George Zhu’s BLOG

PmgRiPhone of elite team has released a tool (sendmodem) to send command directly to iPhone modem. This is convenient. The tool uses /dev/tty.debug to communicate with modem, so you don’t have to turn off the communication center during the operations.

The command syntax is quite straight forward:

sendmodem “AT command”

Here are some examples:

Querying the baseband version:
sendmodem “AT+XGENDATA”

Querying the lock state:
sendmodem “AT+XSIMSTATE=1″

Querying the battery capacity:
sendmodem “AT+CBC”

Querying the signal quality:
sendmodem “AT+CSQ”

If you wanna use double quote in an AT command, you have to escape it like in C language (\”), eg.:

sendmodem “AT+CLCK=\”PN\”,2″

For available AT commands, refer to ETS 300 642 documentation.

UPDATE: to check the bootloader version of your iPhone, enter the following command (equivalent to ‘bbupdater -v’):

sendmodem “AT+XGENDATA”

Example output:

Sending command to modem: AT
-.+
AT
OK
Sending command to modem: AT+XGENDATA
-..+
AT+XGENDATA
+XGENDATA: ”
“,
“DEV_ICE_MODEM_04.01.13_G”,
“EEP_VERSION:207″,
“EEP_REVISION:8″,
“BOOTLOADER_VERSION:3.9_M3S2″,1,0

OK

The source code of sendmodem is here:

#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 

#define BUFSIZE (65536+100)
unsigned char readbuf[BUFSIZE];

static struct termios term;
static struct termios gOriginalTTYAttrs;
int InitConn(int speed);

void SendCmd(int fd, void *buf, size_t size)
{

    if(write(fd, buf, size) == -1) {
        fprintf(stderr, "SendCmd error. %s\n", strerror(errno));
        exit(1);
    }
}

void SendStrCmd(int fd, char *buf)
{
    fprintf(stderr,"Sending command to modem: %s\n",buf);
    SendCmd(fd, buf, strlen(buf));
}

int ReadResp(int fd)
{
    int len = 0;
    struct timeval timeout;
    int nfds = fd + 1;
    fd_set readfds;
    int select_ret;

    FD_ZERO(&readfds);
    FD_SET(fd, &readfds);

    // Wait a second
    timeout.tv_sec = 1;
    timeout.tv_usec = 500000;

    fprintf(stderr,"-");
    while (select_ret = select(nfds, &readfds, NULL, NULL, &timeout) > 0)
    {
        fprintf(stderr,".");
        len += read(fd, readbuf + len, BUFSIZE - len);
        FD_ZERO(&readfds);
        FD_SET(fd, &readfds);
        timeout.tv_sec = 0;
        timeout.tv_usec = 500000;
    }
    if (len > 0) {
        fprintf(stderr,"+\n");
    }
    readbuf[len] = 0;
    fprintf(stderr,"%s",readbuf);
    return len;
}

int InitConn(int speed)
{
    int fd = open("/dev/tty.debug", O_RDWR | O_NOCTTY);

    if(fd == -1) {
        fprintf(stderr, "%i(%s)\n", errno, strerror(errno));
        exit(1);
    }

    ioctl(fd, TIOCEXCL);
    fcntl(fd, F_SETFL, 0);

    tcgetattr(fd, &term);
    gOriginalTTYAttrs = term;

    cfmakeraw(&term);
    cfsetspeed(&term, speed);
    term.c_cflag = CS8 | CLOCAL | CREAD;
    term.c_iflag = 0;
    term.c_oflag = 0;
    term.c_lflag = 0;
    term.c_cc[VMIN] = 0;
    term.c_cc[VTIME] = 0;
    tcsetattr(fd, TCSANOW, &term);

    return fd;
}
void CloseConn(int fd)
{
    tcdrain(fd);
    tcsetattr(fd, TCSANOW, &gOriginalTTYAttrs);
    close(fd);
}

void SendAT(int fd)
{
    char cmd[5];

    //  SendStrCmd(fd, "AT\r");
    sprintf(cmd,"AT\r");
    SendCmd(fd, cmd, strlen(cmd));
}

void AT(int fd)
{
    fprintf(stderr, "Sending command to modem: AT\n");
    SendAT(fd);
    for (;;) {
        if(ReadResp(fd) != 0) {
            if(strstr((const char *)readbuf,"OK") != NULL)
            {
                break;
            }
        }
        SendAT(fd);
    }
}

int main(int argc, char **argv)
{
    int fd;
    char cmd[1024];
    if(argc < 2)
    {
        fprintf(stderr,"usage: %s \n",argv[0]);
        fprintf(stderr,"examples:\t%s \"AT+XSIMSTATE=1\"\n",argv[0]);
        fprintf(stderr,"\t\t%s \"AT+XGENDATA\"\n",argv[0]);
        fprintf(stderr,"\t\t%s \"AT+CLCK=\\\"SC\\\",2\"\n",argv[0]);
        exit(1);
    }
    fd = InitConn(115200);

    AT(fd);
    sprintf(cmd,"%s\r",argv[1]);
    SendStrCmd(fd,cmd);
    ReadResp(fd);
    CloseConn(fd);
    return 0;
}

UPDATE: Another proggie (igsm from Marcio’s iPhone Apps) has the similar functions (thanks Ais’ comment) or maybe more powerful, however, the igsm uses /dev/tty.baseband which means you have to turn off the communication center before using it, fortunately, igsm has options to do these jobs so you don’t have to enter the long ‘launchctl …’ lines manually.

The syntax:

usage: igsm [-p pin] [-c command ... -c command] [-l] [-L] [-u] [-d] [-v] [-r]

-p pin SIM pin (if needed)
-d dump IMEI IMSI …
-c cmd command to be executed (more than 1 is supported)
-l load commcenter
-L list all jobs loaded into launchd
-u unload commcenter
-r reset baseband
-m string modem init string
-M num max lines on any command
-v verbose mode
-vv verbose mode and hex dump
-h this help
-hh extended help

An example:

# igsm -c AT+CPBS?
Opened: /dev/tty.baseband
> ATE0 - set echo OFF
< OK

> AT
< OK

> AT+CPIN? - SIM requires PIN ?
< +CPIN: READY
< OK

> AT+CPBS?
< +CPBS: “SM”,34,150
< OK
Done

Marcio’s site also has a native utility iToggle, which can be useful if you frequently switch on/off some of your services. The following is a screenshot of the application’s startup screen: