618 lines
31 KiB
Plaintext
618 lines
31 KiB
Plaintext
|
|
_
|
|
| \
|
|
| \
|
|
| | \
|
|
__ | |\ \ __
|
|
_____________ _/_/ | | \ \ _/_/ _____________
|
|
| ___________ _/_/ | | \ \ _/_/ ___________ |
|
|
| | _/_/_____ | | > > _/_/_____ | |
|
|
| | /________/ | | / / /________/ | |
|
|
| | | | / / | |
|
|
| | | |/ / | |
|
|
| | | | / | |
|
|
| | | / | |
|
|
| | |_/ | |
|
|
| | | |
|
|
| | c o m m u n i c a t i o n s | |
|
|
| |________________________________________________________________| |
|
|
|____________________________________________________________________|
|
|
|
|
...presents...
|
|
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
|
:::::::: ____ : ____ : _ :::: _ :::::::::: _ : _ : ____ : _ :::: _ :::::::::::
|
|
::::::: | | | ___| | | :: | | :::::::: | | | | | ___| | | :: | | ::::::::::
|
|
::::::: | ||_| | _| | | :: | | ::: ___ | |_| | | _| | | :: | | ::::::::::
|
|
::::::: | | _ | | .: | | :: | | :: |___| | _ | | | .: | | :: | | ::::::::::
|
|
::::::: | || | | |__ | |__ | |__ | | | | | |__ | |__ | |__ ::::::::
|
|
::::::: |____| |____| |____| |____| ::::: |_| |_| |____| |____| |____| :::::::
|
|
::::::::. .:. .:. .:. .:::::::. .:. .:. .:. .:. .::::::::
|
|
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
|
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
|
::::::::::::THE:DIRECTORY:OF:CELLULAR:MODIFICATION:::MITSUBISHI:800:::::::::::
|
|
:::::::::::::...:.........:..:........:............:::..........:...::::::::::
|
|
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
|
==============================================================================
|
|
WRITTEN, CREATED, AND TESTED BY VIDEO VINDICATOR
|
|
==============================================================================
|
|
|
|
>>> a cDc distribution......1993 <<<
|
|
-cDc- CULT OF THE DEAD COW -cDc-
|
|
____ _ ____ _ ____ _ ____ _ ____
|
|
|____digital_media____digital_culture____digital_media____digital_culture____|
|
|
|
|
INTRODUCTION
|
|
~~~~~~~~~~~~
|
|
Here it is... the long-awaited first file on cellular modification. Not
|
|
just some bullshit that tells you how to reprogram the NAM, but the down and
|
|
dirty ripping of the ESN. This is the first in what should (and I hope) will
|
|
be a neverending series of files from me on some of our happy cellular
|
|
manufacturers' fine (and not so fine) products.
|
|
|
|
In the interests of keeping health and happiness, this modification was
|
|
completely tested on ten test humans who said they had no problems, except for
|
|
a large growth located behind their left ears. Cellular phones causing cancer?
|
|
Yeah right, I think my toilet puts out more harmful (and the key word is
|
|
harmful) radiation then a fucking 0.5 watt handheld. And shit, even if they
|
|
do, I'll still use 'em.
|
|
|
|
This file deals with the general layout of the Mitsubishi 800, and also
|
|
includes the binary for a generic tumbling modification.
|
|
|
|
|
|
WHAT YOU'LL FIND INSIDE
|
|
~~~~~~~~~~~~~~~~~~~~~~~
|
|
The Mitsubishi has got to be one of the best phones out there to modify,
|
|
since it needs only the most smallest permanent modification, and NO soldering
|
|
on the PC boards themselves!
|
|
|
|
The ESN is located on what I have referred to as Board C in the first
|
|
diagram below. This chip was manufactured by CSI and is a 93C64K. One easy
|
|
way in which to modify this particular phone would be to replace it with a ZIFF
|
|
socket, and an EEPROM (or preferably a flash PROM) which would contain the new
|
|
ESN.
