TDMA 5120
=========

Eduardo Spremolla at gnokii-users@mail.freesoftware.fsf.org

After playing a while with my 5120i y find some use full frames:

got from sneefing in Logomanger the get startup logo
----------------------------------------------------

request::

    40 {0x07, 0x07, 0x08, section} section goes from 1 to 6

answer::

    dd {+0x01, 0x00, 0x07, 0x08, (84 bytes => 84 cols x 8 bits bit0 first row )

Can't figure out how to modify 6110 code to get & put the logo, not in a
hi value to me now.

got key press working
---------------------

As stated in http://www.flosys.com/tdma/n5160.html

with frame: key-press::

    D1 {+00 01 50 00 01 KY}

this seems to press the key for a while. No release needed

key-release:

    D1 {+00 01 50 00 00 KY}

keep the key press => got speedee dial::

    D1 {+00 01 50 00 02 00 KY}

get memory
----------

the getmemory::
    40 {+00 00 07 11 00 10 00 mem}

get phonebook with the phone in bcd, but it seems to be a way to read
chunks of memory with different numbers in the 6 place. in particular:

get configuration pins::

    40 {+0x00, 0x00, 0x07, 0x11, 0x00, 0x0f, 0x00, 0x00 }

get security code::

    40 {+0x00, 0x00, 0x07, 0x11, 0x00, 0x09, 0x00, 0x00 }

get NAM data ::

    40 {+0x00, 0x00, 0x07, 0x11, 0x00, 0x08, 0x00, nam# }

that last answers with::

    dd {+01 00 11 00 08 00 00,

03 04
    home sys id
01 4d
    primary paggin channel
02 c4
    seconda paggin channel
88 88 88 88 88
    own #
09 63 c2 09 03 00 0b
    unknown
0a
    group id
01
    Access method
01
    local option
0f
    overload class
20 41 43 41 45 00 00 00 00 00 00 00 00 00 00 00
    alpha tag
b3 4d
    unknown
01
    NAM status
11 11 11 11 11 00 00 00 00 00 00 00 00
    unknown
00 00 00 00 00 00 01 00 00 00 01 36
    unknown
01 4d
    dedicate ch
01 4e
    dedicate B ch
14
    dedicate ch #
14
    dedicate B ch #
00
    msg center # len
00
    msg center in flag
00 00 00 00 00 00 00 00 00 00 00 00 00 00
    msg center #
08 01 80 70 8f dd 00 ef 00 00 00 00 00 00 00 00
    unknown
00 00 00 00 00
    gate way #
00 00 00
    unknown

More interesting ( and dangerous ) is than the 07 10 sequence  in place
of 07 11 in the request change the command from read to write.be care
full!!! I almost ruin my 5125 with a 40 {+0x00, 0x00, 0x07, 0x10, 0x00,
0x08, 0x00, 0x01 } frame , since the frame is ok, but the phone the
write info from an area of the buffer that I did not send!!!!

OK so far. Still looking for how to handle SMS......