <mike@trumpington.st>
\r
11 Odinokov Serge <serge@takas.lt>
\r
12 Pavel Janik <Pavel@Janik.cz>
\r
13 BORBELY Zoltan (bozo@andrews.hu)
14 Pawel Kot <pkot@linuxnews.pl>
\r
15 Marcin Wiacek (Marcin-Wiacek@TOPNET.PL)
\r
16 ... and other members of gnokii mailing list
\r
17 and authors of some WWW pages.
\r
19 The data provided is for information purposes only.
\r
20 Some of the frames might be hazardous to your phone. Be careful!!!
\r
21 We do not take any responsibility or liability for damages, etc.
\r
23 NOTE: this information isn't (and can't be) complete. If you know anything
\r
24 about features not listed here or you noticed a bug in this list, please
\r
25 notify us via e-mail. Thank you.
\r
27 Document describing frames used in
\r
28 GSM/PCN Nokia 6110 and derivatives (Nokia 6130, 6150, 6190, 5110, 5130, 5150,
\r
30 Correct format is FBUS version 2/Direct IRDA/MBUS version 2
\r
31 (see nokia.txt for protocol details):
\r
35 0x00: Monitoring values
\r
36 r monitoring value {+0x01, 0x01, block... }
\r
37 where block: 0x5e, 0x05, 0x7a(?), 0xd0(?), 0x85(?), 0x02, percentHI, percentLO
\r
38 Battery percent level
\r
39 0x5e, 0x0c, 0x52(?), 0x4b(?), 0x6f(?), 0x02, voltageHI, voltageLO
\r
40 Battery standby voltage
\r
42 0x01: Call Information
\r
43 s Make call { 0x0001, "number", type, block }
\r
48 data call (non digital lines):
\r
49 0x02,0x01,0x05,0x81,0x01,0x00,0x00,0x01,0x02,0x0a,
\r
50 0x07,0xa2,0x88,0x81,0x21,0x15,0x63,0xa8,0x00,0x00
\r
51 data call (digital lines):
\r
52 0x02,0x01,0x05,0x81,0x01,0x00,0x00,0x01,0x02,0x0a,
\r
53 0x07,0xa1,0x88,0x89,0x21,0x15,0x63,0xa0,0x00,0x06,
\r
54 0x88,0x90,0x21,0x48,0x40,0xbb
\r
56 0x01, 0x01, 0x05, 0x81/0x00, sendnum, 0x00, 0x00, 0x01
\r
58 sendnum (own number sending):
\r
59 0x01: preset (depends on network)
\r
62 r Call going msg { 0x0002 }
\r
63 r Call in progress { 0x0003, seqnr }
\r
64 r Remote end hang up { 0x0004, seqnr, ?, error (like in netmon in 39) }
\r
65 r incoming call alert { 0x0005, seqnr, numlen, "number", namelen, "name" }
\r
66 s Answer call part 2 { 0x0006, seqnr, 0x00 }
\r
67 r answered call { 0x0007, seqnr }
\r
68 s Hang up { 0x0008, seqnr, 0x85 }
\r
69 r terminated call { 0x0009, seqnr }
\r
70 r call msg { 0x000a, seqnr }
\r
71 r call held { 0x0023, seqnr, 0x01 }
\r
72 r call resumed { 0x0025, seqnr, 0x01 }
\r
73 r Send DTMF/voice call { 0x0040}
\r
74 s Answer call part 1 { 0x0042,0x05,0x01,0x07,0xa2,0x88,0x81,0x21,0x15,0x63,0xa8,0x00,0x00,
\r
75 0x07,0xa3,0xb8,0x81,0x20,0x15,0x63,0x80 }
\r
76 s Sent after issuing { 0x0042,0x05,0x81,0x07,0xa1,0x88,0x89,0x21,0x15,0x63,0xa0,0x00,0x06,
\r
77 data call 0x88,0x90,0x21,0x48,0x40,0xbb,0x07,0xa3,
\r
78 (digital lines) 0xb8,0x81,0x20,0x15,0x63,0x80 }
\r
79 s Sent after issuing { 0x0042,0x05,0x01,0x07,0xa2,0xc8,0x81,0x21,0x15,0x63,0xa8,0x00,0x00,
\r
80 data call 0x07,0xa3,0xb8,0x81,0x20,0x15,0x63,0x80,
\r
81 (non digital lines) 0x01,0x60 }
\r
82 s Send DTMF { 0x0050, length, {ascii codes for DTMF}, 0x01 }
\r
85 to make data call (non digital lines):
\r
86 1.send "Make call" for non digital lines
\r
87 2.send "Sent after issuing data call (non digital lines)"
\r
88 to make data call (digital lines):
\r
89 1.send "Answer call part 1"
\r
90 2.send "Sent after issuing data call (digital lines)"
\r
91 3.send "Make call" for digital lines
\r
93 1.send "Answer call part 1"
\r
94 2.send "Answer call part 2"
\r
97 s Send SMS message { 0x0001, 0x02, 0x00 (SEND REQUEST), ... }
\r
98 r Message sent { 0x0002 }
\r
99 r Send failed { 0x0003, ?, ?, error (like in netmon in 65)}
\r
100 s Get SMS message { 0x0007, 0x02, location, 0x01, 0x64 }
\r
101 s Initiate connection { 0x000d, 0x00, 0x00, 0x02 }
\r
102 r Initiate ACK { 0x000e, 0x01 }
\r
103 r SMS message received { 0x0010, ...... } (whole message)
\r
104 s Set CellBroadcast { 0x0020, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01 }
\r
105 for enable cell broadcast ?
