|
|
 |
|
|
|
register |
bbs |
search |
rss |
faq |
about
|
|
|
meet up |
add to del.icio.us |
digg it
|
|
|
|
The Ultimate Cellular Modification Manual: How to
NOTICE: TO ALL CONCERNED Certain text files and messages contained on this site deal with activities and devices which would be in violation of various Federal, State, and local laws if actually carried out or constructed. The webmasters of this site do not advocate the breaking of any law. Our text files and message bases are for informational purposes only. We recommend that you contact your local law enforcement officials before undertaking any project based upon any information obtained from this or any other web site. We do not guarantee that any of the information contained on this system is correct, workable, or factual. We are not responsible for, nor do we assume any liability for, damages resulting from the use of any information on this site.
*****************************************************************************
* THE ULTIMATE CELLULAR MODIFICATION MANUAL *
* released by *
* %%%%%%%% Dr. Bloodmoney %%%%%%%%%% *
* June 1, 1992 *
*****************************************************************************
The following information was gathered from various sources and is not meant
to be a technical treatise on the cellular network. There are plenty of
other files out there on the subject. This file specifically deals with the
processes involved in modifying cellulars. I put together this file because
I have not seen one that actually tells how to do this. When some of you
start reading this you might say to yourselves "Hey, some of this is almost
word for word from Brian Oblivion's article (incidently, one of the best
I have seen on the subject) in Phrack #38 or so and so's article in so and so
magazine". Well, not to discount anyone who has written anything on cellular
phones, but all the information in this file was purchased by me from various
ads in the back of various radio and communications magazines. I make no
pretense as to where the original source of this material comes from. In
fact, most of the t-files I have seen contain some of the Consumertronics
info. word for word, and the writers try and claim it as their own. Or maybe
vice versa. I make no claim to have written this manual (but beleive me
after putting this together I could). The only thing I have done is spent
many hours compiling what I believe to be a very good file on the subject.
=============================================================================
THE ULTIMATE CELLULAR MODIFICATION MANUAL
TABLE OF CONTENTS
PART I. WHAT IS BROADCAST FROM A CELLULAR TOWER?
PART II. DEFINITIONS
PART III. TYPES OF NAMS
PART IV. NAM FORMAT MAP
PART V. STANDARD NAM FORMATS
PART VI. NAM REPROGRAMMING INSTRUCTIONS FOR 30+ PHONES
PART VII. THE ELECTRONIC SERIAL NUMBER - AN INTRODUCTION
PART VIII. IDENTIFYING THE ESN IN YOUR CELLULAR PHONE
PART IX. SCANNING TO FIND THE ESN/MIN PAIR
PART X. A FEW COMMON SCANNER MODIFICATIONS
PART XI. THE 40-50 MHZ CELLULAR SCANNER
PART XII. HOW THE ESN IS REPLACED
PART XIII. EQUATIONS FOR PROGRAMMING THE CHIPS
PART XIV. MANUFACTURER'S ESN CODE LISTING
PART XV. HOME SYSTEM ID LISTING (A-L)
PART XVI. HOME SYSTEM ID LISTING (M-Z)
PART XVII. "THE ROAMING SCAM"
PART XVIII. MERCHANDISE SHEET
*****************************************************************************
Comments can be left to me at RIPCO (bloodmoney),Blitzkrieg,or Lucid Dreams
PART I. WHAT IS BROADCAST FROM A CELLULAR TOWER?
When a cellular phone makes a call, it normally transmits it's
Electronic Security Number(ESN),Mobile Identification Number(MIN),it's
Station Class Mark(SCM) and the number called in a short burst of data.
This burst is the short buzz you hear after you press the SEND button and
before the tower catches the data. These four things are the components
the cellular provider uses to ensure that the phone is programmed to be
billed and that it also has the identity of both the customer and the
phone.
There are usually two cellular phone companies in an area. One is
the wire-line carrier (Band B), which is usually Bell, and the other is the
non-wireline carrier (Band A). Within the two bands are 832 cellular phone
channels. Each one has 416 bands, and within the bands are voice channels
that actually transmit and receive information from cellular phones.
The ESN and the phone number (MIN) are the two primary identifiers
for any cellular phone. By changing both, the cellular carrier will accept
the call and bill it to either a wrong account or provide service based on
the fact that it is NOT a disconnected receiver. It will also look at the
other two components, in order to insure that it is actually a cellular
phone and to forward billing information to that carrier.
The Station Class Mark can also be changed if you wish to prevent
the cellular carrier from determining the type of phone that is placing the
call. By providing the cellular tower with a false SCM, the cellular
carrier, the FCC, or whoever happens to chase down cellular fraud is often
looking for a particular phone which in reality is not the phone they are
looking for. For example, you can provide the SCM for a Radio Shack phone,
when in reality you are using a Novatell (How this is done from changing
the SCM I do not know...remember...I didn't write this).
The Number Assignment Module (NAM) also has the SIDH (System
Identification for Home System) number programmed into it. Refer to SIDH
TABLE. The transmittal of the SIDH number tells the carrier where to forward
the billing information to in case the user is "roaming". The SIDH table
tells the major cities and their identifying numbers. Changing an SIDH is
programming job that takes only minutes, but be aware that the ESN is still
sent to the cellular phone company. After they realize that the ESN is
connected to either a fake number or a phone that is not in the network, they
will block service. They only way around this is to reprogram the ESN.
*****************************************************************************
PART II. DEFINITIONS
The following is a list of commonly used abbreviations used in cellular
phones.
SIDH
A 15-bit field in the NAM designating the System Identification for the Home
System. Bit 0 of the SIDH corresponds to the Preferred System flag used
elsewhere in the NAM. Bits 6 and 5 of byte 0 are international code bits.
Normally the SIDH is entered during programming of the phone as a 5 digit
decimal number. Enter 0's to the left-most unused positions when
reprogramming.
L.U.
Local Use Flag. Tells the cellular phone user if it must preregister with
the system. Preregistration with the system means that a mobile must
transmit its parameters to the Cellular System as soon as the power-up
task and the control channel tasks are completed. "1" enables the flag.
Usually set to "1".
MIN MARK
A 1-bit flag designating that MIN2 (area code) is always sent when making
system access. "1" enables the flag. Usually set to "1".
MIN2
A 10-bit field representing the area code of the mobile ID number.
MIN1
A 24-bit field representing the mobile telephone number. MIN2 plus MIN1
equals MIN, the 10-digit phone number.
SCM
A 4-bit field designating the Station Class Mark. A (3-Watt) 832 channel
mobile unit typically will be 1000, a 1.2 Watt portable 1001 or a 0.6 Watt
handheld 1010 or 1110 (discontinuous transmission, meaning push-to-talk).
These are class I, Class II and Class III power levels respectively.
With the SCM the cellular system determines whether or not a cellular phone
can be switched to one of the 156 channels.
Bit-1 is "0" for 666 and "1" for 832. (See cellular freq. list)
Bit-2 is "0" for a mobile unit and "1" for a voice-activated
transmit.
Bit-3 and -4 identify the power class of the phone:
"00" = 3.0 watts
"01" = 1.2 watts
"10" = 0.6 watts
"11" is not assigned
IPCH
An 11-bit field designating the initial paging channel to be used if in
the home system. Normally it is 334 for wireline systems, 333 for non-
wireline systems. But most phones allow other settings for test purposes.
ACCOLC
A 4-bit field designating the overload class for the cellular phone. The
intention of this entry is to allow the Cellular System to be able to
determine priority in the event of a system overload, however it is currently
useless as the system operators have generally not provided guidance for
thier installers. The usual (and correct) system now in effect (in U.S.) is
to use a "0" plus the last digit of the phone number. Test phones should be
set at "10",emergency vehicles at "11","12" through "15" are reserved.
(A class 15 system is supposed to be police, fire, or military).
P.S.
1 1-bit flag designating the preferred system. If PS is "0", channels 334
through 666(EVIL!!!) are used. If PS is "1" then channels 1 through 333 are
used. Even numbered system numbers (B systems) require a PS of "0", odd
system numbers (A systems) require a "1".
GIM
A 4-bit field designating the Group Identification Mark. This number tells
the Cellular system how far to look in the SIDH to determine if it is roaming
in a system which may have a roam agreement with the phone system. It is
usually set to "10".
LOCK DIGITS
A 4-bit field designating the unlock code. The digit "0" in the lock code
is represented by an "A" in the actual NAM hexidecimal data. A lock code of
all "0" sometimes unlocks the cellular phone.(Note: Lock codes are 3 digits.
When programming a phone use "0" as the first number.)
E.E.
A 1-bit flag designating that end-to-end signaling is enabled. End-to-end
signaling means that the DTMF tones will be transmitted on the voice channel
as well as being echoed on the handset. This feature in necessary for
such services as Bank by Phone, activating answering machines and in third
party long distance services such as Sprint and MCI. A "1" enables the flag.
Usually set to "1".
REP
A 1-bit flag designating that repertory memory (speed dialing) in the
cellular phone is enabled. And once a again a "1" enables the flag.
H.A.
A 1-bit flag designating that the horn alert feature in enabled. "1" enables
the flag.
H.F.
A 1-bit flag designating that the handsfree option is enabled. A "1" enables
the flag. Often, transceivers supplied as hands-free units require that
this flag be left at "0".
*****************************************************************************
PART III. TYPES OF NAMS
NAM Types Used in Cellular Phones
NAM- Number Assignment Module - A 32 word by 8 bit PROM
The NAM contains all the information that can be programmed to the phone
directly from the handset. (i.e. SIDH,MIN,LOCK-CODE,etc.).
All phones except NEC will accept tri-state NAMs. NEC requires an open
collector NAM. Fujitsu phones will accept either open collector or tri-
state NAMs.
Brand Qualifications: Fujitsu and Alpine phones will not operate properly
with any Harris Brand NAM or with any Signetics brand NAMs with a part
number NOT ending with an "A". TI NAMs must not be used in GE Star models.
Panasonic has suggested only TI NAMs should be used in their phones. NAMs
are available in ceramic (F) or plastic encapsulation (N).
BRAND OPEN COL. TRI-STATE OPEN COL. TRI-STATE
=============================================================================
Signetics 82S23 82S123
Texas Inst. 74S188 74S288 TBP18SA030 TBP18S030
AMD AM27LS18 AM27LS19 AM27S18 AM27S19
Texas Inst. TBP38SA030 TBP38S030
Harris HM7602 HM7603
MMI 53/6330 53/6331
MMI 53/63S080 53/63S081
NSC DM54S188 DM54S288 DM74S188
NSC DM82S23 DM82S123
Motorola This is for a special NAM used in some Motorolas. Requires
an adapter.
Fujitsu MB7056 MB7051
*****************************************************************************
PART IV. NAM FORMAT MAP
HEX
MARK DEFINITION MOST <- BIT SIGNIFICANCE -> LEAST ADDRESS
----------------------------------------------------------------------------
0 SIDH (14-8) 00
SIDH (7-0) 01
LU=LOCAL USE** 000000 MIN 02
LU A/B* RI* MIN2(33-28) 03
MIN2(27-24) 0000 04
0000 MIN1(23-20) 05
MIN1(19-12) 06
MIN1(11-4) 07
MIN1(3-0) 0000 08
0000 SCM(3-0) 09
00000 IPCH(10-8) 0A
IPCH(7-0) 0B
0000 ACCOLC(3-0) 0C
PS=PREFERRED** 0000000 PS 0D
SYSTEM 0000 GIM(3-0) 0E
LOCK DIGIT 1 LOCK DIGIT 2 0F
LOCK DIGIT 3 LOCK SPARE BITS 10
EE=END TO END EE 000000 REP 11
SIGNALING HA 000000 HF 12
REP=REPERTORY ----------------------------------------------
HA=HORN ALERT 13
HF=HANDS FREE 14
15
16
SPARE LOCATIONS (13-1D) 17
CONTAIN ALL ZEROS EXCEPT 18
FOR MANUFACTURERS OPTIONS 19
1A
1B
1C
1D
NAM CHECKSUM ADJUSTMENT 1E
NAM CHECKSUM 1F
The Checksum Adjustment and Checksum are calculated automatically after
the data has been edited for the NAM. The sum of all words in the NAM plus
the last two must equal a number with "0" in the last two digits. The radio
checks this sum and if it isn't correct, the radio assumes the NAM is bad or
that it has been tampered with.
* - These bits are used only by AT&T,Hitachi and Mitsubishi. They are A/B
Enable and Roam Inhibit. They must be "0" for all other models.
** - My information does not agree here. One source claims that address 03
has 6 bits and that address 0D has 7 bits. The other source states the
the exact opposite.
*****************************************************************************
PART V. STANDARD NAM FORMATS
NAMs are generally mapped the same in all cellular phones, and the
ones that have no "fancy" options are generally programmed the same. This
chart provides the usual digits and settings for almost every NAM.
ITEM DESCRIPTION NO. OF DIGITS USUAL SETTING
--------------------------------------------------------------------------
1 First 3 digits 3 XXX
of phone number
2 Last 4 digits 4 XXXX
of phone number
3 Lock Code(LOCK) 3 or 4 XXXA or XXXX
4 Area Code (MIN2) 3 XXX
5 Home Area System
ID No. (SIDH) 4* XXXX
6 Horn Alert (HA) 1 0 or 1
7 Hands Free (HF) 1 0 or 1
8 End-to-End Signaling 1 1
(EE)
9 Repertory Mark (REP) 1 1
10 Group Identification 2 10
Mark (GIM)
11 Access Overload Class 2 XX*
(ACCOLC)
12 Station Class Mark (SCM) 4* XXXX
13 Local Use Mark (LU) 1 1
14 Min Mark (MIN) 1 1
15 Initial Paging Channel 3 333 or 334*
(IPCH)
16 Preferred System Mark 1 0 or 1*
(PS)
* Notes-
1. Home Area ID Number normally consists of five digits. However, four
are usually sufficient is the U.S.
2. Access Overload Class is generally made up of a "0" plus the last
digits of the telephone number. Some systems set at "15" or "00".
3. Station Class Mark is expressed as four binary digits.
4. Initial Paging Channel is 334 for wireline, 333 for non-wireline
systems.
5. The Preferred Mark System is set to "0" for wireline, "1" for non-
wireline systems.
*****************************************************************************
PART VI.
NAM Programming (Reprogramming) Instructions
For 30+ Cellular Telephones
-----------------------------------------------------------------------------
PLEASE NOTE: Area specific numbers contained within these programming
instructions may not be accurate for your cellular area.
-----------------------------------------------------------------------------
Programming Instructions for:
DIAMONDTEL MESA90X HANDHELD
ACTION TO STORE DISPLAY
USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE -
PRESS FCN 7
ENTER 4 DIGIT SECURITY CODE
ENTER NEW 3 DIGIT UNLOCK CODE
PRESS CLR
PWR up unit
Press "END" and hold within 10 seconds of pwr up
Enter "5132920"
Release END key.
0 SEND DUAL NO
XXXXXXXXXX SEND NO1
_ _ _ _ _ SEND SID1
1 SEND LU1
1 SEND EX1
334 SEND IPCH1
07 SEND ACCOLC1
0 SEND PREF1
10 SEND GIM1
0 SEND RI1
1 SEND DTX1
1 SEND AR1
1234 SEND SEC
1 SEND EE
1 SEND C TONE
0 SEND AL
0 SEND BO
1 SEND BEEP
TO EXIT PROGRAMMING MODE PRESS "END" AT ANY TIME
TO RESET NAM FROM THE LIMIT OF 3 PROGRAM ATTEMPTS
PWR up unit
Press "END" and hold within 10 seconds of pwr up
TO RESET NAM OF MESA 90 HANDHELD USE THE CODE "6972814"
Programming Instructions for:
DIAMONDTEL MESA99X HANDHELD
ACTION TO STORE DISPLAY
USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE -
PRESS FCN 7
ENTER 4 DIGIT SECURITY CODE
ENTER NEW 3 DIGIT UNLOCK CODE
PRESS CLR
PWR up unit
Press "END" and hold within 10 seconds of pwr up
Enter "5132920"
Release END key.
0 SEND DUAL NO
XXXXXXXXXX SEND NO1
_ _ _ _ _ SEND SID1
1 SEND LU1
1 SEND MIN MARK1
334 SEND IPCH1
07 SEND ACCOLC1
10 SEND GIM1
0 SEND RI1
0 SEND DTX1
0 SEND AR1
1234 SEND SEC
1 SEND CONTINUE D.T.M.F.
0 SEND AUTO LOCK
0 SEND BOOSTER
TO EXIT PROGRAMMING MODE PRESS "END" AT ANY TIME
Programming Instructions for:
GATEWAY CP 900 HANDHELD
USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE -
CURRENT UNLOCK CODE CAN NOT BE SEEN AND MUST BE KNOWN TO CHANGE
THE CURRENT UNLOCK CODE.
