Undocumented data-cable commands
for Sagem 9xx series mobile phones
Warning / Disclaimer:
Using the undocumented commands can result in permanent
damage to your phone. If you decide to try the commands, you do so at your own risk. Sagem
phones are known to be quite sensitive regarding hacking attempts, and will lock themselves
very quickly. Sagem is a registered trademark of SAGEM SA.
Thanks to Hufri, a German version of this Document is now available.
Contents:
|
|
 |
All commands follow the same basic structure: (hex representation)
02 LL D2 05 00 CC [PP] CC 03
Each command must begin with the start code (02), followed by the total length of the command
string - 4 and the two-byte constant (D2 05). The (00)-byte signals that this string is a command (Response
strings have a (01) here). The command code (CC) determines which command is to be issued.
Depending on which command is issued, parameters of variable length can be passed along with
the command. The checksum (CC) is calculated by XOR-ing all bytes except the checksum byte and
the end code (03).
Responses from the phone have a structure similar to the command structure: (hex representation)
02 LL D2 05 01 RR [VV] CC 03
As with command codes, each response begins with the start code (02), followed by the total length of the response
string - 4 and the two-byte constant (D2 05). The (01)-byte signals that this string is a response. The response code
(RR) determines the type of the response, and is dependent on the command issued.
Most response types also return a value (VV) of variable length, for example the requested prom field.
The checksum (CC) is calculated by XOR-ing all bytes except the checksum byte and
the end code (03).
If the command is not accepted by the phone, an error message is returned:
02 05 D2 05 01 45 [CO] [CC] 03
Reading / writing the EEPROM |
The eeproms contained in Sagem phones are divided
into several logical fields. The internal structure of how fields are
stored is quite complicated, and although the fields are numbered, they
are not stored sequentially. Fields 0 to 999 can be accessed with these
commands.
Code 0x44: read prom
Command Syntax:
02 06 D2 05 00 44 [A1] [A2] [CC] 03
With
Response from phone:
02 [LL] D2 05 01 3B [DD] [BB] [CC] 03
With
Code 0x45: write prom
Command Syntax:
02 [LL] D2 05 00 45 [A1] [A2] [DD] [BB] [CC] 03
With
Response from phone:
02 [LL] D2 05 01 44 [A1] [A2] [DD] [BB] [CC] 03
With
Code 0x81: resize / delete prom field
Command Syntax:
02 08 D2 05 00 81 [A1] [A2] [L1] [L2] [CC] 03
With
It is recommended to keep the length < 32 bytes.
If fields get longer than this, they can no longer be written via cable,
though they can still be resized/deleted.
Response from phone:
02 08 D2 05 01 7B [A1] [A2] [L1] [L2] [CC] 03
With
Reading / writing the Flash |
Field numbers in the range 1024 to 16383 are referred to as "flash" in the sagem menus.
Code 0x7C: read flash
Command Syntax:
02 06 D2 05 00 7C [A1] [A2] [CC] 03
With
Response from phone:
02 [LL] D2 05 01 76 [DD] [CC] 03
With
Code 0x7D: write flash
Command Syntax:
02 [LL] D2 05 00 7D [A1] [A2] [NN] [DD] [CC] 03
With
Response from phone:
02 [LL] D2 05 01 77 [A1] [A2] [NN] [DD] [CC] 03
With
Code 0x80: resize / delete flash field
Command Syntax:
02 08 D2 05 00 80 [A1] [A2] [L1] [L2] [CC] 03
With
Setting the length to 0 will delete the field.
Response from phone:
02 08 D2 05 01 7A [A1] [A2] [L1] [L2] [CC] 03
With
Code 0x82: read length of flash field
Command Syntax:
02 06 D2 05 00 82 [A1] [A2] [CC] 03
With
Response from phone:
02 06 D2 05 01 7C [N1] [N2] [CC] 03
With
The following commands can be used to deal with long flash fields:
These fields can have a length > 240 bytes, but they can not be read or written with the
normal flash commands. Instead, you must read/write several smaller portions of the field in
separate steps.
