599 lines
30 KiB
Plaintext
599 lines
30 KiB
Plaintext
|
|
|
|
==============================================================================
|
|
RELEASED ON 06/20/93
|
|
==============================================================================
|
|
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
|
:::::::: ____ : ____ : _ :::: _ :::::::::: _ : _ : ____ : _ :::: _ :::::::::::
|
|
::::::: | | | ___| | | :: | | :::::::: | | | | | ___| | | :: | | ::::::::::
|
|
::::::: | ||_| | _| | | :: | | ::: ___ | |_| | | _| | | :: | | ::::::::::
|
|
::::::: | | _ | | .: | | :: | | :: |___| | _ | | | .: | | :: | | ::::::::::
|
|
::::::: | || | | |__ | |__ | |__ | | | | | |__ | |__ | |__ ::::::::
|
|
::::::: |____| |____| |____| |____| ::::: |_| |_| |____| |____| |____| :::::::
|
|
::::::::. .:. .:. .:. .:::::::. .:. .:. .:. .:. .::::::::
|
|
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
|
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
|
::::::::::::THE:DIRECTORY:OF:CELLULAR:MODIFICATION:::MITSUBISHI:800:::::::::::
|
|
:::::::::::::...:.........:..:........:............:::..........:...::::::::::
|
|
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
|
==============================================================================
|
|
WRITTEN, CREATED, AND TESTED BY VIDEO VINDICATOR
|
|
==============================================================================
|
|
|
|
|
|
INTRODUCTION
|
|
~~~~~~~~~~~~
|
|
Here it is... The long awaited first file on cellular modification... Not
|
|
just some bullshit that tells you how to reprogram the NAM, but the down and
|
|
dirty ripping of the ESN. This is the first in what should (and hopefully)
|
|
will be a neverending series of files from me on some of out happy cellular
|
|
manufactures fine (and not so fine) products.
|
|
|
|
In the interests of keeping health and happy, this modification was
|
|
completely test on 10 test humans, who said they had no problems, except a
|
|
large growth located behind their left ear... Cellular phones causing
|
|
cancer? Ya right, I think my toilet puts out more harmful (and the key word
|
|
is harmful) radiation then a fucking 0.5 watt handheld. And shit, even if
|
|
it does, I'll still use 'em.
|
|
|
|
This file deals with the general layout of the Mistubishi 800, as well
|
|
as includes the binary for a generic tumbling modification, which will be
|
|
covered later in the file.
|
|
|
|
|
|
WHAT YOU'LL FIND INSIDE
|
|
~~~~~~~~~~~~~~~~~~~~~~~
|
|
The Mitsubishi has got to be one of the best phones out there to modify,
|
|
since it requires only the most minimum permanent modification to occur, and
|
|
NO soldering on the PC Boards themselves!
|
|
|
|
The ESN is located on what I have refered to as Board C in the first
|
|
diagram below. This chip was manufactured by CSI and is a 93C64K. One easy
|
|
way in which to modify this peticular phone would be to replace it with a
|
|
ZIFF socket, and an EEPROM (or preferably a flash prom) which would contain
|
|
the new ESN.
|
|
|
|
The software chip is locates on the underside of Board A, and is a
|
|
standard 27C256 (32K) software EPROM. For the sake of compatability, I have
|
|
included the binary source to the version I preformed this modification on
|
|
(and there are several other revisions out there!). To replace it, simply
|
|
choose a EEPROM that is faster than 25ns (I would recommend a 15), and if
|
|
you plan on tampering with the software at all, then get flash proms. Make
|
|
sure that the chip you program has the proper checksum, which is E1A5, and
|
|
for your own information this is revision CB6.
|
|
|
|
The phone uses a Mitsubishi proprietary processor, the M50747, which was
|
|
discontinued this year, and replaced by the M38000. This is a Motorol
|
|
68HC11 compatible chip, and does not have any special instructions AS FAR AS
|
|
I KNOW. If you are interested in modifying it, there are quite a few PD
|
|
cross-assemblers out there, although I have only seen a very few copyrighted
|
|
programs.
|
|
|
|
|
|
DISASSEMBLING THE PHONE
|
|
~~~~~~~~~~~~~~~~~~~~~~~
|
|
Unlike what most people would like you to believe, this is probably on of
|
|
the easiest modifications to do, requiring very little soldering. The only
|
|
tools required to remove the boards from the Mitsu 800 are a small flathead
|
|
screwdriver, a small phillips, and a set of Allen wrenches. Here we go...
