$Id$
Assembled by
Balazs Nagy (js@lsc.hu)
Alfred R. Nurnberger <arnu@flosys.com>
Hugh Blemings <Hugh.Blemings@vsb.com.au>
Mike Bradley <mike@trumpington.st>
Odinokov Serge <serge@takas.lt>
Pavel Janik <Pavel@Janik.cz>
Pawel Kot <gnokii@gmail.com>
Marcin Wiacek (Marcin-Wiacek@TOPNET.PL)
Harri Yli-Torkko <hyt@surfeu.fi>
... and other members of gnokii mailing list <gnokii-users@nongnu.org>
and authors of some WWW pages.
The data provided is for information purposes only.
Some of the frames might be hazardous to your phone. Be careful!!!
We do not take any responsibility or liability for damages, etc.
NOTE: this information isn't (and can't be) complete. If you know anything
about features not listed here or you noticed a bug in this list, please
notify us via e-mail at our mailing list <gnokii-users@nongnu.org>. Thank you.
Document describing frames used in
GSM/PCN Nokia 6110 and derivatives (Nokia 6130, 6150, 6190, 5110, 5130, 5150,
5190, 3210, 3310)
Correct format is FBUS version 2/Direct IRDA/MBUS version 2
(see nokia.txt for protocol details):
List:
0x00: Monitoring values
r monitoring value {+0x01, 0x01, block... }
where block: 0x5e, 0x05, 0x7a(?), 0xd0(?), 0x85(?), 0x02, percentHI, percentLO
Battery percent level
0x5e, 0x0c, 0x52(?), 0x4b(?), 0x6f(?), 0x02, voltageHI, voltageLO
Battery standby voltage
............
0x01: Call Information
s Make call { 0x0001, "number", type, block }
where type:
0x01 - data call
0x05 - voice call
block:
data call (non digital lines):
0x02,0x01,0x05,0x81,0x01,0x00,0x00,0x01,0x02,0x0a,
0x07,0xa2,0x88,0x81,0x21,0x15,0x63,0xa8,0x00,0x00
data call (digital lines):
0x02,0x01,0x05,0x81,0x01,0x00,0x00,0x01,0x02,0x0a,
0x07,0xa1,0x88,0x89,0x21,0x15,0x63,0xa0,0x00,0x06,
0x88,0x90,0x21,0x48,0x40,0xbb
voice call:
0x01, 0x01, 0x05, 0x81/0x00, sendnum, 0x00, 0x00, 0x01
where:
sendnum (own number sending):
0x01: preset (depends on network)
0x03: on
0x02: off
r Call going msg { 0x0002 }
r Call in progress { 0x0003, seqnr }
r Remote end hang up { 0x0004, seqnr, ?, error (like in netmon in 39) }
r incoming call alert { 0x0005, seqnr, numlen, "number", namelen, "name" }
s Answer call part 2 { 0x0006, seqnr, 0x00 }
r answered call { 0x0007, seqnr }
s Hang up { 0x0008, seqnr, 0x85 }
r terminated call { 0x0009, seqnr }
r call msg { 0x000a, seqnr }
s Get call status { 0x0020 }
r Get call status { 0x0021, num of calls, callinfo }
where callinfo: {0x64, blklen - 2 (0x17), seqnr,
channel (1-2), state, prevstate, ?, ?, ?, ?,
namelen, name (13 chars + 0x00) }
r call held { 0x0023, seqnr, 0x01 }
r call resumed { 0x0025, seqnr, 0x01 }
r call switch { 0x0027, 0xff, 0x01 }
r Send DTMF/voice call { 0x0040}
s Answer call part 1 { 0x0042,0x05,0x01,0x07,0xa2,0x88,0x81,0x21,0x15,0x63,0xa8,0x00,0x00,
0x07,0xa3,0xb8,0x81,0x20,0x15,0x63,0x80 }
s Sent after issuing { 0x0042,0x05,0x81,0x07,0xa1,0x88,0x89,0x21,0x15,0x63,0xa0,0x00,0x06,
data call 0x88,0x90,0x21,0x48,0x40,0xbb,0x07,0xa3,
(digital lines) 0xb8,0x81,0x20,0x15,0x63,0x80 }
s Sent after issuing { 0x0042,0x05,0x01,0x07,0xa2,0xc8,0x81,0x21,0x15,0x63,0xa8,0x00,0x00,
data call 0x07,0xa3,0xb8,0x81,0x20,0x15,0x63,0x80,
(non digital lines) 0x01,0x60 }
s Send DTMF { 0x0050, length, {ascii codes for DTMF}, 0x01 }
r Send DTMF ok { 0x0051 }
Note:
to make data call (non digital lines):
1.send "Make call" for non digital lines
2.send "Sent after issuing data call (non digital lines)"
to make data call (digital lines):
1.send "Answer call part 1"
2.send "Sent after issuing data call (digital lines)"
3.send "Make call" for digital lines
to answer call:
1.send "Answer call part 1"
2.send "Answer call part 2"
0x02: SMS handling
s Send SMS message { 0x0001, 0x02, 0x00 (SEND REQUEST), ... }
r Message sent { 0x0002 }
r Send failed { 0x0003, ?, ?, error (like in netmon in 65)}
s Get SMS message { 0x0007, 0x02, location, 0x01, 0x64 }
s Initiate connection { 0x000d, 0x00, 0x00, 0x02 }
r Initiate ACK { 0x000e, 0x01 }
r SMS message received { 0x0010, ...... } (whole message)
s Set CellBroadcast { 0x0020, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01 }
for enable cell broadcast ?