|
|
|
|
The software chip is located on the underside of Board A, and is a
|
|
standard 27C256 (32K) software EPROM. For the sake of compatibility, I have
|
|
included the binary source to the version I preformed this modification on
|
|
(and there are several other revisions out there!). To replace it, simply
|
|
choose an EEPROM that is faster than 25ns (I would recommend a 15), and if
|
|
you plan on tampering with the software at all, then get flash PROMS. Make
|
|
sure that the chip you program has the proper checksum, which is E1A5, and
|
|
for your own information, this is revision CB6.
|
|
|
|
The phone uses a Mitsubishi proprietary processor, the M50747, which was
|
|
discontinued this year and replaced by the M38000. This is a Motorola 68HC11
|
|
compatible chip, and does not have any special instructions AS FAR AS I KNOW.
|
|
If you are interested in modifying it, there are quite a few PD cross-
|
|
assemblers out there, although I have only seen a very few copyrighted
|
|
programs.
|
|
|
|
|
|
DISASSEMBLING THE PHONE
|
|
~~~~~~~~~~~~~~~~~~~~~~~
|
|
Unlike what most people would like you to believe, this is probably one of
|
|
the easiest modifications to do and requires very little soldering. The only
|
|
tools needed to remove the boards from the Mitsubishi 800 are a small flathead
|
|
screwdriver, a small Phillips, and a set of Allen wrenches. Here we go....
|
|
|
|
(1) Remove the handset and cradle/battery from the main phone component.
|
|
(2) Remove the three Allen head screws from the main body and then gently pry
|
|
the top off with the screwdriver.
|
|
(3) Remove the four Phillips screws from Board B (refer to diagram) and unplug
|
|
all of the exposed antenna relays, as well as all of the wire connections.
|
|
(4) Gently pry the board up with the screwdriver, making sure to keep the board
|
|
level (so as not to bend the pins connecting Board B to A).
|
|
(5) Remove the antenna lead from the metal casing surrounding Board D, and then
|
|
unscrew Board C.
|
|
(6) Remove the EPROM from the underside of Board A with the screwdriver. It is
|
|
installed in a tower and requires no soldering (how thoughtful of them).
|
|
|
|
That's it, the unit is as disassembled as we need.
|
|
|
|
|
|
THE BOARD LAYOUT
|
|
~~~~~~~~~~~~~~~~
|
|
Here is the top view of the phone's boards and screw locations. This
|
|
is 1/3 scale on a NEC 4D.
|
|
|
|
|
|
.----CONNECTED-----. BOARD C
|
|
| | ___
|
|
| BOARD A | | o| LEGEND
|
|
___ | _____________ | |###| ~~~~~~
|
|
/ O |___| | | # - Wire connect
|
|
| ### o o| |____| : - Drop Pins
|
|
| | o - Screw for Board
|
|
| (1) O| O - Case screw
|
|
| ___________| 1 - Processor
|
|
| |_ BOARD B
|
|
| :| ____________
|
|
| o :| <--CONNECTED-. |o |
|
|
| :| | |: o |
|
|
| :| `-> |: |
|
|
| | |: |
|
|
| _| |: o |
|
|
| #| | |
|
|
| #| <-----. | |
|
|
| o #|_ | | |
|
|
|____ | | | |
|
|
~| # O | | | |
|
|
.--> |_#___| | | |
|
|
| | | |
|
|
| CONNECTS | o o|
|
|
CONNECTS TO BOARD D | |
|
|
TO POWER (NOT SHOWN) |____________|
|
|
INPUT
|
|
|
|
|
|
General information on the Boards involved:
|
|
|
|
BOARD A - The main board controls all the other boards in the phone. All
|
|
antenna relays and power controls are present here. The software
|
|
EPROM is also on this board. Battery and NAM functions reside here.
|
|
|
|
BOARD B - Controls all receive functions, and also tone synthesis for reverse
|
|
channels. Tone crystal is located on board A. Antenna loops from
|
|
Board D.
|
|
|
|
BOARD C - This board only contains the ESN.
|
|
|
|
BOARD D - Controls all transmit functions, and also the D/A conversion process.
