Undocumented/Underdocumented Commands for US Robotics Sportster 28800 Vi ======================================================================== by Ralf Brown August 27, 1998 =========== AT commands =========== +f : fax command -- see below g= [addr] : dump 100h memory locations starting at hex addr [0] (bytes) gb [addr] : dump 100h I/O ports starting at hex address [0] gi [addr] : read I/O port at hex addr [0] and return value in hex gn : set NVRAM-corrupted flag go, : output hex value to I/O port at hex address [0] gr [addr] : dump 100h memory locations starting at hex addr [0] (words) gu : nop gx [addr] : gy [addr] : (same as GX in examined ROM) g<4 hex digits> : g<8 hex digits> : n : (low byte of zero/nonzero determines action) nl : nx : cold-reset modem q3 : only report RING on first ring r : set ?? flag (related to AA LED) rs99? : print copyright string usr : print out credits y5 : clears nine hardware bits, then sets them (one every 600ms) : and re-initializes MR/CTS/DSR/AA LEDs y6 : (Sportster only) same as ATI6 y7 : check signal quality (only while connected) y8 : dump compression dictionary (receive) y9 : dump compression dictionary (xmit) y11 : prints "Freq Level", plus listing if connected y12 : prints "Recv Xmit", plus listing if connected y14 : prints modem options "000,000,018,007,010,000" : = ?,?,modem_features,?,modem_options,country code : modem_features : bit 3: GW2000 Telepath : bit 1: proprietary V.32 extensions : modem_options (some bits set internally but not shown) : bit 1: V.32bis : bit 2: HST : bit 5: 20MHz CPU instead of 13MHz ?? : bit 6: V.FC : bit 7: V.34 -scd? : get capabilities data (prints "44 7D" by default) -scd=? : prints "254" -scd="hexdigits" : add bytes to capabilities buffer (must be even # of digits) -scd="" : clear VoiceView capabilities buffer -sda : start modem data mode -sds? : print current value -sds=? : print valid values (0,1) -sds= : set -sdt : NOP -ser? : get error status as two hex digits, then clear it to 0 -sfx : start Fax data mode -sic : reset capabilities to defaults -sip=? : -sip0 : initialize VoiceView parameters -smt=? : show valid values (0,1) -smt : -sqr? : capabilities query response control -sqr=? : -ssp? : print current values -ssp=? : print valid values (0-7) -ssp=,, : set VoiceView transmission speed -ssq : -ssr? : print current value -ssr=? : print valid values (0,1) -ssr= : set start sequence response -stm : NOP -sto : talk-off event +fclass=0 : select data operation +fclass=1 : select Fax Class 1 operation (see below for FAX commands) +fclass=2.0 : select Fax Class 2.0 operation (see below) &J0 : (rackmount only?) &J1 : (rackmount only?) ~S? : print serial number ~S=<16digits> : set serial number : (lost on next ATZ or power cycle unless &Wn used) #BDR= : #BDR=? : print valid values (0,1,2,4,8,16,24) #BDR? : print current value #CID= : set Caller ID mode : 0 = disabled (default) : 1 = enabled -- formatted Caller ID : 2 = enabled -- raw ASCII printable hex #CID=? : list valid values (0,1,2) #CID? : print current value #MDL? : print modem model string #MFR? : print modem manufacturer's name #REV? : print revision string #VBQ? : print buffer sizes #VBS= : #VBS=? : list valid values (2,3,4) #VBS? : print current value #VBT= : #VBT=? : list valid values (0-40) #VBT? : print current value #VCI? : print modem ID string #VLS= : hardware type control? #VLS=? : list valid values (0,1,2,3,4) #VLS? : #VRA : NOP (ringback-goes-away timer) #VRN : NOP (ringback-never-appeared timer) #VSD= : silence detection (quiet and silence) #VSD=? : list valid values (0,1) #VSD? : print current value #VSK : NOP #VSP= : speakerphone volume(?) control #VSP=? : list valid values (0-255) #VSP? : print current value #VSR= : set sample rate #VSR=? : list valid values (8000) #VSR? : print current sample rate? #VSS= : #VSS=? : list valid values (0,1,2,3) #VSS? : print current value #VTD= : beep tone duration timer? #VTD=? : list valid values (3F,3F,3F) #VTD? : print current value #VTM : end #V mode #VTS=[n,n,n] : DTMF and tone generation #VTS=[n,n,n]*n : #VTS=[n,n] : #VTS=[n,n]*n : #VTS={n,n,n} : #VTS={n,n,n}*n : #VTS={n,n} : #VTS={n,n}*n : (doc) #VRX : start record mode (see below for special chars in mode) (doc) #VTX : start playback mode (see below for special chars in mode) (AT commands which are present but disabled on Sportster) c0 : disable transmitter (modem is receive-only) c1 : enable transmitter k0 : modem clock in call-duration mode k1 : modem clock in real-time mode &L0 : normal phone line (doc. for old Courier) &L1 : leased line (doc. for old