3 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
6 Balazs Nagy (js@lsc.hu)
7 Harri Yli-Torkko (hyt@surfeu.fi)
8 Alfred R. Nurnberger <arnu@flosys.com>
9 Hugh Blemings <Hugh.Blemings@vsb.com.au>
10 Mike Bradley <mike@trumpington.st>
11 Odinokov Serge <serge@takas.lt>
12 Pavel Janik <Pavel@Janik.cz>
13 BORBELY Zoltan (bozo@andrews.hu)
14 Pawel Kot <pkot@linuxnews.pl>
15 Marcin Wiacek (Marcin-Wiacek@TOPNET.PL)
16 ... and other members of gnokii mailing list
17 and authors of some WWW pages.
19 The data provided is for information purposes only.
20 Some of the frames might be hazardous to your phone. Be careful!!!
21 We do not take any responsibility or liability for damages, etc.
23 NOTE: this information isn't (and can't be) complete. If you know anything
24 about features not listed here or you noticed a bug in this list, please
25 notify us via e-mail. Thank you.
27 Document describing frames used in
28 GSM/PCN Nokia 6110 and derivatives (Nokia 6130, 6150, 6190, 5110, 5130, 5150,
30 Correct format is FBUS version 2/Direct IRDA/MBUS version 2
31 (see nokia.txt for protocol details):
35 0x00: Monitoring values
36 r monitoring value {+0x01, 0x01, block... }
37 where block: 0x5e, 0x05, 0x7a(?), 0xd0(?), 0x85(?), 0x02, percentHI, percentLO
39 0x5e, 0x0c, 0x52(?), 0x4b(?), 0x6f(?), 0x02, voltageHI, voltageLO
40 Battery standby voltage
42 0x01: Call Information
43 s Make call { 0x0001, "number", type, block }
48 data call (non digital lines):
49 0x02,0x01,0x05,0x81,0x01,0x00,0x00,0x01,0x02,0x0a,
50 0x07,0xa2,0x88,0x81,0x21,0x15,0x63,0xa8,0x00,0x00
51 data call (digital lines):
52 0x02,0x01,0x05,0x81,0x01,0x00,0x00,0x01,0x02,0x0a,
53 0x07,0xa1,0x88,0x89,0x21,0x15,0x63,0xa0,0x00,0x06,
54 0x88,0x90,0x21,0x48,0x40,0xbb
56 0x01, 0x01, 0x05, 0x81/0x00, sendnum, 0x00, 0x00, 0x01
58 sendnum (own number sending):
59 0x01: preset (depends on network)
62 r Call going msg { 0x0002 }
63 r Call in progress { 0x0003, seqnr }
64 r Remote end hang up { 0x0004, seqnr, ?, error (like in netmon in 39) }
65 r incoming call alert { 0x0005, seqnr, numlen, "number", namelen, "name" }
66 s Answer call part 2 { 0x0006, seqnr, 0x00 }
67 r answered call { 0x0007, seqnr }
68 s Hang up { 0x0008, seqnr, 0x85 }
69 r terminated call { 0x0009, seqnr }
70 r call msg { 0x000a, seqnr }
71 r call held { 0x0023, seqnr, 0x01 }
72 r call resumed { 0x0025, seqnr, 0x01 }
73 r Send DTMF/voice call { 0x0040}
74 s Answer call part 1 { 0x0042,0x05,0x01,0x07,0xa2,0x88,0x81,0x21,0x15,0x63,0xa8,0x00,0x00,
75 0x07,0xa3,0xb8,0x81,0x20,0x15,0x63,0x80 }
76 s Sent after issuing { 0x0042,0x05,0x81,0x07,0xa1,0x88,0x89,0x21,0x15,0x63,0xa0,0x00,0x06,
77 data call 0x88,0x90,0x21,0x48,0x40,0xbb,0x07,0xa3,
78 (digital lines) 0xb8,0x81,0x20,0x15,0x63,0x80 }
79 s Sent after issuing { 0x0042,0x05,0x01,0x07,0xa2,0xc8,0x81,0x21,0x15,0x63,0xa8,0x00,0x00,
80 data call 0x07,0xa3,0xb8,0x81,0x20,0x15,0x63,0x80,
81 (non digital lines) 0x01,0x60 }
82 s Send DTMF { 0x0050, length, {ascii codes for DTMF}, 0x01 }
85 to make data call (non digital lines):
86 1.send "Make call" for non digital lines
87 2.send "Sent after issuing data call (non digital lines)"
88 to make data call (digital lines):
89 1.send "Answer call part 1"
90 2.send "Sent after issuing data call (digital lines)"
91 3.send "Make call" for digital lines
93 1.send "Answer call part 1"
94 2.send "Answer call part 2"
97 s Send SMS message { 0x0001, 0x02, 0x00 (SEND REQUEST), ... }
98 r Message sent { 0x0002 }
99 r Send failed { 0x0003, ?, ?, error (like in netmon in 65)}
100 s Get SMS message { 0x0007, 0x02, location, 0x01, 0x64 }
101 s Initiate connection { 0x000d, 0x00, 0x00, 0x02 }
102 r Initiate ACK { 0x000e, 0x01 }
103 r SMS message received { 0x0010, ...... } (whole message)
104 s Set CellBroadcast { 0x0020, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01 }
105 for enable cell broadcast ?