\r
106 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }
\r
107 for disable cell broadcast ?
\r
108 r Set CellBroadcast OK { 0x0021, 0x01 }
\r
109 r Read CellBroadcast { 0x0023, ?, ?, ?, channel, ?, message... } ?
\r
110 s Set SMS center { 0x0030, 0x64, priority, checksum? ,0?, format,
\r
111 validity, {DefaultRecipient no.}[12],
\r
112 {SMScenter no.}[12], {SMSC name}, 0x00}
\r
113 where tel.no.[12]: {len, type, {number(BCD)}}
\r
115 0x91: + (international)
\r
124 validity: 0x0b: 1 hour
\r
130 r Set SMS center OK { 0x0031 }
\r
131 r Set SMS center error { 0x0032, reason }
\r
132 s Get SMS center { 0x0033, 0x64, priority }
\r
133 r SMS center received { 0x0034, priority, checksum?, format, 0x00?,
\r
134 validity, {DefaultRecipient no.}[12],
\r
135 {SMScenter no.}[12], {SMSC name}, 0x00}
\r
136 tel.no[12]: {len, type, {number(BCD)}}
\r
137 where priority, checksum, type, validity,
\r
138 tel.no.[12]: see 0x02/0x0030
\r
139 r SMS center error recv { 0x0035, reason }
\r
140 0x03: Phonebook functions
\r
141 s Get mem location { 0x0001, memtype, location, 0 }
\r
143 0x01: telephone and SIM phonebook (in one)
\r
144 0x02: telephone phonebook
\r
145 0x03: SIM phonebook
\r
146 0x04: SIM fixdialling-phonebook (?)
\r
148 0x07: Dialled numbers
\r
150 0x09: Received calls
\r
151 0x0b: voice mailbox (location not important)
\r
152 r mem location recvd { 0x0002, 0x00,namelen,"name",numlen,"number",groupID, 0x01?, yearLO, yearHI, month, day, hour, minute, sec. }
\r
153 Note: in 3310 all entries have null name ("feature" of bug ?)
\r
154 r mem loc error recvd { 0x0003, errtype }
\r
155 where errtype: 0x7d: invalid memory type
\r
156 s Set mem location { 0x0004, memtype,location,namelen,"Name",numlen,"number",groupID }
\r
157 r mem set OK { 0x0005 }
\r
158 r mem set error { 0x0006, errtype }
\r
159 where errtype: 0x7d: name is too long
\r
160 s Mem status request { 0x0007, memtype }
\r
161 r Mem status recvd { 0x0008, memtype, free, used }
\r
162 r Mem status error recv { 0x0009, errtype }
\r
163 where errtype: 0x6f: mem status error
\r
164 0x7d: invalid memory type
\r
165 0x8d: waiting for pin
\r
166 s Get caller group data { 0x0010, groupID }
\r
167 r Get caller group data { 0x0011, groupID, size, "Name", ringtoneID, graphic_on?1:0, lenHI, lenLO, OTABitmap (72x14 logo) }
\r
168 r Get call.group error { 0x0012, reason }
\r
169 where reason: 0x7d: invalid location
\r
170 s Set caller group data { 0x0013, groupID, size, "Name", ringtoneID, graphic_on?1:0, lenHI, lenLO, OTABitmap (72x14 logo) }
\r
171 r Set caller group OK { 0x0014 }
\r
172 r Set call.group error { 0x0015, reason }
\r
173 where reason: 0x7d: invalid location
\r
174 s Get speed dial { 0x0016, index(1-9) }
\r
175 r Get speed dial OK { 0x0017, mem.type, location }
\r
176 where mem.type: 0x02: ME (== 0 if not stored)
\r
178 location: memory location (== 0 if not stored)
\r
179 r Get speed dial error { 0x0018 }
\r
180 s Set speed dial { 0x0019, index(1-9), mem.type, location }
\r
181 r Set speed dial OK { 0x001a }
\r
182 r Set speed dial error { 0x001b }
\r
184 s Phone status { 0x0001 }
\r
185 r Phone status { 0x0002, mode, signal str, ???, pwr, batt.level }
\r
186 where mode: 1: registered within the network
\r
187 2: call in progress
\r
192 s Request Phone ID { 0x0003 }
\r
193 r RequestPhone ID { 0x0004, 0x01,"NOKIA""imei", 0, "model", 0, "prod.code", 0, "HW", 0, "firmware", 0x00, 0x01 }
\r
194 0x05: Profile settings
\r
195 s Set profile feature { 0x0010, 1, nr, feature, a, 1 }
\r
196 where nr: see 0x05/0x0013
\r
197 feature: see 0x05/0x0014
\r
199 r Set profile feat. OK { 0x0011, 1 }
\r
200 s Get profile feature { 0x0013, 1, nr, feature, 1 }
\r
201 where nr is profile number (general=0, silent, meeting, outdoor, pager, car, headset=6)
\r
202 feature: see 0x05/0x0014
\r
203 r Get profile feature { 0x0014, 1, nr, feature, 4, a, b, c, d, 1 }
\r
205 Note: For Nokia 3330 settings num 0x00 .. 0x09 can be assigned
\r
206 separately to each profile (0x00 .. 0x05), but rest are common
\r
209 Features and answers (in a, b, c, d form):
\r
210 0x00: keypad notes (in Nokia 33x0 feature 0x00)
\r
216 0x01: lights (? only in car profile) (what number in Nokia 3310 ?)
