STATION ID - 7047/3.12

9x Datakit Network
FOR OFFICIAL USE ONLY

This is a 9x system, restricted to authorized persons and for
official 9x business only. Anyone using this system, network or data
is subject to being monitored at any time for system administration and
for identifying unauthorized users or system misuse. Anyone using this
system expressly consents to such monitoring and is advised that any
evidence of criminal activity revealed through such monitoring may be
provided to law enforcement for prosecution.


                     Undocumented Codes for GSM phones
                              by: m0nty of 9x




                        -[    N   O   K   I   A   ]-

			Nokia 1610 and 1611
                      ~~~~~~~~~~~~~~~~~~~~~~~
 o In order to see the IMEI (International Mobile Equipment Identity)
      type:    *#06#
   Information that you get from the IMEI: 
     XXXXXX  XX  XXXXXX  X
     TAC    FAC  SNR    SP

     TAC = Type Approval Code (The 2 first digits are the countrys code)
     FAC = Final Assembly Code (For Nokia FAC=10 or 20)
     SNR = Serial Number
     SP = Spare (the is always 0)
 

 o For the firmware revision information type: *#170602112302#
   Information that you get from the Firmware version:
     V 05.15   (Software version
                The last version is V 05.15 date 25-02-97)
     25-02-97  (The date that the software was released)

 
			Nokia 2110i 
                      ~~~~~~~~~~~~~~~ 		

o  To view IMEI (International Mobile Equipment Identity) number 
     type: *#06#
   Information that you get from the IMEI:
     XXXXXX  XX  XXXXXX  X
     TAC    FAC  SNR    SP

     TAC = Type Approval Code (The 2 first digits are the countrys code)
     FAC = Final Assembly Code (For Nokia FAC=10 or 20)
     SNR = Serial Number
     SP = Spare (the is always 0)

o  To view Week and Year of manufacture enter:
     
         *#3283#  (which is the same if you type *#DATE#)

   The last two digits are the year. If the year is 95, the first two
   digits are the month. For 96 the first two digits are the week of 
   the year.

o  To view the software version on 2110e / 2110i enter: 
    
       *#170602112302#   or   *#9999#

   On newer phones, the code has been changed to *#682371158412125#
   Software UPDATED / NEW

   LASTEST  Version V. 5.70 (Not sure about the date)

   Version V. 5.62 (05-05-97)

   Version V. 5.31 (06-01-96)

   The phone should display something like this:
     V 5.31   (The software Version)
     06-01-96 (The date the software was released)
     NHE-4    (The type of the cellphone)        

o   Service Provider Lock
   The Service provider (SP) lock is used to lock the cell phone to the
   SP's SIM card. Once the cell phone is locked to a specific operator,
   if one inserts a SIM card from a different operator the phone will 
   refuse to accept it. The cell phone will however accept another SIM 
   card from the same operator.

   All Nokia phones (2110 and newer) have four different SIM locks which
   can be used to lock the phone for upto 4 different providers. But most 
   phones with restriction only have one lock activated. ( lock 1)
   The main code used in Nokia phones is:

   #pw+(master code)+Y#

   This code is able to check, activate or remove Sim card restriction
   (SP-lock).

   Use the * key to get the p, + and w chars.

   'Y' has to be 1,2,3 or 4 - depending of what lock you what to deal with.

   The 4 Lock types:
   #pw+1234567890+1# for Provider-Lock status
   #pw+1234567890+2# for Network-Lock status
   #pw+1234567890+3# for Provider(???)-Lock status
   #pw+1234567890+4# for SimCard-Lock status

   (master code) is a 10 digit code, based on the phones IMEI number.
   NOTICE: If you decide to play with these Locks 

o  Bypass the SP lock
   With a Nokia 16xx/21xx/31xx/51xx/81xx that are SIMlocked to one
   provider you can bypass the SP lock like this:

   1) Insert sim card of diferent provider.
   2) Turn on the phone and press the UP VOLUME key for 3 sec. then
   release it and the phone says PIN CODE ?
   3) Press the "C" key.
   4) Then Press * and wait until it desapear and apear again, then press
      * one more time and 04*PIN*PIN*PIN#