|
|
|
|
(1) Remove the handset and cradel/battery from the main phone component.
|
|
(2) Remove the three allen head screws from the main body, and then gently
|
|
pry the top off with the screwdriver.
|
|
(3) Remove the four phillips screws from Board B (refer to diagram), and
|
|
unplug all of the exposed antenni relays, as well as all of the wire
|
|
connections.
|
|
(4) Gently pry the board up with the screwdriver, making sure to keep the
|
|
board level (so as not to bend the pins connecting board B to A.
|
|
(5) Remove the antenni lead from the metal casing surrounding Board D, and
|
|
then unscrew board C.
|
|
(6) Remove the EPROM from the underside of Board A with the screwdriver.
|
|
It is installed in a tower and requires no soldering (how thoughtful
|
|
of them).
|
|
|
|
That's it, the unit is as disassembled as we need.
|
|
|
|
|
|
THE BOARD LAYOUT
|
|
~~~~~~~~~~~~~~~~
|
|
Here is the top view of the phones' boards, and the screw locations. This
|
|
is 1/3 scale on a NEC 4D.
|
|
|
|
|
|
.----CONNECTED-----. BOARD C
|
|
| | ___
|
|
| BOARD A | | o| LEGEND
|
|
___ | _____________ | |###| ~~~~~~
|
|
/ O |___| | | # - Wire connect
|
|
| ### o o| |____| : - Drop Pins
|
|
| | o - Screw for Board
|
|
| (1) O| O - Case screw
|
|
| ___________| 1 - Processor
|
|
| |_ BOARD B
|
|
| :| ____________
|
|
| o :| <--CONNECTED-. |o |
|
|
| :| | |: o |
|
|
| :| `-> |: |
|
|
| | |: |
|
|
| _| |: o |
|
|
| #| | |
|
|
| #| <-----. | |
|
|
| o #|_ | | |
|
|
|____ | | | |
|
|
~| # O | | | |
|
|
.--> |_#___| | | |
|
|
| | | |
|
|
| CONNECTS | o o|
|
|
CONNECTS TO BOARD D | |
|
|
TO POWER (NOT SHOWN) |____________|
|
|
INPUT
|
|
|
|
General Information on the Boards involved
|
|
|
|
BOARD A - The Main board, controls all the other boards in the phone. All
|
|
antenni relays and power controls are present here. The Software
|
|
EPROM is also on this board. Battery and NAM functions also
|
|
reside here.
|
|
|
|
BOARD B - Controls all recieve functions, and also tone synthesis for
|
|
reverse channels. Tone crystal is located on board A Antenni
|
|
loops from Board D.
|
|
|
|
BOARD C - This board only contains the ESN.
|
|
|
|
BOARD D - Controls all transmit functions, and also the D/A conversion
|
|
process. Antenni Loops from board A.
|
|
|
|
|
|
BOARD A REVERSE SIDE CLOSEUP
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
LEGEND
|
|
~~~~~~
|
|
+ - Inputs from Board B
|
|
s - Crystal for subaudible tones
|
|
c - Crystal for Touchtones
|
|
O - Case Screw
|
|
o - Screw for Board ___________________
|
|
Z - Input for Handset |O o ZZZZ|
|
|
Y - Handsfree/Horn Hookup | BBB ZZZZ|
|
|
X - Power Hookup | BBB YYY|
|
|
C - Software EPROM | YYY|
|
|
B - Battery |CCCCCCCCCC s YYY|
|
|
H - TDK Heatsinks |>CCCCCCCCC s XXXX|
|
|
___________ |CCCCCCCCCC XXXX|
|
|
_________ ___|+++++++++++|__| o XXXX|
|
|
|O |______| |
|
|
| |
|
|
| _|
|
|
| |
|
|
|____ ccc |
|
|
|_ o o |_
|
|
| |
|
|
| HHHHHHHHHHHHHHHH HHHHHHHHHHHHHHHH O|
|
|
|_HHHHHHHHHHHHHHHH_HHHHHHHHHHHHHHHH_____________/
|
|
|
|
|
|
BOARD C CLOSEUP
|
|
~~~~~~~~~~~~~~~
|
|
This is the main board that we will be concerned with in the modification,
|
|
since this is the primary piece modified. On the
|
|
Facing down diagram, the '%' represent the ESN IC,
|
|
which is identified above. The '.'s represent W1 Y1 Y2 Y3 Y4 Y5
|
|
solder spots... Now one thing that is interesting, : : : : : :
|
|
if you notice on the facing up side, there is a : : : : : :
|
|
':' between two of the solder spots. This is their : : : : : :
|
|
Security fuse... Wow, real : : : : : :
|
|
