[Bitpim-devel] Support for Kyocera 7135 (QC MSM5100)

Discussion:

Stephen Marchant

2004-03-14 13:32:58 UTC

Hello,
I found a slight BREW protocol difference with this phone...

Normally, you expect a file list response as below:
PACKET listfileresponse:
* responseheader header
4 UINT entrynumber
4 UNKNOWN unknown1
4 UINT date
4 UINT size
5 UNKNOWN unknown2
* STRING {'terminator': None, 'pascal': True} filename # no terminator
for some reason

But this phone has 5 "UNKNOWN" bytes before the remaining fields
(date,size,etc...)
Would it be possible to add this option in to support this phone?

Thanks!
-- Steve

-------------------------------------------------------------------------
22:09:25.594 SCP-5300: Now in brew mode
22:09:25.594 SCP-5300: brew request Data - 9 bytes
<#! p_brew.listfilerequest !#>
00000000 59 0b 00 00 00 00 02 2f 00 Y....../.
22:09:25.664 SCP-5300: brew response Data - 37 bytes
<#! p_brew.listfileresponse !#>
00000000 59 0b 00 00 00 00 00 01 1f 00 00 00 c1 83 1d 2c Y..............,
00000010 06 00 00 00 00 00 00 00 00 0b 75 69 62 75 69 6c ..........uibuil
00000020 64 2e 64 69 72 d.dir
-------------------------------------------------------------------------

Roger Binns

2004-03-14 23:07:14 UTC

Permalink

Post by Stephen Marchant
But this phone has 5 "UNKNOWN" bytes before the remaining fields
(date,size,etc...)
Would it be possible to add this option in to support this phone?

I would prefer something that works correctly against all models
(ie find the root cause of the problem). (BTW the VX4400 is
also based on the MSM5100).

I was hoping that the first or second of unknowns would give
some clue as to why the latter field is larger, but couldn't
find anything. However I would appreciate it if you could
put some more work into trying to figure out what these
fields actually are.

For unknown1, these are the values on the 3 phones I have:

VX6000 FF 00 01 00
CDM8900 FF 00 01 03 (last 03 is sometimes zero)
VX4400 FF 00 01 00

Unknown2 is almost always 00 followed by a four byte integer
that is usally the same as the entry number. It is always
a small value, usually less than 10.

So far it looks like we can use the first byte of unknown1 to
detect what is happening. Can everyone who doesn't have
one of the phones listed please turn on the protocol logging,
list a directory, and then press Ctrl-Alt-P in the protocol
log pane. Find a p_brew.listfileresponse, and expand it in
the second pane and write down what the value of the unknown1
field is. Feel free to also try and figure out what unknown2
is.

Roger

Tom Pollard

2004-03-15 00:04:24 UTC

Permalink

Post by Roger Binns
VX6000 FF 00 01 00
CDM8900 FF 00 01 03 (last 03 is sometimes zero)
VX4400 FF 00 01 00
Unknown2 is almost always 00 followed by a four byte integer
that is usally the same as the entry number. It is always
a small value, usually less than 10.
So far it looks like we can use the first byte of unknown1 to
detect what is happening. Can everyone who doesn't have
one of the phones listed please turn on the protocol logging,
list a directory, and then press Ctrl-Alt-P in the protocol
log pane. Find a p_brew.listfileresponse, and expand it in
the second pane and write down what the value of the unknown1
field is. Feel free to also try and figure out what unknown2
is.

It looks like unknown1 isn't simply a phone-dependent constant. After
listing the root directory on my VX4500, I found at least three
different values for unknown1 in different listfileresponse packets:

unknown1 unknown2
FF 00 00 00 00 02 00 00 00
FF 00 01 00 00 02 00 00 00
FF 00 01 03 00 02 00 00 00

Listing the ART directory, I get a few more variations:

FF 00 01 01 00 08 00 00 04
FF 00 01 01 00 06 00 00 04
FF 00 01 01 00 04 00 00 04
FF 00 01 01 00 30 00 00 04

Listing the OWS directory, I found:

FF 00 01 00 00 16 00 00 04
FF 00 01 00 00 02 00 00 04
FF 00 01 00 00 04 00 00 04

etc. There were additional variations for unknown2 in other
directories, but these are the only three values of unknown1 I've seen.
In all cases, the directory listing itself was successful.

Tom

Stephen Wood

2004-03-15 01:06:30 UTC

Permalink

... Can everyone who doesn't have
one of the phones listed please turn on the protocol logging,
list a directory, ...

