751 lines
37 KiB
Plaintext
751 lines
37 KiB
Plaintext
|
|
|
|
C e l l u l a r T e l e p h o n y
|
|
|
|
|
|
by
|
|
|
|
B r i a n O b l i v i o n
|
|
|
|
|
|
|
|
A -=Restricted -=Data -=Transmission
|
|
|
|
|
|
|
|
The benefit of a mobile transceiver has been the wish of experimentors
|
|
since the late 1800's. To have the ablility to be reached by another
|
|
man despite location, altitude, or depth has had high priority in
|
|
communication technology throughout its history. Only until the late
|
|
1970's has this been available to the general public. That is when
|
|
Bell Telephone (the late MaBell) introduced the Advanced Mobile
|
|
Phone Service, AMPS for short.
|
|
|
|
Cellular phones today are used for a multitude of different jobs.
|
|
They are used in just plain jibber-jabber, data transfer(I will
|
|
go into this mode of cellular telephony indepth later), corporate
|
|
deals, surveillance, emergencies, and countless other applications.
|
|
The advantages of cellular telephony to the user/phreaker are
|
|
obvious:
|
|
|
|
1. Difficulty of tracking the location of a transciever
|
|
(especially if the transciever is on the move) makes
|
|
it very difficult to locate
|
|
|
|
2. Range of the unit within settled areas
|
|
|
|
3. Scrambling techniques are feasible and can be made to
|
|
provide moderate security for most transmissions.
|
|
|
|
4. The unit, with modification can be used as a bug, being
|
|
called upon by the controlling party from anywhere on
|
|
the globe.
|
|
|
|
5. It with the right knowledge one can modify the cellular
|
|
in both hardware and software to create a rather diverse-
|
|
iffied machine that will scan, store and randomly change
|
|
ESN's per call there by making detection almost impossible.
|
|
|
|
|
|
I feel it will be of great importance for readers to understand the
|
|
background of the Cellular phone system, mainly due to the fact that
|
|
much of the pioneering systems are still in use today. The first
|
|
use of a moblie radio came about in 1921 (remember prohibition?)
|
|
by the Detroit police department. This system operated at 2Mhz. In
|
|
1940, frequencies between 30 and 40Mhz were made available to and
|
|
soon became overcrowded. The trend of overcrowding continues today.
|
|
|
|
In 1946, the FCC declared a 'public corresponence system' called,
|
|
or rather classified as "Domestic Public Land Mobile Radio Service"
|
|
(DPLMRS) at 35 - 44 Mhz band that ran along the highway between
|
|
New York and Boston. Now the 35-44MHz band is used mainly by Amateur
|
|
radio hobbiest's due to the bands susceptibility to skip-propogation.
|
|
|
|
These early mobile radio systems were all PTT(push-to-talk) systems
|
|
that did not enjoy todays duplex conversations. The first real
|
|
mobile 'phone' system was the 'Improved Mobile Telephone Service'
|
|
or the IMTS for short, in 1969. This system covered the spectrum
|
|
from 150 - 450MhHz, sported automatic channel selection for each
|
|
call, eliminated PTT, and allowed the customer to do thier own
|
|
dialing. From 1969 to 1979 this was the mobile telephone service
|
|
that served the public and business community, and it is still
|
|
used today.
|
|
|
|
IMTS frequencies used(MHz):
|
|
|
|
Channel Base Frequency Mobile Frequency
|
|
|
|
VHF Low Band
|
|
|
|
ZO 35.26 43.26
|
|
ZF 35.30 43.30
|
|
ZH 35.34 43.34
|
|
ZA 35.42 43.32
|
|
ZY 34.46 43.46
|
|
ZC 35.50 43.50
|
|
ZB 35.54 43.54
|
|
ZW 35.62 43.62
|
|
ZL 35.66 43.66
|
|
|
|
VHF High Band
|
|
|
|
JL 152.51 157.77
|
|
YL 152.54 157.80
|
|
JP 152.57 157.83
|
|
YP 152.60 157.86
|
|
YJ 152.63 157.89
|
|
YK 152.66 157.92
|
|
JS 152.69 157.95
|
|
YS 152.72 157.98
|
|
YA 152.75 158.01
|
|
JK 152.78 158.04
|
|
JA 152.81 158.07
|
|
|
|
UHF Band
|
|
|
|
QC 454.375 459.375
|
|
QJ 454.40 459.40
|
|
QO 454.425 459.425
|
|
QA 454.45 459.45
|
|
QE 454.475 459.475
|
|
QP 454.50 459.50
|
|
QK 454.525 459.525
|
|
QB 454.55 459.55
|
|
QO 454.575 459.575
|
|
QA 454.60 459.60
|
|
QY 454.625 459.625
|
|
QF 454.650 459.650
|
|
|
|
VHF High frequencies are the most popular frequencies of all
|
|
the IMTS band. VHF low bands are used primarily in rural areas
|
|
and those with hilly terrain. UHF bands is primarily used in cities
|
|
where the VHF bands are overcrowded. Most large cities will find
|
|
at least one station being used in their area.
