communication protocol for siemens - GSM-Forum

XenKo78 · 07-19-2002, 03:08

hello
to finish my project, i need is the communication protocol to read the Idphone in the siemens xxxx and IMEI

How can i proceed to write a *.map file into this phone (communication protocol ) ??

any help will be apprecied
thank you in advance!

Warlord711 · 07-24-2002, 21:07

Its send with BFB Commands i guess !

There is a bfb95eg.dll, look at it !

tuxhack · 07-24-2002, 23:04

BFB frames are
[ type ][ len ][ chk ][ payload ]

where chk is xor and types are

0x02 - single bytes used for connecting (and data reading?)
0x01 - crc'ed sequence to change interface (speed)
0x05 - unkown (send key-codes?)
0x06 - AT-Command
0x09 - unkown (return code from mobile?)
0x0E - unkown (return code from mobile?)
0x14 - EEPROM block manipulation
0x16 - crc'ed generic data (like OBEX)

payload is mostly
[ subtype ][ data... ][ chk ]

where chk is xor again.

Perhaps someone can fill in the gaps or point to some more info.

TheSig · 07-29-2002, 21:15

Quote:

Originally posted by tuxhack
BFB frames are
[ type ][ len ][ chk ][ payload ]

where chk is xor and types are

0x02 - single bytes used for connecting (and data reading?)
0x01 - crc'ed sequence to change interface (speed)
0x05 - unkown (send key-codes?)
0x06 - AT-Command
0x09 - unkown (return code from mobile?)
0x0E - unkown (return code from mobile?)
0x14 - EEPROM block manipulation
0x16 - crc'ed generic data (like OBEX)

payload is mostly
[ subtype ][ data... ][ chk ]

where chk is xor again.

Perhaps someone can fill in the gaps or point to some more info.

If You detailed see bfb95eg.dll then see when:
0x05 - BFB command

I starting wrote disassembled bfb95eg.dll functions with my comments in Forum
But in russian language (but aniway asm listing in english) - if more peoples is intresting to help me in this not easy process - i try to wrote in both (russian and english) languages.

tuxhack · 07-30-2002, 01:42

Hi TheSig,

Your work is great. I appreciate browsing your site.
Please try to write some key notes in english.

Warlord711 · 07-30-2002, 04:58

It is possible to access the phone memory directly with the bfb95eg.dll ?

I saw some commands like WPokeMemByte !

But i dont know how !

TheSig · 07-30-2002, 13:50

Quote:

Originally posted by Warlord711
It is possible to access the phone memory directly with the bfb95eg.dll ?

I saw some commands like WPokeMemByte !

But i dont know how !

1. Need non original cable like this
2. Open port with bfb95eg.ddl function "WComOpen"
3. Configure library with function "WConfigLibrary(2)"
4. Go to service mode with fuction "WInitServiceMode" (mobile before this is switched off) when starting this function press power on button on mobile (library is send to mobile boot block)
5. Now You allow to start functions like "WPeekMemory" etc...
----------------
Any questions?

Warlord711 · 07-30-2002, 15:19

That doesnt work !

I want to access the flash mem with bfb95eg.dll !

Is that possible ?

I can do things like Read+Write to EEBlocks or delete+erase them, but i want to access flash memory !

TheSig · 07-30-2002, 15:51

replace "WInitServiceMode" with"WInitBurnInMode" function in point 4

Warlord711 · 07-30-2002, 17:08

You ever tested Burn-In Mode ?

Phone makes noise, thats all !
I cant access memory !

TheSig · 07-30-2002, 19:30

Try "WAWriteFlashBlock"

Warlord711 · 07-30-2002, 20:28

You ever managed to access Flash mem with bfb95eg.dll ?

Warlord711 · 07-30-2002, 20:35

I need to read flash mem, too !
Do you know how much parameters to give to Calls like WAWriteFlashBlock ?

TheSig · 07-30-2002, 20:55

DELPHI syntax:
Function WAWriteFlashBlock(MHandle : TMHandle; Addr : Dword; DataLen : Dword; Data : PChar) : Dword;

Where:
TMHandle is Integer;
Addr is Addres to write
DataLen is a length of block which You want to write
Data is Data block

Note:
Max len of data block is 25 (0x19)

P.S. I not tested this function but i analyse dissasembled code for thois function and give a 99% of correct syntax

Warlord711 · 07-30-2002, 20:59

But i guess you need to put phone in a special "mode" not Service nor Burn-In Test mode !

07-19-2002, 03:08	#1 (permalink)
XenKo78 No Life Poster Join Date: Mar 2002 Location: Guadeloupe Age: 50 Posts: 531 Member: 9955 Status: Offline Thanks Meter: 7	communication protocol for siemens hello to finish my project, i need is the communication protocol to read the Idphone in the siemens xxxx and IMEI How can i proceed to write a *.map file into this phone (communication protocol ) ?? any help will be apprecied thank you in advance!

