Wednesday, April 27, 2011

Fun with old Siemens Cellular Phones



I still use a Siemens M55 phone and this article describes how one can use this phone for data transfers, GRPS modem and several other things in Linux.

Background

In 2004 I was an intern at the University of Waterloo. I was doing my research term there that was actually part of my undergraduate curriculum at my home university in Germany.
The first thing to do in Canada was to stay connected, so I got a prepaid SIM card from Fido at the time. I always loved pay as you go tariffs from Germany so I wanted to have something similar there too. Sticking it into my beloved Nokia 3310 at that time, I had to find out that this phone did not support the North American frequency band. So I had to get a new phone. What I got was a very nice Siemens M55 phone at the time for about 185$. It served me well during my internship. Unfortunately it was SIM-locked, so I left it with my cousin at that time and returned back to Germany… 3 years later in 2007, I started my PhD studies in Canada again and got it back. It was kind of cute to switch it on after it has been unused for 3 years and find out that it was still working. I really fell in love with that phone and still use it today. It is the most dependable mobile phone I had so far. I had a brief affair with a Blackberry Tour that was given to me by a friend to write some software for it, but after I gave it back, I fell back to using my M55 again.
Even though Siemens is not making anymore mobile phones for quite a while already, spare parts are still widely available. The other thing to note is the dependability of the phone. The phone is currently about 7 years old, still has the original Lithium Ion battery that still lasts about 2.5 days. It survived several falls on stairs and walkways so far.
These days I got back to Europe for a few weeks and decided to unlock the phone for a local carrier, because Fido roaming is just overkill over here. As it turns out buying a used and unlocked M55 on eBay Germany with all the extras turned out to be cheaper (5 EUR + shipping). So I got a second nice one.
Since I have to travel around a lot here I actually want to use the phone to its full extend, including mobile internet connectivity via GRPS. Here is the story how to revive some untouched open source software projects and configure a more recent Linux to work all the features of this phone, including file system access, sending short messages, synchronizing calendars and synchronizing phone books. You can download all the features at the end.

The Phone Specifications

(bottom left is a Pour-le-Merite Zippo
to get an idea of the size of the phone and camera)

If you see these specs below, you might think that I am anachronistic person; but as the old saying goes a craftsman is judged by the quality of his work not by his tools. This also applies somewhat to computer engineers like me. If you want to use a cellular phone for phone calls, “texting”, and as modem… you do not need an expensive bloated I-Phone, Blackberry or other prestigious smart phones. This one is just fine; plus you safe significant amounts of money on the data plan.
2G Network
GSM 900, 1800, 1900
Announced
Q2 2003… nowadays discontinued
Display
CSTN 4096 colours, 101x80px, 7 lines
(yes that is old-school!!!)
Sound
Vibration, polyphonic ring-tones, voice notes (Intel ADPCM codec)
Memory
500 phone book entries @ 14 fields,
Call records: 10 dialled, 10 received, 10 missed
Calendar entries: 999
A simple file system to manage profiles, pictures, and audio.
And all of just within 1.8 MBs.
(Today you can buy more than 16GB of micro SD-cards for your I-Phone/Blackberry)
Battery
Standard Li-Ion 700 mAh (up to 250h standby, 6h talking)
…. Mine still lasts about 2.5 days after 7 years of use… Try to get that out of an I-Phone or Blackberry battery made in China
Java
MIDP-1.0, CLDC-1.0
with close to none of the useful JSRs implemented.
More info here
Camera
This is the really fun part…
EXTERNAL!
Siemens QuickPic Camera IQP-510
CMOS 640 x 480 24 bit
Focus: 40 cm – infinity
Automatic shutter: 1/4000 – 1/8 second
with LED flash
(each picture is about 60kb JPEG / 6kb QVGA)
In 2003 this was top notch and in terms of features and usability more than enough for a general purpose cell phone. Yes and it is still usable if you want to use it as phone and a little bit beyond.
In the following sections I will not talk about making phone calls or how to take pictures but elaborate on some of the data integration problems when you want to use this phone in Linux.

Data Connectivity
This phone came with USB cable. As it turns out this cable is just a simple USB-Serial adapter. Once you connect it, it shows up as serial port in Ubuntu.
treideme@PROBLEM:~$ dmesg
[15212.672612] usb 5-2: new full speed USB device using uhci_hcd and address 14
[15212.835492] usb 5-2: configuration #1 chosen from 1 choice
[15212.837416] pl2303 5-2:1.0: pl2303 converter detected
[15212.853324] usb 5-2: pl2303 converter now attached to ttyUSB0
treideme@PROBLEM:~$ lsusb
Bus 005 Device 014: ID 067b:2303 Prolific Technology, Inc. PL2303 Serial Port

Phone records management
Since I have now two phones I need to move the data from one phone to the other. As it turns out SCMxx a tool that was widely used in the past to manage Siemens phones still ships with Ubuntu. This one allows you to manage text messages, call logs, phone books and the calendar on the command line. You can also inquire the phone specs and the state of the memory banks.