secure. The easiest way FACING DOWN : : : : : :
|
|
to bypass this (or ____________________ __################__
|
|
any you might come | . . . . . . | | ################ |
|
|
across that are the | | | . . . . . . . . |
|
|
same layout), is to | | | | | | | | | | | : |
|
|
simply find out the | %%%%%%% | | ` ` ` ` ` `.` `. |
|
|
pinout assignments, | %%%%%%% | | | | | | . |
|
|
and then connect the | | | | | | | |
|
|
appropriate pins into | . /~~\ | | /~~\ . |
|
|
your EPROM reader (Or | . . . . . \__/ | | \__/ . . . . . |
|
|
use a logic probe that |____________________| |____________________|
|
|
will creat an IBM
|
|
formatted disk which is then read). FACING UP / CONNECTS TO A
|
|
I will hopfully have another mod for this same
|
|
phone, using a very similar setup that connects to the HP 95LX and uses it
|
|
as a real-time psydo-prom (one of the advantages of my operating system for
|
|
the HP).
|
|
|
|
|
|
REPROGRAMMING THE NAM
|
|
~~~~~~~~~~~~~~~~~~~~~
|
|
The Mitsu 800 is like all of the Mitsu family, and can be reprogrammed an
|
|
unlimited amount of times through the handset. Although this procedure has
|
|
been outlined elsewhere, I will go into a little more detail about what
|
|
exactly each option means.
|
|
|
|
To enter programming mode, power up the unit, and hold the (STO)re button
|
|
down, while entering '5474432'. Release (STO)re and it should display the
|
|
following information; remember, press SEND to move to the next option:
|
|
|
|
|
|
OPTIONS DISPLAY DESCRIPTION
|
|
---------------|-----------|---------------------------------------------
|
|
0/1 DUAL Dual number mark (0 = Single / 1 = Dual)
|
|
(xxx)xxx-xxxx NO1 10 Digit Mobile phone number
|
|
xxxxxx SID1 6 Digit Station ID Number (Odd [A] / Even [B])
|
|
0/1 LU1 Local use mark (Preregistration 0 = Disabled
|
|
1 = Enabled)
|
|
0/1 MIN MARK Min Mark
|
|
0333/0334 IPCH Paging Channel (0333 = A / 0334 = B)
|
|
00-15 ACCOLC Access Overload Class
|
|
0/1 PS1 Prefered System for First phone number
|
|
00-15 GI1 GIM Mark for First phone number
|
|
xxxx SECURITY Security code to lock/unload phone
|
|
0/1 EE Use DTMF (0 = External / 1 = Internal)
|
|
0/1 DT Discontinuous Transmittion
|
|
0/1 HF Horn Alert (0 = On / 1 = Off)
|
|
0/1 INHIBIT Roam Inhibit (0 = Able to Roam / 1 = Unable)
|
|
0/1 C TONE Continuous DTMF Tones (0 = Enable / 1 = Disable)
|
|
0/1 SYS A/B System A or B selection (0 = A / 1 = B)
|
|
0/1 DUAL HS Dual Handsets (0 = Disabled / 1 = Enabled)
|
|
0/1 INHIBIT LD Inhibit Long Distance (0 = LD / 1 = No LD)
|
|
---------------|-----------|---------------------------------------------
|
|
|
|
To exit the programming mode, and store the changes, press END. The phone
|
|
will then reset and display all of it's information.
|
|
|
|
|
|
THE IMFAMOUS 800 MOD
|
|
~~~~~~~~~~~~~~~~~~~~
|
|
This peticular mod is unlike most, since the eprom is a 27C256 and has
|
|
little remaining room in it. Also, Mitsubishi scattered their software
|
|
throughout the prom as well, making it even more difficult.
|
|
|
|
The software for this mod is located in the following hex locations:
|
|
|
|
7236H to 7490H
|
|
7500H to 7CF1H
|
|
7D65H to 7EFFH
|
|
|
|
There are also pointer reassignments at the following hex locations:
|
|
|
|
0D0DH 130DH 185AH 285FH 2CCDH
|
|
4C4FH 4E37H 6B2CH
|
|
|
|
Now on to the actually workings of the modification. Installation is
|
|
simple, just replace the existing software eprom with the new modified one,
|
|
and then close the phone back up. Make sure to reconnect ALL of the antenni
|
|
leads, since if you do not, you will have problems.
