Undocumented data-cable commands
for Sagem 9xx series mobile phones


Warning / Disclaimer:

Using the undocumented commands can result in permanent damage to your phone. If you decide to try the commands, you do so at your own risk. Sagem phones are known to be quite sensitive regarding hacking attempts, and will lock themselves very quickly. Sagem is a registered trademark of SAGEM SA.

Thanks to Hufri, a German version of this Document is now available.


Contents:

 


 Basic Command Structure 

All commands follow the same basic structure: (hex representation)

02 LL D2 05 00 CC [PP] CC 03
Each command must begin with the start code (02), followed by the total length of the command string - 4 and the two-byte constant (D2 05). The (00)-byte signals that this string is a command (Response strings have a (01) here). The command code (CC) determines which command is to be issued. Depending on which command is issued, parameters of variable length can be passed along with the command. The checksum (CC) is calculated by XOR-ing all bytes except the checksum byte and the end code (03).

 Basic Response Structure 

Responses from the phone have a structure similar to the command structure: (hex representation)

02 LL D2 05 01 RR [VV] CC 03
As with command codes, each response begins with the start code (02), followed by the total length of the response string - 4 and the two-byte constant (D2 05). The (01)-byte signals that this string is a response. The response code (RR) determines the type of the response, and is dependent on the command issued. Most response types also return a value (VV) of variable length, for example the requested prom field. The checksum (CC) is calculated by XOR-ing all bytes except the checksum byte and the end code (03).

If the command is not accepted by the phone, an error message is returned:

02 05 D2 05 01 45 [CO] [CC] 03


 Reading / writing the EEPROM 


The eeproms contained in Sagem phones are divided into several logical fields. The internal structure of how fields are stored is quite complicated, and although the fields are numbered, they are not stored sequentially. Fields 0 to 999 can be accessed with these commands.

Code 0x44: read prom

Command Syntax:

02 06 D2 05 00 44 [A1] [A2] [CC] 03

With

Response from phone:

02 [LL] D2 05 01 3B [DD] [BB] [CC] 03

With


Code 0x45: write prom

Command Syntax:

02 [LL] D2 05 00 45 [A1] [A2] [DD] [BB] [CC] 03

With

Response from phone:

02 [LL] D2 05 01 44 [A1] [A2] [DD] [BB] [CC] 03

With


Code 0x81: resize / delete prom field

Command Syntax:

02 08 D2 05 00 81 [A1] [A2] [L1] [L2] [CC] 03

With

It is recommended to keep the length < 32 bytes.
If fields get longer than this, they can no longer be written via cable, though they can still be resized/deleted.

Response from phone:

02 08 D2 05 01 7B [A1] [A2] [L1] [L2] [CC] 03

With



 Reading / writing the Flash 

Field numbers in the range 1024 to 16383 are referred to as "flash" in the sagem menus.

Code 0x7C: read flash

Command Syntax:

02 06 D2 05 00 7C [A1] [A2] [CC] 03

With

Response from phone:

02 [LL] D2 05 01 76 [DD] [CC] 03

With


Code 0x7D: write flash

Command Syntax:

02 [LL] D2 05 00 7D [A1] [A2] [NN] [DD] [CC] 03

With

Response from phone:

02 [LL] D2 05 01 77 [A1] [A2] [NN] [DD] [CC] 03

With


Code 0x80: resize / delete flash field

Command Syntax:

02 08 D2 05 00 80 [A1] [A2] [L1] [L2] [CC] 03

With

Setting the length to 0 will delete the field.


Response from phone:

02 08 D2 05 01 7A [A1] [A2] [L1] [L2] [CC] 03

With


Code 0x82: read length of flash field

Command Syntax:

02 06 D2 05 00 82 [A1] [A2] [CC] 03

With

Response from phone:

02 06 D2 05 01 7C [N1] [N2] [CC] 03

With


The following commands can be used to deal with long flash fields:

These fields can have a length > 240 bytes, but they can not be read or written with the
normal flash commands. Instead, you must read/write several smaller portions of the field in
separate steps.

Code 0x7E: read portion of long flash field

Command Syntax:

02 09 D2 05 00 7E [A1] [A2] [O1] [O2] [NN] [CC] 03

With

Response from phone:

02 [LL] D2 05 01 78 [DD] [CC] 03

With


Code 0x7F: write portion of long flash field

Command Syntax:

02 [LL] D2 05 00 7F [A1] [A2] [O1] [O2] [NN] [DD] [CC] 03

With

Response from phone:

02 [LL] D2 05 01 79 [A1] [A2] [NN] [DD] [CC] 03

With



 Reading / writing the RAM 


Code 0x15: read ram

Command Syntax:

02 09 D2 05 00 15 [A1] [A2] [A3] [A4] [NN] [CC] 03

With

Response from phone:

02 [LL] D2 05 01 2E [DD] [CC] 03

With


Code 0x16: write ram

Command Syntax:

02 LL D2 05 00 16 [A1] [A2] [A3] [A4] [DD] [CC] 03

With

Response from phone:

02 LL D2 05 01 40 [A1] [A2] [A3] [A4] [DD] [CC] 03

With



 Get phone information 


This command returns an ascii string containing information about the phone's firmware revision and the date of production.