\r
219 0x??: on (maybe 0x01)
\r
220 0x02: incoming call alert (in Nokia 33x0 feature 0x01)
\r
228 7: caller groups (see feature #0x08)
\r
229 0x03: ringing tone (in Nokia 33x0 feature 0x02)
\r
231 xx: 0x12: ring ring
\r
234 0x04: ringing volume (in Nokia 33x0 feature 0x03)
\r
236 xx: level 1 (0x06) - level 5 (0x0a)
\r
237 0x05: message alert tone (in Nokia 33x0 feature 0x04)
\r
244 0x06: vibration (in Nokia 33x0 feature 0x05)
\r
248 0x07: warning and game tones (in Nokia 33x0 feature 0x06 called warning tones)
\r
252 0x07: screen saver - Nokia 33x0
\r
255 0x08: incoming caller groups (what number in Nokia 3310 ?)
\r
262 0x08: Screen saver -> Timeout (Nokia 33xx):
\r
267 0x09: automatic answer (what number in Nokia 3310 ?)
\r
272 0x09: Screen saver -> Screen saver (Nokia 33xx):
\r
273 0x00 ... 0x0d = Number of picture image
\r
277 0x15: ???: Read only?
\r
283 0x17: Phone book -> Options -> Memory in use (Nokia 3330):
\r
287 0x18: Settings -> Phone settings -> Network selection (Nokia 3330):
\r
291 0x19 Settings -> Call settings -> Automatic redial(Nokia 3330):
\r
295 0x1a: Settings -> Call settings -> Speed dialling (Nokia 3330):
\r
299 0x1b: Settings -> Call settings -> Own number sending (Nokia 3330):
\r
300 0x00 = Set by network
\r
304 0x1c: Settings -> Phone settings -> Cell info display (Nokia 3330):
\r
307 0x1d: Phone book -> Options -> Type of view (Nokia 3330):
\r
309 0x01 = Name, number
\r
312 0x1e: Settings -> Phone settings -> Language (Nokia 3330):
\r
321 0x32 = Reboots ME (3330)
\r
323 0x1f: ???: Read only? (3330)
\r
325 0x20: Messages -> Message settings -> Common -> Reply via same centre (N3330):
\r
329 0x21: Messages -> Message settings -> Common -> Delivery reports (3330):
\r
333 0x22: Clock -> Clock settings -> Show/Hide clock (3330):
\r
337 0x23: Clock -> Clock settings -> Time format (N3330):
\r
341 0x24: Select profile (N3330):
\r
343 0x01 ... 0x05 = rest of them
\r
345 0x25: ???: Read only? (N3330)
\r
347 0x26: Settings -> Phone settings -> Confirm SIM service actions (N3330):
\r
351 0x27: Messages -> Write messages -> Options -> Dictionary (N3330):
\r
356 0x28: Messages -> Message settings -> Common -> Character support (N3330):
\r
358 0x01 = GSM alphabet
\r
361 0x29: Startup logo settings (N33x0):
\r
362 0x00 = Your own uploaded logo
\r
364 0x02 = Draft HUMAN technology(tm)
\r
367 0x2a:???: 0x00 = ??? 0x01 = ??? (N3330)
\r
369 0x2b: ???: 0x00 = ??? 0x01 = ??? (N3330)
\r
371 0x2c: ???: Read only? (N3330)
\r
373 0x2d: Clock -> Auto update of date and time (N3330):
\r
375 0x01 = Confirm first
\r
378 s Get welcome message { 0x0016 }
\r
379 r Get welcome message { 0x0017, no.of blocks, { block } * }
\r
380 where block: { id, {blockspecific} }
\r
381 id: 1: startup logo { y, x, picture (coding?) }
\r
382 2: welcome note { len, "message" }
\r
383 3: operator msg { len, "message" }
\r
384 s Set welcome message { 0x0018, no.of blocks, { block } * }
\r
385 where block: see 0x05/0x0017
\r
386 r Set welcome OK { 0x0019, 0x01 }
\r
387 s Get profile name { 0x001a, nr }
\r
388 where nr: see 0x05/0x0013
\r
389 r Profile name { 0x001b, 1, 1, 3, flen, nr, len, {text} }
\r
390 where nr: see 0x05/0x0013
\r
392 flen len + len(nr, len) = len + 2
\r
393 Note: in Nokia 3310 name is in Unicode
\r
395 r ??? { 0x001d, 0x93 }
\r
396 s Set oplogo { 0x0030, location, MCC1, MCC2, MNC, lenhi=0x00, lenlo=0x82, OTABitmap }
\r
397 r Set oplogo OK { 0x0031 }
\r
398 r Set oplogo error { 0x0032, reason }
\r
399 where reason: 0x7d invalid location
\r
400 s Get oplogo { 0x0033, location }
\r
401 where location: 1 (doesn't seem to matter)
\r
402 r Get oplogo { 0x0034, location, MCC1, MCC2, MNC, lenhi=0x00, lenlo=0x82, OTABitmap }
\r
403 r Get oplogo error { 0x0035, reason }
\r
404 where reason: 0x7d invalid location
\r
405 s Set ringtone { 0x0036, location,0x00,0x78, ringtone packed according to SM2.0}
\r
406 r Set ringtone OK { 0x0037 }
\r
407 r Set ringtone error { 0x0038, reason }
\r
408 where reason=0x7d, when not supported location
\r
409 s Get services settings { 0x0080, setting (2 bytes) }
\r
410 where: setting: 0x02,0x00=Nokia access number 1
\r
411 0x02,0x01=Operator access number 1
\r
412 0x01,0x00=Personal bookmark 1 settings (name only ?)
