m-obex protocol used by some Samsung mobiles
This document is copied from <http://code.google.com/p/samsyncro/wiki/mobex> and extended.
Introduction
This is an attempt to document the m-obex protocol. It is a obex-variation by Samsung used to exchange PIM data and files over bluetooth.
This documentation is by no means complete but is only a reference for the samsyncro implementation. As I don’t know the obex protocol I can’t say in which parts it differs from the standard-obex. The only thing I found strange is the fact, that you will always get 0xA0 as a response. Which means Ok, success in obex. If there was an error you will find it’s error code in the 0x42 header. If this is a normal behavior: Why are there so many response codes defined?
The information about the protocol was gained by listening to the transferred data from Samsungs New PC Studio to a SGH-F480i and B2100 mobile.
Requirements
Established bluetooth connection to the serial channel of the mobile
Some way to access this serial port. For example minicom.
Starting the obex server
To start the obex server you have to send this AT command first:
AT+SYNCML=MOBEXSTART
Some phones seem to start with following command:
AT$TSSPCSW=1
Obex commands
In the following chapters I will describe the obex packages to read and edit data on the mobile. I think most of them are in standard-obex format and are following this structure:
Package Header |
Session Id |
Obex Header(s) |
|---|---|---|
|
|
|
For detailed information about obex, for example what types of packages and headers exists, get the official Obex documentation from Infared Data Association. But I don’t know if this is available for free.
Here is a list of the most used types for the Samsung mobiles:
There exists mainly two types of operations: Put (package header 0x02 and 0x82) to write data to the mobile and Get (package header 0x03 and 0x83) to retrieve data from the mobile. A put or get operation can be divided into several packages. The high-bit indicates if this is the last package of an operation. For example if you want to transfer a file to the mobile you send n-time 0x02 packages and only the last one is 0x82.
Headers consists normally out of three blocks: First byte: Header type, second and third byte: length of the header (if the headers length is variable), following bytes: data. The most used header types are
Obex description |
Byte |
following two bytes |
following bytes |
|---|---|---|---|
Name |
0x01 |
length of header |
Used for filesystem operation to name a path or file |
Type |
0x42 |
length of header |
Obex command for example “m-obex/contacts/list” |
Length |
0xC3 |
Used in put operations and specifies the length of the transferred data (without header bytes). The length is represented in 4 bytes. |
|
Body |
0x48 |
length of header |
Data in a multi-package put operation |
End of Bady |
0x49 |
length of header |
Last data package in a put operation |
Session id |
0xCB |
Four bytes representing the session id. Needed for multiplexing |
|
Application Parameter |
0X4C |
length of header |
In a request: Parameters for example a contact’s id. <p>In an answer: The error/return code. If it is 0x00 0x00 than the operation was successful |
Contacts
Get contacts count
Request
- 83 00 25
Obex Get
- CB 00 00 00 00
Session Id
- 42 00 19 6D 2D 6F 62 65 78 2F 63 6F 6E 74 61 63 74 73 2F 63 6F 75 6E 74 00
m-obex command: m-obex/contacts/count
- 4C 00 04 01
Unknown! Didn’ see PC Studio sending something other than 0x01 as parameter
Answer
- A0 00 14
Obex ok
- C3 00 00 00 04
Maybe the number of requests you have to send to get all contacts. See next chapter for more information
- 4C 00 05 00 00
Error code
- 49 00 07 07 D0 00 18
First two data bytes: maximum number of contacts (0x07D0 = 2000). Last two data bytes: Current number of contacts
List all
Request
- 83 00 26
Obex Get package
- CB 00 00 00 00
Session Id
- 42 00 18 6D 2D 6F 62 65 78 2F 63 6F 6E 74 61 63 74 73 2F 6C 6F 61 64 00
m-obex Command: m-obex/contacts/load
- 4C 00 06 01 00 00
First Byte unknown. Last two bytes: increment until all contacts received
Answer
- A0 08 C1
Obex Ok
- C3 00 00 08 B1
Length of sent data
- 4C 00 05 00 02
Indicates if these are the last contacts
- 49 07 41 01 10 01 8D ….”
The first byte is unknown but all answers have this byte, then byte 2 and 3 contains the length of the answer, bytes 4 and 5 are the ID of the first entry bytes 6 and 7 are the length of this entry.
In one response more than 1 vcard can be returned in this case, entries are separated by 4 bytes with the following meaning: bytes 1 and 2 ID of the entry, bytes 3 and 4: length of the entry.
To get all contacts the request have to be sent several times. The last two bytes must be incremented by every call.
The end of the contacts list is reached if the header 0x4C is 0. The header will be 4C 00 05 00 00.
Create a contact
Beware: This is a put operation and is performed in some obex implementations in several packages (for example 0x02, 0x02, 0x82). But I didn’t get the mobile to accept this. I had to create/update PIM data in exactly one package.
Request
- 82 00 88
Obex put
- CB 00 00 00 00
Session id
- 42 00 1A 6D 2D 6F 62 65 78 2F 63 6F 6E 74 61 63 74 73 2F 63 72 65 61 74 65 00
m-obex/contacts/create
- 4C 00 04 01
? maybe flag for internal/external memory
- C3 00 00 00 5A
Length of the vcard string
- 49 00 5D 42 45….
Contact as vcard
Answer
- A0 00 12
Obex ok
- C3 00 00 00 02
?
- 4C 00 05 00 00
Error code
- 49 00 05 00 21
last two bytes: the id of the newly created contact
Update a contact
Beware: This is a put operation and is performed in some obex implementations in several packages (for example 0x02, 0x02, 0x82). But I didn’t get the mobile to accept this. I had to create/update PIM data in exactly one package.