|
|
|
|
This peticular mod is just the basic roamers scam, which means the phone
|
|
is registered to the local systems (usually the B side) as an out-of-state
|
|
cellular. Then, due to the roamers agreement most of the carriers adhear
|
|
to, it allows you to make overseas, long distance, local, 950, and 800
|
|
(pretty much the whole 9 yards) calls without validation. Now, validation
|
|
is processed once the call is initiated, but they will not normally
|
|
disconnect you when it is discovered. If you get a message which states
|
|
"Welcome to Cellular One", "Cellular service to this phone has been
|
|
temporarily disconnected.", or "Sorry, this number is not registered", then
|
|
simply attempt a new number set. If you happen to live in an area that is
|
|
not 'roam-able' (such as CA, TX, or IL), then you will more than likely only
|
|
be allowed to make local, 950, and 800 calls. If you happen to a connection
|
|
country (Mexico or Canada), you will be allowed to make country-wide calls,
|
|
800, and connecting state calls (i.e. In Canada to Montana, or Mexico to
|
|
Texas). Here's how to active the mod...
|
|
|
|
Power up the phone, and then enter the NAM programming mode, then
|
|
proceed to press [SEND] until you reach the phone number location. Enter an
|
|
OUT OF STATE phone number, and then valid cellular prefix... The last four
|
|
digits are not important, and may remain fixed. Next progress to the ACCOLC
|
|
(Access Over load Class), which is the first part of the tumbled ESN
|
|
(described later). Set this field to 00, and then add one to it every time
|
|
the phone gets deactivated. When you reach 15, set it back to 00 and change
|
|
the security. The last portion of this mod which needs to be changed is the
|
|
SECURITY, which should be set to a number ending with either an 8, 9, or 0.
|
|
Here is the ratio of changes:
|
|
|
|
First to change:
|
|
|
|
ACCESS 6 beeps Change up to 15 times to avoid "service
|
|
suspended" message with 01 through 15
|
|
(Change 100% of the time)
|
|
|
|
Second to change:
|
|
|
|
SECURITY 9 beeps Change after no ACCESS changes work, to avoid
|
|
"welcome to","sorry unregistered" etc messages
|
|
with any 4 digits with 3,5,8,9 or 0 at the end.
|
|
(Change about 60% of the time)
|
|
|
|
Third to change:
|
|
|
|
NUMBER 1 beep Change after no SECURITY changes work with
|
|
one of the above valid area code and prefix
|
|
numbers with any last 4 digits.
|
|
(Change about 30% of the time)
|
|
|
|
Last to change:
|
|
|
|
AREA CODE/PREFIX Change after no NUMBER changes work
|
|
(Change about 10% of the time)
|
|
|
|
I would recommend the following settings for use with either the A or
|
|
the B systems:
|
|
|
|
|
|
DISPLAY A SETTINGS B SETTINGS
|
|
-----------|-------------------|------------------
|
|
DUAL 0 0
|
|
no1 Use list for A Use list for B
|
|
Sid1 00027/00019 00002/00034
|
|
LU1 1 1
|
|
E1 1 1
|
|
IPCH1 0333 0334
|
|
ACCoLC1 00-15 00-15
|
|
PS1 1 0
|
|
G11 10 10 or 12
|
|
SECURITY 0008-9999 0008-9999 (end with 8 or 9)
|
|
EE 1 1
|
|
dt 0 0
|
|
HF 1 1
|
|
InHIbIt 0 0
|
|
C tone 1 1
|
|
SyS Ab 1 1
|
|
dUAL HS 0 0
|
|
InHIbIt Ld 0 0
|
|
-----------|-------------------|------------------
|
|
|
|
|
|
WHAT THE CELLSITE SEES
|
|
~~~~~~~~~~~~~~~~~~~~~~
|
|
This will give you an idea of what exactly you are doing when you change
|
|
any of the information in the NAM programming area. Using this table, it
|
|
would even be feasible to use this phone, like a clone, by simply entering
|
|
in the ESN in the tables method, and then entering the corresponding phone
|
|
number. The full 8 digit hexidecimal ESN is controlled solely by the ACCOLC
|
|
and SECURITY in the program. No other data revealed on the DDI is
|
|
transmitted.
