STATION ID - 7047/3.12 9x Datakit Network FOR OFFICIAL USE ONLY This is a 9x system, restricted to authorized persons and for official 9x business only. Anyone using this system, network or data is subject to being monitored at any time for system administration and for identifying unauthorized users or system misuse. Anyone using this system expressly consents to such monitoring and is advised that any evidence of criminal activity revealed through such monitoring may be provided to law enforcement for prosecution. Undocumented Codes for GSM phones by: m0nty of 9x -[ N O K I A ]- Nokia 1610 and 1611 ~~~~~~~~~~~~~~~~~~~~~~~ o In order to see the IMEI (International Mobile Equipment Identity) type: *#06# Information that you get from the IMEI: XXXXXX XX XXXXXX X TAC FAC SNR SP TAC = Type Approval Code (The 2 first digits are the countrys code) FAC = Final Assembly Code (For Nokia FAC=10 or 20) SNR = Serial Number SP = Spare (the is always 0) o For the firmware revision information type: *#170602112302# Information that you get from the Firmware version: V 05.15 (Software version The last version is V 05.15 date 25-02-97) 25-02-97 (The date that the software was released) Nokia 2110i ~~~~~~~~~~~~~~~ o To view IMEI (International Mobile Equipment Identity) number type: *#06# Information that you get from the IMEI: XXXXXX XX XXXXXX X TAC FAC SNR SP TAC = Type Approval Code (The 2 first digits are the countrys code) FAC = Final Assembly Code (For Nokia FAC=10 or 20) SNR = Serial Number SP = Spare (the is always 0) o To view Week and Year of manufacture enter: *#3283# (which is the same if you type *#DATE#) The last two digits are the year. If the year is 95, the first two digits are the month. For 96 the first two digits are the week of the year. o To view the software version on 2110e / 2110i enter: *#170602112302# or *#9999# On newer phones, the code has been changed to *#682371158412125# Software UPDATED / NEW LASTEST Version V. 5.70 (Not sure about the date) Version V. 5.62 (05-05-97) Version V. 5.31 (06-01-96) The phone should display something like this: V 5.31 (The software Version) 06-01-96 (The date the software was released) NHE-4 (The type of the cellphone) o Service Provider Lock The Service provider (SP) lock is used to lock the cell phone to the SP's SIM card. Once the cell phone is locked to a specific operator, if one inserts a SIM card from a different operator the phone will refuse to accept it. The cell phone will however accept another SIM card from the same operator. All Nokia phones (2110 and newer) have four different SIM locks which can be used to lock the phone for upto 4 different providers. But most phones with restriction only have one lock activated. ( lock 1) The main code used in Nokia phones is: #pw+(master code)+Y# This code is able to check, activate or remove Sim card restriction (SP-lock). Use the * key to get the p, + and w chars. 'Y' has to be 1,2,3 or 4 - depending of what lock you what to deal with. The 4 Lock types: #pw+1234567890+1# for Provider-Lock status #pw+1234567890+2# for Network-Lock status #pw+1234567890+3# for Provider(???)-Lock status #pw+1234567890+4# for SimCard-Lock status (master code) is a 10 digit code, based on the phones IMEI number. NOTICE: If you decide to play with these Locks o Bypass the SP lock With a Nokia 16xx/21xx/31xx/51xx/81xx that are SIMlocked to one provider you can bypass the SP lock like this: 1) Insert sim card of diferent provider. 2) Turn on the phone and press the UP VOLUME key for 3 sec. then release it and the phone says PIN CODE ? 3) Press the "C" key. 4) Then Press * and wait until it desapear and apear again, then press * one more time and 04*PIN*PIN*PIN# The phone now says: PIN CODE CHANGED (or ACCEPTED) and the SIM card is accepted until you restart the phone again. Thanks to CrashOut for the information. o DTMF tones Pressing Menu, then Green Phonebutton allows you to transmitt DTMF tones Nokia 3110 ~~~~~~~~~~~~~~ o In order to see the IMEI type: *#06# Information that you get from the IMEI: XXXXXX XX XXXXXX X TAC FAC SNR SP TAC = Type Approval Code (The 2 first digits are the countrys code) FAC = Final Assembly Code (For Nokia FAC=10 or 20) SNR = Serial Number SP = Spare (the SP is always 0) o For the firmware revision information type: *#3110# Information that you get from the Firmware version: V 07.11 (Software version The last version is V 08.11 date 27-02-98) 24-09-97 (The date that the software was released) NHE-8 (Type of the cellphone) o Things you can do with warranty codes: type: *#92702689# (which is *#war0anty#). When it asks you for a warranty code type: (All warranty codes are followed by the key OK) 6232: for the month and the year that the fone was manufactured 7332: for the date that it was last repaired 7832: for the date that it was purchased 9268: for the serial number (SN) 37832: Set the Purchasing Date MMYY (it can be used only once) 87267: Transfers ALL phone numbers, pictures, sounds from one phone to another. With 6110 u can transfer all data via IRport. o In order to stop the SIM-Clock type: *#746025625# (which is *#sim0clock#) o In order to restore the default settings on the fone type: *#7780# (This doesn't affect the memory or the language) o In order to put the Fast Silent Mode go to menu and type: # This function works on software version v.7.11 and earlier. Nokia 5110 ~~~~~~~~~~~~~~ o In order to see the IMEI type: *#06# Information that you get from the IMEI: XXXXXX XX XXXXXX X TAC FAC SNR SP TAC = Type Approval Code (The 2 first digits are the countrys code) FAC = Final Assembly Code (For Nokia FAC=10 or 20) SNR = Serial Number SP = Spare (the SP is always 0) o For the firmware revision information type: *#0000# V 04.51 (Software version) 26-03-98 (The date of the software release) NSE-1 (Type of the cellphone) o For the Service-Provider's lock the information are the same as in Nokia 2110 except that in earlier than v.5.04 versions the unlocking procedure doesn't work. o Enhanced Full Rate Codec (EFR): Enter *3370# and EFR will be activated after a reboot of the phone ( consumes more power ) Off: Enter #3370# and EFR will be switched off after a reboot of the phone. o Half Rate Codec: Enter *4720# and Half Rate coded will be activated after a reboot of the phone ( better standby time ) Enter #4720# and Half Rate coded will be de-activated after a reboot of the phone NOTICE: Enhanced Full Rate will give you much better sound quality when you enable it. The new Enhanced Full Rate CODEC adopted by GSM uses the ASELP (AlgebraicCode Excitation Linear Prediction) compression technology. This technology allows for much great voice quality in the same number of bits as the older Full Rate CODEC. The older technology was called LPC-RPE (Linear Prediction Coding with Regular Pulse Excitation). Both operate at 13 kilobits.