1Nokia 6110 2========== 3 4 5Assembled by 6Balazs Nagy <js@iksz.hu> 7Harri Yli-Torkko <hyt@surfeu.fi> 8Alfred R. Nurnberger <arnu@flosys.com> 9Hugh Blemings <Hugh.Blemings@vsb.com.au> 10Mike Bradley <mike@trumpington.st> 11Odinokov Serge <serge@takas.lt> 12Pavel Janik <Pavel@Janik.cz> 13BORBELY Zoltan <bozo@andrews.hu> 14Pawel Kot <pkot@linuxnews.pl> 15Marcin Wiacek <Marcin@MWiacek.com> 16Walek <walek@pa98.opole.sdi.tpnet.pl> 17... and other members of gnokii mailing list 18and authors of some WWW pages. 19 20The data provided is for information purposes only. 21Some of the frames might be hazardous to your phone. Be careful!!! 22We do not take any responsibility or liability for damages, etc. 23 24 25.. note:: 26 27 this information isn't (and can't be) complete. If you know anything 28 about features not listed here or you noticed a bug in this list, please 29 notify us via e-mail. Thank you. 30 31Document describing frames used in 32GSM/PCN Nokia 6110 and derivatives (Nokia 6130, 6150, 6190, 5110, 5130, 5150, 335190, 3210, 3310) 34 35Correct format is FBUS version 2/Direct IRDA/MBUS version 2 36(see nokia.txt for protocol details): 37 38List:: 39 40 0x00: Monitoring values 41 r monitoring value {+0x01, 0x01, block... } 42 where block: 0x5e, 0x05, 0x7a(?), 0xd0(?), 0x85(?), 0x02, percentHI, percentLO 43 Battery percent level 44 0x5e, 0x0c, 0x52(?), 0x4b(?), 0x6f(?), 0x02, voltageHI, voltageLO 45 Battery standby voltage 46 ... 47 0x01: Call Information 48 s Make call { 0x0001, "number", type, block } 49 where type: 50 0x01 - data call 51 0x05 - voice call 52 block: 53 data call (non digital lines): 54 0x02,0x01,0x05,0x81,0x01,0x00,0x00,0x01,0x02,0x0a, 55 0x07,0xa2,0x88,0x81,0x21,0x15,0x63,0xa8,0x00,0x00 56 data call (digital lines): 57 0x02,0x01,0x05,0x81,0x01,0x00,0x00,0x01,0x02,0x0a, 58 0x07,0xa1,0x88,0x89,0x21,0x15,0x63,0xa0,0x00,0x06, 59 0x88,0x90,0x21,0x48,0x40,0xbb 60 voice call: 61 0x01, 0x01, 0x05, 0x81/0x00, sendnum, 0x00, 0x00, 0x01 62 where: 63 sendnum (own number sending): 64 0x01: preset (depends on network) 65 0x03: on 66 0x02: off 67 r Call going msg { 0x0002 } 68 r Call in progress { 0x0003, seqnr } 69 r Remote end hang up { 0x0004, seqnr, ?, error (like in netmon in 39) } 70 r incoming call alert { 0x0005, seqnr, numlen, "number", namelen, "name" } 71 s Answer call part 2 { 0x0006, seqnr, 0x00 } 72 r answered call { 0x0007, seqnr } 73 s Hang up { 0x0008, seqnr, 0x85 } 74 r terminated call { 0x0009, seqnr } 75 r call msg { 0x000a, seqnr } 76 r call held { 0x0023, seqnr, 0x01 } 77 r call resumed { 0x0025, seqnr, 0x01 } 78 r Send DTMF/voice call { 0x0040} 79 s Answer call part 1 { 0x0042,0x05,0x01,0x07,0xa2,0x88,0x81,0x21,0x15,0x63,0xa8,0x00,0x00, 80 0x07,0xa3,0xb8,0x81,0x20,0x15,0x63,0x80 } 81 s Sent after issuing { 0x0042,0x05,0x81,0x07,0xa1,0x88,0x89,0x21,0x15,0x63,0xa0,0x00,0x06, 82 data call 0x88,0x90,0x21,0x48,0x40,0xbb,0x07,0xa3, 83 (digital lines) 0xb8,0x81,0x20,0x15,0x63,0x80 } 84 s Sent after issuing { 0x0042,0x05,0x01,0x07,0xa2,0xc8,0x81,0x21,0x15,0x63,0xa8,0x00,0x00, 85 data call 0x07,0xa3,0xb8,0x81,0x20,0x15,0x63,0x80, 86 (non digital lines) 0x01,0x60 } 87 s Send DTMF { 0x0050, length, {ascii codes for DTMF}, 0x01 } 88 89 Note: 90 to make data call (non digital lines): 91 1.send "Make call" for non digital lines 92 2.send "Sent after issuing data call (non digital lines)" 93 to make data call (digital lines): 94 1.send "Answer call part 1" 95 2.send "Sent after issuing data call (digital lines)" 96 3.send "Make call" for digital lines 97 to answer call: 98 1.send "Answer call part 1" 99 2.send "Answer call part 2" 100 101 0x02: SMS handling 102 s Send SMS message { 0x0001, 0x02, 0x00 (SEND REQUEST), ... } 103 r Message sent { 0x0002 } 104 r Send failed { 0x0003, ?, ?, error (like in netmon in 65)} 105 s Get SMS message { 0x0007, 0x02, location, 0x01, 0x64 } 106 s Initiate connection { 0x000d, 0x00, 0x00, 0x02 } 107 r Initiate ACK { 0x000e, 0x01 } 108 r SMS message received { 0x0010, ...... } (whole message) 109 s Set CellBroadcast { 0x0020, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01 } 110 for enable cell broadcast ? 