|
Welcome to the GSM-Forum forums. You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. Only registered members may post questions, contact other members or search our database of over 8 million posts. Registration is fast, simple and absolutely free so please - Click to REGISTER! If you have any problems with the registration process or your account login, please contact contact us . |
|
Register | FAQ | Donate | Forum Rules | Root any Device | ★iPhone Unlock★ | ★ Direct Codes ★ | Direct Unlock Source |
Nokia Legacy Phones ( DCT-1 ,2 ,3 ,L ) Nokia Legacy Models Like 1011, 1610, 211x, 2x20, 6050, 3110, 8110, NKxxx , 2100, 3210, 3310, 3330, 3410, 5110, 5210, 5510, 6110, 6150, 6210, 6250, 7110, 8210, 8250, 8850 also 9110 & 9210 |
| LinkBack | Thread Tools | Display Modes |
05-10-2001, 20:20 | #1 (permalink) |
No Life Poster Join Date: Dec 2000 Location: Austria
Posts: 483
Member: 2832 Status: Offline Thanks Meter: 0 | Checksum & Cobba ID I need ALL information about Checksum and Cobba ID!!! Where can I read it? Whow can I calculat it or update it? ......... Cyberdog |
05-11-2001, 14:20 | #3 (permalink) |
Freak Poster Join Date: Oct 2000 Location: Amsterdam
Posts: 467
Member: 2327 Status: Offline Thanks Meter: 1 | Last update 04.04.2001 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Assembled by Balazs Nagy ([email protected]) Marcin Wiacek ([email protected]) Jens Bennfors <[email protected]> Michael Hund <[email protected]> Jay Bertrand <[email protected]> Gabriele Zappi <[email protected]> ... and other members of gnokii mailing list and authors of some WWW pages. The data provided is for information purposes only. Some of the frames might be hazardous to your phone. Be careful!!! We do not take any responsibility or liability for damages, etc. NOTE: this information isn't (and can't be) complete. If you know anything about features not listed here or you noticed a bug in this list, please notify us via e-mail. Thank you. Document describing frames used in GSM Nokia 6210 and derivatives (7110) Correct format is FBUS version 2/Infrared/MBUS version 2 (see nokia.txt for protocol details): List: 0x00: Connect to NBS port ? r Set ringtone {+0x7c,0x01,0x00,0x0d,0x06[6],0x78,ringtone packed according to SM2.0} Seems not to work in MBUS! 0x01: Communication Status ? r Call msg { 0x0002 } ? r Call in progress { 0x0003, seqnr } ? r Remote end hang up { 0x0004, seqnr, ?, error (like in netmon in 39) } ? r incoming call alert { 0x0005, seqnr, numlen, "number", namelen, "name" } ? r answered call { 0x0007, seqnr } ? r terminated call { 0x0009, seqnr } ? r call msg { 0x000a, seqnr } Note: in 6210 4.27 all msg from 0x01 seems to be unavailable 0x02: SMS handling s Send SMS message { 0x0001, 0x02, 0x00 (SEND REQUEST), ... } r Message sent { 0x0002 } r Send failed { 0x0003, ?, ?, error (like in netmon in 65)} r SMS message received { 0x0010, ...... } (whole message) s Set CellBroadcast { 0x0020, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01 } for enable cell broadcast ? 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } for disable cell broadcast ? r Set CellBroadcast OK { 0x0021, 0x01 } r Read CellBroadcast { 0x0023, ?, ?, ?, channel, ?, message... } ? s Set SMS center { 0x0030, 0x64, priority, checksum?, format, validity[2], {DefaultRecipient no.}[12], {SMScenter no.}[12], {SMSC name}, 0x00} where tel.no.[12]: {len, type, {number(BCD)}} type: 0x81: normal 0x91: + (international) 0xd0: alphanumeric format: 0x00: text 0x22: fax 0x24: voice 0x25: ERMES 0x26: paging 0x31: X.400 0x32: email validity: 0x000b: 1 hour 0x0047: 6 hours 0x00a7: 24 hours 0x00a9: 72 hours 0x00ad: 1 week 0x00ff: max.time r Set SMS center OK { 0x0031 } r Set SMS center error { 0x0032, reason } s Get SMS center { 0x0033, 0x64, priority } r SMS center received { 0x0034, priority, checksum?, type, validity[2], {DefaultRecipient no.}[12], {SMScenter no.}[12], {SMSC name}, 0x00 } where priority, checksum, type, validity, tel.no.[12]: see 0x02/0x0030 r SMS center error recv { 0x0035, reason } 0x03: Phonebook functions s Get memory status { 0x0103, 0x02, memory type } where: memory type - see 0x03/0x0107 r Get memory status { 0x0104, 0x00, xL, 0x00[2], y1H, y1L, 0x10, 0x00[2], z?, ymaxH, ymaxL, y2H, y2L, 0x0d?, xH?, 0x00[2]? } where y1: location (lowermost) y2: no. of locations ymax: maximum location no. s Read memory { 0x0107, 0x01, 0x01, 0x00, 0x01, xH, xL, yH, yL, 0x00, 0x00} where x: memory type 0x01: (256) Dialled numbers 0x02: (512) Missed calls 0x03: (768) Received calls 0x05: (500) telephone phonebook 0x06: (160) SIM phonebook 0x07: (10/0) 0x08: (1/0) 0x09: (4) voice mailbox 0x0e: (10) speed dials 0x10: (5) caller groups y: location r Read memory { 0x0108, 0x00, 0x01, code,0x00, 0x00, z, xH, xL, yH, yL, 0x00, 0x00, 0x00, no.of blocks, { block } * } where if code==0x0f && xH==0x34 - phonebook location not found y: location z: generic block size block: {id, 0, 0, blocksize, block no., {contents}, 0x00} id: 0x04 pointer to another memory location { 0xff?, yH, yL, xL,0x00[3] } 0x07 name {len, (unicode)}, 0x08 email 0x09 postal 0x0a note {len, (unicode)} 0x0b number {type, 0x00[3], len, (unicode)} 0x0c ringtone {ringtone no., 0, 0} 0x13 date for a called list (DC, RC, etc.) 0x1b caller group graphic {width, height, 0, 0 {bitmap}} 0x1c caller group graphic on? {(1: yes, 0: no), 0, 0} 0x1e caller group number {number, 0, 0} type: 0x0a: General, 0x03: Mobile (office ?), 0x06: Work, 0x04: Fax, 0x02: Home (mobile ?) s Set mem location { 0x010b, 0x00, 0x01, 0x01, 0x00, 0x00, z, xH, xL, yH, yL, 0x00, 0x00, 0x00, no.of blocks, { block }[no.of blocks] } r Set mem location { 0x010c, 0?, 1?, code, 0?, 0?, z?, 0?, 0?, yH, yL, xL } where code: 0x3d - wrong entry type 0x3e - too much entries 0x0a: Network status s get used network { 0x0070 } r get used network { 0x0071, available,?,?,length,netstatus,netsel,cellIDH, cellIDL,lacH,lacL,MCC+MNC[3],{Opstr}, 4?, len, xlen(78), ylen(21), 0, {bitmap} } where {Opstr}: namelen, {operator name(unicode)} len: {xlen, ylen, 0, {bitmap} + 2 {bitmap}: bitmaplen, 0, 0, {OTA bitmap} available: 0x02 if the logo following is valid, 0x01 for no operator logo following s get network status { 0x0081 } r get network status { 0x0082, network%, 0x14? } s set operator logo { 0x01a3 0x01, oplogo?, MCC+MNC[3], 0?,4?,len, xlen(78),ylen(21), 0 (frames?), {bitmap}*?, 0x00(padding) } where len, {bitmap}: see 0x0a/0x0071 r set operator logo OK { 0x01a4 } 0x13: Calendar notes s Add meeting note { 0x0001, body like in subtype 0x001a...} r Add meeting note { 0x0002, location (2 bytes), status (2 bytes)} s Add call note { 0x0003, body like in subtype 0x001a...} r Add call note { 0x0004, location (2 bytes), status (2 bytes)} s Add birthday note { 0x0005, body like in subtype 0x001a...} r Add birthday note { 0x0006, location (2 bytes), status (2 bytes)} s Add reminder note { 0x0007, body like in subtype 0x001a...} r Add reminder note { 0x0008, location (2 bytes), status (2 bytes)} s Delete calendar note { 0x000b, location (2 bytes) } r Delete calendar note { 0x000c, location (2 bytes), ?, ?, ?, ? } s Get calendar note { 0x0019, location (2 bytes) } r Calendar note recvd { 0x001a, location (2 bytes), entry type, 0x00, year (2 bytes), Month, Day, block} where: entry type - 0x01 - Meeting, 0x02 - Call, 0x04 - Birthday, 0x08 - Reminder block: for Meeting:{hour,minute,alarm (two bytes),recurrance (two bytes),len,0x00,string(unicode)} where alarm=Number of minutes before the time of the meeting that the alarm should be triggered: For meetings with "No alarm"=0xFFFF (-1). For "On time"=0x0000 half an hour=0x001E, and so on. Recurrance=in hours, between future occurances of this meeting. If there is no repeat, this value is 0x0000. The special value 0xffff means 1 Year! for Call:{Hour,Minute,Alarm (as above),Recurrance (as above),namelen,numberlen, name(unicode),number(unicode)} for Reminder:{Recurrance (as above),len,0x00,string(unicode)} for Birthday:{byte1,byte2,alarm(4 bytes),yearofbirth,alarmtype,len,string(unicode)} byte1 and byte2 may vary (???). Usually are 0x00 both (but not always) In Birthday, the Year in the common part, usually contains a strange year. So, don't consider it as Year of note, neither year of BirthDay (for Year of Birthday use the value described below). where alarm=32-bit integer that is the number of seconds between the desired alarm time and 11:59:58pm on the birthday.For "No Alarm", the value is 0x0000FFFF (65535). YearOfBirth=used instead of the one in the common part of the entry (see above) but only when reading birthday entries. For storing entries, this field does not exist. AlarmType: 0x00 - Tone, 0x01 - Silent s Get first free pos { 0x0031 } r Get first free pos { 0x0032, location (2bytes) } s Get notes info { 0x003a, 0xFF, 0xFE} r Get notes info { 0x003b, how many notes used (2 bytes), 0x01, 0x07, { two bytes with location for each note} *} 0x14: s Get Picture Image { 0x0007, location, number[2 bytes], 0x00, 0x64 } where location: 0x21 (always ?) r Get Picture Image { 0x0008, 0x07, location, number[2 bytes], 0x07, ??[38], width, height, lenH, lenL, {bitmap}} where location: 0x21 (always ?) s Set Picture Image { 0x0050, 0x07, location, number[2 bytes], 0x07, ??[38], width, height, lenH, lenL, {bitmap}} std. size: 72x28 where location: 0x21 (always ?) r Set Picture Image { 0x0051, location, number[2 bytes], 0x07 } where location: 0x21 (always ?) s List Picture Images { 0x0096, location, 0x0f, 0x07 } where location: LM tries with 0x09, 0x11, 0x19, 0x21, 0x29, 0x31, 0x39, 0x41, 0x49 Returned value with 0x21 r List Picture Images { 0x0097, number of pictures[2 bytes], number1[2 bytes], number2[2 bytes], ..., } s Get SMS from folder { 0x0107, folderID, location(2 bytes), 0x01, 0x65, 0x01} where: folderID - see 0x14/0x017B r Get SMS from folder { 0x0108, 0x01/0x07(?), folderID, location(2 bytes), 0x00/0x01/0x02(read/unread/default?),sender number ?,...} where: folderID - see 0x14/0x017B s Get folder status { 0x016b, folderID, 0x0F, 0x01} where: folderID - see 0x14/0x017B r Get folder status { 0x016c, number of entries (2 bytes), entry1number (2 bytes), entry2number(2 bytes), ....} s Get folder names { 0x017A, 0x00, 0x00} r Get folder names { 0x017B, number of strings, folderID, name1, 0x00, folderID, name2, 0x00, name3, 0x00,...