4 Balazs Nagy (js@lsc.hu)
5 Alfred R. Nurnberger <arnu@flosys.com>
6 Hugh Blemings <Hugh.Blemings@vsb.com.au>
7 Mike Bradley <mike@trumpington.st>
8 Odinokov Serge <serge@takas.lt>
9 Pavel Janik <Pavel@Janik.cz>
10 Pawel Kot <pkot@linuxnews.pl>
11 Marcin Wiacek (Marcin-Wiacek@TOPNET.PL)
12 ... and other members of gnokii mailing list
13 and authors of some WWW pages.
15 The data provided is for information purposes only.
16 Some of the frames might be hazardous to your phone. Be careful!!!
17 We do not take any responsibility or liability for damages, etc.
19 NOTE: this information isn't (and can't be) complete. If you know anything
20 about features not listed here or you noticed a bug in this list, please
21 notify us via e-mail. Thank you.
23 Document describing frames used in
24 GSM/PCN Nokia 6110 and derivatives (Nokia 6130, 6150, 6190, 5110, 5130, 5150,
26 Correct format is FBUS version 2/Direct IRDA/MBUS version 2
27 (see nokia.txt for protocol details):
31 0x00: Monitoring values
32 r monitoring value {+0x01, 0x01, block... }
33 where block: 0x5e, 0x05, 0x7a(?), 0xd0(?), 0x85(?), 0x02, percentHI, percentLO
35 0x5e, 0x0c, 0x52(?), 0x4b(?), 0x6f(?), 0x02, voltageHI, voltageLO
36 Battery standby voltage
38 0x01: Call Information
39 s Make call { 0x0001, "number", type, block }
44 data call (non digital lines):
45 0x02,0x01,0x05,0x81,0x01,0x00,0x00,0x01,0x02,0x0a,
46 0x07,0xa2,0x88,0x81,0x21,0x15,0x63,0xa8,0x00,0x00
47 data call (digital lines):
48 0x02,0x01,0x05,0x81,0x01,0x00,0x00,0x01,0x02,0x0a,
49 0x07,0xa1,0x88,0x89,0x21,0x15,0x63,0xa0,0x00,0x06,
50 0x88,0x90,0x21,0x48,0x40,0xbb
52 0x01, 0x01, 0x05, 0x81/0x00, sendnum, 0x00, 0x00, 0x01
54 sendnum (own number sending):
55 0x01: preset (depends on network)
58 r Call going msg { 0x0002 }
59 r Call in progress { 0x0003, seqnr }
60 r Remote end hang up { 0x0004, seqnr, ?, error (like in netmon in 39) }
61 r incoming call alert { 0x0005, seqnr, numlen, "number", namelen, "name" }
62 s Answer call part 2 { 0x0006, seqnr, 0x00 }
63 r answered call { 0x0007, seqnr }
64 s Hang up { 0x0008, seqnr, 0x85 }
65 r terminated call { 0x0009, seqnr }
66 r call msg { 0x000a, seqnr }
67 r Send DTMF/voice call { 0x0040}
68 s Answer call part 1 { 0x0042,0x05,0x01,0x07,0xa2,0x88,0x81,0x21,0x15,0x63,0xa8,0x00,0x00,
69 0x07,0xa3,0xb8,0x81,0x20,0x15,0x63,0x80 }
70 s Sent after issuing { 0x0042,0x05,0x81,0x07,0xa1,0x88,0x89,0x21,0x15,0x63,0xa0,0x00,0x06,
71 data call 0x88,0x90,0x21,0x48,0x40,0xbb,0x07,0xa3,