|
|
Antenna loops from Board A.
|
|
|
|
|
|
BOARD A REVERSE SIDE CLOSEUP
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
LEGEND
|
|
~~~~~~
|
|
@ - Inputs from Board B
|
|
s - Crystal for subaudible tones
|
|
c - Crystal for Touchtones
|
|
O - Case screw
|
|
o - Screw for Board ___________________
|
|
Z - Input for handset |O o ZZZZ|
|
|
Y - Handsfree/Horn hookup | BBB ZZZZ|
|
|
X - Power hookup | BBB YYY|
|
|
C - Software EPROM | YYY|
|
|
B - Battery |CCCCCCCCCC s YYY|
|
|
H - TDK heatsinks |>CCCCCCCCC s XXXX|
|
|
___________ |CCCCCCCCCC XXXX|
|
|
_________ ___|@@@@@@@@@@@|__| o XXXX|
|
|
|O |______| |
|
|
| |
|
|
| _|
|
|
| |
|
|
|____ ccc |
|
|
|_ o o |_
|
|
| |
|
|
| HHHHHHHHHHHHHHHH HHHHHHHHHHHHHHHH O|
|
|
|_HHHHHHHHHHHHHHHH_HHHHHHHHHHHHHHHH_____________/
|
|
|
|
|
|
BOARD C CLOSEUP
|
|
~~~~~~~~~~~~~~~
|
|
This is the board that we will be concerned with most in the modification,
|
|
since this is the primary piece modified. On the "facing down" diagram, the
|
|
'%' represents the ESN IC, which is identified above. The '.'s represent
|
|
solder spots. Now one thing that is interesting, W1 Y1 Y2 Y3 Y4 Y5
|
|
if you notice on the "facing up" side, there is a : : : : : :
|
|
':' between two of the solder spots. This is their : : : : : :
|
|
security fuse. Wow, real secure. The easiest way : : : : : :
|
|
to bypass this : : : : : :
|
|
(or any you might come FACING DOWN : : : : : :
|
|
across that are the ____________________ __################__
|
|
same layout), is to | . . . . . . | | ################ |
|
|
simply find out the | | | . . . . . . . . |
|
|
pinout assignments, | | | | | | | | | | | : |
|
|
and then connect the | %%%%%%% | | ` ` ` ` ` `.` `. |
|
|
appropriate pins into | %%%%%%% | | | | | | . |
|
|
your EPROM reader (or | | | | | | | |
|
|
use a logic probe that | . /~~\ | | /~~\ . |
|
|
will create an IBM | . . . . . \__/ | | \__/ . . . . . |
|
|
formatted disk which is|____________________| |____________________|
|
|
then read). I will FACING UP / CONNECTS TO A
|
|
hopefully have another mod for this same phone, using a very similar setup that
|
|
connects to the HP 95LX and uses it as a real-time psydo-PROM (one of the
|
|
advantages of my operating system for the HP).
|
|
|
|
|
|
REPROGRAMMING THE NAM
|
|
~~~~~~~~~~~~~~~~~~~~~
|
|
The Mitsu 800 is like all of the Mitsu family, and can be reprogrammed an
|
|
unlimited amount of times through the handset. Although this procedure has
|
|
been outlined elsewhere, I will go into a little more detail about what exactly
|
|
each option means.