0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }
for disable cell broadcast ?
r Set CellBroadcast OK { 0x0021, 0x01 }
r Set CellBroadcast err { 0x0022, 0x01 } ???
r Read CellBroadcast { 0x0023, ?, ?, ?, channel, ?, message... } ?
s Set SMS center { 0x0030, 0x64, priority, checksum? ,0?, format,
validity, {DefaultRecipient no.}[12],
{SMScenter no.}[12], {SMSC name}, 0x00}
where tel.no.[12]: {len, type, {number(BCD)}}
type: 0x81: normal
0x91: + (international)
0xd0: alphanumeric
format: 0x00: text
0x22: fax
0x24: voice
0x25: ERMES
0x26: paging
0x31: X.400
0x32: email
validity: 0x0b: 1 hour
0x47: 6 hours
0xa7: 24 hours
0xa9: 72 hours
0xad: 1 week
0xff: max.time
r Set SMS center OK { 0x0031 }
r Set SMS center error { 0x0032, reason }
where reason: 0x02: empty location
0x06: SIM card not ready
0x0c: waiting for PIN
s Get SMS center { 0x0033, 0x64, priority }
[Nokia 3410 info: before the actual response unknown frame is returned:
0x01 0x0f 0x00 0xc9]
r SMS center received { 0x0034, priority, checksum?, format, 0x00?,
validity, {DefaultRecipient no.}[12],
{SMScenter no.}[12], {SMSC name}, 0x00}
tel.no[12]: {len, type, {number(BCD)}}
where priority, checksum, type, validity,
tel.no.[12]: see 0x02/0x0030
r SMS center error recv { 0x0035, reason }
where reason: 0x01: empty location
0x06: SIM card not ready
0x0c: waiting for PIN
r Still waiting { 0x00c9 }
0x03: Phonebook functions
s Get mem location { 0x0001, memtype, location, 0 }
where memory:
0x01: telephone and SIM phonebook (in one)
0x02: telephone phonebook
0x03: SIM phonebook
0x04: SIM fixdialling-phonebook (?)
0x05: Own numbers
0x07: Dialled numbers
0x08: Missed calls
0x09: Received calls
0x0b: voice mailbox (location not important)
[Note: Nokia 3210, 3310 and 3330 can write both name and number to "Own numbers", but
3310 reads back only the number, not the name.]
r mem location recvd { 0x0002, 0x00,namelen,"name",numlen,"number",groupID, date_set?, yearLO, yearHI, month, day, hour, minute, sec. }
where: date_set==0x01 - set
0x00 - not set, yearLO, yearHI, month, day, hour, minute, sec.
not available in frame
Note: in 3310 all entries have null name ("feature" or bug ?)
r mem loc error recvd { 0x0003, errtype }
where errtype: 0x6f: SIM card not ready
0x74: invalid location
0x75: protected by security code
0x7d: invalid memory type
0x8d: waiting for PIN
s Set mem location { 0x0004, memtype,location,namelen,"Name",numlen,"number",groupID }
r mem set OK { 0x0005 }
r mem set error { 0x0006, errtype }
where errtype: 0x6f: SIM card not ready
0x74: invalid location
0x7d: name is too long
0x8d: waiting for PIN
0x90: name is too long
s Mem status request { 0x0007, memtype }
r Mem status recvd { 0x0008, memtype, free, used }
r Mem status error recv { 0x0009, errtype }
where errtype: 0x6f: mem status error
0x7d: invalid memory type
0x8d: waiting for pin
s Get caller group data { 0x0010, groupID }
r Get caller group data { 0x0011, groupID, size, "Name", ringtoneID, graphic_on?1:0, lenHI, lenLO, OTABitmap (72x14 logo) }
r Get call.group error { 0x0012, reason }
where reason: 0x7d: invalid location
s Set caller group data { 0x0013, groupID, size, "Name", ringtoneID, graphic_on?1:0, lenHI, lenLO, OTABitmap (72x14 logo) }
r Set caller group OK { 0x0014 }
r Set call.group error { 0x0015, reason }
where reason: 0x7d: invalid location
s Get speed dial { 0x0016, index(1-9) }
r Get speed dial OK { 0x0017, mem.type, location }
where mem.type: 0x02: ME (== 0 if not stored)
0x03: SIM
location: memory location (== 0 if not stored)
r Get speed dial error { 0x0018 }
s Set speed dial { 0x0019, index(1-9), mem.type, location }
r Set speed dial OK { 0x001a }
r Set speed dial error { 0x001b, errtype }
where errtype: 0x6f: SIM card not ready
0x74: invalid location
0x7d: invalid memory type
0x8d: waiting for PIN
Note: if mem.type == ME on Nokia 3210 errtype is 0x7d but on Nokia 3330 it is 0x74
0x04: Phone Status
s Phone status { 0x0001 }
r Phone status { 0x0002, mode, signal str, ???, pwr, batt.level }
where mode: 1: registered within the network
2: call in progress
3: waiting for pin
4: powered off
pwr: 1: AC/DC
2: battery
s Request Phone ID { 0x0003 }
r RequestPhone ID { 0x0004, 0x01,"NOKIA""imei", 0, "model", 0, "prod.code", 0, "HW", 0, "firmware", 0x00, 0x01 }
0x05: Profile settings
s Set profile feature { 0x0010, 1, nr, feature, a, 1 }
where nr: see 0x05/0x0013
feature: see 0x05/0x0014
a: see 0x05/0x0014
r Set profile feat. OK { 0x0011, 1 }
r Set profile feat. ERR { 0x0012, reason }
where reason: 0x6f: SIM card not ready
0x7d: invalid location
0x8d: waiting for PIN
s Get profile feature { 0x0013, 1, nr, feature, 1 }
where nr is profile number (general=0, silent, meeting, outdoor, pager, car, headset=6)
feature: see 0x05/0x0014
r Get profile feature { 0x0014, 1, nr, feature, 4, a, b, c, d, 1 }
Features and answers (in a, b, c, d form):
0x00: keypad tones
xx, 1, 0, 2
xx: 0xff: off
0x00: level 1
0x01: level 2
0x02: level 3
0x01: lights (? only in car profile) (what number in Nokia 3310 ?)