111 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 } 112 for disable cell broadcast ? 113 r Set CellBroadcast OK { 0x0021, 0x01 } 114 r Read CellBroadcast { 0x0023, ?, ?, ?, channel, ?, message... } ? 115 s Set SMS center { 0x0030, 0x64, priority, checksum? ,0?, format, 116 validity, {DefaultRecipient no.}[12], 117 {SMScenter no.}[12], {SMSC name}, 0x00} 118 where tel.no.[12]: {len, type, {number(BCD)}} 119 type: 0x81: normal 120 0x91: + (international) 121 0xd0: alphanumeric 122 format: 0x00: text 123 0x22: fax 124 0x24: voice 125 0x25: ERMES 126 0x26: paging 127 0x31: X.400 128 0x32: email 129 validity: 0x0b: 1 hour 130 0x47: 6 hours 131 0xa7: 24 hours 132 0xa9: 72 hours 133 0xad: 1 week 134 0xff: max.time 135 r Set SMS center OK { 0x0031 } 136 r Set SMS center error { 0x0032, reason } 137 s Get SMS center { 0x0033, 0x64, priority } 138 r SMS center received { 0x0034, priority, checksum?, format, 0x00?, 139 validity, {DefaultRecipient no.}[12], 140 {SMScenter no.}[12], {SMSC name}, 0x00} 141 tel.no[12]: {len, type, {number(BCD)}} 142 where priority, checksum, type, validity, 143 tel.no.[12]: see 0x02/0x0030 144 r SMS center error recv { 0x0035, reason } 145 0x03: Phonebook functions 146 s Get mem location { 0x0001, memtype, location, 0 } 147 where memory: 148 0x01: telephone and SIM phonebook (in one) 149 0x02: telephone phonebook 150 0x03: SIM phonebook 151 0x04: SIM fixdialling-phonebook (?) 152 0x05: Own numbers 153 0x07: Dialled numbers 154 0x08: Missed calls 155 0x09: Received calls 156 0x0b: voice mailbox (location not important) 157 r mem location recvd { 0x0002, 0x00,namelen,"name",numlen,"number",groupID, 0x01?, yearLO, yearHI, month, day, hour, minute, sec. } 158 Note: in 3310 all entries have null name ("feature" of bug ?) 159 r mem loc error recvd { 0x0003, errtype } 160 where errtype: 161 0x7d: invalid memory type 162 0x74: empty location ? 163 0x8d: no PIN 164 s Set mem location { 0x0004, memtype,location,namelen,"Name",numlen,"number",groupID } 165 r mem set OK { 0x0005 } 166 r mem set error { 0x0006, errtype } 167 where errtype: 0x7d: name is too long 168 s Mem status request { 0x0007, memtype } 169 r Mem status recvd { 0x0008, memtype, free, used } 170 r Mem status error recv { 0x0009, errtype } 171 where errtype: 0x6f: mem status error 172 0x7d: invalid memory type 173 0x8d: waiting for pin 174 s Get caller group data { 0x0010, groupID } 175 r Get caller group data { 0x0011, groupID, size, "Name", ringtoneID, graphic_on?1:0, lenHI, lenLO, OTABitmap (72x14 logo) } 176 r Get call.group error { 0x0012, reason } 177 where reason: 0x7d: invalid location 178 s Set caller group data { 0x0013, groupID, size, "Name", ringtoneID, graphic_on?1:0, lenHI, lenLO, OTABitmap (72x14 logo) } 179 r Set caller group OK { 0x0014 } 180 r Set call.group error { 0x0015, reason } 181 where reason: 0x7d: invalid location 182 s Get speed dial { 0x0016, index(1-9) } 183 r Get speed dial OK { 0x0017, mem.type, location } 184 where mem.type: 0x02: ME (== 0 if not stored) 185 0x03: SIM 186 location: memory location (== 0 if not stored) 187 r Get speed dial error { 0x0018 } 188 s Set speed dial { 0x0019, index(1-9), mem.type, location } 189 r Set speed dial OK { 0x001a } 190 r Set speed dial error { 0x001b } 191 0x04: Phone Status 192 s Phone status { 0x0001 } 193 r Phone status { 0x0002, mode, signal str, ???, pwr, batt.level } 194 where mode: 1: registered within the network 195 2: call in progress 196 3: waiting for pin 197 4: powered off 198 pwr: 1: AC/DC 199 2: battery 200 s Request Phone ID { 0x0003 } 201 r RequestPhone ID { 0x0004, 0x01,"NOKIA""imei", 0, "model", 0, "prod.code", 0, "HW", 0, "firmware", 0x00, 0x01 } 202 0x05: Profile settings 203 s Set profile feature { 0x0010, 1, nr, feature, a, 1 } 204 where nr: see 0x05/0x0013 205 feature: see 0x05/0x0014 206 a: see 0x05/0x0014 207 r Set profile feat. OK { 0x0011, 1 } 208 s Get profile feature { 0x0013, 1, nr, feature, 1 } 209 where nr is profile number (general=0, silent, meeting, outdoor, pager, car, headset=6) 210 feature: see 0x05/0x0014 211 r Get profile feature { 0x0014, 1, nr, feature, 4, a, b, c, d, 1 } 212 213 Note: Settings num 0x00 .. 