Main page News Guest book Home bs0dd.net Phones List of modelsFirmware Net Monitor FT/NM activationNet Monitor (DCT3) Net Monitor (DCT4) Soft and games Java MIDletsOfficial soft Soft for 5510 PC software Connectivity Data-CablesFLOSYS FBUS/MBUS docs DLR-3 MBUS (atrox) Modding Color display (6310)WAP WAP-gatewayWAP-page Other Nokia 9210 archiveElektronika MK Kannel for Windows |
My latest research shows that the TDMA phones support
simultaneously both MBUS protocols, the old one used for 21xx,31xx phones
and the new 1F protocol used by the 51xx,61xx phones.
Here are the few frames used by a 3Com cellular modem card: reg cellmodem: 00 F8
05 E9 01 01 1C 01 1C
SQ
CS
unknown purpose : 00 E0 00 1D SQ CS probably request Alive response from cellmodem UC_RESERVE_REQ: 00 E0 05 19 00 00 01 01 00 SQ CS register sytem state info presentation UC_RESERVE_REQ: E0 00 01 CD 01 SQ CS phone tries to register some info from cellmodem LN_KEY_REQ: 00
E0 02 17 01 KEYNUM
SQ
CS
push
key
Dialing as cellmodem forces the
phone into analoge AMPS mode, answering a call as cellmodem answers in
AMPS mode
LN_ALIVE_REQ: E0 00 00 1E SQ CS checks if cellmodem is still present (sent 1 /sec.) SYS_STATE_IND: FF 02
07 CA 1C Con 02 01 0E
0F 00 SQ CS
sytems
state information
MBUS frames (new format): 1F = protocol identifier
1F=MBUS
, 1E=FBUS, 1C=IrDa
register commands: Register req: 00 F8
05 E9 00
02 1D 00 1D 02
3C
(old
2110 style) register device 1D
0x40 commands: (usually direct register r/w commands) kind of end: 1F 00 10 40 00 04 00 01 64 01 SQ CS sent by Service Software when exiting Rd phonebook: 1F 00
1D 40 00 07 00
01 1F 01 04 86 NO SQ
CS
read
phonebook location NO (high level)
0x4E commands: (sent from a 5160i TDMA / 6160i TDMA / 6185 CDMA or 7110 GSM phone to the uC in the DLR-3 cable) DLR-3 req: 1F 48
00 4E 00 02 01
XX SQ
CS
frame
sent from the phone to the DLR-3 cable (after
15kOhm resistor detected betw. XMIC (3) and DGND (9).)
DLR-3
mode = enable a 19.200 bit/s AT-command set interface on the FBUS-TX and
FBUS-RX lines.
Flow
control lines are DSR,DCD,CTS arecoded into the 2nd databyte XX:
See
more information how to build a DLR-3 cable here: Adrians
Datacable pages
0x78
/ 0x79 commands: (used by handsfree carkit) Works
also on GSM phones (5110 / 6110 / etc)
mute status tone: 1F 04
00 78 00 04 01
02 0E
00 SQCS
status
indication = disable carkit audio amplifier (no audio / no tone)
mute status call: 1F 04
00 78 00 04 01
02 07 00
SQ CS status
indication = disable radio mute output (no call)
enable ???: 1F 04 00 78 00 04 01 02 08 01 SQCS status indication = enable ??? sent to HFU-2 on power on byte 9 (07,08,0E) seems to be a pointer to a memory location , byte 10 is the data at this memeory location. response from HFU: 1F 00 04 78 00 03 02 01 03 SQ CS response message from HFU-2 (use unknown) go HF and IGN on: 1F 00
04 79 00 05 02
01 01 63
00 SQ CS
enables
carkit mode + turns phone on + req. mute status
ext. HS Offhk: 1F
00
04 79 00 05 02
01 01 23
00 SQ CS
enables
carkit mode + external handset lifted
(OFF-Hook)
Ignition and Hook are coded into one byte
HFU-2 version: 1F00
04 79 00 12 02
01 02 06 00 56 20 30 36 2E 30 30 0A 48 46
55 32 00 SQ
CS
HFU-2
version string
init: 1F
00
1D D0 00 01
04
SQ CS sent
by the Service Software or HFU-2 on startup
0xD1 commands: undefind behv.:1F 00
1D D1 00 05 00
01 47
00 00
SQ
CS Caution
- might delete data
registr. req: 1F 00 1D D1 00 09 00 F8 05 E9 00 02 1D 00 1D SQ CSnew style registration request for the TDMA 516x, 616x phones:
for the CDMA phone 6185:
for the 7110 GSM and 7160 TDMA phones:
for all phones:
Keypress codes:
Keypress commands shall be followed by key release
commands.
0xD2 responses: Keypress resp: 1F 1D 00 D2 00 04 01 00 50 00 SQ CSreturned from phone after receiving a keypress frame D1 47 resp. 1F 1D 00 D2 00 04 01 00 47 00 SQ CS ID response: 1F
10
00 D2
00 24 01 00
00 03
version resp: 1F 1D
00 D2 00 11 01
00 00 0D
reg response: 1F
1D
00 D2
00
0A F8 00 05 06
AB CD EF AB CD EF SQ
CS response
to new registration request
0xD8 registration: answ:
1F F8
00 D8 00
01 55
SQ CS
response to old registration request
0xDA frame: for HFU-2: 1F 04
00 DA 00 02 00
02
SQ CS
function
unknown - sent from Nokia phone to HFU-2mute output (call active
)
0x7F ACK frames: ACK frame: 1F
1D
00 7F SQ
CS
Acknowledge
for every received frameframe
Checksum
problem:
Please send any comments, new commands or any information to: arnu@flosysinc.com
|
|
WAP-gateway IP: 79.186.132.242 Port: 9201 | ||
Powered by COMPPAG 0.50 2022-2024 © Compys S&N Systems |