m-obex protocol used by some Samsung mobiles

This document is copied from <http://code.google.com/p/samsyncro/wiki/mobex> and extended.

Introduction

This is an attempt to document the m-obex protocol. It is a obex-variation by Samsung used to exchange PIM data and files over bluetooth.

This documentation is by no means complete but is only a reference for the samsyncro implementation. As I don’t know the obex protocol I can’t say in which parts it differs from the standard-obex. The only thing I found strange is the fact, that you will always get 0xA0 as a response. Which means Ok, success in obex. If there was an error you will find it’s error code in the 0x42 header. If this is a normal behavior: Why are there so many response codes defined?

The information about the protocol was gained by listening to the transferred data from Samsungs New PC Studio to a SGH-F480i and B2100 mobile.

Requirements

  • Established bluetooth connection to the serial channel of the mobile

  • Some way to access this serial port. For example minicom.

Starting the obex server

To start the obex server you have to send this AT command first:

AT+SYNCML=MOBEXSTART

Some phones seem to start with following command:

AT$TSSPCSW=1

Obex commands

In the following chapters I will describe the obex packages to read and edit data on the mobile. I think most of them are in standard-obex format and are following this structure:

Package Header

Session Id

Obex Header(s)

  • First byte: Type of request.

  • Second and third bytes: length of package

  • 0xCB and four bytes of session id

  • First byte: Type of header.

  • Second and third bytes: length of header.

  • Next bytes: data.

  • Last byte: 0x00

For detailed information about obex, for example what types of packages and headers exists, get the official Obex documentation from Infared Data Association. But I don’t know if this is available for free.

Here is a list of the most used types for the Samsung mobiles:

There exists mainly two types of operations: Put (package header 0x02 and 0x82) to write data to the mobile and Get (package header 0x03 and 0x83) to retrieve data from the mobile. A put or get operation can be divided into several packages. The high-bit indicates if this is the last package of an operation. For example if you want to transfer a file to the mobile you send n-time 0x02 packages and only the last one is 0x82.

Headers consists normally out of three blocks: First byte: Header type, second and third byte: length of the header (if the headers length is variable), following bytes: data. The most used header types are

Obex description

Byte

following two bytes

following bytes

Name

0x01

length of header

Used for filesystem operation to name a path or file

Type

0x42

length of header

Obex command for example “m-obex/contacts/list”

Length

0xC3

Used in put operations and specifies the length of the transferred data (without header bytes). The length is represented in 4 bytes.

Body

0x48

length of header

Data in a multi-package put operation

End of Bady

0x49

length of header

Last data package in a put operation

Session id

0xCB

Four bytes representing the session id. Needed for multiplexing

Application Parameter

0X4C

length of header

In a request: Parameters for example a contact’s id. <p>In an answer: The error/return code. If it is 0x00 0x00 than the operation was successful

Contacts

Get contacts count

Request

83 00 25

Obex Get

CB 00 00 00 00

Session Id

42 00 19 6D 2D 6F 62 65 78 2F 63 6F 6E 74 61 63 74 73 2F 63 6F 75 6E 74 00

m-obex command: m-obex/contacts/count

4C 00 04 01

Unknown! Didn’ see PC Studio sending something other than 0x01 as parameter

Answer

A0 00 14

Obex ok

C3 00 00 00 04

Maybe the number of requests you have to send to get all contacts. See next chapter for more information

4C 00 05 00 00

Error code

49 00 07 07 D0 00 18

First two data bytes: maximum number of contacts (0x07D0 = 2000). Last two data bytes: Current number of contacts

List all

Request

83 00 26

Obex Get package

CB 00 00 00 00

Session Id

42 00 18 6D 2D 6F 62 65 78 2F 63 6F 6E 74 61 63 74 73 2F 6C 6F 61 64 00

m-obex Command: m-obex/contacts/load

4C 00 06 01 00 00

First Byte unknown. Last two bytes: increment until all contacts received

Answer

A0 08 C1

Obex Ok

C3 00 00 08 B1

Length of sent data

4C 00 05 00 02

Indicates if these are the last contacts

49 07 41 01 10 01 8D ….”

The first byte is unknown but all answers have this byte, then byte 2 and 3 contains the length of the answer, bytes 4 and 5 are the ID of the first entry bytes 6 and 7 are the length of this entry.

In one response more than 1 vcard can be returned in this case, entries are separated by 4 bytes with the following meaning: bytes 1 and 2 ID of the entry, bytes 3 and 4: length of the entry.

To get all contacts the request have to be sent several times. The last two bytes must be incremented by every call.

The end of the contacts list is reached if the header 0x4C is 0. The header will be 4C 00 05 00 00.

Create a contact

Beware: This is a put operation and is performed in some obex implementations in several packages (for example 0x02, 0x02, 0x82). But I didn’t get the mobile to accept this. I had to create/update PIM data in exactly one package.

Request

82 00 88

Obex put

CB 00 00 00 00

Session id

42 00 1A 6D 2D 6F 62 65 78 2F 63 6F 6E 74 61 63 74 73 2F 63 72 65 61 74 65 00

m-obex/contacts/create

4C 00 04 01

? maybe flag for internal/external memory

C3 00 00 00 5A

Length of the vcard string

49 00 5D 42 45….

Contact as vcard

Answer

A0 00 12

Obex ok

C3 00 00 00 02

?