|
|
|
|
ADVANCED MOBILE PHONE SYSTEM
|
|
|
|
The next step for Mobile telephone was made in 1979 by Bell
|
|
Telephone, again (gee.. where was the competition?), introducing
|
|
the Advanced Mobile Phone Service. This service is the focus
|
|
of this document, which has now taken over the mobile telephone
|
|
industry as the standard. What brought this system to life
|
|
were the new digital technologies of the 1970's. This being
|
|
large scale integrated custom circuits and microprocessors.
|
|
Without these technologies, the system would not have been
|
|
economically possible.
|
|
|
|
The basic elements of the cellular concept have to do with
|
|
frequency reuse and cell splitting.
|
|
|
|
Frequency reuse refers to the use of radio channels on the same
|
|
carrier frequency to cover different areas which are seperated by
|
|
a signifigant distance. Cell splitting is the ability to split
|
|
any cell into smaller cells if the traffic of that cell requires
|
|
attitional frequencies to handle all the area's calls. These two
|
|
elements provide the network an opportunity to handle more simul-
|
|
taneous calls, decrease the transmitters/receivers output/input
|
|
wattage/gain and a more universal signal quality.
|
|
|
|
When the system was first introduced, it was allocated 40mHz in
|
|
the frequency spectrum, divided into 666 duplex radio channels
|
|
providing about 96 channels per cell for the seven cluster
|
|
frequency reuse pattern. Cell sites (base stations) are located
|
|
in the cells which make up the cellular network. These cells
|
|
are usually represented by hexagons on maps or when developing
|
|
new systems and layouts. The cell sites contain radio, control,
|
|
voice frequency processing and maintnence equipment, as well as
|
|
transmitting and receiving antennas. The cell sites are inter-
|
|
connected by landline with the Mobie Telecommunications Switching
|
|
Office (MTSO).
|
|
|
|
In recent years, the FCC has added 156 frequencies to the Cellular
|
|
bandwidth. This provides 832 possible frequencies available to
|
|
each subscriber per cell. All new cellular telephones are built
|
|
to accomodate these new frequencies, but old cellular telephones
|
|
still work on the system. How does a cell site know if the unit
|
|
is old or new? Let me explain.
|
|
|
|
The problem of identifying a cellular phones age is done by the
|
|
STATION CLASS MARK (SCM). This Numer is 4 bits long and broken
|
|
down like this:
|
|
|
|
Bit 1: 0 for 666 channel usage (old)
|
|
1 for 832 channel usage (new)
|
|
|
|
Bit 2: 0 for a mobile unit(in vehical)
|
|
1 for voice-activated transmit (for protables)
|
|
|
|
Bit 3-4: Indentify the power class of the unit
|
|
|
|
Class I 00 = 3.0 watts Continuous Tx's 00XX...DTX <> 1
|
|
Class II 01 = 1.2 watts Discont. Tx's 01XX...DTX = 1
|
|
Class III 10 = 0.6 watts reserved 10XX, 11XX
|
|
Reserved 11 = --------- Letters DTX set to 1 permits
|
|
use of discontinuous trans-
|
|
missions
|
|
|
|
|
|
Cell Sites: How Cellular telephones get their name
|
|
|
|
Cell sites, as mentioned above are layed out in a hexagonal type
|
|
grid. Each cell is part of a larger cell which is made up of
|
|
seven cells in the following fashion:
|
|
|
|
|---| ||===|| |---| |---| |---| |---
|
|
/ \ // \\ / \ / \ / \ /
|
|
| |===|| 2 ||===|| ||===|| |---| |---|
|
|
\ // \ / \\ // \\ / \ / \
|
|
|---|| 7 |---| 3 ||==|| 2 ||==|| |---| |---|
|
|
/ \\ / \ // \ / \\ Due to the \
|
|
| ||---| 1 |---|| 7 |---| 3 ||--| difficulty of |
|
|
\ // \ / \\ / \ // \ representing /
|
|
|--|| 6 |---| 4 ||--| 1 |---|| |graphics with |
|
|
/ \\ / \ // \ / \\ / ascii characters\
|
|
| ||==|| 5 ||==|| 6 |---| 4 ||--| I will only show |
|
|
\ / \\ // \\ / \ // \ two of the cell /
|
|
|---| ||===|| ||===|| 5 ||==|| |types I am trying-
|
|
/ \ / \ / \\ // \ / to convey. \
|
|
| |---| |---| ||==|| |---| |---| |
|
|
\ / \ / \ / \ / \ / \ /
|
|
|---| |---| |---| |---| |---| |---|
|
|
|
|
As you can see, each cell is a 1/7th of a larger cell. Where one(1)
|
|
is the center cell and two(2) is the cell directly above the center.
