Here are some more message types for the GSM-900 / GSM-1800 phones 5110 / 6110 / 6150
They are originally FBUS commands most of them could be used as MBUS Commands also.
Maybe with little variations, just use them as a guideline.
They should work with a 6190 also.
 

MBUS Header:

0x1F 0x00 0x1D "CMD" 0x00 LEN "data as on table" SEQ CRC

CMD

0x01: Call Information

s make data call 0x00, 0x01, 0x00, 0x01, numlen, "number", 0x01, 0x02, 0x01, 0x05, 0x81, 0x01, 0x00, 0x00, 0x01, 0x02, 0x0a, 0x07, 0xa2, 0xc8, 0x81, 0x21, 0x15, 0x63, 0xa8, 0x00, 0x00
s make voice call 0x00, 0x01, 0x00, 0x01, numlen, "number", 0x05, 0x01, 0x01, 0x05, 0x81, 0x01, 0x00, 0x00, 0x01
r call seq num for this call 0x01, 0x08, 0x00, 0x02, callseqnr
r established data call 0x01, 0x08, 0x00, 0x03, callseqnr, 0x01, 0x00, 0x01, 0x03, 0x09, 0x91, 0x07, 0xa2, 0x88, 0x81, 0x21, 0x15, 0x63, 0xa6
r established voice call 0x01, 0x08, 0x00, 0x03, callseqnr, 0x05, 0x00, 0x01, 0x03, 0x02, 0x91, 0x00
r destignation not available 0x01, 0x08, 0x00, 0x04, callseqnr, 0x65, cause 0x01, 0x00 unallocated number (Q.931 ISDN cause elements)
r missed call (inc call end) 0x01, 0x08, 0x00, 0x04, callseqnr, 0x65, cause 0x10, 0x00 normal call clearing
r line is busy 0x01, 0x08, 0x00, 0x04, callseqnr, 0x65, cause 0x11, 0x00 user busy
r not available 0x01, 0x08, 0x00, 0x04, callseqnr, 0x65, cause 0x12, 0x00 no user responding
r no answer from user 0x01, 0x08, 0x00, 0x04, callseqnr, 0x65, cause 0x13, 0x00 no answer from user
r call rejected 0x01, 0x08, 0x00, 0x04, callseqnr, 0x65, cause 0x15, 0x00 call rejected
r called number invalid 0x01, 0x08, 0x00, 0x04, callseqnr, 0x65, cause 0x1c, 0x00 invalid number format
r network busy 0x01, 0x08, 0x00, 0x04, callseqnr, 0x65, cause 0x29, 0x00 temporary failure
r end of datacall, rlp termin 0x01, 0x08, 0x00, 0x04, callseqnr, 0x65, cause 0x7f, 0x00 interworking unspecified
r error in data call? 0x01, 0x08, 0x00, 0x04, callseqnr, 0x65, cause 0xa0, 0x00
r incoming call alert 0x01, 0x08, 0x00, 0x05, callseqnr, calltype (0x05=voice), numlen, "number", namelen, "name", 0x00
r answered call 0x01, 0x08, 0x00, 0x07, callseqnr
r terminated call 0x01, 0x08, 0x00, 0x09, callseqnr, 0x00
r hangup by phone 0x01, 0x08, 0x00, 0x0a, callseqnr, 0x87
r wrong terminal init? 0x01, 0x08, 0x00, 0x40
s initiate terminal 0x00, 0x01, 0x00, 0x42, 0x05, 0x01, 0x07, 0xa2, 0xc8, 0x81, 0x21, 0x15, 0x63, 0xa8, 0x00, 0x00, 0x07, 0xa3, 0xb8, 0x81, 0x20, 0x15, 0x63, 0x80, 0x01, 0x60
r response of init terminal 0x01, 0x08, 0x00, 0x43, 0x02
r error resp.-illegal format 0x01, 0x08, 0x00, 0x44, 0x7d
r error resp.-unknown 0x01, 0x08, 0x00, 0x44, 0x83

0x02: SMS handling

s Send SMS message { 0x00 01, 0x02, 0x00 (SEND REQUEST), ... }
r Message sent { 0x00 02 }
r Send failed { 0x00 03 }

s Get SMS message { 0x00 07, 0x02, location, 0x01, 0x64 }
s Initiate connection { 0x00 0d, 0x00, 0x00, 0x02 }
r SMS message received { 0x00 10, ...... } (whole message)

s Get SMS center { 0x00 33, 0x64, priority }
r SMS center received { 0x00 34, priority, ... } 21-> smscenter number (BCD), 33-> smscenter name
r SMS center error recv { 0x00 35 }

0x03: Phonebook functions

s Get mem location { 0x00 01, memtype, location, 0 }
r mem location recvd { 0x00 02, memtype, namelen, "name", numlen, "number", groupID}
r mem loc error recvd { 0x00 03, errtype }
errtype: 0x7d: invalid memory type

sSet mem location{ 0x00 04, memtype,location,namelen,"Name",numlen,"number",groupID}
rmem set OK{ 0x00 05 }
rmem set error{ 0x00 06, errtype }
errtype: 0x7d: name is too long

sMem status request{ 0x00 07, memtype }
rMem status recvd{ 0x00 08, memtype, free, used }
rMem status error recv{ 0x00 09, errtype }
errtype: 0x6f: mem status error
0x7d: invalid memory type
0x8d: waiting for pin

sGet caller group name{ 0x00 10, groupID }
rGet caller group name{ 0x00 11, groupID, size, "Name", ringtone, graphics?1:0, ?,?,?, {72x14 logo}, ?,? }
rGet call.group error{ 0x00 12 }

sGet speed dial{ 0x00 16, index(1-9) }
rGet speed dial OK{ 0x00 17, mem.type, location }
where
mem.type: 0x02: ME (== 0 if not stored)
0x03: SIM
location: memory location (== 0 if not stored)
rGet speed dial error{ 0x0018 }

sSet speed dial{ 0x0019, index(1-9), mem.type, location }
rSet speed dial OK{ 0x001a }
rSet speed dial error{ 0x001b }