|
|
|
|
To enter programming mode, power up the unit and hold the (STO)re button
|
|
down while entering '5474432'. Release (STO)re and it should display the
|
|
following information; remember, press SEND to move to the next option:
|
|
|
|
|
|
OPTIONS DISPLAY DESCRIPTION
|
|
---------------|-----------|---------------------------------------------
|
|
0/1 DUAL Dual number mark (0 = Single / 1 = Dual)
|
|
(xxx)xxx-xxxx NO1 10 Digit Mobile phone number
|
|
xxxxxx SID1 6 Digit Station ID Number (Odd [A] / Even [B])
|
|
0/1 LU1 Local use mark (Preregistration 0 = Disabled
|
|
1 = Enabled)
|
|
0/1 MIN MARK Min Mark
|
|
0333/0334 IPCH Paging Channel (0333 = A / 0334 = B)
|
|
00-15 ACCOLC Access Overload Class
|
|
0/1 PS1 Preferred System for First phone number
|
|
00-15 GI1 GIM Mark for First phone number
|
|
xxxx SECURITY Security code to lock/unload phone
|
|
0/1 EE Use DTMF (0 = External / 1 = Internal)
|
|
0/1 DT Discontinuous Transmission
|
|
0/1 HF Horn Alert (0 = On / 1 = Off)
|
|
0/1 INHIBIT Roam Inhibit (0 = Able to Roam / 1 = Unable)
|
|
0/1 C TONE Continuous DTMF Tones (0 = Enable / 1 = Disable)
|
|
0/1 SYS A/B System A or B selection (0 = A / 1 = B)
|
|
0/1 DUAL HS Dual Handsets (0 = Disabled / 1 = Enabled)
|
|
0/1 INHIBIT LD Inhibit Long Distance (0 = LD / 1 = No LD)
|
|
---------------|-----------|---------------------------------------------
|
|
|
|
To exit the programming mode and store the changes, press END. The phone
|
|
will then reset and display all of its information.
|
|
|
|
|
|
THE INFAMOUS 800 MOD
|
|
~~~~~~~~~~~~~~~~~~~~
|
|
This particular mod is unlike most, since the EPROM is a 27C256 and has
|
|
little remaining room in it. Also, Mitsubishi scattered their software
|
|
throughout the PROM as well, making it even more difficult.
|
|
|
|
The software for this mod is located in the following hex locations:
|
|
|
|
7236H to 7490H
|
|
7500H to 7CF1H
|
|
7D65H to 7EFFH
|
|
|
|
There are also pointer reassignments at the following hex locations:
|
|
|
|
0D0DH 130DH 185AH 285FH 2CCDH 4C4FH 4E37H
|
|
6B2CH
|
|
|
|
Now on to the actual workings of the modification. Installation is
|
|
simple, just replace the existing software EPROM with the new modified one and
|
|
then close the phone back up. Make sure to reconnect ALL of the antenna
|
|
leads, since if you do not, you will have problems.
|
|
|
|
This particular mod is just the basic roamers scam, which means the phone
|
|
is registered to the local systems (usually the B side) as an out-of-state
|
|
cellular. Then, due to the roamers' agreement most of the carriers adhere
|
|
to, it allows you to make overseas, long distance, local, 950, and 800
|
|
(pretty much the whole 9 yards) calls without validation. Now, validation
|
|
is processed once the call is initiated, but they will not normally disconnect
|
|
you when it is discovered. If you get a message which states "Welcome to
|
|
Cellular One," or "Cellular service to this phone has been temporarily
|
|
disconnected," or "Sorry, this number is not registered," then simply attempt a
|
|
new number set. If you happen to live in an area that is not "roam-able" (such
|
|
as CA, TX, or IL), then you will more than likely only be allowed to make
|
|
local, 950, and 800 calls. If you happen to get to a connection country
|
|
(Mexico or Canada), you will be allowed to make country-wide calls, 800, and
|
|
connecting state calls (i.e. In Canada to Montana, or Mexico to Texas). Here's
|
|
how to activate the mod.
|
|
|
|
Power up the phone, and then enter the NAM programming mode, then proceed
|
|
to press [SEND] until you reach the phone number location. Enter an OUT OF
|
|
STATE phone number, and then valid cellular prefix. The last four digits are
|
|
not important, and may remain fixed. Next, progress to the ACCOLC (Access Over
|
|
load Class), which is the first part of the tumbled ESN (described later). Set
|
|
this field to 00, and then add 1 to it every time the phone gets deactivated.
|
|
When you reach 15, set it back to 00 and change the security. The last portion
|
|
of this mod which needs to be changed is the SECURITY, which should be set to a
|
|
number ending with either an 8, 9, or a 0.
|
|
|
|
Here is the ratio of changes:
|
|
|
|
First to change:
|
|
|
|
ACCESS 6 beeps Change up to 15 times to avoid "service suspended"
|
|
message with 01 through 15 (change 100% of the
|
|
time).