Courier) &S2 &S3 &S4 &Xn : synchronous transmit clock source : 0 = modem generates clock (default) : 1 = derived from DTE : 2 = derived from remote modem's data carrier &ZC? : display stored command &ZC= : store a command (used by talk/data switch, S32=9) ======================== S Registers ======================== S15 bit 0: documented as Reserved, used internally bit 1: No Online Fallback bit 2: 450 BPS backchannel disabled (Courier HST only) bit 3: documented as Reserved, used internally to select between two different sets of default values for internal variables bit 5: ignore DEL (ASCII 127) character embedded in AT commands instead of incorporating them into the command bit 6: documented as Reserved, used internally in conjunction w/ S27.6 also shortens ? delay from 300 to 200 ms bit 7: documented as Reserved, affects ATZ operation (cleared by ATZ); also causes some additional serial port output on error returns S17 an unknown result code is stored in this S-register S20 unknown delay in 1/2 millisecond units, used in conjunction with S15.6 if S15.6=0, the default (and minimum) delay of 2 milliseconds is used S24 DTR pulse delay S26 delay between RTS and CTS S27 bit 6: documented as Reserved, used internally in conjunction w/ S15.6 S29 V.21 answer time S30 ? default value S31 ? flags S32 talk switch action (Courier only) S33 related to small packets S35 ? default value S36 ? default value S37 not used S39 ? result code S40 BlackList flags (Courier only) S41 maximum login tries (Courier only) S42 Escape character for remote control operation (Courier only) S43 Escape guard time for remote control operation (Courier only) S44 Leased-Line reset delay S45 not used S46 ? S47 not used S48 ? default value S49 not used S50 ? result code S52 not used S53 security options S57 flags for operation in Germany ============================ Voice Record Mode Characters ============================ After sending a #VRX command to the modem, all further characters except DLE (Control-P) which are read from the modem are digitized sound samples. A DLE plus the following character indicates a special function: Char Hex ^@ 00 no operation ^C 03 end recorded data ^P 10 literal ^P in data stream ^Z 1A two consecutive literal ^P chars in data stream # 23 DTMF tone # detected * 2A DTMF tone * detected 0-9 30-39 DTMF tones 0-9 detected A-D 41-44 DTMF tones A-D detected E 4E DTMF tone # detected F 4F DTMF tone * detected H 48 local phone goes off hook L 4C remote hangup P 50 extension phone goes off hook R 52 incoming ring a 61 Fax or data answer tone (2100 Hz) b 62 busy/reorder/fast busy detected c 63 1100-Hz Fax calling tone d 64 dial tone detected e 65 energy detected f 66 data answer detected (2225 Hz) h 68 local phone goes on hook l 6C remote hangup o 6F receive buffer overrun p 70 extension phone goes on hook q 71 presumed end-of-message quiet timeout s 73 presumed hang-up silence timeout u 75 transmit buffer under-run Note: not all of the above may actually be supported ============================== Voice Playback Mode Characters ============================== After sending a #VRX command to the modem, all further characters except DLE (Control-P) which are written to the modem are expected to be digitized sound samples. A DLE plus the following character indicates a special function: Char Hex ^@ 00 no operation ^C 03 end transmitted voice data ^P 10 literal ^P in data stream ^X 18 clear transmit buffer of voice data ^Z 1A two consecutive literal ^P chars in data stream ^[ 1B end receive-data state ^\ 1C finish current message, then start new message ! 21 receive data abort . 2E packet terminator for 'Complex Event Detection Report' / 2F start DTMF tone shielding ? 3F query available transmit buffer space 7F DTMF transition to off X 58 packet header for 'Complex Event Detection Report' d 64 decrease volume e 65 1300-Hz data calling tone o 6F receive buffer overrun r 72 ringback u 75 increase volume Note: not all of the above may actually be supported ======================== EIA Class 1 FAX commands ======================== (mostly documented in V34MAN.TXT) The following are valid only after AT+FCLASS=1 or AT+FCLASS=2.0: +fth= : transmit HDLC frame data using modulation +fth=? : list valid HDLC modulation schemes +frh= : receive HDLC frame data using modulation +frh=? : list valid HDLC modulation schemes +ftm= : transmit stream data using modulation +ftm=? : list valid modulation schemes (see below) +frm= : receive stream data using modulation +frm=? : list valid modulation schemes (see below) +fts=