Ady Wicaksono Daily Activities

Sending WAP Push – Service Indication

with 3 comments

I believe many of you ever receive this kind of SMS, normally content provider send java games, midi ringtone, or any multimedia content usin this type of SMS.

Actually how they send it is normally like picture below:

At first stage Push Initiator will send Service Indication in XML format (process 1) into Push Proxy Gateway (PPG) and then PPG will build a WAP Push SMS and send it to user (2).

When User receive it (3), it will be simply like normal SMS but contains a URL that could be simply opened. If user try to open it, then the rest is normally WAP session or TCP/IP session (4) and it’s actually like normal mobile browsing (5)

The algorithm use by mobile phone when receiving WAP Push Service Indication is like this:

Now I don’t want to discuss about how SI XML is sent by push initiator, but how PPG build WAP Push Service Indication. Actually the SI XML sent by push initiator is like this:

<?xml version="1.0"?>
<indication href=""
You have 4 new emails

PPG will then build WBXML or Wireless Binary format for that XML data, and it’s like this


That code above is hexadecimal code where 2 digit represented 1 byte hexadecimal digit range from 0x00 to 0xFF.

The detail of this encoding is:

^^ -> 0x02: Version of WBXML is 1.2
  ^^ -> 0x05: SI 1.0 Public Identifier, this indicated that document is a SI version 1.0 document
    ^^ -> 0x6A: Character Set is UTF-8
      ^^ -> 0x00: Table string length is 0x00
        ^^ -> 0x45: This is a WBXML coding for tag <SI> with content only (No attribute)
	  ^^ -> 0xC6: This is a WBXML coding for tag <indication> with content & attribute
	    ^^ -> 0x0D: This is a WBXML coding for attribute href="http://www."
	      ^^ -> 0x03: This is an indicator that a string is following ended with 0x00 (NULL)
	        ^^^^^^^^ -> 0x78 0x79 0x7A 0x00: This is a hex value of string "xyz" ended with 0x00 (NULL)

^^ -> 0x85: This is a WBXML coding for string ".com/"
  ^^ -> 0x03: This is an indicator that a string is following ended with 0x00 (NULL)
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -> 0x656D61696C2F3132332F6162632E776D6C000
                                             Hex representation of string "email/123/abc.wml"
					     ended with 0x00 (NULL)

^^ -> 0x0A: This is a WBXML coding for attribute "created="
  ^^ -> 0xC3: This is an indicator that an OPAQUE data (data with Length Value format)
    ^^ -> 0x07: Length of OPAQUE data
      ^^^^^^^^^^^^^^ -> 0x19990625152315 (7 octet) this is represent date "1999-06-25 15:23:15"

^^ -> 0x10: This is a WBXML coding for attribute "expires="
  ^^ -> 0xC3: This is an indicator that an OPAQUE data (data with Length Value format)
    ^^ -> 0x04: Length of OPAQUE data
      ^^^^^^^^ -> 0x20990603 (4 octet) this is to represent date "2099-06-30 00:00:00"
              ^^ -> 0x01: This is to indicate end of attribute for current TAG
	                  so no more attribute inside tag <indication>

^^ -> 0x03: This is an indicator that a string is following ended with 0x00 (NULL)
  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ -> 0x596F7520686176652034206E657720652D6D61696C73000
                                       This is a hex representation of string:
				       "You have 4 emails" ended with 0x00 (NULL)
^^ -> 0x01: this is to indicate end of attribute for current TAG (should refer to </indication> )
  ^^ -> 0x01: this is to indicate end of attribute for current TAG (should refer to </si> )

Now, PPG will generate WSP (Wireless Session Protocol) header as defined in WAP spec ( like this:



This WSP header is actually encoded like this:

^^ -> 0x01: This is Push Identifier
  ^^ -> 0x06: WSP PDU Type = Push
    ^^ -> 0x04: Length of octet followed 4 bytes
      ^^^^^^^^ -> 03AE81EA

03AE81EA itself is encoded like this:
^^ -> Length of content-type + header (3 octets)
  ^^ -> This is the content type of WAP Push (application/vnd.wap.sic)
        generated by doing OR operation with 0x80 like this
	1. Value of application/vnd.wap.sic is 0x2E
	   0x2E = 00101110
	   0x80 = 10000000
	   ------------------ OR
	   0xAE = 10101110

    ^^ -> 0x81: This is a header "Accept-Charset" (0x01) -> become 0x81
                since 0x81 = 0x01 | 0x80
      ^^ -> 0xEA: This is a value of header "Accept-Charset" which is UTF-8 (hexa code 0x6A)
                become 0xEA since 0xEA = 0x6A|0x80

The job is not done yet, PPG will now build WDP (Wireless Datagram Protocol) like this


Where actually this WDP is refer to this encoding:

^^ -> 0x05: IEI (Application Port Schema Addressing, 16 bit), see GSM 03.40
  ^^ -> 0x04: Length of octet following (4 bytes)
    ^^^^ -> 0x0B84: Destination Port of datagram = 2948 in decimal
                    Mobile phone which support WAP Push will normally listen
		    on WDP port 2948 to receive WAP Push 

		    This is the standard port for WAP Push connectionless
		    session service
        ^^^^ -> 0x23F0: Source port of datagram: the value here
	                is refer to Connectionless WAP Browser Proxy Server

So now we have combination WSP+WDP+SI layer to send as WAP Push:

05040B8423F0 (WDP Layer)
01060403AE81EA (WSP Layer)
5231510C304209906030103596F7520686176652034206E657720652D6D61696C73000101 (SI layer)

If you try to calculate the number of octet there is 89 octets,means we can send it using 1 SMS only no need for sending long sms, since 1 SMS can contains 140 octets of data.

Now PPG will send it to end user by completing GSM 03.40 header for this data, like this



55010C9126582602680800F5A75A   --> GSM 03.40 Header
06                             --> UDHI Length
05040B8423F0                   --> WDP Layer
01060403AE81EA                 --> WSP Layer

6D6C000AC3071999062515231510C    ==> SI Layer

Now if send it using AT command like this:



Our mobile phone will receive the WAP Push like this:

Please note, the WAP Push application behaviour for each mobile phone may different each others.

Written by adywicaksono

May 11, 2008 at 7:58 am

3 Responses

Subscribe to comments with RSS.

  1. Hello mas Ady, dimana ya nomor telpon yang di tuju ?


    February 11, 2009 at 6:13 pm

  2. I am having issues viewing this blog. It displays all weird with paragraph breaks incorrectly. You might need to check it out.

    Ambrose Manross

    February 12, 2010 at 1:23 am

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: