totse.com | The Ultimate Cellular Modification Manual

NOTICE: TO ALL CONCERNED Certain text files and messages contained on this site deal with activities and devices which would be in violation of various Federal, State, and local laws if actually carried out or constructed. The webmasters of this site do not advocate the breaking of any law. Our text files and message bases are for informational purposes only. We recommend that you contact your local law enforcement officials before undertaking any project based upon any information obtained from this or any other web site. We do not guarantee that any of the information contained on this system is correct, workable, or factual. We are not responsible for, nor do we assume any liability for, damages resulting from the use of any information on this site.

The following information was gathered from various sources and is not meant to be a technical treatise on the cellular network. There are plenty of other files out there on the subject. This file specifically deals with the processes involved in modifying cellulars. I put together this file because I have not seen one that actually tells how to do this. When some of you start reading this you might say to yourselves "Hey, some of this is almost word for word from Brian Oblivion's article (incidently, one of the best I have seen on the subject) in Phrack #38 or so and so's article in so and so magazine". Well, not to discount anyone who has written anything on cellular phones, but all the information in this file was purchased by me from various ads in the back of various radio and communications magazines. I make no pretense as to where the original source of this material comes from. In fact, most of the t-files I have seen contain some of the Consumertronics info. word for word, and the writers try and claim it as their own. Or maybe vice versa. I make no claim to have written this manual (but beleive me after putting this together I could). The only thing I have done is spent many hours compiling what I believe to be a very good file on the subject.

WHAT IS BROADCAST FROM A CELLULAR TOWER?

When a cellular phone makes a call, it normally transmits it's Electronic Security Number(ESN),Mobile Identification Number(MIN),it's Station Class Mark(SCM) and the number called in a short burst of data. This burst is the short buzz you hear after you press the SEND button and before the tower catches the data. These four things are the components the cellular provider uses to ensure that the phone is programmed to be billed and that it also has the identity of both the customer and the phone.

There are usually two cellular phone companies in an area. One is the wire-line carrier (Band B), which is usually Bell, and the other is the non-wireline carrier (Band A). Within the two bands are 832 cellular phone channels. Each one has 416 bands, and within the bands are voice channels that actually transmit and receive information from cellular phones.

The ESN and the phone number (MIN) are the two primary identifiers for any cellular phone. By changing both, the cellular carrier will accept the call and bill it to either a wrong account or provide service based on the fact that it is NOT a disconnected receiver. It will also look at the other two components, in order to insure that it is actually a cellular phone and to forward billing information to that carrier.

The Station Class Mark can also be changed if you wish to prevent the cellular carrier from determining the type of phone that is placing the call. By providing the cellular tower with a false SCM, the cellular carrier, the FCC, or whoever happens to chase down cellular fraud is often looking for a particular phone which in reality is not the phone they are looking for. For example, you can provide the SCM for a Radio Shack phone, when in reality you are using a Novatell (How this is done from changing the SCM I do not know...remember...I didn't write this).

The Number Assignment Module (NAM) also has the SIDH (System Identification for Home System) number programmed into it. Refer to SIDH TABLE. The transmittal of the SIDH number tells the carrier where to forward the billing information to in case the user is "roaming". The SIDH table tells the major cities and their identifying numbers. Changing an SIDH is programming job that takes only minutes, but be aware that the ESN is still sent to the cellular phone company. After they realize that the ESN is connected to either a fake number or a phone that is not in the network, they will block service. They only way around this is to reprogram the ESN.

DEFINITIONS

A 15-bit field in the NAM designating the System Identification for the Home System. Bit 0 of the SIDH corresponds to the Preferred System flag used elsewhere in the NAM. Bits 6 and 5 of byte 0 are international code bits. Normally the SIDH is entered during programming of the phone as a 5 digit decimal number. Enter 0's to the left-most unused positions when reprogramming.

Local Use Flag. Tells the cellular phone user if it must preregister with the system. Preregistration with the system means that a mobile must transmit its parameters to the Cellular System as soon as the power-up task and the control channel tasks are completed. "1" enables the flag. Usually set to "1".

A 1-bit flag designating that MIN2 (area code) is always sent when making system access. "1" enables the flag. Usually set to "1".

A 24-bit field representing the mobile telephone number. MIN2 plus MIN1 equals MIN, the 10-digit phone number.

A 4-bit field designating the Station Class Mark. A (3-Watt) 832 channel mobile unit typically will be 1000, a 1.2 Watt portable 1001 or a 0.6 Watt handheld 1010 or 1110 (discontinuous transmission, meaning push-to-talk). These are class I, Class II and Class III power levels respectively.