Code 0x23: get phone information string

Command Syntax:

02 04 D2 05 00 23 F2 03

Response from phone:

02 [LL] D2 05 01 35 [DD] [CC] 03

With



 Enter service mode on phone 


This command will enable the service mode on the phone.

Code 0x52: enter service mode

Command Syntax:

02 04 D2 05 00 52 83 03

Response from phone:

02 04 D2 05 01 4C 9C 03


 Test LCD screen 


This command performs tests with the display and the LED of the phone.

Code 0x54: test lcd

(The same test pictures can also be accessed from the hotline menu on the phone)

Command Syntax:

02 05 D2 05 00 54 [PP] [CC] 03

With


Response from phone:

02 05 D2 05 01 4E [PP] [CC] 03

With

Code 0x55: finish lcd test

Command Syntax:

02 04 D2 05 00 55 84 03

Response from phone:

02 04 D2 05 01 4F 9F 03

 Display Contrast Settings 


This command allows you to set the contrast setttings of the phone's display.

Code 0x6E: set display contrast settings

Command Syntax:

02 05 D2 05 00 6E [PP] [CC] 03

With


Response from phone:

02 05 D2 05 01 68 [P1] [CC] 03

With


 Test Ring Sounds 


This command will test ring sounds of the phone.

Code 0x56: test ring sound

Command Syntax:

02 06 D2 05 00 56 [P1] [P2] [CC] 03

With


Response from phone:

02 06 D2 05 01 50 [P1] [P2] [CC] 03

With

Code 0x57: finish ring sound test

Command Syntax:

02 04 D2 05 00 57 [CC] 03

Response from phone:

02 04 D2 05 01 51 [CC] 03

 Test Vibra Alarm 


This command will test the vibrator alarm feature of the phone.

Code 0x69: turn vibra on

Command Syntax:

02 04 D2 05 00 69 B8 03

Response from phone:

02 04 D2 05 01 63 B3 03

Code 0x6A: turn vibra off

Command Syntax:

02 04 D2 05 00 6A BB 03

Response from phone:

02 04 D2 05 01 64 B4 03


 Test phone keypad 


The following commands test the keypad of the phone.

Code 0x4F: enter keypad testing mode

This command puts the phone in a special keypad testing mode: if a button is pressed, the event is recorded, but the phone does not react to the button press in the normal way.

Command Syntax:

02 04 D2 05 00 4F 9E 03

Response from phone:

02 04 D2 05 01 49 99 03

Code 0x50: leave keypad testing mode

This command leaves the keypad testing mode on the phone so the keypad can be used normally.

Command Syntax:

02 04 D2 05 00 50 81 03

Response from phone:

02 04 D2 05 01 4A 9A 03

Code 0x51: request pressed buttons in keypad test mode

If the phone is in keypad testing mode, this command requests a list of buttons pressed since the start of the keypad test or the last requested list.

Command Syntax:

02 04 D2 05 00 51 80 03

Response from phone:

02 0A D2 05 01 4B 05 [D1] [D2] [D3] 00 00 [CC] 03

With

 Remote Control (Keypad Simulation) 


The following commands can simulate keypresses on the phone.

They use a different header structure with the value '07 1E' as the 4. and 5. bytes of the command.

Code 0x1E: Simulate keypress

The command is different for the different phone models:

For 93X type phones:

Command Syntax:

02 [LL] D2 07 1E [SS] [DD] [CC] 03

With

For 93X type phones, the name parameter is a Null-terminated ASCII-string of the key name:

For 922 type phones:

Command Syntax:

02 04 D2 02 00 [DD] [CC] 03

With

For the 922 phone, the key code is a single byte:


 Read Phone Connection Status 

This commands reads information about the presence of the sim card and the connection status.

Code 0x68: read sim / connection information

Command Syntax:

02 04 D2 05 00 68 [CC] 03

Response from phone:

02 06 D2 05 01 62 [D1] [D2] [CC] 03

With




 Misc. Commands 


The following list contains some commands that are still not fully understood. They all are valid commands, but they can have unknown side effects on the phone, so please do not try them unless you are sure you know what you are doing. Even if an obvious effect is described here, there might be errors in the description. You have been warned...

The output strings are responses I got from my phone. Your phone might produce different outputs.

Possible command codes found so far:

 Credits 


Thanks go out to the people in the
Sagem MC939 Forum, especially Maddde and Team 939 (Anonymous Coward & OverFloh). They made valuable fundamental discoveries and found out how to read ram and prom. Good work! Thanks to Hufri for writing the German Translation! Thanks to Etna for the new testing commands! Big thanks to Jack for telling me about the command to delete flash fields! Thanks to XAtlan for the keypad testing command description! Thanks to Thomas for finding an error on this page ;)

Last updated: 01.10.2002 (Error in command 0x7F response corrected)