   The phone now says: PIN CODE CHANGED (or ACCEPTED)
   and the SIM card is accepted until you restart the phone again.
   Thanks to CrashOut for the information.

o  DTMF tones
   Pressing Menu, then Green Phonebutton allows you to transmitt DTMF
   tones


			   Nokia 3110
                         ~~~~~~~~~~~~~~
o In order to see the IMEI type: *#06#
  Information that you get from the IMEI:
    XXXXXX  XX  XXXXXX  X
    TAC    FAC  SNR    SP

    TAC = Type Approval Code (The 2 first digits are the countrys code)
    FAC = Final Assembly Code (For Nokia FAC=10 or 20)
    SNR = Serial Number
    SP = Spare (the SP is always 0)
 
o For the firmware revision information type: *#3110#
  Information that you get from the Firmware version:
    V 07.11  (Software version
              The last version is V 08.11 date 27-02-98)
    24-09-97 (The date that the software was released)
    NHE-8    (Type of the cellphone)

o Things you can do with warranty codes: type: *#92702689# 
  (which is *#war0anty#). When it asks you for a warranty code type: 
  (All warranty codes are followed by the key OK)
    6232: for the month and the year that the fone was manufactured
    7332: for the date that it was last repaired
    7832: for the date that it was purchased
    9268: for the serial number (SN)
   37832: Set the Purchasing Date MMYY (it can be used only once)
   87267: Transfers ALL phone numbers, pictures, sounds from one
   phone to another. With 6110 u can transfer all data via IRport.

o In order to stop the SIM-Clock type: *#746025625# (which is *#sim0clock#)

o In order to restore the default settings on the fone type: *#7780#
  (This doesn't affect the memory or the language)

o In order to put the Fast Silent Mode go to menu and type: #
  This function works on software version v.7.11 and earlier.


			Nokia 5110
                      ~~~~~~~~~~~~~~
o  In order to see the IMEI type: *#06#
   Information that you get from the IMEI:
     XXXXXX  XX  XXXXXX  X
     TAC    FAC  SNR    SP

     TAC = Type Approval Code (The 2 first digits are the countrys code)
     FAC = Final Assembly Code (For Nokia FAC=10 or 20)
     SNR = Serial Number
     SP = Spare (the SP is always 0)

o  For the firmware revision information type: *#0000#   	
    V 04.51   (Software version)
    26-03-98  (The date of the software release)
    NSE-1     (Type of the cellphone)

o  For the Service-Provider's lock the information are the same as in
   Nokia 2110 except that in earlier than v.5.04 versions the unlocking
   procedure doesn't work.

o  Enhanced Full Rate Codec (EFR):
   Enter *3370# and EFR will be activated after a reboot of the phone
   ( consumes more power )
   Off: Enter #3370# and EFR will be switched off after a reboot of the
   phone.

o  Half Rate Codec:
   Enter *4720# and Half Rate coded will be activated after a reboot
   of the phone ( better standby time )
   Enter #4720# and Half Rate coded will be de-activated after a
   reboot of the phone
NOTICE: Enhanced Full Rate will give you much better sound quality when
   you enable it. The new Enhanced Full Rate CODEC adopted by GSM uses the
   ASELP (AlgebraicCode Excitation Linear Prediction) compression
   technology. This technology allows for much great voice quality in the
   same number of bits as the older Full Rate CODEC. The older technology
   was called LPC-RPE (Linear Prediction Coding with Regular Pulse
   Excitation). Both operate at 13 kilobits.(but you take up more space
   on the network, so they can charge you more) - Talk-time is reduced
   with about 5%.
     Half Rate will give you bad soundquality, which gives the
   serviceprovider the opportunity to have more calls on the network, and
   you might get a lower charge from them. - Will give you 30% longer
   talk-time.

o  If you hold the key # while you are in the names list, the telephone
   number can be viewed larger.

o  Send a SMS full of . (dots) the it'll go crazy when you scroll the
   received message in your 5110. It doesn't do any permanent damage,
   it only goes crazy if you scroll the SMS. I'm not sure if it works 
   with all of the software version but it works with 4.59. Doesn't work 
   on SW version 4.53 ..

o  Build you own Nokia data suite cable:
   The cable consists of four parts, the RS232 (DB9 Serial) connector,
   the 3.3volt power supply, the MAX 3232 IC and the phone connector.