72 (digital lines) 0xb8,0x81,0x20,0x15,0x63,0x80 }
73 s Sent after issuing { 0x0042,0x05,0x01,0x07,0xa2,0xc8,0x81,0x21,0x15,0x63,0xa8,0x00,0x00,
74 data call 0x07,0xa3,0xb8,0x81,0x20,0x15,0x63,0x80,
75 (non digital lines) 0x01,0x60 }
76 s Send DTMF { 0x0050, length, {ascii codes for DTMF}, 0x01 }
79 to make data call (non digital lines):
80 1.send "Make call" for non digital lines
81 2.send "Sent after issuing data call (non digital lines)"
82 to make data call (digital lines):
83 1.send "Answer call part 1"
84 2.send "Sent after issuing data call (digital lines)"
85 3.send "Make call" for digital lines
87 1.send "Answer call part 1"
88 2.send "Answer call part 2"
91 s Send SMS message { 0x0001, 0x02, 0x00 (SEND REQUEST), ... }
92 r Message sent { 0x0002 }
93 r Send failed { 0x0003, ?, ?, error (like in netmon in 65)}
94 s Get SMS message { 0x0007, 0x02, location, 0x01, 0x64 }
95 s Initiate connection { 0x000d, 0x00, 0x00, 0x02 }
96 r Initiate ACK { 0x000e, 0x01 }
97 r SMS message received { 0x0010, ...... } (whole message)
98 s Set CellBroadcast { 0x0020, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01 }
99 for enable cell broadcast ?
100 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }
101 for disable cell broadcast ?
102 r Set CellBroadcast OK { 0x0021, 0x01 }
103 r Read CellBroadcast { 0x0023, ?, ?, ?, channel, ?, message... } ?
104 s Set SMS center { 0x0030, 0x64, priority, checksum? ,0?, format,
105 validity, {DefaultRecipient no.}[12],
106 {SMScenter no.}[12], {SMSC name}, 0x00}
107 where tel.no.[12]: {len, type, {number(BCD)}}
109 0x91: + (international)
118 validity: 0x0b: 1 hour
124 r Set SMS center OK { 0x0031 }
125 r Set SMS center error { 0x0032, reason }
126 s Get SMS center { 0x0033, 0x64, priority }
127 r SMS center received { 0x0034, priority, checksum?, format, 0x00?,
128 validity, {DefaultRecipient no.}[12],
129 {SMScenter no.}[12], {SMSC name}, 0x00}
130 tel.no[12]: {len, type, {number(BCD)}}
131 where priority, checksum, type, validity,
132 tel.no.[12]: see 0x02/0x0030
133 r SMS center error recv { 0x0035, reason }
134 0x03: Phonebook functions
135 s Get mem location { 0x0001, memtype, location, 0 }
137 0x01: telephone and SIM phonebook (in one)
138 0x02: telephone phonebook
140 0x04: SIM fixdialling-phonebook (?)
142 0x07: Dialled numbers
145 0x0b: voice mailbox (location not important)
146 r mem location recvd { 0x0002, 0x00,namelen,"name",numlen,"number",groupID, 0x01?, yearLO, yearHI, month, day, hour, minute, sec. }