Code 0x7E: read portion of long flash field
Command Syntax:
02 09 D2 05 00 7E [A1] [A2] [O1] [O2] [NN] [CC] 03
With
Response from phone:
02 [LL] D2 05 01 78 [DD] [CC] 03
With
Code 0x7F: write portion of long flash field
Command Syntax:
02 [LL] D2 05 00 7F [A1] [A2] [O1] [O2] [NN] [DD] [CC] 03
With
Response from phone:
02 [LL] D2 05 01 79 [A1] [A2] [NN] [DD] [CC] 03
With
Reading / writing the RAM |
Code 0x15: read ram
Command Syntax:
02 09 D2 05 00 15 [A1] [A2] [A3] [A4] [NN] [CC] 03
With
Response from phone:
02 [LL] D2 05 01 2E [DD] [CC] 03
With
Code 0x16: write ram
Command Syntax:
02 LL D2 05 00 16 [A1] [A2] [A3] [A4] [DD] [CC] 03
With
Response from phone:
02 LL D2 05 01 40 [A1] [A2] [A3] [A4] [DD] [CC] 03
With
This command returns an ascii string containing information about the phone's firmware revision and the date of production.
Code 0x23: get phone information string
Command Syntax:
02 04 D2 05 00 23 F2 03
Response from phone:
02 [LL] D2 05 01 35 [DD] [CC] 03
With
Enter service mode on phone |
This command will enable the service mode on the phone.
Code 0x52: enter service mode
Command Syntax:
02 04 D2 05 00 52 83 03
Response from phone:
02 04 D2 05 01 4C 9C 03
This command performs tests with the display and the LED of the phone.
Code 0x54: test lcd
(The same test pictures can also be accessed from the hotline menu on the phone)
Command Syntax:
02 05 D2 05 00 54 [PP] [CC] 03
With
Response from phone:
02 05 D2 05 01 4E [PP] [CC] 03
With
Code 0x55: finish lcd test
Command Syntax:
02 04 D2 05 00 55 84 03
Response from phone:
02 04 D2 05 01 4F 9F 03
Display Contrast Settings |
This command allows you to set the contrast setttings of the phone's display.
Code 0x6E: set display contrast settings
Command Syntax:
02 05 D2 05 00 6E [PP] [CC] 03
With
Response from phone:
02 05 D2 05 01 68 [P1] [CC] 03
With
This command will test ring sounds of the phone.
Code 0x56: test ring sound
Command Syntax:
02 06 D2 05 00 56 [P1] [P2] [CC] 03
With
Response from phone:
02 06 D2 05 01 50 [P1] [P2] [CC] 03
With
Code 0x57: finish ring sound test
Command Syntax:
02 04 D2 05 00 57 [CC] 03
Response from phone:
02 04 D2 05 01 51 [CC] 03
This command will test the vibrator alarm feature of the phone.
Code 0x69: turn vibra on
Command Syntax:
02 04 D2 05 00 69 B8 03
Response from phone:
02 04 D2 05 01 63 B3 03
Code 0x6A: turn vibra off
Command Syntax:
02 04 D2 05 00 6A BB 03
Response from phone:
02 04 D2 05 01 64 B4 03
The following commands test the keypad of the phone.
Code 0x4F: enter keypad testing mode
This command puts the phone in a special keypad testing mode: if a button is pressed, the
event is recorded, but the phone does not react to the button press in the normal way.
Command Syntax:
02 04 D2 05 00 4F 9E 03
Response from phone:
02 04 D2 05 01 49 99 03
Code 0x50: leave keypad testing mode
This command leaves the keypad testing mode on the phone so the keypad can be used normally.
Command Syntax:
02 04 D2 05 00 50 81 03
Response from phone:
02 04 D2 05 01 4A 9A 03
Code 0x51: request pressed buttons in keypad test mode
If the phone is in keypad testing mode, this command requests a list of buttons pressed
since the start of the keypad test or the last requested list.