0x09 can be assigned 214 separately to each profile (0x00 .. 0x05), but rest are common 215 to all profiles. 216 217 6110 218 219 Feature Description Value 220 ------- ------------------- ----------------- 221 0x00 keypad notes 0xff=off, 0x00=level 1, 0x01=level 2, 0x02=level 3 222 0x01 lights (? only in car profile) 0x00=off, 0x??=on (maybe 0x01) 223 0x02 incoming call alert 1=ringing, 2=beep once, 3=unknown, 4=off, 5=ring once, 224 6=ascending, 7=caller groups (see feature #0x08) 225 0x03 ringing tone ID for original 6110: 0x12=ring ring, 0x13=low, etc. 226 0x04 ringing volume level 1 (0x06) - level 5 (0x0a) 227 0x05 message alert tone 0=no tone, 1=standard, 2=special, 3=beep once, 4=ascending 228 0x06 vibration 0=off, 1=on 229 0x07 warning and game tones 0xff=off, 0x04=on 230 0x08 incoming caller groups 1=family, 2=VIP, 4=friends, 8=colleagues, 16=other 231 0x09 automatic answer 0x00=off, 0x01=on 232 ------------------------- 233 0x16 Anykey answer 0x00=Off, 0x01=On 234 0x17 ??? 0x00 | 0x01 235 0x18 Memory in use 0x00=Phone, 0x01=SIM card 236 0x19 Network selection 0x00=Automatic, 0x01=Manual 237 0x1a Automatic redial 0x00=Off, 0x01=On 238 0x1b ??? 0x00 | 0x01 239 0x1c ??? 0x00...0x18 240 0x1d Speed dialling 0x00=Off, 0x01=On 241 0x1e Own number sending 0x00=Preset, 0x01=On, 0x02=Off 242 0x1f Cell info display 0x00=Off, 0x01=On 243 0x21 Language 0x00=English 244 0x01=Deutsch 245 0x02=Francais 246 0x03=Italiano 247 0x06=Nederlands 248 0x07=Dansk 249 0x08=Svenska 250 0x09=Suomi 251 0x0e=Norsk 252 0x10=Automatic 253 0x26 Reply via same centre 0x00=No, 0x01=Yes 254 0x27 Delivery reports 0x00=No, 0x01=Yes 255 0x28 Hide clock 0x00=Show clock, 0x01=Hide clock 256 0x29 Time format 0x00=24-hour, 0x01=12-hour 257 0x2a Selected profile 0x00=General, 0x01.. the rest 258 259 33x0 260 261 Feature Description Value 262 ------- ------------------- ----------------- 263 0x00 keypad notes 0xff=off, 0x00=level 1, 0x01=level 2, 0x02=level 3 264 0x01 incoming call alert 1=ringing, 2=beep once, 3=unknown, 4=off, 5=ring once, 265 6=ascending 266 0x02 ringing tone ID 267 0x03 ringing volume level 1 (0x06) - level 5 (0x0a) 268 0x04 message alert tone 0=no tone, 1=standard, 2=special, 3=beep once, 4=ascending 269 0x05 vibration 0=off, 1=on, 2=vibrate first 270 0x06 warning tones 0xff=off, 0x04=on 271 0x07 screen saver 1=on, 0=off 272 0x08 Screen saver -> Timeout 0x00=5 sec, 0x01=20 sec,.... 273 0x09 Screen saver -> Screen saver 0x00 ... 0x0d = Number of picture image 274 ------------------------- 275 0x0a: ???: 276 ...: ???: 277 0x15: ???: Read only? 278 ------------------------- 279 0x16: ???: 0x00=??? 0x01=??? 280 0x17: Memory in use (Nokia 3330): 0x00=Phone, 0x01=SIM card 281 0x18: Network selection: 0x00=Automatic, 0x01=Manual 282 0x19: Automatic redial: 0x00=Off, 0x01=On 283 0x1a: Speed dialling: 0x00=Off, 0x01=On 284 0x1b: Own number sending: 0x00=Set by network, 0x01=On, 0x02=Off 285 0x1c: Cell info display: 0x00=Off 286 0x1d: Type of view: 0x00=Name list,0x01=Name, number,0x02=Large font 287 0x1e: Language: 0x00=English 288 0x07=Dansk 289 0x08=Svenska 290 0x09=Suomi 291 0x0c=Turcke 292 0x0e=Norsk 293 0x10=Automatic 294 0x32: Reboots ME (3330) 295 0x1f: ???: Read only? (3330) 296 0x20: Reply via same centre: 0x00=No, 0x01=Yes 297 0x21: Delivery reports: 0x00=No, 0x01=Yes 298 0x22: Show/Hide clock: 0x00=Show, 0x01=Hide 299 0x23: Time format: 0x00=24-hour, 0x01=12-hour 300 0x24: Select profile: 0x00=General, 0x01 ... 0x05=rest of them 301 0x25: ???: Read only? (N3330) 302 0x26: Confirm SIM service actions: 0x00=Not asked, 0x01=Asked 303 0x27: T9 Dictionary: 0x00=Off, 0x01=English, 0x0a=Suomi 304 0x28: Messages -> Character support: 0x00=Automatic, 0x01=GSM alphabet, 0x02=Unicode 305 0x29: Startup logo settings: 0x00=Your own uploaded logo,0x01=Nokia 306 0x02=Draft HUMAN technology(tm),0x03=Itineris 307 0x2a: ???: 0x00=??? 0x01=??? 