106 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }
107 for disable cell broadcast ?
108 r Set CellBroadcast OK { 0x0021, 0x01 }
109 r Read CellBroadcast { 0x0023, ?, ?, ?, channel, ?, message... } ?
110 s Set SMS center { 0x0030, 0x64, priority, checksum? ,0?, format,
111 validity, {DefaultRecipient no.}[12],
112 {SMScenter no.}[12], {SMSC name}, 0x00}
113 where tel.no.[12]: {len, type, {number(BCD)}}
115 0x91: + (international)
124 validity: 0x0b: 1 hour
130 r Set SMS center OK { 0x0031 }
131 r Set SMS center error { 0x0032, reason }
132 s Get SMS center { 0x0033, 0x64, priority }
133 r SMS center received { 0x0034, priority, checksum?, format, 0x00?,
134 validity, {DefaultRecipient no.}[12],
135 {SMScenter no.}[12], {SMSC name}, 0x00}
136 tel.no[12]: {len, type, {number(BCD)}}
137 where priority, checksum, type, validity,
138 tel.no.[12]: see 0x02/0x0030
139 r SMS center error recv { 0x0035, reason }
140 0x03: Phonebook functions
141 s Get mem location { 0x0001, memtype, location, 0 }
143 0x01: telephone and SIM phonebook (in one)
144 0x02: telephone phonebook
146 0x04: SIM fixdialling-phonebook (?)
148 0x07: Dialled numbers
151 0x0b: voice mailbox (location not important)
152 r mem location recvd { 0x0002, 0x00,namelen,"name",numlen,"number",groupID, 0x01?, yearLO, yearHI, month, day, hour, minute, sec. }
153 Note: in 3310 all entries have null name ("feature" of bug ?)
154 r mem loc error recvd { 0x0003, errtype }
155 where errtype: 0x7d: invalid memory type
156 s Set mem location { 0x0004, memtype,location,namelen,"Name",numlen,"number",groupID }
157 r mem set OK { 0x0005 }
158 r mem set error { 0x0006, errtype }
159 where errtype: 0x7d: name is too long
160 s Mem status request { 0x0007, memtype }
161 r Mem status recvd { 0x0008, memtype, free, used }
162 r Mem status error recv { 0x0009, errtype }
163 where errtype: 0x6f: mem status error
164 0x7d: invalid memory type
165 0x8d: waiting for pin
166 s Get caller group data { 0x0010, groupID }
167 r Get caller group data { 0x0011, groupID, size, "Name", ringtoneID, graphic_on?1:0, lenHI, lenLO, OTABitmap (72x14 logo) }
168 r Get call.group error { 0x0012, reason }
169 where reason: 0x7d: invalid location
170 s Set caller group data { 0x0013, groupID, size, "Name", ringtoneID, graphic_on?1:0, lenHI, lenLO, OTABitmap (72x14 logo) }
171 r Set caller group OK { 0x0014 }
172 r Set call.group error { 0x0015, reason }
173 where reason: 0x7d: invalid location
174 s Get speed dial { 0x0016, index(1-9) }
175 r Get speed dial OK { 0x0017, mem.type, location }
176 where mem.type: 0x02: ME (== 0 if not stored)
178 location: memory location (== 0 if not stored)
179 r Get speed dial error { 0x0018 }
180 s Set speed dial { 0x0019, index(1-9), mem.type, location }
181 r Set speed dial OK { 0x001a }
182 r Set speed dial error { 0x001b }
184 s Phone status { 0x0001 }
185 r Phone status { 0x0002, mode, signal str, ???, pwr, batt.level }
186 where mode: 1: registered within the network
192 s Request Phone ID { 0x0003 }
193 r RequestPhone ID { 0x0004, 0x01,"NOKIA""imei", 0, "model", 0, "prod.code", 0, "HW", 0, "firmware", 0x00, 0x01 }
194 0x05: Profile settings
195 s Set profile feature { 0x0010, 1, nr, feature, a, 1 }
196 where nr: see 0x05/0x0013
197 feature: see 0x05/0x0014
199 r Set profile feat. OK { 0x0011, 1 }
200 s Get profile feature { 0x0013, 1, nr, feature, 1 }
201 where nr is profile number (general=0, silent, meeting, outdoor, pager, car, headset=6)
202 feature: see 0x05/0x0014
203 r Get profile feature { 0x0014, 1, nr, feature, 4, a, b, c, d, 1 }
205 Note: For Nokia 3330 settings num 0x00 .. 0x09 can be assigned
206 separately to each profile (0x00 .. 0x05), but rest are common
209 Features and answers (in a, b, c, d form):
210 0x00: keypad notes (in Nokia 33x0 feature 0x00)
216 0x01: lights (? only in car profile) (what number in Nokia 3310 ?)