|
|
|
|
SECURITY IS SET ON 1238 AND REMAINS UNCHANGED (positions 4,5,8 & 1)
|
|
|
|
ESN ACCOLC NOTES
|
|
~~~ ~~~~~~ ~~~~~
|
|
1 23 45 67 8 xx 1-8 ESN Digit Positions
|
|
- -- -- -- - --
|
|
8 1F 12 00 3 00 As ACCOLC is changed note pos 6&7 and
|
|
8 20 12 01 3 01 2&3 change as pos 1,4,5,8 remain the
|
|
8 21 12 02 3 02 same.
|
|
8 22 12 03 3 03
|
|
8 23 12 04 3 04
|
|
8 24 12 05 3 05
|
|
8 25 12 06 3 06
|
|
8 26 12 07 3 07
|
|
8 27 12 08 3 08
|
|
8 28 12 09 3 09
|
|
8 29 12 0A 3 10
|
|
8 2A 12 0B 3 11
|
|
8 2B 12 0C 3 12
|
|
8 2C 12 0D 3 13
|
|
8 2D 12 0E 3 14
|
|
8 2E 12 0F 3 15
|
|
|
|
Note while security only affects positions 4,5,8 & 1 respectively the
|
|
changing of the ACCOLC 00-15 changes not only its positions 6 and 7 into its
|
|
hexedecimal equivalents but also steps in sequence positions 2 and 3 through
|
|
1F-2E to correspond to 00-15.
|
|
|
|
ESN DIGIT POSITIONS:
|
|
|
|
MFR: 1 DIGIT 4 OF SECURITY CAN ONLY BE NUMBERS 8,9 OR 0.
|
|
2 CHANGED BY ACCOLC POSITIONS 2&3 TOGETHER 1F-2E
|
|
SN: 3 CHANGED BY ACCOLC POSITIONS 2&3 TOGETHER 1F-2E
|
|
4 DIGIT 1 OF SECURITY CAN BE ANY NUMBER
|
|
5 DIGIT 2 OF SECURITY CAN BE ANY NUMBER
|
|
6 DIGIT 1 OF ACCOLC POSITIONS 6&7 ACCEPT ONLY 00-15
|
|
7 DIGIT 2 OF ACCOLC POSITIONS 6&7 ACCEPT ONLY 00-15
|
|
8 DIGIT 3 OF SECURITY CAN BE ANY NUMBER
|
|
|
|
Security with the following last digit gives the following responses due
|
|
to the fact that the first 2 digits are the manufacturers code and a
|
|
non-valid mfr code yields an improper registration.
|
|
|
|
1,2,3,4,5,6,7 "SORRY NOT PROPERLY REGISTERED FOR SERVICE"
|
|
0,8,9 CONNECTION ALLOWED
|
|
|
|
The following DDI reverse channel log is with the phone number set to
|
|
(617) 571-4590, and Access Overload set to 01, and the Security set to 7418:
|
|
|
|
----- Mobile Request ------
|
|
SAT=2
|
|
Continuous, 25 Mhz BW
|
|
571-4590 (617) Page
|
|
MFR: 82 SN: 074011 (2181513233)
|
|
130 475153
|
|
Dialing: 80055512
|
|
Dialing: 12
|
|
|
|
This should give you a good idea of how the phone could easily be used
|
|
in a clone-type method, although it would have signifigant limits.
|
|
|
|
|
|
MIT800.EXE: THE PROGRAM
|
|
~~~~~~~~~~~~~~~~~~~~~~~
|
|
The executable included along with this will allow you to enter and ESN,
|
|
and then test it for validity in the mod. If it is valid, it will show you
|
|
the proper settings to make the phone. To use this, simply select option
|
|
'1', and then enter the HEX ESN, like 82A92128 (8 chars long), and press
|
|
return. The program will process the data, and output the appropriate
|
|
response.
|
|
|
|
Although this version does not support the DDI scan utility, what it
|
|
will allow you to do is enter a DDI log file, and then the program will
|
|
search through all the reverse channel data and redirect all valid NAM/ESN
|
|
pairs to a designated file. This is especially convienient due to the
|
|
limits set upon the ESN generation.
|
|
|
|
If anyone out there is using something other than the DDI box to recieve
|
|
reverse channel, contact me and I'll make an import filter for that systems
|
|
capture file structure as well.
