3 Document describing protocol used in Nokia phones.
5 The data provided is for information purposes only.
6 Some of the frames might be hazardous to your phone. Be careful!!!
7 We do not take any responsibility or liability for damages, etc.
10 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
12 Balazs Nagy (js@lsc.hu)
13 Alfred R. Nurnberger <arnu@flosys.com>
14 Hugh Blemings <Hugh.Blemings@vsb.com.au>
15 Mike Bradley <mike@trumpington.st>
16 Odinokov Serge <serge@takas.lt>
17 Pavel Janik <Pavel@Janik.cz>
18 Pawe³ Kot <pkot@linuxnews.pl>
19 Marcin Wiacek (Marcin-Wiacek@TOPNET.PL)
20 Jens Bennfors <jens.bennfors@ing.hj.se>
21 Michael Hund <michael@drhund.de>
22 Jay Bertrand <jay.bertrand@libertysurf.fr>
25 Pavel Machek <pavel@ucw.cz>
26 Diego Betancor <dbetancor@duocom.net>
27 ... and other members of gnokii mailing list
28 and authors of some WWW pages.
30 NOTE: this information isn't (and can't be) complete. If you know anything
31 about features not listed here or you noticed a bug in this list, please
32 notify us via e-mail. Thank you.
34 Frame format for MBUS version 1:
36 Request from Computer/Answer from Phone:
38 { DestDEV, SrcDEV, FrameLength, MsgType, {block}, id, ChkSum }
40 where DestDEV, SrcDEV: 0x00: phone
43 FrameLength: length of data frame. Maximal 0x78. Longer
44 frames are divided into smaller.
47 id: request identity number 1..n, incremented after
48 the request is accepted
49 ChkSum: XOR on frame's all numbers
53 { DestDEV, 0x00, FrameLength, MsgType, {block} , id, ChkSum }
55 where DestDEV: taken from original request packet
56 FrameLength: 0x7f, when DestDEV = 0xe4
57 0x7e, when DestDEV = 0xf8
58 MsgType: see List. Present only, when DestDEV = 0xf8
59 {block}: main frame. Present only, when DestDEV = 0xf8
60 id: request identity number 1..?, corresponding
61 to the original request packet id
62 the request is accepted
63 ChkSum: XOR on frame's all numbers
65 Update: description above according to the
66 http://www.gadgets.demon.co.uk/nokia21xx/protocol.html.
68 Pavel Machek <pavel@ucw.cz> wrote:
69 0x7e is actually registration acknowledge. Both have nothing to do
70 with DestDEV, except that special device needs to be used for
75 { 0x00, SrcDEV, 0x7f, id, ChkSum }
77 where SrcDEV: taken from response packet
78 id: request identity number 1..?, corresponding
79 to the response packet id
80 the request is accepted
81 ChkSum: XOR on frame's all numbers
84 Speed 9600 bps, Bits 8, ParityOdd, Stop Bits 1, DTR and RTS logic 0
86 In the MBUS bus, the phone has only one connector for transmition and
89 Because of this characteristics of the phone connector, every time that the
90 PC writes into the phone it is writing as well into its own Rx. So every
91 time the PC sends info into the phone it finds that same information in its
92 own Rx buffers, like a mirror copy. This should be discarded.
94 The communications is made like an old cb radio, only one
95 talking at a time. Many transmission are made this way:
97 <computer sends request>
99 <phone sends response>
102 Some frames are sent from phone without asking for them
104 You have to implement collision protocol. IE. you should listen for
105 what you are transmitting, and if it does not come back, you have
108 You should wait for bus to be free for 3 miliseconds before normal
109 message, and for 2.5 miliseconds before acknowledge. You should wait
110 for acknowledge for 200 miliseconds, then retransmit.
112 Frame format for FBUS version 1:
114 { FrameID, FrameLength, MsgType, {block}, SeqNo, ChkSum }
116 where FrameID: 0x01 Command frame from computer to Nokia
117 0x02 ??? - Data call frame from computer to Nokia - ???
118 0x03 Data call frame from Nokia to computer
119 0x04 Command frame from Nokia to computer
120 FrameLength: {block} + 2
122 SeqNum: Sequence number of command in case where direction is
123 from ME to computer, the sequence number is
124 counting from 0x30 to 0x37 and resetting back to 0x30.
125 When direction is from computer to ME,
126 sequence number counts from 0x08 to 0x0f and resets back to 0x08.