(but you take up more space on the network, so they can charge you more) - Talk-time is reduced with about 5%. Half Rate will give you bad soundquality, which gives the serviceprovider the opportunity to have more calls on the network, and you might get a lower charge from them. - Will give you 30% longer talk-time. o If you hold the key # while you are in the names list, the telephone number can be viewed larger. o Send a SMS full of . (dots) the it'll go crazy when you scroll the received message in your 5110. It doesn't do any permanent damage, it only goes crazy if you scroll the SMS. I'm not sure if it works with all of the software version but it works with 4.59. Doesn't work on SW version 4.53 .. o Build you own Nokia data suite cable: The cable consists of four parts, the RS232 (DB9 Serial) connector, the 3.3volt power supply, the MAX 3232 IC and the phone connector. The RS232 end supplies 12v via pins 4 and 7, through 2 (DI, D2) Schottky barrier diodes to a low power (500ma) 5 volt regulator, the 5v output goes through 3 diodes (D3, D4, D5), each of these diodes drops the voltage by 0.6v, so that about 3.3v is delivered to the MAX3232. The MAX3232 is a 3volt version of the popular MAX232 TTL to RS232 convertor IC, that is used by a number of manufacturers for their interface cables. The 2V7 Zenner diodes hold the TX and RX date lines to the phone at a safe maximum limit of 2.7volts. Note that the capacitor on pin 6 of the IC has it's +ve lead to ground. The hardest part to get hold of might be the phone connector, you might have to utilise a hands free connector.. (Infos gi'auto brika sto www.mobil.cz/telefon/triky/6110/zapojeni.html) Nokia 6110 ~~~~~~~~~~~ o In order to see the IMEI type: *#06# Information that you get from the IMEI: XXXXXX XX XXXXXX X TAC FAC SNR SP TAC = Type Approval Code (The 2 first digits are the countrys code) FAC = Final Assembly Code (For Nokia FAC=10 or 20) SNR = Serial Number SP = Spare (the SP is always 0) o For the firmware revision information type: *#0000# Sometimes the *#6110# works too. Information that you get from the Firmware version: V 3.14 (Software version Last version is V 4.73 date 22-04-98) 28-11-97 (The date that the software was released) NSE-3NX (Type of the cellphone) o For the above information with only one command: *#92702689# This shows in the first line the IMEI then the production date and the date that it was purchased and last the repaired date. It will be something like this: 447402514676390 (the IMEI) Made 1298 (production date) Purchasing date 1298 (self explained) Repaired 0000 (repaired date) o In order to purchase new ringin tones put for SMS center the number +358405202999 and send a SMS with the word TONES in the number 99999 When you'll get an answer EDIT the message that you got (the answer you got) and erase the asterisc (*) only from the name of the melody that you choose. You will receive something like this: tones >.filename .>figaro1 >*flute >*hungaria >*hungary2 >*jbells >*larry >*liberty >*mozart3 Edit the message with the tones that you want. Then send again this message in the number 99999. If you want to send for the liberty theme you will send this: tones >.filename .>liberty After you send this message you will be notified that the phone has received a new ring tone and you can listen to it, save it or discard it. If you save it it will appear as ring tone number 36 in the list with the name Personal. NOTICE: In 6110 you can only store one downloaded tune at a time. Here is a list of the melodies: figaro1 flute hungaria hungary2 jbells (Jingle Bells) larry (Leisure Suit Larry) liberty (Monthy Python theme) mozart3 nacht nutchin nutfair nutmarch nuttrep nutwltz sonatac star washpost o A business card is a special SMS message which is composed as following: //SCKE2 BEGIN:VCARD N:name TEL:number END:VCARD NOTICE: If anyone has information about this please drop me a email o To activate the Enhanched Full Rate (EFR) type: *3370# and then reboot. o To deactivate the Enhanched Full Rate type: #3370# and then reboot. o Call Menu In a call you can press and hold down the menu button for 3 sec. and a menu appears. (trasfer, mute etc.) o You can check if the Sim-Clock can be Stopped only on the version 5.24 by entering *#746025625# (which is *#sim0clock#) o A small bug: when editing a sms the cursor is one character more to the right on the display. o For the Service-Provider's lock the information are the same as in Nokia 2110. o Half Rate Codec: Enter *4720# and Half Rate coded will be activated after a reboot of the phone ( better standby time ) Enter #4720# and Half Rate coded will be de-activated after a reboot of the phone NOTICE: The infos about HRC and EFR are the same as in 5110. o 61XX Serial Cable Build you own Nokia data suite cable: The cable consists of four parts, the RS232 (DB9 Serial) connector, the 3.3volt power supply, the MAX 3232 IC and the phone connector. The RS232 end supplies 12v via pins 4 and 7, through 2 (DI, D2) Schottky barrier diodes to a low power (500ma) 5 volt regulator, the 5v output goes through 3 diodes (D3, D4, D5), each of these diodes drops the voltage by 0.6v, so that about 3.3v is delivered to the MAX3232. The MAX3232 is a 3volt version of the popular MAX232 TTL to RS232 convertor IC, that is used by a number of manufacturers for their interface cables. The 2V7 Zenner diodes hold the TX and RX date lines to the phone at a safe maximum limit of 2.7volts. Note that the capacitor on pin 6 of the IC has it's +ve lead to ground. The hardest part to get hold of might be the phone connector, you might have to utilise a hands free connector.. (Infos gi'auto brika sto www.mobil.cz/telefon/triky/6110/zapojeni.html) Nokia 8110 & 8110i ~~~~~~~~~~~~~~~~~~~~~~ o In order to see the IMEI type: *#06# Information that you get from the IMEI: XXXXXX XX XXXXXX X TAC FAC SNR SP TAC = Type Approval Code (The 2 first digits are the countrys code) FAC = Final Assembly Code (For Nokia FAC=10 or 20) SNR = Serial Number SP = Spare (the SP is always 0) o For the firmware revision information type: *#8110# an example of what you will see: V 24.23 (Software version. The last version is V 34.23 date 22-10-97) 08-08-97 (The date that the software was released) NHE-6 (The type of the cellphone) o Things you can do with warranty codes: type: *#92702689# (which is *#war0anty#). When it asks you for a warranty code type: (All warranty codes are followed by the key OK) 6232: for the month and the year that the fone was manufactured 7332: for the date that it was last repaired 7832: for the date that it was purchased 9268: for the serial number (SN) 37832: in order to set the date that it was bought (it can be used only once) 87267: Transfers ALL phone numbers, pictures, sounds from one phone to another (eg. if broken) with 6110 u can transfer all data via IRport. o For the Service-Provider's lock the information are the same as in Nokia 2110. o New Ring Tones Same as in 6110. o A business card is a special SMS message which is composed as following: //SCKE2 BEGIN:VCARD N:name TEL:number END:VCARD NOTICE: If anyone has information about this please drop me a email o In order see if you can stop the SIM-Clock type: *#746025625# (which is *#sim0clock#) Nokia 9000 & 9000i ~~~~~~~~~~~~~~~~~~~~~~ o In order to see the IMEI type: *#06# Information that you get from the IMEI: XXXXXX XX XXXXXX X TAC FAC SNR SP TAC = Type Approval Code (The 2 first digits are the countrys code) FAC = Final Assembly Code (For Nokia FAC=10 or 20) SNR = Serial Number SP = Spare (the SP is always 0) o For the firmware revision information type: *#682371158412125# an example of what you will see: V. 4.01 (Software Version Last version for the 9000 is V. 4.01 date 15-09-97 Last version for the 9000i is V 6.34 date 16-09-97 15-09-97 (The date that the software was released) GE9 (The type of the cellphone) o To see the week and the year that the phone was manufactured type: *#3283# Other Nokia CellPhones ~~~~~~~~~~~~~~~~~~~~~~~~~~ o Nokia 6120 / 6160 / 6162 (TDMA phones) *#92772689# for checking ISDN number. *3001#12345# for field test mode and nam selection..and some other stuff... *#9999# shows the SoftWare version. o Nokia 6190 *#6190# shows the SW version. *#92772689# (after removing the analog module) shows service menu. *3001#12345[OK] to enter test mode. *#639# to change NAM. o Nokia 6150 *#0000# shows the Software version. *#92702689# to enter servicemenu. *************************************************************************** * * * E R I C S S O N * * * *************************************************************************** ERICSSON 198 ~~~~~~~~~~~~~~~~ o To view IMEI number *#06# o Erase Timers by typing 904060 SEND o Programming mode by typing 923885 . NOTICE: You may have to type these codes in with the function key held down ERICSSON 218/337 ~~~~~~~~~~~~~~~~~~~~ o To view IMEI number *#06# o To view Software Version enter -> * <- <- * <- * CLR (Use with Care) o To activate operator lock <- * * <- (This locks the phone to one carriers SIM card - Use with lots of care) Press Yes to lock and No to notlock. You can also use the codes below to undo this function. USE AT OWN RISK o About Service Provider Lock At least on the 337 there's a submenu: Enter SPCK-code. There are 5 attempts, which is showed (05 attempts). At final attempt the phone beeps as a warning, 'this is the final try', when entering the menu... Wrong code exits the menu, so you are not stuck in something... When you have tried to enter the code (wrong) all five times, the menu is deactivated, and you'll get: 'Not allowed' when entering <-**<- o A "secret test mode" can be accessed on the GH337. There seems to be two methods: > * < < * > * displays software version, such as 940810 1310 > * < < * < * displays software version, such as 951024 1054 After entering this mode, the < and > keys scroll through a menu. There seems to be different menus for different versions of software. Software version number are apparently a date and time stamp. 940810 1310 version commands: TEXT CHECK - shows 254 messages in current language INIT EEPROM MMI - resents NVRAM settings (User Settings). Other, probably more recent version: FLASH - will restart the phone, to the point of entering PIN numbers.You can't kill a 337 when pressing YES while it says "FLASH"(?), you must connect it to 5/12 volts first to be able to erase the flash-memory. 1-ROW TEXTS - scroll through 174 single line text messages with < and > n-ROW-TEXTS - scroll through full-screen messages with < and > 950626 1405 version commands: CXC (number) - The Application software's "product number". The GH337/GF337 is always "CXC 125 005" PRG - Indication for Programming o Programming 337 Set ComPort to 9600bps, 8 data, 1 stop, no parity. Power on phone by pressing "NO/ENDpwr". When performing its powerup sequence the phone will send two ">>" (ASCII 62 decimal) characters. Within 1 second, reply to it by sending the 4 character sequence "TP1". You can use a script to do that. If everything went fine you should get the "OK" prompt back. Test the TEST PROGRAM by sending the commands terminated by a : PROG 0 (shows Test Program product number info) PROG 1 (shows Test Program product date info) PROG 3 (Shows Main Application product number info) PROG D (Shows Main Application product date info) - Programming Calculator and Channel Indicator/RBS - To enable, send the following: EEWR 047A 01 Wait for the OK prompt, power off* the phone and disconnect it from the interface cables. Powerup and browse through the menus. To diasable, send the following: EEWR 047A 00 - Clearing Electronic Lock - To clear the electronic lock you have to clear the EEPROM address range 045B to 0466 by sending the commands: EEWR 045B 00 EEWR 045C 00 EEWR 045D 00 EEWR 045E 00 EEWR 045F 00 EEWR 0460 00 EEWR 0461 00 EEWR 0462 00 EEWR 0463 00 EEWR 0464 00 EEWR 0465 00 EEWR 0466 00 NOTICE: For these you can Download the Procomm Plus Scipt and clear the electronic lock. - Disabling the Service Provider Lock - To disable send the following command: EEWR 1587 00 To enable send the following command: EEWR 1587 01 - Experimental Commands - NOTICE: USE THESE COMMANDS AT YOUR OWN RISC! To dump the application software send the following: PREA
