What’s the difference between USSD, MMI and SS codes?

The recent Samsung remote wipe attack got a lot of media coverage. In every article and blog post you could read that the attack made use of an "USSD code".

But that is not the case.

So what are the codes with those */# characters called and what is an USSD code?

Every code that you enter over your phones keypad that contains asterisk (*) or hash (#) characters is an MMI code. MMI stands for Man-Machine-Interface.
Even though most of these MMI codes look pretty similar, they fall into different groups with completely different actions. Some are just used locally on the device, some are sent to the SIM, others are sent to the network.

Different kinds of MMI codes

Supplementary Service (SS) codes

Those are the codes used to control, for example, call forwarding or number presentation.
With *21*123456789#  you would instruct your phone to ask the network to forward all your incoming calls to the number 123456789. But this code is not sent directly to the network. Instead, it is parsed by the phone which then constructs an ASN.1 coded request to the network.
These codes are hardcoded into every GSM/UMTS/LTE device worldwide and cannot be changed by your network operator.

Unstructured Supplementary Service Data (USSD) codes

If you enter a code that at least ends in a hash sign (and press ) and is not recognized by the phones MMI parser, the code will be sent to the network verbatim. It then depends on the network if this code is supported. One of the most used cases is a code for prepaid cards to check your balance. Many networks use something like *#100#. But it is really the choice of the network operator which code to use as long as it not already taken.

So entering *20*1234#  or *21*1234#  would do two completely different things: The first code would be sent as-is to the network for further processing (most likely returning an error), while the second code would be parsed by the phone and a structured request for activation of call forwarding would be sent to the network.

Please note: For SS and USSD codes you always need to press the  key after entering them, so it is not possible to automatically execute those codes with a tel-URL.

Manufacturer defined MMI codes

This is the category into which the much talked-about Samsung code falls.

Codes specific to your phone model that have been built in by the manufacturer to, for example, activate service menus or reset the device. These codes also contain * and # characters. Since the codes are not being sent to the network, you don’t have to press the  key at the end – they are executed as soon as the last digit or character has been entered. There is one code that is mandatory for all manufacturers of GSM/UMTS/LTE phones to implement:*#06#
It shows the devices IMEI (Internatiol Mobile Equipment Identifier)

SIM control codes

These codes are used, for example, to change your SIMs PIN code.
**04*1234*6789*6789# would change your PIN code from "1234" to "6789".
These codes are also executed without pressing the  key.

The complete specification for the MMI interface of GSM/UMTS/LTE devices can be found in 3GPP TS 22.030: "Man-Machine Interface (MMI) of the User Equipment (UE)"

MMI是Man-Machine-Interface的缩写。从功能上来看，有一些从拨号盘拨出去的字符串，它的实际作用不是建立一个通话而是为了完成某种服务，这个就是MMI；从格式上来看，每一个从拨号盘输入的字符串，如果包含有*或者#，都可以称之为MMI.

MMI包括SS, USSD,Manufacturer defined MMI codes, SIM control codes等等。

Manufacturer defined MMI codes

一些嵌在手机里的服务码，比如你要查询一个手机的IMEI号码，你可以在拨号键盘输入*#06#，手机的IMEI码会自动弹出来。

SIM control codes

比如用来修改SIM卡PIN码的命令，在拨号键盘输入**04*1234*6789*6789#，这将会将SIM卡的PIN码从1234修改成为6789.

SS

Supplementary Service，补充服务，比如控制号码显示，呼叫转移等服务的号码串。这些号码串是每部GSM/UMTS/LTE手机中的固定服务号码，运营商是不能对它进行修改的。当手机系统接受到这些服务号码后，先在手机内部进行处理后，再传给网络。比如你随便拿个手机，在拨号盘输入*21*123456789#然后点击发送，这个时候你所有的来电都会直接转移到123456789。

USSD

与SS相对应的是Unstructured Supplementary Service Data。从字面上看，是非结构化的补充字符，曾经我以为字符串格式上的不同是SS和USSD间最大的区别，后来发现自己大错特错了：单从字符串格式上是没法区分的。那他俩到底有啥区别？一，USSD基本都是运营商根据自己的服务自己定制的，而SS就像上面说的是每个手机固有的；二，SS在发送给网络前，手机首先会自己处理一下，而USSD是完全透明的传送给网络。

SS和USSD都必须点击发送后才能生效，而Manufacturer defined MMI codes和SIM control codes都不需要点击，输入后直接生效。

MMI格式

手机支持如下格式的MMI。

Activation : *SC*SI#

Deactivation : #SC*SI#

Interrogation : *#SC*SI#

Registration :  *SC*SI# and **SC*SI#

Erasure : ##SC*SI#

Action：*，#，*#，**，##。

SC: Service Code, 由2-3位数字组成

SI:  Supplementary Information。

MMI串通常以*，#，*#，**，##等开头，以#结束。各个部分间以*隔开。