   The RS232 end supplies 12v via pins 4 and 7, through 2 (DI, D2)
   Schottky barrier diodes to a low power (500ma) 5 volt regulator, the
   5v output goes through 3 diodes (D3, D4, D5), each of these diodes
   drops the voltage by 0.6v, so that about 3.3v is delivered to the
   MAX3232.

   The MAX3232 is a 3volt version of the popular MAX232 TTL to RS232
   convertor IC, that is used by a number of manufacturers for their
   interface cables. The 2V7 Zenner diodes hold the TX and RX date lines
   to the phone at a safe maximum limit of 2.7volts. Note that the
   capacitor on pin 6 of the IC has it's +ve lead to ground.

   The hardest part to get hold of might be the phone connector, you
   might have to utilise a hands free connector..

(Infos gi'auto brika sto  www.mobil.cz/telefon/triky/6110/zapojeni.html)


			Nokia 6110
		       ~~~~~~~~~~~ 
o In order to see the IMEI type: *#06#
  Information that you get from the IMEI:
    XXXXXX  XX  XXXXXX  X
    TAC    FAC  SNR    SP

    TAC = Type Approval Code (The 2 first digits are the countrys code)
    FAC = Final Assembly Code (For Nokia FAC=10 or 20)
    SNR = Serial Number
    SP = Spare (the SP is always 0)

o For the firmware revision information type: *#0000#
  Sometimes the *#6110# works too.
  Information that you get from the Firmware version:
    V 3.14   (Software version
              Last version is V 4.73 date 22-04-98)
    28-11-97 (The date that the software was released)
    NSE-3NX  (Type of the cellphone)
  
o For the above information with only one command: *#92702689#
  This shows in the first line the IMEI then the production date 
  and the date that it was purchased and last the repaired date. 
  It will be something like this: 
    447402514676390        (the IMEI)
    Made 1298              (production date)
    Purchasing date 1298   (self explained)
    Repaired 0000	  (repaired date)

o  In order to purchase new ringin tones put for SMS center the number 
  +358405202999 and send a SMS with the word TONES in the number 99999
  When you'll get an answer EDIT the message that you got (the answer you
  got) and erase the asterisc (*) only from the name of the melody that 
  you choose. You will receive something like this:
            tones
           ><Vconf:
           beeps.conf
           ><Vnumber:
           +Your_Phone_Number_Here
           Select ringtone
           >.filename
           .>figaro1
           >*flute
           >*hungaria
           >*hungary2
           >*jbells
           >*larry
           >*liberty
           >*mozart3

  Edit the message with the tones that you want. 
  Then send again this message in the number 99999. 
  If you want to send for the liberty theme you will send this:

           tones
           ><Vconf:
           beeps.conf
           ><Vnumber:
           +Your_Phone_Number_Here
           Select ringtone
           >.filename
           .>liberty
 
  After you send this message you will be notified that the phone has 
  received a new ring tone and you can listen to it, save it or discard it.
  If you save it it will appear as ring tone number 36 in the list with
  the name Personal. 
NOTICE: In 6110 you can only store one downloaded tune at a time.

  Here is a list of the melodies:
   figaro1          
   flute            
   hungaria        
   hungary2       
   jbells             (Jingle Bells)
   larry              (Leisure Suit Larry)
   liberty            (Monthy Python theme)
   mozart3        
   nacht          
   nutchin          
   nutfair            
   nutmarch       
   nuttrep          
   nutwltz          
   sonatac         
   star               
   washpost       

o  A business card is a special SMS message which is composed as following:
   //SCKE2 BEGIN:VCARD N:name TEL:number END:VCARD
NOTICE: If anyone has information about this please drop me a email
   

o  To activate the Enhanched Full Rate (EFR) type: *3370# and then reboot.

o  To deactivate the Enhanched Full Rate type: #3370# and then reboot.

o  Call Menu
   In a call you can press and hold down the menu button for 3 sec. and
   a menu appears. (trasfer, mute etc.)