0x04: Phone Status

sPhone status{ 0x0001 }
rPhone status{ 0x0002, mode, signal str, ???, pwr, batt.level }
mode:
  1. registered within the network
  2. call in progress
  3. waiting for pin
  4. powered off
pwr:
  1. AC/DC
  2. battery

sRequest Phone ID{ 0x0003 }
rRequest Phone ID{ 0x0004, 0x01, "imei", 0, "model", 0, "prod.code", 0, "HW", 0, "firmware", 0x00, 0x01 }

0x05: Welcome Messages / pictures

sGet welcome message{ 0x0016, 0x01 }
sSet welcome message{ 0x0018, 0x01, 0x02, text }

sUnset welcome message{ 0x0018, 0x01, 0x03 }
sRequest of picture{ 0x0033, 0x01 }

0x07: Key assignments

sGet key assignments{ 0x0040, 0x01 }
(answer in '0x0c')

0x08: PIN request

s??? (maybe status){ 0x0007, 0x01, 0x01 }
rpin recvd{ 0x0008, accepted }
accepted: 0x0c: OK

sentering pin{ 0x000a, 0x02, "PIN", 0x00 }

0x0a: Network status

rnetwork registration{ 0x0071, ?,?,?,length,netstatus,netsel,cellIDH,cellIDL,lacH,lacL,netcode,netcode,netcode }

sKey duplication on/off{ 0x0044, on? 0x01: 0x02 }

0x0c: Key assignments

rGet key assignments{ 0x00, 0x01, 0x08, 0x00, {key '1'}, 0x00,{key '2'} ... {key '0'}, 0, 0, 0, {symbols}, 0 }
where {key '0'} => ' ', '0'

0x0d: Status

sStatus request{ 0x0051 }
rStatus{ 0x0052, no. of byte pairs, {byte pair} }
where {byte pair}: {cmd, 1:off 2:on}
cmd:
  1. call in progress
  2. ???
  3. have unread sms
  4. voice call active
  5. fax call active
  6. data call active
  7. key lock active
  8. is SMS storage full

sDisplay status{ 0x0053, 1:on 2:off }
(will send displayed messages with x,y coordinates)

0x11: Phone clock & alarm

sset date and time{ 0x0060, 1,1,7,yearh,yearl,month,mday,hour,min, 0x00 }
rdate and time set{ 0x0061 }

sget date and time{ 0x0062 }
rdate and time recvd{ 0x0063,?,?,?,?,yearh,yearl,month,mday,hour,min,second }

sset alarm{ 0x006b, 1,32,3, 0x02(on-off),hour,min, 0x00 }
ralarm set{ 0x006c }

sget alarm{ 0x006d }
ralarm received{ 0x006e,?,?,?,?,alrm(==2:on),hour,min }

0x12: Connect to NBS port

sSend{+0x0c, 0x01, 0x06, 0x05, 0x04,destporth,destportl,srcporth,srcportl,...
(without 0,1, 0 header -- for oplogo, cli, ringtone etc upload)

0x13: Calendar notes

sWrite calendar note{ 0x0064, 0x01, 0x10, length, type, yearH, yearL, month, day, hour, timezone, alarm?(alarm yearH, yearL, month, day, hour, timezone): (0, 0, 0, 0, 0, 0), textlen, "text" }
rWrite cal.note report{ 0x0065, return }
where return:
  • 0x01: ok
  • 0x73: failure

sCalendar notes set{ 0x0066... }
rCalendar note recvd{ 0x0067, 0x01, ?, length, type, yrH,yrL,mon,day,hr,tz,alrm yrH,yrL,mon,day,hr,tz, textlen, "text" }
rCal.note recvd error{ 0x0067, err }
where err:
  • 0x93: not available
  • (0x01: OK)
  • other: error

sDelete cal.note{ 0x0068, location }
rDel. cal.note report{ 0x0069, err }
where err:
  • 0x01: OK
  • 0x93: cannot delete

0x14: SMS funcs

sWrite SMS to outbox{ 0x0004, (text cut?)
rSMS message frame rcv{ 0x0008,subtype,?,num,?,BCD(smscenter)...} 20->type, 22->status
type:
  • 0x06: delivery report
    status:
    • 0x00: delivered
    • 0x30: pending
    • 0x46: failed

  • 0x09: reading failed
    subtype:
    • 0x02: invalid mem type
    • 0x07: empty SMS location

sDelete SMS message{ 0x000a, 0x02, location }
rDelete OK{ 0x000b }

sSMS status request{ 0x0036, 0x64 }
rSMS status{ 0x0037,?,?,?,?,?,?,msgnumber,unread }
rSMS status error{ 0x0038 }

0x40: Security commands

sEnable code sending{ 0x0164, 0x01 }

sGet security code{ 0x016e, 0x01 }
rGet security code{ 0x016e,?,?, sec code (text) }

sNetmonitor{ 0x7eXX }
where: XX:
F0: reset
F1: off
F2: field test menus
F3: developer menus

0x64: Phone identification

sPhone ID request{ 0x0010 }
rPhone ID recvd{ "NOKIA", "imei", 0, "model", 0, "prod.code", 0, "HW", 0, "firmware", magic bytes x 4 ... }

0x7f: Acknowledge {+type, seq }


0xd0: Power on message seq 1 (receive only)


0xf4: Power on message seq 2 (receive only)