Phone info:
treideme@PROBLEM:~$ scmxx -d /dev/ttyUSB0 --info
Accessing device /dev/ttyUSB0...done
OK, a modem device is present.
Phone related information:
Vendor:       SIEMENS
Model:        M55
Revision:     11
IMEI:         xxx
Battery:      70%
Charsets:     GSM, UCS2
Time:         Wed 27 Apr 2011 12:41:44 PM EDT

SIM card related information:
IMSI:         xxx
card ID:      xxx

Network related information:
Status:       registered, roaming
Area code:    017C
Cell ID:      0CC9
Operator:     Vodafone D2
SMS server:   +15149931123
Signal:       -51 dBm
GPRS class:   B
GRPS status:  not registered, not searching, detached

Available memories:
Binary files:  bmp, mid, vcf, vcs, t9d
Phonebooks:    FD, SM, ON, LD, MC, RC, OW, SD, MS, CD, BL, MB, RD, CS, VCF
SMS storages:  MT, SM, ME

Settings:
Locks: CS, PS, PF, SC, AO, OI, OX, AI, IR, AB, AG, AC, FD, PN, PU, PP, PC

Memory info:
treideme@PROBLEM:~$ scmxx -d /dev/ttyUSB0 --mem-info
Accessing device /dev/ttyUSB0...done
Detected SIEMENS M55
Binary files: 
mem  readable  writable  description 
---  --------  --------  ----------- 
bmp     0-2       0-4    bitmap
mid    0-10      0-10    midi
vcf    0-500     0-500   vCard (address book)
vcs    1-500     0-500   vCalendar
t9d    none        0     T9 database

Phonebooks:   
mem  slots   writable  digits  chars  description 
---  ------  --------  ------  -----  ----------- 
FD    1-20      yes      20      18   SIM fix-dialing phonebook
SM    1-255     yes      20      18   SIM phonebook
ON     1-4      yes      20      18   own numbers
LD    1-10      no       20      18   last calls (SIM)
MC    1-10      no       20      18   missed calls
RC    1-10      no       20      18   callback numbers
OW     1-4      no       20      18   own numbers
SD     1-5      no       20      18   service numbers
MS    1-10      no       20      18   missed calls
CD    1-10      no       20      18   callback numbers
BL     1-8      no       20      0    blacklist numbers
MB     1-2      no       20      10   mailbox numbers
RD    none      no       20      31   red book (VIP in CS)
CS     1-2      no       20      31   common sortable (FD+SM+ME)
VCF    1-2      no                    address book numbers

SMS storages: 
mem   slots     used    description 
---  ------  ---------  ----------- 
MT    1-150    14/150   ME + SM
SM    1-50      0/50    SIM memory
ME    1-100    14/100   mobile equipment memory

To download the phonebook records into a CSV file use this one:
treideme@PROBLEM:~$ scmxx -d /dev/ttyUSB0 --get -P --out=pbook.pb
Using "UTF-8" as system character set.
Accessing device /dev/ttyUSB0...done
OK, a modem device is present.
Detected SIEMENS M55
Receiving phonebook entries...
SM(1-255) [===] 100%

The format of the phonebook is
{ID},”{PHONE NUMBER}”,”{NAME}

The phonebook can be re-imported this way:
treideme@PROBLEM:~$ scmxx -d /dev/ttyUSB0 --send -P pbook.pb
Accessing device /dev/ttyUSB0...done
Detected SIEMENS M55
Updating entries SM(1-255) [===] 100%
done

One should note that this is a very crude way to update the phone book. I think this format is kind of the greatest common denominator when it comes to exchanging the records. With a little bit of tweaking one can actually import and export the raw phone records as vcf, as follows:

treideme@PROBLEM:~$ scmxx -d /dev/ttyUSB0 --get --binary --mem="vcf" --out=record_
Using "UTF-8" as system character set.
Accessing device /dev/ttyUSB0...done
OK, a modem device is present.
Detected SIEMENS M55
vcf slot 0 [===] 100%

vcf slot 500 [===] 100%

This approach preserves the individual fields and exports the records as individual VCF files. It will only create VCF files for records that are taken out of the 500. In my case I had just 10 records to be backed up that ended up being record_000.vcf to record_009.vcf.
Each of those files can then be imported with (or better script this in a bash for loop). Note you explicitly need to address a particular slot to update. This makes cross-device data integration a bit complicated. For replacing the first 10 records of the “new-old phone” with those ten records of my “old-old phone”, I just used:

treideme@PROBLEM:~$ for i in `seq 0 9`
> do
> scmxx -d /dev/ttyUSB0 --send --binary --mem="vcf" --slot ${i} record_00${i}.vcf
> done
Accessing device /dev/ttyUSB0...done
OK, a modem device is present.
Detected SIEMENS M55
Using slot 0
File transfer...
Waiting for data request...Sending data...Packet 1 sent
File transfer complete.

Updating and managing the calendar records (VCS) works likewise. However, I did not have to back anything up. Writing a script that synchronizes the records with Google calendar is on the list for future hacks. So far I was fine to have Google Calendar send me notifications via SMS.

File Management (Ring-tones, Pictures, …)

While SCMxx is a nice tool to manage the records of the phone, it does not provide enough functionality to actually transfer files on and off it. A bit of searching on Google revealed that someone in the past wrote a user file system driver for Siemens phones. SIEFS theoretically allows you to mount the file system of the phone directly. That way you can upload and download files off it; and that is only from memory banks that are not locked. If you use scmxx –info (see previous section) it will show you which memory banks are locked.
The bad news, this project has not been maintained for over 6 years. The latest working configuration used fuse-2.0 and kernel-2.4.x. Being brave I downloaded it and attempted to build it. After fixing some issues manually in the code (most notably outdated autoconf/automake references, missing libraries and some legacy system calls), I finally managed to get it run. I can send you a patch for the 0.5 version for Ubuntu karmic 9.10 upon request. As shown below this code is still quite buggy and occasionally crashes.
Once you managed to build and install it, you can mount the plugged into the USB jack as follows:
treideme@PROBLEM:~$ sudo mount -t siefs /dev/ttyUSB0 /mnt1/
[sudo] password for treideme:
treideme@PROBLEM:~$ sudo ls /mnt1
ls: reading directory /mnt1: Input/output error
# Yes above one of those random crashes I’m talking about
# Unplug the usbcable, remount and then try again and it works…
treideme@PROBLEM:~$ sudo ls -l /mnt1
total 0
drwxrwxrwx 1 root root 0 2003-01-01 00:00 Address book
drwxrwxrwx 1 root root 0 2003-01-01 00:08 apo
drwxrwxrwx 1 root root 0 2003-01-01 00:08 Cache
drwxrwxrwx 1 root root 0 2003-01-01 00:00 Colour scheme
drwxrwxrwx 1 root root 0 2003-01-01 00:00 Customization
drwxrwxrwx 1 root root 0 2003-01-01 00:08 Data inbox
drwxrwxrwx 1 root root 0 2003-01-01 00:10 email
drwxrwxrwx 1 root root 0 2003-01-01 00:08 Internet
drwxrwxrwx 1 root root 0 2003-01-01 00:00 Java
drwxrwxrwx 1 root root 0 2003-01-01 00:00 PersistentData
drwxrwxrwx 1 root root 0 2003-01-01 00:00 Pictures
drwxrwxrwx 1 root root 0 2003-01-01 00:00 Sounds

To unmount just use:
treideme@PROBLEM:~$ sudo umount /mnt1

The pictures taken from the camera have an average size of about 60KB and reside in “Data Inbox”. Ring-tones and event messages are in “Sounds”. Apparently, this phone can also record voice memos in its own format. SIEFS has a tool to convert those files into uncompressed WAV.
Looking at the existing WAV files for event notifications it turns out that this phone actually supports Intel’s ADPCM encoding (but not MP3), which can compress WAV files by a fair bit. All existing wav files were encoded as Mono, 16000Hz, 32bit float, Intel ADPCM files. I added some custom ring tones by converting them (from 32 bit, Mono, 16000Hz Microsoft uncompressed WAV) to Intel ADPCM using ffmpeg as follows.

treideme@PROBLEM:~$ ffmpeg -i licht.wav -acodec adpcm_ima_wav licht2.wav

Please keep things small and short. Remember this phone only has 1.8 MB of total storage. Once you take a few pictures and have some ring-tones that space is gone.

GPRS Modem
As it turns out the USB-Serial connector that serves as data cable can be directly used as modem in Linux. Hacking around with Mincom, I realized that it actually accepts valid Hayes AT commands. Playing around with them you can associate the phone with GRPS and dial into IP services. Here some hacks explained.