|
|
|
|
|
|
PHONE SPECIFICATIONS
|
|
~~~~~~~~~~~~~~~~~~~~
|
|
For those who are interested in making more modifications for this very
|
|
versatil phone, here are the TR/RX and power specs:
|
|
|
|
Frequency Channel 824.040 - 848.970 Transmitter
|
|
869.040 - 893.970 Receiver
|
|
Number of Channels 832
|
|
Spacing 30 kHz
|
|
|
|
Power Supply 13.7 VDC +/- 20%
|
|
|
|
Standby Drain 90 mA Approx.
|
|
Transmit Mode at Max 1350 mA Approx.
|
|
|
|
Battery Capacity Standby Transmit Transmit
|
|
1400 mAh Max RF Min RF
|
|
15 Hours 55 Minutes 90 Minutes
|
|
Charge Time 5 Hours
|
|
Battery Operating Temp 0 to +40 C
|
|
Storage Temp -30 to +70 C
|
|
|
|
Power Output 3 Watt @ BNC Connector
|
|
50 ohm impedance
|
|
Power Control 8 levels 4 db Apart
|
|
WATTS
|
|
LEVEL 0 1 2 3 4 5 6 7
|
|
[High] 4.7 1.9 .760 .300 .120 .048 .019 .008
|
|
[Norm] 3.0 1.2 .480 .190 .076 .030 .012 .005
|
|
[Low] 1.2 .480 .190 .076 .030 .012 .005 .003
|
|
|
|
dBm
|
|
LEVEL 0 1 2 3 4 5 6 7
|
|
[High] 36.8 32.8 28.8 24.8 20.8 16.8 12.8 8.8
|
|
[Norm] 34.8 30.8 26.8 22.8 18.8 14.8 10.8 6.8
|
|
[Low] 30.8 26.8 22.8 18.8 14.8 10.8 6.8 2.8
|
|
|
|
Spuriout Output -48 dBc
|
|
|
|
Adjacent Channel Power -25 dB
|
|
Frequency Stability +/- 2.5 PPM
|
|
Audio Distortion -26 dB (5%)
|
|
FM Hum & Noise -32 dB
|
|
Voice Modulation 300 - 3000 Hz
|
|
Compressor 2:1 CCITT
|
|
Pre-Empasis +6 dB per Octave
|
|
Deviation Voice +/- 10.8 kHz +/- 10%
|
|
|
|
Ch. Switching Time 20 ms adjacent channel
|
|
40 ms non-adjacent channel
|
|
Data encoding 10 kb/s Manchester
|
|
SAT Transponsding 5970, 6000, 6030 Hz +/- 1 Hz
|
|
Phase Error +/- 20 Degrees Maximum
|
|
Setting Time 250 ms
|
|
Measuring Time 250 ms
|
|
DTMF Encoder 95 +/- 5ms Tone, Fixed
|
|
Interdigit Time 65 +/- 5ms Minimum
|
|
Voice Suppressed during DTMF
|
|
|
|
|
|
PIN ASSIGNMENTS FOR HANDSET
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
Here are the Pin assignments for the handset, so you can build your own
|
|
RJ-11 interface and skip paying the money-loving cellular companies for one.
|
|
They are fairly straightforward, and if you were successful modifying the
|
|
phone, this should pose little difficulty.
|
|
|
|
NAME PIN IN/OUT SIGNAL TYPE DESCRIPTION
|
|
------------|---|---------|-------------|------------------------------
|
|
RX Audio + 1 OUT AF Balanced 10K ohms
|
|
RX Audio - 2 OUT AF Balanced 10K ohms
|
|
TX Audio 3 IN AF Unbalanced 10K ohms
|
|
Ground 4 N/A N/A N/A
|
|
HS-Outdata 5 OUT LOGIC Serial output data to handset
|
|
HS-Indata 6 IN LOGIC Serial input data from handset
|
|
HS-Power 7 N/A N/A 13.7VDC Handset power
|
|
HS-Off Sns 8 IN N/A ON/OFF Sensativity
|
|
------------|---|---------|-------------|------------------------------
|
|
|
|
I would say that the easiest way in which to figure this out is to
|
|
connect power to pin 7, then splice into 3, and merge 1/2 to a second line
|
|
out. Then take a logic probe, and connect leads to 5 and 6, and monitor the
|
|
interaction between the unit and handset, since this is where the [SEND] and
|
|
[END] will be transmitted. Then it would be feasible to make an interface
|
|
for the serial port (the second port), to trigger the send and end, and
|
|
interface this with a war dialer, etc... Just convienient for those
|
|
unobtrusive scans.