|
|
The other cells are number around the center cell in a clockwise
|
|
fashion, ending with seven(7). The cell sites are equiped with
|
|
three directional antennas with an RF beamwidth of 120 degrees
|
|
providing 360 degree coverage for that cell. Note that all cells
|
|
never share a common border. Cells which are next to each other
|
|
are obviously never assigned the same frequencies. They will
|
|
almost always differ by at least 60 Khz. This also demonstrates
|
|
the idea behind cell splitting. One could imagine that the parimeter
|
|
of one of the large cells was once one cell. Due to a traffic
|
|
increase, the cell had to be sub-divided to provide more channels
|
|
for the subscribers. Note that subdivisions must be made in factors
|
|
of seven.
|
|
|
|
There are also Moblie Cell sites, which are usually used in the
|
|
transisitional period during the upscaling of a cell site due to
|
|
increased traffic. Of course, this is just one of the many uses of
|
|
this component. Imagine you are building a new complex in a very
|
|
remote location. You could feasibly install a few mobile cellular
|
|
cell sites to provide a telephone-like network for workers and
|
|
executives. The most unique component would be the controller/
|
|
transceiver which provides the communications line between the
|
|
cell site and the MTSO. In a remote location such a link could
|
|
very easily be provided via satellite up/down link facilities.
|
|
|
|
|
|
Lets get into how the phones actually talk with eachother. There
|
|
are several ways and competitors have still not set an agreed upon
|
|
standard.
|
|
|
|
Frequency Division Multiple Access (FDMA)
|
|
|
|
This is the traditional method of traffic handling. FDMA is a
|
|
single channel per carrier analog method of transmitting signals.
|
|
There has never been a definate set on the type of modulation to
|
|
be used. There are no regulations requiring a party to use a single
|
|
method of modulation. Narrow band FM, single sidband AM, digital, and
|
|
spread-spectrum techniques have all been considered as a possible
|
|
standard. But none hae yet to be chosen.
|
|
|
|
FDMA works like this: Cell sites are constantly searching out
|
|
free channels to start out the next call. As soon as a call finishes
|
|
the channel is freed up and put on the list of free channels. Or, as
|
|
a subscriber moves from one cell to another the new cell they are in
|
|
will hopefully have an open channel to recieve the current call in
|
|
progress and carry it through its location. This process is called
|
|
handoff, and will be discussed more indepth further along.
|
|
|
|
Other proposed traffic handling schemes include Time-Division
|
|
Multiple Acces (TDMA), Code-Division Multiple Access(CDMA), and
|
|
Time-Division/Frequency Division Multiple Access.
|
|
|
|
Time Division Multiple Access
|
|
|
|
With TDMA calls are simultaneously held on the same channels, but
|
|
are mutiplexed between pauses in the conversation. These pauses
|
|
occur in the way people talk and think, and the telephone company
|
|
also injects small delays on top of the conversation to accommodate
|
|
other traffic on that channel. This increase in the length of the
|
|
usual pause results in a longer amount of time spent on the call.
|
|
Longer calls result in higher cost of the call.
|
|
|
|
Code Division Multiple Access
|
|
|
|
This system has been used in mobile military communications for the
|
|
past 35 years. This system is digital and breaks up the digitized
|
|
conversation into bundles, compressed, sent, then decompressed and
|
|
converted back into analog. There are said increases of throughput
|
|
of 20 : 1 but CDMA is susceptible to interference which will result
|
|
in packet retransmission and delays. Of course error correction can
|
|
can help in data integrity, but will also result in a small delay in
|
|
throughput.