|
|
|
|
Second to change:
|
|
|
|
SECURITY 9 beeps Change after no ACCESS changes work, to avoid
|
|
"welcome to", "sorry unregistered" etc messages
|
|
with any 4 digits with 3,5,8,9 or 0 at the end
|
|
(change about 60% of the time).
|
|
|
|
Third to change:
|
|
|
|
NUMBER 1 beep Change after no SECURITY changes work with one of
|
|
the above valid area code and prefix numbers with
|
|
any last 4 digits (change about 30% of the time).
|
|
|
|
Last to change:
|
|
|
|
AREA CODE/PREFIX Change after no NUMBER changes work (change about
|
|
10% of the time).
|
|
|
|
I would recommend the following settings for use with either the A or the
|
|
B systems:
|
|
|
|
DISPLAY A SETTINGS B SETTINGS
|
|
-----------|------------------|---------------------------
|
|
DUAL 0 0
|
|
no1 Use list for A Use list for B
|
|
Sid1 00027/00019 00002/00034
|
|
LU1 1 1
|
|
E1 1 1
|
|
IPCH1 0333 0334
|
|
ACCoLC1 00-15 00-15
|
|
PS1 1 0
|
|
G11 10 10 or 12
|
|
SECURITY 0008-9999 0008-9999 (end with 8 or 9)
|
|
EE 1 1
|
|
dt 0 0
|
|
HF 1 1
|
|
InHIbIt 0 0
|
|
C tone 1 1
|
|
SyS Ab 1 1
|
|
dUAL HS 0 0
|
|
InHIbIt Ld 0 0
|
|
-----------|------------------|---------------------------
|
|
|
|
|
|
WHAT THE CELLSITE SEES
|
|
~~~~~~~~~~~~~~~~~~~~~~
|
|
This will give you an idea of what exactly you are doing when you change
|
|
any of the information in the NAM programming area. Using this table, it would
|
|
even be feasible to use this phone, like a clone, by simply entering in the ESN
|
|
in the tables method, and then entering the corresponding phone number. The
|
|
full 8 digit hexadecimal ESN is controlled solely by the ACCOLC and SECURITY in
|
|
the program. No other data revealed on the DDI is transmitted.
|
|
|
|
SECURITY IS SET ON 1238 AND REMAINS UNCHANGED (positions 4,5,8 & 1).
|
|
|
|
ESN ACCOLC NOTES
|
|
~~~ ~~~~~~ ~~~~~
|
|
1 23 45 67 8 xx 1-8 ESN Digit Positions
|
|
- -- -- -- - --
|
|
8 1F 12 00 3 00 As ACCOLC is changed note pos 6&7 and
|
|
8 20 12 01 3 01 2&3 change as pos 1,4,5,8 remain the
|
|
8 21 12 02 3 02 same.
|
|
8 22 12 03 3 03
|
|
8 23 12 04 3 04
|
|
8 24 12 05 3 05
|
|
8 25 12 06 3 06
|
|
8 26 12 07 3 07
|
|
8 27 12 08 3 08
|
|
8 28 12 09 3 09
|
|
8 29 12 0A 3 10
|
|
8 2A 12 0B 3 11
|
|
8 2B 12 0C 3 12
|
|
8 2C 12 0D 3 13
|
|
8 2D 12 0E 3 14
|
|
8 2E 12 0F 3 15
|
|
|
|
Note that while security only affects positions 4,5,8 and 1 respectively,
|
|
the changing of the ACCOLC 00-15 changes not only its positions 6 and 7 into
|
|
its hexadecimal equivalents, but also steps in sequence positions 2 and 3
|
|
through 1F-2E to correspond to 00-15.
|
|
|
|
ESN DIGIT POSITIONS:
|
|
|
|
MFR: 1 DIGIT 4 OF SECURITY CAN ONLY BE NUMBERS 8,9 OR 0.