|
|
|
|
|
|
OTHER MODIFICATION SOLUTIONS
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
One other option for all those out there who many or many not want to
|
|
modify the operating software of the phone is Spy Supplies cellular mod
|
|
software. They sell a package that lets you modify the MIN and ESN of about
|
|
75% of the phones that are out (like all the Motorolas, etc). One nice
|
|
thing about this is that it actually changes what the phones ESN is, unlike
|
|
a software mod, in which it simply redirects the phone to look elsewhere it.
|
|
|
|
The package sells for around $500, and if you mention say that I sent
|
|
you he'll knock $50 off of that. This is DEFINANTLY a nice choice for those
|
|
who do not wish to invest the time and money into modifing the peticular
|
|
software, and this is an easy option to cloning. Of course, he only sells
|
|
it so you can reprogram one of your other phones to share the same pair,
|
|
thus eliminating the second bill and just combining the two... And of course
|
|
that's all we intend to do with it, right? He doesn't accept credit cards,
|
|
so don't even think about it (hehehe), and at that price, it's well worth it
|
|
and will pay for itself in less than a month if used wisely.
|
|
|
|
The software is fairly simple and menu driven, altogether totally around
|
|
400k. The package then includes diagrams (I believe he might actually have
|
|
pre made cables available now) to build the interface cables. The all the
|
|
user does is plug the phone in, run the program, enter the data, and wala!
|
|
You're cloned.
|
|
|
|
Spy Supply can be reached at 617-327-7272, 9am-5pm (ET) Monday thru
|
|
Friday. The book he sells is also interesting, although most of the
|
|
information contained within it is already available in other files.
|
|
|
|
|
|
CONCLUSION
|
|
~~~~~~~~~~
|
|
Be watching for my own 'CONSUMER REPORTS' file, which will let you in on
|
|
just how good the name brands stock up in modification, which are pitifly
|
|
easy to modify, and which can hold up through the test of time. Remember, I
|
|
do not take any paid advertising, and am completely unbiased.
|
|
|
|
One shocking bit of news... I finally have an internet address, and FTP
|
|
site! Can you imaging that? And just who was crazy enough to give me one...
|
|
None other than those wacky guys at cDc. Just reach me at
|
|
'videov@zero.cypher.com', or in the 'vindicator' ftp directory.
|
|
|
|
If you have any questions or comments concering this file, then you can
|
|
(as always, and yet never) leave them to be on the systems below. If you
|
|
fucked up you phone while doing this, then you're about the most pitiful
|
|
thing in the world, since you don't have to do anything PERMINANT to the
|
|
phone! As always, I would like to extend greetings out to my faithful
|
|
criminals:
|
|
|
|
DYNASTAR EREKOSE DIGITAL HITLER
|
|
MR DRUNKFUX BOOTLEGGER GRANDMASTER RATTE
|
|
CAPT ZAP FUNKY MONKEY BRUJJO
|
|
KLUDGE GATSBY MAXIMUM OVERDRIVE
|
|
|
|
blah blah blah... Be watching for the return of Scantronics... Yah, that's
|
|
right, Kludge and the boys are back, and still running on a '286 (Just goes
|
|
to show you, hacking doesn't pay, but fraud does). And I would also like to
|
|
thank the demon lord Satan, without whom life would not be possible, and not
|
|
worth living; may the living and the dead hold his name forever in torment.
|
|
And always remember...
|
|
|
|
The Surgeon General warns that using cellulars may cause cancer;
|
|
Ya, right, along with sex, drugs, and about 5,000,000,000 other fun things.
|
|
=============================================================================
|
|
Scantronics [ ... it's coming, it's coming ... ] 96 619-???-????
|
|
Demon Roach [PW: THRASH - NUP: FEAR - cDc - Nuff said ] 24 806-794-4362
|
|
Phunline [Extensive Satellite/Virii Sections ] 96 916-481-2306
|
|
The Stash [My European Connection... Lots of files ] 96 46-498-222113
|
|
Reverse Channel [Drunkfux's Board - cDc - uXu - dFx - HoHo ] 96 713-468-5802
|
|
=============================================================================
|
|
This concludes another wonderful file by Video Vindicator (C)opyright 1993
|
|
=============================================================================
|
|
|