STATION ID - 7047/3.12 9x Datakit Network FOR OFFICIAL USE ONLY This is a 9x system, restricted to authorized persons and for official 9x business only. Anyone using this system, network or data is subject to being monitored at any time for system administration and for identifying unauthorized users or system misuse. Anyone using this system expressly consents to such monitoring and is advised that any evidence of criminal activity revealed through such monitoring may be provided to law enforcement for prosecution. THE ERICSSON HACK FAQ by mastry0da TABLE OF CONTENTS ------------------------------------------------------------------------------------------ 1. Building a programming cable 2. MAX-203 info 3. Max203TTL to 232 convertor design 4. TTL to RS232 convertor pin map 5. Ericsson Accessory Connector Pin-outs 6. TEST MODE 7. Keypad IMEI display 8. In Conclusion... ------------------------------------------------------------------------------------------ 1)Building a programming cable NOTE! You can NOT connect the RS232 directly to the phone, you MUST use a TTL to RS232 converter! Pin 8 DC GND -> ComPort GND Pin 11 RXD (TTL serial data TO phone) -> ComPort TXD Pin 12 TXD (TTL serial data FROM phone) -> ComPort RXD Connect external 5 volts to Pin 9 (FLASH 5/12volts input) (Pin 6 SWDC5 [5 volts out] to pin 9 may also work, but have not tried it) Pin 1 is leftmost pin (near Mic), when looking at the front/bottom. The communications port parameters should be 8 data bits, 1 stop bit, and no parity. Communications speed should be at 9600 bps, but if set for 115200 bps, the phones operations are shown as they are done (i.e. communicating with RBS, reading SIM, etc.), but this special "test" mode descibed here is not available. ---------------------------------------------- RR_ACT_REQ , PLMN = F432 0003 MM state 4 Get FCH on ARFCN = 618 Rxlev = -93 Get SCH on ARFCN = 618 Old TCXO value 128 Intermediate TCXO value 128 New TCXO value 128 FirstPhaseDiff = 1, SecondPhaseDiff = 1 ---------------------------------------------- Power on phone by pressing "NO/ENDpwr". When performing its powerup sequence the phone will send "2". Within 1 second, reply to it by sending the 2 character sequence "0B". The computer will respond "R". At this time, you must send it the sequence contained in the jumpserv.bin. The phone will respond "SP, OK", and the computer should display "R". WARNING! There have been suggestions that reading to and writing from certain locations in memory (specifically the IMEI and SPCK locations) will erase the phones EEPROM! Be Careful! EEWR [address] [value] writes a value to the given address, given in hexadecimal. The following functions can be done with this. I am sure there are many more. These functions require the phone to be turned off, then on again after this programming. EEWR 03EE 01 = enable built-in calculator and RBS info. 00 =disable EEWR 03CF 00 = disable electronic lock, place 00 in all these locations EEWR 03D0 00 = disable electronic lock, place 00 in all these locations EEWR 03D1 00 = disable electronic lock, place 00 in all these locations EEWR 03D2 00 = disable electronic lock, place 00 in all these locations EEWR 03D3 00 = disable electronic lock, place 00 in all these locations EEWR 03D4 00 = disable electronic lock, place 00 in all these locations EEWR 03D5 00 = disable electronic lock, place 00 in all these locations EEWR 03D6 00 = disable electronic lock, place 00 in all these locations EEWR 03D7 00 = disable electronic lock, place 00 in all these locations EEWR 03D8 00 = disable electronic lock, place 00 in all these locations EEWR 03D9 00 = disable electronic lock, place 00 in all these locations EEWR 03DA 00 = disable electronic lock, place 00 in all these locations EERE [address] [number-of-bytes] reads the contents of a single memory address. Pressing G several times gets wierd features - these still need to be mapped. K returns from this mode PRRE is from the GH-337 - does this work on the 388? PRRE [bank] [address] [bytes-to-read] displays the contents of the memory starting at [address]. The value at the end is the checksum for the bytes read. [bank] can be 00 through 7F, [address] can be 0000 through BFFF, and [bytes-to-read] can be 0000 through BFFF. PRRE FF returns the checksum of the entire application. LIME - Learn IMEI. WARNING! There are rumors that this will disable the phone! IMEI - List IMEI. SELF - Self Test? ADCR - ? FLSH - Flash the EEPROM - WARNING: If not used correctly, will WIPE the Phone!! KILL - Exit SP (this programming mode) There is a way to flash the EEPROM, but a special sequence is needed to do this. When I get it I will release it. 2)MAX 203 info The MAX-203 is a one-chip design with no other components neccessary, however that chip is not readily available in all areas. The MAX-232 is more widely available, but the circuit requires a few capacitors. 3)Max203TTL to 232 convertor design Here it is: the MAX203 TTL to 232 converter. It is very easy to build. You only need the MAX203 ic and some wire +5 Volt input | ______|7____ -- | | -- | 2-----conv-->----5 | TTL in | | | | RS-232 out | 1-----conv-->----18| -- | | -- | | -- | | -- | 3---<-conv-------4 | TTL out| | | | RS-232 in | 20--<-conv-------19| -- | | -- | | 12 (10) __| |___ 11 (12) | | | | 17 |__| |___| 15 | | | |___ 16 | | | | |___| 10 (11) |____________| 6| |9 |_____| | GND These are connections for the DIP (SO) package Pin numbers in ( ) are for SO package (SO=Small outline = SMD) e.g. if you have the DIP version you must connect pin 12 with 17, 11 with 15 and 16 with 10. But if you have the SO version you must connect pin 10 instead of 12 with pin 17, 12 with 15 and 16 with 11. Pay attention to that! You can use ttl and 232 input and output as you like, but notice that ttl input on pin 2 corresponds to 232 output on pin 5, ttl in on pin 1 corresponds to 232 out on pin 18, 232 input on pin 4 corresponds to ttl out on pin 3, 232 input on pin 19 corresponds to ttl out on pin 20. The +5V input should probably be regulated. You can use a LM7805 to do that. I hope you have a source for this IC. Or you can buy an IC regulated voltage transformer for $6 or $7 (in Italy £15000) and use it. I use one with output set at 4.5 volts. 4)TTL to RS232 convertor pin map These are circuits taken directly from the Maxim application notes. Give them the credit and hassle. Pinouts: DIP/SO LCC MAX202E/MAX232E MAX232E V C N V G C1+ 1 /--__--. 16 Vcc + 1 C c N V+ 2 | | 15 GND + c D C1- 3 | | 14 T1OUT C2+ 4 | | 13 R1IN 3 2 1 20 19 C2- 5 | | 12 R1OUT C1- 4 18 T1OUT V- 6 | | 11 T1IN T2OUT 7 | | 10 T2IN C2+ 5 17 R1IN R2IN 8 | | 09 R2OUT -------- NC 6 16 NC C2- 7 15 R1OUT V- 8 14 T1IN 9 10 11 12 13 T R N R T 2 2 C 2 2 O I O I U N U N T T The pin numbers in the circuit below refer to the DIP/SO package. With the DIP/SO package, the capacitors are 0.1 micro-farads. With the LCC package, the capacitors are 1.0 micro-farads. +5V IN Pin 6----)|----GND Pin 15----GND | | +----|(--GND Pin 1----|(----Pin 3 | 6.3V +----Pin 16 | Pin 4----|(----Pin 5 +----)|----Pin 2 16V 6.3V TTL In Pin 11 --------> RS-232 Out Pin 14 TTL In Pin 10 --------> RS-232 Out Pin 7 TTL Out Pin 12 <-------- RS-232 In Pin 13 TTL Out Pin 9 <-------- RS-232 In Pin 8 Call Maxim 800-998-8800 for free samples or literature. Maxim Integrated Products 120 San Gabriel Drive Sunnyvale, CA 94086 USA (1) 408-737-7600 http://www.maxim-ic.com 5)Ericsson Accessory Connector Pin-outs 1 Audio input 2 +5V=External Power, 0V=Battery 3 PA Speaker control 4 Audio Ground 5 Audio Output 6 Power-on indicator 7 Charger control 8 Digital/DC GND 9 0V=normal,+5V=test, +12V=test+flash 10 hangup signal 11 TTL serial input 12 TTL serial output 13 Power Toggle (hold low 1 second) 14 DC Power supply IN 6)TEST MODE There seem to be 2 methods of gaining access to test mode in the ericsson GSM models, they are: > * < < * > * displays software version, such as 940810 1310 > * < < * < * displays software version, such as 951024 1054 (most recent?) after entering this mode, the < and > keys scroll through a menu. There seems to be different menus for different versions of software. Software version number are apparently a date and time stamp. 