} where: folderID=0x08 - Inbox 0x10 - Outbox 0x18 - Archive 0x20 - Templates 0x17: s Get Battery info { 0x0002 } r Get Battery info { 0x0003, 0x0b, batt%, 0x14?, 0x01? } 0x1b: s Get IMEI { 0x0001 } r Get IMEI { 0x0002, {IMEI(ASCII)}, 0x00 } s get HW&SW version { 0x0003, 0x01, 0x32 } r get HW&SW version { 0x0004, "V " "firmware\n" "firmware date\n" "model\n" "(c) NMP." 0x00 0xff[14] } 0x1f: s ??? { 0x0010, 0x02, 0x00, 0xff, 0xff } r ??? { 0x0011, length, 0x00, {block}[length] } where block: { unicode letter[2], 0x0000, 0x00, 0x55, ??, ?? } s Set ringtone { 0x011f, 0x00, location, 0x00, name(Unicode), ringtone(format the same to 0x40/0x019e and 0x40/0x01a0) } where: location: 0x87 to 0x8b on N6210 0x74 to ... on N7110 0x39: s ??? { 0x0101, 0x04, 0x01, 0x01, 0xff, 0x03 } r ??? { 0x0102, 0x01, 0x02, 0x03, 0x01, 0x01, 0x01, 0x85/0x087 } 0x3f: WAP s Get WAP bookmark { 0x0006, 0x00, location } where: location = 0-14 r Get WAP bookmark OK {+0x01, 0x36, 0x00, block } where block: 0x07,0x00, name_len, name(unicode), url_len, url(unicode), 0x01,0x80,0x00[7] r Get WAP bookmark err { +0x01, 0x36, 0x00, 0x08, error } where error: 0x00 invalid position 0x02 no more bookmark stored s Set WAP bookmark { 0x0009, 0xff, 0xff, name_len, name(unicode), url_len, url(unicode), 0x01,0x80,0x00[7] } Note: bookmark is added to the first free location. r Set WAP bookmark err {+0x01, 0x36, 0x0b, error } where error: 0x04 - memory is full 0x01 - we are in the bookmark menu 0x00 - unknown reason for now ;( r Set WAP bookmark OK {+0x01, 0x36, 0x00, block } where block: 0x0a, location_of_just_written_bookmark(?), 0x00, next_free_location(?) s Delete WAP bookmark { 0x000c, 0x00, location } where: location = 0-14 r Delete WAR bookmark OK{+0x01, 0x36, 0x00, 0x0d } r Delete WAPbookmark err{+0x01, 0x36, 0x00, 0x0e, 0x02 } 0x40: Security commands ? s ???(N6150) { 0x08, 0x00 } ? r ???(N6150) { 0x08 } s Enable extended cmds { 0x64, cmd } where cmd: 0x00: off 0x01: on 0x03: reset (doesn't ask for PIN again) 0x04: reset (PIN is requested) In 5110 makes reset without PIN 0x06: CONTACT SERVICE!!! Don't try it! s Get IMEI { 0x66 } r Get IMEI { 0x66, 0x01, IMEI, 0x00} s (ACD Readings)?(N6150 { 0x68 } r (ACD Readings)?(N6150 { 0x68, ... } s Get Product Profile Settings { 0x6a} r Get Product Profile Settings { 0x6a, 4bytes with Product Profile Settings } s Set Product Profile Settings { 0x6b, 4bytes with Product Profile Settings } r Set Product Profile Settings OK ? { 0x6b } s Get code { 0x6e, code } where code: see 0x08/0x0004 (no allowed code !) r Get code { 0x6e, code, allowed, allowed? (sec code (text)) } where code: see 0x08/0x0004 allowed: 0: no 1: yes ? s Reset Permanent ? Counters (nm->test36) { 0x74, 0x01, 0x01, 0x0e } ? r Reset Permanent ? Counters (nm->test36) { 0x74 } s Call commands { 0x7c, block } where where: command, (values) command: 0x01 values: number(ASCII), 0x00 - makes voice call command: 0x02 - answer call command: 0x03 - release call r Call commands { 0x7c, command } s Netmonitor { 0x7e, field } where: field: 00: next F0: reset F1: off F2: field test menus F3: developer menus s Get simlock info { 0x8a, 0x00} r Get simlock info { 0x8a, 0x00, 0x01, lockstype, locksclosed, 0x00, 0x00, locksinfo(lock1,4,2,3), counter1,counter2,counter4,counter4,0x00 } where: lockstype: bit1,bit2,bit3,bit4 - if set, selected lock is user lock locksclosed: bit1,bit2,bit3,bit4 - if set, selected lock is closed counter1 - counter4: counters for locks s Buzzer pitch { 0x8f, volume, hzLO, hzHI } if volume and hz is 0, it's off r Buzzer pitch { 0x8f} s ACD Readings ? { 0x91, parameter?(0x02,0x03,0x04,0x05,0x07) } r ACD Readings ? { 0x91, parameter?, value? } ? s ???(N6150) { 0x98, 0x00 } ? r ???(N6150) { 0x98, 0x00, 0x04 } s Get bin ringtone { 0x9e, location } where: location=0,1,etc. r Get bin ringtone { 0x9e, location, error, contents... } where location=0,1,etc. error=0x0a, ringtone NOT available 0x00, OK NOTE: N3310 seems to have different format of frame here or this is firmware bug s Set bin ringtone { 0xa0, location, 0x00, contenst... } where: location=0,1,etc. r Set bin ringtone { 0xa0, location, error } where location=0,1,etc. error=0x0a, ringtone NOT set 0x00, ringtone set OK NOTE: N3310 seems to have different format of frame here or this is firmware bug ? r Get MSid { 0xb5, 0x01, 0x2f, msid, 0x25 } s Get info about phone { 0xc8, 0x01 } r Get info about phone { 0xc8, 0x01, 0x00, "V ", "firmware", 0x0a, "firmware date", 0x0a, "model", 0x0a, "(c) NMP.", 0x00 } s Get MCU SW Checksum { 0xc8, 0x02 } r Get MCU SW Checksum { 0xc8, 0x02, 0x00, checksum (4 bytes),0x00 } s DPS External SW { 0xc7, 0x03 } r DSP External SW { 0xc7, 0x03, 0x00, string,0x00 } s Get HW { 0xc8, 0x05 } r Get HW { 0xc8, 0x05, 0x00, HW version (4 bytes), 0x00 } s Get "Made" Date { 0xc8, 0x05 } r Get "Made" Date { 0xc8, 0x05, 0x00, date(4 bytes), 0x00 } s Get DSP Internal SW { 0xc8, 0x09 } r Get DSP Internal SW { 0xc8, 0x09, 0x00, version (1 bytes), 0x00 } s Get PCI version { 0xc8, 0x0b } r Get PCI version { 0xc8, 0x0b, 0x00, version, 0x00 } s Get system ASIC { 0xc8, 0x0c } r Get system ASIC { 0xc8, 0x0c, 0x00, string, 0x00 } s Get COBBA { 0xc8, 0x0d } r Get COBBA { 0xc8, 0x0d, 0x00, string, 0x00 } s Get PLUSSA { 0xc8, 0x0e } r Get PLUSSA { 0xc8, 0x0e, available, 0x00 } where available: 0x01: not available s Get CCONT { 0xc8, 0x0f } r Get CCONT { 0xc8, 0x0f, available, 0x00 } where available: 0x01: not available s Get PPM version { 0xc8, 0x10 } r Get PPM version { 0xc8, 0x10, 0x00, "V ", "firmware", 0x0a, "firmware date", 0x0a, "model", 0x0a, "(c) NMP.", 0x00 } s Get PPM info { 0xc8, 0x12 } r Get PPM info { 0xc8, 0x12, 0x00, PPM version ("B", "C", etc.), 0x00 } s Set HW version { 0xc9, 0x05, version, 0x00 } s Get Product Code { 0xca, 0x01 } r Get Product Code { 0xca, 0x01, 0x00, number, 0x00 } s Get Order Number { 0xca, 0x02 } r Get Order Number { 0xca, 0x02, 0x00, string, 0x00 } s Get Prod.Ser.Number { 0xca, 0x03 } r Get Prod.Ser.Number { 0xca, 0x03, 0x00, number, 0x00 } s Get Basic Prod.Code { 0xca, 0x04 } r Get Basic Prod.Code { 0xca, 0x04, 0x00, number, 0x00 } s Set