219 0x??: on (maybe 0x01)
220 0x02: incoming call alert (in Nokia 33x0 feature 0x01)
228 7: caller groups (see feature #0x08)
229 0x03: ringing tone (in Nokia 33x0 feature 0x02)
234 0x04: ringing volume (in Nokia 33x0 feature 0x03)
236 xx: level 1 (0x06) - level 5 (0x0a)
237 0x05: message alert tone (in Nokia 33x0 feature 0x04)
244 0x06: vibration (in Nokia 33x0 feature 0x05)
248 0x07: warning and game tones (in Nokia 33x0 feature 0x06 called warning tones)
252 0x07: screen saver - Nokia 33x0
255 0x08: incoming caller groups (what number in Nokia 3310 ?)
262 0x08: Screen saver -> Timeout (Nokia 33xx):
267 0x09: automatic answer (what number in Nokia 3310 ?)
272 0x09: Screen saver -> Screen saver (Nokia 33xx):
273 0x00 ... 0x0d = Number of picture image
277 0x15: ???: Read only?
283 0x17: Phone book -> Options -> Memory in use (Nokia 3330):
287 0x18: Settings -> Phone settings -> Network selection (Nokia 3330):
291 0x19 Settings -> Call settings -> Automatic redial(Nokia 3330):
295 0x1a: Settings -> Call settings -> Speed dialling (Nokia 3330):
299 0x1b: Settings -> Call settings -> Own number sending (Nokia 3330):
300 0x00 = Set by network
304 0x1c: Settings -> Phone settings -> Cell info display (Nokia 3330):
307 0x1d: Phone book -> Options -> Type of view (Nokia 3330):
312 0x1e: Settings -> Phone settings -> Language (Nokia 3330):
321 0x32 = Reboots ME (3330)
323 0x1f: ???: Read only? (3330)
325 0x20: Messages -> Message settings -> Common -> Reply via same centre (N3330):
329 0x21: Messages -> Message settings -> Common -> Delivery reports (3330):
333 0x22: Clock -> Clock settings -> Show/Hide clock (3330):
337 0x23: Clock -> Clock settings -> Time format (N3330):
341 0x24: Select profile (N3330):
343 0x01 ... 0x05 = rest of them
345 0x25: ???: Read only? (N3330)
347 0x26: Settings -> Phone settings -> Confirm SIM service actions (N3330):
351 0x27: Messages -> Write messages -> Options -> Dictionary (N3330):
356 0x28: Messages -> Message settings -> Common -> Character support (N3330):
361 0x29: Startup logo settings (N33x0):
362 0x00 = Your own uploaded logo
364 0x02 = Draft HUMAN technology(tm)
367 0x2a:???: 0x00 = ??? 0x01 = ??? (N3330)
369 0x2b: ???: 0x00 = ??? 0x01 = ??? (N3330)
371 0x2c: ???: Read only? (N3330)
373 0x2d: Clock -> Auto update of date and time (N3330):
378 s Get welcome message { 0x0016 }
379 r Get welcome message { 0x0017, no.of blocks, { block } * }
380 where block: { id, {blockspecific} }
381 id: 1: startup logo { y, x, picture (coding?) }
382 2: welcome note { len, "message" }
383 3: operator msg { len, "message" }
384 s Set welcome message { 0x0018, no.of blocks, { block } * }
385 where block: see 0x05/0x0017
386 r Set welcome OK { 0x0019, 0x01 }
387 s Get profile name { 0x001a, nr }
388 where nr: see 0x05/0x0013
389 r Profile name { 0x001b, 1, 1, 3, flen, nr, len, {text} }
390 where nr: see 0x05/0x0013
392 flen len + len(nr, len) = len + 2
393 Note: in Nokia 3310 name is in Unicode
395 r ??? { 0x001d, 0x93 }
396 s Set oplogo { 0x0030, location, MCC1, MCC2, MNC, lenhi=0x00, lenlo=0x82, OTABitmap }
397 r Set oplogo OK { 0x0031 }
398 r Set oplogo error { 0x0032, reason }
399 where reason: 0x7d invalid location
400 s Get oplogo { 0x0033, location }
401 where location: 1 (doesn't seem to matter)
402 r Get oplogo { 0x0034, location, MCC1, MCC2, MNC, lenhi=0x00, lenlo=0x82, OTABitmap }
403 r Get oplogo error { 0x0035, reason }
404 where reason: 0x7d invalid location
405 s Set ringtone { 0x0036, location,0x00,0x78, ringtone packed according to SM2.0}
406 r Set ringtone OK { 0x0037 }
407 r Set ringtone error { 0x0038, reason }
408 where reason=0x7d, when not supported location
409 s Get services settings { 0x0080, setting (2 bytes) }
410 where: setting: 0x02,0x00=Nokia access number 1
411 0x02,0x01=Operator access number 1
412 0x01,0x00=Personal bookmark 1 settings (name only ?)