940810 1310 version commands: TEXT CHECK - shows 254 messages in current language FLASH - DO NOT say YES to this, unless you know for sure what you are doing! This will erase your phones program, and you will have to return it to be serviced. INIT EEPROM MMI - resents NVRAM settings. Other, probably more recent version: FLASH - will restart the phone, to the point of entering PIN numbers. 1-ROW TEXTS - scroll through 174 single line text messages with < and > n-ROW-TEXTS - scroll through full-screen messages with < and > 950626 1405 version commands: CXC (number) - CXC means firmware in Ericsson-speak. So the number is a version. PRG - what is this for? 980114 1553 version commands: Texts? - will show all messages in current language ALSO Pressing yes on the screen that shows the version will bring up another menu with options of (use yes to cycle through them instead of < or >): CXC 125056 - software version 125056 PRG - Doesn't anyone know what this is? I'm assuming it means "program" Available on the 951024 1054 software but apparently not on the 940810 1310 or any other for that matter , the sequence: < * * < Responds "Lock to SP?" an anonymous correspondent reports:" You can lock the phone to a specific operator, which means that if You put in a SIMM-card from a different operator, the phone refuses to accept it. To activate/deactivate this lock, you need a special secret code that is not available for the user, or use the cable described above. 7)Keypad IMEI Display By turning on the phone and Dialing the following sequence, the phone will dispay its IMEI: *#06# I am really not sure what legitimate purpose this serves, but it is useful for hackers who wish to clone a phone and have physical access to it. 8)In Conclusion... ericsson has included some very nice (AND FUN!) features into their GSM phones, and many have yet to be found. I recomend playing around with keypad sequences to see what you can find out. ALSO, special thanks to Dr. Who for providing me with some information and fpezza for sending me erisson phone from italy. mastry0da THE ERICSSON HACK FAQ by mastry0da TABLE OF CONTENTS ------------------------------------------------------------------------------------------ 1. Building a programming cable 2. MAX-203 info 3. Max203TTL to 232 convertor design 4. TTL to RS232 convertor pin map 5. Ericsson Accessory Connector Pin-outs 6. TEST MODE 7. Keypad IMEI display 8. In Conclusion... ------------------------------------------------------------------------------------------ 1)Building a programming cable NOTE! You can NOT connect the RS232 directly to the phone, you MUST use a TTL to RS232 converter! Pin 8 DC GND -> ComPort GND Pin 11 RXD (TTL serial data TO phone) -> ComPort TXD Pin 12 TXD (TTL serial data FROM phone) -> ComPort RXD Connect external 5 volts to Pin 9 (FLASH 5/12volts input) (Pin 6 SWDC5 [5 volts out] to pin 9 may also work, but have not tried it) Pin 1 is leftmost pin (near Mic), when looking at the front/bottom. The communications port parameters should be 8 data bits, 1 stop bit, and no parity. Communications speed should be at 9600 bps, but if set for 115200 bps, the phones operations are shown as they are done (i.e. communicating with RBS, reading SIM, etc.), but this special "test" mode descibed here is not available. ---------------------------------------------- RR_ACT_REQ , PLMN = F432 0003 MM state 4 Get FCH on ARFCN = 618 Rxlev = -93 Get SCH on ARFCN = 618 Old TCXO value 128 Intermediate TCXO value 128 New TCXO value 128 FirstPhaseDiff = 1, SecondPhaseDiff = 1 ---------------------------------------------- Power on phone by pressing "NO/ENDpwr". When performing its powerup sequence the phone will send "2". Within 1 second, reply to it by sending the 2 character sequence "0B". The computer will respond "R". At this