617 lines
34 KiB
Plaintext
617 lines
34 KiB
Plaintext
THE HIGH TECH HOODS
|
|
& A-CORP PRESENTS...
|
|
|
|
*%*%*%*%*%*%*%*%*%*%*%*%*%*%*
|
|
*% THE ULTIMATE %*
|
|
*% CELLULAR PHONE PHREAKS %*
|
|
*% MANUAL PART 2 %*
|
|
*% %*
|
|
*% WRITTEN BY THE RAVEN %*
|
|
*% AND INTROSPECT %*
|
|
*%*%*%*%*%*%*%*%*%*%*%*%*%*%*
|
|
|
|
|
|
|
|
|
|
THE RAVEN
|
|
+=======+
|
|
THANKS TO THE FOLLOWING: PEBBLES, BIT STREAM & THOMAS ICOM
|
|
/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\//\/\/\/\/\/\/\/\/\/\/\/\
|
|
|
|
INDEX:
|
|
|
|
I. WHAT'S IN A NAM
|
|
II. NAM/ESN REPROGRAMMING
|
|
III. ADVANCED REPROGRAMMING
|
|
IV. OBTAINING SYS. REGISTRATION DATA
|
|
V. REPROGRAMMING YOUR PHONE
|
|
VI. ------------------------
|
|
|
|
\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
|
|
|
|
I. What's In A NAM
|
|
|
|
First thing were going to start with is the NAM. The NAM is a PROM, A blank
|
|
NAM costs about $5. Sometimes its more expensive depending on the operating
|
|
temperature and packaging specifications.
|
|
Two flavors of NAM's are most commonly used for cellular phones. NEC Corp.
|
|
uses the open collector (SIGNETICS p/n 82S23 or equivalent). All others use
|
|
the tri-state (SIGNETICS 82S123 or equivalent). Blank NAMs are manufactured by
|
|
Signetics, National Semiconductor, Monolithic Memorys, Fujitsu, Texas Instrum
|
|
ents, and Advanced Microdevices. Blank NAMs can be purchased at your local
|
|
electronic distributor's, thru the various parts sources advertised in
|
|
electronic magazines, and some radios come with a blank included.
|
|
The NAM contains the subscriber number and lock code, the home system ID and
|
|
other system-required data. You may wonder how this info is arranged. The NAM
|
|
is organized into 32 rows and 8 colums. It is 32 words of 8 bits each.
|
|
(256 bits total). Starting from top of the NAM (address 00), you will find
|
|
the abreviation SIDH. This means "System Identifaction Number Home", a number
|
|
starting at 0001 assigned by the FCC. Each market allows two systems. These
|
|
two digits are even for the wire-line and odd for the non-wireline.
|
|
At address 03, we find LU (Local Use) on the left and MIN on the right, and
|
|
they are usually set to 1. Locations with zeros are reserved. Going down the
|
|
map, there's MIN1 and MIN2-the subscriber number and the area code respectively
|
|
Dont try to read them from a raw printout of the NAM data, as they are
|
|
scrambled beyond recognition. The reason? THe way they are arranged is the way
|
|
they must be transmitted to the cellular systems receivers. The programmer
|
|
does this to make the radio's job easier.
|
|
Next is the station class mark, which identifies the class and power
|
|
capability of the phone. The system will treat a handheld (low power)
|
|
differently than a standard 3-watt mobile.
|
|
|
|
IPCH is the Inital Paging Channel. The radio listens for a page on this
|
|
channel. Wirelines use 334 and non-wirelines use 333.
|
|
|
|
ACCOLC (ACCess Overload Class) is designed for throwing off customers in the
|
|
event of an overload. Thru neglect, this standard has been largly unused.
|
|
(A Class 15 stationis supposed to be police, fire or military). Usually, It's
|
|
a set to 0 plus the last digit of the phone number to provide random loading.
|
|
|
|
PS (Preferred System). This is always 1 in a non-wireline and 0 in wireline.
|
|
|
|
The Lock Code is about the only thing you can read directly by studying NAM
|
|
data. The "spare" bit must be a 0 if the radio contains a 3-digit code.