|
|
2 CHANGED BY ACCOLC POSITIONS 2&3 TOGETHER 1F-2E
|
|
SN: 3 CHANGED BY ACCOLC POSITIONS 2&3 TOGETHER 1F-2E
|
|
4 DIGIT 1 OF SECURITY CAN BE ANY NUMBER
|
|
5 DIGIT 2 OF SECURITY CAN BE ANY NUMBER
|
|
6 DIGIT 1 OF ACCOLC POSITIONS 6&7 ACCEPT ONLY 00-15
|
|
7 DIGIT 2 OF ACCOLC POSITIONS 6&7 ACCEPT ONLY 00-15
|
|
8 DIGIT 3 OF SECURITY CAN BE ANY NUMBER
|
|
|
|
Security with the following last digit gives the following responses due
|
|
to the fact that the first 2 digits are the manufacturer's code and a non-valid
|
|
mfr code yields an improper registration.
|
|
|
|
1,2,3,4,5,6,7 "SORRY NOT PROPERLY REGISTERED FOR SERVICE"
|
|
0,8,9 "CONNECTION ALLOWED"
|
|
|
|
The following DDI reverse channel log is with the phone number set to
|
|
(617) 571-4590, and Access Overload set to 01, and the Security set to 7418:
|
|
|
|
----- Mobile Request ------
|
|
SAT=2
|
|
Continuous, 25 Mhz BW
|
|
571-4590 (617) Page
|
|
MFR: 82 SN: 074011 (2181513233)
|
|
130 475153
|
|
Dialing: 80055512
|
|
Dialing: 12
|
|
|
|
This should give you a good idea of how the phone could easily be used in
|
|
a clone-type method, although it would have significant limits.
|
|
|
|
|
|
MIT800.EXE: THE PROGRAM
|
|
~~~~~~~~~~~~~~~~~~~~~~~
|
|
The executable included along with this will allow you to enter an ESN,
|
|
and then test it for validity in the mod. If it is valid, it will show you the
|
|
proper settings to make the phone. To use this, simply select option '1' and
|
|
then enter the HEX ESN, like 82A92128 (8 chars long), and press return. The
|
|
program will process the data, and output the appropriate response.
|
|
|
|
Although this version does not support the DDI scan utility, what it will
|
|
allow you to do is enter a DDI log file, and then the program will search
|
|
through all the reverse channel data and redirect all valid NAM/ESN pairs to a
|
|
designated file. This is especially convenient due to the limits set upon the
|
|
ESN generation.
|
|
|
|
If anyone out there is using something other than the DDI box to receive
|
|
reverse channel, contact me and I'll make an import filter for that system's
|
|
capture file structure as well.
|
|
|
|
|
|
PHONE SPECIFICATIONS
|
|
~~~~~~~~~~~~~~~~~~~~
|
|
For those who are interested in making more modifications for this very
|
|
versatile phone, here are the TR/RX and power specs:
|
|
|
|
Frequency Channel 824.040 - 848.970 Transmitter
|
|
869.040 - 893.970 Receiver
|
|
Number of Channels 832
|
|
Spacing 30 kHz
|
|
|
|
Power Supply 13.7 VDC +/- 20%
|
|
|
|
Standby Drain 90 mA Approx.
|
|
Transmit Mode at Max 1350 mA Approx.