time, you must send it the sequence contained in the jumpserv.bin. The phone will respond "SP, OK", and the computer should display "R". WARNING! There have been suggestions that reading to and writing from certain locations in memory (specifically the IMEI and SPCK locations) will erase the phones EEPROM! Be Careful! EEWR [address] [value] writes a value to the given address, given in hexadecimal. The following functions can be done with this. I am sure there are many more. These functions require the phone to be turned off, then on again after this programming. EEWR 03EE 01 = enable built-in calculator and RBS info. 00 =disable EEWR 03CF 00 = disable electronic lock, place 00 in all these locations EEWR 03D0 00 = disable electronic lock, place 00 in all these locations EEWR 03D1 00 = disable electronic lock, place 00 in all these locations EEWR 03D2 00 = disable electronic lock, place 00 in all these locations EEWR 03D3 00 = disable electronic lock, place 00 in all these locations EEWR 03D4 00 = disable electronic lock, place 00 in all these locations EEWR 03D5 00 = disable electronic lock, place 00 in all these locations EEWR 03D6 00 = disable electronic lock, place 00 in all these locations EEWR 03D7 00 = disable electronic lock, place 00 in all these locations EEWR 03D8 00 = disable electronic lock, place 00 in all these locations EEWR 03D9 00 = disable electronic lock, place 00 in all these locations EEWR 03DA 00 = disable electronic lock, place 00 in all these locations EERE [address] [number-of-bytes] reads the contents of a single memory address. Pressing G several times gets wierd features - these still need to be mapped. K returns from this mode PRRE is from the GH-337 - does this work on the 388? PRRE [bank] [address] [bytes-to-read] displays the contents of the memory starting at [address]. The value at the end is the checksum for the bytes read. [bank] can be 00 through 7F, [address] can be 0000 through BFFF, and [bytes-to-read] can be 0000 through BFFF. PRRE FF returns the checksum of the entire application. LIME - Learn IMEI. WARNING! There are rumors that this will disable the phone! IMEI - List IMEI. SELF - Self Test? ADCR - ? FLSH - Flash the EEPROM - WARNING: If not used correctly, will WIPE the Phone!! KILL - Exit SP (this programming mode) There is a way to flash the EEPROM, but a special sequence is needed to do this. When I get it I will release it. 2)MAX 203 info The MAX-203 is a one-chip design with no other components neccessary, however that chip is not readily available in all areas. The MAX-232 is more widely available, but the circuit requires a few capacitors. 3)Max203TTL to 232 convertor design Here it is: the MAX203 TTL to 232 converter. It is very easy to build. You only need the MAX203 ic and some wire +5 Volt input | ______|7____ -- | | -- | 2-----conv-->----5 | TTL in | | | | RS-232 out | 1-----conv-->----18| -- | | -- | | -- | | -- | 3---<-conv-------4 | TTL out| | | | RS-232 in | 20--<-conv-------19| -- | | -- | | 12 (10) __| |___ 11 (12) | | | | 17 |__| |___| 15 | | | |___ 16 | | | | |___| 10 (11) |____________| 6| |9 |_____| | GND These are connections for the DIP (SO) package Pin numbers in ( ) are for SO package (SO=Small outline = SMD) e.g. if you have the DIP version you must connect pin 12 with 17, 11 with 15 and 16 with 10. But if you have the SO version you must connect pin 10 instead of 12 with pin 17, 12 with 15 and 16 with 11. Pay attention to that! You can use ttl and 232 input and output as you like, but notice that ttl input on pin 2 corresponds to 232 output on pin 5, ttl in on pin 1 corresponds to 232 out on pin 18, 232 input on pin 4 corresponds to ttl out on pin 3, 232 input on pin 19 corresponds to ttl out on pin 20. The +5V input should probably be regulated. You can use a LM7805 to do that. I hope you have a source for this IC. Or you can buy an IC regulated voltage transformer for $6 or $7 (in Italy £15000) and use it. I use one with output set at 4.5 volts. 