308 0x2b: ???: 0x00=??? 0x01=??? 309 0x2c: ???: Read only? (N3330) 310 0x2d: Auto update of date and time: 0x00=Off,0x01=Confirm first,0x02=On 311 312 s Get welcome message { 0x0016 } 313 r Get welcome message { 0x0017, no.of blocks, { block } * } 314 where block: { id, {blockspecific} } 315 id: 1: startup logo { y, x, picture (coding?) } 316 2: welcome note { len, "message" } 317 3: operator msg { len, "message" } 318 s Set welcome message { 0x0018, no.of blocks, { block } * } 319 where block: see 0x05/0x0017 320 r Set welcome OK { 0x0019, 0x01 } 321 s Get profile name { 0x001a, nr } 322 where nr: see 0x05/0x0013 323 r Profile name { 0x001b, 1, 1, 3, flen, nr, len, {text} } 324 where nr: see 0x05/0x0013 325 len: text length 326 flen len + len(nr, len) = len + 2 327 Note: in Nokia 3310 name is in Unicode 328 s ??? { 0x001c } 329 r ??? { 0x001d, 0x93 } 330 s Set oplogo { 0x0030, location, MCC1, MCC2, MNC, lenhi=0x00, lenlo=0x82, OTABitmap } 331 r Set oplogo OK { 0x0031 } 332 r Set oplogo error { 0x0032, reason } 333 where reason: 0x7d invalid location 334 s Get oplogo { 0x0033, location } 335 where location: 1 (doesn't seem to matter) 336 r Get oplogo { 0x0034, location, MCC1, MCC2, MNC, lenhi=0x00, lenlo=0x82, OTABitmap } 337 r Get oplogo error { 0x0035, reason } 338 where reason: 0x7d invalid location 339 s Set ringtone { 0x0036, location,0x00,0x78, ringtone packed according to SM2.0} 340 r Set ringtone OK { 0x0037 } 341 r Set ringtone error { 0x0038, reason } 342 where reason=0x7d, when not supported location 343 s Get services settings { 0x0080, setting (2 bytes) } 344 where: setting: 0x02,0x00=Nokia access number 1 345 0x02,0x01=Operator access number 1 346 0x01,0x00=Personal bookmark 1 settings (name only ?) 347 0x01,0x01=? 348 0x02,0x02=? 349 r Get services sett.OK { 0x0081, .... } 350 r Get services sett.err { 0x0082, 0x7b } 351 0x06: Calling line restriction/Call forwarding etc 352 r Get call divert { 0x0001, 0x02, x, 0x00, divtype, 0x02, calltype, y, z, 0x0b, number, 0x00...0x00, timeout (byte 45) } 353 s Set call divert { 0x0001, 0x03, 0x00, divtype, calltype, 0x01, number(packed like in SMS), 0x00 ... 0x00, 354 length of number (byte 29), 0x00 ... 0x00, timeout (byte 52), 0x00, 0x00, 0x00} 355 NOTE: msglen=0x37 356 where timeout: 357 0x00: not set ? 358 0x05: 5 second 359 0x0a: 10 second 360 0x0f: 15 second 361 0x14: 20 second 362 0x19: 25 second 363 0x1e: 30 second 364 where divtype: 365 0x02: all diverts for all call types ? 366 Found only, when deactivate all diverts for all call types (with call type 0x00) 367 0x15: all calls 368 0x43: when busy 369 0x3d: when not answered 370 0x3e: if not reached 371 calltype: 372 0x00: all calls (data, voice, fax) 373 0x0b: voice calls 374 0x0d: fax calla 375 0x19: data calls 376 s Deactivate calldiverts{ 0x0001, 0x04, 0x00, divtype, calltype, 0x00 } 377 where divtype, calltype: see above 378 r Deactivate calldiverts{ 0x0002, 0x04, 0x00, divtype, 0x02, calltype, data } 379 s Get call diverts { 0x0001, 0x05, 0x00, divtype, calltype, 0x00 } 380 where divtype, calltype: see above 381 r Get call diverts ok { 0x0002, 0x05, 0x00, divtype, 0x02, calltype, data } 382 where divtype, calltype: see above 383 data: { 0x01, 0x00 } - isn't active 384 { 0x02, 0x01, number(packed like in SMS), 0x00, 0x00..., timeout } 385 r Get prepaid(?) info { 0x0005, ?,?,?,length,message(packed like in 7bit SMS)} 386 r Call diverts active { 0x0006, ??? } 387 0x07: 388 s ??? { 0x0022, ? (1&2 sounds OK) } 389 r ??? OK { 0x0023, ?,?,? } 390 r ??? error { 0x0024, reason } 391 s ??? { 0x0025, ??? } 392 r ??? OK { 0x0026, ??? } 393 r ??? error { 0x0027, reason } 394 0x08: Security codes 395 s Change code { 0x0004, code, "current", 0x00, "new", 0x00 } 396 where code: 1: security code (5 chars) 397 2: PIN (4 chars) 398 3: PIN2 (4 chars) 399 4: PUK (8 chars) 400 5: PUK2 (8 chars) 401 s Status request { 0x0007, 0x01 } 402 r pin recvd { 0x0008, accepted } 403 where accepted: 0x0c (or 0x06): OK 404 code: waiting for (0x08/0x0004) code 405 s entering code { 0x000a, code, "code", 0x00 } 406 where