Product Code { 0xcb, 0x01, product code, 0x00 } s Set Order Number { 0xcb, 0x02, number, 0x00 } s Set Prod.Ser.Number { 0xcb, 0x03, number, 0x00 } s Get (original ?)IMEI { 0xcc, 0x01 } r Get (original ?)IMEI { 0xcc, 0x01, IMEI, 0x00 } s Get Manufacture Month { 0xcc, 0x02 } r Get Manufacture Month { 0xcc, 0x02, 0x00, string, 0x00 } s Get Purchare date { 0xcc, 0x04 } r Get Purchare date { 0xcc, 0x04, 0x00, string, 0x00 } s Set "Made" date { 0xcd, 0x02, string, 0x00 } s Make "all" phone tests{ 0xce,0x1d,0xfe,0x23,0x00,0x00} s Make one phone test { 0xce,0x1d,num1,num2,num3,num4} Where num1-num4: 0x02,0x00,0x00,0x00; 0x04,0x00,0x00,0x00; 0x08,0x00,0x00,0x00; 0x10,0x00,0x00,0x00; 0x20,0x00,0x00,0x00; 0x40,0x00,0x00,0x00; 0x80,0x00,0x00,0x00; 0x00,0x01,0x00,0x00; 0x00,0x02,0x00,0x00; 0x00,0x04,0x00,0x00; - "Power off" No test for "Security data" 0x00,0x10,0x00,0x00; 0x00,0x20,0x00,0x00; 0x00,0x40,0x00,0x00; 0x00,0x80,0x00,0x00; 0x00,0x00,0x01,0x00; .... 0x00,0x00,0x10,0x00; s Result of phone tests { 0xcf } r Result of phone tests { 0xcf, number of tests, results of next tests } ? s ??? { 0xd1 } ? r ???(N5110) { 0xd1, 0x00, 0x1d, 0x00, 0x01, 0x08, 0x00 } s LCD Test { 0xd3, value } where value: 0x03, 0x02 - 1'st test 0x03, 0x01 - 2'nd test 0x02, 0x03 - clears screen s ACD Readings(N6150)? { 0xd4, 0x02, 0x00, 0x02, 0x00, 0x0e, 0x01} r ACD Readings(N6150)? { 0xd4, 0x02, 0x00, 0x02, 0x00, 0x0e, 0x01, ?} r Function of { 0xff, 0x8c } 0x40 msgtype not supported ? 0x78: s Status confirm { 0x0201, 0x03 } r Incoming call seq1 { 0x0102 0x0e 0x03 } r Incoming call seq2 { 0x0102 0x7e 0x01 } 0x79: s CarKit enable { 0x0201 0x01 0x62 0x00 } r CarKit enabled { 0x0201 0x02 0x06 0x00 "V " {version} "\nHFU" 0x00 } 0x7a: r Set startup logo { 0x01eb, 0x15, 0x00 } s Set startup logo { 0x01ec, 0x15, 0x00, 0x00, 0x00, 0x04, 0xc0, 0x02, 0x00, height, 0xc0, 0x03, 0x00, width, 0xc0, 0x04, 0x03, 0x00, {bitmap} } where width, height, {bitmap}: see 0x7a/0x01ed 0x15 r Get startup logo { 0x01ed, 0x15, 0x00, 0x00, 0x00, 0x00, 0x04, 0xc0, 0x02, 0x00, height, 0xc0, 0x03, 0x00, width, 0xc0, 0x04, 0x03, 0x00, {bitmap} } where height: 60 (0x3c) or 65 width: 96 (0x60) {bitmap}: like other bitmaps but pixels placed vertically. r Get security code { 0x01ed, 0x1c, 0x00, {code(ascii)}, 0x00 } s Get startup logo { 0x01ee, 0x15, s Get security code { 0x01ee, 0x1c } 0x7f: Acknowledge(FBUS/IRDA){+type, seq } Acknowledge(MBUS)... 0xd0: s Power on message seq1 {+04 } r Power on message seq1 {+05 } 0xd1: s Get HW&SW version { 0x0003, 0x00 } 0xd2: r Get HW&SW version { 0x0003 "V " "firmware\n" "firmware date\n" "model\n" "(c) NMP." } 0xf4: Power on message seq 2 |
05-11-2001, 14:24 | #4 (permalink) |
Freak Poster Join Date: Oct 2000 Location: Amsterdam
Posts: 467
Member: 2327 Status: Offline Thanks Meter: 1 | Last update 04.04.2001 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Assembled by Balazs Nagy ([email protected]) Alfred R. Nurnberger <[email protected]> Hugh Blemings <[email protected]> Mike Bradley <[email protected]> Odinokov Serge <[email protected]> Pavel Janik <[email protected]> Pawel Kot <[email protected]> Marcin Wiacek ([email protected]) ... and other members of gnokii mailing list and authors of some WWW pages. The data provided is for information purposes only. Some of the frames might be hazardous to your phone. Be careful!!! We do not take any responsibility or liability for damages, etc. NOTE: this information isn't (and can't be) complete. If you know anything about features not listed here or you noticed a bug in this list, please notify us via e-mail. Thank you. Document describing frames used in GSM/PCN Nokia 6110 and derivatives (Nokia 6130, 6150, 6190, 5110, 5130, 5150, 5190, 3210, 3310) Correct format is FBUS version 2/Direct IRDA/MBUS version 2 (see nokia.txt for protocol details): List: 0x00: Monitoring values r monitoring value {+0x01, 0x01, block... } where block: 0x5e, 0x05, 0x7a(?), 0xd0(?), 0x85(?), 0x02, percentHI, percentLO Battery percent level 0x5e, 0x0c, 0x52(?), 0x4b(?), 0x6f(?), 0x02, voltageHI, voltageLO Battery standby voltage ............ 0x01: Call Information s Make call { 0x0001, "number", type, block } where type: 0x01 - data call 0x05 - voice call block: data call (non digital lines): 0x02,0x01,0x05,0x81,0x01,0x00,0x00,0x01,0x02,0x0a, 0x07,0xa2,0x88,0x81,0x21,0x15,0x63,0xa8,0x00,0x00 data call (digital lines): 0x02,0x01,0x05,0x81,0x01,0x00,0x00,0x01,0x02,0x0a, 0x07,0xa1,0x88,0x89,0x21,0x15,0x63,0xa0,0x00,0x06, 0x88,0x90,0x21,0x48,0x40,0xbb voice call: 0x01, 0x01, 0x05, 0x81/0x00, sendnum, 0x00, 0x00, 0x01 where: sendnum (own number sending): 0x01: preset (depends on network) 0x03: on 0x02: off r Call going msg { 0x0002 } r Call in progress { 0x0003, seqnr } r Remote end hang up { 0x0004, seqnr, ?, error (like in netmon in 39) } r incoming call alert { 0x0005, seqnr, numlen, "number", namelen, "name" } s Answer call part 2 { 0x0006, seqnr, 0x00 } r answered call { 0x0007, seqnr } s Hang up { 0x0008, seqnr, 0x85 } r terminated call { 0x0009, seqnr } r call msg { 0x000a, seqnr } r Send DTMF/voice call { 0x0040} s Answer call part 1 { 0x0042,0x05,0x01,0x07,0xa2,0x88,0x81,0x21,0x15,0x6 3,0xa8,0x00,0x00, 0x07,0xa3,0xb8,0x81,0x20,0x15,0x63,0x80 } s Sent after issuing { 0x0042,0x05,0x81,0x07,0xa1,0x88,0x89,0x21,0x15,0x6 3,0xa0,0x00,0x06, data call 0x88,0x90,0x21,0x48,0x40,0xbb,0x07,0xa3, (digital lines) 0xb8,0x81,0x20,0x15,0x63,0x80 } s Sent after issuing { 