I think the correct command description is in the GSM
standard TS 11.4. You can download the document for free
at
www.etsi.org. (For decoding the network management
results you will also need the GSM standard TS 04.08,
chapter 10.5.2.20. It is also at
www.etsi.org).
The request look like this:
Byte# Value (Hex) Description
1 D0 Proactive SIM command tag
2 09 length
3 81 command details tag
4 03 length
5 01 command number
6 26 Command: provide local info
7 00 '00' = Loc Info (MCC, MNC, LAC and Cell Id)
'01' = IMEI of the ME
'02' = Network Measurement results
'03' = Date, time and time zone
'04' = Language setting
'05' = Timing Advance
8 82 Device identities tag
9 02 length
10 81 source: 81=SIM,
1X = Add Card Reader X (0..7),
2Y = Channel Y (1..7)
11 82 destination: 82=ME, 02=Display, 03=Earpice
Example: (not sure, if the lenght in the "AT^SSTK=len,count" is
correct because my S45 seems to ignore this parameter :-)
Request Network, LAI and Cell ID:
AT^SSTK=22,0
> D009810301260082028182 [Ctrl-Z]
AT^SSTK
810301260082028281830100930762F210081C0005
1 81 command details tag
4 03 length
5 01 command number
6 26 Command: provide local info
7 00 '00' = Loc Info (MCC, MNC, LAC, Cell Id)
8 82 Device identities tag
9 02 length
10 82 source = ME
11 81 dest = SIM
12 83 result tag
13 01 length
14 00 00 = success
15 93 Locinfo Tag
16 07 Length
17-19 62F210 MCC2|MCC1|1111|MCC3|NMC2|NMC1| -> 262 01
20-21 081C LAC (where I am? :-)
22-23 0005 Cell ID
Request IMEI:
AT^SSTK=22,0
> D009810301260182028182 [Ctrl-Z]
AT^SSTK
81030126018202828183010094083A057150xxxxxxxx
... everything the same ...
15 94 IMEI Tag
16 08 Length
17-24 3A057150xxxxxxxx IMEI
Request Network Measurement Info:
AT^SSTK=22,0
> D009810301260282028182 [Ctrl-Z]
AT^SSTK
81030126028202828183010096101A1A01564BC70DD282C928 6C93BC0000
9D0D088270A852154571645C184640
... everything the same ...
15 96 Network Measurement Results tag
16 10 Length
17-32 1A1A01564BC70DD282C9286C93BC0000 Results (see TS04.08)
33 9D BCCH channel list tag
34 0D Length
35-47 088270A852154571645C184640 BCCH channel list
Results (see TS04.08):
1| | A |1| | A |0| |1 | 5 | 6 |4 B| C | 7 0|
0|0|011010|0|0|011010|0|000|000|101|010110|01001|0 11110|001110|
D | D |2 8 | 2 | C 9| 2 | 8 |6 C |
00011|011101|001010|00001|011001|001001|01000|0110 11|
9 |3 B| C | 0 0| 0 | 0
001001|00111|011110|000000|00000|000000
1-Bit-BA-Used 0 0
1-Bit-DTX-Used 0 0
6-Bit-RXLEV-FULL-SERVING-CELL 011010 26
1-Bit-Spare 0 0
1-Bit-Measurement-Valid-Bit 0 0
6-Bit-RXLEV-SUB-SERVING-CELL 011010 26
1-Bit-Spare 0 0
3-Bit-RXQUAL-FULL-SERVING-CELL 000 0
3-Bit-RXQUAL-SUB-SERVING-CELL 000 0
3-Bit-NO-NCELL 101 5
6-Bit-RXLEV-NCELL 1 010110 21
5-Bit-BCCH-FREQ-NCELL 1 01001 9
6-Bit-BSIC-NCELL 1 011110 30
6-Bit-RXLEV-NCELL 2 001110 14
5-Bit-BCCH-FREQ-NCELL 2 00011 3
6-Bit-BSIC-NCELL 2 011101 29
6-Bit-RXLEV-NCELL 3 001010 10
5-Bit-BCCH-FREQ-NCELL 3 00001 1
6-Bit-BSIC-NCELL 3 011001 25
6-Bit-RXLEV-NCELL 4 001001 9
5-Bit-BCCH-FREQ-NCELL 4 01000 8
6-Bit-BSIC-NCELL 4 011011 27
6-Bit-RXLEV-NCELL 5 001001 9
5-Bit-BCCH-FREQ-NCELL 5 00111 7
6-Bit-BSIC-NCELL 5 011110 30
6-Bit-RXLEV-NCELL 6 000000 0
5-Bit-BCCH-FREQ-NCELL 6 00000 0
6-Bit-BSIC-NCELL 6 000000 0
BCCH channel list: 10Bit packed for every ARFCN:
0 8 8 | 2 7 |0 A 8 | 5 2 |1 5 4 | 5 7 |
0000100010|0000100111|0000101010|0001010010|000101 0101|0001010111|
1 6 4 | 5 C |1 8 4 | 6 4 |0
0001011001|0001011100|0001100001|0001100100|0000
0000100010 = 34 = ARFCN Absolut Radio Frequency Channel Number
0000100111 = 39
0000101010 = 42
0001010010 = 82
0001010101 = 85
0001010111 = 87
0001011001 = 89
0001011100 = 92
0001100001 = 97
0001100100 = 100
They are crazy!
best regards Mike