Re: 6310i key simulation

[Ola Carlvik]

Hi Marcin

What I understand NCDS3 will not work with 6310i.
Also the software that I got with the 6310i phone only works with DLR3-P
cable and AT-commands

I am sorry the frames that I have found so far was not in the attached
email, but here they are. Please note these are my first findings and
the only thing they do is pressing UP or DOWN key. I have not managed to
control any other key, and I have not managed to release the keys except
by pressing the physical UP/DOWN button on the phone:
This is what I have found:
UP button:
Transmitted: 1E 00 0C 0C 00 0C 00 01 00 11 00 01 00 00 01 01 01 43 12 53

Recieved:    1E 0C 00 0C 00 08 01 26 00 12 00 00 01 47 1E 7B
DOWN dutton:
Transmitted: 1E 00 0C 0C 00 0C 00 01 00 11 00 01 00 00 00 01 01 45 13 55

Recieved:    1E 0C 00 0C 00 08 01 26 00 12 00 00 01 41 1E 7D

I have used some octets from the keypad simulation on other phones in
the "press UP button"
Frame:  1E 00 0C 0C 00 0C 00 01 00 11 00 01 00 00 01 01 01 43 12 53
OctetNr: 1  2  3  4  5  6  7  8  9 10 11 12 13 14 15 16 17
MsgType (octet 4) 0C as for "keys" for for example 6110
Command (octet 9,10) {0011} for pressing keys (instead of  {0042} for
6110)
(octet 11,12){00, 01} ???
(octet 13,14){00, 00} ??
(octet 15) {key} 0x01: up; 0x00, 0x02->0xFF:down
(octet 16) {nr_of_presses}  this value makes the phone do more then one
press at start
                            Example if you have the cursor in a SMS
message and emulate
                            "up button". If no key is pressed:
                            0x00: nothing happens
                            0x01: cursor jumps 1 step to the left and
then 1 step at the
                                  time as when the key is stuck
                            .......
                            0xn:  cursor jumps n step to the left and
then 1 step at the
                                  time as when the key is stuck
                                  ( you also hear n nr of beeps from the
phone)
                            .....
I think have tried all different combinations for the bytes marked with
????, but I either
managed to emulate up or down key presses or the phone didn't respond.

I have also found other Command in MsgType 0C that the phone responses
well to but I have not
found out what they do:
Command (octet 9,10)
   C = 0001; 0003; 000E; 0011 gives good responses
   C = 0007; 0009; 00F0 gives no response at all
All other C gives the response:
1E 0C 00 0C 00 0C 01 26 00 F0 01 00 00 00 00 00 01 id XOrHi XOrLo
(which I read as a "command error" or "command not implemented")

I have tried to make longer and longer frames, and it seams I can
control new things like above
the last byte is the "nr_of_presses"...

I have today also played arround with in FBUS:
0x0a: Network status
s Key duplication on/off{ 0x0044, on? 0x01: 0x02 }

On 5190 and 6190 it is awesome where the phones gives me the FBUS frames
to control a key ever time I press a key on the phone.
On 7190 I only get a ACK and the nothing more
On 6310i I get
Transmitted: 1E 00 0C 0A 00 07 00 01 00 44 01 01 42 00 51 49
Recieved:    1E 0C 00 0A 00 0C 01 5C 00 F0 01 44 00 00 00 00 01 46 1F A4

Note  (octet 10) F0 (which I again read as a "command error" or "command
not implemented", see above)
The 6310i does NOT give me anything after this when I press the keys on
the phone

Regards
/ola
Marcin Wiacek wrote:

> Hi,
>
> > Does anyone of you know how the key simulation FBUS frams
> > originally were found for 6110 and other Nokia phones?
> Sniffing NCDS3.
>
> > So far I have by accident found out how send FBUS frames to
> > simulate press of up and down key on the 6310i, but no other
> > buttons, and no release of the keys as of yet. Also see
> > attached email.
> I don't see it ;-)
>
> Pozdrowienia/Best Regards
> --
> Marcin Wiacek (mailto:address@hidden,
> http://marcin-wiacek.topnet.pl, http://marcin-wiacek.fkn.pl/)
>