|
|
Because the number of clicks when you dial 0 on a (dial) phone equals 10,
|
|
zeros in the lock code are represented by an "A"(the hexadecimal equiv of 10).
|
|
|
|
EE, REP, HA and HF correspond to end-to-end signaling (DTMF tones, possibly
|
|
as you talk), and REPeratory dialing (provision for 10 or more numbers in
|
|
memory).
|
|
|
|
Horn Alert and Hands Free. Like all options, they are 1 if turned on and 0 if
|
|
turned off (all these numbers are in hex). They are supposed to be used by
|
|
radio makers to store option switches. Usually 13 is used, 14 sometimes and
|
|
the rest less often.
|
|
|
|
Last, you will find Cheksum Adjustment and Checksum. These numbers are
|
|
calculated automatically after the data has been edited for the NAM. The sum
|
|
of all words in the NAM plus these last two must equal a number with 0's in
|
|
the last two digits. The radio checks this sum and if it isn't correct the
|
|
radio assumes the NAM is bad or tampered with. In the case radio refuses to
|
|
operate until a legal NAM is installed.
|
|
|
|
THE ANATOMY OF A NAM
|
|
--------------------
|
|
|
|
MARK Defin. most <-- BIT Significance --> least Hex
|
|
------------------------------------------------------
|
|
0 SIDH (14-8) 00
|
|
SIDH (7-0) 01
|
|
LU=Local use LU 000000 MIN 02
|
|
00 MIN2 (33-28) 03
|
|
MIN2 (27-24) 0000 04
|
|
0000 MIN1 (23-20) 05
|
|
MIN1 (19-12) 06
|
|
MIN1 (11-4) 07
|
|
MIN1 (3-0) 0000 08
|
|
0000 SCM (3-0) 09
|
|
00000 IPCH (10-8) 0A
|
|
IPCH (7-0) 0B
|
|
0000 ACCOLC (3-0) 0C
|
|
PS=Perf Syst 0000000 PS 0D
|
|
0000 GIM (3-0) 0E
|
|
LOCK DIGIT 1 LOCK DIGIT 2 0F
|
|
LOCK DIGIT 3 LOCK SPARE BITS 10
|
|
EE=End/End EE 000000 REP 11
|
|
REP=Reprity HA 000000 HF 12
|
|
HF=Handsfree Spare Locations (13-1D) 13
|
|
HA=Horn Alt contain all 0's 1D
|
|
|
|
NAM CHECKSUM ADJUST. 1E
|
|
NAM CHECKSUM 1F
|
|
|
|
II. NAM/ESN REPROGRAMMING
|
|
|
|
The first step to using cellular phones is to obtain one. They can be
|
|
purchased new or used. Ham fests are one good source. Many people dump their
|
|
cellular phones once they see just how expensive they are to operate. And of
|
|
course the perception of being jerked promotes phreaking.
|
|
First generation E.F. Johnson units are good choice as they are easy to
|
|
modify, use uniquely effective diveristy (dual antenna) receivers, and use the
|
|
AMPS control bus, which means that several maker's control heads will work
|
|
with it. Another good choice is Novatel's Aurora/150. It uses a proprietary
|
|
parallel bus and control head, but costs less, is rugged, and is also easy to
|
|
work on. Also, all Novatel CMTs have built-in diagnostics. This allows you to
|
|
manually scan all 666 repeater output freqs-great for scanning!
|
|
All cellular phones have a unique ESN. This is a 4-byte hex or 11 digit
|
|
octal number stored in the ROM soldered on the logic board. Ideally, it's
|
|
supposed to be never changed. Some newer cellulars embed the ESN in a
|
|
VLSI IC (Very Large Scale Integration Integrated Circuit) along with the units
|
|
program code. This makes ESN mods very difficult at best. The ESN is also
|
|
imprinted on the reciever boiler plate, usually mounted on the outside of the
|
|
housing. When converted to octal (11 digits), the first 3 digits represents
|
|
the maker while the other 8 identify the unit.
|
|
The other important ROM is the NAM. It contains the MIN (i.e. phone #,
|
|
including area code), the lock code, and various model ID and carrier ID
|
|
codes.