code: see 0x08/0x0004 407 0x09: SIM login 408 r login { 0x0080 } 409 r logout { 0x0081 } 410 0x0a: Network status 411 s Key duplication on/off{ 0x0044, on? 0x01: 0x02 } 412 s get used network { 0x0070 } 413 r network registration { 0x0071, ?,?,?,length,netstatus,netsel,cellIDH,cellIDL,lacH,lacL,netcode,netcode,netcode } 414 0x0c: Keys 415 s Get key assignments { 0x0040, 0x01 } 416 r Get key assignments { 0x0041, {key '1'}, 0x00, {key '2'} ... {key '0'}, 0,0,0, {symbols}, 0 } 417 where {key '0'} => ' ', '0' 418 s Press key { 0x0042, press: 0x01; release: 0x02, button, 0x01 } 419 where button: 0x01 - 0x09: 1-9 420 0x0a: 0 421 0x0b: # 422 0x0c: * 423 0x0d: Power 424 0x0e: Pick up phone 425 0x0f: Hang 426 0x10: Volume + 427 0x11: Volume - 428 0x17: Up 429 0x18: Down 430 0x19: Menu 431 0x1a: Names 432 0x1B onwards: don't know but they do produce 433 a beep and light up the keypad as if 434 a key had been pressed. 435 r Press key ack { 0x0043, press/release/error(0x05) } 436 s ??? { 0x0044 } 437 r ??? ack { 0x0045, 0x01 } 438 0x0d: Status 439 r Display { 0x0050, 0x01, y, x, len, "string"(unicode) } 440 s Status request { 0x0051 } 441 r Status { 0x0052, no. of byte pairs, {byte pair} } 442 where {byte pair}: {cmd, 1:off 2:on} 443 cmd: 1: call in progress 444 2: ??? 445 3: have unread sms 446 4: voice call active 447 5: fax call active 448 6: data call active 449 7: key lock active 450 8: is SMS storage full 451 s Display status { 0x0053, 1:on 2:off } 452 (will send displayed messages with x,y coordinates) 453 r Display status ack { 0x0054, 1 } 454 0x11: Phone clock & alarm 455 s set date and time { 0x0060, 1,1,7,yearh,yearl,month,mday,hour,min,0x00 } 456 r date and time set { 0x0061 } 457 s get date and time { 0x0062 } 458 r date and time recvd { 0x0063,date_set?,time_set?,?,?,yearh,yearl,month,mday,hour,min,second } 459 where: date_set & time_set==0x01 - set 460 0x00 - not set, ?,?,yearh,yearl,month,mday,hour,min,second 461 not available in frame 462 s set alarm { 0x006b, 1,32,3,0x02(on-off),hour,min,0x00 } 463 r alarm set { 0x006c } 464 s get alarm { 0x006d } 465 r alarm received { 0x006e,?,?,?,?,alrm(==2:on),hour,min } 466 0x12: Connect to NBS port (61xx only ?) 467 s Send {+0x0c, 0x01, UDH header, data} 468 (without 0,1 header -- for oplogo, cli, ringtone etc upload) 469 where: UDH header = 0x06, 0x05, 0x04,destporth,destportl,srcporth,srcportl 470 0x13: Calendar notes 471 s Write calendar note { 0x0064, 0x01, 0x10, length, type, yearH, yearL, month, day, hour, timezone, 472 alarm?(alarm yearH, yearL, month, day, hour, timezone): (0,0,0,0,0,0), 473 textlen, "text" } 474 r Write cal.note report { 0x0065, return } 475 where return: 0x01: ok 476 0x73: failure 477 0x81: calendar functions busy. Exit Calendar menu and try again 478 s Calendar notes set { 0x0066... } 479 r Calendar note recvd { 0x0067, 0x01, ?, length, type, yrH,yrL,mon,day,hr,tz,alrm yrH,yrL,mon,day,hr,tz,textlen, "text" } 480 r Cal.note recvd error { 0x0067, err } 481 where err: 0x93: not available 482 (0x01: OK) 483 other: error 484 s Delete cal.note { 0x0068, location } 485 r Del. cal.note report { 0x0069, err } 486 where err: 0x01: OK 487 0x93: cannot delete 488 0x14: SMS funcs 489 s Write SMS to SIM { 0x0004, .... } 490 s Mark SMS as read { 0x0007, 0x02, location, 0x00, 0x64 } 491 r SMS message frame rcv { 0x0008,subtype,?,num,?,BCD(smscenter)...} 20->type, 22->status 492 where type: 0x06: delivery report 493 status: 0x00: delivered 494 0x30: pending 495 0x46: failed 496 0x09: reading failed 497 subtype: 0x02: invalid mem type 498 0x07: empty SMS location 499 0x0c: no access to memory (no PIN in card, etc.) 500 s Delete SMS message { 0x000a, 0x02, location } 501 r Delete OK { 0x000b } 502 s SMS status request { 0x0036, 0x64 } 503 r SMS status { 0x0037,?,?,?,?,?,?,msgnumber,unread } 504 r SMS status error { 0x0038 } 505 0x3f: WAP 506 s Enable WAP frames { 0x0000} 507 r Enable WAP frames { 0x0002, 0x01} 508 509 s ?? { 0x0003} 510 r ?? { 0x0004} 511 512 s Get WAP bookmark { 0x0006, 0x00, location} 513 where location: 0 - 14 514 r Get WAP bookmark { 0x0007, 0x00, name_len, name(unicode), 515 url_len, url(unicode), 0x01,0x80,0x00[7]} 516 r Get WAP bookmark err { 0x0008, error } 517 where error: 518 0x00(?)invalid position 519 0x01 user inside "Bookmarks" menu. Must leave it 520 0x02 invalid/too high/empty location 521 522 s Set WAP bookmark { 0x0009, 0xff, 0xff, name_len, name(unicode), 523 url_len, url(unicode), 0x01,0x80,0x00[7] } 524 Note: bookmark is added to the first free location. 