415 r Get services sett.OK { 0x0081, .... }
416 r Get services sett.err { 0x0082, 0x7b }
417 0x06: Calling line restriction/Call forwarding etc
418 r Get call divert { 0x0001, 0x02, x, 0x00, divtype, 0x02, calltype, y, z, 0x0b, number, 0x00...0x00, timeout (byte 45) }
419 s Set call divert { 0x0001, 0x03, 0x00, divtype, calltype, 0x01, number(packed like in SMS), 0x00 ... 0x00,
420 length of number (byte 29), 0x00 ... 0x00, timeout (byte 52), 0x00, 0x00, 0x00}
431 0x02: all diverts for all call types ?
432 Found only, when deactivate all diverts for all call types (with call type 0x00)
435 0x3d: when not answered
438 0x00: all calls (data, voice, fax)
442 s Deactivate calldiverts{ 0x0001, 0x04, 0x00, divtype, calltype, 0x00 }
443 where divtype, calltype: see above
444 s Get call diverts { 0x0001, 0x05, 0x00, divtype, calltype, 0x00 }
445 where divtype, calltype: see above
446 r Get prepaid(?) info { 0x0005, ?,?,?,length,message(packed like in 7bit SMS)}
448 s ??? { 0x0022, ? (1&2 sounds OK) }
449 r ??? OK { 0x0023, ?,?,? }
450 r ??? error { 0x0024, reason }
451 s ??? { 0x0025, ??? }
452 r ??? OK { 0x0026, ??? }
453 r ??? error { 0x0027, reason }
455 s Change code { 0x0004, code, "current", 0x00, "new", 0x00 }
456 where code: 1: security code (5 chars)
461 s Status request { 0x0007, 0x01 }
462 r pin recvd { 0x0008, accepted }
463 where accepted: 0x0c (or 0x06): OK
464 code: waiting for (0x08/0x0004) code
465 s entering code { 0x000a, code, "code", 0x00 }
466 where code: see 0x08/0x0004
471 s Key duplication on/off{ 0x0044, on? 0x01: 0x02 }
472 s get used network { 0x0070 }
473 r network registration { 0x0071, ?,?,?,length,netstatus,netsel,cellIDH,cellIDL,lacH,lacL,netcode,netcode,netcode }
475 s Get key assignments { 0x0040, 0x01 }
476 r Get key assignments { 0x0041, {key '1'}, 0x00, {key '2'} ... {key '0'}, 0,0,0, {symbols}, 0 }
477 where {key '0'} => ' ', '0'
478 s Press key { 0x0042, press: 0x01; release: 0x02, button, 0x01 }
479 where button: 0x01 - 0x09: 1-9
492 0x1B onwards: don't know but they do produce
493 a beep and light up the keypad as if
494 a key had been pressed.