0x0042,0x05,0x01,0x07,0xa2,0xc8,0x81,0x21,0x15,0x6 3,0xa8,0x00,0x00, data call 0x07,0xa3,0xb8,0x81,0x20,0x15,0x63,0x80, (non digital lines) 0x01,0x60 } s Send DTMF { 0x0050, length, {ascii codes for DTMF}, 0x01 } Note: to make data call (non digital lines): 1.send "Make call" for non digital lines 2.send "Sent after issuing data call (non digital lines)" to make data call (digital lines): 1.send "Answer call part 1" 2.send "Sent after issuing data call (digital lines)" 3.send "Make call" for digital lines to answer call: 1.send "Answer call part 1" 2.send "Answer call part 2" 0x02: SMS handling s Send SMS message { 0x0001, 0x02, 0x00 (SEND REQUEST), ... } r Message sent { 0x0002 } r Send failed { 0x0003, ?, ?, error (like in netmon in 65)} s Get SMS message { 0x0007, 0x02, location, 0x01, 0x64 } s Initiate connection { 0x000d, 0x00, 0x00, 0x02 } r Initiate ACK { 0x000e, 0x01 } r SMS message received { 0x0010, ...... } (whole message) s Set CellBroadcast { 0x0020, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01 } for enable cell broadcast ? 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } for disable cell broadcast ? r Set CellBroadcast OK { 0x0021, 0x01 } r Read CellBroadcast { 0x0023, ?, ?, ?, channel, ?, message... } ? s Set SMS center { 0x0030, 0x64, priority, checksum? ,0?, format, validity, {DefaultRecipient no.}[12], {SMScenter no.}[12], {SMSC name}, 0x00} where tel.no.[12]: {len, type, {number(BCD)}} type: 0x81: normal 0x91: + (international) 0xd0: alphanumeric format: 0x00: text 0x22: fax 0x24: voice 0x25: ERMES 0x26: paging 0x31: X.400 0x32: email validity: 0x0b: 1 hour 0x47: 6 hours 0xa7: 24 hours 0xa9: 72 hours 0xad: 1 week 0xff: max.time r Set SMS center OK { 0x0031 } r Set SMS center error { 0x0032, reason } s Get SMS center { 0x0033, 0x64, priority } r SMS center received { 0x0034, priority, checksum?, format, 0x00?, validity, {DefaultRecipient no.}[12], {SMScenter no.}[12], {SMSC name}, 0x00} tel.no[12]: {len, type, {number(BCD)}} where priority, checksum, type, validity, tel.no.[12]: see 0x02/0x0030 r SMS center error recv { 0x0035, reason } 0x03: Phonebook functions s Get mem location { 0x0001, memtype, location, 0 } where memory: 0x01: telephone and SIM phonebook (in one) 0x02: telephone phonebook 0x03: SIM phonebook 0x04: SIM fixdialling-phonebook (?) 0x05: Own numbers 0x07: Dialled numbers 0x08: Missed calls 0x09: Received calls 0x0b: voice mailbox (location not important) r mem location recvd { 0x0002, 0x00,namelen,"name",numlen,"number",groupID, 0x01?, yearLO, yearHI, month, day, hour, minute, sec. } Note: in 3310 all entries have null name ("feature" of bug ?) r mem loc error recvd { 0x0003, errtype } where errtype: 0x7d: invalid memory type s Set mem location { 0x0004, memtype,location,namelen,"Name",numlen,"number",gr oupID } r mem set OK { 0x0005 } r mem set error { 0x0006, errtype } where errtype: 0x7d: name is too long s Mem status request { 0x0007, memtype } r Mem status recvd { 0x0008, memtype, free, used } r Mem status error recv { 0x0009, errtype } where errtype: 0x6f: mem status error 0x7d: invalid memory type 0x8d: waiting for pin s Get caller group data { 0x0010, groupID } r Get caller group data { 0x0011, groupID, size, "Name", ringtoneID, graphic_on?1:0, lenHI, lenLO, OTABitmap (72x14 logo) } r Get call.group error { 0x0012, reason } where reason: 0x7d: invalid location s Set caller group data { 0x0013, groupID, size, "Name", ringtoneID, graphic_on?1:0, lenHI, lenLO, OTABitmap (72x14 logo) } r Set caller group OK { 0x0014 } r Set call.group error { 0x0015, reason } where reason: 0x7d: invalid location s Get speed dial { 0x0016, index(1-9) } r Get speed dial OK { 0x0017, mem.type, location } where mem.type: 0x02: ME (== 0 if not stored) 0x03: SIM location: memory location (== 0 if not stored) r Get speed dial error { 0x0018 } s Set speed dial { 0x0019, index(1-9), mem.type, location } r Set speed dial OK { 0x001a } r Set speed dial error { 0x001b } 0x04: Phone Status s Phone status { 0x0001 } r Phone status { 0x0002, mode, signal str, ???, pwr, batt.level } where mode: 1: registered within the network 2: call in progress 3: waiting for pin 4: powered off pwr: 1: AC/DC 2: battery s Request Phone ID { 0x0003 } r RequestPhone ID { 0x0004, 0x01, "imei", 0, "model", 0, "prod.code", 0, "HW", 0, "firmware", 0x00, 0x01 } 0x05: Profile settings s Set profile feature { 0x0010, 1, nr, feature, a, 1 } where nr: see 0x05/0x0013 feature: see 0x05/0x0014 a: see 0x05/0x0014 r Set profile feat. OK { 0x0011, 1 } s Get profile feature { 0x0013, 1, nr, feature, 1 } where nr is profile number (general=0, silent, meeting, outdoor, pager, car, headset=6) feature: see 0x05/0x0014 r Get profile feature { 0x0014, 1, nr, feature, 4, a, b, c, d, 1 } Features and answers (in a, b, c, d form): 0x00: keypad notes (in Nokia 3310 feature 0x00) xx, 1, 0, 2 xx: 0xff: off 0x00: level 1 0x01: level 2 0x02: level 3 0x01: lights (? only in car profile) (what number in Nokia 3310 ?) xx, 0, 0, 1 xx: 0x00: off 0x??: on (maybe 0x01) 0x02: incoming call alert (in Nokia 3310 feature 0x01) xx, 1, 0, 7 xx: 1: ringing, 2: beep once, 3: unknown 4: off 5: ring once 6: ascending 7: caller groups (see feature #0x08) 0x03: ringing tone (in Nokia 3310 feature 0x02) xx, 0, 0, 0 xx: 0x12: ring ring 0x13: low etc 0x04: ringing volume (in Nokia 3310 feature 0x03) xx, 0, 0, 0 xx: level 1 (0x06) - level 5 (0x0a) 0x05: message alert tone (in Nokia 3310 feature 0x04) xx, 1, 0, 4 xx: 0: no tone 1: standard 2: special 3: beep once 4: ascending 0x06: vibration (in Nokia 3310 feature 0x05) xx: 0: off 1: on 0x07: warning and game tones (in Nokia 3310 feature 0x06 called warning tones) xx, 4, 0, 4 xx: 0xff: off 0x04: on 0x07: screen saver - Nokia 3310 xx: 1: on 0: off 0x08: incoming caller groups (what number in Nokia 3310 ?) xx, 0, 0, 0 xx: 1: family 2: VIP 4: friends 8: collegues 16: other 0x09: automatic answer (what number in Nokia 3310 ?) xx, 0, 0, 1 xx: 0x00: off 0x01: on s Get welcome message { 0x0016 } r Get welcome message { 0x0017, no.of blocks, { block } * } where block: { id, {blockspecific} } id: 1: startup logo { y, x, picture (coding?) } 2: welcome note { len, "message" } 3: operator msg { len, "message" } s Set welcome message { 0x0018, no.of blocks, { block } * } where block: see 0x05/0x0017 r Set welcome OK { 0x0019, 0x01 } s Get profile name { 0x001a, nr } where nr: see 0x05/0x0013 r Profile name { 0x001b, 1, 1, 3, flen, nr, len, {text} } where nr: see 0x05/0x0013 len: text length flen len + len(nr, len) = len + 2 Note: in Nokia 3310 name is in Unicode s ??? { 0x001c } r ??? { 0x001d, 0x93 } s Set oplogo { 0x0030, location, MCC1, MCC2, MNC, lenhi=0x00, lenlo=0x82, OTABitmap } r Set oplogo OK { 0x0031 } r Set oplogo error { 0x0032, reason } where reason: 0x7d invalid location s Get oplogo { 0x0033, location } where location: 1 (doesn't seem to matter) r Get oplogo { 0x0034, location, MCC1, MCC2, MNC, lenhi=0x00, lenlo=0x82, OTABitmap } r Get oplogo error { 0x0035, reason } where reason: 0x7d invalid location s Set ringtone { 0x0036, location,0x00,0x78, ringtone packed according to SM2.0} r Set ringtone OK { 0x0037 } r Set ringtone error { 0x0038, reason } where reason=0x7d, when not supported location s Get services settings { 0x0080, setting (2 bytes) } where: setting: 0x02,0x00=Nokia access number 1 0x02,0x01=Operator access number 1 0x01,0x00=Personal bookmark 1 settings (name only ?) 0x01,0x01=? 0x02,0x02=? r Get services sett.OK { 0x0081, .... } r Get services sett.err { 0x0082, 0x7b } 0x06: Calling line restriction/Call forwarding etc s Set call divert { 0x0001, 0x03, 0x00, divtype, calltype, 0x01, number(packed like in SMS), 0x00, 0x00...,timeout} NOTE: msglen=0x37 where timeout: 0x00: not set ? 0x05: 5 second 0x0a: 10 second 0x0f: 15 second 0x1e: 20 second 0x14: 25 second 0x19: 30 second where divtype: 0x02: all diverts for all call types ? Found only, when deactivate all diverts for all call types (with call type 0x00) 0x15: all calls 0x43: when busy 0x3d: when not answered 0x3e: if not reached calltype: 0x00: all calls (data, voice, fax) 0x0b: voice calls 0x0d: fax calla 0x19: data calls s Deactivate calldiverts{ 0x0001, 0x04, 0x00, divtype, calltype, 0x00 } where divtype, calltype: see above s Get call diverts { 0x0001, 0x05, 0x00, divtype, calltype, 0x00 } where divtype, calltype: see above r Get prepaid(?) info { 0x0005, ?,?,?,length,message(packed like in 7bit SMS)} 0x07: s ??? { 0x0022, ? (1&2 sounds OK) } r ??? OK { 0x0023, ?,?,? } r ??? error { 0x0024, reason } s ??? { 0x0025, ??? } r ??? OK { 0x0026, ??? } r ??? error { 0x0027, reason } 0x08: Security codes s Change code { 0x0004, code, "current", 0x00, "new", 0x00 } where code: 1: security code (5 chars) 2: PIN (4 chars) 3: PIN2 (4 chars) 4: PUK (8 chars) 5: PUK2 (8 chars) s Status request { 0x0007, 0x01 } r pin recvd { 0x0008, accepted } where accepted: 0x0c (or 0x06): OK code: waiting for (0x08/0x0004) code s entering code { 0x000a, code, "code", 0x00 } where code: see 0x08/0x0004 0x09: SIM login r login { 0x0080 } r logout { 0x0081 } 0x0a: Network status s Key duplication on/off{ 0x0044, on? 0x01: 0x02 } s get used network { 0x0070 } r network registration { 0x0071, ?,?,?,length,netstatus,netsel,cellIDH,cellIDL,lacH ,lacL,netcode,netcode,netcode } 0x0c: Keys s Get key assignments { 0x0040, 0x01 } r Get key assignments { 0x0041, {key '1'}, 0x00, {key '2'} ... {key '0'}, 0,0,0, {symbols}, 0 } where {key '0'} => ' ', '0' s Press key { 0x0042, press: 0x01; release: 0x02, button, 0x01 } where button: 0x01 - 0x09: 1-9 0x0a: 0 0x0b: # 0x0c: * 0x0d: Power 0x0e: Pick up phone 0x0f: Hang 0x10: Volume + 0x11: Volume - 0x17: Up 0x18: Down 0x19: Menu 0x1a: Names 0x1B onwards: don't know but they do produce a beep and light up the keypad as if a key had been pressed. r Press key ack { 0x0043, press/release/error(0x05) } s ??? { 0x0044 } r ??? ack { 0x0045, 0x01 } 0x0d: Status r Display { 0x0050, 0x01, y, x, len, "string"(unicode) } s Status request { 0x0051 } r Status { 0x0052, no. of byte pairs, {byte pair} } where {byte pair}: {cmd, 1 ff 2 n} cmd: 1: call in progress 2: ??? 3: have unread sms 4: voice call active 5: fax call active 6: data call active 7: key lock active 8: is SMS storage full s Display status { 0x0053, 1 n 2 ff } (will send displayed messages with x,y coordinates) r Display status ack { 0x0054, 1 } 0x11: Phone clock & alarm s set date and time { 0x0060, 1,1,7,yearh,yearl,month,mday,hour,min,0x00 } r date and time set { 0x0061 } s get date and time { 0x0062 } r date and time recvd { 0x0063,date_set?,time_set?,?,?,yearh,yearl,month,m day,hour,min,second } where: date_set & time_set==0x01 - set 0x00 - not set, ?,?,yearh,yearl,month,mday,hour,min,second not available in frame s set alarm { 0x006b, 1,32,3,0x02(on-off),hour,min,0x00 } r alarm set { 0x006c } s get alarm { 0x006d } r alarm received { 0x006e,?,?,?,?,alrm(==2 n),hour,min } 0x12: Connect to NBS port (61xx only ?) s Send {+0x0c, 0x01, UDH header, data} (without 0,1 header -- for oplogo, cli, ringtone etc upload) where: UDH header = 0x06, 0x05, 0x04,destporth,destportl,srcporth,srcportl Seems not to work in MBUS! 0x13: Calendar notes s Write calendar note { 0x0064, 0x01, 0x10, length, type, yearH, yearL, month, day, hour, timezone, alarm?