PRESS MENU
ENTER 03
ENTER CURRENT 4 DIGIT SECURITY CODE
ENTER NEW 4 DIGIT SECURITY CODE
PHONE WILL AUTO EXIT TO READY
ACTION TO STORE DISPLAY
PRESS MENU 99 ENTR SCRTY CODE(FCTRY PRST IS 9999) PROGRAM NAM
_ _ _ _ _ SEND SID
XXXXXXXXXX SEND PHONE NUMBER
0334 SEND IPC
07 SEND ACCOL
10 SEND GIM
1 SEND MOBILE I.D. NUMBER
1 SEND LOCAL USE MARK
2 SEND SYSTEM SELECT (B)
UPON PRESSING SEND THE PHONE WILL CYCLE TO WAIT AND THEN RETURN TO THE
READY MODE.
TO DISPLAY THE NEW PHONE NUMBER:
PRESS RCL 00
Programming Instructions for:
GENERAL ELECTRIC MINI II
ACTION TO STORE DISPLAY
USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE -
PRESS FCN 7
ENTER 4 DIGIT SECURITY CODE
ENTER NEW 3 DIGIT UNLOCK CODE
PRESS CLR
PWR up unit
Press and hold END key within 10 seconds of pwr up
Enter "6282905"
Release END key
0 Press SEND DUAL NO
XXXXXXXXXX Press SEND NO1
_ _ _ _ _ Press SEND SID1
1 Press SEND LU1
1 Press SEND EX1
0334 Press SEND IPCH1
07 Press SEND ACCOLC1
0 Press SEND PREF1
10 Press SEND GIM1
0 Press SEND RI1
1 Press SEND DTX1
1 Press SEND AR1
1234 Press SEND SEC
1 Press SEND EE
1 Press SEND C DTMF
0 Press SEND AL
0 Press SEND BEEP
0 Press SEND BO
TO EXIT PROGRAMMING MODE PRESS "END" AT ANY TIME
Programming Instructions for:
GENERAL ELECTRIC MINI
ACTION TO STORE DISPLAY
USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE -
UNLOCK CODES WILL BE CHANGED ONLY IN PROGRAMMING MODE
FOLLOW THE INSTRUCTIONS THAT FOLLOW
PWR up unit
Press and hold CL key within 10 seconds of pwr up
0Enter "7591122"
Release CL key
XXXXXXXXXX PRESS SEND MIN
123 PRESS SEND UNLOCK
_ _ _ _ _ PRESS SEND SID
1 PRESS SEND LU
1 PRESS SEND MIN MARK
334 PRESS SEND IPCH
07 PRESS SEND ACCOLC
0 PRESS SEND PS
10 PRESS SEND GIM
1 PRESS SEND EE
0 PRESS SEND BOOSTER
1 PRESS SEND AR
TO EXIT PROGRAMMING MODE PRESS "END" AT ANY TIME
Programming Instructions for:
MITSUBISHI 800
ACTION TO STORE DISPLAY
PWR up unit
Press and Hold STO within 10 Seconds of pwr up
Enter "5474432"
Release STO
0 Press SEND dUAL
XXXXXXXXXX Press SEND NO1
_ _ _ _ _ Press SEND SId1
1 Press SEND LU1
0 Press SEND MIN Mark
0334 Press SEND IPCH
07 Press SEND ACCOLC
0 Press SEND PS1
10 Press SEND GI1
1234 Press SEND SECUrity
1 Press SEND EE
0 Press SEND dt
1 Press SEND HF
0 Press SEND InHIbit
1 Press SEND C tOnE
0 Press SEND SyS A/B
0 Press SEND dUAL HS
0 Press SEND InHibit Ld
TO EXIT PROGRAMMING MODE PRESS "END" AT ANY TIME
Programming Instructions for:
MITSUBISHI 900
ACTION TO STORE DISPLAY
PWR up unit
Press and Hold END key within 10 seconds of pwr up
Enter "6972814"
Release END key
0 Press SEND DUAL NO
XXXXXXXXXX Press SEND NO1
_ _ _ _ _ Press SEND SID1
1 Press SEND LU1
0 Press SEND EX1
0334 Press SEND IPCH1
07 Press SEND ACCOLC1
0 Press SEND PREF1
10 Press SEND GIM1
0 Press SEND RI1
1 Press SEND DTX1
1 Press SEND AR1
1234 Press SEND SEC
1 Press SEND EE
1 Press SEND C DTMF
0 Press SEND AL
0 Press SEND BO
1 Press SEND BEEP
TO EXIT PROGRAMMING MODE PRESS "END" AT ANY TIME
TO ENTER TEST MODE HOLD END ON PWR UP-CODE 0944635
Programming Instructions for:
MOTOROLA 8000H
ACTION TO STORE DISPLAY
USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE -
THIS FUNCTION IS PROVIDED IN STEP 9 OF THE PROGRAMMING
MODE
PWR up unit
Enter STORE #123456123456 RCL
If the phone is fresh from factory then
Enter STORE #000000000000 RCL
If the phone is used or already programmed then
Enter STORE #123456123456 RCL
DISPLAY WILL SHOW 01
PRESS *
_ _ _ _ _ * 02 (SID)
XXX * 03 (Area Code)
XXX XXXX * 04 (Phone #)
14 * 05
07 * 06
00 * 07
123456 * 08
123 * 09
334 * 10
010100 * 11
000 *
PRESS * TO REVIEW ENTRIES
TO BURN NAM: PRESS SEND WHILE 01,02,03, ETC. IS DISPLAYED
SET TO SCAN B MODE BY :
RCL * : PRESS * UNTIL SCAN B MODE SHOWS then:
press store
Programming Instructions for:
MOTOROLA ULTRA CLASSIC HANDHELD
ACTION TO STORE DISPLAY
USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE -
THE UNLOCK CODE IS PROGRAMMED IN STEP 8 OF THE PROGRAMMING
MODE
FOR NEW PHONE: Press FCN, 0 + Security code entered twice (Factory
preset is 000000), RCL
The message 01 will appear in the display to confirm programming mode.
Press * 01 Press *
1) _ _ _ _ _ Press * 02 Press *
2) XXX Press * 03 Press *
3) XXX XXXX Press * 04 Press *
4) 14 Press * 05 Press *
5) 07 Press * 06 Press *
6) 10 Press * 07 Press *
7) 123456 Press * 08 Press *
8) 123 Press * 09 Press *
9) 0334 Press * 10 Press *
10) 010101 Press * 11 Press *
11) 101 Press * 12 Press *
Review entries by pressing "*" repeatedly.
Press SEND to program phone.
Programming Instructions for:
NEC P300
ACTION TO STORE DISPLAY
THESE INSTRUCTIONS FOR SERIAL NUMBERS AFTER 135-839601
Insert NAM Programming Adapter (NECAM #41-2019) into plug connector on P300
phone bottom.
PWR On
RCL # 0 1 to enter test mode. Phone will display shaded blocks.
RCL # 7 6 to select NAM. Phone will show 76-
Press 0 # to program NAM 1. (NAM 1=0,NAM 2=1,NAM 3=2,NAM 4=3)
RCL # 7 1 to enter programming mode.
XXXXXXXXXX PRESS # MIN
1234 PRESS # LOCK CODE
_ _ _ _ _ PRESS # SID
10 PRESS # GROUP I.D.
0334 PRESS # INITIAL PAGING CH
0 PRESS # SYSTEM SELECT (1=A)
07 PRESS # ACCOLC
1 PRESS # MIN MARK 1
1 PRESS # LOCAL USE
911 PRESS # EMERGENCY NO.
Press Clr (and hold) to exit programming and return to TEST MODE.
Press RCL # 0 2 to burn and exit to standby.
THESE INSTRUCTIONS FOR SERIAL NUMBERS PRIOR TO 135-839601
Insert NAM Programming Cable (41-2019)
PWR on
RCL # 7 6 to enter TEST MODE
Press 0 # to select NAM.
RCL # 7 1
You are now in Programming Mode.
Enter NAM info as above.
Press and hold CLR to exit.
Pwr down.
Programming Instructions for:
NEC P9100
ACTION TO STORE DISPLAY
USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE -
UNLOCK CODES WILL BE CHANGED ONLY IN PROGRAMMING MODE
FOLLOW THE INSTRUCTIONS THAT FOLLOW
Make sure NAM battery is fully charged before attempting programming
Switch power on
Press RCL #01 display will then show shaded blocks
For a USED phone - to clear nam and accumulated call timer
Press RCL #39
To program NAM1
Press RCL #760#
To enter programming mode Press RCL #71
XXXXXXXXXX Press # MIN
1234 Press # Lock Code
_ _ _ _ _ Press # SYS. I.D.
10 Press # G.I. Mark
0334 Press # First Paging Channel
0 Press # System Select
07 Press # ACCOLC
0 Press # MIN Mark
1 Press # Local Use
TO EXIT PROGRAM MODE AT THIS TIME PRESS CLR AND HOLD
DISPLAY WILL SHOW TEST MODE
TO EXIT TEXT MODE PRESS RCL#02
IF THE MEMORY IS CLEARED VIA RCL #39 DURING THE PROGRAMMING THEN THE PHONE
WILL AUTOMATICALLY ENTER FULL-LOCK AFTER EXITING THE TEST MODE
TO UNLOCK: FCN #XXXX(4 DIGIT LOCK CODE FOR LAST NAM PROGRAMMED).
Programming Instructions for:
NOKIA P-30
ACTION TO STORE DISPLAY
USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE -
PRESS SEL 7 UNLCODE APPEARS ON THE DISPLAY
ENTER 5 DIGIT SECURITY CODE AND THE CURRENT UNLOCK CODE APPEARS IN
THE DISPLAY PRESS CLR AND ENTER THE NEW FOUR DIGIT UNLOCK CODE
PRESS SEL TO STORE THE NEW CODE - NOTE: IF YOU DON'T PRESS SEL WITHIN
FIVE SECONDS THE DISPLAY WILL CLEAR AND CANCEL THE FUNCTION
PWR up unit
Enter *17*2001*12345*
HO-Id must appear on display
Press SEL to view current value
Display will be one step behind TO STORE instructions
_ _ _ _ _ Press SEL ACCESS (SID)
1 Press SEL LOCAL
1 Press SEL PhonE n
XXXXXXXXXX Press SEL CLASS
10 Press SEL PAGE ch
334 Press SEL O-LOAd
07 Press SEL GrouP
10 Press SEL SEC
12345 Press SEL AUTO EXIT PROGRAM MODE
TO EXIT PROGRAMMING MODE AT ANY TIME PRESS "END"
WHEN THE SEL KEY IS PRESSED FOLLOWING THE LAST PARAMETER VALUE, THE PHONE
WILL AUTOMATICALLY EXIT THE NAM PROGRAMMING MODE AND RETURN TO NORMAL
OPERATION
Programming Instructions for:
NOVATEL PTR800
ACTION TO STORE DISPLAY
USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE -
UNLOCK CODES WILL BE CHANGED ONLY IN PROGRAMMING MODE
FOLLOW THE INSTRUCTIONS THAT FOLLOW
PWR up unit
Press FCN
Press FCN again
Enter *626776*
Display will show CMT REV and a date code - Press Volume Up
Display will show NAM SELECT1 Press Volume Up
_ _ _ _ _ PRESS # PRESS VOLUME UP SIDH
PRESS VOLUME UP SCM
XXXXXXXXXX PRESS # PRESS VOLUME UP MIN
0333 PRESS # PRESS VOLUME UP IDCCA
0334 PRESS # PRESS VOLUME UP IDCCB
0334 PRESS # PRESS VOLUME UP IPCH
07 PRESS # PRESS VOLUME UP ACCOLC
10 PRESS # PRESS VOLUME UP GIM
123 PRESS # PRESS VOLUME UP LOCK A
456 PRESS # PRESS VOLUME UP LOCK B
1 PRESS # PRESS VOLUME UP OPTION LC
1 PRESS # PRESS VOLUME UP OPTION EX
0 PRESS # PRESS VOLUME UP OPTION PS
0 PRESS # PRESS VOLUME UP OPTION NSC
1 PRESS # PRESS VOLUME UP OPTION EE
1 PRESS # PRESS VOLUME UP OPTION REP
0 PRESS # PRESS VOLUME UP OPTION HA
0 PRESS # PRESS VOLUME UP OPTION HF
0 PRESS # PRESS VOLUME UP OPTION F1
0 PRESS # PRESS VOLUME UP OPTION F2
0 PRESS # PRESS VOLUME UP OPTION F3
0 PRESS # PRESS VOLUME UP OPTION F4
TO EXIT PROGRAMMING MODE AT ANY TIME PRESS FCN END
FCN FCN *6462257* WILL CLEAR THE NAM IF IT HAS BEEN PROGRAMMED MORE THAN
3 TIMES OR IF THE NEED EXISTS TO CLEAR THE MEMORY
Programming Instructions for:
NOVATEL PTR825
ACTION TO STORE DISPLAY
PWR up unit
Press FCN
Press FCN again
Enter *697201*
Display will show CMT REV 972 105 Press Volume Up
1 PRESS # VOL UP NAM SELECT 1
_ _ _ _ _ PRESS # VOL UP SIDH
10 PRESS VOL UP SCM
XXXXXXXXXX PRESS # VOL UP MIN
0333 PRESS VOL UP IDCCA
0334 PRESS VOL UP IDCCB
0334 PRESS # VOL UP IPCH
07 PRESS # VOL UP ACCOLC
10 PRESS # VOL UP GIM
123 PRESS # VOL UP LOCK A
123 PRESS # VOL UP LOCK B
1 PRESS # VOL UP LC
1 PRESS # VOL UP OPTION EX
0 PRESS # VOL UP PS - PREF SYSTEM
0 PRESS VOL UP OPTION NSC
1 PRESS # VOL UP OPTION EE-END TO END
1 PRESS # VOL UP OPTION REP
0 PRESS # VOL UP HORN ALERT
0 PRESS # VOL UP HANDS FREE
0 PRESS # VOL UP OPTION F1
0 PRESS # VOL UP OPTION F2
0 PRESS # VOL UP OPTION F3
1 PRESS # VOL UP OPTION F4 AIR RND UP
0 PRESS # VOL UP OPTION F5 FUTURE USE
0 PRESS # VOL UP OPTION F6 FUTURE USE
0 PRESS # VOL UP OPTION F7 FUTURE USE
Programming will now wrap to beginning SIDH display.
Press VOL UP to review entries
Programming Instructions for:
OKI HANDHELD MODEL # 750
ACTION TO STORE DISPLAY
USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE -
THIS FUNCTION IS PROVIDED FOR IN THE PROGRAMMING SEQUENCE
Pwr up unit
Press (*) and (#) simultaneously
Enter 10 digit Sec Code as follows: *12345678#
What follows can be done only once!
The display "Enter NEW PW-Sto"
Enter 0123456789 then press STORE
Pwr unit down.
Pwr up unit
Press MENU and RCL simultaneously
Enter 0123456789 Software Version and
ESN Number in HEX
Clears in 2 secs.
Spd Dial Mem Clear
Press 0 Press STO Def Data Reset
Press 0 Press STO
NAM 1 Mode
Own #111 111-1111
XXX XXX XXXX Press STO Vol Up Security
123456 Press STO Vol Up OPTION
1100 Press STO Vol Up SCM
1010 Press STO Vol Up GIM
10 Press STO Vol Up Unlock #
1234 Press STO Vol Up ACCOLC #
07 Press STO Vol Up IPCH NO.
0334 Press STO Vol Up
_ _ _ _ _ Press STO Vol Up System ID:
At this time you may exit the programming mode by pressing CLR to bypass
the other NAM modules.
Programming Instructions for:
OKI HANDHELD MODEL # 900
ACTION TO STORE DISPLAY
USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE -
THIS FUNCTION IS PROVIDED FOR IN THE PROGRAMMING SEQUENCE
Pwr up unit
Press RCL and MENU simultaneously
Enter 10 digit Sec Code as follows: *12345678#
What follows can be done only once!
The display "Enter NEW PW-Sto"
Enter 0123456789 then press STORE.
The display "Re-Enter New PW-Sto"
Enter 0123456789 then press STORE to enter Programming Mode.
IF You don't wish to keep the new password then Pwr unit down.