495 r Press key ack { 0x0043, press/release/error(0x05) }
497 r ??? ack { 0x0045, 0x01 }
499 r Display { 0x0050, 0x01, y, x, len, "string"(unicode) }
500 s Status request { 0x0051 }
501 r Status { 0x0052, no. of byte pairs, {byte pair} }
502 where {byte pair}: {cmd, 1:off 2:on}
503 cmd: 1: call in progress
510 8: is SMS storage full
511 s Display status { 0x0053, 1:on 2:off }
512 (will send displayed messages with x,y coordinates)
513 r Display status ack { 0x0054, 1 }
514 0x11: Phone clock & alarm
515 s set date and time { 0x0060, 1,1,7,yearh,yearl,month,mday,hour,min,0x00 }
516 r date and time set { 0x0061 }
517 s get date and time { 0x0062 }
518 r date and time recvd { 0x0063,date_set?,time_set?,?,?,yearh,yearl,month,mday,hour,min,second }
519 where: date_set & time_set==0x01 - set
520 0x00 - not set, ?,?,yearh,yearl,month,mday,hour,min,second
521 not available in frame
522 s set alarm { 0x006b, 1,32,3,0x02(on-off),hour,min,0x00 }
523 r alarm set { 0x006c }
524 s get alarm { 0x006d }
525 r alarm received { 0x006e,?,?,?,?,alrm(==2:on),hour,min }
526 0x12: Connect to NBS port (61xx only ?)
527 s Send {+0x0c, 0x01, UDH header, data}
528 (without 0,1 header -- for oplogo, cli, ringtone etc upload)
529 where: UDH header = 0x06, 0x05, 0x04,destporth,destportl,srcporth,srcportl
531 s Write calendar note { 0x0064, 0x01, 0x10, length, type, yearH, yearL, month, day, hour, timezone,
532 alarm?(alarm yearH, yearL, month, day, hour, timezone): (0,0,0,0,0,0),
534 r Write cal.note report { 0x0065, return }
535 where return: 0x01: ok
537 0x81: calendar functions busy. Exit Calendar menu and try again
538 s Calendar notes set { 0x0066... }
539 r Calendar note recvd { 0x0067, 0x01, ?, length, type, yrH,yrL,mon,day,hr,tz,alrm yrH,yrL,mon,day,hr,tz,textlen, "text" }
540 r Cal.note recvd error { 0x0067, err }
541 where err: 0x93: not available
544 s Delete cal.note { 0x0068, location }
545 r Del. cal.note report { 0x0069, err }
549 s Write SMS to SIM { 0x0004, .... }
550 s Mark SMS as read { 0x0007, 0x02, location, 0x00, 0x64 }
551 r SMS message frame rcv { 0x0008,subtype,?,num,?,BCD(smscenter)...} 20->type, 22->status
552 where type: 0x06: delivery report
553 status: 0x00: delivered
557 subtype: 0x02: invalid mem type
558 0x07: empty SMS location
559 0x0c: no access to memory (no PIN in card, etc.)
560 s Delete SMS message { 0x000a, 0x02, location }
561 r Delete OK { 0x000b }
562 s SMS status request { 0x0036, 0x64 }
563 r SMS status { 0x0037,?,?,?,?,?,?,msgnumber,unread }
564 r SMS status error { 0x0038 }
566 s Enable WAP frames { 0x0000}
567 r Enable WAP frames { 0x0002, 0x01}
572 s Get WAP bookmark { 0x0006, 0x00, location}
573 where location: 0 - 14
574 r Get WAP bookmark { 0x0007, 0x00, name_len, name(unicode),
575 url_len, url(unicode), 0x01,0x80,0x00[7]}
576 r Get WAP bookmark err { 0x0008, error }
578 0x00(?)invalid position
579 0x01 user inside "Bookmarks" menu. Must leave it
580 0x02 invalid/too high/empty location
582 s Set WAP bookmark { 0x0009, 0xff, 0xff, name_len, name(unicode),
583 url_len, url(unicode), 0x01,0x80,0x00[7] }
584 Note: bookmark is added to the first free location.
585 r Set WAP bookmark OK {+0x01, 0x36, 0x0a, block }
587 0x0a, location_of_just_written_bookmark(?),
588 0x00, next_free_location(?)