147 Note: in 3310 all entries have null name ("feature" of bug ?)
148 r mem loc error recvd { 0x0003, errtype }
149 where errtype: 0x7d: invalid memory type
150 s Set mem location { 0x0004, memtype,location,namelen,"Name",numlen,"number",groupID }
151 r mem set OK { 0x0005 }
152 r mem set error { 0x0006, errtype }
153 where errtype: 0x7d: name is too long
154 s Mem status request { 0x0007, memtype }
155 r Mem status recvd { 0x0008, memtype, free, used }
156 r Mem status error recv { 0x0009, errtype }
157 where errtype: 0x6f: mem status error
158 0x7d: invalid memory type
159 0x8d: waiting for pin
160 s Get caller group data { 0x0010, groupID }
161 r Get caller group data { 0x0011, groupID, size, "Name", ringtoneID, graphic_on?1:0, lenHI, lenLO, OTABitmap (72x14 logo) }
162 r Get call.group error { 0x0012, reason }
163 where reason: 0x7d: invalid location
164 s Set caller group data { 0x0013, groupID, size, "Name", ringtoneID, graphic_on?1:0, lenHI, lenLO, OTABitmap (72x14 logo) }
165 r Set caller group OK { 0x0014 }
166 r Set call.group error { 0x0015, reason }
167 where reason: 0x7d: invalid location
168 s Get speed dial { 0x0016, index(1-9) }
169 r Get speed dial OK { 0x0017, mem.type, location }
170 where mem.type: 0x02: ME (== 0 if not stored)
172 location: memory location (== 0 if not stored)
173 r Get speed dial error { 0x0018 }
174 s Set speed dial { 0x0019, index(1-9), mem.type, location }
175 r Set speed dial OK { 0x001a }
176 r Set speed dial error { 0x001b }
178 s Phone status { 0x0001 }
179 r Phone status { 0x0002, mode, signal str, ???, pwr, batt.level }
180 where mode: 1: registered within the network
186 s Request Phone ID { 0x0003 }
187 r RequestPhone ID { 0x0004, 0x01,"NOKIA""imei", 0, "model", 0, "prod.code", 0, "HW", 0, "firmware", 0x00, 0x01 }
188 0x05: Profile settings
189 s Set profile feature { 0x0010, 1, nr, feature, a, 1 }
190 where nr: see 0x05/0x0013
191 feature: see 0x05/0x0014
193 r Set profile feat. OK { 0x0011, 1 }
194 s Get profile feature { 0x0013, 1, nr, feature, 1 }
195 where nr is profile number (general=0, silent, meeting, outdoor, pager, car, headset=6)
196 feature: see 0x05/0x0014
197 r Get profile feature { 0x0014, 1, nr, feature, 4, a, b, c, d, 1 }
198 Features and answers (in a, b, c, d form):
199 0x00: keypad notes (in Nokia 3310 feature 0x00)
205 0x01: lights (? only in car profile) (what number in Nokia 3310 ?)
208 0x??: on (maybe 0x01)
209 0x02: incoming call alert (in Nokia 3310 feature 0x01)
217 7: caller groups (see feature #0x08)
218 0x03: ringing tone (in Nokia 3310 feature 0x02)
223 0x04: ringing volume (in Nokia 3310 feature 0x03)
225 xx: level 1 (0x06) - level 5 (0x0a)
226 0x05: message alert tone (in Nokia 3310 feature 0x04)
233 0x06: vibration (in Nokia 3310 feature 0x05)
236 0x07: warning and game tones (in Nokia 3310 feature 0x06 called warning tones)
240 0x07: screen saver - Nokia 3310
243 0x08: incoming caller groups (what number in Nokia 3310 ?)
250 0x09: automatic answer (what number in Nokia 3310 ?)
254 s Get welcome message { 0x0016 }
255 r Get welcome message { 0x0017, no.of blocks, { block } * }
256 where block: { id, {blockspecific} }
257 id: 1: startup logo { y, x, picture (coding?) }
258 2: welcome note { len, "message" }
259 3: operator msg { len, "message" }
260 s Set welcome message { 0x0018, no.of blocks, { block } * }
261 where block: see 0x05/0x0017
262 r Set welcome OK { 0x0019, 0x01 }
263 s Get profile name { 0x001a, nr }
264 where nr: see 0x05/0x0013
265 r Profile name { 0x001b, 1, 1, 3, flen, nr, len, {text} }
266 where nr: see 0x05/0x0013
268 flen len + len(nr, len) = len + 2
269 Note: in Nokia 3310 name is in Unicode
271 r ??? { 0x001d, 0x93 }
272 s Set oplogo { 0x0030, location, MCC1, MCC2, MNC, lenhi=0x00, lenlo=0x82, OTABitmap }
273 r Set oplogo OK { 0x0031 }
274 r Set oplogo error { 0x0032, reason }
275 where reason: 0x7d invalid location
276 s Get oplogo { 0x0033, location }
277 where location: 1 (doesn't seem to matter)
278 r Get oplogo { 0x0034, location, MCC1, MCC2, MNC, lenhi=0x00, lenlo=0x82, OTABitmap }
279 r Get oplogo error { 0x0035, reason }
280 where reason: 0x7d invalid location
281 s Set ringtone { 0x0036, location,0x00,0x78, ringtone packed according to SM2.0}
282 r Set ringtone OK { 0x0037 }
283 r Set ringtone error { 0x0038, reason }
284 where reason=0x7d, when not supported location
285 s Get services settings { 0x0080, setting (2 bytes) }
286 where: setting: 0x02,0x00=Nokia access number 1
287 0x02,0x01=Operator access number 1
288 0x01,0x00=Personal bookmark 1 settings (name only ?)