\r
415 r Get services sett.OK { 0x0081, .... }
\r
416 r Get services sett.err { 0x0082, 0x7b }
\r
417 0x06: Calling line restriction/Call forwarding etc
\r
418 r Get call divert { 0x0001, 0x02, x, 0x00, divtype, 0x02, calltype, y, z, 0x0b, number, 0x00...0x00, timeout (byte 45) }
419 s Set call divert { 0x0001, 0x03, 0x00, divtype, calltype, 0x01, number(packed like in SMS), 0x00 ... 0x00,
420 length of number (byte 29), 0x00 ... 0x00, timeout (byte 52), 0x00, 0x00, 0x00}
431 0x02: all diverts for all call types ?
\r
432 Found only, when deactivate all diverts for all call types (with call type 0x00)
\r
435 0x3d: when not answered
\r
436 0x3e: if not reached
\r
438 0x00: all calls (data, voice, fax)
\r
442 s Deactivate calldiverts{ 0x0001, 0x04, 0x00, divtype, calltype, 0x00 }
\r
443 where divtype, calltype: see above
\r
444 s Get call diverts { 0x0001, 0x05, 0x00, divtype, calltype, 0x00 }
\r
445 where divtype, calltype: see above
\r
446 r Get prepaid(?) info { 0x0005, ?,?,?,length,message(packed like in 7bit SMS)}
\r
448 s ??? { 0x0022, ? (1&2 sounds OK) }
\r
449 r ??? OK { 0x0023, ?,?,? }
\r
450 r ??? error { 0x0024, reason }
\r
451 s ??? { 0x0025, ??? }
\r
452 r ??? OK { 0x0026, ??? }
\r
453 r ??? error { 0x0027, reason }
\r
454 0x08: Security codes
\r
455 s Change code { 0x0004, code, "current", 0x00, "new", 0x00 }
\r
456 where code: 1: security code (5 chars)
\r
461 s Status request { 0x0007, 0x01 }
\r
462 r pin recvd { 0x0008, accepted }
\r
463 where accepted: 0x0c (or 0x06): OK
\r
464 code: waiting for (0x08/0x0004) code
\r
465 s entering code { 0x000a, code, "code", 0x00 }
\r
466 where code: see 0x08/0x0004
\r
469 r logout { 0x0081 }
\r
470 0x0a: Network status
\r
471 s Key duplication on/off{ 0x0044, on? 0x01: 0x02 }
\r
472 s get used network { 0x0070 }
\r
473 r network registration { 0x0071, ?,?,?,length,netstatus,netsel,cellIDH,cellIDL,lacH,lacL,netcode,netcode,netcode }
\r
475 s Get key assignments { 0x0040, 0x01 }
\r
476 r Get key assignments { 0x0041, {key '1'}, 0x00, {key '2'} ... {key '0'}, 0,0,0, {symbols}, 0 }
\r
477 where {key '0'} => ' ', '0'
\r
478 s Press key { 0x0042, press: 0x01; release: 0x02, button, 0x01 }
\r
479 where button: 0x01 - 0x09: 1-9
\r
484 0x0e: Pick up phone
\r
492 0x1B onwards: don't know but they do produce
\r
493 a beep and light up the keypad as if
\r
494 a key had been pressed.
\r
495 r Press key ack { 0x0043, press/release/error(0x05) }
\r
497 r ??? ack { 0x0045, 0x01 }
\r
499 r Display { 0x0050, 0x01, y, x, len, "string"(unicode) }
\r
500 s Status request { 0x0051 }
\r
501 r Status { 0x0052, no. of byte pairs, {byte pair} }
\r
502 where {byte pair}: {cmd, 1:off 2:on}
\r
503 cmd: 1: call in progress
\r
506 4: voice call active
\r
508 6: data call active
\r
510 8: is SMS storage full
\r
511 s Display status { 0x0053, 1:on 2:off }
\r
512 (will send displayed messages with x,y coordinates)
\r
513 r Display status ack { 0x0054, 1 }
\r
514 0x11: Phone clock & alarm
\r
515 s set date and time { 0x0060, 1,1,7,yearh,yearl,month,mday,hour,min,0x00 }
\r
516 r date and time set { 0x0061 }
\r
517 s get date and time { 0x0062 }
\r
518 r date and time recvd { 0x0063,date_set?,time_set?,?,?,yearh,yearl,month,mday,hour,min,second }
\r
519 where: date_set & time_set==0x01 - set
\r
520 0x00 - not set, ?,?,yearh,yearl,month,mday,hour,min,second
\r
521 not available in frame
\r
522 s set alarm { 0x006b, 1,32,3,0x02(on-off),hour,min,0x00 }
\r
523 r alarm set { 0x006c }
\r
524 s get alarm { 0x006d }
\r
525 r alarm received { 0x006e,?,?,?,?,alrm(==2:on),hour,min }
\r
526 0x12: Connect to NBS port (61xx only ?)