Software Version and
ESN Number in HEX
Clears in 2 secs.
Spd Dial Mem Clear
Press * Press STO SPD DIAL MEM CLEAR
Press * Press STO DEFAULT DATA CLEAR
NAM 1 Mode
Own #111 111-1111
XXX XXX XXXX Press STO Vol Up MIN
123456 Press STO Vol Up SECURITY
_ _ _ _ _ Press STO Vol Up SYSTEM ID:
0334 Press STO Vol Up IPCH
07 Press STO Vol Up ACCOLC #
15 Press STO Vol Up GROUP I.D.
1234 Press STO Vol Up UNLOCK CODE
1010 Press STO Vol Up STATION CLASS
1110 Press STO Vol Up OPTION
At this time you may exit the programming mode by pressing CLR to bypass
the other NAM modules.
Programming Instructions for:
PANASONIC EB3500
Charged Battery and Nam Adaptor are needed.
ACTION TO STORE DISPLAY
USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE -
THIS FUNCTION IS PROVIDED FOR IN THE PROGRAMMING SEQUENCE
*0000# to enter program mode
*1 Press SND NAM 1 MODE
_ _ _ _ _ Press STO 01 SIDH
XXXXXXXXXX Press STO 02 OWNDL
0 Press STO 03 PRESYS
334 Press STO 04 IPCH
07 Press STO 05 ACCOLC
10 Press STO 06 GIM
00 Press STO 07 DLMT
10 Press STO 08 SCM
911 Press STO 09 SPDL
1234 Press STO 10 LOCK
1 1 0 1 1 0 0 0 Press STO 11 FCN 1
0 0 0 1 0 1 0 0 Press STO 12 FCN 2
1 1 1 1 0 1 1 1 Press STO 13 FCN 3
STO **
END to program phone
Programming Instructions for:
COLT TRANSPORTABLE
ACTION TO STORE DISPLAY
USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE -
UNLOCK CODES WILL BE CHANGED ONLY IN PROGRAMMING MODE
FOLLOW THE INSTRUCTIONS THAT FOLLOW
Phone must be locked, to accomplish: press FUNC 5
Enter: FUNC #626# FUNC
The software revision date will be shown.
Press SEND
This will advance phone through memory locations.
E.S.N. will be displayed, press SEND again.
XXX Press SEND AREA CODE
XXX XXXX Press SEND PHONE NUMBER
_ _ _ _ _ Press SEND SYSTEM ID
07 Press SEND ACCOLC
10 Press SEND GIM
1 Press SEND LOCAL USE MARK
1 Press SEND MIN MARK (MOBILE ID)
123 Press SEND LOCK CODE
0 Press SEND AUTOMATIC LOCK
123 Press SEND CALL RESTRICTION
12 Press SEND CALL COUNTER RESET
1 Press SEND ENABLE HANDSFREE
0 Press SEND DISABLE HORN ALERT
0 Press SEND HA TURN OFF TIME
12 Press SEND TOTAL AIRTIME RESET
TO REVIEW PROGRAMMING AT THIS TIME PRESS SEND.
TO EXIT PROGRAMMING AND STORE DATA AT ANY TIME PRESS
END FUNC END - WAKE UP WILL SOUND, PHONE WILL BE LOCKED
ENTER UNLOCK CODE- 123
SYSTEM PREFERENCE MUST BE KEYPAD SELECTED! PRESS FUNC 7 FOR "A" NON W/L
OR PRESS FUNC 8 FOR "B" W/L SYS.
Programming Instructions for:
DIAMONDTEL MESA 55 TRANSPORTABLE
ACTION TO STORE DISPLAY
PWR up unit
Press "CL" and hold within 10 seconds of pwr up
Enter "1951426"
Current Mobile I.D. will display
XXXXXXXXXX Press SEND MIN
123 Press SEND 1 SECURITY
_ _ _ _ _ Press SEND 2 SID
1 Press SEND 3 LU
1 Press SEND 4 MIN MARK
334 Press SEND 5 IPCH
07 Press SEND 6 ACCOLC
0 Press SEND 7 PREF SYS
10 Press SEND 8 GIM
1 Press SEND 9 EE
1 Press SEND 10 ENBL HANDSFREE
0 Press SEND 11 RI
04 Press SEND 12 AUX 1
07 Press SEND 13 AUX 2
Phone automatically returns to show the 10 digits MIN number at this time
and to indicate that the NAM has been programmed. The END key should be
pressed to burn the NAM.
Programming Instructions for:
DIAMONDTEL MESA95 TRANSPORTABLE
ACTION TO STORE DISPLAY
PWR up unit
Press and hold Clr within 10 Seconds of pwr up
Enter "1951426"
Release Clr
0 Press SEND duaAL no
XXXXXXXXXX Press SEND no1
_ _ _ _ _ Press SEND SId1
1 Press SEND LU1
1 Press SEND E1
334 Press SEND IPCH1
07 Press SEND ACCOLC1
0 Press SEND PS1
10 Press SEND GI1
5 Press SEND t InC1
1234 Press SEND SECUrIty
1 Press SEND EE
0 Press SEND dt
0 Press SEND HF
0 Press SEND InHIbIt
1 Press SEND Ctone
0 Press SEND dIS CU
0 Press SEND dIS IGn
SEnSE
0 Press SEND DUAL HS
TO EXIT PROGRAMMING MODE PRESS "END" AT ANY TIME
TO RESET NAM FROM THE LIMIT OF 3 PROGRAM ATTEMPTS
FOLLOW THE BLOCK OF INSTRUCTIONS AT TOP USING "8291112" W/CLR
TO RESET NAM OF MESA 90 HANDHELD USE THE CODE "6972814"
Programming Instructions for:
FUJITSU MOBILE PHONE
ACTION TO STORE DISPLAY
PWR up unit
Unit must be locked to program.
To lock press F+LOCK
PWR down unit.
PWR up unit.
Within 10 seconds press #626#7764726 (#NAM#PROGRAM)
A continuous tone will be heard for 7 seconds.
PRESS AND HOLD THE * KEY WHILE THE TONE SOUNDS,
DO NOT LET GO!
The tone will change to an intermittent tone, then it will stop.
Release the * key.
CONGRATULATIONS!!! YOU ARE NOW IN PROGRAMMING MODE!
_ _ _ _ _ PRESS STOR 1 SIDH
1 PRESS STOR 2 LOCAL
1 PRESS STOR 3 MIN MARK
XXXXXXXXXX PRESS STOR 4 MIN
10 PRESS STOR 5 STATION
0334 PRESS STOR 6 IPCH
07 PRESS STOR 7 ACCOLC
0 PRESS STOR 8 PS
10 PRESS STOR 9 GIM
1234 PRESS STOR 10 LOCK
1 PRESS STOR 11 CALL TIME
2 PRESS STOR 12 AUTO LOCK
1 PRESS STOR 13 CALL REST
PRESS STOR TO REVIEW ENTRIES.
WHEN AT MODE #1 PRESS SEND TO BURN NAM AND RETURN TO NORMAL OPERATION.
IF PROGRAMMING WAS DONE INCORRECTLY A SHORT HIGH TONE WILL BE HEARD, YOU
MUST THEN REPEAT DATA ENTRY. YOU MUST PRESS STOR AFTER EACH ENTRY FOR THE
CHECKSUM FUNCTION TO BE FULFILLED.
Programming Instructions for:
GENERAL ELECTRIC CARFONE XR3000
ACTION TO STORE DISPLAY
USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE -
THE UNLOCK CODE IS PROGRAMMED IN STEP 2 OF THE PROGRAMMING
MODE
PWR up unit
Press "CL" and hold within 10 seconds of pwr up
Enter "923885"
Serial # will display
Press Send key to advance to first entry
XXXXXXXXXX Press SEND MIN
123 Press SEND UNLOCK
_ _ _ _ _ Press SEND SID
1 Press SEND LU
1 Press SEND MIN MARK
334 Press SEND IPCH
07 Press SEND ACCOLC
0 Press SEND PS
10 Press SEND GIM
0 Press SEND AUX
1 Press SEND HANDS
PRESS SEND TO REVIEW ENTRIES. NOTE: AREA CODE (402) WILL DISPLAY FOR MIN
THEN AUTO SWITCH TO REST OF NUMBER ON DISPLAY - BE PATIENT
PRESS "E" KEY TO COMPLETE PROGRAMMING OF THE XR 3000 AT THIS TIME
Programming Instructions for:
GOLDSTAR SERIES 5000 MOBILE
ACTION TO STORE DISPLAY
PWR up Unit
Press FCN 4 to see the selected NAM. Press * to advance. Select NAM1.
Press FCN, 9, 9, * "Enter Code" will be displayed.
Enter 1234567890
XXXXXXXXXX PRESS MEM Enter MIN
_ _ _ _ _ PRESS MEM Enter System ID
0334 PRESS MEM Enter IPCH
07 (ACCOLC) PRESS MEM Enter OVLD Class
1234 PRESS MEM LOCK CODE
123456 PRESS MEM SECURITY CODE
1234 PRESS MEM ALARM DISARM CODE
0 PRESS MEM PREFFERED SYSTEM
0 PRESS MEM STATION CLASS MARK
1 PRESS MEM HANDS FREE MARK (ON)
1 PRESS MEM LOCAL USE MARK (ON)
1 PRESS MEM MIN MARK (ON)
0 PRESS MEM HORN ALERT (OFF)
0 PRESS MEM OPT. SPEAKER (OFF)
TO SAVE TO NAM NOW PRESS MEM
TO REVIEW ENTRIES USE THE VOLUME UP OR DOWN KEYS
Programming Instructions for:
MITSUBISHI 555,560,600
ACTION TO STORE DISPLAY
USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE -
TO PROGRAM THIS FUNCTION YOU MUST BE OUT OF THE PROGRAMMING MODE
ENTER FCN 6 AND THEN ENTER THE NEW 3 DIGIT UNLOCK CODE
PRESS CLR.
To program from keypad remove and discard Nam Pad
PWR up unit
Press and Hold STO key within 10 seconds of pwr up
Enter "5474432"
Release STO key
XXXXXXXXXX Press SEND MIN
123 Press SEND SECURITY CODE
_ _ _ _ _ Press SEND SID
1 Press SEND LU
1 Press SEND MIN MARK
334 Press SEND IPCH1
07 Press SEND ACCOLC1
0 Press SEND PS1
10 Press SEND GIM
1 Press SEND EE
1 Press SEND HANDS FREE
0 Press SEND ROAM INHIBIT
0 Press SEND A/B SELECT
00 Press SEND f3-f0 DUAL HEAD
00 Press SEND f7-f4 LD INH
TO EXIT PROGRAMMING MODE PRESS "END" AT ANY TIME
Installing the LOCK CODE
To program the customer's lock code, the phone must be out ot the
programming mode.
To program, enter FCN, 6,3-digit security code, the a 3-digit lock code.
Press CLR.
Programming Instructions for:
NEC M3700 SERIES MOBILE
ACTION TO STORE DISPLAY
USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE -
UNLOCK CODES WILL BE CHANGED ONLY IN PROGRAMMING MODE
FOLLOW THE INSTRUCTIONS THAT FOLLOW
A NAM PROGRAMMER ADAPTOR (NECAM #41-2012) IS
REQUIRED
PWR UP
TO ENTER TEST MODE:
RCL, #,0,1. WILL CYCLE TO SHADED
TO CLEAR MEMORY:
RCL # 3 9
select nam
RCL # 7 6 0 # nam 1
RCL # 7 6 1 # nam 2
TO ENTER PROGRAMMING MODE:
RCL #71
XXX XXX XXXX PRESS # Telephone No. (MIN)
1234 PRESS # Lock Code
_ _ _ _ _ PRESS # Home Area (SYS I.D.)
10 PRESS # G-NO (Group I.D.)
0334 PRESS # First Paging Channel
0 for wireline PRESS # System Select
07 PRESS # ACCOLC
1 PRESS # ACCESS
1 PRESS # Local Use
To exit PROGRAMMING MODE PRESS CLR and hold TEST MODE will show
to exit TEST MODE RCL #02
IF MEM WAS CLEARED VIA RCL #39, PHONE WILL AUTOMATICALLY ENTER FULL-LOCK
AFTER EXITING THE TEST MODE.
TO UNLOCK PRESS FCN # 1234.
Programming Instructions for:
NOKIA LX-11
ACTION TO STORE DISPLAY
USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE -
PRESS SEL,5 THEN ENTER 5 DIGIT SECURITY CODE
PRESS SEL TO RECEIVE DISPLAY OF CURRENT UNLOCK CODE
PRESS 5 NOW TO CLEAR ALL CALL TIMERS
ENTER THE NEW UNLOCK CODE
PRESS SEL TO ACCEPT
PWR up unit
Enter *3001#12345 Then - SEL 9 END
IdEnt IF InFO should appear on display
Pressing END will move you through the parameters
Pressing SND will toggle between choices available
_ _ _ _ _ Press END HO-Id (SID)
1 Press END ACCESS
1 Press END LOCL OPt
XXXXXXXXXX Press END Phonxx
08 Press END St CLASS
334 Press END PAging Ch
07 Press END O-LOAd CLASS
B Press END PrEF SyS
10 Press END grOUP Id
12345 Press END SECUrIty
-------- (Can't be changed) Press END 1 dAtE
00/00/90 (INSTALLATION DATE) Press END 2 dAtE
TO EXIT PROGRAMMING MODE AT ANY TIME PRESS "END" TO STORE LAST PARAMETER
THEN POWER DOWN
WHEN THE "END" KEY IS PRESSED FOLLOWING THE LAST PARAMETER, THE TEXT
Prog donE WILL APPEAR ON DISPLAY
Programming Instructions for:
NOKIA M-10
ACTION TO STORE DISPLAY
USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE -
THIS FUNCTION IS PROVIDED BY THE SECURITY CODE PROGRAMMED AT THE
TIME OF PROGRAMMING
PWR up unit
Enter *17*3001*1234*
HO-Id must appear on display
Press SEL to view current value
Display will be one step behind TO STORE instructions
_ _ _ _ _ Press SEL ACCESS (SID)
1 Press SEL LOCAL
1 Press SEL PhonE n
XXXXXXXXXX Press SEL CLASS
08 Press SEL PAGE ch
334 Press SEL O-LOAd
07 Press SEL GrouP
10 Press SEL SEC
1234 Press SEL AUTO EXIT PROGRAM MODE
TO EXIT PROGRAMMING MODE AT ANY TIME PRESS "END"
WHEN THE SEL KEY IS PRESSED FOLLOWING THE LAST PARAMETER VALUE, THE PHONE
WILL AUTOMATICALLY EXIT THE NAM PROGRAMMING MODE AND RETURN TO NORMAL
OPERATION
Programming Instructions for:
NOVATEL 8305 TRANSPORTABLE
CA08 SOFTWARE VERSION
USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE -
IF EQUIPMENT IS PROVIDED WITH A MENU KEY THEN ENTER THE MENU PORTION OF
THE PHONE AND DISPLAY AND IF NECESSARY REPROGRAM THE UNLOCK CODE FROM
THERE.
IF PHONE DOES NOT HAVE A MENU KEY THEN THERE CAN BE NO PROGRAMMING OF THE
UNLOCK CODE... THE SECURITY CODE WILL BE ALL THAT IS PROVIDED
Lock Phone by pressing FCN 1
Enter Programming Mode by pressing #259
Screen will display the software revision number
Press Volume Up
Screen will display Phone's E.S.N.
Press Volume Up
Screen will display INIT REP USE SND
Press SEND to erase any numbers stored in the phones memory
Press Volume Up
_ _ _ _ _ Send Vol. Up SIDH system I.D.
XXX XXX XXXX Send Vol. Up MIN mobile I.D.
Must be changed when done Send Vol. Up LOCK CODE 1
programming - BY CUSTOMER
Must be changed when done Send Vol. Up LOCK CODE 2
programming - BY CUSTOMER
SET Vol. Up Option EX extnd adrss
334 press send to change Vol. Up IPCH initial pge
07 Send Vol. Up ACCOLC overload
10 Send Vol. Up GIM group i.d.
333 Vol. Up IDCCA initl a
334 Vol. Up IDCCB initl b
1 Vol. Up REG TBL SIZE
Volume up through the four invalid System I.D. addresses
SET Vol. Up OPTION LU local use
B press send to change Vol. Up OPTION PS (prefered sys)
CLR Vol. Up OPTION IRI rm inhbt
CLR Vol. Up OPTION SSD
SET Vol. Up OPTION QRC qck rcall
SET Vol. Up OPTION QST qck store
SET Vol. Up OPTION WUT wake tone
SET Vol. Up OPTION EE use dtmf
SET Vol. Up OPTION FD use dtmf
SET Vol. Up OPTION MFD ext dtmf
SET Vol. Up OPTION 32D dgt dial
CLR Vol. Up OPTION MLH timer
CLR Vol. Up OPTION LHM timer
CLR Vol. Up OPTION CRU timer dsp
CLR Vol. Up OPTION NLM timer
SET for on CLR for off Vol. Up OPTION HA hrn alert
CLR Vol. Up OPTION ONL diagnostc
END to exit or VOLUME UP to review entries.