589 r Set WAP bookmark err {+0x01, 0x36, 0x0b, error }
591 0x04 - memory is full
592 0x01 - we are in the bookmark menu
593 0x00 - unknown reason for now ;(
595 ? s Delete WAP bookmark { 0x000c, 0x00, location }
596 where: location = 0-14
597 ? r Delete WAR bookmark OK{ 0x000d }
598 ? r Delete WAPbookmark err{ 0x000e, 0x02 }
603 s Get WAP settings 1 { 0x0015, location}
604 where location: 0x00 - 0x05
605 r Get WAP settings 1 OK { 0x0016, title length, title (Unicode), URL length, URL(Unicode),con_type, ???[6 bytes],location, ???[5 bytes],security,...}
607 con_type: 0x00 - temporary
609 location: when use "Get WAP settings 2 frame", must give it
610 security: 0x00 = no, 0x01 = yes
611 r Get WAP settings 1 err{ 0x0017, error }
613 0x01 user inside "Settings" menu. Must leave it
614 0x02 invalid/too high/empty location
616 s Get WAP settings 2 { 0x001b, location}
617 where location: 0x00 - 0x1d (you get it in "Get WAP settings 1" frame)
618 r Get WAP settings 2 OK { 0x001c, 0x01, type, frame...}
619 where type : 0x00 - SMS bearer
621 service_num_len, service_num (Unicode), server_num_len, server_num(Unicode)
624 auth, call_type, call_speed, ?, IP len, IP (Unicode), dialup len, dialup (Unicode),
625 user len, user (Unicode), password len, password (Unicode)
626 where auth: 0x00 - normal, 0x01 - secure
627 call_type: 0x00 - analogue, 0x01 - ISDN
628 call_speed: 0x00 - 9600, 0x01 - 14400
630 frame: type, service number len/IP len,service num (Unicode)/IP (Unicode),service code len,
631 service code (Unicode)
632 where type: 0x01 - service number, 0x00 - IP
633 r Get WAP settings 2 err{ 0x001d,error}
635 0x40: Security commands
636 s ??? {+0x00, 0x00, 0x07, 0x11, 0x00, 0x10, 0x00, 0x00}
637 This frame hangs phone (N3310 4.02). Meaning unknown !
638 s Open simlock 1 { 0x02, 0x03, 0x1f, 0x11, 0x01, 0x01, 0x10, 0x00}
639 r Open simlock 1 { 0x02 }
640 s ???(N6150) { 0x08, 0x00 }
641 r ???(N6150) { 0x08 }
642 s Enable extended cmds { 0x64, cmd }
645 0x02: enter service mode ?
646 0x03: reset (doesn't ask for PIN again)
647 0x04: reset (PIN is requested)
648 In 5110 makes reset without PIN
649 0x06: CONTACT SERVICE!!! Don't try it!
650 s Reset phone settings { 0x65, value, 0x00 }
651 where value: 0x08 - reset UI (User Interface) settings
652 0x38 - reset UI, SCM and call counters
653 r Reset phone settings { 0x65, 0x00 }
655 r Get IMEI { 0x66, 0x01, IMEI, 0x00}
656 s (ACD Readings)?(N6150 { 0x68 }
657 r (ACD Readings)?(N6150 { 0x68, ... }
658 s Get Product Profile
660 r Get Product Profile
661 Settings { 0x6a, 4bytes with Product Profile Settings }
662 s Set Product Profile
663 Settings { 0x6b, 4bytes with Product Profile Settings }
664 r Set Product Profile
665 Settings OK ? { 0x6b }
666 s Get code { 0x6e, code }
667 where code: see 0x08/0x0004 (only sec.code is allowed)
668 r Get code { 0x6e, code, allowed, allowed? (sec code (text)) }
669 where code: see 0x08/0x0004
672 s Set code { 0x6f, code, sec code(text), 0x00 }
673 where code: see 0x08/0x0004
674 s Start monitoring { 0x70, block }
676 0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
677 0xff,0xff,0xff,0xff,0xff,0xf9,0x76,0x65,0x20,0x00,
678 0x00,0x00,0x00,0x00,0x18,0x26,0x15,0x7d,0x0a,0x00,
679 0xf5,0x82,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
680 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xf0,0x77,0x80,
681 0x77,0x80,0xf2,0x82,0x20,0x20,0x20,0x20,0x20,0x20,
683 This block enables probably all possible monitorred parameters.
684 After it phone sends 0x00 message type values
685 s Break monitoring { 0x71 }
686 r Break monitoring { 0x71 }
688 Counters (nm->test36) { 0x74, 0x01, 0x01, 0x0e }
690 Counters (nm->test36) { 0x74 }
691 s Call commands { 0x7c, block }
692 where where: command, (values)