\r
527 s Send {+0x0c, 0x01, UDH header, data}
\r
528 (without 0,1 header -- for oplogo, cli, ringtone etc upload)
\r
529 where: UDH header = 0x06, 0x05, 0x04,destporth,destportl,srcporth,srcportl
\r
530 0x13: Calendar notes
\r
531 s Write calendar note { 0x0064, 0x01, 0x10, length, type, yearH, yearL, month, day, hour, timezone,
\r
532 alarm?(alarm yearH, yearL, month, day, hour, timezone): (0,0,0,0,0,0),
\r
534 r Write cal.note report { 0x0065, return }
\r
535 where return: 0x01: ok
\r
537 0x81: calendar functions busy. Exit Calendar menu and try again
\r
538 s Calendar notes set { 0x0066... }
\r
539 r Calendar note recvd { 0x0067, 0x01, ?, length, type, yrH,yrL,mon,day,hr,tz,alrm yrH,yrL,mon,day,hr,tz,textlen, "text" }
\r
540 r Cal.note recvd error { 0x0067, err }
\r
541 where err: 0x93: not available
\r
544 s Delete cal.note { 0x0068, location }
\r
545 r Del. cal.note report { 0x0069, err }
\r
546 where err: 0x01: OK
\r
547 0x93: cannot delete
\r
549 s Write SMS to SIM { 0x0004, .... }
\r
550 s Mark SMS as read { 0x0007, 0x02, location, 0x00, 0x64 }
\r
551 r SMS message frame rcv { 0x0008,subtype,?,num,?,BCD(smscenter)...} 20->type, 22->status
\r
552 where type: 0x06: delivery report
\r
553 status: 0x00: delivered
\r
556 0x09: reading failed
\r
557 subtype: 0x02: invalid mem type
\r
558 0x07: empty SMS location
\r
559 0x0c: no access to memory (no PIN in card, etc.)
\r
560 s Delete SMS message { 0x000a, 0x02, location }
\r
561 r Delete OK { 0x000b }
\r
562 s SMS status request { 0x0036, 0x64 }
\r
563 r SMS status { 0x0037,?,?,?,?,?,?,msgnumber,unread }
\r
564 r SMS status error { 0x0038 }
\r
566 s Enable WAP frames { 0x0000}
\r
567 r Enable WAP frames { 0x0002, 0x01}
\r
572 s Get WAP bookmark { 0x0006, 0x00, location}
\r
573 where location: 0 - 14
\r
574 r Get WAP bookmark { 0x0007, 0x00, name_len, name(unicode),
\r
575 url_len, url(unicode), 0x01,0x80,0x00[7]}
\r
576 r Get WAP bookmark err { 0x0008, error }
\r
578 0x00(?)invalid position
\r
579 0x01 user inside "Bookmarks" menu. Must leave it
\r
580 0x02 invalid/too high/empty location
\r
582 s Set WAP bookmark { 0x0009, 0xff, 0xff, name_len, name(unicode),
\r
583 url_len, url(unicode), 0x01,0x80,0x00[7] }
\r
584 Note: bookmark is added to the first free location.
\r
585 r Set WAP bookmark OK {+0x01, 0x36, 0x0a, block }
\r
587 0x0a, location_of_just_written_bookmark(?),
\r
588 0x00, next_free_location(?)
\r
589 r Set WAP bookmark err {+0x01, 0x36, 0x0b, error }
\r
591 0x04 - memory is full
\r
592 0x01 - we are in the bookmark menu
\r
593 0x00 - unknown reason for now ;(
\r
595 ? s Delete WAP bookmark { 0x000c, 0x00, location }
\r
596 where: location = 0-14
\r
597 ? r Delete WAR bookmark OK{ 0x000d }
\r
598 ? r Delete WAPbookmark err{ 0x000e, 0x02 }
\r
601 r ?? { 0x0010, 0x00}
\r
603 s Get WAP settings 1 { 0x0015, location}
\r
604 where location: 0x00 - 0x05
\r
605 r Get WAP settings 1 OK { 0x0016, title length, title (Unicode), URL length, URL(Unicode),con_type, ???[6 bytes],location, ???[5 bytes],security,...}
\r
607 con_type: 0x00 - temporary
\r
609 location: when use "Get WAP settings 2 frame", must give it
\r
610 security: 0x00 = no, 0x01 = yes
\r
611 r Get WAP settings 1 err{ 0x0017, error }
\r
613 0x01 user inside "Settings" menu. Must leave it
\r
614 0x02 invalid/too high/empty location
\r
616 s Get WAP settings 2 { 0x001b, location}
\r
617 where location: 0x00 - 0x1d (you get it in "Get WAP settings 1" frame)
\r
618 r Get WAP settings 2 OK { 0x001c, 0x01, type, frame...}
\r
619 where type : 0x00 - SMS bearer
\r
621 service_num_len, service_num (Unicode), server_num_len, server_num(Unicode)
\r
624 auth, call_type, call_speed, ?, IP len, IP (Unicode), dialup len, dialup (Unicode),
\r
625 user len, user (Unicode), password len, password (Unicode)
\r
626 where auth: 0x00 - normal, 0x01 - secure
\r
627 call_type: 0x00 - analogue, 0x01 - ISDN
\r
628 call_speed: 0x00 - 9600, 0x01 - 14400
\r
630 frame: type, service number len/IP len,service num (Unicode)/IP (Unicode),service code len,
\r
631 service code (Unicode)
