4 Marcin Wiacek (Marcin-Wiacek@TOPNET.PL)
5 Pavel Machek <pavel@ucw.cz>
6 ... and other members of gnokii mailing list
7 and authors of some WWW pages.
9 The data provided is for information purposes only.
10 Some of the frames might be hazardous to your phone. Be careful!!!
11 We do not take any responsibility or liability for damages, etc.
13 NOTE: this information isn't (and can't be) complete. If you know anything
14 about features not listed here or you noticed a bug in this list, please
15 notify us via e-mail. Thank you.
17 Document describing frames used in GSM Nokia 2110 and derivatives:
18 Correct format is MBUS version 1 (see nokia.txt for protocol details):
23 r Display {+?, ?, ?, x, y, string, 0x00 }
25 s Enable display status {+0x03, 0x03, 0x00, 0x00, 0x01}
27 s Get mem location {+0x1a, memtype, location }
29 0x03: telephone phonebook
31 s Set mem location {+0x1b, memtype, location, name, 0x00, number, 0x00 }
32 where: memtype: see 0x1f/0x1a
34 r Status {+?, byte1, byte2, byte3, byte4, byte5}
35 where byte1 (for N2110):
36 bit 0 - "d", bit 2 - "b", bit 4 - "a", bit 6 - "lights"
38 bit 0 - "service",bit 2 - "scroll_up",bit 4 - "scroll_down",bit 6 - "ABC"
40 bit 0 - "2.>", bit 2 - "1.>", bit 4 - "roam", bit 6 - "handset"
42 bit 0 - "vmail", bit 2 - "envelope", bit 4 - "battery bar",bit 6 - "3.>"
44 bit 4 - "fieldbar", bit 6 - "ring"
46 r SendSMS/GetSMS/DelSMS/{+0x10, code, frame }
47 SetSMSC/GetSMSC where:
48 code: 0x08 - SMS send OK
50 0x1d 0x24 0x25 (latter 2 in order)
53 memtype, location, msgstatus, unknown2, unknown2, 0x00, date(7 bytes) in BCD, msglen, msgtext, recipient,
56 memtype, msglen, msgtext: see 0x38/0x1002 frame
57 msgstatus, unknown2, unknown3: see 0x37/0x21
58 Note: This frame used only, when FrameLength < 0x75
60 0x0f - SMS delete failed
61 0x10 - SMS send failed
63 0x1d 0x24 0x25 (latter 2 in order)
65 0x1a - SMS message received (by phone).
67 memtype, location, unknown1, unknown2, 0x00, date(7 bytes) in BCD, msglen, sender,
70 memtype: see 0x38/0x1002 frame
71 unknown1: 0x00 0x00 0x04 more messages?
74 unknown2: 0x20 0x20 0x20
76 0x1d - SMSC set failed
79 0x00, 0x00, unknown1, unknown2, 0x00, 0x00, unknown3, unknown4, unknown5,
83 last memtype location used or number of messages??
85 unread messages indicator??
88 unknown4: accept reply costs?
91 unknown5: status reports
94 0x30 - SMSC get failed
95 r Get SMS part 2 {+0x20, ... continuation of 0x37/0x21 frame }
96 r Get SMS part 1 {+0x21, 0x0b, memtype, location, msgstatus, unknown2, unknown3, 0x00, date(7 bytes) in BCD, msglen, msgtext}
97 where memtype: see 0x38/0x1002
104 unknown2: more messages ?
107 this flag seems to be set by locust when a message (e.g. tv) is split across more than 1 sms
110 s Send SMS message {+0x1000, unknown, pr, 0x00, validity, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
111 msglen, msgtxt, recipient, 0x00, smsc, 0x00}
112 where: unknown: 0x11 or 0x91 parameter mask?
113 (data, data coding, protocol but 0x80?)
114 pr: 0x00 or protocol id + 0x20
115 validity: 0x0b: 1 hour
120 msglen: SMS message length
121 msgtext: message string (unterminated)
122 recipient: receipient`s number string
123 smsc: SMS centre number string
124 Note: Used when FrameLength < 0x75
125 s Get SMS message {+0x1002, memtype, location }
130 s Delete SMS message {+0x1003, memtype, location }
131 where: memtype: see 0x38/0x1002
133 s Reserve SMS {+0x1012, <do you want normal reserve or only new messages indication?>}
134 s Enable cell broadcast {+0x1013, ...}
135 s Kill reserve SMS {+0x1014}
136 r New msg from network ?{+0x1015...}
137 r Reserve SMS OK {+0x1016}
138 r Reserve SMS err {+0x1017, error}
139 s Set SMSC {+0x101b, unknown, pr, 0x00, validity, reply, report, 0x00, smsc, 0x00, 0x00 }
141 pr: protocol id + 0x20
142 validity: 0x0b: 1 hour
147 reply: reply via same SMSC:
150 report: delivery reports:
153 unknown: 0x74, 0x75 parameter mask ??
154 s Get SMSC {+0x101e, 0x09, 0xe9}
155 s Send SMS message 2part{+0x20, continuation of 0x38/0x21 frame }
156 Note: Used when FrameLength >= 0x75
157 Format the same to 0x38/0x1000 frame
158 s Send SMS message 1part{+0x21, unknown, pr, 0x00, validity, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
160 Note: Used when FrameLength >= 0x75
161 Format the same to 0x38/0x1000 frame
163 r Get mem location {+0a1a, memtype, location, code, {name}, 0x00, {number}, 0x00 }
164 where: memtype: see 0x1f/0x1a
166 0x64 - invalid location
167 0x65 - device failure
168 0x66 - device not available
170 0x68 - communication error
171 0x69 - update impossible
172 0x6a - number too long
176 0x84 - number overflow
177 name: name string, only present on "read ok" code
178 number: phone number string, only present on "read ok" code
179 r Set mem location {+0a1a, memtype, location, code }
180 where: memtype: see 0x1f/0x1a
181 code: see "Get mem location"
183 s Start connection {+0x00, 0x02, 0x1c, 0x00, 0x1c}
184 Note: this is message with SrcDEV = 0xf8 !
185 ACK frame for it is (DestDEV = 0xf8 too) 0x1c, 0x01, 0x1c
186 According to http://www.gadgets.demon.co.uk/nokia21xx/protocol.html
187 s Start connection {+0x01, 0x01, 0x0f, 0x01, 0x0f}
188 Note: frame according to mbus-2110.c from gnokii (Normal DestDEV)
190 r Enable display status {+0x01}
192 s Phone ID request {+0x11, 0x03, 0x00}
193 s Get RF level {+0x84, 0x02, 0x00}
194 s Get battery level {+0x85, 0x02, 0x00}
195 s Press key {+press: ?; release: ?; 0x00, 0x01, keycode }
198 r Phone ID request {+0x11, 0x03, "revision", "\n", "revision_date", "\n", "model"}
199 r Get RF level {+0x84, 0x02, 0x00, ?, value}
200 r Get battery level {+0x85, 0x02, 0x00, ?, value}