xx, 0, 0, 1
xx: 0x00: off
0x??: on (maybe 0x01)
0x02: incoming call alert (in Nokia 3310/3330 feature 0x01)
xx, 1, 0, 7
xx: 1: ringing,
2: beep once,
3: unknown
4: off
5: ring once
6: ascending
7: caller groups (see feature #0x08)
0x03: ringing tone (in Nokia 3310/3330 feature 0x02)
xx, 0, 0, 0
xx: 0x12: ring ring
0x13: low
etc
0x04: ringing volume (in Nokia 3310/3330 feature 0x03)
xx, 0, 0, 0
xx: level 1 (0x06) - level 5 (0x0a)
0x05: message alert tone (in Nokia 3310/3330 feature 0x04)
xx, 1, 0, 4
xx: 0: no tone
1: standard
2: special
3: beep once
4: ascending
0x06: vibration (in Nokia 3310/3330 feature 0x05)
xx: 0: off
1: on
0x07: warning and game tones (in Nokia 3310/3330 feature 0x06 called warning tones)
xx, 4, 0, 4
xx: 0xff: off
0x04: on
0x07: screen saver - Nokia 3310/3330
xx: 1: on
0: off
0x08: incoming caller groups (what number in Nokia 3310 ?)
xx, 0, 0, 0
xx: 1: family
2: VIP
4: friends
8: collegues
16: other
0x09: automatic answer (what number in Nokia 3310 ?)
xx, 0, 0, 1
xx: 0x00: off
0x01: on
The following frames are valid only in Nokia 3330. Features for a <=
0x09 are separately set to each profile, other are common for all
profiles:
0x08 Screen saver -> Timeout:
0x00 = 5 sec
0x01 = 20 sec
0x09 Screen saver -> Screen saver:
0x00 ... 0x0d = Number of picture image
0x17 Phone book -> Options -> Memory in use:
0x00 = Phone
0x01 = SIM card
0x18 Settings -> Phone settings -> Network selection:
0x00 = Automatic
0x01 = Manual
0x19 Settings -> Call settings -> Automatic redial:
0x00 = Off
0x01 = On
0x1a Settings -> Call settings -> Speed dialling:
0x00 = Off
0x01 = On
0x1b Settings -> Call settings -> Own number sending:
0x00 = Set by network
0x01 = On
0x02 = Off
0x1c Settings -> Phone settings -> Cell info display:
0x00 = Off
0x1d Phone book -> Options -> Type of view:
0x00 = Name list
0x01 = Name, number
0x02 = Large font
0x1e Settings -> Phone settings -> Language:
0x00 = English
0x07 = Dansk
0x08 = Svenska
0x09 = Suomi
0x0c = Turcke
0x0e = Norsk
0x10 = Automatic
0x32 = Reboots ME
0x20 Messages -> Message settings -> Common -> Reply via same centre:
0x00 = No
0x01 = Yes
0x21 Messages -> Message settings -> Common -> Delivery reports:
0x00 = No
0x01 = Yes
0x22 Clock -> Clock settings -> Show/Hide clock:
0x00 = Show
0x01 = Hide
0x23 Clock -> Clock settings -> Time format:
0x00 = 24-hour
0x01 = 12-hour
0x24 Select profile:
0x00 = General
0x01 ... 0x05 = rest of them
0x26 Settings -> Phone settings -> Confirm SIM service actions:
0x00 = Not asked
0x01 = Asked
0x27 Messages -> Write messages -> Options -> Dictionary:
0x00 = Off
0x01 = English
0x0a = Suomi
0x28 Messages -> Message settings -> Common -> Character support:
0x00 = Automatic
0x01 = GSM alphabet
0x02 = Unicode
0x29 Startup logo settings:
0x00 = Your own uploaded logo
0x01 = Nokia
0x02 = Draft HUMAN technology(tm)
0x03 = Itineris
0x2d Clock -> Auto update of date and time:
0x00 = Off
0x01 = Confirm first
0x02 = On
The following frames are valid only in Nokia 6110
0x16 Anykey answer:
0x00 = Off
0x01 = On
0x17 ???
0x18 Memory in use:
0x00 = Phone
0x01 = SIM card
0x19 Network selection:
0x00 = Automatic
0x01 = Manual
0x1a Automatic redial:
0x00 = Off
0x01 = On
0x1b ???
0x1c ???