Programming Instructions for:
OKI CDL400
ACTION TO STORE DISPLAY
To Enter Programming mode:
Press IN SEQUENCE:
END RCL FUNC CLR SND
Screen shows Entr id
Enter 08693427
XXX XXX XXXX PRESS # PRESS * PHon
_ _ _ _ _ PRESS # PRESS * S id no
0334 PRESS # PRESS * iPCH
07 PRESS # PRESS * ACC oLC
123 PRESS # PRESS * LoC Cod
10 PRESS # PRESS * G id
0000 PRESS # PRESS * Stn CLS
0111 PRESS # PRESS * HORN ALERT, HANDS
FREE, LOCAL USE,
MIN. MARK.
PRESS END AT THIS TIME TO EXIT PROGRAMMING MODE.
__________________________________________________________________________
TO REPROGRAM TELEPHON NUMBER AND SYSTEM I.D. # -
PRESS IN SEQUENCE THE FOLLOWING KEYSTROKES:
FUNC 90 * 123 (SECURITY CODE)
PHon WILL DISPLAY
ENTER NEW PHONE NUMBER
XXX XXX XXXX PRESS # PRESS * PHon
_ _ _ _ _ PRESS # PRESS * S id no
PRESS END AT THIS TIME TO EXIT PROGRAMMING MODE.
___________________________________________________________________________
To Re-Initialize Nam Memory for Handset Programmable Models -
Func 99*
Enter Last 8 digits of S.N.
Press *
Programming Instructions for:
PANASONIC EB362
Charged Battery and Nam Adaptor(Grey Cord w/25pin Connector)are needed.
ACTION TO STORE DISPLAY
USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE -
THIS FUNCTION IS PROVIDED FOR IN THE PROGRAMMING SEQUENCE
*0000# to enter program mode
*1 Press SND
50 Press SND NAM 1 MODE
_ _ _ _ _ Press STO 01 SIDH
XXXXXXXXXX Press STO 02 OWNDL
1 2 3 Press STO 03 LOCK
0 0 0 0 0 0 0 0 0 0 0 0 (12) Press STO 04 SPDL
00 Press STO 05 SCM
334 Press STO 06 IPCH
07 Press STO 07 ACCOLC
10 Press STO 08 GIM
1 1 0 1 1 1 0 0 Press STO 09 FEATURE A
0 0 0 0 0 1 0 0 Press STO 10 FEATURE B
1 0 0 0 0 0 1 1 Press STO 11 FEATURE C
00 Press STO 12 DLMT
STO **
Turn power off
Programming Instructions for:
PANASONIC EB-500 OR TP-500
ACTION TO STORE DISPLAY
USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE -
THIS FUNCTION IS PROVIDED FOR IN THE PROGRAMMING SEQUENCE
Attach Nam Programmer Cable (Our Stock # 823)
Pwr up unit
Enter *0000# 0
*1 SND
You are now in the NAM 1 Program mode.
_ _ _ _ _ Press STO 01 S.I.D.
XXXXXXXXXX Press STO 02 OWN #
0 Press STO 03 O for W/L system
334 Press STO 04 IPCH
07 Press STO 05 ACCOLC
10 Press STO 06 GIM
00 Press STO 07 Digit Dial Limit
08 Press STO 08 SCM (3watt i.d.)
911 Press STO 09 Rcl 00
1234 Press STO 10 Security Code
11000000 Press STO 11 FUNCTION BYTE 1
00010010 Press STO 12 FUNCTION BYTE 2
10010111 Press STO 13 FUNCTION BYTE 3
TO BURN NAM AT THIS TIME Press STO ** NAM is burned
Turn off unit
Detach programming cable
Programming Instructions for:
RADIO SHACK 17-1002 TRANSPORTABLE
THIS UNIT REQUIRES A SERVICE HANDSET TO BE PROGRAMMED!!!
A Mobira Service Handset (Modified) may be used. It is made from an ME53
or ME57 handset by opening and adding a jumper to the left of the one
factory installed just below the white 24 pin connector joining the top and
bottom PCB's. Also, pins 1 and 14 of the handset connector must be jumpered
at the radio end. To disassemble the handset, carefully pry off the
plastic earpad retaining housing to expose on hexdrive screw. Two other
screws are under the rubber plugs at either side of the microphone. The
handset then splits apart. This is a ticklish job and isn't recommended
except in an extreme case and not with the customer's handset. The
modification does not affect normal operation of the handset. It is not
known if a Radio handset will work the same.
After the Service Handset has been applied:
To enter LOCAL MODE (which takes the phone off the air and allows
service commands to be obeyed) press 01#. The display should clear and noise
is heard from the earpiece.
To enter the NAM programming mode, enter 48#. The display shows 48
briefly and clears.
ACTION KEYBOARD ENTRY DISPLAY
0 * (5-digit SID)
1 *
1 *
XXXXXXXXXX *
10 *
334 *
07 *
0 *
10 *
12345 *
Press * to exit NAM programming mode and return to Local Mode.
To enter the NAM reading mode, press 49#. The display will show 49.
*****************************************************************************
PART VII. THE ELECTRONIC SERIAL NUMBER - AN INTRODUCTION
When a cellular phone is removed from factory packaging, the ESN
normally can be found in the document package (or on a sticker stuck to the
phone). This ESN is usually correct and system registration procedes
quickly. If the phone is used or has been turned off for non-payment of
bills, the person who restores the service needs the ESN in order to program
the system with an MIN. Every manufacturer assigns their own ESN,
consequently it is possible to have a number of the same ESN's, although
each may be produced by a seperate manufacturer. For example, there may be
a Motorola ESN of 123456, an Audiovox ESN of 123456, etc. With this in mind
it is a possibility that a person could broadcast without changing the ESN,
but rather changing the SCM and the SIDH.
The ESN is a 32-bit number which uniquely identifies each unit. This
ESN is factory programmed and installed and cannot be changed in the field
without removing it and reprogramming a new chip. The ESN may or may not be
related to the serial number stamped on the outside of the transceiver
chassis. The ESN is encoded into messages which are interchanged with the
cellular tower. The ESN must be provided when the phone is registered for
service. The ESN is an 11-digit number. THE FIRST THREE NUMBERS ARE THE
MANUFACTURERS DECIMAL CODE, THE NEXT TWO ARE RESERVED (BUT MAY CONTAIN ZEROS
OR NUMBERS) AND THE REMAINING SIX ARE THE DECIMAL SERIAL NUMBER.
*****************************************************************************
PART VIII. IDENTIFYING THE ESN IN YOUR CELLULAR PHONE
Depending on what model phone you have, the ESN will be located on a
PROM. The PROM is programmed at the factory, and installed usually with the
security fuse blown to prevent tampering. The code on the PROM might
possibly be obtained by unsoldering it from the cellular phone, putting it in
a PROM reader, and then obtaining a memory map of the chip.
The PROM is going to have from sixteen to twenty-eight leads coming
from it. It is a bipolar PROM. SEE ESN.GIF FOR ADDITIONAL INFORMATION.
The majority of phones will accept the National Semiconductor 32x8 PROM,
which will hold the ESN and cannot be reprogrammed. If the ESN is known
on the phone, it is possible to trace the memory map by installing the PROM
into a reader, and obtaining the fuse map from the PROM by triggering the
"READ MASTER" switch of the PROM programmer. In addition, most PROM
programming systems include a verify and compare switch to allow you to
compare the programming of one PROM with another.
As said earlier, the ESN is uniformly black with sixteen to
twenty-eight leads emanating from it's rectangular body, or square shaped
body. If it is the dual-in-line package chip, (usually found in
transportables and installed phones),it is rectangular. If it is the plastic
leaded chip carrier (PLCC), it will be square and have a much smaller
appearance. Functionally, they are the same chip, but the PLCC is used with
hand held cellular phones because of the need for reduced size circuitry.
It will have a notch within, and also have writing in small white letters
on it. (A black chip with small white letters? Should be easy to spot huh?).
Look for the follow letters on the chip:
MMI
TI
NS
HARRIS
NSC
MB
DM
HM
AMD
TBP
MOTOROLA
AMPS
Once you have found the chip, try ordering a new one (maybe a couple of new
ones) from the businesses in the MERCHANDISE SECTION located at the end of
this file.
*****************************************************************************
PART IX. SCANNING TO FIND THE ESN/MIN PAIR
Well if you haven't guessed by now, the mobiles ESN and MIN must
match in the switch or no go. This is required for billing purposes. If one
had the ESN and the mobile phone number (MIN), he could call anytime and
anyplace without fear of a trace - let alone a bill. The ideal setup would
let you listen with a scanner to the reverse control channel, record and
display heard working numbers and ESN's, and recall them as one needs to make
calls.
This would be it, but we are not quite there yet. But some of the
hard work has already been done for us. All the aforementioned codes are
sent in hex, in NRZ code (phase-key shifting), when a cellular subscriber
places a call. But guess what? All phones have an NRZ receiver and
transmitter built right into them. All that has to be done is to have a
receiver on the reverse control channel, recover the other subscibers data
and save it or print it out.
Cellular phones operate on a full duplex channel. One frequency is
used for transmission from the base to the phone, while another is used for
transmission from the phone to the base. The base frequencies are always
exactly 45 MHZ higher than the phone frequency, and both of these are
incremented by 30 KHZ as the progression of channels increases from Channel
#1 to Chanel #1023 (NOTE: There are no channels between 800 and 990).
With some systems (not all) the cellular transmission is received by
the base and retransmitted on the base frequency. When this is done, a
scanner can listen to both sides of the conversation by simply monitoring the
base frequency. When this is not the case, two scanners set 45 MHZ apart
will work.
Here is a list of all Cellular Frequencies:
Non-Wireline Wireline
Channel Tx Freq Rx Freq Channel Tx Freq Rx Freq
Number Mhz Mhz Number Mhz Mhz
1 870.03 825.03 334 880.02 835.02
2 870.06 825.06 335 880.05 835.05
3 870.09 825.09 336 880.08 835.08
4 870.12 825.12 337 880.11 835.11
5 870.15 825.15 338 880.14 835.14
6 870.18 825.18 339 880.17 835.17
7 870.21 825.21 340 880.20 835.20
8 870.24 825.24 341 880.23 835.23
9 870.27 825.27 342 880.26 835.26
10 870.30 825.30 343 880.29 835.29
11 870.33 825.33 344 880.32 835.32
12 870.36 825.36 345 880.35 835.35
13 870.39 825.39 346 880.38 835.38
14 870.42 825.42 347 880.41 835.41
15 870.45 825.45 348 880.44 835.44
16 870.48 825.48 349 880.47 835.47
17 870.51 825.51 350 880.50 835.50
18 870.54 825.54 351 880.53 835.53
19 870.57 825.57 352 880.56 835.56
20 870.60 825.60 353 880.59 835.59
21 870.63 825.63 354 880.62 835.62
22 870.66 825.66 355 880.65 835.65
23 870.69 825.69 356 880.68 835.68
24 870.72 825.72 357 880.71 835.71
25 870.75 825.75 358 880.74 835.74
26 870.78 825.78 359 880.77 835.77
27 870.81 825.81 360 880.80 835.80
28 870.84 825.84 361 880.83 835.83
29 870.87 825.87 362 880.86 835.86
30 870.90 825.90 363 880.89 835.89
31 870.93 825.93 364 880.92 835.92
32 870.96 825.96 365 880.95 835.95
33 870.99 825.99 366 880.98 835.98
34 871.02 826.02 367 881.01 836.01
35 871.05 826.05 368 881.04 836.04
36 871.08 826.08 369 881.07 836.07
37 871.11 826.11 370 881.10 836.10
38 871.14 826.14 371 881.13 836.13
39 871.17 826.17 372 881.16 836.16
40 871.20 826.20 373 881.19 836.19
41 871.23 826.23 374 881.22 836.22
42 871.26 826.26 375 881.25 836.25
43 871.29 826.29 376 881.28 836.28
44 871.32 826.32 377 881.31 836.31
45 871.35 826.35 378 881.34 836.34
46 871.38 826.38 379 881.37 836.37
47 871.41 826.41 380 881.40 836.40
48 871.44 826.44 381 881.43 836.43
49 871.47 826.47 382 881.46 836.46
50 871.50 826.50 383 881.49 836.49
51 871.53 826.53 384 881.52 836.52
52 871.56 826.56 385 881.55 836.55
53 871.59 826.59 386 881.58 836.58
54 871.62 826.62 387 881.61 836.61
55 871.65 826.65 388 881.64 836.64
56 871.68 826.68 389 881.67 836.67
57 871.71 826.71 390 881.70 836.70
58 871.74 826.74 391 881.73 836.73
59 871.77 826.77 392 881.76 836.76
60 871.80 826.80 393 881.79 836.79
61 871.83 826.83 394 881.82 836.82
62 871.86 826.86 395 881.85 836.85
63 871.89 826.89 396 881.88 836.88
64 871.92 826.92 397 881.91 836.91
65 871.95 826.95 398 881.94 836.94
66 871.98 826.98 399 881.97 836.97
67 872.01 827.01 400 882.00 837.00
68 872.04 827.04 401 882.03 837.03
69 872.07 827.07 402 882.06 837.06
70 872.10 827.10 403 882.09 837.09
71 872.13 827.13 404 882.12 837.12
72 872.16 827.16 405 882.15 837.15
73 872.19 827.19 406 882.18 837.18
74 872.22 827.22 407 882.21 837.21
75 872.25 827.25 408 882.24 837.24
76 872.28 827.28 409 882.27 837.27
77 872.31 827.31 410 882.30 837.30
78 872.34 827.34 411 882.33 837.33
79 872.37 827.37 412 882.36 837.36
80 872.40 827.40 413 882.39 837.39
81 872.43 827.43 414 882.42 837.42
82 872.46 827.46 415 882.45 837.45
83 872.49 827.49 416 882.48 837.48
84 872.52 827.52 417 882.51 837.51
85 872.55 827.55 418 882.54 837.54
86 872.58 827.58 419 882.57 837.57
87 872.61 827.61 420 882.60 837.60
88 872.64 827.64 421 882.63 837.63
89 872.67 827.67 422 882.66 837.66
90 872.70 827.70 423 882.69 837.69
91 872.73 827.73 424 882.72 837.72
92 872.76 827.76 425 882.75 837.75
93 872.79 827.79 426 882.78 837.78
94 872.82 827.82 427 882.81 837.81
95 872.85 827.85 428 882.84 837.84
96 872.88 827.88 429 882.87 837.87
97 872.91 827.91 430 882.90 837.90
98 872.94 827.94 431 882.93 837.93
99 872.97 827.97 432 882.96 837.96
100 873.00 828.00 433 882.99 837.99
101 873.03 828.03 434 883.02 838.02
102 873.06 828.06 435 883.05 838.05
103 873.09 828.09 436 883.08 838.08
104 873.12 828.12 437 883.11 838.11
105 873.15 828.15 438 883.14 838.14
106 873.18 828.18 439 883.17 838.17
107 873.21 828.21 440 883.20 838.20
108 873.24 828.24 441 883.23 838.23
109 873.27 828.27 442 883.26 838.26
110 873.30 828.30 443 883.29 838.29
111 873.33 828.33 444 883.32 838.32
112 873.36 828.36 445 883.35 838.35
113 873.39 828.39 446 883.38 838.38
114 873.42 828.42 447 883.41 838.41
115 873.45 828.45 448 883.44 838.44
116 873.48 828.48 449 883.47 838.47
117 873.51 828.51 450 883.50 838.50