|
|
|
|
Battery Capacity Standby Transmit Transmit
|
|
1400 mAh Max RF Min RF
|
|
15 Hours 55 Minutes 90 Minutes
|
|
Charge Time 5 Hours
|
|
Battery Operating Temp 0 to +40 C
|
|
Storage Temp -30 to +70 C
|
|
|
|
Power Output 3 Watt @ BNC Connector
|
|
50 ohm impedance
|
|
Power Control 8 levels 4 db Apart
|
|
|
|
WATTS
|
|
LEVEL 0 1 2 3 4 5 6 7
|
|
[High] 4.7 1.9 .760 .300 .120 .048 .019 .008
|
|
[Norm] 3.0 1.2 .480 .190 .076 .030 .012 .005
|
|
[Low] 1.2 .480 .190 .076 .030 .012 .005 .003
|
|
|
|
dBm
|
|
LEVEL 0 1 2 3 4 5 6 7
|
|
[High] 36.8 32.8 28.8 24.8 20.8 16.8 12.8 8.8
|
|
[Norm] 34.8 30.8 26.8 22.8 18.8 14.8 10.8 6.8
|
|
[Low] 30.8 26.8 22.8 18.8 14.8 10.8 6.8 2.8
|
|
|
|
Spurious Output -48 dBc
|
|
|
|
Adjacent Channel Power -25 dB
|
|
Frequency Stability +/- 2.5 PPM
|
|
Audio Distortion -26 dB (5%)
|
|
FM Hum & Noise -32 dB
|
|
Voice Modulation 300 - 3000 Hz
|
|
Compressor 2:1 CCITT
|
|
Pre-Emphasis +6 dB per Octave
|
|
Deviation Voice +/- 10.8 kHz +/- 10%
|
|
|
|
Ch. Switching Time 20 ms adjacent channel
|
|
40 ms non-adjacent channel
|
|
Data encoding 10 kb/s Manchester
|
|
SAT Transponding 5970, 6000, 6030 Hz +/- 1 Hz
|
|
Phase Error +/- 20 Degrees Maximum
|
|
Setting Time 250 ms
|
|
Measuring Time 250 ms
|
|
DTMF Encoder 95 +/- 5ms Tone, Fixed
|
|
Interdigit Time 65 +/- 5ms Minimum
|
|
Voice Suppressed during DTMF
|
|
|
|
|
|
PIN ASSIGNMENTS FOR HANDSET
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
Here are the pin assignments for the handset, so you can build your own
|
|
RJ-11 interface and skip paying the money-loving cellular companies for one.
|
|
They are fairly straightforward and if you were successful modifying the
|
|
phone, then this should pose little difficulty.
|
|
|
|
NAME PIN IN/OUT SIGNAL TYPE DESCRIPTION
|
|
------------|---|---------|-------------|------------------------------
|
|
RX Audio + 1 OUT AF Balanced 10K ohms
|
|
RX Audio - 2 OUT AF Balanced 10K ohms
|
|
TX Audio 3 IN AF Unbalanced 10K ohms
|
|
Ground 4 N/A N/A N/A
|
|
HS-Outdata 5 OUT LOGIC Serial output data to handset
|
|
HS-Indata 6 IN LOGIC Serial input data from handset
|
|
HS-Power 7 N/A N/A 13.7VDC Handset power
|
|
HS-Off Sns 8 IN N/A ON/OFF Sensitivity
|
|
------------|---|---------|-------------|------------------------------
|
|
|
|
I would say that the easiest way in which to figure this out is to connect
|
|
power to pin 7, then splice into 3, and merge 1/2 to a second line out. Then
|
|
take a logic probe and connect leads to 5 and 6, and monitor the interaction
|
|
between the unit and handset since this is where the [SEND] and [END] will be
|
|
transmitted. Then it would be feasible to make an interface for the serial
|
|
port (the second port) to trigger the send and end, and interface this with a
|
|
war dialer, etc. Convenient for those unobtrusive scans.
|
|
|
|
|
|
OTHER MODIFICATION SOLUTIONS
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
One other option for all those out there who may or may not want to modify
|
|
the operating software of the phone is Spy Supplies cellular mod software.
|
|
They sell a package that lets you modify the MIN and ESN of about 75% of the
|
|
phones that are out (like all the Motorolas, etc). One nice thing about this
|
|
is that it actually changes what the phone's ESN is, unlike a software mod, in
|
|
which it simply redirects the phone to look elsewhere.
|
|
|
|
The package sells for around $500, and if you mention that I sent you
|
|
he'll knock $50 off of that. This is DEFINITELY a nice choice for those who do
|
|
not wish to invest the time and money into modifying the particular software,
|
|
and this is an easy option to cloning. Of course, he only sells it so you can
|
|
reprogram one of your other phones to share the same pair, thus eliminating the
|
|
second bill and just combining the two... and of course that's all we intend to
|
|
do with it, right? He doesn't accept credit cards, so don't even think about
|
|
it... and at that price, it's well worth it and will pay for itself in less
|
|
than a month if used wisely.