0x1d Speed dialling:
0x00 = Off
0x01 = On
0x1e Own number sending:
0x00 = Preset
0x01 = On
0x02 = Off
0x1f Cell info display:
0x00 = Off
0x01 = On
0x21 Language:
0x00 = English
0x01 = Deutsch
0x02 = Francais
0x03 = Italiano
0x06 = Nederlands
0x07 = Dansk
0x08 = Svenska
0x09 = Suomi
0x0e = Norsk
0x10 = Automatic
0x26 Reply via same centre:
0x00 = No
0x01 = Yes
0x27 Delivery reports:
0x00 = No
0x01 = Yes
0x28 Hide clock:
0x00 = Show clock
0x01 = Hide clock
0x29 Time format:
0x00 = 24-hour
0x01 = 12-hour
0x2a Selected profile:
see "Get profile feature"
r Get profile feat. ERR { 0x0015, reason }
where reason: 0x6f: SIM card not ready
0x7d: invalid location
0x8d: waiting for PIN
s Get welcome message { 0x0016 }
r Get welcome message { 0x0017, no.of blocks, { block } * }
where block: { id, {blockspecific} }
id: 1: startup logo { y, x, picture (coding?) }
2: welcome note { len, "message" }
3: operator msg { len, "message" }
s Set welcome message { 0x0018, no.of blocks, { block } * }
where block: see 0x05/0x0017
r Set welcome OK { 0x0019, 0x01 }
s Get profile name { 0x001a, nr }
where nr: see 0x05/0x0013
r Profile name { 0x001b, 1, 1, 3, flen, nr, len, {text} }
where nr: see 0x05/0x0013
len: text length
flen len + len(nr, len) = len + 2
Note: in Nokia 3310 name is in Unicode
s Set profile name { 0x001c, 1, 3, flen, nr, len, {text} }
r Set profile name OK / ERR { 0x001d, return }
where return: 0x01: OK
0x6f: SIM card not ready
0x8d: waiting for PIN
0x93: ??
s Set oplogo { 0x0030, location, MCC1, MCC2, MNC, lenhi=0x00, lenlo=0x82, OTABitmap }
r Set oplogo OK { 0x0031 }
r Set oplogo error { 0x0032, reason }
where reason: 0x7d invalid location
s Get oplogo { 0x0033, location }
where location: 1 (doesn't seem to matter)
r Get oplogo { 0x0034, location, MCC1, MCC2, MNC, lenhi=0x00, lenlo=0x82, OTABitmap }
[Nokia 3410 info: before OTABitmap we have 2 extra octets -- 0x00 0x1e]
r Get oplogo error { 0x0035, reason }
where reason: 0x7d invalid location (treated as unknown error in the driver)
s Set ringtone { 0x0036, location,0x00,0x78, ringtone packed according to SM2.0}
r Set ringtone OK { 0x0037 }
r Set ringtone error { 0x0038, reason }
where reason=0x7d, when not supported location (treated as unknown error in the driver)
s Get services settings { 0x0080, setting (2 bytes) }
where: setting: 0x02,0x00=Nokia access number 1
0x02,0x01=Operator access number 1
0x01,0x00=Personal bookmark 1 settings (name only ?)
0x01,0x01=?
0x02,0x02=?
r Get services sett.OK { 0x0081, .... }
r Get services sett.err { 0x0082, 0x7b }
0x06: Calling line restriction/Call forwarding etc
s Set call divert { 0x0001, 0x03, 0x00, divtype, calltype, 0x01, number(packed like in SMS), 0x00, 0x00...,timeout}
NOTE: msglen=0x37
where timeout:
0x00: not set ?
0x05: 5 second
0x0a: 10 second
0x0f: 15 second
0x14: 20 second
0x19: 25 second
0x1e: 30 second
where divtype:
0x02: all diverts for all call types ?
Found only, when deactivate all diverts for all call types (with call type 0x00)
0x15: all calls
0x43: when busy
0x3d: when not answered
0x3e: if not reached
calltype:
0x00: all calls (data, voice, fax)
0x0b: voice calls
0x0d: fax calls
0x19: data calls
s Deactivate calldiverts{ 0x0001, 0x04, 0x00, divtype, calltype, 0x00 }
where divtype, calltype: see above
r Deactivate calldiverts{ 0x0002, 0x04, 0x00, divtype, 0x02, calltype, data }
s Get call diverts { 0x0001, 0x05, 0x00, divtype, calltype, 0x00 }
where divtype, calltype: see above
r Get call diverts ok { 0x0002, 0x05, 0x00, divtype, 0x02, calltype, data }
where divtype, calltype: see above
data: { 0x01, 0x00 } - isn't active
{ 0x02, 0x01, number(packed like in SMS), 0x00, 0x00..., timeout }
r Get prepaid(?) info { 0x0005, ?,?,?,length,message(packed like in 7bit SMS)}
r Call diverts active { 0x0006, ??? }
0x07:
s ??? { 0x0022, ? (1&2 sounds OK) }
r ??? OK { 0x0023, ?,?,? }
r ??? error { 0x0024, reason }
s ??? { 0x0025, ??? }
r ??? OK { 0x0026, ??? }
r ??? error { 0x0027, reason }
0x08: Security codes
s Change code { 0x0004, code, "current", 0x00, "new", 0x00 }
where code: 1: security code (5 chars)
2: PIN (4 chars)
3: PIN2 (4 chars)
4: PUK (8 chars)
5: PUK2 (8 chars)
r Change code ok { 0x0005 }
r Get code status err { 0x0006, reason }
where reason: 0x6f: SIM card not ready
0x79: ??? (see note)
0x88: current code wrong (or not needed?)