\r
632 where type: 0x01 - service number, 0x00 - IP
\r
633 r Get WAP settings 2 err{ 0x001d,error}
\r
635 0x40: Security commands
\r
636 s ??? {+0x00, 0x00, 0x07, 0x11, 0x00, 0x10, 0x00, 0x00}
\r
637 This frame hangs phone (N3310 4.02). Meaning unknown !
\r
638 s Open simlock 1 { 0x02, 0x03, 0x1f, 0x11, 0x01, 0x01, 0x10, 0x00}
639 r Open simlock 1 { 0x02 }
640 s ???(N6150) { 0x08, 0x00 }
\r
641 r ???(N6150) { 0x08 }
\r
642 s Enable extended cmds { 0x64, cmd }
\r
643 where cmd: 0x00: off
\r
645 0x02: enter service mode ?
646 0x03: reset (doesn't ask for PIN again)
\r
647 0x04: reset (PIN is requested)
\r
648 In 5110 makes reset without PIN
\r
649 0x06: CONTACT SERVICE!!! Don't try it!
\r
650 s Reset phone settings { 0x65, value, 0x00 }
651 where value: 0x08 - reset UI (User Interface) settings
652 0x38 - reset UI, SCM and call counters
653 r Reset phone settings { 0x65, 0x00 }
654 s Get IMEI { 0x66 }
\r
655 r Get IMEI { 0x66, 0x01, IMEI, 0x00}
\r
656 s (ACD Readings)?(N6150 { 0x68 }
\r
657 r (ACD Readings)?(N6150 { 0x68, ... }
\r
658 s Get Product Profile
\r
660 r Get Product Profile
\r
661 Settings { 0x6a, 4bytes with Product Profile Settings }
\r
662 s Set Product Profile
\r
663 Settings { 0x6b, 4bytes with Product Profile Settings }
\r
664 r Set Product Profile
\r
665 Settings OK ? { 0x6b }
\r
666 s Get code { 0x6e, code }
\r
667 where code: see 0x08/0x0004 (only sec.code is allowed)
\r
668 r Get code { 0x6e, code, allowed, allowed? (sec code (text)) }
\r
669 where code: see 0x08/0x0004
\r
672 s Set code { 0x6f, code, sec code(text), 0x00 }
673 where code: see 0x08/0x0004
\r
674 s Start monitoring { 0x70, block }
\r
675 where block(N6150):
\r
676 0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
\r
677 0xff,0xff,0xff,0xff,0xff,0xf9,0x76,0x65,0x20,0x00,
\r
678 0x00,0x00,0x00,0x00,0x18,0x26,0x15,0x7d,0x0a,0x00,
\r
679 0xf5,0x82,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
\r
680 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xf0,0x77,0x80,
\r
681 0x77,0x80,0xf2,0x82,0x20,0x20,0x20,0x20,0x20,0x20,
\r
682 0x20,0x20,0x20,0x20
\r
683 This block enables probably all possible monitorred parameters.
\r
684 After it phone sends 0x00 message type values
\r
685 s Break monitoring { 0x71 }
\r
686 r Break monitoring { 0x71 }
\r
688 Counters (nm->test36) { 0x74, 0x01, 0x01, 0x0e }
\r
690 Counters (nm->test36) { 0x74 }
\r
691 s Call commands { 0x7c, block }
\r
692 where where: command, (values)