|
|
|
|
The software is fairly simple and menu driven, altogether total around
|
|
400k. The package then includes diagrams (I believe he might actually have
|
|
pre-made cables available now) to build the interface cables. Then all the
|
|
user does is plug the phone in, run the program, enter the data, and wham!
|
|
You're cloned.
|
|
|
|
Spy Supply can be reached at 617-327-7272, 9am-5pm (ET) Monday through
|
|
Friday. The book he sells is also interesting, although most of the infor-
|
|
mation contained within it is already available in other files.
|
|
|
|
|
|
CONCLUSION
|
|
~~~~~~~~~~
|
|
Be watching for my own 'CONSUMER REPORTS' file which will let you in on
|
|
just how good the name brands stack up in modification, which are pitifully
|
|
easy to modify, and which can hold up through the test of time. Remember, I
|
|
do not take any paid advertising, and am completely unbiased.
|
|
|
|
One shocking bit of news... I finally have an Internet address and FTP
|
|
site! Can you imagine that? And just who was crazy enough to give me one...
|
|
none other than those wacky guys at cDc. Just reach me at
|
|
videov@zero.cypher.com, or in the "vindicator" ftp directory.
|
|
|
|
If you have any questions or comments concerning this file, then you can
|
|
(as always, and yet never) leave them to me on the systems below. If you
|
|
fucked up your phone while doing this, then you're about the most pitiful thing
|
|
in the world, since you don't have to do anything PERMANENT to the phone! As
|
|
always, I would like to extend greetings out to my faithful criminals:
|
|
|
|
DYNASTAR EREKOSE DIGITAL HITLER
|
|
DRUNKFUX BOOTLEGGER SWAMP RATTE'
|
|
CAPT ZAP FUNKY MONKEY BRUJJO
|
|
KLUDGE GATSBY MAXIMUM OVERDRIVE
|
|
|
|
Blah blah blah... be watching for the return of Scantronics. Yeah,
|
|
that's right, Kludge and the boys are back, and still running on a '286 (just
|
|
goes to show you, hacking doesn't pay, but fraud does). I would also like to
|
|
thank the demon lord Satan, without whom life would not be possible, and not
|
|
worth living; may the living and the dead hold his name forever in torment.
|
|
And always remember....
|
|
|
|
The Surgeon General warns that using cellulars may cause cancer; yeah,
|
|
right, along with sex, drugs, and about 5,000,000,000 other fun things.
|
|
=============================================================================
|
|
Scantronics [ ... it's coming, it's coming ... ] 96 619-???-????
|
|
Demon Roach [NUP required - cDc HQ - 'nuff said ] 24 806-794-4362
|
|
Phunline [Extensive satellite/virus sections ] 96 916-481-2306
|
|
The Stash [My European connection... lots of files ] 96 46-498-222113
|
|
Reverse Channel [Drunkfux's board - cDc - dFx - HoHo ] 96 713-468-5802
|
|
=============================================================================
|
|
This concludes another wonderful file by Video Vindicator (C)opyright 1993
|
|
_______ __________________________________________________________________
|
|
/ _ _ \|Demon Roach Undrgrnd.806/794-4362|Kingdom of Shit.....806/794-1842|
|
|
((___)) |Cool Beans!..........510/THE-COOL|Polka AE {PW:KILL}..806/794-4362|
|
|
[ x x ] |Metalland Southwest..713/468-5802|Lunatic Labs........213/655-0691|
|
|
\ / |The Works............617/861-8976|Ripco ][............312/528-5020|
|
|
(' ') |ftp - zero.cypher.com in pub/cdc |ftp - ftp.eff.org in pub/cud/cdc|
|
|
(U) |==================================================================|
|
|
.ooM |1993 cDc communications by Video Vindicator 12/30/93-#241|
|
|
\_______/| Save yourself! Go outside! DO SOMETHING! |
|
|
|