694 values: number(ASCII), 0x00 - makes voice call
695 command: 0x02 - answer call
696 command: 0x03 - release call
697 r Call commands { 0x7c, command }
698 s Netmonitor { 0x7e, field }
699 where: field: 00: next
704 s Open simlock 2 { 0x81, 0x01, locknumber, 0x10, 0x10, 0x10, 0x10, 0x10 }
705 Note: sets simlock type to factory?
706 where locknumber: 1,2,4,8
707 s Open simlock 2 { 0x81, 0x01, locknumber }
708 where locknumber: 1,2,4,8
709 s Close simlock { 0x82, 0x01, locknumber, 0x00, 0x00, locksinfo(lock1,4,2,3), 0x00 }
710 where locknumber: 1,2,4,8
711 r Close simlock { 0x82, the rest like in 0x40/0x8a }
712 s Get simlock info { 0x8a, 0x00}
713 r Get simlock info { 0x8a, 0x00, 0x01, lockstype, locksclosed, 0x00, 0x00, locksinfo(lock1,4,2,3), counter1,counter2,counter4,counter4,0x00 }
714 where: lockstype: bit1,bit2,bit3,bit4 - if set, selected lock is user lock
715 locksclosed: bit1,bit2,bit3,bit4 - if set, selected lock is closed
716 counter1 - counter4: counters for locks
717 s Set downloaded OpName { 0x8b, 0x00, MCC1, MCC2, MNC, Name, 0x00 }
718 r SetdownloadedOpNameOK?{ 0x8b, 0x00, 0x01 }
719 s Get downloaded OpName { 0x8c, 0x00 }
720 r Get downloaded OpName { 0x8c, 0x00, 0x01, MCC1, MCC2, MNC, Name, 0x00,...}
721 s Buzzer pitch { 0x8f, volume, hzLO, hzHI }
722 if volume and hz is 0, it's off
723 r Buzzer pitch { 0x8f}
724 s ACD Readings ? { 0x91, parameter?(0x02,0x03,0x04,0x05,0x07) }
725 r ACD Readings ? { 0x91, parameter?, value? }
726 s Sleep mode test { 0x92, 0x00, 0x00, howlong(2 bytes), enable }
727 where: enable == 0x01 - enable after test
728 0x00 - don't enable after test
729 howlong (ms) = 0x07, 0xd0 = 2000
730 s ???(N6150) { 0x98, 0x00 }
731 r ???(N6150) { 0x98, 0x00, 0x04 }
732 s Get bin ringtone { 0x9e, location }
733 where: location=0,1,etc.
734 r Get bin ringtone { 0x9e, location, error, contents... }
735 where location=0,1,etc.
736 error=0x0a, ringtone NOT available
738 s Set bin ringtone { 0xa0, location, 0x00, contenst... }
739 where: location=0,1,etc.
740 r Set bin ringtone { 0xa0, location, error }
741 where location=0,1,etc.
742 error=0x0a, ringtone NOT set
743 0x00, ringtone set OK
744 r Get MSid { 0xb5, 0x01, 0x2f, msid, 0x25 }
745 s Get info about phone { 0xc8, 0x01 }
746 r Get info about phone { 0xc8, 0x01, 0x00, "V ", "firmware", 0x0a, "firmware date", 0x0a, "model", 0x0a, "(c) NMP.", 0x00 }
747 s Get MCU SW Checksum { 0xc8, 0x02 }
748 r Get MCU SW Checksum { 0xc8, 0x02, 0x00, checksum (4 bytes),0x00 }
749 s DPS External SW { 0xc7, 0x03 }
750 r DSP External SW { 0xc7, 0x03, 0x00, string,0x00 }
751 s Get HW { 0xc8, 0x05 }
752 r Get HW { 0xc8, 0x05, 0x00, HW version (4 bytes), 0x00 }
753 s Get "Made" Date { 0xc8, 0x05 }
754 r Get "Made" Date { 0xc8, 0x05, 0x00, date(4 bytes), 0x00 }
755 s Get DSP Internal SW { 0xc8, 0x09 }
756 r Get DSP Internal SW { 0xc8, 0x09, 0x00, version (1 bytes), 0x00 }
757 s Get PCI version { 0xc8, 0x0b }
758 r Get PCI version { 0xc8, 0x0b, 0x00, version, 0x00 }
759 s Get system ASIC { 0xc8, 0x0c }
760 r Get system ASIC { 0xc8, 0x0c, 0x00, string, 0x00 }
761 s Get COBBA { 0xc8, 0x0d }
762 r Get COBBA { 0xc8, 0x0d, 0x00, string, 0x00 }
763 s Get PLUSSA { 0xc8, 0x0e }
764 r Get PLUSSA { 0xc8, 0x0e, available, 0x00 }
765 where available: 0x01: not available
766 s Get CCONT { 0xc8, 0x0f }
767 r Get CCONT { 0xc8, 0x0f, available, 0x00 }
768 where available: 0x01: not available
769 s Get PPM version { 0xc8, 0x10 }