\r
694 values: number(ASCII), 0x00 - makes voice call
\r
695 command: 0x02 - answer call
\r
696 command: 0x03 - release call
\r
697 r Call commands { 0x7c, command }
\r
698 s Netmonitor { 0x7e, field }
\r
699 where: field: 00: next
\r
702 F2: field test menus
\r
703 F3: developer menus
\r
704 s Open simlock 2 { 0x81, 0x01, locknumber, 0x10, 0x10, 0x10, 0x10, 0x10 }
705 Note: sets simlock type to factory?
706 where locknumber: 1,2,4,8
707 s Open simlock 2 { 0x81, 0x01, locknumber }
708 where locknumber: 1,2,4,8
709 s Close simlock { 0x82, 0x01, locknumber, 0x00, 0x00, locksinfo(lock1,4,2,3), 0x00 }
710 where locknumber: 1,2,4,8
711 r Close simlock { 0x82, the rest like in 0x40/0x8a }
712 s Get simlock info { 0x8a, 0x00}
\r
713 r Get simlock info { 0x8a, 0x00, 0x01, lockstype, locksclosed, 0x00, 0x00, locksinfo(lock1,4,2,3), counter1,counter2,counter4,counter4,0x00 }
\r
714 where: lockstype: bit1,bit2,bit3,bit4 - if set, selected lock is user lock
\r
715 locksclosed: bit1,bit2,bit3,bit4 - if set, selected lock is closed
\r
716 counter1 - counter4: counters for locks
\r
717 s Set downloaded OpName { 0x8b, 0x00, MCC1, MCC2, MNC, Name, 0x00 }
\r
718 r SetdownloadedOpNameOK?{ 0x8b, 0x00, 0x01 }
\r
719 s Get downloaded OpName { 0x8c, 0x00 }
\r
720 r Get downloaded OpName { 0x8c, 0x00, 0x01, MCC1, MCC2, MNC, Name, 0x00,...}
\r
721 s Buzzer pitch { 0x8f, volume, hzLO, hzHI }
\r
722 if volume and hz is 0, it's off
\r
723 r Buzzer pitch { 0x8f}
\r
724 s ACD Readings ? { 0x91, parameter?(0x02,0x03,0x04,0x05,0x07) }
\r
725 r ACD Readings ? { 0x91, parameter?, value? }
\r
726 s Sleep mode test { 0x92, 0x00, 0x00, howlong(2 bytes), enable }
727 where: enable == 0x01 - enable after test
728 0x00 - don't enable after test
729 howlong (ms) = 0x07, 0xd0 = 2000
730 s ???(N6150) { 0x98, 0x00 }
\r
731 r ???(N6150) { 0x98, 0x00, 0x04 }
\r
732 s Get bin ringtone { 0x9e, location }
\r
733 where: location=0,1,etc.
\r
734 r Get bin ringtone { 0x9e, location, error, contents... }
\r
735 where location=0,1,etc.
\r
736 error=0x0a, ringtone NOT available
\r
738 s Set bin ringtone { 0xa0, location, 0x00, contenst... }
\r
739 where: location=0,1,etc.
\r
740 r Set bin ringtone { 0xa0, location, error }
\r
741 where location=0,1,etc.
\r
742 error=0x0a, ringtone NOT set
\r
743 0x00, ringtone set OK
\r
744 r Get MSid { 0xb5, 0x01, 0x2f, msid, 0x25 }
\r
745 s Get info about phone { 0xc8, 0x01 }
\r
746 r Get info about phone { 0xc8, 0x01, 0x00, "V ", "firmware", 0x0a, "firmware date", 0x0a, "model", 0x0a, "(c) NMP.", 0x00 }
\r
747 s Get MCU SW Checksum { 0xc8, 0x02 }
\r
748 r Get MCU SW Checksum { 0xc8, 0x02, 0x00, checksum (4 bytes),0x00 }
\r
749 s DPS External SW { 0xc7, 0x03 }
\r
750 r DSP External SW { 0xc7, 0x03, 0x00, string,0x00 }
\r
751 s Get HW { 0xc8, 0x05 }
\r
752 r Get HW { 0xc8, 0x05, 0x00, HW version (4 bytes), 0x00 }
\r
753 s Get "Made" Date { 0xc8, 0x05 }
\r
754 r Get "Made" Date { 0xc8, 0x05, 0x00, date(4 bytes), 0x00 }
\r
755 s Get DSP Internal SW { 0xc8, 0x09 }
\r
756 r Get DSP Internal SW { 0xc8, 0x09, 0x00, version (1 bytes), 0x00 }
\r
757 s Get PCI version { 0xc8, 0x0b }
\r
758 r Get PCI version { 0xc8, 0x0b, 0x00, version, 0x00 }
\r
759 s Get system ASIC { 0xc8, 0x0c }
\r
760 r Get system ASIC { 0xc8, 0x0c, 0x00, string, 0x00 }
\r
761 s Get COBBA { 0xc8, 0x0d }
\r
762 r Get COBBA { 0xc8, 0x0d, 0x00, string, 0x00 }
\r
763 s Get PLUSSA { 0xc8, 0x0e }
\r
764 r Get PLUSSA { 0xc8, 0x0e, available, 0x00 }
\r
765 where available: 0x01: not available
\r
766 s Get CCONT { 0xc8, 0x0f }
\r
767 r Get CCONT { 0xc8, 0x0f, available, 0x00 }
\r
768 where available: 0x01: not available
\r
769 s Get PPM version { 0xc8, 0x10 }
\r
770 r Get PPM version { 0xc8, 0x10, 0x00, "V ", "firmware", 0x0a, "firmware date", 0x0a, "model", 0x0a, "(c) NMP.", 0x00 }
\r
771 s Get PPM info { 0xc8, 0x12 }
\r
772 r Get PPM info { 0xc8, 0x12, 0x00, PPM version ("B", "C", etc.), 0x00 }