4C 00 05 00 00

Error code

49 00 05 00 21

last two bytes: the id of the newly created contact

Update a contact

Beware: This is a put operation and is performed in some obex implementations in several packages (for example 0x02, 0x02, 0x82). But I didn’t get the mobile to accept this. I had to create/update PIM data in exactly one package.

Request

82 00 8D

Obex put

CB 00 00 00 00

Session id

42 00 19 6D 2D 6F 62 65 78 2F 63 6F 6E 74 61 63 74 73 2F 77 72 69 74 65 00

m-obex/contacts/write

4C 00 06 01 00 20

Id of the contact which should be updated

C3 00 00 00 5E

Length of the vcard string

49 00 61 42…

Contact as vcard

Answer

A0 00 08

Obex ok

4C 00 05 00 00

Error code: 0x00 0x00 means successful

Read one contact

There is also the possibility to read exactly one contact.

Request

83 00 26

Obex get

CB 00 00 00 00

Session id

42 00 18 6D 2D 6F 62 65 78 2F 63 6F 6E 74 61 63 74 73 2F 72 65 61 64 00

m-obex/contacts/read

4C 00 06 01 00 20

First byte:? Last two bytes: Id of contact

Answer

A0 00 C4

Obex ok

C3 00 00 00 B4

Length of vcard (without headers, just data)

4C 00 05 00 00

Error code

49 00 B7 42 45 47 49 4E …

contact as vcard. TODO: where is id? First two bytes?

Delete contact

To delete a contact you only have to know it’s id.

Request

82 00 28

Obex put

CB 00 00 00 00

Session id

42 00 1A 6D 2D 6F 62 65 78 2F 63 6F 6E 74 61 63 74 73 2F 64 65 6C 65 74 65 00

m-obex/contacts/delete

4C 00 06 01 00 19

First byte: ? Last two bytes: Id of contact

Answer

A0 00 08

Obex ok

4C 00 05 00 00

Error code

Calendar

Get count

Request

83 00 25

Obex get

CB 00 00 00 00

Session id

42 00 19 6D 2D 6F 62 65 78 2F 63 61 6C 65 6E 64 61 72 2F 63 6F 75 6E 74 00

m-obex/calendar/count

4C 00 04 FF

?

Answer

A0 00 1C

Obex ok

C3 00 00 00 0C

length of data

4C 00 05 00 00

Error code

49 00 0F 01 2C 00 06 00 64 00 00 00 64 00 00

?TODO?

List all

Request

83 00 20

Obex get

CB 00 00 00 00

Session id

42 00 18 6D 2D 6F 62 65 78 2F 63 61 6C 65 6E 64 61 72 2F 69 6E 66 6F 00

m-obex/calendar/load

Answer

A0 00 C0

Obex ok

C3 00 00 00 B0

Session

4C 00 05 00 00

Error code

49 00 B3 01 07 08 00 00 00 00 00 00 00 00 …

Calendar items in vcalendar format. TODO: where are the ids?

Create

Request

82 00 CC

Obex put

CB 00 00 00 00

Session

42 00 1A 6D 2D 6F 62 65 78 2F 63 61 6C 65 6E 64 61 72 2F 63 72 65 61 74 65 00

m-obex/calendar/create

4C 00 04 01

?

C3 00 00 00 9E

Length of vcalendar

49 00 A1 42 45 47 49 4E 3A 56 43 41 4C 45 …

vcalendar

Answer

A0 00 12

Obex ok

C3 00 00 00 02

Length

4C 00 05 00 00

Error code

49 00 05 00 06

Id of the created item

Update

Request

82 00 F7

Obex put

CB 00 00 00 00

Session

42 00 19 6D 2D 6F 62 65 78 2F 63 61 6C 65 6E 64 61 72 2F 77 72 69 74 65 00

m-obex/calendar/write

4C 00 06 01 00 05

First byte: ? Second and third byte: Id of the item

C3 00 00 00 C8

Length of vcalendar

49 00 CB 42 45 47 49 4E 3A 56

vcalendar item

Answer

A0 00 08

Obex ok

4C 00 05 00 00

Error code

Read

Request

83 00 26

Obex get

CB 00 00 00 00

Session

42 00 18 6D 2D 6F 62 65 78 2F 63 61 6C 65 6E 64 61 72 2F 72 65 61 64 00

m-obex/calendar/read

4C 00 06 01 00 06

Id of calendar item

Answer

A0 00 C0

Obex ok

C3 00 00 00 B0

Length

4C 00 05 00 00

Error code

49 00 B3 42 45 47 49 4E 3A 56 43 41 4C 45 4E 44 41 52 0D 0A 56 45 52 53 49 4F 4E 3A 31 2E 3….

vcalendar item. TODO: Where is the id?

Delete

Request

82 00 28

Obex put

CB 00 00 00 00

Session

42 00 1A 6D 2D 6F 62 65 78 2F 63 61 6C 65 6E 64 61 72 2F 64 65 6C 65 74 65 00

m-obex/calendar/delete

4C 00 06 01 00 06

id of calendar item

Notes

Tasks

Files

To get the file structure on the mobile, there are two commands. One that lists all subdirectories and one that lists all files.

List directories

List files

Get file

Create file

Delete file

SMS

0x01: Inbox 0x08: Outbox

Get sms count

List all sms

Send sms

Create sms

I don’t think this is possible. At least I didn’t find the function in New PC Studio. So sadly there will be no backup of sms messages.