525 r Set WAP bookmark OK {+0x01, 0x36, 0x0a, block } 526 where block: 527 0x0a, location_of_just_written_bookmark(?), 528 0x00, next_free_location(?) 529 r Set WAP bookmark err {+0x01, 0x36, 0x0b, error } 530 where error: 531 0x04 - memory is full 532 0x01 - we are in the bookmark menu 533 0x00 - unknown reason for now ;( 534 535 ? s Delete WAP bookmark { 0x000c, 0x00, location } 536 where: location = 0-14 537 ? r Delete WAR bookmark OK{ 0x000d } 538 ? r Delete WAPbookmark err{ 0x000e, 0x02 } 539 540 s ?? { 0x000F} 541 r ?? { 0x0010, 0x00} 542 543 s Get WAP settings 1 { 0x0015, location} 544 where location: 0x00 - 0x05 545 r Get WAP settings 1 OK { 0x0016, title length, title (Unicode), URL length, URL(Unicode),con_type, ???[6 bytes],location, ???[5 bytes],security,...} 546 where: 547 con_type: 0x00 - temporary 548 0x01 - continuous 549 location: when use "Get WAP settings 2 frame", must give it 550 security: 0x00 = no, 0x01 = yes 551 r Get WAP settings 1 err{ 0x0017, error } 552 where error: 553 0x01 user inside "Settings" menu. Must leave it 554 0x02 invalid/too high/empty location 555 556 s Get WAP settings 2 { 0x001b, location} 557 where location: 0x00 - 0x1d (you get it in "Get WAP settings 1" frame) 558 r Get WAP settings 2 OK { 0x001c, 0x01, type, frame...} 559 where type : 0x00 - SMS bearer 560 frame: 561 service_num_len, service_num (Unicode), server_num_len, server_num(Unicode) 562 0x01 - data bearer 563 frame: 564 auth, call_type, call_speed, ?, IP len, IP (Unicode), dialup len, dialup (Unicode), 565 user len, user (Unicode), password len, password (Unicode) 566 where auth: 0x00 - normal, 0x01 - secure 567 call_type: 0x00 - analogue, 0x01 - ISDN 568 call_speed: 0x00 - 9600, 0x01 - 14400 569 0x02 - USSD bearer 570 frame: type, service number len/IP len,service num (Unicode)/IP (Unicode),service code len, 571 service code (Unicode) 572 where type: 0x01 - service number, 0x00 - IP 573 r Get WAP settings 2 err{ 0x001d,error} 574 where: error=0x05 575 0x40: Security commands 576 s ??? {+0x00, 0x00, 0x07, 0x11, 0x00, 0x10, 0x00, 0x00} 577 This frame hangs phone (N3310 4.02). Meaning unknown ! 578 s Open simlock 1 { 0x02, 0x03, 0x1f, 0x11, 0x01, 0x01, 0x10, 0x00} 579 r Open simlock 1 { 0x02 } 580 s ???(N6150) { 0x08, 0x00 } 581 r ???(N6150) { 0x08 } 582 s Enable extended cmds { 0x64, cmd } 583 where cmd: 0x00: off 584 0x01: on 585 0x02: enter service mode ? 586 0x03: reset (doesn't ask for PIN again) 587 0x04: reset (PIN is requested) 588 In 5110 makes reset without PIN 589 0x06: CONTACT SERVICE!!! Don't try it! 590 s Reset phone settings { 0x65, value, 0x00 } 591 where value: 0x08 - reset UI (User Interface) settings 592 0x38 - reset UI, SCM and call counters 593 0x40 - reset test 36 in netmonitor 594 r Reset phone settings { 0x65, 0x00 } 595 s Get IMEI { 0x66 } 596 r Get IMEI { 0x66, 0x01, IMEI, 0x00} 597 s (ACD Readings)?(N6150 { 0x68 } 598 r (ACD Readings)?(N6150 { 0x68, ... } 599 s Get Product Profile 600 Settings { 0x6a} 601 r Get Product Profile 602 Settings { 0x6a, 4bytes with Product Profile Settings } 603 s Set Product Profile 604 Settings { 0x6b, 4bytes with Product Profile Settings } 605 r Set Product Profile 606 Settings OK ? { 0x6b } 607 s Get code { 0x6e, code } 608 where code: see 0x08/0x0004 (only sec.code is allowed) 609 r Get code { 0x6e, code, allowed, allowed? (sec code (text)) } 610 where code: see 0x08/0x0004 611 allowed: 0: no 612 1: yes 613 s Set code { 0x6f, code, sec code(text), 0x00 } 614 where code: see 0x08/0x0004 615 s Start monitoring { 0x70, block } 616 where block(N6150): 617 0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff, 618 0xff,0xff,0xff,0xff,0xff,0xf9,0x76,0x65,0x20,0x00, 619 0x00,0x00,0x00,0x00,0x18,0x26,0x15,0x7d,0x0a,0x00, 620 0xf5,0x82,0x7f,0xff,0xff,0xff,0xff,0xff,0xff,0xff, 621 0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xf0,0x77,0x80, 622 0x77,0x80,0xf2,0x82,0x20,0x20,0x20,0x20,0x20,0x20, 623 0x20,0x20,0x20,0x20 624 This block enables probably all possible monitored parameters. 