|
|
|
|
Time-Dvision/Frequency Division Multiple Access
|
|
|
|
TD/FDMA is a relatively new system which is an obvious hybrid of
|
|
FDMA and TDMA. This system is mainly geared towards the increase
|
|
of digital transmission over the cellular network. TD/FDMA make
|
|
it possible to transmit signals from base to moblie without
|
|
disturbing the conversation. With FDMA there are signifigant
|
|
disturbances during handoff with prevent continual data transmission
|
|
from site to site. TD/FDMA make it possible to transmit control
|
|
signals by the same carrier as the data/voice thereby ridding
|
|
extra channel usage for control.
|
|
|
|
|
|
Cellular Frequency Usage and channel allocation
|
|
|
|
|
|
There are 832 cellular phone channels which are split into two
|
|
seperate bands. Band A consists of 416 channels for non-wireline
|
|
services. Band B consists equally of 416 channels for wireline
|
|
services. Each of these channels are split into two frequencies
|
|
to provide duplex operation. The lower frequency is for the mobile
|
|
unite while the other is for the cell site. 21 channels of each
|
|
Band are dedicated to 'control' channels and the other 395 are
|
|
voice channels. You will find that the channels are numbered from
|
|
1 to 1023, skipping channels 800 to 990.
|
|
|
|
I found these handy-dandy equations that can be used for calculating
|
|
frequencies from channels and channels from frequencies.
|
|
|
|
N = Cellular Channel # F = Cellular Frequency
|
|
B = 0 (mobile) or B = 1 (cell site)
|
|
|
|
|
|
|
|
CELLULAR FREQUENCIES from CHANNEL NUMBER:
|
|
|
|
|
|
F = 825.030 + B * 45 + ( N + 1 ) * .03
|
|
where: N = 1 to 799
|
|
|
|
F = 824.040 + B * 45 + ( N + 1 ) * .03
|
|
where: N = 991 to 1023
|
|
|
|
|
|
|
|
CHANNEL NUMBER from CELLULAR FREQUENCIES
|
|
|
|
|
|
N = 1 + (F - 825.030 - B * 45) / .03
|
|
|
|
where: F >= 825.000 (mobile)
|
|
or F >= 870.030 (cell site)
|
|
|
|
N = 991 + (F - 824.040 - B * 45) / .03
|
|
|
|
where: F <= 825.000 (moblie)
|
|
or F <= 870.000 (base)
|
|
|
|
|
|
Now that you have those frequencies, what to do with them. Well,
|
|
for starters, one can very easily monitor the cellular frequencies
|
|
with most hand/base scanners. Almost all scanners pre-1988 have
|
|
some coverage of the 800 - 900 MHz band. All scanners can
|
|
monitor the IMTS frequencies.
|
|
|
|
Remember that cellular phones operate on a full duplex channel.
|
|
That means that one frequency is used for transmission and the
|
|
other is used for receiving, each spaced exactly 30 Khz apart.
|
|
Remember also that the base frequencies are 45MHz higher than
|
|
the cellular phone frequencies. This can obviously make
|
|
listening rather difficult. One way to listen to both parts of
|
|
the conversation would be having two scanners programmed 45 Mhz
|
|
apart to capture the entrire conversation.
|
|
|
|
The upper UHF frequency specrum was 'appropriated' by the Cellular
|
|
systems in the late 1970's. Televisions are still made to
|
|
recieve up to channel 83. This means that you can recieve much
|
|
of the cellular system on you UHF receiver. One television channel
|
|
occupies 6Mhz of bandwidth. This was for video, sync, and audio
|
|
transmission of the channel. A cellular channel only takes up
|
|
24 KHz plus 3KHz set up as a guard band for each audio signal.
|
|
This means that 200 cellular channels can fit into one UHF
|
|
television channel. If you have an old black and white television
|
|
drop a variable cap in there to increase the sensistivity of the
|
|
tuning. Some of the older sets have coarse and fine tuning knobs.
|
|
|
|
Some of the newer, smaller, portable television sets are tuned by
|
|
a variable resistor. This make modifications MUCH easier, for now
|
|
all you have to do is drop in there a smaller value pot and
|
|
tweak away. I have sucessfully done this on two televisions.
|
|
Most users will find that those who don't live in a city will
|
|
have a much better listening rate per call. In the city, the cells
|
|
are so damn small that handoff is usually every other minute.
