STATION ID - 7047/3.12

9x Datakit Network
FOR OFFICIAL USE ONLY

This is a 9x system, restricted to authorized persons and for
official 9x business only. Anyone using this system, network or data
is subject to being monitored at any time for system administration and
for identifying unauthorized users or system misuse. Anyone using this
system expressly consents to such monitoring and is advised that any
evidence of criminal activity revealed through such monitoring may be
provided to law enforcement for prosecution.

				THE ERICSSON HACK FAQ
								by mastry0da



					TABLE OF CONTENTS
------------------------------------------------------------------------------------------
1. Building a programming cable
2. MAX-203 info
3. Max203TTL to 232 convertor design
4. TTL to RS232 convertor pin map
5. Ericsson Accessory Connector Pin-outs
6. TEST MODE
7. Keypad IMEI display 
8. In Conclusion...
------------------------------------------------------------------------------------------


1)Building a programming cable

NOTE! You can NOT connect the RS232 directly to the phone, you MUST use a TTL to RS232 converter!

        Pin 8   DC GND                           ->  ComPort GND
        Pin 11  RXD (TTL serial data TO phone)   ->  ComPort TXD
        Pin 12  TXD (TTL serial data FROM phone) ->  ComPort RXD



Connect external 5 volts to Pin 9 (FLASH 5/12volts input)
(Pin 6 SWDC5 [5 volts out] to pin 9 may also work, but have not tried it)
Pin 1 is leftmost pin (near Mic), when looking at the front/bottom.


The communications port parameters should be 8 data bits, 1 stop bit, and no parity. Communications speed should be at 9600 bps, but if set for 115200 bps, the phones operations are shown as they are done (i.e. communicating with RBS, reading SIM, etc.), but this special "test" mode descibed here is not available.



  ----------------------------------------------

  RR_ACT_REQ , PLMN = F432 0003
  MM state 4
  Get FCH on ARFCN = 618  Rxlev = -93
  Get SCH on ARFCN = 618
  Old TCXO value 128
  Intermediate TCXO value 128
  New TCXO value 128
  FirstPhaseDiff = 1, SecondPhaseDiff = 1

  ----------------------------------------------

Power on phone by pressing "NO/ENDpwr".
When performing its powerup sequence the phone will send "2".

Within 1 second, reply to it by sending the 2 character sequence "0B". The computer will respond "R". At this time, you must send it the sequence contained in the jumpserv.bin. The phone will respond "SP, OK", and the computer should display "R".


WARNING! There have been suggestions that reading to and writing from certain
locations in memory (specifically the IMEI and SPCK locations) will erase the
phones EEPROM! Be Careful!

EEWR [address] [value]   writes a value to the given address, given in
hexadecimal. The following functions can be done with this. I am sure there are many more. These functions require the phone to be turned off, then on again after this programming.

        EEWR 03EE       01 = enable built-in calculator and RBS info. 00 =disable
        EEWR 03CF       00 = disable electronic lock, place 00 in all these locations
        EEWR 03D0       00 = disable electronic lock, place 00 in all these locations
        EEWR 03D1       00 = disable electronic lock, place 00 in all these locations
        EEWR 03D2       00 = disable electronic lock, place 00 in all these locations
        EEWR 03D3       00 = disable electronic lock, place 00 in all these locations
        EEWR 03D4       00 = disable electronic lock, place 00 in all these locations
        EEWR 03D5       00 = disable electronic lock, place 00 in all these locations
        EEWR 03D6       00 = disable electronic lock, place 00 in all these locations
        EEWR 03D7       00 = disable electronic lock, place 00 in all these locations
        EEWR 03D8       00 = disable electronic lock, place 00 in all these locations
        EEWR 03D9       00 = disable electronic lock, place 00 in all these locations
        EEWR 03DA       00 = disable electronic lock, place 00 in all these locations



EERE [address]  [number-of-bytes] reads the contents of a single memory address.
Pressing G several times gets wierd features - these still need to be mapped. 
K returns from this mode

PRRE is from the GH-337 - does this work on the 388?
PRRE [bank] [address] [bytes-to-read]  displays the contents of the memory starting at 
[address]. The value at the end is the checksum for the bytes read. [bank] can be 00 
through 7F, [address] can be 0000 through BFFF, and [bytes-to-read] can be 0000 through BFFF.
PRRE FF returns the checksum of the entire application.

