Hi.

I am currently trying to "reverse engineer" the serial protocol used
by my Siemens GSM mobile.

So far I could only bring the phone to output 3 data messages. From
them I figured the following:


It is a TTL level full duplex 8N1 link at 57600bps. Both devices, host
and mobile, can initiate a data transfer.

A transfer is split into two parts, header and body.  The header is
3 bytes long.  The data body is of variable length - the 2nd header
byte indicates how long it is.


The three packets I received so far are:

#1      06 06 00    0d 0a 4f 4b 0d 0a
           ^^len          "OK"

#2      05 05 00    0f 00 00 00 00
           ^^len

#3      09 10 19    45 58 49 54 3 20 30 32 30 35 20 30 43 20 20 38
           ^^len    "EXIT: 0205 0C  8"

The #1 message is automatically output after powerup.

The #2 is a response to a packet I figured out by sending random data
(the packet I send is 05 05 00 0d 0a 05 05 00 0d 0a, which is probably
not a valid one, but triggers response #2).

Msg #3 comes when the phone is fed up receiving random data from
me, and shuts off. The data ASCII part varies from time to time.


What I think is that the first header byte indicates the message
type, like DEBUG, etc. Maybe it's a channel id to direct commands
and messages to their addressees.



Have you seen a similar protocol already?  I don't think that Siemens
has developed something new, I rather think they  use a protocol
that earlier products contain, too.

If you recognize something, please send me email!! Thanks a lot!