BFB protocol

[nrg]

Hi there all of you gsm hackers most of you have all knowlage to make free siemens flasher and many of you have exact specs of bfb protocol but I've never seen it free finally I found something about it on http://triq.net/obexftp.html but as I know it's not the whole protocol but a good starting place so if it's not useless just let me know

Here you have it:

================================================== ==============
BFB protocol
as used by Siemens Mobile Equipment (e.g. S45/ME45) over a
serial connection
================================================== ==============

Christian Zuckschwerdt <[email protected]> 2002-02-06


0. Disclaimer

It is possible to harm your mobile phone.
Use the information in this document at your own risk.


1. Preface

This document is a result of many hours of studying the
Siemens Mobile Equipment BFB protocol
by the author, in an attempt to implement a way to access
Flex.Mem. Like all tools, this document
was born out of frustration with the lack of documention
available on the subject.

Though every attempt has been made to ensure the correctness
of this document, the author cannot make any guarantees as
to its accuracy.


2. Transport encapsulation:

[ type ][ len ][ chk ][ payload ]

Types are
0x02 - single bytes used for connecting
0x01 - crc'ed sequence to change interface (speed)
0x06 - AT-Command
0x16 - crc'ed generic data

Len is from 1 to max 32 for a max MTU of 35 bytes.

Chk equals type xor len.


3. OBEX encapsulation (transport type = 0x16):

[ cmd ][ chk ] for cmd 0x01

[ cmd ][ chk ][ seq ][ len16 ][ data... ][ crc16 ] for cmd 0x02 and 0x03.

Chk is ~cmd (bitwise not cmd)

Cmd 0x01: "ack" command. If some packet isn't acknowledged it will be resend.
Cmd 0x02: first transmission in a row. Sequence counter is 0
Cmd 0x03: continued transmission. Sequence counter is incremented with each
subsequent packet

Seq is 1 byte. TA increments, ME replys.

Len is 2 bytes in network byte order.

Data is an OBEX frame.

Crc16 is 2 bytes CCITT-CRC16 in network byte order. Rendered over the the
whole packet except for cmd and chk.


4. Conclusion

This seems to cover all the bits.
My test-implementation works great -- YMMV.