LIME - Learn IMEI. WARNING! There are rumors that this will disable the phone!
IMEI - List IMEI.
SELF - Self Test?
ADCR - ?
FLSH - Flash the EEPROM - WARNING: If not used correctly, will WIPE the Phone!!
KILL - Exit SP (this programming mode)

There is a way to flash the EEPROM, but a special sequence is needed to 
do this. When I get it I will release it.


2)MAX 203 info

 The MAX-203 is a one-chip design with no other components neccessary, however that chip is not readily available in all areas. The MAX-232 is more widely available, but the circuit requires a few capacitors. 

3)Max203TTL to 232 convertor design
 
Here it is: the MAX203 TTL to 232 converter. It is very easy to build.
You only need the MAX203 ic and some wire

                +5 Volt input
                  |
            ______|7____
        -- |            | --
       | 2-----conv-->----5 |
TTL in |   |            |   | RS-232 out
       | 1-----conv-->----18|
        -- |            | --
           |            |
        -- |            | --
       | 3---<-conv-------4 |
TTL out|   |            |   | RS-232 in
       | 20--<-conv-------19|
        -- |            | --
           |            |
 12 (10) __|            |___ 11 (12)
        |  |            |   |
     17 |__|            |___| 15
           |            |
           |            |___ 16
           |            |   |
           |            |___| 10 (11)
           |____________|
             6|     |9
              |_____|
                 |
                GND

These are connections for the DIP (SO) package
Pin numbers in ( ) are for SO package (SO=Small outline = SMD)

e.g. if you have the DIP version you must connect pin 12 with 17,
11 with 15 and 16 with 10. But if you have the SO version you must connect 
pin 10 instead of 12 with pin 17, 12 with 15 and 16 with 11. Pay 
attention to that!

You can use ttl and 232 input and output as you like, but notice that ttl 
input on pin 2 corresponds to 232 output on pin 5, ttl in on pin 1 
corresponds to 232 out on pin 18, 232 input on pin 4 corresponds to ttl 
out on pin 3, 232 input on pin 19 corresponds to ttl out on pin 20.

The +5V input should probably be regulated. You can use a LM7805 to do 
that. I hope you have a source for this IC. Or you can buy an IC regulated 
voltage transformer for $6 or $7 (in Italy 15000) and use it. I use one 
with output set at 4.5 volts.


4)TTL to RS232 convertor pin map

These are circuits taken directly from the Maxim application notes. Give
them the credit and hassle.

Pinouts:      DIP/SO                               LCC
         MAX202E/MAX232E                         MAX232E


                                                V  C  N  V  G
C1+    1     /--__--.   16    Vcc               +  1  C  c  N
V+     2     |      |   15    GND                  +     c  D
C1-    3     |      |   14    T1OUT                  
C2+    4     |      |   13    R1IN              3  2  1  20 19
C2-    5     |      |   12    R1OUT    C1-  4                  18 T1OUT
V-     6     |      |   11    T1IN
T2OUT  7     |      |   10    T2IN     C2+  5                  17 R1IN
R2IN   8     |      |   09    R2OUT
             --------                  NC   6                  16 NC

                                       C2-  7                  15 R1OUT

                                       V-   8                  14 T1IN
                                                9  10 11 12 13

                                                T  R  N  R  T
                                                2  2  C  2  2
                                                O  I     O  I
                                                U  N     U  N
                                                T        T

The pin numbers in the circuit below refer to the DIP/SO package. With 
the DIP/SO package, the capacitors are 0.1 micro-farads. With the LCC 
package, the capacitors are 1.0 micro-farads.


+5V IN                    Pin 6----)|----GND         Pin 15----GND
|
|
+----|(--GND              Pin 1----|(----Pin 3
|                                 6.3V
+----Pin 16
|                         Pin 4----|(----Pin 5
+----)|----Pin 2                  16V
    6.3V


TTL In Pin 11  -------->  RS-232 Out Pin 14
TTL In Pin 10  -------->  RS-232 Out Pin 7
TTL Out Pin 12 <--------  RS-232 In Pin 13
TTL Out Pin 9  <--------  RS-232 In Pin 8

Call Maxim 800-998-8800 for free samples or literature.
Maxim Integrated Products
120 San Gabriel Drive
Sunnyvale, CA  
94086 
USA
(1) 408-737-7600
http://www.maxim-ic.com


5)Ericsson Accessory Connector Pin-outs

1       Audio input
2       +5V=External Power, 0V=Battery
3       PA Speaker control
4       Audio Ground
5       Audio Output
6       Power-on indicator 
7       Charger control
8       Digital/DC GND
9       0V=normal,+5V=test, +12V=test+flash
10      hangup signal
11      TTL serial input
12      TTL serial output
13      Power Toggle (hold low 1 second)
14      DC Power supply IN


6)TEST MODE

There seem to be 2 methods of gaining access to test mode in the ericsson GSM models, they are:

> * < < * > * displays software version, such as 940810 1310

> * < < * < * displays software version, such as 951024 1054 (most recent?) 

after entering this mode, the < and > keys scroll through a menu. There seems to be different menus for different versions of software.
Software version number are apparently a date and time stamp.