625 After it phone sends 0x00 message type values 626 s Break monitoring { 0x71 } 627 r Break monitoring { 0x71 } 628 ? s ???? { 0x74, 0x01, 0x01, 0x0e } 629 ? r ???? { 0x74 } 630 s Call commands { 0x7c, block } 631 where where: command, (values) 632 command: 0x01 633 values: number(ASCII), 0x00 - makes voice call 634 command: 0x02 - answer call 635 command: 0x03 - release call 636 r Call commands { 0x7c, command } 637 s Netmonitor { 0x7e, field } 638 where: field: 00: next 639 F0: reset 640 F1: off 641 F2: field test menus 642 F3: developer menus 643 s Open simlock 2 { 0x81, 0x01, locknumber, 0x10, 0x10, 0x10, 0x10, 0x10 } 644 Note: sets simlock type to factory? 645 where locknumber: 1,2,4,8 646 s Open simlock 2 { 0x81, 0x01, locknumber } 647 where locknumber: 1,2,4,8 648 s Close simlock { 0x82, 0x01, locknumber, 0x00, 0x00, locksinfo(lock1,4,2,3), 0x00 } 649 where locknumber: 1,2,4,8 650 r Close simlock { 0x82, the rest like in 0x40/0x8a } 651 s Get simlock info { 0x8a, 0x00} 652 r Get simlock info { 0x8a, 0x00, 0x01, lockstype, locksclosed, 0x00, 0x00, locksinfo(lock1,4,2,3), counter1,counter2,counter4,counter4,0x00 } 653 where: lockstype: bit1,bit2,bit3,bit4 - if set, selected lock is user lock 654 locksclosed: bit1,bit2,bit3,bit4 - if set, selected lock is closed 655 counter1 - counter4: counters for locks 656 s Set downloaded OpName { 0x8b, 0x00, MCC1, MCC2, MNC, Name, 0x00 } 657 r SetdownloadedOpNameOK?{ 0x8b, 0x00, 0x01 } 658 s Get downloaded OpName { 0x8c, 0x00 } 659 r Get downloaded OpName { 0x8c, 0x00, 0x01, MCC1, MCC2, MNC, Name, 0x00,...} 660 s Buzzer pitch { 0x8f, volume, hzLO, hzHI } 661 if volume and hz is 0, it's off 662 r Buzzer pitch { 0x8f} 663 s ACD Readings ? { 0x91, parameter?(0x02,0x03,0x04,0x05,0x07) } 664 r ACD Readings ? { 0x91, parameter?, value? } 665 s Sleep mode test { 0x92, 0x00, 0x00, howlong(2 bytes), enable } 666 where: enable == 0x01 - enable after test 667 0x00 - don't enable after test 668 howlong (ms) = 0x07, 0xd0 = 2000 669 s ???(N6150) { 0x98, 0x00 } 670 r ???(N6150) { 0x98, 0x00, 0x04 } 671 s Get bin ringtone { 0x9e, location } 672 where: location=0,1,etc. 673 r Get bin ringtone { 0x9e, location, error, contents... } 674 where location=0,1,etc. 675 error=0x0a, ringtone NOT available 676 0x00, OK 677 s Set bin ringtone { 0xa0, location, 0x00, contenst... } 678 where: location=0,1,etc. 679 r Set bin ringtone { 0xa0, location, error } 680 where location=0,1,etc. 681 error=0x0a, ringtone NOT set 682 0x00, ringtone set OK 683 r Get MSid { 0xb5, 0x01, 0x2f, msid, 0x25 } 684 s Get info about phone { 0xc8, 0x01 } 685 r Get info about phone { 0xc8, 0x01, 0x00, "V ", "firmware", 0x0a, "firmware date", 0x0a, "model", 0x0a, "(c) NMP.", 0x00 } 686 s Get MCU SW Checksum { 0xc8, 0x02 } 687 r Get MCU SW Checksum { 0xc8, 0x02, 0x00, checksum (4 bytes),0x00 } 688 s DPS External SW { 0xc7, 0x03 } 689 r DSP External SW { 0xc7, 0x03, 0x00, string,0x00 } 690 s Get HW { 0xc8, 0x05 } 691 r Get HW { 0xc8, 0x05, 0x00, HW version (4 bytes), 0x00 } 692 s Get "Made" Date { 0xc8, 0x05 } 693 r Get "Made" Date { 0xc8, 0x05, 0x00, date(4 bytes), 0x00 } 694 s Get DSP Internal SW { 0xc8, 0x09 } 695 r Get DSP Internal SW { 0xc8, 0x09, 0x00, version (1 bytes), 0x00 } 696 s Get PCI version { 0xc8, 0x0b } 697 r Get PCI version { 0xc8, 0x0b, 0x00, version, 0x00 } 698 s Get system ASIC { 0xc8, 0x0c } 699 r Get system ASIC { 0xc8, 0x0c, 0x00, string, 0x00 } 700 s Get COBBA { 0xc8, 0x0d } 701 r Get COBBA { 0xc8, 0x0d, 0x00, string, 0x00 } 702 s Get PLUSSA { 0xc8, 0x0e } 703 r Get PLUSSA { 0xc8, 0x0e, available, 0x00 } 704 where available: 0x01: not available 705 s Get CCONT { 0xc8, 