0x8d: current code wrong
Note: 0x79 was observed when trying to change the code on
an expired SIM (it still can be changed via phone menus)
s Status request { 0x0007, 0x01 }
r pin recvd { 0x0008, accepted }
where accepted: 0x0c (or 0x06): OK
code: waiting for (0x08/0x0004) code
r Change code err { 0x0009, reason }
where reason: see above
s entering code { 0x000a, code, "code", 0x00 }
where code: see 0x08/0x0004
r Enter code err { 0x000c, reason }
where reason: see above
0x09: SIM login
r login { 0x0080 }
r logout { 0x0081 }
0x0a: Network status
s Key duplication on/off{ 0x0044, on? 0x01: 0x02 }
s get used network { 0x0070 }
r network registration { 0x0071, ?,?,?,length,netstatus,netsel,cellIDH,cellIDL,lacH,lacL,netcode,netcode,netcode }
where netstatus: 0x00: home network
0x01: roaming network
0x02: no service searching
0x03: no service not searching
0x04: no service no sim
netsel: 0x00: manual
0x01: automatic
0xff: unknown
observed values on Nokia 3210, 3310 and 3330
netstatus: 0x01 home network
0x03 no service (when powered off or waiting pincode or no signal or roaming refused)
netsel: 0x01 manual
0x02 automatic
when waiting for PIN code the reply is shorter
r { 0x0071, ?,?,?,length==2,netstatus?,netsel? }
0x0c: Keys (Nokia 3310 seems to not respond to these frames)
s Get key assignments { 0x0040, 0x01 }
r Get key assignments { 0x0041, {key '1'}, 0x00, {key '2'} ... {key '0'}, 0,0,0, {symbols}, 0 }
where {key '0'} => ' ', '0'
s Press key { 0x0042, press: 0x01; release: 0x02, button, 0x01 }
where button: 0x01 - 0x09: 1-9
0x0a: 0
0x0b: #
0x0c: *
0x0d: Power
0x0e: Pick up phone
0x0f: Hang
0x10: Volume +
0x11: Volume -
0x17: Up
0x18: Down
0x19: Menu
0x1a: Names
0x1B onwards: don't know but they do produce
a beep and light up the keypad as if
a key had been pressed.
r Press key ack { 0x0043, press/release/error(0x05) }
s ??? { 0x0044 }
r ??? ack { 0x0045, 0x01 }
0x0d: Status
r Display { 0x0050, 0x01, y, x, len, "string"(unicode) }
s Status request { 0x0051 }
r Status { 0x0052, no. of byte pairs, {byte pair} }
where {byte pair}: {cmd, 1:off 2:on}
cmd: 1: call in progress
2: ???
3: have unread sms
4: voice call active
5: fax call active
6: data call active
7: key lock active
8: is SMS storage full
s Display status { 0x0053, 1:on 2:off }
(will send displayed messages with x,y coordinates)
r Display status ack { 0x0054, 1 }
0x11: Phone clock & alarm
s set date and time { 0x0060, 1,1,7,yearh,yearl,month,mday,hour,min,0x00 }
r date and time set { 0x0061, return }
where return 0x01: OK
0x6f: SIM card not ready
0x8d: waiting for PIN
s get date and time { 0x0062 }
r date and time recvd { 0x0063,date_set?,time_set?,?,?,yearh,yearl,month,mday,hour,min,second }
where: date_set & time_set==0x01 - set
0x00 - not set, ?,?,yearh,yearl,month,mday,hour,min,second
not available in frame
s set alarm { 0x006b, 1,32,3,0x02(on-off),hour,min,0x00 }
r alarm set { 0x006c, return }
where return 0x01: OK
0x6f: SIM card not ready
0x8d: waiting for PIN
s get alarm { 0x006d } [Not supported by Nokia 3410]
r alarm received { 0x006e,?,?,?,?,alrm(==2:on),hour,min }
0x12: Connect to NBS port (61xx only ?)
s Send {+0x0c, 0x01, UDH header, data}
(without 0,1 header -- for oplogo, cli, ringtone etc upload)
where: UDH header = 0x06, 0x05, 0x04,destporth,destportl,srcporth,srcportl
Seems not to work in MBUS!
0x13: Calendar notes
s Write calendar note { 0x0064, 0x01, 0x10, length, type, yearH, yearL, month, day, hour, timezone,
alarm?(alarm yearH, yearL, month, day, hour, timezone): (0,0,0,0,0,0),
textlen, "text" }
r Write cal.note report { 0x0065, return }
where return: 0x01: ok
0x6f: SIM card not ready
0x73: memory full
0x7d: failure
0x81: calendar functions busy. Exit Calendar menu and try again
0x8d: waiting for PIN
s Calendar notes set { 0x0066... }
r Calendar note recvd { 0x0067, 0x01, ?, length, type, yrH,yrL,mon,day,hr,tz,alrm yrH,yrL,mon,day,hr,tz,textlen,"text"}
[Nokia 3310|3330 info:
The year given for start date is incorrect -- apparently it is always 2090 -- the year for the alarm is correct.
The text field starts with the type of encoding for the rest of the text:
0x01 for ASCII-only text
0x02 if text contains the Yen sign
0x03 if text contains the Euro sign (or both Euro and Yen)
]
[Nokia 3410 info:
The year given by the phone is incorrect -- subtract 90 to get the real value
The text field starts with character 0x01. This is apparently a value for
the type of encoding for the rest of the text field.]
r Calendar note recvd { 0x0067, return }
where return: 0x01: OK
0x6f: SIM card not ready
0x8d: waiting for PIN
0x93: empty location
s Delete cal.note { 0x0068, location }
r Del. cal.note report { 0x0069, err }
where err: 0x01: OK
0x6f: SIM card not ready
0x81: calendar functions busy. Exit Calendar menu and try again
0x8d: waiting for PIN
0x93: empty location
0x14: SMS funcs
s Write SMS to SIM { 0x0004, .... }
r Write SMS to SIM Ok { 0x0005, ?, location }
r Write SMS to SIM err { 0x0006, errcode }
where errcode: 0x02: all locations busy
0x03: invalid location
0x06: SIM card not ready
0x0c: waiting for PIN
s Mark SMS as read { 0x0007, 0x02, location, 0x00, 0x64 }
r SMS message frame rcv { 0x0008,subtype,?,num,?,BCD(smscenter)...} 20->type, 22->status
where type: 0x06: delivery report
status: 0x00: delivered
0x30: pending
0x46: failed
0x09: reading failed
subtype: 0x02: invalid mem type
0x07: empty SMS location
0x0c: no access to memory (no PIN in card, etc.)