|
|
The lock code keeps unauthorized parties from using the phone. Some newer
|
|
cellulars have no built in NAM and instead use an EEPROM, which allows a
|
|
technician who knows the maintenance code to quickly change the NAM data thru
|
|
the control head keypad.
|
|
WHen one attempts to make a cellular call, the transceiver first automatically
|
|
transmits the ESN and NAM data to the nearest cellsite reapeter by means of
|
|
the Overhead Data Stream (ODS). The ODS is a 10 kilobaud data channel that
|
|
links the cellular's computer to the MTSO, which then controls the phone's
|
|
entire operation down to the selected channel and output power. If the MTSO
|
|
doesn't recognize the received ESN/MIN pair as valid (sometimes due to RF
|
|
noise), it issues a repeat order and will not process the call unit until a
|
|
valid pair is received.
|
|
In most cities, there are two CPCs or "carries". One is the wireline CPC and
|
|
the other is the non-wireline CPC. Both maintain their own MTSO and network
|
|
(i.e: cell-site repeaters), and occupy separate halves of the cellular radio
|
|
band. Non-wirelines use System A, and wirelines use System B. (the amenities
|
|
that are avaible with most landline phone service - call waiting, caller ID,
|
|
call-forwarding, 3-way calling,etc., are standard fair for most CPCs. However,
|
|
they are usually applied for differently.)
|
|
For the cellular phreaker, the most diffuclt task is obtaining usable ESN/MIN
|
|
pairs. Over the years,standard phreaker techniques have been employed for all
|
|
types of phreaking to obtain the required info. These includes trashing,
|
|
using inside help,joining the staff,hacking them from known good ESNs and
|
|
MINs (i.e: spoofing), con strategis, strong-arming, Bribing, blackmail, etc.
|
|
(This is how The High Tech Hoods get them!).
|
|
The hacker knows that most CPCs do not turn off or keep track of unused MIN
|
|
numbers. In fact, their general pattern is to start at the low numbers and
|
|
work their way up. WHen a number is cancelled, it is reassigned instead of
|
|
using a larger number.
|
|
The first places to look is the authorized cellular installers and service
|
|
centers in your area (see your Yellow Pages). They have on file a record of
|
|
every cellular phone installed or serviced by them, including the ESN/MIN
|
|
pairs. Another place to focus on is the cellular CPC's customer service or
|
|
billing department. These offices contain the ESN/MIN pairs often for
|
|
thousands of cellular phones, and hire low-paid people. Some cellular CPCs,
|
|
installers and service centers will provide NAM system parameters upon
|
|
request, and some will sell you NAM and ESN memory maps and schematics of a
|
|
specific cellular phone model. And some will sell you service manuals
|
|
(i.e: Motorola) that will describe the often easy method to program their
|
|
cellular phones.
|
|
The good phreak/hacker could interface the cellular phone's ADC circuit to
|
|
his PC and hack out all of the valid ESN/MIN pairs he could possibly need.
|
|
Since the ESN/MIN pair are transmitted from cellular phones (usually in an
|
|
unencrypted form), these pairs can be obtained simply by scanning the cellular
|
|
phone channels. Even if they are encrypted, the phreaker only will need to
|
|
reproduce the encrypted pair. In some areas, you can buy the ROMs right off
|
|
the street - often by the same dealers who sell drugs and stolen property,
|
|
etc. All it takes is a few discreet inquires. However, many get caught
|
|
doing this because of police stings.
|
|
Once a valid ESN/MIN is obtained, it must be programed into the cellular
|
|
phone's ROM. Some cellular makers use different devices and memory maps, but
|
|
the standard is the AMPS 16-pin 32x8 bit format and some ROMs have proprietary
|
|
markings.
|
|
If the part number are different than those given and you can't find them in
|
|
your data book, look for the IC maker's logo and call or write them for data
|
|
sheets. If the IC's have proprietary markings, by looking at the external
|
|
parts that are directly wired to them, one can often determine not only
|
|
whether the IC is open-collector or tri-state, but also what the pin assingn-
|
|
ments are, and sometimes the type of replacement IC to use.