0x0f } 706 r Get CCONT { 0xc8, 0x0f, available, 0x00 } 707 where available: 0x01: not available 708 s Get PPM version { 0xc8, 0x10 } 709 r Get PPM version { 0xc8, 0x10, 0x00, "V ", "firmware", 0x0a, "firmware date", 0x0a, "model", 0x0a, "(c) NMP.", 0x00 } 710 s Get PPM info { 0xc8, 0x12 } 711 r Get PPM info { 0xc8, 0x12, 0x00, PPM version ("B", "C", etc.), 0x00 } 712 s Set HW version { 0xc9, 0x05, version, 0x00 } 713 s Get Product Code { 0xca, 0x01 } 714 r Get Product Code { 0xca, 0x01, 0x00, number, 0x00 } 715 s Get Order Number { 0xca, 0x02 } 716 r Get Order Number { 0xca, 0x02, 0x00, string, 0x00 } 717 s Get Prod.Ser.Number { 0xca, 0x03 } 718 r Get Prod.Ser.Number { 0xca, 0x03, 0x00, number, 0x00 } 719 s Get Basic Prod.Code { 0xca, 0x04 } 720 r Get Basic Prod.Code { 0xca, 0x04, 0x00, number, 0x00 } 721 s Set Product Code { 0xcb, 0x01, product code, 0x00 } 722 s Set Order Number { 0xcb, 0x02, number, 0x00 } 723 s Set Prod.Ser.Number { 0xcb, 0x03, number, 0x00 } 724 s Get (original ?)IMEI { 0xcc, 0x01 } 725 r Get (original ?)IMEI { 0xcc, 0x01, IMEI, 0x00 } 726 s Get Manufacture Month { 0xcc, 0x02 } 727 r Get Manufacture Month { 0xcc, 0x02, 0x00, string, 0x00 } 728 s Get Purchare date { 0xcc, 0x04 } 729 r Get Purchare date { 0xcc, 0x04, 0x00, string, 0x00 } 730 s Set "Made" date { 0xcd, 0x02, string, 0x00 } 731 s Make "all" phone tests{ 0xce,0x1d,0xfe,0x23,0x00,0x00} 732 s Make one phone test { 0xce,0x1d,num1,num2,num3,num4} 733 Where num1-num4: 0x02,0x00,0x00,0x00; 734 0x04,0x00,0x00,0x00; 735 0x08,0x00,0x00,0x00; 736 0x10,0x00,0x00,0x00; 737 0x20,0x00,0x00,0x00; 738 0x40,0x00,0x00,0x00; 739 0x80,0x00,0x00,0x00; 740 0x00,0x01,0x00,0x00; 741 0x00,0x02,0x00,0x00; 742 0x00,0x04,0x00,0x00; - "Power off" 743 No test for "Security data" 744 0x00,0x10,0x00,0x00; 745 0x00,0x20,0x00,0x00; 746 0x00,0x40,0x00,0x00; 747 0x00,0x80,0x00,0x00; 748 0x00,0x00,0x01,0x00; 749 .... 750 0x00,0x00,0x10,0x00; 751 s Result of phone tests { 0xcf } 752 r Result of phone tests { 0xcf, number of tests, results of next tests } 753 s ??? { 0xd1 } 754 r ???(N5110) { 0xd1, 0x00, 0x1d, 0x00, 0x01, 0x08, 0x00 } 755 s LCD Test { 0xd3, value } 756 where value: 0x03, 0x02 - 1'st test 757 0x03, 0x01 - 2'nd test 758 0x02, 0x03 - clears screen 759 s ACD Readings(N6150)? { 0xd4, 0x02, 0x00, 0x02, 0x00, 0x0e, 0x01} 760 r ACD Readings(N6150)? { 0xd4, 0x02, 0x00, 0x02, 0x00, 0x0e, 0x01, ?} 761 s Get EEPROM { 0xd4, 0x02, 0x00, 0xa0, locationLo, locationHi, numofbytes } 762 where: numofbytes - how many bytes to read 763 Note: Works ONLY in MBUS 764 r Get EEPROM { 0xd4, 0x02, 0x00, 0xa0, locationLo, locationHi, numofbytes, contest... } 765 where numofbytes - how many bytes available 766 contest - bytes with contests (if numofbytes != 0) 767 0x41: Snake game ? 768 0x47: 769 s Get Picture Image { 0x0001, location } 770 r Get Picture Image when contains sender number 771 { 0x0002, location, number(like in SMS), 0x00, len, text, 0x00, width, height, 0x01, bitmap } 772 NOTE: 773 Supports only 0x81 and 0x91 coding (NOT alphanumeric numbers!) 774 in sender without sender number 775 { 0x0002, location, 0x00, 0x00, 0x00, len, text, 0x00, width, height, 0x01, bitmap } 776 s Set Picture Image { 0x0003, frame...} 777 where frame: see 0x47/0x0002 778 r Get/Set PictureImageOK{ 0x0004 } 779 r Set Picture Image err { 0x0005, error? } 780 where error=0x74 - wrong location ? 781 0x64: 782 s Phone ID request { 0x0010 } 783 r Phone ID recvd { 0x0011, "NOKIA", "imei", 0, "model", 0, "prod.code", 0, "HW", 0, "firmware", magic bytes x 4 ... } 784 s Accessory connection { 0x0012, 16x0x00, 'NOKIA&NOKIA accessory', 3x0x00 } (45 bytes) 785 0x7f: Acknowledge(FBUS/IRDA){+type, seq } 786 Acknowledge(MBUS)... 787 0xd0: 788 s Power on message seq1 {+04 } 789 r Power on message seq1 {+05 } 790 0xd1: 791 s Get HW&SW version { 0x0003, 0x00 } 792 0xd2: 793 r Get HW&SW version { 0x0003 "V " "firmware\n" "firmware date\n" 794 "model\n" "(c) NMP." } 795 0xda: ? (during playing 2 player snake) 796 0xf0: 797 s Send RLP frame {+0x00, 0xd9, ... } 798 0xf4: Power on message seq 2 799