Bank range : 00..7F Address : 0000..BFFF Bytestoread : 0000..BFFF The "additional" value returned at the end are the checksum value for the returned program memory bytes. Note, the byte-values are always returned in format 0000 and NOT 00. PREA FF Returns the application checksum, takes a few seconds. Ericsson PH 337 ~~~~~~~~~~~~~~~~~~~ Some notes on PH377 1. Calculator mode is NOT available on all PH sw versions. 2. Invoking Calc/RBS mode not available for GH337 sw versions below R2A 3. SPCK attempts can be changed to 50 instead of the std 5 tries 4. The instruction LIME returns ERR but does not screw up phone 5. The instruction IMEI returns the IMEI no. 6. Pressing YES in response to FLASH? does screw up the unit. o Pin Outs 1 = In Voice 2 = In +5V=External Power, 0V=Battery 3 = Out Ext Speak control 4 = Analog GND 5 = Out Voice 6 = Out +5V=POWER ON, 0V=POWER OFF 7 = Out Charger control 8 = Digital/DC GND 9 = In 0V=normal,+5V=test, +12V=test+flash 10 = In Hook 11 = In TTL serial in 12 = Out TTL serial out 13 = In 0V for aprox 1 sec = POWER ON/OFF 14 = In DC Power supply ERICSSON 318/388 ~~~~~~~~~~~~~~~~~~~~~ o To view IMEI number *#06# o To view Software Version enter -> * <- <- * <- * CLR o To fine tune sound and clean up any echos, place the 388 into the car kit HF 2600. Then close all windows, engine off and type * # * # 3. The E 388 will fine-tune itself in about a few seconds. o To activate operator lock <- * * <- (This locks the phone to one carriers SIM card - Use with lots of care) Press Yes to lock and No to notlock. You can also use the codes below to undo this function. USE AT OWN RISK o About Service Provider Lock At least on the 337 there's a submenu: Enter SPCK-code. There are 5 attempts, which is showed (05 attempts). At final attempt the phone beeps as a warning, 'this is the final try', when entering the menu... Wrong code exits the menu, so you are not stuck in something... When you have tried to enter the code (wrong) all five times, the menu is deactivated, and you'll get: 'Not allowed' when entering <-**<- o Accessing the Service Program that is not provided with the 388 1. Connect the 388 to Cable with RS232/TTL converter. 2. Set Comport to 9600bps, 8 data, 1 stop, no parity. 3. Power ON, wait for "2" and send "0B" to the phone. DO NOT Press ENTER. 4. R should be on screen. 5. Send TEST.BIN. (Send as a binary file) 6. 388 should answer "SP,OK". 7. R should be on screen. DO NOT write or read from the IMEI or SPCK area! If you try that you can send the phone to service at once, because you will automatically write FE or EF to EVERY cell in the EEPROM. In other words, all the calibration values for the radio is overwritten... (NOT good) Some commands in the ServiceProg: eere read from eeprom eewe write eeprom lime xxxx xxxx xxxx xxx Learn imei no. Returns Error. imei - Displays IMEI number o Programming Channel Indicator or RBS To enable, send the following command: EEWR 3EE 1 Wait for the OK prompt, power off* the phone and disconnect it from the interface cables. Powerup and browse through the menus. To diasable, send the following command: EEWR 3EE 0 o Clearing Electronic Lock To clear the electronic lock you have to clear the EEPROM address range 03CF to 03DA by sending the commands: EEWR 3CF 00 EEWR 3D0 00 EEWR 3D1 00 EEWR 3D2 00 EEWR 3D3 00 EEWR 3D4 00 EEWR 3D5 00 EEWR 3D6 00 EEWR 3D7 00 EEWR 3D8 00 EEWR 3D9 00 EEWR 3DA 00 o Pin Outs 1 In Voice 2 In +5V=External Power, 0V=Battery 3 Out Ext Speak control 4 Analog GND 5 Out Voice 6 Out +5V=POWER ON, 0V=POWER OFF 7 Out Charger control 8 Digital/DC GND 9 In 0V=normal,+5V=test, +12V=test+flash 10 In Hook 11 In TTL serial in 12 Out TTL serial out 13 In 0V for aprox 1 sec = POWER ON/OFF 14 In DC Power supply Ericsson GA 628 ~~~~~~~~~~~~~~~~~~~ o In order to see the IMEI type: *#06# Information that you get from the IMEI: XXXXXX XX XXXXXX X TAC FAC SNR SP TAC = Type Approval Code (The 2 first digits are the countrys code) FAC = Final Assembly Code (For Ericsson FAC=51 ) SNR = Serial Number SP = Spare (the SP is always 0) o In order to change the language back in English: *#0000# o For the firmware revision information type: >*<<*<* Information that you get, an example: CXC125065 (Internal Phone Code) PRG (Firmware version?) 970715 1515 (Date and Time that the software was released) o Service Provider Lock The Service provider (SP) lock is used to lock the cell phone to the SP's SIM card. Once the cell phone is locked to a specific operator, if one inserts a SIM card from a different operator the phone will refuse to accept it. The cell phone will however accept another SIM card from the same operator. To activate/deactivate this lock one needs a special secret code that is not available to the end user. (not even to you, i think so) How to activate this: <**< to view Lock to Network status if pressing yes you have 5 attempts to enter NCK. <**<< Lock to Network subset? if pressing yes you have 5 attempts to enter NSCK. Warning: Your phone can be locked to a service provider FOREVER by doing this!!! If an invalid code is entered all five times, the menu will exit and be deactivated! Any further attempt to activate the NCK/NSCK lock Menu will result in the response "Not allowed". However the NCK/NSCK lock can be recover through a direct clearing in the EEPROM. o Shortcut for Last Dialed call menu If you for some reason don't want to enter the 'Last Dialed calls menu' by using the 'YES' key you can use the following key stroke instead: First '0' then '#'. o To see Extended menus (on older versions) go to MISSED CALLS, empty directory, press and HOLD right arrow button, choose menu type o To see Extended menus (on newer versions) go to READ, empty directory, press and HOLD left arrow button, choose menu type o To edit phone book Turn on extended menus and choose "EditPh.Bk". o Access menu without Sim card To access to the menu in your phone without having a card inside do the following type **04*0000*0000*0000# When display say "Wrong Pin" press NO and you have access to all menus: Info, Access, Settings, Calculator, Clock, Keylock On?, Mail, Phone book. o To fast dial press phone number pos nr and # (Example: 1 5 #) o The following commands are recongnized by the phone. Use 9600 baud, 1 stopbit, 8 data bits, no parity. ATA Pick up phone during ring AT+GMI Manufacturer identification AT+GMO Request model Identification AT+GMR Request revision Identification AT+GMM ATDxxx; Dial number xxx ATH Hangup phone AT+CFUN=? Define levels of fuctionality in the order of power consumed AT+CFUN=0 Switches off the phone AT+CBC Query battery level Each command has to be followed by a 0x0A, 0x0D sequence, that is carriage return - line feed. These commands will be ackowledged with an 'OK' prompt. An incoming call is signalled by the string 'RING' sent by the phone at 9600b in normal mode. o Alarm Clock Menu Go to MissedCall Empty the list Press the -> key for a second or two The option Menu size turns up Choose 'yes' and go from there. o Free phone calls with GA628 ?!?!?!??!?!?!?!?!?!? This works mainly in the pre-paid cards (like ala'carte or B-free or CosmoCarta). Here is what to do: You dial the number you want and you press YES in order to connect. While the phone shows "Connecting" in the screen do the following: Press CLR then 0 then # and then NO (twice) so as to switch OFF the phone. You can then still speak on the phone while it is switched off but the SIM card does not record your calls which will lead to FREE (?) phone calls. NOTICE: From my personal experience i've tried this trick in 5 different GA628 and i had these resaults: 