|
|
The ESN ROM is then carefully desoldered from the logic board (first ground
|
|
the soldering tip thru a 1 Meg-ohm resistor). Once, removed the IC can then be
|
|
placed on a ROM reader/programmer or NAM programmer (bit editing mode). Any
|
|
ROM reader/programmer that will burn a compatible ROM is usable, but a
|
|
dedicated NAM programmer has built-in software that takes out much of the
|
|
aggravation. Using a non-NAM ROM reader/programmer, one searches for the memory
|
|
locations that has the same number as ESN printed on the boiler plate. This
|
|
number will be immediatly followed by an 8-bit checksum determined by the 8
|
|
least significant bits of the hex sum of the ESNs four bytes.
|
|
The old ESN data (now copied into the NAM programmer's RAM) is replaced by the
|
|
new ESN and the updated checksum. A new blank and compatible ROM is inserted
|
|
into the ROM burner and burned with the new ESN data. Most cellular phreakers
|
|
at this point install a Zero Insertion Force (ZIF) DIP socket into the logic
|
|
board for this and any future ROM changes.
|
|
The NAM IC is usually already installed in a ZIF socket on the logic board.
|
|
Similarly, its MIN is read by the ROM reader/programmer and a new ROM is
|
|
burned with the new MIN and updated MIN checksum. Altho one may wish to also
|
|
update the CPC's system parameters, they can left the same if the same CPC
|
|
is desired. To change the CPC'c designation, the last four MIN digits, the
|
|
checksum and the exchange (if they use more than one exchange) are changed.
|
|
The more astute cellular phreaker of course can design and build his own NAM
|
|
programmer/reader, ideally one interfaced to a PC. A more primitive approach
|
|
is to interface two banks of hex thumbwheel switches to the sockets, altho
|
|
a computer program would be very helpful to determine the proper switch
|
|
settings. Thumbwheel switches allow you to make changes on the fly and they
|
|
can be plugged in as needed, so if one is caught red-handed, it is difficult
|
|
to prove intent and origin of phone call.
|
|
|
|
III. ADVANCED REPROGRAMMING
|
|
|
|
Your cellular phone contains a special memory which retains data about the
|
|
phone's individual characteristics, such as its assigned phone number, system
|
|
identification number, (ID#) and other data that is necessary for cellular
|
|
operation. This special memory is known as the NAM. You can program the phone
|
|
yourself, if the phone has not already been programmed where you got it. You
|
|
can also reprogram the phone yourself should you wish to change some of the
|
|
features already selected for the NAM.
|
|
The reprogramming of the NAM is performed after you have contacted your
|
|
cellular system operator for the nessary data as described below. Enter the
|
|
data received from your cellular system operator in the NAM Reprogramming
|
|
Data Table before reprogramming the NAM of your cellular phone. Incorrect
|
|
NAM entries can cause your cellular phone to operate improperaly or not at
|
|
all. Your cellular phone can be reprogrammed up to three times. After that,
|
|
it must be reset at a Motorola-authorized service facility.
|
|
Be sure you read this complete text before attempting to reprogram your
|
|
phone!
|
|
|
|
1. RE-PROGRAMMING FEATURES
|
|
|
|
You must get seven pieces of data from the cellular system operator to
|
|
allow you to reprogram the cellular phone. You provide the remaining data.
|
|
Write all of this programming data on the NAM Reprogramming Data Table
|
|
provided in this text before implementing this procedure. Incorrect NAM
|
|
entries can cause your cellular phone to operate improperly or not at all.
|
|
The required data is:
|
|
* System Identification (SID) Code (S-digits): Indicates youe home system
|
|
Enter 0's into the left-most unsued positions. Provided by the system
|
|
operator.
|
|
|
|
* Cellular Phone Number (10 digits): Used in the same manner as a standard
|
|
land-line phone. The mobile phone number and the Electric Serial Number
|
|
are checked against each other by the cellular system each time a call
|
|
is placed or recieved. Provided to you by the system operator.
|
|
|
|
* Station Class Code (2 digits): This number is 06 or 14 for most personal
|
|
or portable phones. Even though your phone has extended bandwith
|
|
capability (832 channel capacity), the cellular system operator may
|
|
require your station class code to remain 06. The code should be 14 if
|
|
832 channel operation is allowed.
|
|
|
|
* Access Overload Class (2 digits): Provided to you by the system operator.