291 r Get services sett.OK { 0x0081, .... }
292 r Get services sett.err { 0x0082, 0x7b }
293 0x06: Calling line restriction/Call forwarding etc
294 s Set call divert { 0x0001, 0x03, 0x00, divtype, calltype, 0x01, number(packed like in SMS), 0x00, 0x00...,timeout}
305 0x02: all diverts for all call types ?
306 Found only, when deactivate all diverts for all call types (with call type 0x00)
309 0x3d: when not answered
312 0x00: all calls (data, voice, fax)
316 s Deactivate calldiverts{ 0x0001, 0x04, 0x00, divtype, calltype, 0x00 }
317 where divtype, calltype: see above
318 s Get call diverts { 0x0001, 0x05, 0x00, divtype, calltype, 0x00 }
319 where divtype, calltype: see above
320 r Get prepaid(?) info { 0x0005, ?,?,?,length,message(packed like in 7bit SMS)}
322 s ??? { 0x0022, ? (1&2 sounds OK) }
323 r ??? OK { 0x0023, ?,?,? }
324 r ??? error { 0x0024, reason }
325 s ??? { 0x0025, ??? }
326 r ??? OK { 0x0026, ??? }
327 r ??? error { 0x0027, reason }
329 s Change code { 0x0004, code, "current", 0x00, "new", 0x00 }
330 where code: 1: security code (5 chars)
335 s Status request { 0x0007, 0x01 }
336 r pin recvd { 0x0008, accepted }
337 where accepted: 0x0c (or 0x06): OK
338 code: waiting for (0x08/0x0004) code
339 s entering code { 0x000a, code, "code", 0x00 }
340 where code: see 0x08/0x0004
345 s Key duplication on/off{ 0x0044, on? 0x01: 0x02 }
346 s get used network { 0x0070 }
347 r network registration { 0x0071, ?,?,?,length,netstatus,netsel,cellIDH,cellIDL,lacH,lacL,netcode,netcode,netcode }
349 s Get key assignments { 0x0040, 0x01 }
350 r Get key assignments { 0x0041, {key '1'}, 0x00, {key '2'} ... {key '0'}, 0,0,0, {symbols}, 0 }
351 where {key '0'} => ' ', '0'
352 s Press key { 0x0042, press: 0x01; release: 0x02, button, 0x01 }
353 where button: 0x01 - 0x09: 1-9
366 0x1B onwards: don't know but they do produce
367 a beep and light up the keypad as if
368 a key had been pressed.