2 of them didn't react at all 1 of them didn't charge me while i was talking with the phone switched off and i had to remove the battery inorder to hang-up 2 of them charged me even when the phone was switced off and i had to remove the battery inorder to hang-up. The reason that i can think of is that they had different software version though i can not say for sure yet. o Yet another trick for free phone calls with GA628 ?!?!?!??!?!?!?!?!?!? You dial the number you want and you press YES in order to connect. While the phone shows "Connecting" in the screen do the following: type 083# the phone should respone "Pos Empty" then you must press NO key untill the phone turns off. This trick worked in 4 from the above 5 GA628 mobiles that i tried it. o Small bug?: After you turn your phone on it asks for the PIN number. When you press the first digit it will be appeared in the screen for less than a second and then the asterisc (*) will take it place. The other digits will appear on the screen as asteriscs (*) which is the normall thing. o Pin Outs As you view it from Bottom, keyboard up, counting from the left: 01 Out Audio from Mobile Station 02 In Audio to Mobile Station 03 In External Analog Audio Accessory Sense. Connect to GND to enable external mike and speaker 04 - Audio Signal Ground, 0V reference 05 In Portable Handsfree. 06 Out Music Mute (to mute e.g. the car radio) High when calling. 07 In Flash Memory Voltage and Service Voltage. Phone enters debugmode when tied to +5V at power-up. 08 Out Logic Reference, Status On. Sources over 100mA. 09 Out Data from Mobile Station. Debug messages appear here at 112KBaud when in debug mode. 10 GND Digital Ground and DC return 11 In Data to Mobile Station 12 I/O DC positive for battery charging (in)/DC for extenal accessory powering (out) NOTICE: All signals seem to be at 5V logic. Most debug messages are text. Like "CB ok!" etc. Debug messages are trailed by 0x0A, 0x0D. Power-up means removal of battery, reconnection of battery, depressure of "NO". Ericsson GH 688 ~~~~~~~~~~~~~~~~~~~ o In order to see the IMEI type: *#06# Information that you get from the IMEI: XXXXXX XX XXXXXX X TAC FAC SNR SP TAC = Type Approval Code (The 2 first digits are the countrys code) FAC = Final Assembly Code (For Ericsson FAC=51 ) SNR = Serial Number SP = Spare (the SP is always 0) o In order to change the language back in English: *#0000# o For the firmware revision information type: >*<<*<* Information that you get, an example: CXC125065 (Internal Phone Code) PRG (Firmware version?) 970715 1515 (Date and Time that the software was released) o Check the phones text programming: Type >*<<*<*> 1-row text strings. If pressing yes you can check the phones text programming in currently selected language. (298 entries) Type >*<<*<*>> n-row text strings. If pressing yes you can check the phones text programming in currently selected language. (? entries) o When you want to go fast in the Last Dialed call menu type: 0# o In order to see the full name of the network: Go in the Network menu and when the fone shows the avaliable networks press the asterisc (*) and the full name of the network will show up. o In order to see the full operator list: Go in the Networks and then in the Edit List. The phone will show "Please Wait" on th screen, when it stops showing this type: < and then press the YES twice. The fone will show the whole list with the keys < > . o In order to see how charged is your battery while your phone is closed press No fast and then wait for about 2 seconds. o Free phone calls with GH688 ?!?!?!??!?!?!?!?!?!? This works mainly in the pre-paid cards (like ala'carte or B-free or CosmoCarta). Here is what to do: You dial the number you want and you press YES in order to connect. While the phone shows "Connecting" in the screen do the following: Press CLR then 0 then # and then NO (twice) so as to switch OFF the phone. You can then still speak on the phone while it is switched off but the SIM card does not record your calls which will lead to FREE (?) phone calls. o Yet another trick for free phone calls with GA628 ?!?!?!??!?!?!?!?!?!? You dial the number you want and you press YES in order to connect. While the phone shows "Connecting" in the screen do the following: type 083# the phone should respone "Pos Empty" then you must press NO key untill the phone turns off. o Small bug?: After you turn your phone on it asks for the PIN number. When you press the first digit it will be appeared in the screen for less than a second and then the asterisc (*) will take it place. The other digits will appear on the screen as asteriscs (*) which is the normall thing. o Pin Outs (These infos where send from an IRC guy, i haven't checked them) 1 = + external power supply 2 = RS232 input (TTL) 3 = GND (digital) 4 = RS232 output (TTL) 5 = +5V output 6 = Test 7 = Mute 8 = Internal/external 9 = GND (analogic) 10 = ? 11 = BF in 12 = BF out Short description 1: it is for best external power supply, to charge the phone battery. The external power supply alone without the phone battery DOES NOT switch on! Suggested voltage 7.2V with 600mA at least. 2: The RS232 serial line input at TTL (0/5V) level. When the phone is on, this pin is at "0" (?!?!?), against any logic. Connect your interface RS232/TTL even if its output is 1!!! 3: GND digital....no comment! 4: It is the RS232 serial out put at level TTL (0/5V). When the phone is switched on this pin is at 1 (this seems logical!). 5: +5V output with phone on. Usable provided that few mA are absorbed. 6: Mode test. As a general rule is at 0. To switch in test mode, switch the cellular off, set the pin at 1 (+5V), switch the phone on.In this mode the serial line works at 115200 instead of the standard 9600. 7: Mute. Normally at 0, it goes at 1 while scrolling or during a conversation. Useful to mute the possible ear breaking radio! 8: if open, the internal microphone and loudspeaker are on. If at 0, the external ones are enabled. 9: GND analogic (no comment). 10: The function of this pin is a mystery. It seems like a microphone and loudspeaker attenuates when at 0. o You can create your own melodies for GF788 GH688 GF768 and SH888 go check http://www.gsmcom.com/mel.html Ericsson GF 788 ~~~~~~~~~~~~~~~~~~~ o In order to see the IMEI type: *#06# Information that you get from the IMEI: XXXXXX XX XXXXXX X TAC FAC SNR SP TAC = Type Approval Code (The 2 first digits are the countrys code) FAC = Final Assembly Code (For Ericsson FAC=51 ) SNR = Serial Number SP = Spare (the SP is always 0) o For the firmware revision information type: >*<<*<* Information that you get, an example: CXC125065 (Internal Phone Code) PRG (Firmware version?) 