940810 1310 version commands:

TEXT CHECK - shows 254 messages in current language
FLASH - DO NOT say YES to this, unless you know for sure what you are doing! This will erase your phones program, and you will have to return it to
be serviced. 
INIT EEPROM MMI - resents NVRAM settings. 
Other, probably more recent version:
FLASH - will restart the phone, to the point of entering PIN numbers.
1-ROW TEXTS - scroll through 174 single line text messages with < and >
n-ROW-TEXTS - scroll through full-screen messages with < and >


950626 1405 version commands:

CXC (number) - CXC means firmware in Ericsson-speak. So the number is a version.
PRG - what is this for?

980114 1553 version commands:

Texts? - will show all messages in current language
ALSO Pressing yes on the screen that shows the version will bring up another menu with options of (use yes to cycle through them instead of < or >):
CXC 125056 - software version 125056
PRG - Doesn't anyone know what this is? I'm assuming it means "program" 

Available on the 951024 1054 software but apparently not on the 940810 1310 or any other for that matter , the sequence:  
< * * < Responds "Lock to SP?"  
an anonymous correspondent reports:" You can lock the phone to a specific operator, which means that if You put in a SIMM-card from a different operator, the phone refuses to accept it. To activate/deactivate this lock, you need a special secret code that is not available for the user, or use the cable described above. 




7)Keypad IMEI Display

By turning on the phone and Dialing the following sequence, the phone will dispay its IMEI: 

*#06# 

I am really not sure what legitimate purpose this serves, but it is useful for hackers who wish to clone a phone and have physical access to it.


8)In Conclusion...

ericsson has included some very nice (AND FUN!) features into their GSM phones, and many have yet to be found. I recomend playing around with keypad sequences to see what you can find out. ALSO, special thanks to Dr. Who for providing me with
some information and fpezza for sending me erisson phone from italy.

 					mastry0da				THE ERICSSON HACK FAQ
								by mastry0da



					TABLE OF CONTENTS
------------------------------------------------------------------------------------------
1. Building a programming cable
2. MAX-203 info
3. Max203TTL to 232 convertor design
4. TTL to RS232 convertor pin map
5. Ericsson Accessory Connector Pin-outs
6. TEST MODE
7. Keypad IMEI display 
8. In Conclusion...
------------------------------------------------------------------------------------------


1)Building a programming cable

NOTE! You can NOT connect the RS232 directly to the phone, you MUST use a TTL to RS232 converter!

        Pin 8   DC GND                           ->  ComPort GND
        Pin 11  RXD (TTL serial data TO phone)   ->  ComPort TXD
        Pin 12  TXD (TTL serial data FROM phone) ->  ComPort RXD



Connect external 5 volts to Pin 9 (FLASH 5/12volts input)
(Pin 6 SWDC5 [5 volts out] to pin 9 may also work, but have not tried it)
Pin 1 is leftmost pin (near Mic), when looking at the front/bottom.


The communications port parameters should be 8 data bits, 1 stop bit, and no parity. Communications speed should be at 9600 bps, but if set for 115200 bps, the phones operations are shown as they are done (i.e. communicating with RBS, reading SIM, etc.), but this special "test" mode descibed here is not available.



  ----------------------------------------------

  RR_ACT_REQ , PLMN = F432 0003
  MM state 4
  Get FCH on ARFCN = 618  Rxlev = -93
  Get SCH on ARFCN = 618
  Old TCXO value 128
  Intermediate TCXO value 128
  New TCXO value 128
  FirstPhaseDiff = 1, SecondPhaseDiff = 1

  ----------------------------------------------

Power on phone by pressing "NO/ENDpwr".
When performing its powerup sequence the phone will send "2".

Within 1 second, reply to it by sending the 2 character sequence "0B". The computer will respond "R". At this time, you must send it the sequence contained in the jumpserv.bin. The phone will respond "SP, OK", and the computer should display "R".