|
|
Resulting in chopped conversations.
|
|
|
|
If you wanted to really get into it, I would suggest to obtain an
|
|
old Television set with decent tuning controls and remove the RF
|
|
section out of the set. You don't want all that hi-voltage circuitry
|
|
lying around(flyback and those caps). UHF recievers in televisions
|
|
downconvert UHF frequencies to IF (intermediate frequencies) between
|
|
41 and 47 MHz. These output IF frequencies can then be run into a
|
|
scanner set to pick-up between 41 - 47 MHz. Anyone who works with
|
|
RF knows that it is MUCH easier to work with 40MHz signals than working
|
|
with 800MHz signals (not to far away from Ghz.. mmmmmmm.. Waveguides
|
|
are just sooo much fun). JUST REMEMBER ONE THING!!!! Isolate the
|
|
UHF reciever from your scanner by using a coupling capacitor(.01 -
|
|
.1 microfarad(50V min.) will do nicely)!!!! You don't want any of
|
|
those biasing voltages creeping into your scanners recieving
|
|
AMPLIFIERS!!! Horrors. Also, don't forget to gound both the scanner
|
|
and reciever.
|
|
|
|
Some systems transmit and recieve the same cellular transmission
|
|
on the base frequencies. There you can simply hang out on the
|
|
base frequency and capture both sides of the conversation. The
|
|
handoff rate is much higher in high traffic areas leading the listener
|
|
to hear short or choppy conversations. At times you can listen in
|
|
for 5 to 10 minutes per call, depending on how fast the caller is
|
|
moving through the cell site.
|
|
|
|
TV Cell & Channel Scanner TV Oscillator Band
|
|
Channel Freq.& Number Frequency Frequency Limit
|
|
===================================================================
|
|
73 (first) 0001 - 825.03 45.97 871 824 - 830
|
|
73 (last) 0166 - 829.98 41.02 871 824 - 830
|
|
74 (first) 0167 - 830.01 46.99 877 830 - 836
|
|
74 (last) 0366 - 835.98 41.02 877 830 - 836
|
|
75 (first) 0367 - 836.01 46.99 883 836 - 842
|
|
75 (last) 0566 - 841.98 41.02 883 836 - 842
|
|
76 (first) 0567 - 842.01 46.99 889 842 - 848
|
|
76 (last) 0766 - 847.98 41.02 889 842 - 848
|
|
77 (first) 0767 - 848.01 46.99 895 848 - 854
|
|
77 (last) 0799 - 848.97 46.03 895 848 - 854
|
|
|
|
All frequencies are in MHz
|
|
|
|
You can spend hours just listening to cellular telephone conversations
|
|
but I would like to mention that it is illegal to do so. Yes, it is
|
|
illegal to monitor cellular telephone conversations. It just another
|
|
one of those laws like removing tags off of furniture and pillows.
|
|
It's illegal, but what the hell for? Its also illegal to spit on
|
|
the sidewalks here in Massachusetts, yet you can carry a shotgun
|
|
on sundays with you to mass(thats still in the books. Obviously
|
|
it was for the original settlers). At any rate, I just want you
|
|
to understand that doing the following is in violation of the law.
|
|
|
|
Now back to the good stuff.
|
|
|
|
Conversation is not only what an avid listener will find on the
|
|
cellular bands. One will also hear call/channel setup control
|
|
data streams, dialing, and other control messages. At times,
|
|
a cell site will send out a full request for all units in its
|
|
cell to indentify itself. The phone will then respond with the
|
|
appropriate identification on the corresponding control channel.
|
|
|
|
Whenever a moblie unit is turned on, even when not placing a call,
|
|
whenever there is power to the unit, it transmits its phone
|
|
number and its 8-digit ID number. The same process is done when
|
|
an idling phone passes from one cell to the other. This process
|
|
is repeated for as long as there is power to the unit. This allows
|
|
the MTSO to 'track' a mobile through the network. That is why it is
|
|
not a good reason to use a mobile phone from one site. They do have
|
|
ways of finding you. And it really is not that hard. Just a bit
|
|
of RF Triangulation theory and you're found. However, when the
|
|
power to the unit is shut off, as far as the MTSO cares, you never
|
|
existed in that cell, of course unless your unit was flagged for some
|
|
reason. MTSO's are basically just ESS sytems designed for mobile
|
|
applications. This will be explained later within this document.