r SMS read error { 0x0009, errcode }
where errcode: 0x00: unknown reason
0x02: invalid location
0x06: SIM card not ready
0x07: empty location
0x0c: waiting for PIN
s Delete SMS message { 0x000a, 0x02, location }
r Delete OK { 0x000b }
r Delete error { 0x000c, errcode }
where errcode: 0x00: unknown reason
0x02: invalid location
0x06: SIM card not ready
(no error if deleting an empty location)
0x0c: waiting for PIN
s SMS status request { 0x0036, 0x64 }
r SMS status { 0x0037,?,?,?,?,?,?,msgnumber,unread }
r SMS status error { 0x0038, errcode }
where errcode: 0x06: SIM card not ready
0x0c: waiting for PIN
0x3f: WAP
s Enable WAP frames { 0x0000}
r Enable WAP frames { 0x0002, 0x01}
s ?? { 0x0003}
r ?? { 0x0004}
s Get WAP bookmark { 0x0006, 0x00, location}
where location: 0 - 14
r Get WAP bookmark { 0x0007, 0x00, name_len, name(unicode),
url_len, url(unicode), 0x01,0x80,0x00[7]}
r Get WAP bookmark err { 0x0008, error }
where error:
0x00(?)invalid position
0x01 user inside "Bookmarks" menu. Must leave it
0x02 invalid/too high/empty location
s Set WAP bookmark { 0x0009, 0xff, 0xff, name_len, name(unicode),
url_len, url(unicode), 0x01,0x80,0x00[7] }
Note: bookmark is added to the first free location.
r Set WAP bookmark OK {+0x01, 0x36, 0x0a, block }
where block:
0x0a, location_of_just_written_bookmark(?),
0x00, next_free_location(?)
r Set WAP bookmark err {+0x01, 0x36, 0x0b, error }
where error:
0x04 - memory is full
0x01 - we are in the bookmark menu
0x00 - unknown reason for now ;(
? s Delete WAP bookmark { 0x000c, 0x00, location }
where: location = 0-14
? r Delete WAR bookmark OK{ 0x000d }
? r Delete WAPbookmark err{ 0x000e, 0x02 }
s ?? { 0x000F}
r ?? { 0x0010, 0x00}
s Get WAP settings 1 { 0x0015, location}
where location: 0x00 - 0x05
r Get WAP settings 1 OK { 0x0016, title length, title (Unicode), URL length, URL(Unicode),con_type, ???[6 bytes],location, ???[5 bytes],security,...}
where:
con_type: 0x00 - temporary
0x01 - continuous
location: when use "Get WAP settings 2 frame", must give it
security: 0x00 = no, 0x01 = yes
r Get WAP settings 1 err{ 0x0017, error }
where error:
0x01 user inside "Settings" menu. Must leave it
0x02 invalid/too high/empty location
s Get WAP settings 2 { 0x001b, location}
where location: 0x00 - 0x1d (you get it in "Get WAP settings 1" frame)
r Get WAP settings 2 OK { 0x001c, 0x01, type, frame...}
where type : 0x00 - SMS bearer
frame:
service_num_len, service_num (Unicode), server_num_len, server_num(Unicode)
0x01 - data bearer
frame:
auth, call_type, call_speed, ?, IP len, IP (Unicode), dialup len, dialup (Unicode),
user len, user (Unicode), password len, password (Unicode)
where auth: 0x00 - normal, 0x01 - secure
call_type: 0x00 - analogue, 0x01 - ISDN
call_speed: 0x00 - 9600, 0x01 - 14400
0x02 - USSD bearer
frame: type, service number len/IP len,service num (Unicode)/IP (Unicode),service code len,
service code (Unicode)
where type: 0x01 - service number, 0x00 - IP
r Get WAP settings 2 err{ 0x001d,error}
where: error=0x05
0x40: Security commands
s ??? {+0x00, 0x00, 0x07, 0x11, 0x00, 0x10, 0x00, 0x00}
This frame hangs phone (N3310 4.02). Meaning unknown !
s Open simlock 1 { 0x02, 0x03, 0x1f, 0x11, 0x01, 0x01, 0x10, 0x00}
r Open simlock 1 { 0x02 }
s ???(N6150) { 0x08, 0x00 }
r ???(N6150) { 0x08 }
s Enable extended cmds { 0x64, cmd }
where cmd: 0x00: off
0x01: on
0x02: enter service mode ?
0x03: reset (doesn't ask for PIN again)
0x04: reset (PIN is requested)
In 5110 makes reset without PIN
0x06: CONTACT SERVICE!!! Don't try it!
s Reset phone settings { 0x65, value, 0x00 }
where value: 0x08 - reset UI (User Interface) settings
0x38 - reset UI, SCM and call counters
r Reset phone settings { 0x65, 0x00 }
s Get IMEI { 0x66 }
r Get IMEI { 0x66, 0x01, IMEI, 0x00}
s (ACD Readings)?(N6150 { 0x68 }
r (ACD Readings)?(N6150 { 0x68, ... }
s Get Product Profile
Settings { 0x6a}
r Get Product Profile
Settings { 0x6a, 4bytes with Product Profile Settings }
s Set Product Profile
Settings { 0x6b, 4bytes with Product Profile Settings }
r Set Product Profile
Settings OK ? { 0x6b }
s Get code { 0x6e, code }
where code: see 0x08/0x0004 (only security code is allowed)
r Get code { 0x6e, code, allowed, allowed? (sec code (text), 0x00) }
where code: see 0x08/0x0004
allowed: 0: no
1: yes
s Set code { 0x6f, code, sec code(text), 0x00 }
where code: see 0x08/0x0004
s Start monitoring { 0x70, block }
where block(N6150):
0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xf9,0x76,0x65,0x20,0x00,
0x00,0x00,0x00,0x00,0x18,0x26,0x15,0x7d,0x0a,0x00,
0xf5,0x82,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xf0,0x77,0x80,
0x77,0x80,0xf2,0x82,0x20,0x20,0x20,0x20,0x20,0x20,
0x20,0x20,0x20,0x20
This block enables probably all possible monitored parameters.