o  You can check if the Sim-Clock can be Stopped only on the version 5.24
   by entering *#746025625# (which is *#sim0clock#)

o  A small bug: when editing a sms the cursor is one character more to 
   the right on the display.

o  For the Service-Provider's lock the information are the same as in
   Nokia 2110.

o  Half Rate Codec:
   Enter *4720# and Half Rate coded will be activated after a reboot
   of the phone ( better standby time )
   Enter #4720# and Half Rate coded will be de-activated after a
   reboot of the phone
NOTICE: The infos about HRC and EFR are the same as in 5110.

o  61XX Serial Cable
   Build you own Nokia data suite cable:
   The cable consists of four parts, the RS232 (DB9 Serial) connector,
   the 3.3volt power supply, the MAX 3232 IC and the phone connector.

   The RS232 end supplies 12v via pins 4 and 7, through 2 (DI, D2)
   Schottky barrier diodes to a low power (500ma) 5 volt regulator, the
   5v output goes through 3 diodes (D3, D4, D5), each of these diodes
   drops the voltage by 0.6v, so that about 3.3v is delivered to the
   MAX3232.

   The MAX3232 is a 3volt version of the popular MAX232 TTL to RS232
   convertor IC, that is used by a number of manufacturers for their
   interface cables. The 2V7 Zenner diodes hold the TX and RX date lines
   to the phone at a safe maximum limit of 2.7volts. Note that the
   capacitor on pin 6 of the IC has it's +ve lead to ground.

   The hardest part to get hold of might be the phone connector, you
   might have to utilise a hands free connector..
(Infos gi'auto brika sto  www.mobil.cz/telefon/triky/6110/zapojeni.html)

   

			Nokia 8110 & 8110i
		      ~~~~~~~~~~~~~~~~~~~~~~
o In order to see the IMEI type: *#06#
  Information that you get from the IMEI:
    XXXXXX  XX  XXXXXX  X
    TAC    FAC  SNR    SP

    TAC = Type Approval Code (The 2 first digits are the countrys code)
    FAC = Final Assembly Code (For Nokia FAC=10 or 20)
    SNR = Serial Number
    SP = Spare (the SP is always 0)

o For the firmware revision information type: *#8110#
  an example of what you will see: 
    V 24.23   (Software version. 
               The last version is V 34.23 date 22-10-97)
    08-08-97  (The date that the software was released)
    NHE-6     (The type of the cellphone)

o Things you can do with warranty codes: type: *#92702689#
  (which is *#war0anty#). When it asks you for a warranty code type:
  (All warranty codes are followed by the key OK)
    6232: for the month and the year that the fone was manufactured
    7332: for the date that it was last repaired
    7832: for the date that it was purchased
    9268: for the serial number (SN)
   37832: in order to set the date that it was bought (it can be used
          only once)
   87267: Transfers ALL phone numbers, pictures, sounds from one
   phone to another (eg. if broken) with 6110 u can transfer all data via
   IRport. 

o  For the Service-Provider's lock the information are the same as in
   Nokia 2110.

o New Ring Tones Same as in 6110.

o  A business card is a special SMS message which is composed as following:
   //SCKE2 BEGIN:VCARD N:name TEL:number END:VCARD
NOTICE: If anyone has information about this please drop me a email




o In order see if you can stop the SIM-Clock type: *#746025625# 
  (which is *#sim0clock#)
  
 
			Nokia 9000 & 9000i
                      ~~~~~~~~~~~~~~~~~~~~~~
o In order to see the IMEI type: *#06#
  Information that you get from the IMEI:
    XXXXXX  XX  XXXXXX  X
    TAC    FAC  SNR    SP

    TAC = Type Approval Code (The 2 first digits are the countrys code)
    FAC = Final Assembly Code (For Nokia FAC=10 or 20)
    SNR = Serial Number
    SP = Spare (the SP is always 0)

o For the firmware revision information type: *#682371158412125#
  an example of what you will see:
    V. 4.01    (Software Version
                Last version for the 9000 is V. 4.01 date 15-09-97
                Last version for the 9000i is V 6.34 date 16-09-97
    15-09-97   (The date that the software was released)
    GE9        (The type of the cellphone)

o To see the week and the year that the phone was manufactured 
  type: *#3283#


                      Other Nokia CellPhones
                    ~~~~~~~~~~~~~~~~~~~~~~~~~~
o Nokia 6120 / 6160 / 6162 (TDMA phones) 
   *#92772689# for checking ISDN number.
   *3001#12345# for field test mode and nam selection..and some other
   stuff...
   *#9999# shows the SoftWare version.

o Nokia 6190
   *#6190# shows the SW version.
   *#92772689# (after removing the analog module) shows service menu.
   *3001#12345[OK] to enter test mode.
   *#639# to change NAM.

o Nokia 6150
   *#0000# shows the Software version.
   *#92702689# to enter servicemenu.
 