I get a bit more variety in unknown1 and unknown2 with Sanyo phones.
With the SCP-5500 in the top directory, with 6 files I get

FF 00 01 03 00 02 00 00 00 $USER_DIRS
37 00 01 03 00 02 00 00 00 $SYS.FACTORY
FF 00 01 00 00 02 00 00 00 uivrState.dat
FF 00 01 00 00 02 00 00 00 CLK_DB
FF 00 00 00 00 02 00 00 00 RDM_PORT_MAP
FF 00 01 00 00 02 00 00 00 $SYS_RMT

On the SCP-4900 which has all these files except CLK_DB. The same
unknown codes match up with the same file names as the 5500.

Now if I go into a directory, say nvm on the 5500, it gets a little more
interesting.

37 00 01 03 00 02 00 00 04 nvm/$SYS.ESN
37 00 01 03 00 02 00 00 04 nvm/$SYS.INVAR1
37 00 01 03 00 02 00 00 04 nvm/$SYS.INVAR2
FF 00 01 03 00 02 00 00 04 nvm/$SYS.INVAR3

Now drilling down to down to nvm/nvm
file size
FF 00 01 03 00 04 00 00 08 nvm/nvm/nvm_0000 829
FF 00 01 03 00 82 00 00 08 nvm/nvm/nvm_0001 31976
FF 00 01 03 00 04 00 00 08 nvm/nvm/nvm_0002 716
FF 00 01 03 00 08 00 00 08 nvm/nvm/nvm_0003 1524
FF 00 01 03 00 02 00 00 08 nvm/nvm/nvm_0004 5
FF 00 01 03 00 10 00 00 08 nvm/nvm/nvm_0005 3809
FF 00 01 03 00 c4 00 00 08 nvm/nvm/nvm_0008 48200
FF 00 01 03 00 c4 00 00 08 nvm/nvm/nvm_0009 48200
FF 00 01 03 00 c4 00 00 08 nvm/nvm/nvm_0010 48200

So unknown 2 seems to be related to file size, but not by a nice power
of 2.

Then again, if I go into other directories, the second byte doesn't seem
connected to file size anymore??

I am sure this just adds more confusion.

Stephen

Roger Binns

2004-03-15 03:22:30 UTC

Permalink

Post by Roger Binns
VX6000 FF 00 01 00
CDM8900 FF 00 01 03 (last 03 is sometimes zero)
VX4400 FF 00 01 00
VX4500 FF 00 00 00
VX4500 FF 00 01 01
VX4500 FF 00 01 03
SCP5500 FF 00 01 03
SCP5500 37 00 01 03

Stephen Marchant

2004-03-15 13:40:43 UTC

Permalink

Hi again, sorry my previous email address was using auto-reply SPAM
filters...
Here's a directory listing of my 7135...

----------------------------------------------------------------------------
--------------------
Kyocera 7135 (MSM5100)
MZ1044