|
|
|
|
* Group ID Mark (2 digits): Provided to you by the system operator.
|
|
|
|
* Security Code (6 digits): The six-digit security code allows the user to
|
|
restrict his calls in certain ways and permits other advanced security
|
|
measures. Refer to your phones operator manual for further details.
|
|
Select any 6-digit code that you will remember, but one that will not be
|
|
easily guessed.
|
|
|
|
* Unlock Code (3-digits): The 3-digit unlock code unlocks the phone after
|
|
it has been locked. LOcking the phone allows you to prevent unauthorized
|
|
usage. With many models, this number can be resued as often as desired.
|
|
Check the users manual. Select any convenient 3-digit number.
|
|
|
|
* Initial Paging Channel (4 digits): Use a leading 0 if required.
|
|
(example: Channel 334 is entered as 0334.) Provided to you by the
|
|
system operator.
|
|
|
|
* Option Bits (6 digits): This reprogramming step allows you to program
|
|
six seperate features in one step. Each feature is either selected or
|
|
cancelled by assigning a value of 1 or 0. The six individual single-
|
|
digit features combine to form a six-digit code which is entered as one
|
|
step. If any of the features is to be changed , the entire six-bit word
|
|
must be re-entered.
|
|
|
|
DIGIT #1: Internal Speaker: This feature is normally selected by
|
|
entering 0. However, if you purchased the convertible
|
|
Accessory and it contains a seperate external/VSP unit,
|
|
cancel the internal speaker feature by reprogramming 1.
|
|
|
|
DIGIT #2: Local Use: This feature is normally selected by entering 1.
|
|
Your system operator can tell you if you need to cancel
|
|
this feature by reprogramming 0.
|
|
|
|
DIGIT #3: MIN Mark: This feature is normally not used and is assigned
|
|
a value of 0. To select use 1.
|
|
|
|
DIGIT #4: Auto Recall: This feature is always 1.
|
|
|
|
DIGIT #5: 2nd Phone Number: This feature is usually not used and
|
|
assigned a value of 0.
|
|
|
|
DIGIT #6: Diversity: This feature is always set at 0 for the portable/
|
|
personal phone used alone. If you have a convertible
|
|
accessory, and it has two external antennas, select this
|
|
feature by reprogramming 1.
|
|
|
|
* Option Bits (3 digits): This step allows you to reprogram an additional
|
|
three separate features in one step. Each feature is either selected or
|
|
cancelled with the digit 1 or 0. The three individual single-digit
|
|
features combine to form a three-digit code which is entered as one
|
|
step. If any of the features is to be changed the entire three-bit word
|
|
must be reentered.
|
|
|
|
DIGIT #1: Long Tone DTMF: Certian electronic devices such as answering
|
|
machines, are are not able to decode the normal DTMF tones
|
|
because the phone standard duration is too short. The Long
|
|
Tone DTMF allows access to answer machines and other similar
|
|
devices by transmitting the DTMF tone for as long as the key
|
|
is depressed. This feature is normally not used and is
|
|
assigned a value of 0. However you can select long tone DTMF
|
|
by reprogramminng 1.
|
|
|
|
NOTE: Personal or portable models with a MENU key can more flexibly
|
|
select and cancel this feature thru the menu. To allow Menu
|
|
control of the function it must be cancelled in the NAM by
|
|
setting this bit to 0. If Long Tone DTMF is selected in the
|
|
NAM with a 1 in this bit, it cannot be reversed thru the menu.
|
|
|
|
DIGIT #2: Future use: This feature is always set at 0.
|
|
|
|
DIGIT #3: Eight-Hour Timeout (Convertible only): Personal or portable
|
|
phones with the convertible accessory can normally be left
|
|
active in the vehicle for eight hours with the ignation cut
|
|
off. If the time out feature is selected the phone will turn
|
|
itself off after eight hours to preserve the vehicle's
|
|
battery. This feature is normally selected by entering 0.
|
|
However, you can cancel this eight-hour time limit by
|
|
entering 1.
|
|
|
|
IV. OBTAINING SYS. REGISTRATION DATA
|
|
|
|
A cellular phone owner purchases services from a cellular system operator,
|
|
just as he would purchase land-line service (for standard phones) from the
|
|
local phone company. In cities with cellular coverage, the customer may have
|
|
the option of picking one or two possible cellular system operators.