369 r Press key ack { 0x0043, press/release/error(0x05) }
371 r ??? ack { 0x0045, 0x01 }
373 r Display { 0x0050, 0x01, y, x, len, "string"(unicode) }
374 s Status request { 0x0051 }
375 r Status { 0x0052, no. of byte pairs, {byte pair} }
376 where {byte pair}: {cmd, 1:off 2:on}
377 cmd: 1: call in progress
384 8: is SMS storage full
385 s Display status { 0x0053, 1:on 2:off }
386 (will send displayed messages with x,y coordinates)
387 r Display status ack { 0x0054, 1 }
388 0x11: Phone clock & alarm
389 s set date and time { 0x0060, 1,1,7,yearh,yearl,month,mday,hour,min,0x00 }
390 r date and time set { 0x0061 }
391 s get date and time { 0x0062 }
392 r date and time recvd { 0x0063,date_set?,time_set?,?,?,yearh,yearl,month,mday,hour,min,second }
393 where: date_set & time_set==0x01 - set
394 0x00 - not set, ?,?,yearh,yearl,month,mday,hour,min,second
395 not available in frame
396 s set alarm { 0x006b, 1,32,3,0x02(on-off),hour,min,0x00 }
397 r alarm set { 0x006c }
398 s get alarm { 0x006d }
399 r alarm received { 0x006e,?,?,?,?,alrm(==2:on),hour,min }
400 0x12: Connect to NBS port (61xx only ?)
401 s Send {+0x0c, 0x01, UDH header, data}
402 (without 0,1 header -- for oplogo, cli, ringtone etc upload)
403 where: UDH header = 0x06, 0x05, 0x04,destporth,destportl,srcporth,srcportl
404 Seems not to work in MBUS!
406 s Write calendar note { 0x0064, 0x01, 0x10, length, type, yearH, yearL, month, day, hour, timezone,
407 alarm?(alarm yearH, yearL, month, day, hour, timezone): (0,0,0,0,0,0),
409 r Write cal.note report { 0x0065, return }
410 where return: 0x01: ok
412 0x81: calendar functions busy. Exit Calendar menu and try again
413 s Calendar notes set { 0x0066... }
414 r Calendar note recvd { 0x0067, 0x01, ?, length, type, yrH,yrL,mon,day,hr,tz,alrm yrH,yrL,mon,day,hr,tz,textlen, "text" }
415 r Cal.note recvd error { 0x0067, err }
416 where err: 0x93: not available
419 s Delete cal.note { 0x0068, location }
420 r Del. cal.note report { 0x0069, err }
424 s Write SMS to SIM { 0x0004, .... }
425 s Mark SMS as read { 0x0007, 0x02, location, 0x00, 0x64 }
426 r SMS message frame rcv { 0x0008,subtype,?,num,?,BCD(smscenter)...} 20->type, 22->status
427 where type: 0x06: delivery report
428 status: 0x00: delivered
432 subtype: 0x02: invalid mem type
433 0x07: empty SMS location
434 0x0c: no access to memory (no PIN in card, etc.)
435 s Delete SMS message { 0x000a, 0x02, location }
436 r Delete OK { 0x000b }
437 s SMS status request { 0x0036, 0x64 }
438 r SMS status { 0x0037,?,?,?,?,?,?,msgnumber,unread }
439 r SMS status error { 0x0038 }
440 0x40: Security commands
441 s ??? {+0x00, 0x00, 0x07, 0x11, 0x00, 0x10, 0x00, 0x00}
442 This frame hangs phone (N3310 4.02). Meaning unknown !
443 s Open simlock 1 { 0x02, 0x03, 0x1f, 0x11, 0x01, 0x01, 0x10, 0x00}
444 r Open simlock 1 { 0x02 }
445 s ???(N6150) { 0x08, 0x00 }
446 r ???(N6150) { 0x08 }
447 s Enable extended cmds { 0x64, cmd }
450 0x02: enter service mode ?
451 0x03: reset (doesn't ask for PIN again)
452 0x04: reset (PIN is requested)
453 In 5110 makes reset without PIN
454 0x06: CONTACT SERVICE!!! Don't try it!