ListFileRequest
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 00 Size: 00006 File:
uibuild.dir
Unknown1: 01 FF 00 01 03 Unknown2: 00 04 00 00 00 Size: 001DC File:
$USER_DIRS
Unknown1: 01 FF 00 01 00 Unknown2: 00 02 00 00 00 Size: 00004 File:
$FIB_CHECKSUM
Unknown1: 01 FF 00 01 00 Unknown2: 00 08 00 00 00 Size: 00701 File:
$SYS_RMT
Unknown1: 01 FF 00 01 00 Unknown2: 00 02 00 00 00 Size: 00014 File:
$LINK_TIME
Unknown1: 01 00 00 FF 00 Unknown2: 00 02 00 00 00 Size: 00008 File:
$SYS_RMT_COUNT
Unknown1: 01 FF 00 01 00 Unknown2: 00 02 00 00 00 Size: 00173 File:
PRIData.txt
Unknown1: 01 FF 00 01 00 Unknown2: 00 40 00 00 00 Size: 03C76 File:
CarrierLogo.bmp
Unknown1: 01 FF 00 00 00 Unknown2: 00 02 00 00 0A Size: 0002C File:
user/apps/UP4BCfg.dat
Unknown1: 01 FF 00 01 00 Unknown2: 00 02 00 00 0A Size: 000B0 File:
user/apps/UP4BBearer.dat
Unknown1: 01 FF 00 00 00 Unknown2: 00 02 00 00 0A Size: 00078 File:
user/apps/UP4BPerm.dat
Unknown1: 01 FF 00 00 00 Unknown2: 00 92 00 00 0A Size: 08C00 File:
user/apps/UP4BCache.dat
Unknown1: 01 FF 00 01 00 Unknown2: 00 02 00 00 0E Size: 00180 File:
user/contacts/user.dat
Unknown1: 01 FF 00 01 00 Unknown2: 00 02 00 00 0E Size: 0001D File:
user/contacts/sys_pb
Unknown1: 01 FF 00 01 00 Unknown2: 00 02 00 00 0E Size: 00008 File:
user/contacts/user.idx
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 08 Size: 104E4 File:
ui/base/common.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 08 Size: 02E70 File:
ui/base/uirs.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0B Size: 07F78 File:
ui/lang/en/common.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0B Size: 095BC File:
ui/lang/es/common.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0B Size: 09964 File:
ui/lang/fr/common.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0B Size: 09330 File:
ui/lang/pt/common.bqr
Unknown1: 01 37 00 01 03 Unknown2: 00 02 00 00 04 Size: 00061 File:
nvm/$SYS.ESN
Unknown1: 01 37 00 01 03 Unknown2: 00 02 00 00 04 Size: 000C1 File:
nvm/$SYS.INVAR1
Unknown1: 01 37 00 01 03 Unknown2: 00 02 00 00 04 Size: 00087 File:
nvm/$SYS.INVAR2
Unknown1: 01 FF 00 01 03 Unknown2: 00 02 00 00 08 Size: 00032 File:
nvm/nvm/nvm_0000
Unknown1: 01 FF 00 01 03 Unknown2: 00 02 00 00 08 Size: 0006B File:
nvm/nvm/nvm_amps
Unknown1: 01 FF 00 01 03 Unknown2: 00 1C 00 00 08 Size: 01AD0 File:
nvm/nvm/nvm_display
Unknown1: 01 FF 00 01 03 Unknown2: 00 02 00 00 08 Size: 000C0 File:
nvm/nvm/nvm_security
Unknown1: 01 FF 00 01 03 Unknown2: 00 06 00 00 08 Size: 00553 File:
nvm/nvm/nvm_factory
Unknown1: 01 FF 00 01 03 Unknown2: 00 0E 00 00 08 Size: 00C81 File:
nvm/nvm/nvm_data
Unknown1: 01 FF 00 01 03 Unknown2: 00 04 00 00 08 Size: 002DF File:
nvm/nvm/nvm_cdma
Unknown1: 01 FF 00 01 03 Unknown2: 00 08 00 00 08 Size: 0068B File:
nvm/nvm/nvm_system
Unknown1: 01 FF 00 01 03 Unknown2: 00 02 00 00 08 Size: 00004 File:
nvm/nvm/nvm_serialport
Unknown1: 01 FF 00 01 03 Unknown2: 00 02 00 00 08 Size: 00007 File:
nvm/nvm/nvm_customer
Unknown1: 01 FF 00 01 03 Unknown2: 00 12 00 00 08 Size: 01006 File:
nvm/prl/prl_0000
Unknown1: 01 FF 00 01 03 Unknown2: 00 22 00 00 08 Size: 0200C File:
nvm/prl/prl_0001
Unknown1: 01 FF 00 01 00 Unknown2: 00 02 00 00 08 Size: 0007F File:
nvm/prl/eri1.bin
Unknown1: 01 FF 00 01 00 Unknown2: 00 02 00 00 08 Size: 0007F File:
nvm/prl/eri.bin
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 05 Size: 021EB File:
font/anlc12.bin
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 05 Size: 022ED File:
font/anlcbd12.bin
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 05 Size: 00870 File:
font/arialtal.bin
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 05 Size: 017E3 File:
font/levbd12.bin
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 05 Size: 021EB File:
font/levnm12.bin
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 05 Size: 00C15 File:
font/qicons12.bin
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0D Size: 00148 File:
apps/lang/pt/BreakOut.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0D Size: 00044 File:
apps/lang/pt/CalApp.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0D Size: 00210 File:
apps/lang/pt/CalcApp.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0D Size: 00294 File:
apps/lang/pt/ClockApps.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0D Size: 00044 File:
apps/lang/pt/MemoApp.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0D Size: 00358 File:
apps/lang/pt/QCOMControls.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0D Size: 004E8 File:
apps/lang/pt/UP4BApp.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0D Size: 00114 File:
apps/lang/pt/WAPSetup.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0D Size: 0012C File:
apps/lang/fr/BreakOut.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0D Size: 00044 File:
apps/lang/fr/CalApp.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0D Size: 00210 File:
apps/lang/fr/CalcApp.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0D Size: 00270 File:
apps/lang/fr/ClockApps.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0D Size: 00044 File:
apps/lang/fr/MemoApp.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0D Size: 00364 File:
apps/lang/fr/QCOMControls.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0D Size: 00554 File:
apps/lang/fr/UP4BApp.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0D Size: 00134 File:
apps/lang/fr/WAPSetup.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0D Size: 00154 File:
apps/lang/es/BreakOut.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0D Size: 00044 File:
apps/lang/es/CalApp.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0D Size: 00280 File:
apps/lang/es/CalcApp.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0D Size: 00280 File:
apps/lang/es/ClockApps.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0D Size: 00044 File:
apps/lang/es/MemoApp.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0D Size: 00350 File:
apps/lang/es/QCOMControls.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0D Size: 00528 File:
apps/lang/es/UP4BApp.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0D Size: 000E8 File:
apps/lang/es/WAPSetup.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0A Size: 00128 File:
apps/base/BreakOut.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0A Size: 00044 File:
apps/base/CalApp.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0A Size: 001E4 File:
apps/base/CalcApp.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0A Size: 0023C File:
apps/base/ClockApps.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0A Size: 0030C File:
apps/base/Launcher.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0A Size: 00044 File:
apps/base/MemoApp.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0A Size: 0033C File:
apps/base/QCOMControls.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0A Size: 003AC File:
apps/base/Space.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0A Size: 004CC File:
apps/base/UP4BApp.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 0A Size: 00110 File:
apps/base/WAPSetup.bqr
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 10 Size: 00B5C File:
VoiceDB/Lang/fr/fcadat_sd1.dtw
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 10 Size: 0B1FC File:
VoiceDB/Lang/fr/fcadat_sd1.prm
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 10 Size: 00B5C File:
VoiceDB/Lang/es/spadat_sd1.dtw
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 10 Size: 0EABC File:
VoiceDB/Lang/es/spadat_sd1.prm
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 10 Size: 04F24 File:
VoiceDB/Lang/en/engdat1.dtw
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 10 Size: 057BA File:
VoiceDB/Lang/en/engdat1.hmm
Unknown1: 01 1F 00 00 00 Unknown2: 00 00 00 00 10 Size: 0EAF4 File:
VoiceDB/Lang/en/engdat1.prm
Unknown1: 01 FF 00 01 00 Unknown2: 00 66 00 00 15 Size: 06280 File:
VoiceDB/All/Patterns/NameTag.int
Unknown1: 01 FF 00 01 00 Unknown2: 00 16 00 00 15 Size: 014BC File:
VoiceDB/All/Patterns/CtrlWrd.int
Unknown1: 01 FF 00 01 00 Unknown2: 00 02 00 00 12 Size: 00004 File:
VoiceDB/All/Memos/NextMemo.int
Unknown1: 01 FF 00 00 00 Unknown2: 00 0A 00 00 12 Size: 0087E File:
VoiceDB/All/Memos/Mem00017.qcp
Unknown1: 01 FF 00 00 00 Unknown2: 00 08 00 00 12 Size: 00614 File:
VoiceDB/All/Memos/Mem00018.qcp
Unknown1: 01 FF 00 00 00 Unknown2: 00 0C 00 00 12 Size: 00A84 File:
VoiceDB/All/Memos/Mem00021.qcp
Unknown1: 01 FF 00 00 00 Unknown2: 00 12 00 00 12 Size: 0101C File:
VoiceDB/All/Memos/Mem00022.qcp
Unknown1: 01 FF 00 00 00 Unknown2: 00 2E 00 00 12 Size: 02ADC File:
VoiceDB/All/Memos/Mem00023.qcp
Unknown1: 01 FF 00 00 00 Unknown2: 00 CE 01 00 12 Size: 1BEDE File:
VoiceDB/All/Memos/Mem00025.qcp
----------------------------------------------------------------------------
--------------------------