Request
- 82 00 8D
Obex put
- CB 00 00 00 00
Session id
- 42 00 19 6D 2D 6F 62 65 78 2F 63 6F 6E 74 61 63 74 73 2F 77 72 69 74 65 00
m-obex/contacts/write
- 4C 00 06 01 00 20
Id of the contact which should be updated
- C3 00 00 00 5E
Length of the vcard string
- 49 00 61 42…
Contact as vcard
Answer
- A0 00 08
Obex ok
- 4C 00 05 00 00
Error code: 0x00 0x00 means successful
Read one contact
There is also the possibility to read exactly one contact.
Request
- 83 00 26
Obex get
- CB 00 00 00 00
Session id
- 42 00 18 6D 2D 6F 62 65 78 2F 63 6F 6E 74 61 63 74 73 2F 72 65 61 64 00
m-obex/contacts/read
- 4C 00 06 01 00 20
First byte:? Last two bytes: Id of contact
Answer
- A0 00 C4
Obex ok
- C3 00 00 00 B4
Length of vcard (without headers, just data)
- 4C 00 05 00 00
Error code
- 49 00 B7 42 45 47 49 4E …
contact as vcard. TODO: where is id? First two bytes?
Delete contact
To delete a contact you only have to know it’s id.
Request
- 82 00 28
Obex put
- CB 00 00 00 00
Session id
- 42 00 1A 6D 2D 6F 62 65 78 2F 63 6F 6E 74 61 63 74 73 2F 64 65 6C 65 74 65 00
m-obex/contacts/delete
- 4C 00 06 01 00 19
First byte: ? Last two bytes: Id of contact
Answer
- A0 00 08
Obex ok
- 4C 00 05 00 00
Error code
Calendar
Get count
Request
- 83 00 25
Obex get
- CB 00 00 00 00
Session id
- 42 00 19 6D 2D 6F 62 65 78 2F 63 61 6C 65 6E 64 61 72 2F 63 6F 75 6E 74 00
m-obex/calendar/count
- 4C 00 04 FF
?
Answer
- A0 00 1C
Obex ok
- C3 00 00 00 0C
length of data
- 4C 00 05 00 00
Error code
- 49 00 0F 01 2C 00 06 00 64 00 00 00 64 00 00
?TODO?
List all
Request
- 83 00 20
Obex get
- CB 00 00 00 00
Session id
- 42 00 18 6D 2D 6F 62 65 78 2F 63 61 6C 65 6E 64 61 72 2F 69 6E 66 6F 00
m-obex/calendar/load
Answer
- A0 00 C0
Obex ok
- C3 00 00 00 B0
Session
- 4C 00 05 00 00
Error code
- 49 00 B3 01 07 08 00 00 00 00 00 00 00 00 …
Calendar items in vcalendar format. TODO: where are the ids?
Create
Request
- 82 00 CC
Obex put
- CB 00 00 00 00
Session
- 42 00 1A 6D 2D 6F 62 65 78 2F 63 61 6C 65 6E 64 61 72 2F 63 72 65 61 74 65 00
m-obex/calendar/create
- 4C 00 04 01
?
- C3 00 00 00 9E
Length of vcalendar
- 49 00 A1 42 45 47 49 4E 3A 56 43 41 4C 45 …
vcalendar
Answer
- A0 00 12
Obex ok
- C3 00 00 00 02
Length
- 4C 00 05 00 00
Error code
- 49 00 05 00 06
Id of the created item
Update
Request
- 82 00 F7
Obex put
- CB 00 00 00 00
Session
- 42 00 19 6D 2D 6F 62 65 78 2F 63 61 6C 65 6E 64 61 72 2F 77 72 69 74 65 00
m-obex/calendar/write
- 4C 00 06 01 00 05
First byte: ? Second and third byte: Id of the item
- C3 00 00 00 C8
Length of vcalendar
- 49 00 CB 42 45 47 49 4E 3A 56
vcalendar item
Answer
- A0 00 08
Obex ok
- 4C 00 05 00 00
Error code
Read
Request
- 83 00 26
Obex get
- CB 00 00 00 00
Session
- 42 00 18 6D 2D 6F 62 65 78 2F 63 61 6C 65 6E 64 61 72 2F 72 65 61 64 00
m-obex/calendar/read
- 4C 00 06 01 00 06
Id of calendar item
Answer
- A0 00 C0
Obex ok
- C3 00 00 00 B0
Length
- 4C 00 05 00 00
Error code
- 49 00 B3 42 45 47 49 4E 3A 56 43 41 4C 45 4E 44 41 52 0D 0A 56 45 52 53 49 4F 4E 3A 31 2E 3….
vcalendar item. TODO: Where is the id?
Delete
Request
- 82 00 28
Obex put
- CB 00 00 00 00
Session
- 42 00 1A 6D 2D 6F 62 65 78 2F 63 61 6C 65 6E 64 61 72 2F 64 65 6C 65 74 65 00
m-obex/calendar/delete
- 4C 00 06 01 00 06
id of calendar item
Notes
Tasks
Files
To get the file structure on the mobile, there are two commands. One that lists all subdirectories and one that lists all files.
List directories
List files
Get file
Create file
Delete file
SMS
0x01: Inbox 0x08: Outbox
Get sms count
List all sms
Send sms
Create sms
I don’t think this is possible. At least I didn’t find the function in New PC Studio. So sadly there will be no backup of sms messages.