07-24-2002, 23:04	#3 (permalink)
tuxhack Junior Member Join Date: Jul 2002 Location: Germany Posts: 4 Member: 14041 Status: Offline Thanks Meter: 0	BFB BFB frames are [ type ][ len ][ chk ][ payload ] where chk is xor and types are 0x02 - single bytes used for connecting (and data reading?) 0x01 - crc'ed sequence to change interface (speed) 0x05 - unkown (send key-codes?) 0x06 - AT-Command 0x09 - unkown (return code from mobile?) 0x0E - unkown (return code from mobile?) 0x14 - EEPROM block manipulation 0x16 - crc'ed generic data (like OBEX) payload is mostly [ subtype ][ data... ][ chk ] where chk is xor again. Perhaps someone can fill in the gaps or point to some more info.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Communication cable for Siemens - strange problem. Attention !	roller	x1x to x45/x50	4	11-06-2001 10:03
I need protocols for sending/receiving SMS and data with NOKIA 5110 over a serial cab	SashaM	Nokia Legacy Phones ( DCT-1 ,2 ,3 ,L )	0	02-18-2001 17:33
Need Nokia Communication Protocol...	nightxyz	Nokia Legacy Phones ( DCT-1 ,2 ,3 ,L )	0	11-02-2000 05:12
Communication protocol Txx	dre4u	Old Ericsson Phones & Sony Phones	0	07-26-2000 07:22
Communication protocol	wmc	Nokia Legacy Phones ( DCT-1 ,2 ,3 ,L )	0	08-29-1999 14:58

07-24-2002, 21:07	#2 (permalink)
Warlord711 Junior Member Join Date: May 2002 Posts: 24 Member: 11818 Status: Offline Thanks Meter: 0	Its send with BFB Commands i guess ! There is a bfb95eg.dll, look at it !

07-30-2002, 01:42	#5 (permalink)
tuxhack Junior Member Join Date: Jul 2002 Location: Germany Posts: 4 Member: 14041 Status: Offline Thanks Meter: 0	Hi TheSig, Your work is great. I appreciate browsing your site. Please try to write some key notes in english.

07-30-2002, 04:58	#6 (permalink)
Warlord711 Junior Member Join Date: May 2002 Posts: 24 Member: 11818 Status: Offline Thanks Meter: 0	It is possible to access the phone memory directly with the bfb95eg.dll ? I saw some commands like WPokeMemByte ! But i dont know how !

07-30-2002, 15:19	#8 (permalink)
Warlord711 Junior Member Join Date: May 2002 Posts: 24 Member: 11818 Status: Offline Thanks Meter: 0	That doesnt work ! I want to access the flash mem with bfb95eg.dll ! Is that possible ? I can do things like Read+Write to EEBlocks or delete+erase them, but i want to access flash memory !

07-30-2002, 15:51	#9 (permalink)
TheSig Junior Member Join Date: Jun 2002 Location: Latvia Age: 55 Posts: 28 Member: 13092 Status: Offline Thanks Meter: 0	replace "WInitServiceMode" with"WInitBurnInMode" function in point 4

07-30-2002, 17:08	#10 (permalink)
Warlord711 Junior Member Join Date: May 2002 Posts: 24 Member: 11818 Status: Offline Thanks Meter: 0	You ever tested Burn-In Mode ? Phone makes noise, thats all ! I cant access memory !

07-30-2002, 19:30	#11 (permalink)
TheSig Junior Member Join Date: Jun 2002 Location: Latvia Age: 55 Posts: 28 Member: 13092 Status: Offline Thanks Meter: 0	Try "WAWriteFlashBlock"

07-30-2002, 20:28	#12 (permalink)
Warlord711 Junior Member Join Date: May 2002 Posts: 24 Member: 11818 Status: Offline Thanks Meter: 0	You ever managed to access Flash mem with bfb95eg.dll ?

07-30-2002, 20:35	#13 (permalink)
Warlord711 Junior Member Join Date: May 2002 Posts: 24 Member: 11818 Status: Offline Thanks Meter: 0	I need to read flash mem, too ! Do you know how much parameters to give to Calls like WAWriteFlashBlock ?

07-30-2002, 20:55	#14 (permalink)
TheSig Junior Member Join Date: Jun 2002 Location: Latvia Age: 55 Posts: 28 Member: 13092 Status: Offline Thanks Meter: 0	DELPHI syntax: Function WAWriteFlashBlock(MHandle : TMHandle; Addr : Dword; DataLen : Dword; Data : PChar) : Dword; Where: TMHandle is Integer; Addr is Addres to write DataLen is a length of block which You want to write Data is Data block Note: Max len of data block is 25 (0x19) P.S. I not tested this function but i analyse dissasembled code for thois function and give a 99% of correct syntax

07-30-2002, 20:59	#15 (permalink)
Warlord711 Junior Member Join Date: May 2002 Posts: 24 Member: 11818 Status: Offline Thanks Meter: 0	But i guess you need to put phone in a special "mode" not Service nor Burn-In Test mode !