(alarm yearH, yearL, month, day, hour, timezone): (0,0,0,0,0,0), textlen, "text" } r Write cal.note report { 0x0065, return } where return: 0x01: ok 0x73: failure 0x81: calendar functions busy. Exit Calendar menu and try again s Calendar notes set { 0x0066... } r Calendar note recvd { 0x0067, 0x01, ?, length, type, yrH,yrL,mon,day,hr,tz,alrm yrH,yrL,mon,day,hr,tz,textlen, "text" } r Cal.note recvd error { 0x0067, err } where err: 0x93: not available (0x01: OK) other: error s Delete cal.note { 0x0068, location } r Del. cal.note report { 0x0069, err } where err: 0x01: OK 0x93: cannot delete 0x14: SMS funcs s Write SMS to SIM { 0x0004, .... } s Mark SMS as read { 0x0007, 0x02, location, 0x00, 0x64 } r SMS message frame rcv { 0x0008,subtype,?,num,?,BCD(smscenter)...} 20->type, 22->status where type: 0x06: delivery report status: 0x00: delivered 0x30: pending 0x46: failed 0x09: reading failed subtype: 0x02: invalid mem type 0x07: empty SMS location 0x0c: no access to memory (no PIN in card, etc.) s Delete SMS message { 0x000a, 0x02, location } r Delete OK { 0x000b } s SMS status request { 0x0036, 0x64 } r SMS status { 0x0037,?,?,?,?,?,?,msgnumber,unread } r SMS status error { 0x0038 } 0x40: Security commands s ??? {+0x00, 0x00, 0x07, 0x11, 0x00, 0x10, 0x00, 0x00} This frame hangs phone (N3310 4.02). Meaning unknown ! s Open simlock 1 { 0x02, 0x03, 0x1f, 0x11, 0x01, 0x01, 0x10, 0x00} r Open simlock 1 { 0x02 } s ???(N6150) { 0x08, 0x00 } r ???(N6150) { 0x08 } s Enable extended cmds { 0x64, cmd } where cmd: 0x00: off 0x01: on 0x02: enter service mode ? 0x03: reset (doesn't ask for PIN again) 0x04: reset (PIN is requested) In 5110 makes reset without PIN 0x06: CONTACT SERVICE!!! Don't try it! s Reset phone settings { 0x65, value, 0x00 } where value: 0x08 - reset UI (User Interface) settings 0x38 - reset UI, SCM and call counters r Reset phone settings { 0x65, 0x00 } s Get IMEI { 0x66 } r Get IMEI { 0x66, 0x01, IMEI, 0x00} s (ACD Readings)?(N6150 { 0x68 } r (ACD Readings)?(N6150 { 0x68, ... } s Get Product Profile Settings { 0x6a} r Get Product Profile Settings { 0x6a, 4bytes with Product Profile Settings } s Set Product Profile Settings { 0x6b, 4bytes with Product Profile Settings } r Set Product Profile Settings OK ? { 0x6b } s Get code { 0x6e, code } where code: see 0x08/0x0004 (only sec.code is allowed) r Get code { 0x6e, code, allowed, allowed? (sec code (text)) } where code: see 0x08/0x0004 allowed: 0: no 1: yes s Set code { 0x6f, code, sec code(text), 0x00 } where code: see 0x08/0x0004 s Start monitoring { 0x70, block } where block(N6150): 0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff, 0xff,0xff,0xff,0xff,0xff,0xf9,0x76,0x65,0x20,0x00, 0x00,0x00,0x00,0x00,0x18,0x26,0x15,0x7d,0x0a,0x00, 0xf5,0x82,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff, 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xf0,0x77,0x80, 0x77,0x80,0xf2,0x82,0x20,0x20,0x20,0x20,0x20,0x20, 0x20,0x20,0x20,0x20 This block enables probably all possible monitorred parameters. After it phone sends 0x00 message type values s Break monitoring { 0x71 } r Break monitoring { 0x71 } s Reset Permanent Counters (nm->test36) { 0x74, 0x01, 0x01, 0x0e } r Reset Permanent Counters (nm->test36) { 0x74 } s Call commands { 0x7c, block } where where: command, (values) command: 0x01 values: number(ASCII), 0x00 - makes voice call command: 0x02 - answer call command: 0x03 - release call r Call commands { 0x7c, command } s Netmonitor { 0x7e, field } where: field: 00: next F0: reset F1: off F2: field test menus F3: developer menus s Open simlock 2 { 0x81, 0x01, locknumber, 0x10, 0x10, 0x10, 0x10, 0x10 } Note: sets simlock type to factory? where locknumber: 1,2,4,8 s Open simlock 2 { 0x81, 0x01, locknumber } where locknumber: 1,2,4,8 s Close simlock { 0x82, 0x01, locknumber, 0x00, 0x00, locksinfo(lock1,4,2,3), 0x00 } where locknumber: 1,2,4,8 r Close simlock { 0x82, the rest like in 0x40/0x8a } s Get simlock info { 0x8a, 0x00} r Get simlock info { 0x8a, 0x00, 0x01, lockstype, locksclosed, 0x00, 0x00, locksinfo(lock1,4,2,3), counter1,counter2,counter4,counter4,0x00 } where: lockstype: bit1,bit2,bit3,bit4 - if set, selected lock is user lock locksclosed: bit1,bit2,bit3,bit4 - if set, selected lock is closed counter1 - counter4: counters for locks s Set downloaded OpName { 0x8b, 0x00, MCC1, MCC2, MNC, Name, 0x00 } r SetdownloadedOpNameOK?{ 0x8b, 0x00, 0x01 } s Get downloaded OpName { 0x8c, 0x00 } r Get downloaded OpName { 0x8c, 0x00, 0x01, MCC1, MCC2, MNC, Name, 0x00,...} s Buzzer pitch { 0x8f, volume, hzLO, hzHI } if volume and hz is 0, it's off r Buzzer pitch { 0x8f} s ACD Readings ? { 0x91, parameter?(0x02,0x03,0x04,0x05,0x07) } r ACD Readings ? { 0x91, parameter?, value? } s ???(N6150) { 0x98, 0x00 } r ???