127 It may not be required to be this way.
128 Sequence numbers are used in acknowledging commands.
130 for (i = 0; i < (2 + CMD_LEN); i++)
133 Frame format for FBUS version 2/Direct IRDA:
135 { FrameID, DestDEV, SrcDEV, MsgType, 0x00, FrameLength, {block}, FramesToGo,
136 SeqNo, PaddingByte?, ChkSum1, ChkSum2 }
138 where FrameID: 0x1c: IR / FBUS
140 DestDev, SrcDev: 0x00: mobile phone
141 0x0c: TE (FBUS) [eg. PC]
143 FrameLength: {block} + 2 (+ 1 if PaddingByte exists)
144 FramesToGo: 0x01 means the last frame
149 PaddingByte: 0x00 if FrameLength would be an odd number
150 anyways it doesn't exists
151 ChkSum1: XOR on frame's odd numbers
152 ChkSum2?: XOR on frame's even numbers
154 Frame format for MBUS version 2:
156 { FrameID, DestDEV, SrcDEV, MsgType, FrameLengthLO, FrameLengthHI, {block},
159 where FrameID: 0x1f: Serial / M2BUS
160 DestDev, SrcDev: 0x00: mobile phone
162 0x10: TE (M2BUS) (Service Software ?)
165 0xF8: unknown target?
169 SeqNo: sequence number
170 ChkSum: XOR on frame's all numbers
172 Please note that M2BUS has only one checksum: XOR on frame[FrameID..SeqNo]
176 { FrameID, DestDEV, SrcDEV, 0x7f, Id_SeqNo, ChkSum }
178 where Id_SeqNo: Is the sequence number that you are
179 acknowleging (from the other part).
181 Frame format for Infrared:
183 { FrameID, DestDEV, SrcDEV, MsgType, FrameLengthLo, FrameLengthHi, {block}}
186 DestDev, SrcDev: 0x00: mobile phone
193 hex: Short description
196 0xXXYY -> two bytes (== 0xXX, 0xYY)
198 where hex: message type
199 x: s=send (eg. to mobile), r=receive
200 { ... }: data after 0x00, 0x01 header
201 {+... }: raw data (without header)
203 -------------------------------------------------------------------------------
205 Misc (about MBUS version 2):
208 (sent from a 5160i TDMA / 6160i TDMA / 6185 CDMA or 7110 GSM
209 phone to the uC in the DLR-3 cable)
211 1F 48 00 4E 00 02 01 XX SQ CS
212 frame sent from the phone to the DLR-3 cable
213 (after 15kOhm resistor detected betw. XMIC (3) and DGND (9).)
214 DSR,DCD,CTS flow control data is coded into the 2nd databyte
221 0x78 / 0x79 commands:
222 (used by handsfree carkit) Works also on GSM phones (5110 / 6110 / etc)
223 These commands are used by the Nokia Carkits to switch the phone audio path to
224 XMiC and XEAR , turn the phone on/off according to the car ignition, and
225 control the PA loudspeaker amplifier in the carkit and the car radio mute
226 output which silences the car radio during a call
228 1F 04 00 78 00 04 01 02 0E 00 SQ CS
229 status indication = disable carkit audio amplifier (no audio / no tone)
231 1F 04 00 78 00 04 01 02 0E 03 SQ CS
232 status indication = enable carkit audio amplifier (audio / tone present)
234 1F 04 00 78 00 04 01 02 07 00 SQ CS
235 status indication = disable radio mute output (no call)
237 1F 04 00 78 00 04 01 02 07 01 SQ CS
238 status indication = enable radio mute output (call active)
240 1F 04 00 78 00 04 01 02 08 01 SQ CS
241 status indication = enable ??? sent to HFU-2 on power on
242 byte 9 (07,08,0E) seems to be a pointer to a memory location,
243 byte 10 is the data at this memeory location.
245 1F 00 04 78 00 03 02 01 03 SQ CS
246 response message from HFU-2 (use unknown)
248 1F 00 04 79 00 05 02 01 01 63 00 SQ CS
249 enables carkit mode + turns phone on + req. mute status
251 1F 00 04 79 00 05 02 01 01 61 00 SQ CS
252 enables carkit mode + powers phone off (1 min delay) + req. mute status
254 1F 00 04 79 00 05 02 01 01 23 00 SQ CS
255 enables carkit mode + external handset lifted (OFF-Hook)
257 1F 00 04 79 00 05 02 01 01 63 00 SQ CS
258 enables carkit mode + external handset put back (ON-Hook)
259 Ignition and Hook are coded into one byte
260 bit.0 = 0:on power on 1:when in operation
261 bit.1 = IGNITION STATUS
262 bit.2 = x can be 1 or 0
266 bit.6 = Hook (inverted)
269 1F 00 04 79 00 12 02 01 02 06 00 56 20 30 36 2E 30 30 0A 48 46 55 32 00 SQ CS
271 1F 04 00 DA 00 02 00 02 SQ CS
272 function unknown - sent from Nokia phone to HFU-2mute output (call active )
276 1F 00 1D D0 00 01 04 SQ CS
277 sent by the Service Software or HFU-2 on startup
279 1F 1D 00 D0 00 01 05 SQ CS
280 response from phone to above frame