First set-up Mincom:
treideme@PROBLEM:~$ minicom -s


Go to serial port set-up and put in the appropriate port. My settings are shown below

Now “exit” and start hacking. A “#” is a comment that explains the individual AT commands.

Welcome to minicom 2.3                                                        
                                                                              
OPTIONS: I18n                                                                 
Compiled on Sep 25 2009, 23:45:34.                                            
Port /dev/ttyUSB0                                                             
                                                                              
                 Press CTRL-A Z for help on special keys                                    
                                                                                            
AT S7=45 S0=0 L1 V1 X4 &c1 E1 Q0                                                             
OK                                                                                          
# Above was the default minicom modem init sequence
# below here you start to enter stuff
# let’s see if it actually accepts AT commands
AT                                                                                           
OK
# Look if we are already associated with GRPS?
AT+CGATT?                                                                     
+CGATT: 0                                                                      
                                                                              
OK    
# +CGATT: 0 = Nope we are not...
# So lets do it
AT+CGATT=1                                                                    
OK
# Wait a couple seconds and check again
AT+CGATT?                                                                     
+CGATT: 1                                                                     
                                                                               
OK
# Yay!!!

Ok now things become provider specific. When I did this I still had my SIM card from Fido sitting in the phone. Below you see the Fido configuration for the GPRS service call. In general you specify this command as

AT+CGDCONT=,"IP","{APN}"

The list of APNs can be obtained here for individual providers. The config num enumerates the devices APN configuration index. I usually use 1, if you have multiple providers you can use other indexes as well. Once you dial the GPRS service you need to remember that index again.
For Fido and the first configuration index it ends up being:
AT+CGDCONT=1,"IP","internet.fido.ca"
OK

Now dial the appropriate index to become connected and see if the configuration works.
# ATD *99***#
# so for configuration index 1… wait a couple seconds
ATD*99***1#
CONNECT

Now that we validated that the phone supports GRPS modem and we also paid for GPRS services, we can configure wvdial with it and use it for Internet connectivity.
/etc/wvdial.conf:
[Dialer Defaults]
Modem = /dev/ttyUSB0
Baud = 115200
Init1 = AT+CGDCONT=1,"IP","internet.fido.ca"
Init2 =
Init3 =
Area Code =
Phone = *99***1#
Username = internet
Password = internet
Ask Password = 0
Dial Command = ATD
Stupid Mode = 1
Compuserve = 0
Force Address =
Idle Seconds = 0
DialMessage1 =
DialMessage2 =
ISDN = 0
Auto DNS = 1
Check Def Route = 1


Just issuing wvdial connects us with the Internet:
treideme@PROBLEM:~$ sudo wvdial
--> WvDial: Internet dialer version 1.60
--> Cannot get information for serial port.
--> Initializing modem.
--> Sending: AT+CGDCONT=1,"IP","internet.fido.ca"
AT+CGDCONT=1,"IP","internet.fido.ca"
OK
--> Modem initialized.
--> Sending: ATD*99***1#
--> Waiting for carrier.
ATD*99***1#
CONNECT
--> Carrier detected.  Starting PPP immediately.
--> Starting pppd at Wed Apr 27 08:27:59 2011
--> Pid of pppd: 25044
--> Using interface ppp0
--> local  IP address 25.30.202.165
--> remote IP address 192.168.254.254
--> primary   DNS address 64.71.255.198
--> secondary DNS address 64.71.255.253

Yay. Now we are connected through a very thin life-line to the Internet. The bandwidth of the GRPS data service is somewhere in between 38kbit – 114kbit, depending on the link quality and the usage of the cell.
Although you now get downloads at a rate of 6kb/second you can load Gmail in HTML mode and use Skype for messaging. For emergency situations like going on vacation without proper internet this is a still a viable solution.
Note the GRPS configuration of any other 2G phone that accepts Hayes AT commands directly is identical. Just figure out APN of your network and put it in the configuration.

I hope some other anachronistic people out there who still use 2G phones or are in rural areas with just GRPS services (Middle-East, India, China, …) find this info helpful. On modern 3G phones you will have other options like UMTS high-bandwidth internet connectivity in Europe or the Edge network services in North America. Most of the so-called smart-phones will enable you to use their interface directly for the internet. You may also get a dedicated App for your email service, such that you do not really need to hack your phone as modem.

Other useful references:

2 comments:

  1. Good article. You could submit this to a technical magazine.

    ReplyDelete
  2. Hello i'm tring to use this old phone , do you have the files of the original ringtones and games of the m55, i didn't find a way to have this on the internet i need beacuse i miss when i cancel, if you can help me mad.mauro@tin.it many thanks

    ReplyDelete