455 s Reset phone settings { 0x65, value, 0x00 }
456 where value: 0x08 - reset UI (User Interface) settings
457 0x38 - reset UI, SCM and call counters
458 r Reset phone settings { 0x65, 0x00 }
460 r Get IMEI { 0x66, 0x01, IMEI, 0x00}
461 s (ACD Readings)?(N6150 { 0x68 }
462 r (ACD Readings)?(N6150 { 0x68, ... }
463 s Get Product Profile
465 r Get Product Profile
466 Settings { 0x6a, 4bytes with Product Profile Settings }
467 s Set Product Profile
468 Settings { 0x6b, 4bytes with Product Profile Settings }
469 r Set Product Profile
470 Settings OK ? { 0x6b }
471 s Get code { 0x6e, code }
472 where code: see 0x08/0x0004 (only sec.code is allowed)
473 r Get code { 0x6e, code, allowed, allowed? (sec code (text)) }
474 where code: see 0x08/0x0004
477 s Set code { 0x6f, code, sec code(text), 0x00 }
478 where code: see 0x08/0x0004
479 s Start monitoring { 0x70, block }
481 0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
482 0xff,0xff,0xff,0xff,0xff,0xf9,0x76,0x65,0x20,0x00,
483 0x00,0x00,0x00,0x00,0x18,0x26,0x15,0x7d,0x0a,0x00,
484 0xf5,0x82,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
485 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xf0,0x77,0x80,
486 0x77,0x80,0xf2,0x82,0x20,0x20,0x20,0x20,0x20,0x20,
488 This block enables probably all possible monitorred parameters.
489 After it phone sends 0x00 message type values
490 s Break monitoring { 0x71 }
491 r Break monitoring { 0x71 }
493 Counters (nm->test36) { 0x74, 0x01, 0x01, 0x0e }
495 Counters (nm->test36) { 0x74 }
496 s Call commands { 0x7c, block }
497 where where: command, (values)
499 values: number(ASCII), 0x00 - makes voice call
500 command: 0x02 - answer call
501 command: 0x03 - release call
502 r Call commands { 0x7c, command }
503 s Netmonitor { 0x7e, field }
504 where: field: 00: next
509 s Open simlock 2 { 0x81, 0x01, locknumber, 0x10, 0x10, 0x10, 0x10, 0x10 }
510 Note: sets simlock type to factory?
511 where locknumber: 1,2,4,8
512 s Open simlock 2 { 0x81, 0x01, locknumber }
513 where locknumber: 1,2,4,8
514 s Close simlock { 0x82, 0x01, locknumber, 0x00, 0x00, locksinfo(lock1,4,2,3), 0x00 }
515 where locknumber: 1,2,4,8
516 r Close simlock { 0x82, the rest like in 0x40/0x8a }
517 s Get simlock info { 0x8a, 0x00}
518 r Get simlock info { 0x8a, 0x00, 0x01, lockstype, locksclosed, 0x00, 0x00, locksinfo(lock1,4,2,3), counter1,counter2,counter4,counter4,0x00 }
519 where: lockstype: bit1,bit2,bit3,bit4 - if set, selected lock is user lock
520 locksclosed: bit1,bit2,bit3,bit4 - if set, selected lock is closed
521 counter1 - counter4: counters for locks
522 s Set downloaded OpName { 0x8b, 0x00, MCC1, MCC2, MNC, Name, 0x00 }
523 r SetdownloadedOpNameOK?{ 0x8b, 0x00, 0x01 }
524 s Get downloaded OpName { 0x8c, 0x00 }
525 r Get downloaded OpName { 0x8c, 0x00, 0x01, MCC1, MCC2, MNC, Name, 0x00,...}
526 s Buzzer pitch { 0x8f, volume, hzLO, hzHI }
527 if volume and hz is 0, it's off
528 r Buzzer pitch { 0x8f}
529 s ACD Readings ? { 0x91, parameter?(0x02,0x03,0x04,0x05,0x07) }
530 r ACD Readings ? { 0x91, parameter?, value? }
531 s Sleep mode test { 0x92, 0x00, 0x00, howlong(2 bytes), enable }
532 where: enable == 0x01 - enable after test
533 0x00 - don't enable after test
534 howlong (ms) = 0x07, 0xd0 = 2000
535 s ???(N6150) { 0x98, 0x00 }
536 r ???(N6150) { 0x98, 0x00, 0x04 }
537 s Get bin ringtone { 0x9e, location }
538 where: location=0,1,etc.