|
|
|
|
It isn't feasible for the telephone companies to keep track of each
|
|
customer on the network. Therefore the MTSO really doesn't know
|
|
if you are authorized to use the network or not. When you purchase
|
|
a cellular phone, the dealer gives the units phone ID number to the
|
|
local BOC, as well as the number the BOC assigned to the customer.
|
|
When the unit is fired up in a cell site its ID number and phone
|
|
number is transmitted and checked. If the two numbers are registered
|
|
under the same subscriber, then the cell site will allow the mobile
|
|
to send and recieve calls. If they don't match, then the cell will
|
|
not allow the unit to send or recieve calls. Hence, the most
|
|
successful way of reactivating a cellular phone is to obtain an
|
|
ID that is presently in use and modifying your rom/prom/eprom for
|
|
your specific phone.
|
|
|
|
RF and AF Specifications:
|
|
|
|
Everything that you will see from here on out is specifically
|
|
Industry/FCC standard. A certian level of compatibility has
|
|
to be maintained for national intercommunications, therefore
|
|
a common set of standards that apply to all Cellular telephones
|
|
can be compiled and analyzed.
|
|
|
|
Transmitter Mobiles: audio transmission
|
|
|
|
- 3 kHz to 15 kHz and 6.1 kHz to 15 kHz
|
|
- 5.9 kHz to 6.1 kHz 35 dB attenuation
|
|
- Above 15 kHz, the attenuation becomes 28 dB
|
|
- All this is required after the modulation limiter and before
|
|
the modulation stage
|
|
|
|
Transmitters Base Stations: audio transmission
|
|
|
|
- 3 kHz to 15 kHz
|
|
- Above 15 kHz, attenuation required 28 dB
|
|
- Atennuation after modulation limiter - no notch filter required
|
|
|
|
RF attenuation below carrier Transmitter: audio transmission
|
|
|
|
- 20 kHz to 40 kHz, use 26 dB.
|
|
- 45 kHz to 2nd harmonic, the specification is 60 dB or 43 + 10 log
|
|
of mean output power
|
|
- 12 kHz to 20 kHz, attenuation 117 log f/12
|
|
- 20 kHz to 2nd harmonic, there is a choice: 100 log F/100 or 60 dB
|
|
or 43 log + 10 log of mean output power, whichever is less.
|
|
|
|
Wideband Data
|
|
|
|
- 20 kHz to 45 kHz, use 26 dB
|
|
- 45 kHz to 90 kHz, use 45 dB
|
|
- 90 kHz to 2nd harmonic, either 60 dB or 43 + 10 log mean output
|
|
power
|
|
|
|
- all data streams are encoded so that NRZ (non-return-to-zero)
|
|
binary ones and zeroes are now zero-to-one and one-to-zero
|
|
transitions respectively. Wideband data can then modulate
|
|
the transmitter carrier by binary frequency shift keying(BFSK)
|
|
and ones and zeroes into the modulator must now be equivalent
|
|
to nominal peak frequency deviations of 8 kHz above and below
|
|
the carrier frequency.
|
|
|
|
Supervisory Audio Tones
|
|
|
|
- Save as RF attenuation measurements
|
|
|
|
Signaling Tone
|
|
|
|
- Same as Wideband Data but must be 10 kHz +/- 1 Hz and produce a
|
|
nominal frequency deviation of +/- 8 kHz.
|
|
|
|
|
|
The previous information will assist any technophile to modify or
|
|
even troubleshoot his/her cellular phone. Those are the working
|
|
guidelines, as I stated previously.
|
|
|
|
|
|
UNIT IDENTIFICATION
|
|
|
|
Each mobile unit is identified by the following sets of numbers.
|
|
|
|
The first number is the Moblie Identification Number (MIN). This
|
|
34 bit binary number is derived from the units telephone number,
|
|
MIN1 is the last seven digits of the telephone number and MIN2 is
|
|
the area code.
|
|
|
|
For demonstrative purposes, we'll encode 617-637-8687.
|
|
|
|
Here's how to derive the MIN2 from a standard area code. In this
|
|
example, 617 is the area code. All you have to do is first convert
|
|
to modulo 10 using the following function. A zero digit would be
|
|
considered to have a value of 10.
|
|
|
|
100(first number) + 10(second) +1(third) - 111 = x
|
|
|
|
100(6) + 10(1) + 1(7) - 111 = 506
|
|
|
|
(or you could just - 111 from the area code.)