118 873.54 828.54 451 883.53 838.53
119 873.57 828.57 452 883.56 838.56
120 873.60 828.60 453 883.59 838.59
121 873.63 828.63 454 883.62 838.62
122 873.66 828.66 455 883.65 838.65
123 873.69 828.69 456 883.68 838.68
124 873.72 828.72 457 883.71 838.71
125 873.75 828.75 458 883.74 838.74
126 873.78 828.78 459 883.77 838.77
127 873.81 828.81 460 883.80 838.80
128 873.84 828.84 461 883.83 838.83
129 873.87 828.87 462 883.86 838.86
130 873.90 828.90 463 883.89 838.89
131 873.93 828.93 464 883.92 838.92
132 873.96 828.96 465 883.95 838.95
133 873.99 828.99 466 883.98 838.98
134 874.02 829.02 467 884.01 839.01
135 874.05 829.05 468 884.04 839.04
136 874.08 829.08 469 884.07 839.07
137 874.11 829.11 470 884.10 839.10
138 874.14 829.14 471 884.13 839.13
139 874.17 829.17 472 884.16 839.16
140 874.20 829.20 473 884.19 839.19
141 874.23 829.23 474 884.22 839.22
142 874.26 829.26 475 884.25 839.25
143 874.29 829.29 476 884.28 839.28
144 874.32 829.32 477 884.31 839.31
145 874.35 829.35 478 884.34 839.34
146 874.38 829.38 479 884.37 839.37
147 874.41 829.41 480 884.40 839.40
148 874.44 829.44 481 884.43 839.43
149 874.47 829.47 482 884.46 839.46
150 874.50 829.50 483 884.49 839.49
151 874.53 829.53 484 884.52 839.52
152 874.56 829.56 485 884.55 839.55
153 874.59 829.59 486 884.58 839.58
154 874.62 829.62 487 884.61 839.61
155 874.65 829.65 488 884.64 839.64
156 874.68 829.68 489 884.67 839.67
157 874.71 829.71 490 884.70 839.70
158 874.74 829.74 491 884.73 839.73
159 874.77 829.77 492 884.76 839.76
160 874.80 829.80 493 884.79 839.79
161 874.83 829.83 494 884.82 839.82
162 874.86 829.86 495 884.85 839.85
163 874.89 829.89 496 884.88 839.88
164 874.92 829.92 497 884.91 839.91
165 874.95 829.95 498 884.94 839.94
166 874.98 829.98 499 884.97 839.97
167 875.01 830.01 500 885.00 840.00
168 875.04 830.04 501 885.03 840.03
169 875.07 830.07 502 885.06 840.06
170 875.10 830.10 503 885.09 840.09
171 875.13 830.13 504 885.12 840.12
172 875.16 830.16 505 885.15 840.15
173 875.19 830.19 506 885.18 840.18
174 875.22 830.22 507 885.21 840.21
175 875.25 830.25 508 885.24 840.24
176 875.28 830.28 509 885.27 840.27
177 875.31 830.31 510 885.30 840.30
178 875.34 830.34 511 885.33 840.33
179 875.37 830.37 512 885.36 840.36
180 875.40 830.40 513 885.39 840.39
181 875.43 830.43 514 885.42 840.42
182 875.46 830.46 515 885.45 840.45
183 875.49 830.49 516 885.48 840.48
184 875.52 830.52 517 885.51 840.51
185 875.55 830.55 518 885.54 840.54
186 875.58 830.58 519 885.57 840.57
187 875.61 830.61 520 885.60 840.60
188 875.64 830.64 521 885.63 840.63
189 875.67 830.67 522 885.66 840.66
190 875.70 830.70 523 885.69 840.69
191 875.73 830.73 524 885.72 840.72
192 875.76 830.76 525 885.75 840.75
193 875.79 830.79 526 885.78 840.78
194 875.82 830.82 527 885.81 840.81
195 875.85 830.85 528 885.84 840.84
196 875.88 830.88 529 885.87 840.87
197 875.91 830.91 530 885.90 840.90
198 875.94 830.94 531 885.93 840.93
199 875.97 830.97 532 885.96 840.96
200 876.00 831.00 533 885.99 840.99
201 876.03 831.03 534 886.02 841.02
202 876.06 831.06 535 886.05 841.05
203 876.09 831.09 536 886.08 841.08
204 876.12 831.12 537 886.11 841.11
205 876.15 831.15 538 886.14 841.14
206 876.18 831.18 539 886.17 841.17
207 876.21 831.21 540 886.20 841.20
208 876.24 831.24 541 886.23 841.23
209 876.27 831.27 542 886.26 841.26
210 876.30 831.30 543 886.29 841.29
211 876.33 831.33 544 886.32 841.32
212 876.36 831.36 545 886.35 841.35
213 876.39 831.39 546 886.38 841.38
214 876.42 831.42 547 886.41 841.41
215 876.45 831.45 548 886.44 841.44
216 876.48 831.48 549 886.47 841.47
217 876.51 831.51 550 886.50 841.50
218 876.54 831.54 551 886.53 841.53
219 876.57 831.57 552 886.56 841.56
220 876.60 831.60 553 886.59 841.59
221 876.63 831.63 554 886.62 841.62
222 876.66 831.66 555 886.65 841.65
223 876.69 831.69 556 886.68 841.68
224 876.72 831.72 557 886.71 841.71
225 876.75 831.75 558 886.74 841.74
226 876.78 831.78 559 886.77 841.77
227 876.81 831.81 560 886.80 841.80
228 876.84 831.84 561 886.83 841.83
229 876.87 831.87 562 886.86 841.86
230 876.90 831.90 563 886.89 841.89
231 876.93 831.93 564 886.92 841.92
232 876.96 831.96 565 886.95 841.95
233 876.99 831.99 566 886.98 841.98
234 877.02 832.02 567 887.01 842.01
235 877.05 832.05 568 887.04 842.04
236 877.08 832.08 569 887.07 842.07
237 877.11 832.11 570 887.10 842.10
238 877.14 832.14 571 887.13 842.13
239 877.17 832.17 572 887.16 842.16
240 877.20 832.20 573 887.19 842.19
241 877.23 832.23 574 887.22 842.22
242 877.26 832.26 575 887.25 842.25
243 877.29 832.29 576 887.28 842.28
244 877.32 832.32 577 887.31 842.31
245 877.35 832.35 578 887.34 842.34
246 877.38 832.38 579 887.37 842.37
247 877.41 832.41 580 887.40 842.40
248 877.44 832.44 581 887.43 842.43
249 877.47 832.47 582 887.46 842.46
250 877.50 832.50 583 887.49 842.49
251 877.53 832.53 584 887.52 842.52
252 877.56 832.56 585 887.55 842.55
253 877.59 832.59 586 887.58 842.58
254 877.62 832.62 587 887.61 842.61
255 877.65 832.65 588 887.64 842.64
256 877.68 832.68 589 887.67 842.67
257 877.71 832.71 590 887.70 842.70
258 877.74 832.74 591 887.73 842.73
259 877.77 832.77 592 887.76 842.76
260 877.80 832.80 593 887.79 842.79
261 877.83 832.83 594 887.82 842.82
262 877.86 832.86 595 887.85 842.85
263 877.89 832.89 596 887.88 842.88
264 877.92 832.92 597 887.91 842.91
265 877.95 832.95 598 887.94 842.94
266 877.98 832.98 599 887.97 842.97
267 878.01 833.01 600 888.00 843.00
268 878.04 833.04 601 888.03 843.03
269 878.07 833.07 602 888.06 843.06
270 878.10 833.10 603 888.09 843.09
271 878.13 833.13 604 888.12 843.12
272 878.16 833.16 605 888.15 843.15
273 878.19 833.19 606 888.18 843.18
274 878.22 833.22 607 888.21 843.21
275 878.25 833.25 608 888.24 843.24
276 878.28 833.28 609 888.27 843.27
277 878.31 833.31 610 888.30 843.30
278 878.34 833.34 611 888.33 843.33
279 878.37 833.37 612 888.36 843.36
280 878.40 833.40 613 888.39 843.39
281 878.43 833.43 614 888.42 843.42
282 878.46 833.46 615 888.45 843.45
283 878.49 833.49 616 888.48 843.48
284 878.52 833.52 617 888.51 843.51
285 878.55 833.55 618 888.54 843.54
286 878.58 833.58 619 888.57 843.57
287 878.61 833.61 620 888.60 843.60
288 878.64 833.64 621 888.63 843.63
289 878.67 833.67 622 888.66 843.66
290 878.70 833.70 623 888.69 843.69
291 878.73 833.73 624 888.72 843.72
292 878.76 833.76 625 888.75 843.75
293 878.79 833.79 626 888.78 843.78
294 878.82 833.82 627 888.81 843.81
295 878.85 833.85 628 888.84 843.84
296 878.88 833.88 629 888.87 843.87
297 878.91 833.91 630 888.90 843.90
298 878.94 833.94 631 888.93 843.93
299 878.97 833.97 632 888.96 843.96
300 879.00 834.00 633 888.99 843.99
301 879.03 834.03 634 889.02 844.02
302 879.06 834.06 635 889.05 844.05
303 879.09 834.09 636 889.08 844.08
304 879.12 834.12 637 889.11 844.11
305 879.15 834.15 638 889.14 844.14
306 879.18 834.18 639 889.17 844.17
307 879.21 834.21 640 889.20 844.20
308 879.24 834.24 641 889.23 844.23
309 879.27 834.27 642 889.26 844.26
310 879.30 834.30 643 889.29 844.29
311 879.33 834.33 644 889.32 844.32
312 879.36 834.36 645 889.35 844.35
313 879.39 834.39 646 889.38 844.38
314 879.42 834.42 647 889.41 844.41
315 879.45 834.45 648 889.44 844.44
316 879.48 834.48 649 889.47 844.47
317 879.51 834.51 650 889.50 844.50
318 879.54 834.54 651 889.53 844.53
319 879.57 834.57 652 889.56 844.56
320 879.60 834.60 653 889.59 844.59
321 879.63 834.63 654 889.62 844.62
322 879.66 834.66 655 889.65 844.65
323 879.69 834.69 656 889.68 844.68
324 879.72 834.72 657 889.71 844.71
325 879.75 834.75 658 889.74 844.74
326 879.78 834.78 659 889.77 844.77
327 879.81 834.81 660 889.80 844.80
328 879.84 834.84 661 889.83 844.83
329 879.87 834.87 662 889.86 844.86
330 879.90 834.90 663 889.89 844.89
331 879.93 834.93 664 889.92 844.92
332 879.96 834.96 665 889.95 844.95
333 879.99 834.99 666 889.98 844.98
667 890.01 845.01 717 891.51 846.51
668 890.04 845.04 718 891.54 846.54
669 890.07 845.07 719 891.57 846.57
670 890.10 845.10 720 891.60 846.60
671 890.13 845.13 721 891.63 846.63
672 890.16 845.16 722 891.66 846.66
673 890.19 845.19 723 891.69 846.69
674 890.22 845.22 724 891.72 846.72
675 890.25 845.25 725 891.75 846.75
676 890.28 845.28 726 891.78 846.78
677 890.31 845.31 727 891.81 846.81
678 890.34 845.34 728 891.84 846.84
679 890.37 845.37 729 891.87 846.87
680 890.40 845.40 730 891.90 846.90
681 890.43 845.43 731 891.93 846.93
682 890.46 845.46 732 891.96 846.96
683 890.49 845.49 733 891.99 846.99
684 890.52 845.52 734 892.02 847.02
685 890.55 845.55 735 892.05 847.05
686 890.58 845.58 736 892.08 847.08
687 890.61 845.61 737 892.11 847.11
688 890.64 845.64 738 892.14 847.14
689 890.67 845.67 739 892.17 847.17
690 890.70 845.70 740 892.20 847.20
691 890.73 845.73 741 892.23 847.23
692 890.76 845.76 742 892.26 847.26
693 890.79 845.79 743 892.29 847.29
694 890.82 845.82 744 892.32 847.32
695 890.85 845.85 745 892.35 847.35
696 890.88 845.88 746 892.38 847.38
697 890.91 845.91 747 892.41 847.41
698 890.94 845.94 748 892.44 847.44
699 890.97 845.97 749 892.47 847.47
700 891.00 846.00 750 892.50 847.50
701 891.03 846.03 751 892.53 847.53
702 891.06 846.06 752 892.56 847.56
703 891.09 846.09 753 892.59 847.59
704 891.12 846.12 754 892.62 847.62
705 891.15 846.15 755 892.65 847.65
706 891.18 846.18 756 892.68 847.68
707 891.21 846.21 757 892.71 847.71
708 891.24 846.24 758 892.74 847.74
709 891.27 846.27 759 892.77 847.77
710 891.30 846.30 760 892.80 847.80
711 891.33 846.33 761 892.83 847.83
712 891.36 846.36 762 892.86 847.86
713 891.39 846.39 763 892.89 847.89
714 891.42 846.42 764 892.92 847.92
715 891.45 846.45 765 892.95 847.95
716 891.48 846.48 766 892.98 847.98
991 869.04 824.04 767 893.01 848.01
992 869.07 824.07 768 893.04 848.04
993 869.10 824.10 769 893.07 848.07
994 869.13 824.13 770 893.10 848.10
995 869.16 824.16 771 893.13 848.13
996 869.19 824.19 772 893.16 848.16
997 869.22 824.22 773 893.19 848.19
998 869.25 824.25 774 893.22 848.22
999 869.28 824.28 775 893.25 848.25
1000 869.31 824.31 776 893.28 848.28
1001 869.34 824.34 777 893.31 848.31
1002 869.37 824.37 778 893.34 848.34
1003 869.40 824.40 779 893.37 848.37
1004 869.43 824.43 780 893.40 848.40
1005 869.46 824.46 781 893.43 848.43
1006 869.49 824.49 782 893.46 848.46
1007 869.52 824.52 783 893.49 848.49
1008 869.55 824.55 784 893.52 848.52
1009 869.58 824.58 785 893.55 848.55
1010 869.61 824.61 786 893.58 848.58
1011 869.64 824.64 787 893.61 848.61
1012 869.67 824.67 788 893.64 848.64
1013 869.70 824.70 789 893.67 848.67
1014 869.73 824.73 790 893.70 848.70
1015 869.76 824.76 791 893.73 848.73
1016 869.79 824.79 792 893.76 848.76
1017 869.82 824.82 793 893.79 848.79
1018 869.85 824.85 794 893.82 848.82
1019 869.88 824.88 795 893.85 848.85
1020 869.91 824.91 796 893.88 848.88
1021 869.94 824.94 797 893.91 848.91
1022 869.97 824.97 798 893.94 848.94
1023 870.00 825.00 799 893.97 848.97
PART X. A FEW COMMON SCANNER MODIFICATIONS
Here a few scanners and what it takes to modify them. If your
scanner is not shown here, don't worry. Ham Radio BBS's are all over the
country. You should be able to find the instructions for modifying your
scanner there.
Restoration of Cellular Frequency Coverage on
Radio Shack PRO-34 Handheld Scanner
1. Remove battery cover and battery, four black screws on rear cover, and volume and squelch knobs.
2. Remove rear cover, lifting back and up to clear controls. Do not remove belt clip or circuit bord screws.
3. Unplug the brown volume control connector (grn/yel/blk) and white squelch control connector (whtblk/red) from the linear circuit board.
4. Unsolder the ground lead from T111 (at corner of linear circuit board above the external power cnnectors). Unsolder the two power switch leads from the back of the volume control. Unsolder the atenna connector center pin and ground wires from the l
5. Unscrew the four combination screws that hold the linear circuit board and received the back covr screws.
Grasp the linear board at the top and lift it straight away from the front case, unplugging the 16-pn connector.
6. Remove the three screws holding the metal frame assembly which held the linear board to the fron panel. Unplug the red-black power lead and lay the frame aside. It is still connected to the battry contacts.
7. Locate diodes D9 - D12 on the volume control side of the of the logic circuit board under T1; D1 and D11 are marked. Clip one lead of D11, separating the gap. This may be resoldered later if desred.
8. Reassemble the board by reversing the disassembly procedures above.
Restoration of Cellular Frequency Coverage on
Radio Shack PRO-2004 Scanner
By cutting diode D513 on the PC 3 sub chassis in the Realistic PRO-2004
Scanner you can re-enable the 825.00 to 845.00 and 870-00 to 890.00 frequency
selection. To scan in 30KHZ steps press "STEP-RESET".
Restoration of Cellular Frequency Coverage on
Radio Shack PRO-2005 Scanner
1. Unplug the radio
2. Remove the screws and take off the top cover.
3. Look for D502 on the inside right hand-side of the front panel.
(No need to unsolder the silver plate protecting the vertical board!)
4. Simply cut the diode and reverse the process.
Aren't you glad I only chose to cover Radio Shack models. I'm sure
you appreciate the fact that I only deal with quality merchandise. If you
have some cash to blow (like $500), I would recommend buying the ICOM R-1
handheld scanner. It scans from 1 to 1400 in 1/2 step increments and already
includes the cellular frequencies. Plus is is about as tall as a box of 3.25
floppies and about as wide as a 16 oz. coke bottle. It is the smallest and
one of the more powerful hand-scanners around.
*****************************************************************************
PART XI. THE 40-50 MHZ CELLULAR SCANNER
The cellular phone freqs. occupy the UHF spectrum previously assign
to commercial TV stations. Since a TV channel occupies a Bandwidth(BW) of 6
MHZ and each cellular channel requires 24 KZ (for a plus and minus 12 KHZ
signal) and a 3KHZ guard band for each audio signal (thus the 30KHZ spacing).
200 cellular channels can fit into one UHF TV channel. Thus, with a little
fine tuning, and old TV set with variable VHF tuning can tune in all
cellular freqs. between 824 and 890 MHZ.
UHF TV tuners ares designed to convert these UHF freqa. to intermediate
(difference) freqs. between 41 and 47 MHZ. Thus, by purchasing a commonly
available UHF tuner (check sith a TV shop and try to get a copy of the
SAMS for powering the AFC info, and avoid those with tubes). Tuner voltage
is usually 8-24 volts, and must be correctly connected up. You should also
remove with the tuner, the TV's channel select and fine tuning controls
for ease of use - and they should be in good condition.
Once you have the tuner, you can then wire it between a 30-50 MHZ scanner and
a UHF antenna (highly directional yagi type is preferred). Since the tuner
will probably have a 300 ohm input impedance, a twin antenna cable is
preferred (Yes Radio Shack has 'em). If you are into directional-finding,
the UHF antenna should NOT have AGC (automatic Gain Control) as those with
active AGC will amplify reflections, resulting in readings from so many
directions that the target will be lost. Because of the use of inconspicuous,
commonly available, inexpensive, high-gain UHF antennas, using a good UHF
tuner to scan cellular channels is a good method of doing it.
Tuner output is usually through an RCA-type plug. CAUTION: BE SURE TO COUPLE
YOUR SCANNER TO THE UHF TUNER WITH A 0.01-0.1 mf (50 V min.) CAPACITOR FOR
DC BLOCKING. AND DO NOT TRY TO OPERATE THE TUNER THROUGH ITS TV SET AS THE
DANGER OF HIGH-VOLTAGE DISCHARGE IS HIGH. Also, connect a ground wire
between the tuner and the scanner.
The table below describes how cellular freqs. can be downconverted by a
commonly available UHF TV tuner (all freqs. are in MHZ)
CELLULAR MOBILE FREQS & SCANNER EQUIVALENTS
TV
BAND CELL. CHAN. SCAN TV OSCIL
CHAN. # and FREQ. FREQ. FREQ. LIMIT
----------- ------------ ----- -------- -----
73 (first) 0001-825.03 45.97 871 824-830
73 (last) 0166-829.98 41.02 871 824-830
74 (first) 0167-830.01 46.99 877 830-836
74 (last) 0366-835.98 41.02 877 830-836
75 (first) 0367-836.01 46.99 883 836-842
75 (last) 0566-841.98 41.02 883 836-842
76 (first) 0567-842.01 46.99 889 842-848
76 (last) 0766-847.98 41.02 889 842-848
77 (first) 0767-848.01 46.99 895 848-854
77 (last) 0799-848.97 46.03 895 848-854
CELLULAR PHONE FREQS. HAVE NOT BEEN ASSIGNED
FOR CHANNELS 800-990
73 (first) 0991-824.04 46.96 871 824-830
73 (last) 1023-825.00 46.00 871 824-830
80 (first) 0001-870.03 42.97 913 866-872
80 (last) 0066-871.98 41.02 913 866-972
81 (first) 0067-872.01 46.99 919 872-878
81 (last) 0266-877.98 41.02 919 872-878
82 (first) 0267-878.01 46.99 925 878-884
82 (last) 0466-883.98 41.02 925 878-884
83 (first) 0467-884.01 46.99 931 884-890
83 (last) 0666-889.98 41.02 931 884-890
83 (**) 0667-890.01 46.99 931 884-890
83 (**) 0799-893.97 37.03 931 884-890
CELLULAR PHONE FREQS. HAVE NOT BEEN ASSIGNED
FOR CHANNELS 800-990
80 (first) 0991-869.04 43.96 913 866-872
80 (last) 1023-870.00 43.00 913 866-872
(**) These freqs. are outside of the normal Channel 83 BW. However, most UHF
tuners have a fine tuner that can be adjusted up to about another 6 MHZ.
Note that the term "first" and "last" refers to the first and last cellular
channels receivable by the UHF tuner for the given TV channel. Base voice
channels are monitored when both sides of the conversation is required.
Mobile voice channels or base control channels are monitored to locate a
cellular phone. Tuning is simple:
(1) Decide which cellular channel or freq. you wish to monitor.
(2) Find what UHF channel includes that freq. and switch the TV
to that channel.
(3) Using the table, look up the corresponding TV oscillator freq.
(ex: 919 MHZ for TV channel 81). Subtract the cellular channel
freq. from the TV oscillator freq.
(4) Tune your scanner to the difference freq.
When you select a scanner, you should pick one that will scan in 30 MHZ
increments to efficiently receive cellular transmissions. If you can't get
one like that, then get one that will scan in 15,10 or 5 KHZ increments.
*****************************************************************************
PART XII. HOW THE ESN IS REPLACED
It takes some electronics skill to pull or unsolder the ESN. If you
are sketchy about messing around with your phone, I suggest practicing on
something else first, like an old calculator or something. It is also a
good idea to use the proper tools (A very small soldering tip,chip pullers,
It is imperative NOT to touch any of the surrounding connections, soldering
joints, or chips. The job MUST be done right the very first time. After
that it is not so important, because after the first time you should have the
ESN information stored safely to disk. The only dangers remaining are
physically damaging the chip. (Note: There are devices that wipe PROMs
clean in the event of programming errors).
When removing the ESN, try to follow these 5 steps:
A. Remove the PC board containing the ESN from the entire phone unit. The
boards are usually screwed in with Phillips heads. This will insure
against damage to the rest of the unit.
B. Ascertain the correct chip. Find the letters on the chip, and check it
against the letters from the IDENTIFYING THE ESN section. Refer to the .Gif
file included if necessary.
C. It is a good idea to draw a sketch to help you remember which way the chip
went in. You may laugh, but do it anyway.
D. Carefully remove the chip. Take your time and use the proper tools.
E. Solder in a zero insertion force (ZIF) replacement, so that replacement
chip can be changed easily.
After the ZIF socket has been successfully soldered in, reinsert the
ESN and attempt to make a phone call (Be sure the NAM is programmed
correctly). If it doesn't, check the leads on the ZIF to insure that you
have soldered them correctly. After that, insert your ESN into your PROM
reader and make sure it provides some sort of reading. You should use the
search mode to look for the manufacturers serial number.
(see MANUFACTURER'S ESN CODE LISTING) to identify the address on the PROM
where to reprogram the ESN.
*****************************************************************************
PART XIII. EQUATIONS FOR PROGRAMMING THE CHIPS
In most instances, you will not be able to tell the code on a PROM
because the manufacturer will have blown the security fuse in order to
prevent people from obtaining the codes to reprogram their own chips.
Therefore, it might be necessary to produce a set of equations that are
programmed into the cip to produce a bogus ESN. The bogus chips must contain
the first three digits of the manufacturer's code listing, which is
consequently the first marker of the actual ESN. Experimentation might be
necessary, but hey, isn't that half the fun?
With the aid of an EPROM emulator, the whole process should be able
to be completed in under an hour - this includes pulling the chip, creating
a new ESN, programming the chip, and replacing it.
So know you're saying "Holy Cow this project is getting expensive!".
Well it can get that way, but the long run payoff is worth it. I have seen
both emulators and burners for under $200 (I'm not talking about those spiffy
models that program RAM, just the basic EPROMs...in fact I can buy them for
under $150. Same with the emulator. Just look around.)
I wouldn't be surprised if actual ESN data started appearing on
boards in the near future. I know when I finsish my phone (Hopefully soon)
I plan on U/L the ESN info somewhere.
****************************************************************************
PART XIV. MANUFACTURER'S ESN CODE LISTING
---------------------------------------------------------------------------
MANUFACTURER DECIMAL HEX CODE OCTAL CODE
---------------------------------------------------------------------------
Alpine Electronics # 150 96 226
Antel (see Emptel,Sanyo)
ARA *
AT&T Technologies (see notes) 158 9E 236
Astrotel (see OKI)
Audiovox-Audiotel (see notes) 138 8A 212
Blaupunkt (R. Bosch) # 148 94 224
Clarion Company Ltd. 140 8C 214
Clarion Manufacturing Co. 166 A6 246
CM Communications 153 99 231
Diamondtel (See Mitsubishi)
DI-BAR Electronics 145 91 221
E.F. Johnson # 131 83 203
Emptel Electronics Co. 178 B2 262
Ericsson 143 8F 217
Ericsson GE Mobile 157 9D 235
Fujitsu # 133 85 205
Gateway Telephone 147 93 223
General Electric # (mini is 134)146 92 222
Glenayre (see notes)
Goldstar Products Co. # 141 8D 215
Harris # 137 89 211
Hitachi # 132 84 204
Hughes Network Systems 164 A4 244
Hyundai 160 A0 240
Japan Radio Co. 152 98 230
Kokusai 139 8B 213
Mansoor Electronics 167 A7 247
Mitsubishi (see notes) 134 86 206
Mobira (Nokia-Kinex) # 156 9C 234
Motorola 130 82 202
Motorola Int'l. 168 A8 250
Murata Machinery LTD. 144 90 220
NEC # 135 87 207
Nokia # 165 A5 245
Novatel 142 8E 216
OKI # 129 81 201
Panasonic (Matsushita) # 136 88 210
Phillips Telecom # 170 AA 252
Phillips Circuit 171 AB 253
Qualcomm, Inc. 159 9F 237
Sanyo 175 AF 257
Satellite Technology 161 A1 241
Samsung Communications 176 B0 258
Shintom West (Audio-Vox BC-20)# 174 AE 256
Sony Corp. 154 9A 232
Sun Moon Star # 178 B2 262
Tama Denki Co. 155 9B 233
Tandy/Mobira # 165 A5 245
TacTel (see notes)
Technophone # 162 A2 242
Toshiba 138 8A 212
Uniden Corp. of America # 172 AC 254
Uniden Corp. of Japan 173 AC 255
Universal Cellular 149 95 225
USA Corp. # (see notes)
Walker (JRC, Technophone) 152 98 230
Western Electric # (see notes)
Western Union # (see notes)
Yupiteru Industries 163 A3 243
NOTES:
The hexidecimal ESN is an 11-digit number, first three are manufacturer's
decimal code, next two are reserved (but may contain zeros or numbers);
remaining six are the decimal serial number.
These companies use phones from various manufacturers, code will be of actual
manufacturer.
Alpine 9510 is Fujitsu 362A - Antel, use GE, Emptel, Sanyo - ARA varies- ATT
1300, 1800 use Mitsubishi - AT&T 1100,1400,1440,1700,1710 use Hitachi -
Audiotel 1000,3000,500,BC-40,400,450,550,600 use Toshiba - PC100,200 use
Technophone - BC-20,CMT-125 use Shintom - TacTel use Toshiba,Blaupunkt, most
are Panasonic, some are Blaupunkt - GE Mini, Gelayre 301 , USA A&B
use Mitsubishi - Mitsubishi 460 use Toshiba - Walker Pocketphone use
JRC or Technophone - Western Electric use Hitachi - Western Union use E.F.
Johnson.
# - Chassis number abd ESN correspond to each other.
Decimal ESN conversion is required for serial numbers over 1,000,000 or
2,000,000, etc. Simply drop the millions digit and add 262,144 times the
millions digit to the remaining number. For example, 01,123,456 =
385,600 or 02,123,46 = 647,744. Then affix the Manufacturers Decimal Code plus
two zeros on left to yield 11-digit ESN. The Hex ESN may be found by
converting this number to hexidecimal.
