# m-obex protocol used by some Samsung mobiles

This document is copied from <http://code.google.com/p/samsyncro/wiki/mobex> and extended.

## Introduction

This is an attempt to document the m-obex protocol. It is a obex-variation by Samsung used to exchange PIM data and files over bluetooth.

This documentation is by no means complete but is only a reference for the samsyncro implementation. As I don’t know the obex protocol I can’t say in which parts it differs from the standard-obex. The only thing I found strange is the fact, that you will always get 0xA0 as a response. Which means Ok, success in obex. If there was an error you will find it’s error code in the 0x42 header. If this is a normal behavior: Why are there so many response codes defined?

The information about the protocol was gained by listening to the transferred data from Samsungs New PC Studio to a SGH-F480i and B2100 mobile.

## Requirements

- Established bluetooth connection to the serial channel of the mobile

- Some way to access this serial port. For example minicom.

## Starting the obex server

To start the obex server you have to send this AT command first:

    AT+SYNCML=MOBEXSTART

Some phones seem to start with following command:

    AT$TSSPCSW=1

## Obex commands

In the following chapters I will describe the obex packages to read and edit data on the mobile. I think most of them are in standard-obex format and are following this structure:

Package Header | Session Id | Obex Header(s)
--- | --- | ---

- First byte: Type of request.

- Second and third bytes: length of package

- 0xCB and four bytes of session id

- First byte: Type of header.

- Second and third bytes: length of header.

- Next bytes: data.

- Last byte: 0x00

For detailed information about obex, for example what types of packages and headers exists, get the official Obex documentation from Infared Data Association. But I don’t know if this is available for free.

Here is a list of the most used types for the Samsung mobiles:

There exists mainly two types of operations: Put (package header 0x02 and 0x82) to write data to the mobile and Get (package header 0x03 and 0x83) to retrieve data from the mobile. A put or get operation can be divided into several packages. The high-bit indicates if this is the last package of an operation. For example if you want to transfer a file to the mobile you send n-time 0x02 packages and only the last one is 0x82.

Headers consists normally out of three blocks: First byte: Header type, second and third byte: length of the header (if the headers length is variable), following bytes: data. The most used header types are

Obex description | Byte | following two bytes | following bytes
--- | --- | --- | ---
Name | 0x01 | length of header | Used for filesystem operation to name a path or file
Type | 0x42 | length of header | Obex command for example “m-obex/contacts/list”
Length | 0xC3 |  | Used in put operations and specifies the length of the transferred data (without header bytes). The length is represented in 4 bytes.
Body | 0x48 | length of header | Data in a multi-package put operation
End of Bady | 0x49 | length of header | Last data package in a put operation
Session id | 0xCB |  | Four bytes representing the session id. Needed for multiplexing
Application Parameter | 0X4C | length of header | In a request: Parameters for example a contact’s id. <p>In an answer: The error/return code. If it is 0x00 0x00 than the operation was successful

## Contacts

### Get contacts count

#### Request

83 00 25

  Obex Get

CB 00 00 00 00

  Session Id

42 00 19 6D 2D 6F 62 65 78 2F 63 6F 6E 74 61 63 74 73 2F 63 6F 75 6E 74 00

  m-obex command: m-obex/contacts/count

4C 00 04 01

  Unknown! Didn’ see PC Studio sending something other than 0x01 as parameter

#### Answer

A0 00 14

  Obex ok

C3 00 00 00 04

  Maybe the number of requests you have to send to get all contacts. See next chapter for more information

4C 00 05 00 00

  Error code

49 00 07 07 D0 00 18

  First two data bytes: maximum number of contacts (0x07D0 = 2000). Last two data bytes: Current number of contacts

### List all

#### Request

83 00 26

  Obex Get package

CB 00 00 00 00

  Session Id

42 00 18 6D 2D 6F 62 65 78 2F 63 6F 6E 74 61 63 74 73 2F 6C 6F 61 64 00

  m-obex Command: m-obex/contacts/load

4C 00 06 01 00 00

  First Byte unknown. Last two bytes: increment until all contacts received

#### Answer

A0 08 C1

  Obex Ok

C3 00 00 08 B1

  Length of sent data

4C 00 05 00 02

  Indicates if these are the last contacts

49 07 41 01 10 01 8D ….”

  The first byte is unknown but all answers have this byte, then byte 2 and 3 contains the length of the answer, bytes 4 and 5 are the ID of the first entry bytes 6 and 7 are the length of this entry.

  In one response more than 1 vcard can be returned in this case, entries are separated by 4 bytes with the following meaning: bytes 1 and 2 ID of the entry, bytes 3 and 4: length of the entry.

To get all contacts the request have to be sent several times. The last two bytes must be incremented by every call.

The end of the contacts list is reached if the header 0x4C is 0. The header will be 4C 00 05 00 00.

### Create a contact

Beware: This is a put operation and is performed in some obex implementations in several packages (for example 0x02, 0x02, 0x82). But I didn’t get the mobile to accept this. I had to create/update PIM data in exactly one package.

#### Request

82 00 88

  Obex put

CB 00 00 00 00

  Session id

42 00 1A 6D 2D 6F 62 65 78 2F 63 6F 6E 74 61 63 74 73 2F 63 72 65 61 74 65 00

  m-obex/contacts/create

4C 00 04 01

  ? maybe flag for internal/external memory

C3 00 00 00 5A

  Length of the vcard string

49 00 5D 42 45….

  Contact as vcard

#### Answer

A0 00 12

  Obex ok

C3 00 00 00 02

  ?

