For under $50, you could buy an SPP bluetooth module (and a microcontroller dev board if you need one)
For $50 you can buy a complete WiFi module with a serial interface.
If you use the headphone jack, investigate Frequency Shift Keying. FSK is a modulation scheme used in audio modems.
Here's a couple of relevant projects for pointers:
On the Blackberry side, you could either do the same thing, or play back pre-canned .wav files.
From diagram 3, I could think of two possibilities:
The microphone interface is polling for an existence of a mic periodically and turning the line off when not found. Probably not correct.
The mic input is doubled as another digital interface. Some phones have a way to detect whether the plugged in ear phones are manufacturer's original models or not, for example. If such a earphone pair is detected, the internal audio equalization may be tweaked to produce best possible fidelity.
The pulse shows narrow, I could not sit and figure out it's width, but it does look like a start bit for me. Assuming it is a start bit, it is probably followed by, say some bits and a stop bit - all are zeroes (like a UART). Beyond that, the controller probably is expecting a response.
The first diagram probably is the mic decoupling capacitor acting as weird RC filter with oscilloscope input impedance. Open drain outputs usually require a remote termination. That's another way to detect if remote is connected, somewhat like USB.
Which is the phone on the other end? I might not have access to the same model and I definitely don't have a similar cable handy to figure exactly out what is happening.
It might be interesting, though, to try sending an UART response on the line, taking the high pulse width as bit time: wait for ten or 11 bits and send high start bit and probably try some combinations. Even if we get a response, it might take a while to figure out the protocols etc. I would advise extreme caution, though - if it is a dangerous interface like a firmware backdoor, a trial sequence could potentially erase the flash.
Best Answer
TTY/TDD uses tones in the audio band (similar but not compatible with the old Hayes modems) to communicate over telephone lines. The original protocol uses Baudot code at 45.5 or 50 baud. In 1994 the ITU approved a newer V.18 standard.
So I would presume the headset jack would just pass these tones back and forth to a TTY/TDD modem. It would not be a hidden RS-232 interface -- i.e. the cellphone is not acting as the modem.