*****************************************************************************
PART XV. HOME SYSTEM ID LISTING (A-L)
SYSTEM NON(A) WIRE(B)
Abilene,TX 131 422
Aguadilla 605 188
Aiken,GA 181 084
Akron,OH 073 054
Albany,GA 241 204
Alburquerque,NM 079 110
Alexandria,LA 243 212
Allentown,PA 103 008
Alton,IL 017 046
Altoona,PA 247 032
Amarillo,TX 249 422
Anchorage,AK 251 234
Anderson,IN 253 080
Anderson,SC 139 116
Anniston,AL 113 098
Appleton,WI 217 240
Asheville,NC 263 246
Ashland,WV 307 TBA
Athens,AL 203 198
Athens,GA 041 034
Atlanta,GA 041 034
Atlantic City,NJ 267 250
Augusta,GA 181 084
Aurora,IL 001 020
Austin,TX 107 164
Bakersfield,CA 183 228
Baltimore,MD 013 018
Bangor,ME 271 254
Baton Rouge,LA 085 106
Battle Creek,MI 403 256
Beaumont,TX 185 012
Bellingham,WA 047 006
Beloit,WI 217 210
Benton Harbor,MI 277 260
Biddeford,ME 501 484
Billings,MT 279 262
Biloxi,MS 281 264
Binghamton,NY 283 266
Birmingham,AL 113 098
Bismarck,ND 285 268
Bloomington,IL 455 532
Boise,ID 289 272
Boston,MA 007 028
Bradenton,FL 175 042
Bremerton,WA 047 006
Bridgeport,CT 119 088
Bristol,TN 149 074
Brownsville,TX 451 434
Bryan,TX 297 280
Buffalo,NY 003 056
Burlington,NC 069 144
Burlington,VT 313 300
Canton,OH 073 054
Casper,WY 301 284
Ceder Falls,IA 589 568
Cedar Rapids,IA 303 286
Champaign,IL 305 532
Charleston,WV 307 290
Charleston,SC 127 156
Charlotte,NC 139 114
Charlottesville,VA 309 292
Chattanooga,TN 161 148
Chicago,IL 001 020
Chico,CA 311 294
Cincinnati,OH 051 014
Clarksville,TN 179 296
Cleveland,OH 015 054
College Station,TX 297 280
Colorado Springs,CO 045 180
Columbia,MO 317 298
Columbia,SC 189 182
Columbus,GA 319 302
Columbus,OH 133 138
Corpus Christi,TX 191 184
Council Bluffs,IA 137 152
Cumberland,MD 321 304
Dallas,TX 033 038
Danville,VA 323 306
Davenport,IA 193 186
Dayton, OH 163 134
Daytona Beach,FL 325 308
Decatur,IL 327 532
Dennison,TX 033 038
Denver,CO 045 058
Des Moines,IA 195 150
Detroit, MI 021 010
Dothan,AL 329 312
Dover,NH 501 484
Dubuque,IA 331 314
Duluth,MN 333 316
Durham,NC 069 144
Eau Claire,WI 335 318
Elgin,IL 001 020
El Paso,TX 097 092
Elkhart,IN 549 530
Elmira,NY 283 266
Elyria,OH TBA 054
Enid,OK 341 324
Erie,PA 343 326
Eugene,OR 061 328
Evansville,IN 197 190
Fargo,ND 347 330
Fayettesville,NC 349 100
Fayetteville,AR 607 342
Flint,MI 021 010
Florence,AL 113 334
Florence,SC 377 350
Fort Collins,CO 045 336
Fort Lauderdale,FL 037 024
For Meyers,FL 355 042
Fort Pierce,FL 037 340
Fort Smith,AR 359 342
Fort Walton Bch,FL 361 344
Fort Wayne,IN 199 080
Fort Worth,TX 033 038
Fresno,CA 153 162
Gadsden,AL 113 098
Gainesville,FL 365 348
Galveston,TX 367 012
Gary,IN 001 020
Glens Falls, NY 063 078
Grand Forks,ND 371 356
Grand Rapids,MI 021 244
Granite City,IL 017 046
Great Falls, MT 373 358
Greeley,CO 045 360
Green Bay,WI 217 362
Greensboro,NC 095 142
Greenville,SC 139 116
Gulf of Mexico,LA 171 194
Gulfport,MS TBA 264
Gunterville,AL 203 198
Hagerstown,MD 381 364
Hamilton,OH 383 366
Harlingen,TX 451 434
Harrisburg,PA 159 096
Hartford,CT 119 088
Hickory,NC 385 368
Honolulu,HI 167 060
Houma,LA 387 370
Houston,TX 035 012
Huntington,WV 307 196
Huntsville,AL 203 198
Indianapolis,IN 019 080
Iowa City,IA 389 286
Jackson,MI 391 374
Jackson,MS 205 160
Jacksonville,FL 075 136
Jacksonville,NC 393 376
Janesville, WI 217 210
Johnson City,TN 149 074
Johnstown,PA 039 032
Joliet,IL 001 020
Joplin,MO 401 384
Kalamazoo,MI 403 386
Kankakee,IL 001 020
Kansas City,KS/MO 059 052
Kennewick,WA TBA 500
Kenosha,WI 217 044
Killeen,TX 409 392
Kingsport,TN 149 074
Knoxville,TN 093 104
Kokomo,IN 411 080
La Crosse,WI 413 396
Lafayette,IN 415 080
Lafayette,LA 431 414
Lake Charles,LA 417 400
Lakeland,FL 175 042
Lancaster,PA 159 096
Lansing,MI 021 188
Laredo,TX 419 402
Las Cruces,NM 097 404
Las Vegas,NV 211 064
Lawrence,KS 059 406
Lawton,OK 425 408
Lewiston,ME 427 482
Lexington,KY 213 206
Lima,OH 021 412
Lincoln,NE 433 416
Little Rock,AR 215 208
Long Branch,NY 173 022
Longview,TX 229 418
Lorain,OH 437 054
Los Angeles,CA 027 002
Louisville, KY 065 076
Lubbock,TX 439 422
Lynchberg,VA 441 424
*****************************************************************************
PART XVI. HOME SYSTEM ID LISTING (M-Z)
SYSTEM NON(A) WIRE(B)
Macon,GA 443 426
Madison,WI 217 210
Manchester,NH 445 428
Mansfield,OH 447 430
Marshall,TX 229 418
Mayaguez 449 432
McAllen,TX 451 434
Medford,OR 061 436
Melbourne,FL 175 068
Memphis,TN 143 062
Miami,FL 037 024
Midland,TX 459 422
Millville,NH TBA 250
Milwaukee,WI 005 044
Minneapolis,MN 023 026
Mobile,AL 081 120
Modesto,CA 233 224
Moline,IL 193 186
Monroe,LA 463 440
Monterey,CA 527 126
Montgomery,AL 465 444
Moorehead,ND TBA 330
Muncie,IN 467 080
Muskegon,MI 021 448
Nashua,NH 445 428
Nashville,TN 179 118
NE Pennsylvania 103 172
New Bedford,MA 119 028
New Brunswick,NY 173 022
New Haven,CT 119 088
New London,CT 119 088
New Orleans,LA 057 036
Newport News,VA 083 168
New York,NY 025 022
Norfolk,VA 083 168
Ocala,FL 473 348
Odessa,TX 475 422
Oklahoma City,OK 169 146
Olympia,WA 047 006
Omaha,NE 137 152
Orange County,NY 479 486
Orlando,FL 175 068
Owensboro,KY 197 190
Oxnard,CA 027 002
Panama City,FL 483 462
Parkersburg,WV 485 032
Pascagoula,MS 487 264
Pasco,WA TBA 500
Pensacola,FL 361 120
Peoria,IL 221 214
Petaluma,CA 031 040
Petersburg,VA 071 472
Philadelphia,PA 029 008
Phoenix,AZ 053 048
Pine Bluff,AR 215 208
Pittsburg,PA 039 032
Pittsfield,MA 119 480
Ponce,PR 497 082
Portland,ME 499 482
Portland,OR 061 030
Portsmouth,NH 501 484
Poughkeepsie,NY 503 486
Providence,RI 119 028
Provo,UT 091 488
Pueblo,CO 045 490
Racine,WI 217 044
Raleigh,NC 069 144
Rapid City,SD 511 494
Reading,PA 103 008
Redding,CA 513 294
Reno,NV 515 498
Richland,WA 517 500
Richmond,VA 071 170
Roanoke,VA 519 502
Rochester,NH 501 484
Rochester,MN 521 504
Rochester,NY 117 154
Rockford,IL 217 506
Sacramento,CA 129 112
Saginaw,MI 021 389
Salem,OR 061 030
Salinas,CA 527 126
Salt Lake City,UT 091 094
San Angelo,TX 529 510
San Antonio,TX 151 122
San Diego,CA 043 004
San Francisco,CA 031 040
San Jose,CA 031 040
Terre Haute,IN 567 080
Texarkana,AR/TX 229 550
Toledo,OH 021 130
Topeka,KS 059 552
Trenton,PA 029 008
Tuscon,AZ 053 140
Tulsa,OK 111 166
Tuscaloosa,AL 577 098
Tyler,TX 579 418
Utica,NY 235 226
Vallejo,CA 031 040
Victoria,TX 581 562
Vineland,NJ 583 250
Visalia,CA 153 162
Waco,TX 587 566
Warren,OH 089 126
Washington,DC 013 018
Waterloo,IA 589 568
Wausau,WI 591 570
West Palm Beach,FL 037 024
Wheeling,WV 039 032
Wichita Falls,TX 595 574
Wichita,KS 165 070
Wilkes Barr,PA 103 172
Williamsport,PA 103 576
Wilmington,DE 123 008
Wilmington,NC 599 578
Winston-Salem,NC 095 142
Worcester,MA 007 028
Yakima,WA 601 580
York,PA 159 096
Youngstown,OH 089 126
Yuba City,CA 129 112
*****************************************************************************
PART XVI. "THE ROAMING SCAM"
Some people who are playing with phones that have been originally
registered but have been turned off for non-payment of bills have used the
"Roaming Scam" to place free calls. NOTE: The cellular carriers will still
have records of these calls, and will prosecute those they eventually catch
up to (yeah,right). However, industry standards have shown that they pursue
less than one percent of the fraudulent calls placed. It is far more
economical for them to build software and hardware traps to prevent unbilled
calls from being placed rather than attempt to collect on the other end
which involves greater amounts of personnel and manpower with smaller actual
collections.
People have performed the roaming scam by taking their phones into
areas where the SIDH numbers are different from the ones currently programmed
into their phones. Refer to the SIDH listing in this file for the codes for
particular cities. By reprogramming the NAM and inserting a fake SIDH, the
cellular carrier will often accept the phone call, but on occassion the user
will get a message that the phone must have a local code in order to access
the system. As cellular carriers grow larger in size, this message is less
frequently heard. At this point, the cellular carrier instructs the user to
contact them. I don't think so.
The cellular service has the best chance of of catching a spoofer who
either calls a friend continually at home or by developing traceable trends
such as calling the same number from within the same cell at the same time
every day. Or doing something stupid like ordering a Pizza.
"But I want to hook up the phone to an acoustic coupler, d00d, and
call all the k-rad out-state-boards for the latest
PyRut WaR3z!4@$$!$@!@" <-lamer.
Well, one of the properties of cellular phone systems is that the
transmitter freqs. may be changed or "hopped" in the constant effort to
allocate freqs. Because of freq. hopping it is very difficult to
triangulate a cellular phone using standard directional finding methods
(trace you, d00d). Further, it is known that a directional antenna randomly
aimed at cellsite repeaters will confuse directional finding equipment
being used by them that is synced to their freq. hopping scheme.
*****************************************************************************
PART XI. THE 40-50 MHZ CELLULAR SCANNER
The cellular phone freqs. occupy the UHF spectrum previously assign
to commercial TV stations. Since a TV channel occupies a Bandwidth(BW) of 6
MHZ and each cellular channel requires 24 KZ (for a plus and minus 12 KHZ
signal) and a 3KHZ guard band for each audio signal (thus the 30KHZ spacing).
200 cellular channels can fit into one UHF TV channel. Thus, with a little
fine tuning, and old TV set with variable VHF tuning can tune in all
cellular freqs. between 824 and 890 MHZ.
UHF TV tuners ares designed to convert these UHF freqa. to intermediate
(difference) freqs. between 41 and 47 MHZ. Thus, by purchasing a commonly
available UHF tuner (check sith a TV shop and try to get a copy of the
SAMS for powering the AFC info, and avoid those with tubes). Tuner voltage
is usually 8-24 volts, and must be correctly connected up. You should also
remove with the tuner, the TV's channel select and fine tuning controls
for ease of use - and they should be in good condition.
Once you have the tuner, you can then wire it between a 30-50 MHZ scanner and
a UHF antenna (highly directional yagi type is preferred). Since the tuner
will probably have a 300 ohm input impedance, a twin antenna cable is
preferred (Yes Radio Shack has 'em). If you are into directional-finding,
the UHF antenna should NOT have AGC (automatic Gain Control) as those with
active AGC will amplify reflections, resulting in readings from so many
directions that the target will be lost. Because of the use of inconspicuous,
commonly available, inexpensive, high-gain UHF antennas, using a good UHF
tuner to scan cellular channels is a good method of doing it.
Tuner output is usually through an RCA-type plug. CAUTION: BE SURE TO COUPLE
YOUR SCANNER TO THE UHF TUNER WITH A 0.01-0.1 mf (50 V min.) CAPACITOR FOR
DC BLOCKING. AND DO NOT TRY TO OPERATE THE TUNER THROUGH ITS TV SET AS THE
DANGER OF HIGH-VOLTAGE DISCHARGE IS HIGH. Also, connect a ground wire
between the tuner and the scanner.
The table below describes how cellular freqs. can be downconverted by a
commonly available UHF TV tuner (all freqs. are in MHZ)
CELLULAR MOBILE FREQS & SCANNER EQUIVALENTS
TV
BAND CELL. CHAN. SCAN TV OSCIL
CHAN. # and FREQ. FREQ. FREQ. LIMIT
----------- ------------ ----- -------- -----
73 (first) 0001-825.03 45.97 871 824-830
73 (last) 0166-829.98 41.02 871 824-830
74 (first) 0167-830.01 46.99 877 830-836
74 (last) 0366-835.98 41.02 877 830-836
75 (first) 0367-836.01 46.99 883 836-842
75 (last) 0566-841.98 41.02 883 836-842
76 (first) 0567-842.01 46.99 889 842-848
76 (last) 0766-847.98 41.02 889 842-848
77 (first) 0767-848.01 46.99 895 848-854
77 (last) 0799-848.97 46.03 895 848-854
CELLULAR PHONE FREQS. HAVE NOT BEEN ASSIGNED
FOR CHANNELS 800-990
73 (first) 0991-824.04 46.96 871 824-830
73 (last) 1023-825.00 46.00 871 824-830
80 (first) 0001-870.03 42.97 913 866-872
80 (last) 0066-871.98 41.02 913 866-972
81 (first) 0067-872.01 46.99 919 872-878
81 (last) 0266-877.98 41.02 919 872-878
82 (first) 0267-878.01 46.99 925 878-884
82 (last) 0466-883.98 41.02 925 878-884
83 (first) 0467-884.01 46.99 931 884-890
83 (last) 0666-889.98 41.02 931 884-890
83 (**) 0667-890.01 46.99 931 884-890
83 (**) 0799-893.97 37.03 931 884-890
CELLULAR PHONE FREQS. HAVE NOT BEEN ASSIGNED
FOR CHANNELS 800-990
80 (first) 0991-869.04 43.96 913 866-872
80 (last) 1023-870.00 43.00 913 866-872
(**) These freqs. are outside of the normal Channel 83 BW. However, most UHF
tuners have a fine tuner that can be adjusted up to about another 6 MHZ.
Note that the term "first" and "last" refers to the first and last cellular
channels receivable by the UHF tuner for the given TV channel. Base voice
channels are monitored when both sides of the conversation is required.
Mobile voice channels or base control channels are monitored to locate a
cellular phone. Tuning is simple:
(1) Decide which cellular channel or freq. you wish to monitor.
(2) Find what UHF channel includes that freq. and switch the TV
to that channel.
(3) Using the table, look up the corresponding TV oscillator freq.
(ex: 919 MHZ for TV channel 81). Subtract the cellular channel
freq. from the TV oscillator freq.
(4) Tune your scanner to the difference freq.
When you select a scanner, you should pick one that will scan in 30 MHZ
increments to efficiently receive cellular transmissions. If you can't get
one like that, then get one that will scan in 15,10 or 5 KHZ increments.
*****************************************************************************
PART XII. HOW THE ESN IS REPLACED
It takes some electronics skill to pull or unsolder the ESN. If you
are sketchy about messing around with your phone, I suggest practicing on
something else first, like an old calculator or something. It is also a
good idea to use the proper tools (A very small soldering tip,chip pullers,
It is imperative NOT to touch any of the surrounding connections, soldering
joints, or chips. The job MUST be done right the very first time. After
that it is not so important, because after the first time you should have the
ESN information stored safely to disk. The only dangers remaining are
physically damaging the chip. (Note: There are devices that wipe PROMs
clean in the event of programming errors).
When removing the ESN, try to follow these 5 steps:
A. Remove the PC board containing the ESN from the entire phone unit. The
boards are usually screwed in with Phillips heads. This will insure
against damage to the rest of the unit.
B. Ascertain the correct chip. Find the letters on the chip, and check it
against the letters from the IDENTIFYING THE ESN section. Refer to the .Gif
file included if necessary.
C. It is a good idea to draw a sketch to help you remember which way the chip
went in. You may laugh, but do it anyway.
D. Carefully remove the chip. Take your time and use the proper tools.
E. Solder in a zero insertion force (ZIF) replacement, so that replacement
chip can be changed easily.
After the ZIF socket has been successfully soldered in, reinsert the
ESN and attempt to make a phone call (Be sure the NAM is programmed
correctly). If it doesn't, check the leads on the ZIF to insure that you
have soldered them correctly. After that, insert your ESN into your PROM
reader and make sure it provides some sort of reading. You should use the
search mode to look for the manufacturers serial number.
(see MANUFACTURER'S ESN CODE LISTING) to identify the address on the PROM
where to reprogram the ESN.
*****************************************************************************
PART XIII. EQUATIONS FOR PROGRAMMING THE CHIPS
In most instances, you will not be able to tell the code on a PROM
because the manufacturer will have blown the security fuse in order to
prevent people from obtaining the codes to reprogram their own chips.
Therefore, it might be necessary to produce a set of equations that are
programmed into the cip to produce a bogus ESN. The bogus chips must contain
the first three digits of the manufacturer's code listing, which is
consequently the first marker of the actual ESN. Experimentation might be
necessary, but hey, isn't that half the fun?
With the aid of an EPROM emulator, the whole process should be able
to be completed in under an hour - this includes pulling the chip, creating
a new ESN, programming the chip, and replacing it.
So know you're saying "Holy Cow this project is getting expensive!".
Well it can get that way, but the long run payoff is worth it. I have seen
both emulators and burners for under $200 (I'm not talking about those spiffy
models that program RAM, just the basic EPROMs...in fact I can buy them for
under $150. Same with the emulator. Just look around.)
I wouldn't be surprised if actual ESN data started appearing on
boards in the near future. I know when I finsish my phone (Hopefully soon)
I plan on U/L the ESN info somewhere.
****************************************************************************
PART XIV. MANUFACTURER'S ESN CODE LISTING
---------------------------------------------------------------------------
MANUFACTURER DECIMAL HEX CODE OCTAL CODE
---------------------------------------------------------------------------
Alpine Electronics # 150 96 226
Antel (see Emptel,Sanyo)
ARA *
AT&T Technologies (see notes) 158 9E 236
Astrotel (see OKI)
Audiovox-Audiotel (see notes) 138 8A 212
Blaupunkt (R. Bosch) # 148 94 224
Clarion Company Ltd. 140 8C 214
Clarion Manufacturing Co. 166 A6 246
CM Communications 153 99 231
Diamondtel (See Mitsubishi)
DI-BAR Electronics 145 91 221
E.F. Johnson # 131 83 203
Emptel Electronics Co. 178 B2 262
Ericsson 143 8F 217
Ericsson GE Mobile 157 9D 235
Fujitsu # 133 85 205
Gateway Telephone 147 93 223
General Electric # (mini is 134)146 92 222
Glenayre (see notes)
Goldstar Products Co. # 141 8D 215
Harris # 137 89 211
Hitachi # 132 84 204
Hughes Network Systems 164 A4 244
Hyundai 160 A0 240
Japan Radio Co. 152 98 230
Kokusai 139 8B 213
Mansoor Electronics 167 A7 247
Mitsubishi (see notes) 134 86 206
Mobira (Nokia-Kinex) # 156 9C 234
Motorola 130 82 202
Motorola Int'l. 168 A8 250
Murata Machinery LTD. 144 90 220
NEC # 135 87 207
Nokia # 165 A5 245
Novatel 142 8E 216
OKI # 129 81 201
Panasonic (Matsushita) # 136 88 210
Phillips Telecom # 170 AA 252
Phillips Circuit 171 AB 253
Qualcomm, Inc. 159 9F 237
Sanyo 175 AF 257
Satellite Technology 161 A1 241
Samsung Communications 176 B0 258
Shintom West (Audio-Vox BC-20)# 174 AE 256
Sony Corp. 154 9A 232
Sun Moon Star # 178 B2 262
Tama Denki Co. 155 9B 233
Tandy/Mobira # 165 A5 245
TacTel (see notes)
Technophone # 162 A2 242
Toshiba 138 8A 212
Uniden Corp. of America # 172 AC 254
Uniden Corp. of Japan 173 AC 255
Universal Cellular 149 95 225
USA Corp. # (see notes)
Walker (JRC, Technophone) 152 98 230
Western Electric # (see notes)
Western Union # (see notes)
Yupiteru Industries 163 A3 243
NOTES:
The hexidecimal ESN is an 11-digit number, first three are manufacturer's
decimal code, next two are reserved (but may contain zeros or numbers);
remaining six are the decimal serial number.