539 r Get bin ringtone { 0x9e, location, error, contents... }
540 where location=0,1,etc.
541 error=0x0a, ringtone NOT available
543 s Set bin ringtone { 0xa0, location, 0x00, contenst... }
544 where: location=0,1,etc.
545 r Set bin ringtone { 0xa0, location, error }
546 where location=0,1,etc.
547 error=0x0a, ringtone NOT set
548 0x00, ringtone set OK
549 r Get MSid { 0xb5, 0x01, 0x2f, msid, 0x25 }
550 s Get info about phone { 0xc8, 0x01 }
551 r Get info about phone { 0xc8, 0x01, 0x00, "V ", "firmware", 0x0a, "firmware date", 0x0a, "model", 0x0a, "(c) NMP.", 0x00 }
552 s Get MCU SW Checksum { 0xc8, 0x02 }
553 r Get MCU SW Checksum { 0xc8, 0x02, 0x00, checksum (4 bytes),0x00 }
554 s DPS External SW { 0xc7, 0x03 }
555 r DSP External SW { 0xc7, 0x03, 0x00, string,0x00 }
556 s Get HW { 0xc8, 0x05 }
557 r Get HW { 0xc8, 0x05, 0x00, HW version (4 bytes), 0x00 }
558 s Get "Made" Date { 0xc8, 0x05 }
559 r Get "Made" Date { 0xc8, 0x05, 0x00, date(4 bytes), 0x00 }
560 s Get DSP Internal SW { 0xc8, 0x09 }
561 r Get DSP Internal SW { 0xc8, 0x09, 0x00, version (1 bytes), 0x00 }
562 s Get PCI version { 0xc8, 0x0b }
563 r Get PCI version { 0xc8, 0x0b, 0x00, version, 0x00 }
564 s Get system ASIC { 0xc8, 0x0c }
565 r Get system ASIC { 0xc8, 0x0c, 0x00, string, 0x00 }
566 s Get COBBA { 0xc8, 0x0d }
567 r Get COBBA { 0xc8, 0x0d, 0x00, string, 0x00 }
568 s Get PLUSSA { 0xc8, 0x0e }
569 r Get PLUSSA { 0xc8, 0x0e, available, 0x00 }
570 where available: 0x01: not available
571 s Get CCONT { 0xc8, 0x0f }
572 r Get CCONT { 0xc8, 0x0f, available, 0x00 }
573 where available: 0x01: not available
574 s Get PPM version { 0xc8, 0x10 }
575 r Get PPM version { 0xc8, 0x10, 0x00, "V ", "firmware", 0x0a, "firmware date", 0x0a, "model", 0x0a, "(c) NMP.", 0x00 }
576 s Get PPM info { 0xc8, 0x12 }
577 r Get PPM info { 0xc8, 0x12, 0x00, PPM version ("B", "C", etc.), 0x00 }
578 s Set HW version { 0xc9, 0x05, version, 0x00 }
579 s Get Product Code { 0xca, 0x01 }
580 r Get Product Code { 0xca, 0x01, 0x00, number, 0x00 }
581 s Get Order Number { 0xca, 0x02 }
582 r Get Order Number { 0xca, 0x02, 0x00, string, 0x00 }
583 s Get Prod.Ser.Number { 0xca, 0x03 }
584 r Get Prod.Ser.Number { 0xca, 0x03, 0x00, number, 0x00 }
585 s Get Basic Prod.Code { 0xca, 0x04 }
586 r Get Basic Prod.Code { 0xca, 0x04, 0x00, number, 0x00 }
587 s Set Product Code { 0xcb, 0x01, product code, 0x00 }
588 s Set Order Number { 0xcb, 0x02, number, 0x00 }
589 s Set Prod.Ser.Number { 0xcb, 0x03, number, 0x00 }
590 s Get (original ?)IMEI { 0xcc, 0x01 }