4C 00 05 00 00

  Error code

49 00 05 00 21

  last two bytes: the id of the newly created contact

### Update a contact

Beware: This is a put operation and is performed in some obex implementations in several packages (for example 0x02, 0x02, 0x82). But I didn’t get the mobile to accept this. I had to create/update PIM data in exactly one package.

#### Request

82 00 8D

  Obex put

CB 00 00 00 00

  Session id

42 00 19 6D 2D 6F 62 65 78 2F 63 6F 6E 74 61 63 74 73 2F 77 72 69 74 65 00

  m-obex/contacts/write

4C 00 06 01 00 20

  Id of the contact which should be updated

C3 00 00 00 5E

  Length of the vcard string

49 00 61 42…

  Contact as vcard

#### Answer

A0 00 08

  Obex ok

4C 00 05 00 00

  Error code: 0x00 0x00 means successful

### Read one contact

There is also the possibility to read exactly one contact.

#### Request

83 00 26

  Obex get

CB 00 00 00 00

  Session id

42 00 18 6D 2D 6F 62 65 78 2F 63 6F 6E 74 61 63 74 73 2F 72 65 61 64 00

  m-obex/contacts/read

4C 00 06 01 00 20

  First byte:? Last two bytes: Id of contact

#### Answer

A0 00 C4

  Obex ok

C3 00 00 00 B4

  Length of vcard (without headers, just data)

4C 00 05 00 00

  Error code

49 00 B7 42 45 47 49 4E …

  contact as vcard. TODO: where is id? First two bytes?

### Delete contact

To delete a contact you only have to know it’s id.

#### Request

82 00 28

  Obex put

CB 00 00 00 00

  Session id

42 00 1A 6D 2D 6F 62 65 78 2F 63 6F 6E 74 61 63 74 73 2F 64 65 6C 65 74 65 00

  m-obex/contacts/delete

4C 00 06 01 00 19

  First byte: ? Last two bytes: Id of contact

#### Answer

A0 00 08

  Obex ok

4C 00 05 00 00

  Error code

## Calendar

### Get count

#### Request

83 00 25

  Obex get

CB 00 00 00 00

  Session id

42 00 19 6D 2D 6F 62 65 78 2F 63 61 6C 65 6E 64 61 72 2F 63 6F 75 6E 74 00

  m-obex/calendar/count

4C 00 04 FF

  ?

#### Answer

A0 00 1C

  Obex ok

C3 00 00 00 0C

  length of data

4C 00 05 00 00

  Error code

49 00 0F 01 2C 00 06 00 64 00 00 00 64 00 00

  ?TODO?

### List all

#### Request

83 00 20

  Obex get

CB 00 00 00 00

  Session id

42 00 18 6D 2D 6F 62 65 78 2F 63 61 6C 65 6E 64 61 72 2F 69 6E 66 6F 00

  m-obex/calendar/load

#### Answer

A0 00 C0

  Obex ok

C3 00 00 00 B0

  Session

4C 00 05 00 00

  Error code

49 00 B3 01 07 08 00 00 00 00 00 00 00 00 …

  Calendar items in vcalendar format. TODO: where are the ids?

### Create

#### Request

82 00 CC

  Obex put

CB 00 00 00 00

  Session

42 00 1A 6D 2D 6F 62 65 78 2F 63 61 6C 65 6E 64 61 72 2F 63 72 65 61 74 65 00

  m-obex/calendar/create

4C 00 04 01

  ?

C3 00 00 00 9E

  Length of vcalendar

49 00 A1 42 45 47 49 4E 3A 56 43 41 4C 45 …

  vcalendar

#### Answer

A0 00 12

  Obex ok

C3 00 00 00 02

  Length

4C 00 05 00 00

  Error code

49 00 05 00 06

  Id of the created item

### Update

#### Request

82 00 F7

  Obex put

CB 00 00 00 00

  Session

42 00 19 6D 2D 6F 62 65 78 2F 63 61 6C 65 6E 64 61 72 2F 77 72 69 74 65 00

  m-obex/calendar/write

4C 00 06 01 00 05

  First byte: ? Second and third byte: Id of the item

C3 00 00 00 C8

  Length of vcalendar

49 00 CB 42 45 47 49 4E 3A 56

  vcalendar item

#### Answer

A0 00 08

  Obex ok

4C 00 05 00 00

  Error code

### Read

#### Request

83 00 26

  Obex get

CB 00 00 00 00

  Session

42 00 18 6D 2D 6F 62 65 78 2F 63 61 6C 65 6E 64 61 72 2F 72 65 61 64 00

  m-obex/calendar/read

4C 00 06 01 00 06

  Id of calendar item

#### Answer

A0 00 C0

  Obex ok

C3 00 00 00 B0

  Length

4C 00 05 00 00

  Error code

49 00 B3 42 45 47 49 4E 3A 56 43 41 4C 45 4E 44 41 52 0D 0A 56 45 52 53 49 4F 4E 3A 31 2E 3….

  vcalendar item. TODO: Where is the id?

### Delete

#### Request

82 00 28

  Obex put

CB 00 00 00 00

  Session

42 00 1A 6D 2D 6F 62 65 78 2F 63 61 6C 65 6E 64 61 72 2F 64 65 6C 65 74 65 00

  m-obex/calendar/delete

4C 00 06 01 00 06

  id of calendar item

## Notes

## Tasks

## Files

To get the file structure on the mobile, there are two commands. One that lists all subdirectories and one that lists all files.

### List directories

### List files

### Get file

### Create file

### Delete file

## SMS

0x01: Inbox 0x08: Outbox

### Get sms count

### List all sms

### Send sms

### Create sms

I don’t think this is possible. At least I didn’t find the function in New PC Studio. So sadly there will be no backup of sms messages.