After it phone sends 0x00 message type values
s Break monitoring { 0x71 }
r Break monitoring { 0x71 }
s Reset Permanent
Counters (nm->test36) { 0x74, 0x01, 0x01, 0x0e }
r Reset Permanent
Counters (nm->test36) { 0x74 }
s Call commands { 0x7c, block }
where where: command, (values)
command: 0x01
values: number(ASCII), 0x00 - makes voice call
command: 0x02 - answer call
command: 0x03 - release call
r Call commands { 0x7c, command }
s Netmonitor { 0x7e, field }
where: field: 00: next
F0: reset
F1: off
F2: field test menus
F3: developer menus
s Open simlock 2 { 0x81, 0x01, locknumber, 0x10, 0x10, 0x10, 0x10, 0x10 }
Note: sets simlock type to factory?
where locknumber: 1,2,4,8
s Open simlock 2 { 0x81, 0x01, locknumber }
where locknumber: 1,2,4,8
s Close simlock { 0x82, 0x01, locknumber, 0x00, 0x00, locksinfo(lock1,4,2,3), 0x00 }
where locknumber: 1,2,4,8
r Close simlock { 0x82, the rest like in 0x40/0x8a }
s Get simlock info { 0x8a, 0x00}
r Get simlock info { 0x8a, 0x00, 0x01, lockstype, locksclosed, 0x00, 0x00, locksinfo(lock1,4,2,3), counter1,counter2,counter4,counter4,0x00 }
where: lockstype: bit1,bit2,bit3,bit4 - if set, selected lock is user lock
locksclosed: bit1,bit2,bit3,bit4 - if set, selected lock is closed
counter1 - counter4: counters for locks
s Set downloaded OpName { 0x8b, 0x00, MCC1, MCC2, MNC, Name, 0x00 }
r SetdownloadedOpNameOK?{ 0x8b, 0x00, 0x01 }
s Get downloaded OpName { 0x8c, 0x00 }
r Get downloaded OpName { 0x8c, 0x00, 0x01, MCC1, MCC2, MNC, Name, 0x00,...}
s Buzzer pitch { 0x8f, volume, hzHI, hzLO }
if volume and hz is 0, it's off
r Buzzer pitch { 0x8f}
s ACD Readings ? { 0x91, parameter?(0x02,0x03,0x04,0x05,0x07) }
r ACD Readings ? { 0x91, parameter?, value? }
s Sleep mode test { 0x92, 0x00, 0x00, howlong(2 bytes), enable }
where: enable == 0x01 - enable after test
0x00 - don't enable after test
howlong (ms) = 0x07, 0xd0 = 2000
s ???(N6150) { 0x98, 0x00 }
r ???(N6150) { 0x98, 0x00, 0x04 }
s Get bin ringtone { 0x9e, location }
where: location=0,1,etc.
r Get bin ringtone { 0x9e, location, error, contents... }
where location=0,1,etc.
error=0x0a, ringtone NOT available
0x00, OK
s Set bin ringtone { 0xa0, location, 0x00, contents... }
where: location=0,1,etc.
r Set bin ringtone { 0xa0, location, error }
where location=0,1,etc.
error=0x0a, ringtone NOT set
0x00, ringtone set OK
r Get MSid { 0xb5, 0x01, 0x2f, msid, 0x25 }
s Get info about phone { 0xc8, 0x01 }
r Get info about phone { 0xc8, 0x01, 0x00, "V ", "firmware", 0x0a, "firmware date", 0x0a, "model", 0x0a, "(c) NMP.", 0x00 }
third byte is an error code
0x00 OK
0x03 value not exists?
0x08 value not set?