\r
773 s Set HW version { 0xc9, 0x05, version, 0x00 }
\r
774 s Get Product Code { 0xca, 0x01 }
\r
775 r Get Product Code { 0xca, 0x01, 0x00, number, 0x00 }
\r
776 s Get Order Number { 0xca, 0x02 }
\r
777 r Get Order Number { 0xca, 0x02, 0x00, string, 0x00 }
\r
778 s Get Prod.Ser.Number { 0xca, 0x03 }
\r
779 r Get Prod.Ser.Number { 0xca, 0x03, 0x00, number, 0x00 }
\r
780 s Get Basic Prod.Code { 0xca, 0x04 }
\r
781 r Get Basic Prod.Code { 0xca, 0x04, 0x00, number, 0x00 }
\r
782 s Set Product Code { 0xcb, 0x01, product code, 0x00 }
\r
783 s Set Order Number { 0xcb, 0x02, number, 0x00 }
\r
784 s Set Prod.Ser.Number { 0xcb, 0x03, number, 0x00 }
\r
785 s Get (original ?)IMEI { 0xcc, 0x01 }
\r
786 r Get (original ?)IMEI { 0xcc, 0x01, IMEI, 0x00 }
\r
787 s Get Manufacture Month { 0xcc, 0x02 }
\r
788 r Get Manufacture Month { 0xcc, 0x02, 0x00, string, 0x00 }
\r
789 s Get Purchare date { 0xcc, 0x04 }
\r
790 r Get Purchare date { 0xcc, 0x04, 0x00, string, 0x00 }
\r
791 s Set "Made" date { 0xcd, 0x02, string, 0x00 }
\r
792 s Make "all" phone tests{ 0xce,0x1d,0xfe,0x23,0x00,0x00}
\r
793 s Make one phone test { 0xce,0x1d,num1,num2,num3,num4}
\r
794 Where num1-num4: 0x02,0x00,0x00,0x00;
\r
795 0x04,0x00,0x00,0x00;
\r
796 0x08,0x00,0x00,0x00;
\r
797 0x10,0x00,0x00,0x00;
\r
798 0x20,0x00,0x00,0x00;
\r
799 0x40,0x00,0x00,0x00;
\r
800 0x80,0x00,0x00,0x00;
\r
801 0x00,0x01,0x00,0x00;
\r
802 0x00,0x02,0x00,0x00;
\r
803 0x00,0x04,0x00,0x00; - "Power off"
\r
804 No test for "Security data"
\r
805 0x00,0x10,0x00,0x00;
\r
806 0x00,0x20,0x00,0x00;
\r
807 0x00,0x40,0x00,0x00;
\r
808 0x00,0x80,0x00,0x00;
\r
809 0x00,0x00,0x01,0x00;
\r
811 0x00,0x00,0x10,0x00;
\r
812 s Result of phone tests { 0xcf }
\r
813 r Result of phone tests { 0xcf, number of tests, results of next tests }
\r
815 r ???(N5110) { 0xd1, 0x00, 0x1d, 0x00, 0x01, 0x08, 0x00 }
\r
816 s LCD Test { 0xd3, value }
\r
817 where value: 0x03, 0x02 - 1'st test
\r
818 0x03, 0x01 - 2'nd test
\r
819 0x02, 0x03 - clears screen
\r
820 s ACD Readings(N6150)? { 0xd4, 0x02, 0x00, 0x02, 0x00, 0x0e, 0x01}
\r
821 r ACD Readings(N6150)? { 0xd4, 0x02, 0x00, 0x02, 0x00, 0x0e, 0x01, ?}
\r
822 s Get EEPROM { 0xd4, 0x02, 0x00, 0xa0, locationLo, locationHi, numofbytes }
823 where: numofbytes - how many bytes to read
824 Note: Works ONLY in MBUS
825 r Get EEPROM { 0xd4, 0x02, 0x00, 0xa0, locationLo, locationHi, numofbytes, contest... }
826 where numofbytes - how many bytes available
827 contest - bytes with contests (if numofbytes != 0)
830 s Get Picture Image { 0x0001, location }
\r
831 r Get Picture Image when contains sender number
\r
832 { 0x0002, location, number(like in SMS), 0x00, len, text, 0x00, width, height, 0x01, bitmap }
\r
834 Supports only 0x81 and 0x91 coding (NOT alphanumeric numbers!)
\r
835 in sender without sender number
\r
836 { 0x0002, location, 0x00, 0x00, 0x00, len, text, 0x00, width, height, 0x01, bitmap }
\r
837 s Set Picture Image { 0x0003, frame...}
\r
838 where frame: see 0x47/0x0002
\r
839 r Get/Set PictureImageOK{ 0x0004 }
\r
840 r Set Picture Image err { 0x0005, error? }
\r
841 where error=0x74 - wrong location ?
\r
843 s Phone ID request { 0x0010 }
\r
844 r Phone ID recvd { 0x0011, "NOKIA", "imei", 0, "model", 0, "prod.code", 0, "HW", 0, "firmware", magic bytes x 4 ... }
\r
845 s Accessory connection { 0x0012, 16x0x00, 'NOKIA&NOKIA accessory', 3x0x00 } (45 bytes)
\r
846 0x7f: Acknowledge(FBUS/IRDA){+type, seq }
\r
847 Acknowledge(MBUS)...
\r
849 s Power on message seq1 {+04 }
\r
850 r Power on message seq1 {+05 }
\r
852 s Get HW&SW version { 0x0003, 0x00 }
\r
854 r Get HW&SW version { 0x0003 "V " "firmware\n" "firmware date\n"
\r
855 "model\n" "(c) NMP." }
\r
856 0xda: ? (during playing 2 player snake)
\r
858 s Send RLP frame {+0x00, 0xd9, ... }
\r
859 0xf4: Power on message seq 2
\r
git://git.jankratochvil.net / gnokii.git / blob