770 r Get PPM version { 0xc8, 0x10, 0x00, "V ", "firmware", 0x0a, "firmware date", 0x0a, "model", 0x0a, "(c) NMP.", 0x00 }
771 s Get PPM info { 0xc8, 0x12 }
772 r Get PPM info { 0xc8, 0x12, 0x00, PPM version ("B", "C", etc.), 0x00 }
773 s Set HW version { 0xc9, 0x05, version, 0x00 }
774 s Get Product Code { 0xca, 0x01 }
775 r Get Product Code { 0xca, 0x01, 0x00, number, 0x00 }
776 s Get Order Number { 0xca, 0x02 }
777 r Get Order Number { 0xca, 0x02, 0x00, string, 0x00 }
778 s Get Prod.Ser.Number { 0xca, 0x03 }
779 r Get Prod.Ser.Number { 0xca, 0x03, 0x00, number, 0x00 }
780 s Get Basic Prod.Code { 0xca, 0x04 }
781 r Get Basic Prod.Code { 0xca, 0x04, 0x00, number, 0x00 }
782 s Set Product Code { 0xcb, 0x01, product code, 0x00 }
783 s Set Order Number { 0xcb, 0x02, number, 0x00 }
784 s Set Prod.Ser.Number { 0xcb, 0x03, number, 0x00 }
785 s Get (original ?)IMEI { 0xcc, 0x01 }
786 r Get (original ?)IMEI { 0xcc, 0x01, IMEI, 0x00 }
787 s Get Manufacture Month { 0xcc, 0x02 }
788 r Get Manufacture Month { 0xcc, 0x02, 0x00, string, 0x00 }
789 s Get Purchare date { 0xcc, 0x04 }
790 r Get Purchare date { 0xcc, 0x04, 0x00, string, 0x00 }
791 s Set "Made" date { 0xcd, 0x02, string, 0x00 }
792 s Make "all" phone tests{ 0xce,0x1d,0xfe,0x23,0x00,0x00}
793 s Make one phone test { 0xce,0x1d,num1,num2,num3,num4}
794 Where num1-num4: 0x02,0x00,0x00,0x00;
803 0x00,0x04,0x00,0x00; - "Power off"
804 No test for "Security data"
812 s Result of phone tests { 0xcf }
813 r Result of phone tests { 0xcf, number of tests, results of next tests }
815 r ???(N5110) { 0xd1, 0x00, 0x1d, 0x00, 0x01, 0x08, 0x00 }
816 s LCD Test { 0xd3, value }
817 where value: 0x03, 0x02 - 1'st test
818 0x03, 0x01 - 2'nd test
819 0x02, 0x03 - clears screen
820 s ACD Readings(N6150)? { 0xd4, 0x02, 0x00, 0x02, 0x00, 0x0e, 0x01}
821 r ACD Readings(N6150)? { 0xd4, 0x02, 0x00, 0x02, 0x00, 0x0e, 0x01, ?}
822 s Get EEPROM { 0xd4, 0x02, 0x00, 0xa0, locationLo, locationHi, numofbytes }
823 where: numofbytes - how many bytes to read
824 Note: Works ONLY in MBUS
825 r Get EEPROM { 0xd4, 0x02, 0x00, 0xa0, locationLo, locationHi, numofbytes, contest... }
826 where numofbytes - how many bytes available
827 contest - bytes with contests (if numofbytes != 0)
830 s Get Picture Image { 0x0001, location }
831 r Get Picture Image when contains sender number
832 { 0x0002, location, number(like in SMS), 0x00, len, text, 0x00, width, height, 0x01, bitmap }
834 Supports only 0x81 and 0x91 coding (NOT alphanumeric numbers!)
835 in sender without sender number
836 { 0x0002, location, 0x00, 0x00, 0x00, len, text, 0x00, width, height, 0x01, bitmap }
837 s Set Picture Image { 0x0003, frame...}
838 where frame: see 0x47/0x0002
839 r Get/Set PictureImageOK{ 0x0004 }
840 r Set Picture Image err { 0x0005, error? }
841 where error=0x74 - wrong location ?
843 s Phone ID request { 0x0010 }
844 r Phone ID recvd { 0x0011, "NOKIA", "imei", 0, "model", 0, "prod.code", 0, "HW", 0, "firmware", magic bytes x 4 ... }
845 s Accessory connection { 0x0012, 16x0x00, 'NOKIA&NOKIA accessory', 3x0x00 } (45 bytes)
846 0x7f: Acknowledge(FBUS/IRDA){+type, seq }
849 s Power on message seq1 {+04 }
850 r Power on message seq1 {+05 }
852 s Get HW&SW version { 0x0003, 0x00 }
854 r Get HW&SW version { 0x0003 "V " "firmware\n" "firmware date\n"
855 "model\n" "(c) NMP." }
856 0xda: ? (during playing 2 player snake)
858 s Send RLP frame {+0x00, 0xd9, ... }
859 0xf4: Power on message seq 2