My deduction is that the unknown2 field 5th byte is the length of the
pathname string and the next byte is the length of the filename string.

Additionally, I'm guessing that the first byte of "unknown1" is a flag for
01 meaning an "extended" field of 5 bytes, with the next dword being a set
of flags (1F=system, 37=read only, FF=all, ???). What is also interesting is
that files with the Unknown byte "1F" above are all in "ROM" and don't take
up EFS space, and therefore the Unknown2 dword field is all zeroes.

So my next guess is that the first dword of Unknown2 is the EFS file space
taken up by the file (which implies even boundaries of 256 bytes and
therefore the first byte of '00'). It also looks like there is a minimum of
"200h" bytes for a file which is the minimum for a block size of up to 100h
bytes plus the additional header info.

Hope this helps, Thanks!
-- Steve Marchant

-----Original Message-----
From: bitpim-devel-***@lists.sourceforge.net
[mailto:bitpim-devel-***@lists.sourceforge.net]On Behalf Of Roger
Binns
Sent: Sunday, March 14, 2004 10:23 PM
To: bitpim-***@lists.sourceforge.net
Subject: Re: [Bitpim-devel] Support for Kyocera 7135 (QC MSM5100)

I also had the CDM8900 have 37 as first byte of unknown1
after looking in several other directories.

So it doesn't look like unknown1 can be used as a useful predictor
of the extra byte for the Kyocera 7135 (incidentally Kyocera typically
just rebadge Qualcomm phones and hence are closest to the "real thing").

The second byte of unknown2 seems to be somewhat related to file
size. (The protocol uses a block size of 256 bytes).

Hopefully Stephgen Marchant can figure out some form of indicator
since I really don't want to have variations on the brew protocol.
(I will do so if there is no choice).

Roger

-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click