These companies use phones from various manufacturers, code will be of actual
manufacturer.
Alpine 9510 is Fujitsu 362A - Antel, use GE, Emptel, Sanyo - ARA varies- ATT
1300, 1800 use Mitsubishi - AT&T 1100,1400,1440,1700,1710 use Hitachi -
Audiotel 1000,3000,500,BC-40,400,450,550,600 use Toshiba - PC100,200 use
Technophone - BC-20,CMT-125 use Shintom - TacTel use Toshiba,Blaupunkt, most
are Panasonic, some are Blaupunkt - GE Mini, Gelayre 301 , USA A&B
use Mitsubishi - Mitsubishi 460 use Toshiba - Walker Pocketphone use
JRC or Technophone - Western Electric use Hitachi - Western Union use E.F.
Johnson.
# - Chassis number abd ESN correspond to each other.
Decimal ESN conversion is required for serial numbers over 1,000,000 or
2,000,000, etc. Simply drop the millions digit and add 262,144 times the
millions digit to the remaining number. For example, 01,123,456 =
385,600 or 02,123,46 = 647,744. Then affix the Manufacturers Decimal Code plus
two zeros on left to yield 11-digit ESN. The Hex ESN may be found by
converting this number to hexidecimal.
*****************************************************************************
PART XV. HOME SYSTEM ID LISTING (A-L)
SYSTEM NON(A) WIRE(B)
Abilene,TX 131 422
Aguadilla 605 188
Aiken,GA 181 084
Akron,OH 073 054
Albany,GA 241 204
Alburquerque,NM 079 110
Alexandria,LA 243 212
Allentown,PA 103 008
Alton,IL 017 046
Altoona,PA 247 032
Amarillo,TX 249 422
Anchorage,AK 251 234
Anderson,IN 253 080
Anderson,SC 139 116
Anniston,AL 113 098
Appleton,WI 217 240
Asheville,NC 263 246
Ashland,WV 307 TBA
Athens,AL 203 198
Athens,GA 041 034
Atlanta,GA 041 034
Atlantic City,NJ 267 250
Augusta,GA 181 084
Aurora,IL 001 020
Austin,TX 107 164
Bakersfield,CA 183 228
Baltimore,MD 013 018
Bangor,ME 271 254
Baton Rouge,LA 085 106
Battle Creek,MI 403 256
Beaumont,TX 185 012
Bellingham,WA 047 006
Beloit,WI 217 210
Benton Harbor,MI 277 260
Biddeford,ME 501 484
Billings,MT 279 262
Biloxi,MS 281 264
Binghamton,NY 283 266
Birmingham,AL 113 098
Bismarck,ND 285 268
Bloomington,IL 455 532
Boise,ID 289 272
Boston,MA 007 028
Bradenton,FL 175 042
Bremerton,WA 047 006
Bridgeport,CT 119 088
Bristol,TN 149 074
Brownsville,TX 451 434
Bryan,TX 297 280
Buffalo,NY 003 056
Burlington,NC 069 144
Burlington,VT 313 300
Canton,OH 073 054
Casper,WY 301 284
Ceder Falls,IA 589 568
Cedar Rapids,IA 303 286
Champaign,IL 305 532
Charleston,WV 307 290
Charleston,SC 127 156
Charlotte,NC 139 114
Charlottesville,VA 309 292
Chattanooga,TN 161 148
Chicago,IL 001 020
Chico,CA 311 294
Cincinnati,OH 051 014
Clarksville,TN 179 296
Cleveland,OH 015 054
College Station,TX 297 280
Colorado Springs,CO 045 180
Columbia,MO 317 298
Columbia,SC 189 182
Columbus,GA 319 302
Columbus,OH 133 138
Corpus Christi,TX 191 184
Council Bluffs,IA 137 152
Cumberland,MD 321 304
Dallas,TX 033 038
Danville,VA 323 306
Davenport,IA 193 186
Dayton, OH 163 134
Daytona Beach,FL 325 308
Decatur,IL 327 532
Dennison,TX 033 038
Denver,CO 045 058
Des Moines,IA 195 150
Detroit, MI 021 010
Dothan,AL 329 312
Dover,NH 501 484
Dubuque,IA 331 314
Duluth,MN 333 316
Durham,NC 069 144
Eau Claire,WI 335 318
Elgin,IL 001 020
El Paso,TX 097 092
Elkhart,IN 549 530
Elmira,NY 283 266
Elyria,OH TBA 054
Enid,OK 341 324
Erie,PA 343 326
Eugene,OR 061 328
Evansville,IN 197 190
Fargo,ND 347 330
Fayettesville,NC 349 100
Fayetteville,AR 607 342
Flint,MI 021 010
Florence,AL 113 334
Florence,SC 377 350
Fort Collins,CO 045 336
Fort Lauderdale,FL 037 024
For Meyers,FL 355 042
Fort Pierce,FL 037 340
Fort Smith,AR 359 342
Fort Walton Bch,FL 361 344
Fort Wayne,IN 199 080
Fort Worth,TX 033 038
Fresno,CA 153 162
Gadsden,AL 113 098
Gainesville,FL 365 348
Galveston,TX 367 012
Gary,IN 001 020
Glens Falls, NY 063 078
Grand Forks,ND 371 356
Grand Rapids,MI 021 244
Granite City,IL 017 046
Great Falls, MT 373 358
Greeley,CO 045 360
Green Bay,WI 217 362
Greensboro,NC 095 142
Greenville,SC 139 116
Gulf of Mexico,LA 171 194
Gulfport,MS TBA 264
Gunterville,AL 203 198
Hagerstown,MD 381 364
Hamilton,OH 383 366
Harlingen,TX 451 434
Harrisburg,PA 159 096
Hartford,CT 119 088
Hickory,NC 385 368
Honolulu,HI 167 060
Houma,LA 387 370
Houston,TX 035 012
Huntington,WV 307 196
Huntsville,AL 203 198
Indianapolis,IN 019 080
Iowa City,IA 389 286
Jackson,MI 391 374
Jackson,MS 205 160
Jacksonville,FL 075 136
Jacksonville,NC 393 376
Janesville, WI 217 210
Johnson City,TN 149 074
Johnstown,PA 039 032
Joliet,IL 001 020
Joplin,MO 401 384
Kalamazoo,MI 403 386
Kankakee,IL 001 020
Kansas City,KS/MO 059 052
Kennewick,WA TBA 500
Kenosha,WI 217 044
Killeen,TX 409 392
Kingsport,TN 149 074
Knoxville,TN 093 104
Kokomo,IN 411 080
La Crosse,WI 413 396
Lafayette,IN 415 080
Lafayette,LA 431 414
Lake Charles,LA 417 400
Lakeland,FL 175 042
Lancaster,PA 159 096
Lansing,MI 021 188
Laredo,TX 419 402
Las Cruces,NM 097 404
Las Vegas,NV 211 064
Lawrence,KS 059 406
Lawton,OK 425 408
Lewiston,ME 427 482
Lexington,KY 213 206
Lima,OH 021 412
Lincoln,NE 433 416
Little Rock,AR 215 208
Long Branch,NY 173 022
Longview,TX 229 418
Lorain,OH 437 054
Los Angeles,CA 027 002
Louisville, KY 065 076
Lubbock,TX 439 422
Lynchberg,VA 441 424
*****************************************************************************
PART XVI. HOME SYSTEM ID LISTING (M-Z)
SYSTEM NON(A) WIRE(B)
Macon,GA 443 426
Madison,WI 217 210
Manchester,NH 445 428
Mansfield,OH 447 430
Marshall,TX 229 418
Mayaguez 449 432
McAllen,TX 451 434
Medford,OR 061 436
Melbourne,FL 175 068
Memphis,TN 143 062
Miami,FL 037 024
Midland,TX 459 422
Millville,NH TBA 250
Milwaukee,WI 005 044
Minneapolis,MN 023 026
Mobile,AL 081 120
Modesto,CA 233 224
Moline,IL 193 186
Monroe,LA 463 440
Monterey,CA 527 126
Montgomery,AL 465 444
Moorehead,ND TBA 330
Muncie,IN 467 080
Muskegon,MI 021 448
Nashua,NH 445 428
Nashville,TN 179 118
NE Pennsylvania 103 172
New Bedford,MA 119 028
New Brunswick,NY 173 022
New Haven,CT 119 088
New London,CT 119 088
New Orleans,LA 057 036
Newport News,VA 083 168
New York,NY 025 022
Norfolk,VA 083 168
Ocala,FL 473 348
Odessa,TX 475 422
Oklahoma City,OK 169 146
Olympia,WA 047 006
Omaha,NE 137 152
Orange County,NY 479 486
Orlando,FL 175 068
Owensboro,KY 197 190
Oxnard,CA 027 002
Panama City,FL 483 462
Parkersburg,WV 485 032
Pascagoula,MS 487 264
Pasco,WA TBA 500
Pensacola,FL 361 120
Peoria,IL 221 214
Petaluma,CA 031 040
Petersburg,VA 071 472
Philadelphia,PA 029 008
Phoenix,AZ 053 048
Pine Bluff,AR 215 208
Pittsburg,PA 039 032
Pittsfield,MA 119 480
Ponce,PR 497 082
Portland,ME 499 482
Portland,OR 061 030
Portsmouth,NH 501 484
Poughkeepsie,NY 503 486
Providence,RI 119 028
Provo,UT 091 488
Pueblo,CO 045 490
Racine,WI 217 044
Raleigh,NC 069 144
Rapid City,SD 511 494
Reading,PA 103 008
Redding,CA 513 294
Reno,NV 515 498
Richland,WA 517 500
Richmond,VA 071 170
Roanoke,VA 519 502
Rochester,NH 501 484
Rochester,MN 521 504
Rochester,NY 117 154
Rockford,IL 217 506
Sacramento,CA 129 112
Saginaw,MI 021 389
Salem,OR 061 030
Salinas,CA 527 126
Salt Lake City,UT 091 094
San Angelo,TX 529 510
San Antonio,TX 151 122
San Diego,CA 043 004
San Francisco,CA 031 040
San Jose,CA 031 040
Terre Haute,IN 567 080
Texarkana,AR/TX 229 550
Toledo,OH 021 130
Topeka,KS 059 552
Trenton,PA 029 008
Tuscon,AZ 053 140
Tulsa,OK 111 166
Tuscaloosa,AL 577 098
Tyler,TX 579 418
Utica,NY 235 226
Vallejo,CA 031 040
Victoria,TX 581 562
Vineland,NJ 583 250
Visalia,CA 153 162
Waco,TX 587 566
Warren,OH 089 126
Washington,DC 013 018
Waterloo,IA 589 568
Wausau,WI 591 570
West Palm Beach,FL 037 024
Wheeling,WV 039 032
Wichita Falls,TX 595 574
Wichita,KS 165 070
Wilkes Barr,PA 103 172
Williamsport,PA 103 576
Wilmington,DE 123 008
Wilmington,NC 599 578
Winston-Salem,NC 095 142
Worcester,MA 007 028
Yakima,WA 601 580
York,PA 159 096
Youngstown,OH 089 126
Yuba City,CA 129 112
*****************************************************************************
PART XVII. "THE ROAMING SCAM"
Some people who are playing with phones that have been originally
registered but have been turned off for non-payment of bills have used the
"Roaming Scam" to place free calls. NOTE: The cellular carriers will still
have records of these calls, and will prosecute those they eventually catch
up to (yeah,right). However, industry standards have shown that they pursue
less than one percent of the fraudulent calls placed. It is far more
economical for them to build software and hardware traps to prevent unbilled
calls from being placed rather than attempt to collect on the other end
which involves greater amounts of personnel and manpower with smaller actual
collections.
People have performed the roaming scam by taking their phones into
areas where the SIDH numbers are different from the ones currently programmed
into their phones. Refer to the SIDH listing in this file for the codes for
particular cities. By reprogramming the NAM and inserting a fake SIDH, the
cellular carrier will often accept the phone call, but on occassion the user
will get a message that the phone must have a local code in order to access
the system. As cellular carriers grow larger in size, this message is less
frequently heard. At this point, the cellular carrier instructs the user to
contact them. I don't think so.
The cellular service has the best chance of of catching a spoofer who
either calls a friend continually at home or by developing traceable trends
such as calling the same number from within the same cell at the same time
every day. Or doing something stupid like ordering a Pizza.
"But I want to hook up the phone to an acoustic coupler, d00d, and
call all the k-rad out-state-boards for the latest
PyRut WaR3z!4@$$!$@!@" <-lamer.
Well, one of the properties of cellular phone systems is that the
transmitter freqs. may be changed or "hopped" in the constant effort to
allocate freqs. Because of freq. hopping it is very difficult to
triangulate a cellular phone using standard directional finding methods
(trace you, d00d). Further, it is known that a directional antenna randomly
aimed at cellsite repeaters will confuse directional finding equipment
being used by them that is synced to their freq. hopping scheme.
*****************************************************************************
PART XVIII. MERCHANDISE SHEET
CELLULAR PHONE SUPPLIERS
NCI R/M Wholesale Communications
744 Roble Road, Suite 185 800-837-5532
Allentown,PA 18103
800-669-5167
215-264-5117
Superior Cellular Products Cellular Enterprises, Inc.
3925 N. Rosemead Blvd. #205 813-885-7766
Rosemead,CA 91770
818-280-6665
Dynatek Communication Dist. Wholesale Cellular, Inc.
340 Constance Dr. 5720 West 71st St.
Warminster,PA 18974 Indianapolis, IN 46278
215-672-5000 317-297-6100
CELLULAR SERVICE MONITORS
InTouch USA
800-USA-ROAM
800-872-7626
CELLULAR TEST EQUIPMENT
WAVETEK
1-800-223-WVTK
Ask for free Communications Catalog
CELLULAR SERVICE MONITORS
Communication Instruments
356 Hillcrest Street
El Segundo, CA 90245
800-288-8223
213-322-3666
CELLULAR PHONE REPAIRS
Communication Consultants Co. Cellular Phone Services, Inc
16128 Cohasset St. 403 E. Gude Dr.
Van Nuys, CA 91406 Rockville, MD 20850
818-901-9711 800-326-7901
ext. 101
PROM EMULATORS
Parallax, Inc. Incredible Technologies
6200 Desimone Lane, #69A 708-437-2433
Citrus Heights, CA 95621
916-726-1905
Technical Solutions
P.O. Box 462101
Dept. 101
Garland, TX 75046
214-272-9392
PROM PROGRAMMERS
BP Microsystems Link Computer Graphics
10681 Haddington 369 Passaic Road, Ste. 100
Houston,TX 77043 Fairfield, NJ 07004
713-461-9430 201-808-8990
MVS Needhamps Electronics
Box 994 4539 Orange Grove Ave.
Merrimack, NH Sacramento, CA 95841
508-792-9507 916-924-8037
PROM CHIPS
National Semiconductor
Offices throughout the U.S.
408-721-5000
JDR Microdevices
800-538-5000
Easy Tech
2917 Bayview Drive
Fremont, CA 94538
800-582-4044
|
|
|
To the best of our knowledge, the text on this page may be freely reproduced and distributed.
If you have any questions about this, please check out our Copyright Policy.
totse.com certificate signatures
|
|
|
About | Advertise | Bad Ideas | Community | Contact Us | Copyright Policy | Drugs | Ego | Erotica
FAQ | Fringe | Link to totse.com | Search | Society | Submissions | Technology
|
|
|
|
|
|