Command Syntax:
02 04 D2 05 00 51 80 03
Response from phone:
02 0A D2 05 01 4B 05 [D1] [D2] [D3] 00 00 [CC] 03
With
Remote Control (Keypad Simulation) |
The following commands can simulate keypresses on the phone.
They use a different header structure with the value '07 1E' as the 4. and 5. bytes of the command.
Code 0x1E: Simulate keypress
The command is different for the different phone models:
For 93X type phones:
Command Syntax:
02 [LL] D2 07 1E [SS] [DD] [CC] 03
With
For 93X type phones, the name parameter is a Null-terminated ASCII-string of the key name:
For 922 type phones:
Command Syntax:
02 04 D2 02 00 [DD] [CC] 03
With
For the 922 phone, the key code is a single byte:
Read Phone Connection Status |
This commands reads information about the presence of the sim card and the connection status.
Code 0x68: read sim / connection information
Command Syntax:
02 04 D2 05 00 68 [CC] 03
Response from phone:
02 06 D2 05 01 62 [D1] [D2] [CC] 03
With
The following list contains some commands that are still not fully understood.
They all are valid commands, but they can have unknown side effects on the phone, so
please do not try them unless you are sure you know what you are doing.
Even if an obvious effect is described here, there might be errors in the
description. You have been warned...
The output strings are responses I got from my phone. Your phone might produce
different outputs.
Possible command codes found so far:
- Code 0x47: Read Ram (Parameters: 4 Bytes address, 1
Byte length of ram. Phone will return 2*len of data. Works only for len
<= 123 bytes)
- Code 0x4a: Query battery status (answer: code 0x3e with 2 bytes value)
- Code 0x4c: "Start test (DRV)" (Something happens with the receiver level indicator)
- Code 0x4d: "Test DRV" (with 4 Byte parameter): ???
- Code 0x4e: "Read MDC (RXLEV)" (Output: 00)
- Code 0x53: ??? (Reset / Software crash on phone)
- Code 0x53: (with parameter): "Appel Sortant 3n° / 5n°"
- Code 0x58: "Start DAIAC" ?
- Code 0x59: "Stop DAI" ?
- Code 0x5B: "Start DAIMA" ?
- Code 0x5d: Set microphone/speaker gain, parameters: 1 byte "Gain Micro", 1 byte "Gain Speaker"
- Code 0x5e: Set microphone/speaker gain and volume, parameters: 1 byte "Gain Micro", 1 byte "Gain Speaker", 1 byte "Volume"
- Code 0x63: "R_BATID" (Output: 01 D6 / 01 FF)
- Code 0x66: "Temperature radio" (Output: two
bytes, example "01 D5". Temp is in °C, value = 70 - (first byte)*256 +
(second byte)/10 [thanks to XAtlan]
- Code 0x67: W_FEEP (Attention: prom fields are changed, phone will be "simlocked" afterwards!)
- Code 0x6D: "Who am I?" (Output: 1305012300; [No, this is not the simlock code :-])
- Code 0x73: Enable loudspeaker (builtin handsfree function)
- Code 0x74: Disable loudspeaker (builtin handsfree function)
- Code 0x75: "CTRL_BAT"
- Code 0x77 (with 4 Byte parameter): ???
- Code 0x78: "Read Alea" -> Output
- Code 0x79: ??? (long output)
- Code 0x85: Query position of flap (Output: 00 / 01)
- Code 0x88: ??? (Output: 01 69 C3 ...)
- Code 0x89: Reset phone
Thanks go out to the people in the Sagem MC939 Forum,
especially Maddde and Team 939 (Anonymous Coward & OverFloh). They made valuable fundamental
discoveries and found out how to read ram and prom. Good work! Thanks to Hufri for writing the German Translation!
Thanks to Etna for the new testing commands! Big thanks to Jack for telling me about the command to delete flash
fields! Thanks to XAtlan for the keypad testing command description! Thanks to Thomas for finding an error on this
page ;)
Last updated: 01.10.2002 (Error in command 0x7F response corrected)