591 r Get (original ?)IMEI { 0xcc, 0x01, IMEI, 0x00 }
592 s Get Manufacture Month { 0xcc, 0x02 }
593 r Get Manufacture Month { 0xcc, 0x02, 0x00, string, 0x00 }
594 s Get Purchare date { 0xcc, 0x04 }
595 r Get Purchare date { 0xcc, 0x04, 0x00, string, 0x00 }
596 s Set "Made" date { 0xcd, 0x02, string, 0x00 }
597 s Make "all" phone tests{ 0xce,0x1d,0xfe,0x23,0x00,0x00}
598 s Make one phone test { 0xce,0x1d,num1,num2,num3,num4}
599 Where num1-num4: 0x02,0x00,0x00,0x00;
608 0x00,0x04,0x00,0x00; - "Power off"
609 No test for "Security data"
617 s Result of phone tests { 0xcf }
618 r Result of phone tests { 0xcf, number of tests, results of next tests }
620 r ???(N5110) { 0xd1, 0x00, 0x1d, 0x00, 0x01, 0x08, 0x00 }
621 s LCD Test { 0xd3, value }
622 where value: 0x03, 0x02 - 1'st test
623 0x03, 0x01 - 2'nd test
624 0x02, 0x03 - clears screen
625 s ACD Readings(N6150)? { 0xd4, 0x02, 0x00, 0x02, 0x00, 0x0e, 0x01}
626 r ACD Readings(N6150)? { 0xd4, 0x02, 0x00, 0x02, 0x00, 0x0e, 0x01, ?}
627 s Get EEPROM { 0xd4, 0x02, 0x00, 0xa0, locationLo, locationHi, numofbytes }
628 where: numofbytes - how many bytes to read
629 Note: Works ONLY in MBUS
630 r Get EEPROM { 0xd4, 0x02, 0x00, 0xa0, locationLo, locationHi, numofbytes, contest... }
631 where numofbytes - how many bytes available
632 contest - bytes with contests (if numofbytes != 0)
635 s Get Picture Image { 0x0001, location }
636 r Get Picture Image when contains sender number
637 { 0x0002, location, number(like in SMS), 0x00, len, text, 0x00, width, height, 0x01, bitmap }
639 Supports only 0x81 and 0x91 coding (NOT alphanumeric numbers!)
640 in sender without sender number
641 { 0x0002, location, 0x00, 0x00, 0x00, len, text, 0x00, width, height, 0x01, bitmap }
642 s Set Picture Image { 0x0003, frame...}
643 where frame: see 0x47/0x0002
644 r Get/Set PictureImageOK{ 0x0004 }
645 r Set Picture Image err { 0x0005, error? }
646 where error=0x74 - wrong location ?
648 s Phone ID request { 0x0010 }
649 r Phone ID recvd { 0x0011, "NOKIA", "imei", 0, "model", 0, "prod.code", 0, "HW", 0, "firmware", magic bytes x 4 ... }
650 s Accessory connection { 0x0012, 16x0x00, 'NOKIA&NOKIA accessory', 3x0x00 } (45 bytes)
651 0x7f: Acknowledge(FBUS/IRDA){+type, seq }
654 s Power on message seq1 {+04 }
655 r Power on message seq1 {+05 }
657 s Get HW&SW version { 0x0003, 0x00 }
659 r Get HW&SW version { 0x0003 "V " "firmware\n" "firmware date\n"
660 "model\n" "(c) NMP." }
661 0xda: ? (during playing 2 player snake)
663 s Send RLP frame {+0x00, 0xd9, ... }
664 0xf4: Power on message seq 2