|
|
|
|
Then convert it to a 10-bit binary number: 0111111010
|
|
|
|
To derive MIN1 from the phone number is equally as simple. First
|
|
encode the next three digits, 637.
|
|
|
|
100(6) + 10(3) + 1(7) - 111 = 526
|
|
|
|
Converted to binary: 1000001110
|
|
|
|
The remainder of the number 8687, is processed further by taking
|
|
the first digit, eight(8) and converting it directly to binary.
|
|
|
|
8 = 1000 (binary)
|
|
|
|
The last three digits are processed as the other two sets of
|
|
three numbers were processed.
|
|
|
|
100(6) + 10(8) + 1(7) - 111 = 576
|
|
|
|
Converted to binary: 1001000000
|
|
|
|
So the completed MIN number would look like this:
|
|
|
|
|--637---||8-||---687--||---617--|
|
|
1000001110100010010000000111111010
|
|
\________/\__/\________/\________/
|
|
|
|
|
|
A unit is also identifiable by its Electronic Serial Number or
|
|
ESN. This number is Factory Preset and is usually stored in a
|
|
ROM chip, which is soldered to the board. It may also be found
|
|
in a 'computer on a chip', which are the new microcontrollers
|
|
which have rom/ram/microprocessor all in the same package. This
|
|
type of setup usually has the ESN and the software to drive the
|
|
unit all in the same chip. This makes is significantly harder
|
|
to dump, modify and replace. But it is far from impossible.
|
|
|
|
The ESN is a 4 byte hex or 11-digit octal number. I have encountered
|
|
mostly 11-digit octal numbers on the casing of most celluar phones.
|
|
the first three digits represent the manufacturer and the remaining
|
|
eight digits are the units ESN. I'll go more into the ESN later in
|
|
the document.
|
|
|
|
The Station Class Mark (SCM) is also used for station identification
|
|
by providing the station type and power output rating. This was
|
|
already discussed in a previous section.
|
|
|
|
The System IDentification (SID number is a number wich represents
|
|
the mobile's home system. This number is 15-bits long and a list
|
|
of current nationwide SID's should either be a part of this file
|
|
or it will be distrubted along with it.
|
|
|
|
|
|
In the next issue we'll discuss the Control channels, signalling
|
|
formats, and dissecting the NAM in detail. Social.technological
|
|
impacts (re: cellular interception designed into the units)
|
|
|
|
-------------- cut me here ---------------------------------------------------
|
|
|
|
|
|
PUTTING IT ALL TOGETHER - Signaling on the Control Channels
|
|
|
|
There are two types of continuous wideband data stream transmissions.
|
|
One is the Forward Control Channel which is sent from the land station
|
|
to the mobile. The other is the Reverse Control Channel, which is
|
|
sent from the mobile to the land station. Each data stream runs at a
|
|
rate of 10 kilobit/sec, +/- 1 bit/sec rate. The formats for each of
|
|
the channels follow.
|
|
|
|
|
|
Forward Control Channel
|
|
|
|
The forward control channel consists of three discrete information
|
|
streams. They are called stream A, stream B and the busy-idle
|
|
stream. All three streams are multiplexed together. Messages to
|
|
mobile stations with the least significant bit of thier MIN number
|
|
equal to "0" are sent on stream A, and those with a "1" are sent
|
|
on stream B.
|
|
|
|
The busy-idle stream contains busy-idle bits, whic are used to
|
|
indicate the status of the reverse control channel. If the busy-idle
|
|
bit = "0" the reverse control channel is busy, if it equals "1"
|
|
it is idle. The busy-idle bit is located at the beginning of each
|
|
dotting sequence, word sync sequence, at the beginning of the first
|
|
repeat of word A and after every 10 message bits thereafter.
|
|
|
|
Mobile stations achieve synchronization with the incoming data via
|
|
a 10 bit dotting sequence (1010101010) and an 11 bit word sync
|
|
sequence (11100010010). Each word contains 40 bits, including parity
|
|
and is repeated 5 times after which it is then refered to as a
|
|
"block". For a multiword message, the second word block and subsequent
|
|
word blocks are formed the same as the first word blok including the
|
|
dotting and sync sequences. A "word" is formed when the 28 content
|
|
bits are encoded into a (40, 28; 5) BCH (Bose-Chaudhuri-Hocquenghem)
|
|
code. The left-most bit shall be designated the most-signifigant bit.