4)TTL to RS232 convertor pin map These are circuits taken directly from the Maxim application notes. Give them the credit and hassle. Pinouts: DIP/SO LCC MAX202E/MAX232E MAX232E V C N V G C1+ 1 /--__--. 16 Vcc + 1 C c N V+ 2 | | 15 GND + c D C1- 3 | | 14 T1OUT C2+ 4 | | 13 R1IN 3 2 1 20 19 C2- 5 | | 12 R1OUT C1- 4 18 T1OUT V- 6 | | 11 T1IN T2OUT 7 | | 10 T2IN C2+ 5 17 R1IN R2IN 8 | | 09 R2OUT -------- NC 6 16 NC C2- 7 15 R1OUT V- 8 14 T1IN 9 10 11 12 13 T R N R T 2 2 C 2 2 O I O I U N U N T T The pin numbers in the circuit below refer to the DIP/SO package. With the DIP/SO package, the capacitors are 0.1 micro-farads. With the LCC package, the capacitors are 1.0 micro-farads. +5V IN Pin 6----)|----GND Pin 15----GND | | +----|(--GND Pin 1----|(----Pin 3 | 6.3V +----Pin 16 | Pin 4----|(----Pin 5 +----)|----Pin 2 16V 6.3V TTL In Pin 11 --------> RS-232 Out Pin 14 TTL In Pin 10 --------> RS-232 Out Pin 7 TTL Out Pin 12 <-------- RS-232 In Pin 13 TTL Out Pin 9 <-------- RS-232 In Pin 8 Call Maxim 800-998-8800 for free samples or literature. Maxim Integrated Products 120 San Gabriel Drive Sunnyvale, CA 94086 USA (1) 408-737-7600 http://www.maxim-ic.com 5)Ericsson Accessory Connector Pin-outs 1 Audio input 2 +5V=External Power, 0V=Battery 3 PA Speaker control 4 Audio Ground 5 Audio Output 6 Power-on indicator 7 Charger control 8 Digital/DC GND 9 0V=normal,+5V=test, +12V=test+flash 10 hangup signal 11 TTL serial input 12 TTL serial output 13 Power Toggle (hold low 1 second) 14 DC Power supply IN 6)TEST MODE There seem to be 2 methods of gaining access to test mode in the ericsson GSM models, they are: > * < < * > * displays software version, such as 940810 1310 > * < < * < * displays software version, such as 951024 1054 (most recent?) after entering this mode, the < and > keys scroll through a menu. There seems to be different menus for different versions of software. Software version number are apparently a date and time stamp. 940810 1310 version commands: TEXT CHECK - shows 254 messages in current language FLASH - DO NOT say YES to this, unless you know for sure what you are doing! This will erase your phones program, and you will have to return it to be serviced. INIT EEPROM MMI - resents NVRAM settings. Other, probably more recent version: FLASH - will restart the phone, to the point of entering PIN numbers. 1-ROW TEXTS - scroll through 174 single line text messages with < and > n-ROW-TEXTS - scroll through full-screen messages with < and > 950626 1405 version commands: CXC (number) - CXC means firmware in Ericsson-speak. So the number is a version. PRG - what is this for? 980114 1553 version commands: Texts? - will show all messages in current language ALSO Pressing yes on the screen that shows the version will bring up another menu with options of (use yes to cycle through them instead of < or >): CXC 125056 - software version 125056 PRG - Doesn't anyone know what this is? I'm assuming it means "program" Available on the 951024 1054 software but apparently not on the 940810 1310 or any other for that matter , the sequence: < * * < Responds "Lock to SP?" an anonymous correspondent reports:" You can lock the phone to a specific operator, which means that if You put in a SIMM-card from a different operator, the phone refuses to accept it. To activate/deactivate this lock, you need a special secret code that is not available for the user, or use the cable described above. 7)Keypad IMEI Display By turning on the phone and Dialing the following sequence, the phone will dispay its IMEI: *#06# I am really not sure what legitimate purpose this serves, but it is useful for hackers who wish to clone a phone and have physical access to it. 8)In Conclusion... ericsson has included some very nice (AND FUN!) features into their GSM phones, and many have yet to be found. I recomend playing around with keypad sequences to see what you can find out. ALSO, special thanks to Dr. Who for providing me with some information and fpezza for sending me erisson phone from italy. mastry0da