|
|
Before you can obtain a phone number you will have to supply your cellular
|
|
system operator with your electronic serial number. All cellular phones
|
|
contain a special Electronic Serial Number (ESN). The ESN uniquely identifies
|
|
your phone and provides a measure of protection against theft and fraud. The
|
|
ESN is an eight-charcter (numeric/hexadecimal) number printed on the box
|
|
your phone came in. Once you supply your electronic serial number to the
|
|
system operator he or she will issue your phone number and supply the other
|
|
data required to reprogram the NAM. You should immediately enter this data
|
|
on the NAM Programming Data Table found in this text.
|
|
|
|
V. REPROGRAMMING YOUR PHONE
|
|
************************
|
|
|
|
Determinig the initial Reprogramming Sequence:
|
|
|
|
The initial reprogramming steps include a sequence of keypresses which vary
|
|
depending on the type of cellular phone you have. The phone NAM can be
|
|
reprogrammed from the personal or portable keypad. Determine from the
|
|
Six-Keystroke table below which of the six keystroke sequence numbers to
|
|
use on your phone, based on the type of keys present on the keypad.
|
|
|
|
SIX-KEYSTROKE TABLE
|
|
|
|
Determining the sequence Number with Personal/Portable Keypad
|
|
|
|
PERSONAL/PORTABLE KEYPAD KEYS SEQUENCE
|
|
======================================
|
|
|
|
MENU AND FCN keys 6
|
|
FCN key but no MENU key 1
|
|
No FCN key 2
|
|
|
|
If you have the convertible accessory, the phone NAM must reprogrammed from
|
|
the convertible handset. (MAke sure that the personal phone is disconnected
|
|
from the convertible accessory before reprogramming the convertible.) The
|
|
handset type can be read from the label on the back of the handset. The
|
|
keystroke sequence number is determinded from the KEYSTROKE SEQUENCE TABLE.
|
|
If you have the convertible accessory, and wish to use it seperately as a
|
|
atandalone mobile, you may obtain an additional phone number and reprogram
|
|
this into the convertible accessory at this time.
|
|
|
|
KEYSTROKE SEQUENCE TABLE
|
|
########################
|
|
Determining the sequence Number with Convertible Handset
|
|
|
|
MODEL HANDSET TYPE SEQ.
|
|
----- ------------ ----
|
|
3000 SCN2007A 6
|
|
6000 SCN2023A 2
|
|
6000X SLN2020A 1
|
|
6000XL TLN2659A 1
|
|
6800XL TLN2733A 6
|
|
|
|
Choose one of the six initial reprogramming sequences from the Initial
|
|
Sequence Table depending on the sequence number which you determined from
|
|
previous tables in this file.
|
|
|
|
Initial Reprogram Sequence Table
|
|
++++++++++++++++++++++++++++++++
|
|
|
|
Seq. # Sequence
|
|
1 FCN, Security Code entered twice, RCL
|
|
2 STO, #, Security Code entered twice, RCL
|
|
3 Ctl, 0 + Security Code entered twice, RCL
|
|
4 Ctl, 0 + Security Code entered twice, *
|
|
5 FCN, 0 + Security Code entered twice, MEM
|
|
6 FCN, 0 + Security Code entered twice, RCL
|
|
|
|
Security code is factory-programmed 000000.
|
|
|
|
Initial Steps: Before you proceed with the reprogramming procedure, be sure
|
|
you have filled out the NAM Reprogramming Data Table herin:
|
|
Step a: Turn on your cellular phone by pressing the Pwr or On/Off
|
|
button. The power indicator in the display will flash.
|
|
Step b: Enter the proper keystroke sequence determined from the
|
|
Initial Sequence Table.
|
|
Step c: The message, "01", will appear in the display to confirm the
|
|
activaction of the NAM reprogramming feature. It also
|
|
indicates that you are at the first step in the NAM
|
|
reprogramming sequence. If this message does not appear, it
|
|
may be due to one of these reasons:
|
|
|
|
(1) The initial sequence may not have been entered quickly enough. The
|
|
apperence of zeros in the display will indicate this. Press Clr and Try again.
|
|
(2) The six digit Security Code may have previously been reprogrammed into
|
|
your cellular phone. If this happens to be the case, you must re-enter the
|
|
activation sequence using the assigned security code.
|
|
(3) The maximum number of times that your cellular phone can be reprogrammed
|
|
from the keypad may have been reached.
|
|
(4) The ability for your cellular phone to be reprogrammed from the keypad
|
|
may have been disabled or cancelled.
|
|
|
|
REPROGRAMMING PROCEDURE: Reprogramming for a single phone number can be as
|
|
quick as a four-step process or may take up to 11 steps, depending on how
|
|
many programable features you wish to review or change. The phone always has
|
|
some data programed for each of the features, whether that data is standard
|
|
programming performed at the factory or data provided by someone who
|
|
programmed the unit previously. If, while you are reprogramming, you are
|
|
satisfied with the value already programmed for a particular feature, simply
|
|
press * to move to the next feature. To perform the following steps, it is
|
|
nessary for you to refer to the completed NAM Reprogramming Data Table. If
|
|
you enter a digit incorrectly, press the Clr button to start again.
|
|
|
|
REVIEWING of NAM REPROGRAMMING: Once you have completed the reprogramming
|
|
steps, review the data by repeatedly pressing *. Check to make sure that the
|
|
data reprogrammed matches what you wrote in the NAM Reprogramming Data Table.
|
|
Make any required changes.
|
|
|
|
STORING the DATA: If you are reprogramming a single phone number, press SND
|
|
to store the programming data when you are satisfied that it is all correct.
|
|
A two-digit step number (01-11) must appear in the display in order for you
|
|
to store the data. Press * until one appears and then press SND. Your
|
|
personal or portable cellular phone is now ready for normal use, if you are
|
|
reprogramming a single phone number.
|
|
|
|
REPROGRAMMING the Second Phone #: If "012" appears in the display after you
|
|
have pressed SND to store the programming data for the first phone number,
|
|
you are ready to repeat some or all of the ten steps, this time for a second
|
|
phone number. The 01 indicates that you are ready to enter the System ID
|
|
data (step 1) and the 2 indicates that you are reprogramming data for the
|
|
second phone number. The phone assigns the same security and lock codes
|
|
(steps 7 and 8) for the second phone number and as so skips from step 6 to
|
|
step 9. There is no step 11 when reprogramming a second number.
|
|
If "01 2" did not appear after reprogramming the first phone number, and
|
|
you wish to reprogram a second number, either the second phone option has not
|
|
been selected (step 10) or your phone is not equipped for dual system
|
|
operation. Once you have completed the reprogramming steps, review the data
|
|
by repeatly pressing *. Check to make sure that the data programmed matches
|
|
what you wrote in the NAM reprogramming Data Table. Make any required changes
|
|
Press SND to store the programming data when you are happy that it's all
|
|
correct. (A two-digit step number (01-10) must appear in the dispaly.)
|
|
|
|
Your personal or portable cellular phone is now ready for normal use.
|
|
|
|
NAM REPROGRAMMING DATA TABLE
|
|
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
|
|
|
STEP DESCRIPTION # OF DIGITS SOURCE
|
|
---------------------------------------------------------------------------
|
|
01 System ID # 5 Digits Sys Op
|
|
02 Cellular Area Code 3 Digits Sys Op
|
|
03 Cellular Phone # 7 Digits Sys Op
|
|
04 Station Class Mark 2 Digits Sys Op
|
|
(Usually 14 for 832 chan., 12 for standalone mobile)
|
|
05 Access Overld Class 2 Digits Sys Op
|
|
06 Group ID Mark 2 Digits Sys Op
|
|
07 6-Digit Secur. Code 6 Digits Phone Owner
|
|
08 3-Digit Unlock Code 3 Digits Phone Owner
|
|
09 Initial Paging Chan. 4 Digits Sys Op
|
|
(Usually 0333 or 0334)
|
|
|
|
10 Option Programming 6 Digits
|
|
|
|
/--------------------Handset Internal 1 Dgit Phone Owner
|
|
Speaker disable
|
|
If your install, has a seperate
|
|
External Spkr/VSP unit
|
|
The handset internal speaker
|
|
must be disabled.
