Nokia Wireless Presenter

Nokia mobile phones have an app on them called "Presenter", which is designed so you can control your computer (e.g. powerpoint) remotely over bluetooth. Given that Henry was playing with a Bluetooth module, I thought this seemed worthy of investigation :)

First step is to get it working as intended :)

Presenter controlling Laptop

First thing I tried was to get the mobile "paired" with the laptop, so we could play bluetooth. Under Vista, you can see Bluetooth stuff at:

Control Panel > Bluetooth Devices

You can add devices here. Once paired, under "COM Ports" I had the following:

• COM10, Outgoing, Nokia 6500s-1 'Nokia PC Suite'
• COM11, Incoming, Nokia 6500s-1
• COM12, Outgoing, Nokia 6500s-1 'COM 1'

To use the "Presenter" app on your nokia phone to control your PC, you need to install the "Wireless Presenter" application on your PC:

• Nokia Wireless Presenter Application

I installed and ran this, and then told it to use the incoming COM port (COM11 in my case).

Then back to the phone, and to:

Menu > Apps > Collection > Presenter > Connect > "My Computer Name"

It connects! Then select "Desktop", and I can control the cursor :)

What is it doing?

Next thing is to investigate what is actually going on...

The fact that windows is seeing it just as a com port is interesting, so to investigate further I decided to snoop the serial port traffic. I got hold of the windows port monitor...

• Windows PortMon

Importantly, this needs to be both "Installed" and "Run" as administrator. Vista is really crap in this respect, as apps just behave differently if you run them normally, yet it is not obvious. So with PortMon unzipped to desktop, and my "Presenter" session still active:

Start "PortMon", Computer > Connect Local

Now hitting keys on the mobile dumps a load of data!

So, it is just firing serial data back and forth. Time to decode it...

Traffic

RX (from phone app to PC), TX (what PC app replies with)

"Connect"

RX: 01 12 00 30 00 31 00 2E 00 30 00 31 00 2E 00 30 00 30 00 00 00 	
TX: 01 12 00 30 00 31 00 2E 00 30 00 31 00 2E 00 30 00 30 00 00 00 	
RX: 04 00 00 	
TX: 05 18 00 01 0E 02 01 00 FF FF 00 44 00 65 00 73 00 6B 00 74 00 	

Select "Desktop"

RX: 03 14 00 0E 02 01 00 44 00 65 00 73 00 6B 00 74 00 6F 00 70 00 	
TX: 03 14 00 0E 02 01 00 44 00 65 00 73 00 6B 00 74 00 6F 00 70 00 	

Press Keys!

e.g. Hit "up"
RX: 10 03 00 00 09 F8
RX: 10 03 00 01 09 F8

After a little experimentation, the key press reporting protocol is...

Keypad - RX: 0x10 0x03 0x00 <event> <keycode> 0x00
Dirpad - RX: 0x10 0x03 0x00 <event> <dircode> 0xF8
         
where
  <event>   ::= 0x00 (keydown), 0x01 (keyup)   
  <keycode> ::= '0' - '9', '*', '#'
  <dircode> ::=  0x07 (left), 0x08 (right), 0x09 (up), 0x0A (down), 0x45 (center)

Pretending to be Nokia Wireless Presenter

To test the theory, I wrote a python app that sits on the PC serial port.

It took a long time to get this to play; the main problem was that PortMon logs were incomplete, cropping the command strings to 21, so some messages were over it and hence I was not sending the complete messages when i tried to copy it. Also, windows has a habit of hanging on to serial ports, so there were a lot of reboots :(.

But finally, here is a script that worked! Note that the incoming port is COM19 (and this is 18 in the script as pyserial starts at 0 on windows)

# see if we can pretend to be Nokia Wireless Presenter PC App
SERIAL_PORT = 18
SERIAL_BAUD = 9600

import serial, sys
        
print "Nokia Wireless Presenter Monitor..."

try:
    s = serial.Serial(SERIAL_PORT)
    s.setBaudrate(SERIAL_BAUD)
    print "Connected to serial port " + str(SERIAL_PORT) + " @ " + str(SERIAL_BAUD) + "..."
except:
    print "Failed to open serial port " + str(SERIAL_PORT)
    sys.exit()

def show(bytes):
    for byte in bytes:
        print hex(ord(byte))

# RX 21: 01 12 00 30 00 31 00 2E 00 30 00 31 00 2E 00 30 00 30 00 00 00     
# TX 21: 01 12 00 30 00 31 00 2E 00 30 00 31 00 2E 00 30 00 30 00 00 00     
# RX 03: 04 00 00   
# TX 27: 05 18 00 01 10 01 02 00 FF FF 00 44 00 65 00 73 00 6B 00 74 00 6F 00 70 00 00 00   

# RX 23: 03 14 00 10 01 02 00 44 00 65 00 73 00 6B 00 74 00 6F 00 70 00 00 00   
# TX 23: 03 14 00 10 01 02 00 44 00 65 00 73 00 6B 00 74 00 6F 00 70 00 00 00   
    
def connect():
    print "Waiting for connect..."
    bytes = s.read(21)
    s.write(bytes)
    bytes = s.read(3)
    s.write("\x05\x18\x00\x01\x10\x01\x02\x00\xFF\xFF\x00\x44\x00\x65\x00\x73\x00\x6B\x00\x74\x00\x6F\x00\x70\x00\x00\x00")
    print "OK"

def desktop():
    print "Waiting for desktop request..."
    bytes = s.read(23)
    s.write(bytes)
    print "OK"

def read_key():
    keycode = s.read(6)
    event = "keydown"
    if ord(keycode[3]) == 0x01:
        event = "keyup"    
    key = keycode[4]
    if ord(keycode[5]) == 0xF8:
        if ord(keycode[4]) == 0x07:
            key = 'L'
        if ord(keycode[4]) == 0x08:
            key = 'R'
        if ord(keycode[4]) == 0x09:
            key = 'U'
        if ord(keycode[4]) == 0x0A:
            key = 'D'
        if ord(keycode[4]) == 0x45:
            key = 'C'
    return key + " " + event
    
def read_keys():
    while 1:
        print read_key()
        
connect()
desktop()
read_keys()

NC4BluetoothModule