970715 1515 (Date and Time that the software was released) NOTICE: LASTEST Version is <971128> o Service Provider Lock The Service provider (SP) lock is used to lock the cell phone to the SP's SIM card. Once the cell phone is locked to a specific operator, if one inserts a SIM card from a different operator the phone will refuse to accept it. The cell phone will however accept another SIM card from the same operator. To activate/deactivate this lock one needs a special secret code that is not available to the end user. (not even to you, i think so) How to activate this: <**< Lock to Network? if pressing yes you have 5 attempts to enter NCK. <**<< Lock to Network subset? if pressing yes you have 5 attempts to enter NSCK. Warning: Your phone can be locked to a service provider FOREVER by doing this!!! If an invalid code is entered all five times, the menu will exit and be deactivated! Any further attempt to activate the NCK/NSCK lock Menu will result in the response "Not allowed". However the NCK/NSCK lock can be recover through a direct clearing in the EEPROM. o Shortcut for Last Dialed call menu If you for some reason don't want to enter the 'Last Dialed calls menu' by using the 'YES' key you can use the following key stroke instead: First '0' then '#'. o Access menu without Sim card To access to the menu in your phone without having a card inside do the following type **04*0000*0000*0000# When display say "Wrong Pin" press NO and you have access to all menus: Info, Access, Settings, Calculator, Clock, Keylock On?, Mail, Phone book. o Command set The following commands are recongnized by the phone. Use 9600 baud, 1 stopbit, 8 data bits, no parity. ATA Pick up phone during ring AT+GMI Manufacturer identification AT+GMO Request model Identification AT+GMR Request revision Identification AT+GMM ATDxxx; Dial number xxx ATH Hangup phone AT+CFUN=? Define levels of fuctionality in the order of power consumed AT+CFUN=0 Switches off the phone AT+CBC Query battery level Each command has to be followed by a 0x0A, 0x0D sequence, that is carriage return - line feed. These commands will be ackowledged with an 'OK' prompt. An incoming call is signalled by the string 'RING' sent by the phone at 9600b in normal mode. o Pin Outs Left to right, keyboard up. 1 Audio Out 2 Audio In 3 Accessory Sense. GND to enable External Mic and Speaker (Analog) 4 Audio Signal GND. 5 Portable handsfree In. 6 Music Mute Out, High when phone is used. 7 In Flash Memory Voltage and Service Voltage, In 0V=normal,+5V=test, +12 V=test+flash 8 Logic Out, Status On. Sources over 100mA 9 Data Out from Mobile Station. Debug messages appear here at 112KBaud wh en in debug mode. 10 Digital Ground and DC return 11 Data in 12 DC in for battery charging, DC out for accessory power o Free phone calls with GF788 ?!?!?!??!?!?!?!?!?!? This works mainly in the pre-paid cards (like ala'carte or B-free or CosmoCarta). Here is what to do: You dial the number you want and you press YES in order to connect. While the phone shows "Connecting" in the screen do the following: Press CLR then 0 then # and then NO (twice) so as to switch OFF the phone. You can then still speak on the phone while it is switched off but the SIM card does not record your calls which will lead to FREE (?) phone calls. o Yet another trick for free phone calls with GF728 ?!?!?!??!?!?!?!?!?!? You dial the number you want and you press YES in order to connect. While the phone shows "Connecting" in the screen do the following: type 083# the phone should respone "Pos Empty" then you must press NO key untill the phone turns off. o You can create your own melodies for GF788 GH688 GF768 and SH888 go check http://www.gsmcom.com/mel.html Ericsson 888 ~~~~~~~~~~~~~~~~ o To view IMEI number *#06# o To view Software Version enter * -> * <- <- * <- * (you also get version of InfraRed driver software and text labels) o Pin Outs 1 = + external power supply. 7.2v @ 600mA. 2 = RS232 input (TTL) 3 = GND (digital) 4 = RS232 output (TTL) 5 = +5V output. Limited. 6 = Test. Switch phone off and provide +5V and switch back on. (set comms at 9600, n,8,1) 7 = Mute (0 - Normal, 1 - In Call) 8 = Internal/external (0 - External Mic/Speak, 1 - Internal Mic/Speak) 9 = GND (analog) 10 = Related to Mic/Speak 11 = BF in 12 = BF out *************************************************************************** * * * P H I L I P S * * * *************************************************************************** Philips Genie & Spark & Twist ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ o In order to see the IMEI type: *#06# o In order to see the register status of the phone type: *#2254* an example of what you'll see: C 2 BS 8 RR 0 MMI 0 CREAT. 24 o In order to start and stop the Debug Call Mode type: *#2255*# It will just show you "Activated" or "Deactivated" NOTE: when activated, make a call to a busy line an the phone will display some hex-codes on the screen. o To see how much time that you are connected in the network: *#2558*# an example of what you'll see: 0 day(s) 17 hour(s) 35 minute(s) o In order to re-connect to the network type: *#2562*# o In order to see and change the Security Code of the phone type: *#7489*# It just shows you the Security Code so you just go to the Menu and type 63 in order to get you in the Security Code menu and change it to whatever you desire. o To get information about the SIM card type: *#7378*# an example to see what you'll get: Name: 0 Length: 0 SIM phase: 2 o To get information about the locking of the SIM card type: *#3377*# you'll get something like this: 00000030 00000000 00 IM : 0 LK : 0 - 9 o In order to start and stop the Sleep Mode type: *#7693*# o In order to see information about the Sleep Mode type: *#8463*# you'll get something like this: Wake 7.68 Sleep Req. 3.61 Sleep 621.87 o (NO) BLOCKING - list (15 items) enter: *#3333*# o *#2377*# : "BEER": not clear, the phone waits a random time and reconnects to the net, sometimes the phone makes a reset or something o *#3353*# : resets the (NO) BLOCKING - list *#7378*# : Name, Length, SIM phase o *#7787*# : not clear SPURIOUS INTERRUPT o *#7948*# : SWITCH OFF: not clear; it is a timer or something Philips DIGA ~~~~~~~~~~~~~~ o To view IMEI number *#06# o Connect Time *#2558*# o (No) Blocking List *#3333*# o Init, Flags, Sim Lock *#3377*# o Resets the (No) Blocking List *#3353*# o Displays the Security Code *#7489*# Philips FIZZ ~~~~~~~~~~~~~~ o To view IMEI number *#06# o To view information on the phone *#8377*# "Version : 0916 - EEPROM : 00000000-00 - TDA : 1941 - KISS : 0502" Some phones (probably sim-locked) return also text SIM-LCK at the end of the string o To view security code *#1234*# (1234 is the default code...) "Security code : XXXXX" o Service Code *#5644*# "Version : 09162205 - EEPROM : 0000000-00 - TDA : 1941 - KISS : 0502" o Pin Outs 1 GROUND 2 GROUND 3 HANDS FREE ON/OFF 4 MUTE 5 TX 6 RX 7 RTS 8 REPROGRAMMING 9 ON HOOK CHARGER (APPROX 13V? TO 14V) 10 AUX MIC 11 AUX SPEAKER 12 GROUND 13 +VCC for Car Charger 14 +VCC for Car Charger *************************************************************************** * * * A L C A T E L * * * *************************************************************************** Alcatel One Touch Easy ~~~~~~~~~~~~~~~~~~~~~~~~~ o In order to see the IMEI (International Mobile Equipment Identity) type: *#06# Information that you get from the IMEI: XXXXXX XX XXXXXX X TAC FAC SNR SP TAC = Type Approval Code FAC = Final Assembly Code SNR = Serial Number SP = Spare o To Enter Service Menu type: *#000000# o To view Secret Menu type 000000 then press * o In the Secret Menu After you enter Secret Menu you have these options: ARRETS VIDER ARRETS Press OK and the phone responds: This action is executed! CTRL CHARGE It show the charger voltage and battery voltage. DAMIER display test o IMEI 3300 1453 1139 420 When activated with a Telstra card the Phone boots up with: "PRODUCT CODE" "VAL. => OK" Then we enter 025121992 OK "ENTER SPECIAL CODE" **05* same as Motorola "UNBLOCKING" " PUK ? " 10608CC2*. These two from Vodaphone also work 906081C2* 15900807* "UNBLOCKING" " PIN ? " 0000* "UNBLOCKING" "PIN AGAIN " 0000# It seems that you need to find out the PIN because at this point the phone reboots. o Service Provider Lock The Service provider (SP) lock is used to lock the cell phone to the SP's SIM card. Once the cell phone is locked to a specific operator, if one inserts a SIM card from a different operator the phone will refuse to accept it. The cell phone will however accept another SIM card from the same operator. MANY of these phones are sim locked. This can only be deactivated by getting the special code from Alcatel or your Service Provider. There is a rumor that there is a program floating around the net that allows you to calculate the code from the IMEI, number I have not seen nor verified the existence so it may be untrue . Please do not email me asking for Alcatel codes etc as I will add them to here as soon as I find something. o Removing SP lock on Alcatel Easy You wil need a cable, a eeprom device. Edit the eeprom: Address Replace with ------------- --------------- 176h FFh 177h FFh *************************************************************************** * * * S A G E M * * * *************************************************************************** Sagem CellPhones ~~~~~~~~~~~~~~~~~~~~ Type MENU - 5 - 1 - 1 - # to enter Engineering menu on SAGEM (RC-712) phones. Submenus: 1) IMEI 2) Flash Eeprom etc. 3) ? 4) SP unblock 5) ? 6) Contrast Settings. *************************************************************************** * * * S O N Y * * * *************************************************************************** Sony CMD-Z 1 ~~~~~~~~~~~~~~~~ o In order to see the IMEI type: *#06# Information that you get from the IMEI: XXXXXX XX XXXXXX X TAC FAC SNR SP TAC = Type Approval Code FAC = Final Assembly Code SNR = Serial Number SP = Spare o In order to see the software version and released date type: #8377466# (which is #version#) The above procedure will show on your phone the software version in first row of the display and some CPU and OS info on the second and third one. NOTICE: On earlier version the above tip may not work, but you can try this, In the menu go to PHONE SETTINGS Jog down to: FACTORY SETTINGS and CLICK ONCE You will see a display "Factory Setting Yes No" . Don't do anything with this display, leave it as it is. move the main switch of the phone briefly to the right (briefly means long enough to secure a short electric contact BUT short enough not to switch off the phone!) Now key in the following sequence: # * 0 4 Your display should read the following. Version DSP : A10380 CPU: ce 10294 OS : 1.02.1 ONF Sony CMDX 1000 ~~~~~~~~~~~~~~~~~~ o In order to see the IMEI type: *#06# Information that you get from the IMEI: XXXXXX XX XXXXXX X TAC FAC SNR SP TAC = Type Approval Code FAC = Final Assembly Code SNR = Serial Number SP = Spare o The following procedure will show you the software version: Remove your SIM Card, then press: * # 06 # and finally press: left key o To enter Monitor Mode on Network Option menu: Menu 9 (Phone Options) 7 (Phone Status) [Left Display Button] (left MENU key) 7684666 [HangUp Button] (RedHandSet key) o Service Provider Lock The Service provider (SP) lock is used to lock the cell phone to the SP's SIM card. Once the cell phone is locked to a specific operator, if one inserts a SIM card from a different operator the phone will refuse to accept it. The cell phone will however accept another SIM card from the same operator. o Show Credits Go and view your own number in the phonebook; then delete the number and replace it with +12022243121 then press [OK] a small scenery with palm trees will appear and the names of the people who made the software will scroll upwards ..in some phones you may have to enter a name and then press ok! o Pin Outs 1. Power ( + 9 volt ) 2. Battery charge 3.* Handsfree sos 4. Handsfree extern (10K resistor to +9 to enable handsfree functions) 5.* TXE 6.* RXE 7. Ignition (10K resistor to +9 to illuminate the display continiously) 8. Antenna extern (10K resistor to ground to enable external microphone and antenna) 9.* Audio 1 10. Audio 2 (loudspeaker amplifier output) 11. Microphone (use electrect microfoon and 46 db preamp.) 12. Audio ground (do not connect to 13 and 14 ) 13. Ground (supply) 14. Ground (supply) *************************************************************************** * * * M O T O R O L A * * * *************************************************************************** MOTOROLA CELLPHONES ~~~~~~~~~~~~~~~~~~~~~~~ For Cellphones d460, 2500, 6200 (Flare), 7500, 8200, 8400 & 8700 o To view IMEI (International Mobile Equipment Identity) number enter *#06# (displays IMEI on 8700, But NOT on 6200, 7500, 8200) o Activate RBS (Note: pause means the * key held in until box appears) To activate RBS type: [pause] [pause] [pause] 1 1 3 [pause] 1 [pause] [ok] You now have to press the [MENU] and scroll to the 'Eng Field Options' function with the keys, and enable it. De-activate RBS To de-activate RBS type: [pause] [pause] [pause] 1 1 3 [pause] 0 [pause] [ok] This only works with some versions of software. o What's the use of RBS: Get Distance From Base Station - Place a call, when it is answered, press [MENU] until 'Eng Field Option' is displayed, press [OK], select 'Active Cell', press [OK], press [MENU] until 'Time Adv xxx' appears, where xxx is a number. Multiply this number by 550, and the result is the distance from the RBS (Radio Base Station), in meters. Get Signal Quality - press [MENU] until 'Eng Field Option' is displayed, press [OK], select 'Active Cell', press [OK], press [MENU] until 'C1' appears. This is the signal quality. If it becomes negative for longer than 5 seconds, a new cell is selected. o Pin Outs Motorola Flip Pinout: ANT- (O) | | | | | | | | | | 10 9 8 7 6 5 4 3 2 1 Top of phone (screen) 1) Audio Ground 2) Ext b+ 3) T Data 4) C Data 5) R Data 6) Logic Ground 7) Audio Out - on/off 8) Audio In 9) Manual Test 10) Battery Feedback o TIPS FOR Motorola CD-160 Press menu and type one of these numbers and press OK: 11 = Status Review 13 = Available Networks 14 = Preferred Networks 22 = Select Keypad Tones 25 = Require SIM Card PIN 26 = Language Selection 32 = Repetitive Timer 33 = Single Alert Timer 34 = Set IN-Call Display 35 = Show Call Timers 36 = Show Call Charges 37 = Call Charge Settings 38 = Reset All Timers 43 = Reset All Timers 45 = Show Last Call 46 = Total For All Calls 47 = Lifetime Timer 51 = Change Unlock Code 52 = Master Reset 53 = Master Clear (Warning!! May result in deleting the Message Editor!!!) 54 = New Security Code 55 = Automatic Lock 63 = Battery Saving Mode *************************************************************************** * * * P A N A S O N I C * * * *************************************************************************** Panasonic G500 ~~~~~~~~~~~~~~~~ o To view IMEI number *#06# o PIN OUTS 1 - Ground 2 - TX_Audio 3 - Audio_Ground 4 - HF_ON (L=ON) -> L=H/F ON 5 - AOP_Sense <- Data Adaptor Select 6 - Serial_Up <- UART up (9600,33.8kbps) 7 - Serial_Down -> UART down 8 - External_Power <- POWER FOR CHARGING 9 - Ground 10 - RX_Audio 11 - Radio_Mute -> L=MUTE 12 - HF_Sense <- L=H/F MODE 13 - Reserved L=FLASH WRITE ENABLE 14 - Ignition <- H=ON 15 - Logic_Power -> H=HANDSET ON 16 - PAON -> Power Amplifier Control Signal. *************************************************************************** * * * S I E M E N S * * * *************************************************************************** Siemens S1 / S3 ~~~~~~~~~~~~~~~~~~~ o Tetris: Power on phone and enter PIN. before phone has locked onto network, F9, send own number, hit right button, hit 9. left is 2, right is 8, rotate is 5, and drop is 4. o Monitor Mode: Menu, 9 (Phone Options), 7 (Phone Status), Left Display Button (left MENU key), 5553756, HangUp Button (Red HandSet key) Now "Monitor" should appear at the bottom of the Network Options menu. Pressing the right Display Button when in monitor mode will show a list of the six cells with the strongest signals. o Test Mode Indicators: (* = only available when call in progress ) CH Channel Number RX Signal Strength (dB) N NCC (Color Code) B BCC (Color Code) CI Cell ID (in Hex) C1+ how long before phone does forced hand over. (see RX and RXAM) LAI Location Area Identity. Display Network ID code (42F010 = 240.01) and MSC TXPWR Transmit Power (dB) RXAM Reeceive signal strength cut-off point TS* Time Slot Number TA* Timing Advance. Distance from tower in Km X 2 PL* Power Level Power Table PL: 5 6 7 8 9 10 11 12 13 14 15 dB: 33 31 29 27 25 23 21 19 17 15 13 Watts: 2 1.3 .8 .5 .3 .2 .13 .08 .05 .03 .02 LF* C1 value with continuous transmisson from tower LS* C1 Value with discontinuous tranmission from tower QF* Bit Error Rate with continuous transmission from tower QS* Bit Error Rate with discontinuous transmission from tower BER (bit error rate) table QF/QS register: 0 1 2 3 4 5 6 7 % of bit sent: 0.2 0.8 0.4 1.6 3.2 6.4 12.8 25.6 Siemens S3:comfort ~~~~~~~~~~~~~~~~~~~~~~ o Monitor Mode: The Siemens S3 Com series have a Monitor mode that can be activated directly from the standard user keypad. In order to activate this mode, you must enter the special access code currently programmed into the phone. TO ACTIVATE MONITOR MODE: 1. Turn the phone on. 2. Enter the PIN access code on press OK. (Only if is enabled). 3. Press Menu. (Left top button). 4. Press 9. (Phone Options). 5. Press 8. (Phone Status) (May be button 7 in some phones). You may see your IMEI Number 6. Left Display Button (Top left MENU key). 7. 7684666 8. HangUp Button. (Red HandSet key). Note: Monitor should appear now at the bottom of the Network Options menu. MONITOR MODE Pressing the right Display Button when in monitor mode will toggle into 1 and 2 modes Siemens S4 ~~~~~~~~~~~~~~ o MONITOR MODE The Siemens S4 series have a Monitor mode that can be activated directly from the standard user keypad. In order to activate this mode, you must enter the special access code currently programmed into the phone. TO ACTIVATE MONITOR MODE: Menu, 9 (Phone Options), 7 (Phone Status), Left Display Button (left MENU key), 7684666, HangUp Button (Red HandSet key) Now "Monitor" should appear at the bottom of the Network Options menu. Pressing the right Display Button when in monitor mode will show a list of the six cells with the strongest signals. o Test Mode Indicators: (* = only available when call in progress ) CH Channel Number RX Signal Strength (dB) N NCC (Color Code) B BCC (Color Code) CI Cell ID (in Hex) C1+ how long before phone does forced hand over. (see RX and RXAM) LAI Location Area Identity. Display Network ID code (42F010 = 240.01) and MSC TXPWR Transmit Power (dB) RXAM Reeceive signal strength cut-off point TS* Time Slot Number TA* Timing Advance. Distance from tower in Km X 2 PL* Power Level Power Table PL: 5 6 7 8 9 10 11 12 13 14 15 dB: 33 31 29 27 25 23 21 19 17 15 13 Watts: 2 1.3 .8 .5 .3 .2 .13 .08 .05 .03 .02 LF* C1 value with continuous transmisson from tower LS* C1 Value with discontinuous tranmission from tower QF* Bit Error Rate with continuous transmission from tower QS* Bit Error Rate with discontinuous transmission from tower BER (bit error rate) table QF/QS register: 0 1 2 3 4 5 6 7 % of bit sent: 0.2 0.8 0.4 1.6 3.2 6.4 12.8 25.6 *************************************************************************** * * * M A X O N * * * *************************************************************************** MAXON MX3000 ~~~~~~~~~~~~~~~~ o To view the IMEI number enter: *#06# o To view software version enter: *#9900# o *#9901# Batch o *#9908# Developer Team names o *#9911# L1 Debug on/off o *#9912# Forbidden List o *#9913# bDAC o *#9916# Text (scroll trough with up/down) o *#9917# Service Active o *#9919..9922# Names Maxxon , Audioloop , GCS .. o *#9924# Forced Location Update o *#9931# Backlight off when charging ***********EOF******EOF******EOF******EOF*****EOF*****EOF*****EOF**************