s Get MCU SW Checksum { 0xc8, 0x02 }
r Get MCU SW Checksum { 0xc8, 0x02, 0x00, checksum (4 bytes),0x00 }
s DPS External SW { 0xc7, 0x03 }
r DSP External SW { 0xc7, 0x03, 0x00, string,0x00 }
s Get HW { 0xc8, 0x05 }
r Get HW { 0xc8, 0x05, 0x00, HW version (4 bytes), 0x00 }
s Get "Made" Date { 0xc8, 0x05 }
r Get "Made" Date { 0xc8, 0x05, 0x00, date(4 bytes), 0x00 }
s Get DSP Internal SW { 0xc8, 0x09 }
r Get DSP Internal SW { 0xc8, 0x09, 0x00, version (1 bytes), 0x00 }
s Get PCI version { 0xc8, 0x0b }
r Get PCI version { 0xc8, 0x0b, 0x00, version, 0x00 }
s Get system ASIC { 0xc8, 0x0c }
r Get system ASIC { 0xc8, 0x0c, 0x00, string, 0x00 }
s Get COBBA { 0xc8, 0x0d }
r Get COBBA { 0xc8, 0x0d, 0x00, string, 0x00 }
s Get PLUSSA { 0xc8, 0x0e }
r Get PLUSSA { 0xc8, 0x0e, available, 0x00 }
where available: 0x01: not available
s Get CCONT { 0xc8, 0x0f }
r Get CCONT { 0xc8, 0x0f, available, 0x00 }
where available: 0x01: not available
s Get PPM version { 0xc8, 0x10 }
r Get PPM version { 0xc8, 0x10, 0x00, "V ", "firmware", 0x0a, "firmware date", 0x0a, "model", 0x0a, "(c) NMP.", 0x00 }
s Get PPM info { 0xc8, 0x12 }
r Get PPM info { 0xc8, 0x12, 0x00, PPM version ("B", "C", etc.), 0x00 }
s Set HW version { 0xc9, 0x05, version, 0x00 }
s Get Product Code { 0xca, 0x01 }
r Get Product Code { 0xca, 0x01, 0x00, number, 0x00 }
s Get Order Number { 0xca, 0x02 }
r Get Order Number { 0xca, 0x02, 0x00, string, 0x00 }
s Get Prod.Ser.Number { 0xca, 0x03 }
r Get Prod.Ser.Number { 0xca, 0x03, 0x00, number, 0x00 }
s Get Basic Prod.Code { 0xca, 0x04 }
r Get Basic Prod.Code { 0xca, 0x04, 0x00, number, 0x00 }
s Set Product Code { 0xcb, 0x01, product code, 0x00 }
s Set Order Number { 0xcb, 0x02, number, 0x00 }
s Set Prod.Ser.Number { 0xcb, 0x03, number, 0x00 }
the following 4 values are shown in the "warranty screens" opened typing *#92702689# on phone keyboard
s Get (original ?)IMEI { 0xcc, 0x01 }
r Get (original ?)IMEI { 0xcc, 0x01, IMEI, 0x00 }
s Get Manufacture Date { 0xcc, 0x02 }
r Get Manufacture Date { 0xcc, 0x02, 0x00, string, 0x00 }
string format is MMYY
s Get Repaired Date { 0xcc, 0x03 }
r Get Repaired Date { 0xcc, 0x03, 0x00, string, 0x00 }
s Get Purchasing Date { 0xcc, 0x04 }
r Get Purchasing Date { 0xcc, 0x04, 0x00, string, 0x00 }
s Set "Made" date { 0xcd, 0x02, string, 0x00 }
s Make "all" phone tests{ 0xce,0x1d,0xfe,0x23,0x00,0x00}
s Make one phone test { 0xce,0x1d,num1,num2,num3,num4}
Where num1-num4: 0x02,0x00,0x00,0x00;
0x04,0x00,0x00,0x00;
0x08,0x00,0x00,0x00;
0x10,0x00,0x00,0x00;
0x20,0x00,0x00,0x00;
0x40,0x00,0x00,0x00;
0x80,0x00,0x00,0x00;
0x00,0x01,0x00,0x00;
0x00,0x02,0x00,0x00;
0x00,0x04,0x00,0x00; - "Power off"
No test for "Security data"
0x00,0x10,0x00,0x00;
0x00,0x20,0x00,0x00;
0x00,0x40,0x00,0x00;
0x00,0x80,0x00,0x00;
0x00,0x00,0x01,0x00;
....
0x00,0x00,0x10,0x00;
s Result of phone tests { 0xcf }
r Result of phone tests { 0xcf, number of tests, results of next tests }
s ??? { 0xd1 }
r ???(N5110) { 0xd1, 0x00, 0x1d, 0x00, 0x01, 0x08, 0x00 }
s LCD Test { 0xd3, value }
where value: 0x03, 0x02 - 1'st test
0x03, 0x01 - 2'nd test
0x02, 0x03 - clears screen
s ACD Readings(N6150)? { 0xd4, 0x02, 0x00, 0x02, 0x00, 0x0e, 0x01}
r ACD Readings(N6150)? { 0xd4, 0x02, 0x00, 0x02, 0x00, 0x0e, 0x01, ?}
s Get EEPROM { 0xd4, 0x02, 0x00, 0xa0, locationLo, locationHi, numofbytes }
where: numofbytes - how many bytes to read
Note: Works ONLY in MBUS
r Get EEPROM { 0xd4, 0x02, 0x00, 0xa0, locationLo, locationHi, numofbytes, contents... }
where numofbytes - how many bytes available
contents - bytes with contents (if numofbytes != 0)
0x41: Snake game ?
0x47:
s Get Picture Image { 0x0001, location }
r Get Picture Image when contains sender number
{ 0x0002, location, number(like in SMS), 0x00, len, text, 0x00, width, height, 0x01, bitmap }
NOTE:
Supports only 0x81 and 0x91 coding (NOT alphanumeric numbers!)
in sender without sender number
{ 0x0002, location, 0x00, 0x00, 0x00, len, text, 0x00, width, height, 0x01, bitmap }
s Set Picture Image { 0x0003, frame...}
where frame: see 0x47/0x0002
r Get/Set PictureImageOK{ 0x0004 }
r Set Picture Image err { 0x0005, error? }
where error=0x74 - wrong location ?
0x64: (Nokia 3310 seems to not respond to this frame)
s Phone ID request { 0x0010 }
r Phone ID recvd { 0x0011, "NOKIA", "imei", 0, "model", 0, "prod.code", 0, "HW", 0, "firmware", magic bytes x 4 ... }
s Accessory connection { 0x0012, 16x0x00, 'NOKIA&NOKIA accessory', 3x0x00 } (45 bytes)
0x7f: Acknowledge(FBUS/IRDA){+type, seq }
Acknowledge(MBUS)...
0xd0:
s Power on message seq1 {+04 }
r Power on message seq1 {+05 }
0xd1:
s Get HW&SW version { 0x0003, 0x00 }
0xd2:
r Get HW&SW version { 0x0003 "V " "firmware\n" "firmware date\n"
"model\n" "(c) NMP." }
0xda: ? (during playing 2 player snake)
0xf0:
s Send RLP frame {+0x00, 0xd9, ... }
0xf4: Power on message seq 2
Generated by dwww version 1.15 on Thu May 23 23:42:14 CEST 2024.