(N6150) { 0x98, 0x00, 0x04 } s Get bin ringtone { 0x9e, location } where: location=0,1,etc. r Get bin ringtone { 0x9e, location, error, contents... } where location=0,1,etc. error=0x0a, ringtone NOT available 0x00, OK NOTE: N3310 seems to have different format of frame here or this is firmware bug s Set bin ringtone { 0xa0, location, 0x00, contenst... } where: location=0,1,etc. r Set bin ringtone { 0xa0, location, error } where location=0,1,etc. error=0x0a, ringtone NOT set 0x00, ringtone set OK NOTE: N3310 seems to have different format of frame here or this is firmware bug r Get MSid { 0xb5, 0x01, 0x2f, msid, 0x25 } s Get info about phone { 0xc8, 0x01 } r Get info about phone { 0xc8, 0x01, 0x00, "V ", "firmware", 0x0a, "firmware date", 0x0a, "model", 0x0a, "(c) NMP.", 0x00 } s Get MCU SW Checksum { 0xc8, 0x02 } r Get MCU SW Checksum { 0xc8, 0x02, 0x00, checksum (4 bytes),0x00 } s DPS External SW { 0xc7, 0x03 } r DSP External SW { 0xc7, 0x03, 0x00, string,0x00 } s Get HW { 0xc8, 0x05 } r Get HW { 0xc8, 0x05, 0x00, HW version (4 bytes), 0x00 } s Get "Made" Date { 0xc8, 0x05 } r Get "Made" Date { 0xc8, 0x05, 0x00, date(4 bytes), 0x00 } s Get DSP Internal SW { 0xc8, 0x09 } r Get DSP Internal SW { 0xc8, 0x09, 0x00, version (1 bytes), 0x00 } s Get PCI version { 0xc8, 0x0b } r Get PCI version { 0xc8, 0x0b, 0x00, version, 0x00 } s Get system ASIC { 0xc8, 0x0c } r Get system ASIC { 0xc8, 0x0c, 0x00, string, 0x00 } s Get COBBA { 0xc8, 0x0d } r Get COBBA { 0xc8, 0x0d, 0x00, string, 0x00 } s Get PLUSSA { 0xc8, 0x0e } r Get PLUSSA { 0xc8, 0x0e, available, 0x00 } where available: 0x01: not available s Get CCONT { 0xc8, 0x0f } r Get CCONT { 0xc8, 0x0f, available, 0x00 } where available: 0x01: not available s Get PPM version { 0xc8, 0x10 } r Get PPM version { 0xc8, 0x10, 0x00, "V ", "firmware", 0x0a, "firmware date", 0x0a, "model", 0x0a, "(c) NMP.", 0x00 } s Get PPM info { 0xc8, 0x12 } r Get PPM info { 0xc8, 0x12, 0x00, PPM version ("B", "C", etc.), 0x00 } s Set HW version { 0xc9, 0x05, version, 0x00 } s Get Product Code { 0xca, 0x01 } r Get Product Code { 0xca, 0x01, 0x00, number, 0x00 } s Get Order Number { 0xca, 0x02 } r Get Order Number { 0xca, 0x02, 0x00, string, 0x00 } s Get Prod.Ser.Number { 0xca, 0x03 } r Get Prod.Ser.Number { 0xca, 0x03, 0x00, number, 0x00 } s Get Basic Prod.Code { 0xca, 0x04 } r Get Basic Prod.Code { 0xca, 0x04, 0x00, number, 0x00 } s Set Product Code { 0xcb, 0x01, product code, 0x00 } s Set Order Number { 0xcb, 0x02, number, 0x00 } s Set Prod.Ser.Number { 0xcb, 0x03, number, 0x00 } s Get (original ?)IMEI { 0xcc, 0x01 } r Get (original ?)IMEI { 0xcc, 0x01, IMEI, 0x00 } s Get Manufacture Month { 0xcc, 0x02 } r Get Manufacture Month { 0xcc, 0x02, 0x00, string, 0x00 } s Get Purchare date { 0xcc, 0x04 } r Get Purchare date { 0xcc, 0x04, 0x00, string, 0x00 } s Set "Made" date { 0xcd, 0x02, string, 0x00 } s Make "all" phone tests{ 0xce,0x1d,0xfe,0x23,0x00,0x00} s Make one phone test { 0xce,0x1d,num1,num2,num3,num4} Where num1-num4: 0x02,0x00,0x00,0x00; 0x04,0x00,0x00,0x00; 0x08,0x00,0x00,0x00; 0x10,0x00,0x00,0x00; 0x20,0x00,0x00,0x00; 0x40,0x00,0x00,0x00; 0x80,0x00,0x00,0x00; 0x00,0x01,0x00,0x00; 0x00,0x02,0x00,0x00; 0x00,0x04,0x00,0x00; - "Power off" No test for "Security data" 0x00,0x10,0x00,0x00; 0x00,0x20,0x00,0x00; 0x00,0x40,0x00,0x00; 0x00,0x80,0x00,0x00; 0x00,0x00,0x01,0x00; .... 0x00,0x00,0x10,0x00; s Result of phone tests { 0xcf } r Result of phone tests { 0xcf, number of tests, results of next tests } s ??? { 0xd1 } r ???(N5110) { 0xd1, 0x00, 0x1d, 0x00, 0x01, 0x08, 0x00 } s LCD Test { 0xd3, value } where value: 0x03, 0x02 - 1'st test 0x03, 0x01 - 2'nd test 0x02, 0x03 - clears screen s ACD Readings(N6150)? { 0xd4, 0x02, 0x00, 0x02, 0x00, 0x0e, 0x01} r ACD Readings(N6150)? { 0xd4, 0x02, 0x00, 0x02, 0x00, 0x0e, 0x01, ?} s Get EEPROM { 0xd4, 0x02, 0x00, 0xa0, locationLo, locationHi, numofbytes } where: numofbytes - how many bytes to read Note: Works ONLY in MBUS r Get EEPROM { 0xd4, 0x02, 0x00, 0xa0, locationLo, locationHi, numofbytes, contest... } where numofbytes - how many bytes available contest - bytes with contests (if numofbytes != 0) 0x41: Snake game ? 0x47: s Get Picture Image { 0x0001, location } r Get Picture Image when contains sender number { 0x0002, location, number(like in SMS), 0x00, len, text, 0x00, width, height, 0x01, bitmap } NOTE: Supports only 0x81 and 0x91 coding (NOT alphanumeric numbers!) in sender without sender number { 0x0002, location, 0x00, 0x00, 0x00, len, text, 0x00, width, height, 0x01, bitmap } s Set Picture Image { 0x0003, frame...} where frame: see 0x47/0x0002 r Get/Set PictureImageOK{ 0x0004 } r Set Picture Image err { 0x0005, error? } where error=0x74 - wrong location ? 0x64: s Phone ID request { 0x0010 } r Phone ID recvd { 0x0011, "NOKIA", "imei", 0, "model", 0, "prod.code", 0, "HW", 0, "firmware", magic bytes x 4 ... } s Accessory connection { 0x0012, 16x0x00, 'NOKIA&NOKIA accessory', 3x0x00 } (45 bytes) 0x7f: Acknowledge(FBUS/IRDA){+type, seq } Acknowledge(MBUS)... 0xd0: s Power on message seq1 {+04 } r Power on message seq1 {+05 } 0xd1: s Get HW&SW version { 0x0003, 0x00 } 0xd2: r Get HW&SW version { 0x0003 "V " "firmware\n" "firmware date\n" "model\n" "(c) NMP." } 0xda: ? (during playing 2 player snake) 0xf0: s Send RLP frame {+0x00, 0xd9, ... } 0xf4: Power on message seq 2 |
Bookmarks |
| |
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
COBBA ID NOT FOUND | yui | Nokia Legacy Phones ( DCT-1 ,2 ,3 ,L ) | 0 | 02-16-2002 20:52 |
cobba id error ??? | jozep | Nokia Legacy Phones ( DCT-1 ,2 ,3 ,L ) | 3 | 02-02-2002 23:02 |
COBBA ID INFO.... | tees666za | Nokia Hardware & Hardware Repair | 0 | 10-13-2001 19:10 |
How to get Cobba ID via M-bus. READ ALL.!!!!!!!! | 43e08 | Nokia Legacy Phones ( DCT-1 ,2 ,3 ,L ) | 2 | 08-12-2001 00:44 |
Cobba ID | Cyberdog | Nokia Legacy Phones ( DCT-1 ,2 ,3 ,L ) | 3 | 04-27-2001 21:36 |
|