About
Community
Bad Ideas
Drugs
Ego
Erotica
Fringe
Society
Technology
Phreak
Boxes, Old and New
Bugs and Taps
Cellular Phones
Introduction to Telecommunications
PBX's and Switches
Payphones
Phone Phun
VMB's, Pagers, E-Mail, and S&F Systems
register | bbs | search | rss | faq | about
meet up | add to del.icio.us | digg it

Cellular programming


NOTICE: TO ALL CONCERNED Certain text files and messages contained on this site deal with activities and devices which would be in violation of various Federal, State, and local laws if actually carried out or constructed. The webmasters of this site do not advocate the breaking of any law. Our text files and message bases are for informational purposes only. We recommend that you contact your local law enforcement officials before undertaking any project based upon any information obtained from this or any other web site. We do not guarantee that any of the information contained on this system is correct, workable, or factual. We are not responsible for, nor do we assume any liability for, damages resulting from the use of any information on this site.

Here are some notes I found regarding programming Motorola cellular
products. I have an 8000H portable phone. Some comments:

From the keyboard, you must know the security code to get to
programming mode. You may enter programming mode a total of three
times. After three times, the phone must be returned to the dealer to
have a counter reset. However, at least on the 8000H and Ultra Classic
portables, one can fabricate a jumper, and reset the counter easily.

Before changing anything, I'd use * to step through and record
your present values.

Note that if you install the jumper, you would enter 55# and then
follow the notes for entering the customer/system information. You
can also first do a 32# to clear all timers and restore features to
standard. THIS ERASES ALL STORED PARAMATERS!

What I found most useful was to step through, record all paramaters
entering programming mode from the keypad without the jumper.

Then, power up with the jumper, use 32# to clear evertying
power off
remove jumper
power up
reset params entering programming mode from keyboard,
using 000000 as the security code

This technique let me have two phone numbers in two markets, even
though the phone is single NAM. I'd get to a particular spot on the
road, with a convenient rest area, and reprogram my phone for service
(as contracted for!) in the second city. This was to have a local
number and not pay roaming rates in the second city. On the return
trip, I'd stop and reprogram for my "home" market.

Disclaimers: You can put the phone in several modes intended for
alignment and testing "on the bench". Don't do it. You could also set
the phone up such that the contracted for service won't work properly.
Don't program paramaters to other than those provided by your carrier.

There is no way (as far as I know) to alter the ESN on these phones.
Well, I'm sure it's possible if you're the vendor but there is no
magic keypad code to do it.

You can also make the phone a cellular receiver: power up with jumper

353# Select Handset audio path
08# RX Audio ON
11xxx# Three digit number, i.e. 11362#
474# Set to mid level audio
11xxx# Change to another channel

Power off, remove jumper, power up to restore normal phone
operations.

Dec 29, 1993 Motorola Cellular Mobile Telephone programming notes:

Part 1: From the manual included with the 8000H portable phone.

Items to be programmed:
System ID Code 5 digits
Cellular Telephone Number 10 digits
Station Class Code 2 digits
Access Overload Class 2 digits
Group ID Mark 2 digits
Security Code 6 digits
Unlock Code 3 digits
Initial Paging Channel 4 digits (Use Leading 0)
Option Bits 6 digits
*Internal Speaker 0 for internal
*Local Use normally 1
*Min Mark Normally 0, 0=disabled
when enabled, unit sends area code on all calls
*Auto REcall Always set to 1
*Second PHone number 0
*Diversity 0=off
Option Bits
*Long Tone DTMF 1 (0 to disable)
*FUTURE USE 0
*Eight hour timeout 0 to enable

Programming your telephone:

If you have:
Menu and Fcn keys Sequence 6
FCN key but no Menu key Sequence 1
No Fcn key Sequence 2

Model Handset Type Sequence
3000SCN 2007 A 6
6000SCN 2023 A 2
6000XSL N2020 A 1
6800XLT LN2659 A 1
6800XLT LN2733 A 6
Alpha Hndset SCN2083 A 6

Sequence
1 FCN, Security Code entered twice, RCL
2 STO, #, Security Code entered twice, RCL
3 Ctl, 0 + SC twice, RCL
4 Ctl, 0 + SC twice, *
5 FCN, 0 + SC twice, MEM
6 FDN, 0 + SC twice, RCL
Security code is programmed 000000 at the factory

After successfully entering program mode, 01 appears on the display

* steps thorugh
SND stores information

Step 1 SID
Step 2 Area Code
Step 3 Phone Number
Step 4 Station Class Mark
Step 5 Access Overload Class
Step 6 Group ID
Step 7 Security Code
Step 8 Unlock Code
Step 9 Initial Paging Channel
Step 10 Options (6 digits)
Step 11 Options (3 digits)

Part 2: From a programming Cheat Sheet, not normally included with the
phone: Assumes one has fabricated a jumper or has a test jig. These
functions available only if you start the phone with one pin jumpered
to ground as below.

