BFC mode (Siemens x65 Service mode)

0) About
1) Stucture of an BFC Command
2) Starting the BFC mode
2.1) starting the online BFC mode
2.2) starting the offline BFC mode
3) Leave BFC mode
4) Commands
5) Answer
6) Keys Table
7) Full Command List (without names)
8) Greetings & Respect

0) About:

Written by ACiD[mrp] and Phantom special thanks SiNgle and Skylord for help with discovering commands.
2004 by GSM Development Crew

This is the completest documentation (the only? ;)) about BFC Service mode for Siemens mobiles.
BFC is the new (undocumented) service protocol for mobiles since x65. For mobiles older than x65
use BFB service mode.

1) Structure of an BFC Command

[Command]:
see Command Table

[Length]:
Length of Subdata

[Chk Flag]:
0x20: CRC16
0x04: no checksum

[Header XOR]:
XOR of all Header Bytes

2) Starting the BFC mode

There are two different ways to put the phone into BFC mode. Phone can be online or offline.
for offline mode an flashable cable must be present.

2.1) starting the online BFC mode

Starting the online BFC mode is simple:
- set port speed to 115200 Baud
- make shure you can access the AT mode
- send the AT command AT^SQWE=1 + 0x13

That's all, you're in online BFC mode now ;)

2.2) starting the offline BFC mode

Starting the offline BFC mode is more work:
- set port speed to 115200 Baud
- send "AT" to the Port in a loop. Wait 50ms after every command
- when the user presses the red key, the mobile will answer with 0xB0
- now you can send the Bootcode to the phone:

- phone will answer with: 0xB1
now you have to wait some time till phone is ready with booting.

you can send an Authentification for command 0x11 to see when phone is started (Ping).
now you are in offline BFC mode.

3) Leave BFC mode

4) Commands

5) Answer:

the answer of every BFC command starts with the two bytes of the sended
commands in reverse order.

6) Keys Table:

7) Full Command List (without names):

This is a bruteforced list from CX65 with FW25. If you like to try out
unexplored commands, you should start with commands from this list. This
should be all commands included into the firmware. Note, that for S65 there
may be some more commands because of the MMC and BT.

CX65 FW25 LG1 Full BFC Scan (Online mode)
C65 FW16 LG1 Full BFC Scan (Online mode)
C65 FW16 LG1 Full BFC Scan (Offline mode)
S65 FW32 LG1 Full BFC Scan (Online mode)
S65 FW32 LG1 Full BFC Scan (Offline mode)

8) Greetings & Respect