|
|
1 = disabled, 0 = enabled.
|
|
This bit normally enabled.
|
|
/--------------------Local Use 1 Digit Sys Op
|
|
(Normally enabled
|
|
1=enabled & 0=disabled)
|
|
/--------------------MIN Mark 1 Digit Sys Op
|
|
normally disabled
|
|
1=Enabled, 0=disabled
|
|
/--------------------Auto Recall 1 Digit Always 1
|
|
/--------------------2nd Phone # 1 Digit Phone Owner
|
|
normally disabled
|
|
1=Enabled & 0=Disabled
|
|
/-------------------Diversity 1 Digit
|
|
(based on the # of antenna ports
|
|
on your cellular phone
|
|
0 = standard 1 Ant. & 1 = Optional 2 ant.
|
|
|
|
=====================Optional programming data entry
|
|
|
|
11 Option Programming 3 Digits (Cont'd)
|
|
|
|
/--------------------Long Tone DTMF 1 Digit Phone Owner
|
|
(normally disabled)
|
|
1 = Enabled & 0 = Disabled
|
|
/--------------------For future use 1 Digit Always 0
|
|
/--------------------Eight-Hr. Timeout 1 Digit Phone Owner
|
|
(normally enabled)
|
|
1 = Disabled & 0 = Enabled
|
|
|
|
======================Optional Programming Data Entry
|
|
|
|
Step number - This number is the message that appears in the display during
|
|
reprogramming.
|
|
|
|
|
|
NAM REPROGRAMMING STEPS
|
|
-----------------------
|
|
|
|
step Keypad Entry Display Comments
|
|
------ -------------- ------------- -----------------------------
|
|
01 Ready for step 1
|
|
1a * Current System ID Factory Setting 000000
|
|
1b New Sy. ID XXXXXXX New system ID
|
|
1c * 02 Ready for step 2
|
|
2a * Curr. Area Code Factory set at 111
|
|
2b New Area Code XXX New Area Code
|
|
2c * 03 Ready for step 3
|
|
3a * Cur. Phone # Factory Setting 1110111
|
|
3b New Phone # XXXXXXX New Phone #
|
|
3c * 04 Ready for step 4
|
|
4a * Cur. Station Factory Setting 0/14 for
|
|
Class Mark portable/personal or 12
|
|
for standalone Mobile.
|
|
4b New Station XX New Station
|
|
Class Mark Class Mark
|
|
4c * 05 Ready for step 5
|
|
5a * Cur. Access Cur. Access
|
|
Overload Class Overload Class
|
|
5b New Access XX New Access
|
|
Overload Class Overload Class
|
|
5c * 06 Ready for step 6
|
|
6a * Curr. Group ID Factory set at 00
|
|
6b New Group ID XX New Group ID
|
|
6c * 07 Ready for step 7
|
|
7a * Current Sec. Code Factory set at 000000
|
|
7b New Security Code XXXXXX
|
|
7c * 08 Ready for step 8
|
|
8a * Current Unlock Code setting at 123
|
|
8b New Unlock Code XXX New Unlock Code
|
|
8c * 09 Ready for step 9
|
|
9a * Current Initial Factory Setting 123
|
|
0334 PAGING CHANNEL
|
|
9b New Initial XXXXXX New Initial
|
|
Paging Channel Paging Channel
|
|
9c * 10 Ready for step 10
|
|
10a * Cur. Options Factory Setting 010100
|
|
10b New Options XXXXXX New Options
|
|
10c * 11 Ready for step 11
|
|
11a * Cur. Options Factory Set. 000
|
|
11b New Option XXX New Options
|
|
11c * 01 or 01 2 Ready for Review
|
|
to program.
|
|
or
|
|
Second Phone Number
|
|
|
|
============================================================================
|
|
Now That conclude Part 2, Part 3 will the instructions for NAM reprogramming
|
|
for all the phones I listed in part 1. If you have any questions or comments
|
|
you can leave me mail on one of the following bbs's that I have listed below.
|
|
|
|
THE RAVEN
|
|
+=======+
|
|
|
|
|
|
Downloaded From P-80 International Information Systems 304-744-2253
|