CHAN \/ PWR LVL
x x x x x x <--Rx Sig Strength, 00-99
SAT -->x x x x x x x <--1=TX Audio OFF
^ ^ ^ ^
1=TX on <-- : : : : 1=RX AUdio OFf
1=SigTone ON : : 1=Control Channel

01# Restart (Turns unit off and back on)
02# Display current radio stuatus (non-scrolling version
of above display)
04# Initiales Unit to Standard Default Settings
Carrier OFF
RF Attenuator to max power
Receiver Audio Muted
Transmit Audio Muted
Signalling Tone Off
Resetting of Watchdog Timer Enabled
DTMF and Audio Tones off
Audio path set to speaker

05# TX Carrier ON
06# TX Carrier OFF
07# RX OFF (Mute RX audio)
08# RX Audio ON (Unmuted)
09# TX Audio OFF
10# TX Audio ON
11(CH No)# Sets to desired channel
12# Set power to x; 0=max 7 = min
14# 10 Khz sig tone on
15# 10 Khz Sig tone off
19# Display software version number (4 digits)
25x# SAT Tone on when x=0, SAT = 5970 Hz
x=1, SAT = 6000 Hz
x=2, SAT = 6030 Hz
26# SAT Tone off
27# Transmit Data
28# 1150 Hz Tone on
29# 1150 Hz Tone off
30# 770 Hz Tone on
31# 770 Hz Tone off
32# Clears all timers and resets User's programmable features to
standard, also clears user stored memory.
33x# Turn on DTMF Tone for X, X = 0-9, * or #
34# DTMF Tone(s) off
35# Display RSSI ("D" Series portable only)
35x# Set Audio path to xx = 0, VSP mike
(mobile only)x = 1, speaker
x = 2, Alert
x = 3, Handset
38# Display ESN in Hex, 2 char at a time use * to step
(Compandor OFF (D series portable only))
39# Compandor on (D series portableonly)
41# Enables Diversity (on f19cta series only)
42# Disables Diversity)
43# Disable Diversity
44# Disable Diversity
45# Display current rssi
46# Display cumulative call timer
47x# Set Rx audio level, 0-7 i.e. 474# is mid level
48# Set side tone on
49# Side Tone off
53# Enable Scrambler option when equiped
54# Disable scrambler
55# Programming customer/system information
Enter 55#, display shows U5 '
Enter 55# again, proceed as if you've
followed the sheet included with the phone.
This allows one to change the phone params
an infinite number of times.
However, some of the info is not in sequence
with the sheet provided with the phone.
58# Compandor on
59# Compandor off)
61# Serial number transfer (for dmt / minitac only)
(See Esn transfer procedure elsewhere)
62# Turn on ringer audio path
63# Turn off ringer audio path
70# Abbreviated field transmitter audio deviation command
71# Abbreviated field power adjustment command
72# Field audio phasing commands
73# Field power adjustment command (dmt/minitac only)

Fabrication of jumper in lieu of test jig:

8000H and Ultra Classic
To enter diag/self test mode:

1.Remove battery.
2.Looking at rear of radio, ground pin x
3.Re install battery and apply power

Rear Connector:

I I I ** I I X
I I I ** I I I
**

* Is the antenna. I is the pins. Note: the case screws are NOT
at ground. The outer silver part of the antenna connector is.

I soldered a piece of stiff resistor lead at the X, and made it just
the proper length. I can then move it to touch the ground to read sig
strength, and then move it to touch nothing for normal operations.

Note that soldering to these pads is tricky, and probably voids the
warranty. A more elegant way would be to use a DC adaptor (Ora and
Celldyne sell them) and drill two small holes to use to connect with
an external jumper. No soldering. Note that the phone is not in power
save mode when in self test/diag mode and the battery will go down
quickly!

The inital display is channel and receive sig strength indicator,
useful for determing how close you are to a tower, or for aiming a
yagi in the desired direction.
 
To the best of our knowledge, the text on this page may be freely reproduced and distributed.
If you have any questions about this, please check out our Copyright Policy.

 

totse.com certificate signatures
 
 
About | Advertise | Bad Ideas | Community | Contact Us | Copyright Policy | Drugs | Ego | Erotica
FAQ | Fringe | Link to totse.com | Search | Society | Submissions | Technology
Hot Topics
Php
Withstanding an EMP
Good computer destroyer?
Wow, I never thought the navy would be so obvious.
Alternatives Internets to HTTP
Anti-Virus
a way to monitor someones AIM conversation
VERY simple question: browser history
 
Sponsored Links
 
Ads presented by the
AdBrite Ad Network

 

TSHIRT HELL T-SHIRTS