|
|
|
|
The Generator polynominal for the (40, 28;5) BCH code is:
|
|
|
|
12 10 8 5 4 3 0
|
|
G (X) = X + X + X + X + X + X + X
|
|
B
|
|
|
|
Each FOCC message con consist of one or more words. Messaging trans-
|
|
mitted over the forward control channel are:
|
|
|
|
- Mobile station control message
|
|
- Overhead message
|
|
- control-filler mesage
|
|
|
|
Controller-filler messages may be inserted between messages and
|
|
between word blocks of a multiword message.
|
|
|
|
Message Formats: Found on either stream A or B
|
|
|
|
MOBILE STATION CONTROL MESSAGE
|
|
|
|
The mobile station control message can consist of one, two, or four
|
|
words.
|
|
|
|
Word 1 (abbreviated address word)
|
|
|
|
+--------+-------+---------------------------------------+-----------+
|
|
| T t | | | |
|
|
| 1 2 | DCC | Moblie Identification Number 1 | P |
|
|
| | | 23-0 | |
|
|
+--------+-------+---------------------------------------+-----------+
|
|
bits: 2 2 24 12
|
|
|
|
Word 2 (extended address word)
|
|
|
|
+------+-----+-----------+------+--------+-------+----------+-----+
|
|
| T T |SCC =| | RSVD | LOCAL | CRDQ | ORDER | |
|
|
| 1 2| 11 | MIN2 | = 0 | | | | |
|
|
| = +-----+ 3-24 +------+-----+--+-------+----------| P |
|
|
| 10 |SCC =| | VMAC | CHAN | |
|
|
| | 11 | | | | |
|
|
+------+-----+-----------+------------+---------------------+=----+
|
|
|
|
The Reverse Control Channel (RECC) is a wideband data stream sent
|
|
from the moblie station to the land station. This data stream runs
|
|
at a rate of 10 kilobit/sec, +/- 1 bit/sec rate. The format of the
|
|
RECC data stream follows:
|
|
|
|
+---------+------+-------+------------+-------------+-----------+-----
|
|
| Dotting | Word | Coded | first word | Second word | Third word|
|
|
| | sync | DCC | repeated | repeated | repeated | ...
|
|
| | | | 5 times | 5 times | 5 times |
|
|
+---------+------+-------+------------+-------------+-----------+-----
|
|
|
|
DCC = Digital Color Code Dotting = 01010101...010101
|
|
Received DCC 7-bit Codec DCC Word sync = 11100010010
|
|
00 0000000
|
|
01 0011111
|
|
10 1100011
|
|
11 1111100
|
|
|
|
All messages begin with the RECC seizure precursor with is composed
|
|
of a 30 bit dotting sequence (1010...101), and 11 bit word sync
|
|
sequence (11100010010), and the coded digital color code.
|
|
|
|
Each word contains 48 bits, including parity, and is repeated five
|
|
times after which it is refered to as a word block. A word is
|
|
formed by encoding 36 content bits into a (48, 36) BCH code that has
|
|
a distance of 5, (48 36; 5). The left most bit shall be designated
|
|
the most-significant bit. The 36 most-significant bits of the 48 bit
|
|
field shall be the content bits.
|
|
|
|
The generator polynomial for the code is the same for the (40,28;5)
|
|
code used on the forward channel.
|
|
|
|
|
|
CONTROL CHANNELS (SETUP CHANNELS)
|
|
|
|
Each wireline and non-wireline service have 21 channels. These
|
|
channels are used by the MTSO and the cell sites to directly
|
|
communicate with the mobile unit. The first signal sent to initiate
|
|
a call is the Supervisory Audio Tone (SAT). This can be thought of
|
|
as the voltage used to close the loop on a land telephone.
|
|
|
|
SAT Tones with corresponding binary codes:
|
|
|
|
5970 Hz (00)
|
|
6000 Hz (01)
|
|
6030 HZ (10)
|
|
|
|
The mobile unit recieves the SAT from the cell site and transponds
|
|
it back (closing the loop). Tone recognition must take place
|
|
within 250 milliseconds or the site interprets it as the mobile
|
|
is out of range. If the SAT is returned, then a Signaling Tone
|
|
is issued. This Tone is 10kHz and is present when the user is
|
|
either being alerted(call initialization), being handed off,
|
|
or disconnecting The Signaling tone is used only in mobile to
|
|
land direction
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|