WARNING! There have been suggestions that reading to and writing from certain
locations in memory (specifically the IMEI and SPCK locations) will erase the
phones EEPROM! Be Careful!

EEWR [address] [value]   writes a value to the given address, given in
hexadecimal. The following functions can be done with this. I am sure there are many more. These functions require the phone to be turned off, then on again after this programming.

        EEWR 03EE       01 = enable built-in calculator and RBS info. 00 =disable
        EEWR 03CF       00 = disable electronic lock, place 00 in all these locations
        EEWR 03D0       00 = disable electronic lock, place 00 in all these locations
        EEWR 03D1       00 = disable electronic lock, place 00 in all these locations
        EEWR 03D2       00 = disable electronic lock, place 00 in all these locations
        EEWR 03D3       00 = disable electronic lock, place 00 in all these locations
        EEWR 03D4       00 = disable electronic lock, place 00 in all these locations
        EEWR 03D5       00 = disable electronic lock, place 00 in all these locations
        EEWR 03D6       00 = disable electronic lock, place 00 in all these locations
        EEWR 03D7       00 = disable electronic lock, place 00 in all these locations
        EEWR 03D8       00 = disable electronic lock, place 00 in all these locations
        EEWR 03D9       00 = disable electronic lock, place 00 in all these locations
        EEWR 03DA       00 = disable electronic lock, place 00 in all these locations



EERE [address]  [number-of-bytes] reads the contents of a single memory address.
Pressing G several times gets wierd features - these still need to be mapped. 
K returns from this mode

PRRE is from the GH-337 - does this work on the 388?
PRRE [bank] [address] [bytes-to-read]  displays the contents of the memory starting at 
[address]. The value at the end is the checksum for the bytes read. [bank] can be 00 
through 7F, [address] can be 0000 through BFFF, and [bytes-to-read] can be 0000 through BFFF.
PRRE FF returns the checksum of the entire application.

LIME - Learn IMEI. WARNING! There are rumors that this will disable the phone!
IMEI - List IMEI.
SELF - Self Test?
ADCR - ?
FLSH - Flash the EEPROM - WARNING: If not used correctly, will WIPE the Phone!!
KILL - Exit SP (this programming mode)

There is a way to flash the EEPROM, but a special sequence is needed to 
do this. When I get it I will release it.


2)MAX 203 info

 The MAX-203 is a one-chip design with no other components neccessary, however that chip is not readily available in all areas. The MAX-232 is more widely available, but the circuit requires a few capacitors. 

3)Max203TTL to 232 convertor design
 
Here it is: the MAX203 TTL to 232 converter. It is very easy to build.
You only need the MAX203 ic and some wire

                +5 Volt input
                  |
            ______|7____
        -- |            | --
       | 2-----conv-->----5 |
TTL in |   |            |   | RS-232 out
       | 1-----conv-->----18|
        -- |            | --
           |            |
        -- |            | --
       | 3---<-conv-------4 |
TTL out|   |            |   | RS-232 in
       | 20--<-conv-------19|
        -- |            | --
           |            |
 12 (10) __|            |___ 11 (12)
        |  |            |   |
     17 |__|            |___| 15
           |            |
           |            |___ 16
           |            |   |
           |            |___| 10 (11)
           |____________|
             6|     |9
              |_____|
                 |
                GND

These are connections for the DIP (SO) package
Pin numbers in ( ) are for SO package (SO=Small outline = SMD)

e.g. if you have the DIP version you must connect pin 12 with 17,
11 with 15 and 16 with 10. But if you have the SO version you must connect 
pin 10 instead of 12 with pin 17, 12 with 15 and 16 with 11. Pay 
attention to that!

You can use ttl and 232 input and output as you like, but notice that ttl 
input on pin 2 corresponds to 232 output on pin 5, ttl in on pin 1 
corresponds to 232 out on pin 18, 232 input on pin 4 corresponds to ttl 
out on pin 3, 232 input on pin 19 corresponds to ttl out on pin 20.

The +5V input should probably be regulated. You can use a LM7805 to do 
that. I hope you have a source for this IC. Or you can buy an IC regulated 
voltage transformer for $6 or $7 (in Italy 15000) and use it. I use one 
with output set at 4.5 volts.


4)TTL to RS232 convertor pin map

These are circuits taken directly from the Maxim application notes. Give
them the credit and hassle.

Pinouts:      DIP/SO                               LCC
         MAX202E/MAX232E                         MAX232E


                                                V  C  N  V  G
C1+    1     /--__--.   16    Vcc               +  1  C  c  N
V+     2     |      |   15    GND                  +     c  D
C1-    3     |      |   14    T1OUT                  
C2+    4     |      |   13    R1IN              3  2  1  20 19
C2-    5     |      |   12    R1OUT    C1-  4                  18 T1OUT
V-     6     |      |   11    T1IN
T2OUT  7     |      |   10    T2IN     C2+  5                  17 R1IN
R2IN   8     |      |   09    R2OUT
             --------                  NC   6                  16 NC

                                       C2-  7                  15 R1OUT

                                       V-   8                  14 T1IN
                                                9  10 11 12 13

                                                T  R  N  R  T
                                                2  2  C  2  2
                                                O  I     O  I
                                                U  N     U  N
                                                T        T

The pin numbers in the circuit below refer to the DIP/SO package. With 
the DIP/SO package, the capacitors are 0.1 micro-farads. With the LCC 
package, the capacitors are 1.0 micro-farads.


+5V IN                    Pin 6----)|----GND         Pin 15----GND
|
|
+----|(--GND              Pin 1----|(----Pin 3
|                                 6.3V
+----Pin 16
|                         Pin 4----|(----Pin 5
+----)|----Pin 2                  16V
    6.3V


TTL In Pin 11  -------->  RS-232 Out Pin 14
TTL In Pin 10  -------->  RS-232 Out Pin 7
TTL Out Pin 12 <--------  RS-232 In Pin 13
TTL Out Pin 9  <--------  RS-232 In Pin 8

Call Maxim 800-998-8800 for free samples or literature.
Maxim Integrated Products
120 San Gabriel Drive
Sunnyvale, CA  
94086 
USA
(1) 408-737-7600
http://www.maxim-ic.com


5)Ericsson Accessory Connector Pin-outs

1       Audio input
2       +5V=External Power, 0V=Battery
3       PA Speaker control
4       Audio Ground
5       Audio Output
6       Power-on indicator 
7       Charger control
8       Digital/DC GND
9       0V=normal,+5V=test, +12V=test+flash
10      hangup signal
11      TTL serial input
12      TTL serial output
13      Power Toggle (hold low 1 second)
14      DC Power supply IN


6)TEST MODE

There seem to be 2 methods of gaining access to test mode in the ericsson GSM models, they are:

> * < < * > * displays software version, such as 940810 1310

> * < < * < * displays software version, such as 951024 1054 (most recent?) 

after entering this mode, the < and > keys scroll through a menu. There seems to be different menus for different versions of software.
Software version number are apparently a date and time stamp.

940810 1310 version commands:

TEXT CHECK - shows 254 messages in current language
FLASH - DO NOT say YES to this, unless you know for sure what you are doing! This will erase your phones program, and you will have to return it to
be serviced. 
INIT EEPROM MMI - resents NVRAM settings. 
Other, probably more recent version:
FLASH - will restart the phone, to the point of entering PIN numbers.
1-ROW TEXTS - scroll through 174 single line text messages with < and >
n-ROW-TEXTS - scroll through full-screen messages with < and >


950626 1405 version commands:

CXC (number) - CXC means firmware in Ericsson-speak. So the number is a version.
PRG - what is this for?

980114 1553 version commands:

Texts? - will show all messages in current language
ALSO Pressing yes on the screen that shows the version will bring up another menu with options of (use yes to cycle through them instead of < or >):
CXC 125056 - software version 125056
PRG - Doesn't anyone know what this is? I'm assuming it means "program" 

Available on the 951024 1054 software but apparently not on the 940810 1310 or any other for that matter , the sequence:  
< * * < Responds "Lock to SP?"  
an anonymous correspondent reports:" You can lock the phone to a specific operator, which means that if You put in a SIMM-card from a different operator, the phone refuses to accept it. To activate/deactivate this lock, you need a special secret code that is not available for the user, or use the cable described above. 




7)Keypad IMEI Display

By turning on the phone and Dialing the following sequence, the phone will dispay its IMEI: 

*#06# 

I am really not sure what legitimate purpose this serves, but it is useful for hackers who wish to clone a phone and have physical access to it.


8)In Conclusion...

ericsson has included some very nice (AND FUN!) features into their GSM phones, and many have yet to be found. I recomend playing around with keypad sequences to see what you can find out. ALSO, special thanks to Dr. Who for providing me with
some information and fpezza for sending me erisson phone from italy.

 					mastry0da