With the SCM the cellular system determines whether or not a cellular phone can be switched to one of the 156 channels.

An 11-bit field designating the initial paging channel to be used if in the home system. Normally it is 334 for wireline systems, 333 for non- wireline systems. But most phones allow other settings for test purposes.

A 4-bit field designating the overload class for the cellular phone. The intention of this entry is to allow the Cellular System to be able to determine priority in the event of a system overload, however it is currently useless as the system operators have generally not provided guidance for thier installers. The usual (and correct) system now in effect (in U.S.) is to use a "0" plus the last digit of the phone number. Test phones should be set at "10",emergency vehicles at "11","12" through "15" are reserved. (A class 15 system is supposed to be police, fire, or military).

1 1-bit flag designating the preferred system. If PS is "0", channels 334 through 666(EVIL!!!) are used. If PS is "1" then channels 1 through 333 are used. Even numbered system numbers (B systems) require a PS of "0", odd system numbers (A systems) require a "1".

A 4-bit field designating the Group Identification Mark. This number tells the Cellular system how far to look in the SIDH to determine if it is roaming in a system which may have a roam agreement with the phone system. It is usually set to "10".

A 4-bit field designating the unlock code. The digit "0" in the lock code is represented by an "A" in the actual NAM hexidecimal data. A lock code of all "0" sometimes unlocks the cellular phone.(Note: Lock codes are 3 digits. When programming a phone use "0" as the first number.)

A 1-bit flag designating that end-to-end signaling is enabled. End-to-end signaling means that the DTMF tones will be transmitted on the voice channel as well as being echoed on the handset. This feature in necessary for such services as Bank by Phone, activating answering machines and in third party long distance services such as Sprint and MCI. A "1" enables the flag. Usually set to "1".

A 1-bit flag designating that repertory memory (speed dialing) in the cellular phone is enabled. And once a again a "1" enables the flag.

A 1-bit flag designating that the horn alert feature in enabled. "1" enables the flag.

A 1-bit flag designating that the handsfree option is enabled. A "1" enables the flag. Often, transceivers supplied as hands-free units require that this flag be left at "0".

TYPES OF NAMS

The NAM contains all the information that can be programmed to the phone directly from the handset. (i.e. SIDH,MIN,LOCK-CODE,etc.).

All phones except NEC will accept tri-state NAMs. NEC requires an open collector NAM. Fujitsu phones will accept either open collector or tri- state NAMs.

Brand Qualifications: Fujitsu and Alpine phones will not operate properly with any Harris Brand NAM or with any Signetics brand NAMs with a part number NOT ending with an "A". TI NAMs must not be used in GE Star models. Panasonic has suggested only TI NAMs should be used in their phones. NAMs are available in ceramic (F) or plastic encapsulation (N).

NAM FORMAT MAP

The Checksum Adjustment and Checksum are calculated automatically after the data has been edited for the NAM. The sum of all words in the NAM plus the last two must equal a number with "0" in the last two digits. The radio checks this sum and if it isn't correct, the radio assumes the NAM is bad or that it has been tampered with.

* - These bits are used only by AT&T,Hitachi and Mitsubishi. They are A/B Enable and Roam Inhibit. They must be "0" for all other models.

** - My information does not agree here. One source claims that address 03 has 6 bits and that address 0D has 7 bits. The other source states the the exact opposite.

STANDARD NAM FORMATS

NAMs are generally mapped the same in all cellular phones, and the ones that have no "fancy" options are generally programmed the same. This chart provides the usual digits and settings for almost every NAM.

1. Home Area ID Number normally consists of five digits. However, four are usually sufficient is the U.S.

2. Access Overload Class is generally made up of a "0" plus the last digits of the telephone number. Some systems set at "15" or "00".

5. The Preferred Mark System is set to "0" for wireline, "1" for non- wireline systems.

NAM Programming (Reprogramming) Instructions For 30+ Cellular Telephones

PLEASE NOTE: Area specific numbers contained within these programming instructions may not be accurate for your cellular area.

The Ultimate Cellular Modification Manual

by Dr. Bloodmoney

WHAT IS BROADCAST FROM A CELLULAR TOWER?

DEFINITIONS

TYPES OF NAMS

NAM FORMAT MAP

STANDARD NAM FORMATS

of phone number

of phone number

ID No. (SIDH) 4* XXXX

(EE)

Mark (GIM)

(ACCOLC)

(IPCH)

(PS)

NAM Programming (Reprogramming) Instructions For 30+ Cellular Telephones