***************************************************************************
*                                                                         *
*                    E  R  I  C  S  S  O  N                               *
*                                                                         *
***************************************************************************

 

                        ERICSSON 198
                      ~~~~~~~~~~~~~~~~
o To view IMEI number *#06#

o Erase Timers by typing 904060 <FUNCTION> <FUNCTION> SEND

o Programming mode by typing 923885 <FUNCTION> <FUNCTION>.

NOTICE: You may have to type these codes in with the function key held down


			ERICSSON 218/337
                      ~~~~~~~~~~~~~~~~~~~~
o To view IMEI number *#06#

o To view Software Version enter -> * <- <- * <- * CLR (Use with Care)

o  To activate operator lock <- * * <- (This locks the phone to one
   carriers SIM card - Use with lots of care)
   Press Yes to lock and No to notlock. You can also use the codes below
   to undo this function. USE AT OWN RISK

o About Service Provider Lock 
   At least on the 337 there's a
   submenu: Enter SPCK-code. There are 5 attempts, which is showed (05
   attempts). At final attempt the phone beeps as a warning, 'this is the
   final try', when entering the menu... Wrong code exits the menu, so
   you are not stuck in something... When you have tried to enter the
   code (wrong) all five times, the menu is deactivated, and you'll get:
   'Not allowed' when entering <-**<-

o  A "secret test mode" can be accessed on the GH337. There seems to be
   two methods:

   > * < < * > * displays software version, such as 940810 1310

   > * < < * < * displays software version, such as 951024 1054

   After entering this mode, the < and > keys scroll through a menu.
   There seems to be different menus for different versions of software.
   Software version number are apparently a date and time stamp.
   940810 1310 version commands:
   TEXT CHECK - shows 254 messages in current language
   INIT EEPROM MMI - resents NVRAM settings (User Settings).
   Other, probably more recent version:
   FLASH - will restart the phone, to the point of entering PIN
   numbers.You can't kill a 337 when pressing YES while it says "FLASH"(?),
   you must connect it to 5/12 volts first to be able to erase the
   flash-memory.
   1-ROW TEXTS - scroll through 174 single line text messages with < and >
   n-ROW-TEXTS - scroll through full-screen messages with < and >
   950626 1405 version commands:
   CXC (number) - The Application software's "product number". The
   GH337/GF337 is always "CXC 125 005"
   PRG - Indication for Programming


o Programming 337 
   Set ComPort to 9600bps, 8 data, 1 stop, no parity.

   Power on phone by pressing "NO/ENDpwr".
   When performing its powerup sequence the phone will send two ">>"
   (ASCII 62 decimal) characters. Within 1 second, reply to it by
   sending the 4 character sequence "TP1<CR>".
   You can use a script to do that.

   If everything went fine you should get the "OK" prompt back.
   Test the TEST PROGRAM by sending the commands terminated by a <CR>:
   PROG 0 (shows Test Program product number info)
   PROG 1 (shows Test Program product date info)
   PROG 3 (Shows Main Application product number info)
   PROG D (Shows Main Application product date info)

            -  Programming Calculator and Channel Indicator/RBS -
   To enable, send the following:
   EEWR 047A 01
   Wait for the OK prompt, power off* the phone and disconnect it from
   the interface cables. Powerup and browse through the menus.
   To diasable, send the following:
   EEWR 047A 00

                        -  Clearing Electronic Lock -
   To clear the electronic lock you have to clear the EEPROM address
   range 045B to 0466 by sending the commands:
   EEWR 045B 00
   EEWR 045C 00
   EEWR 045D 00
   EEWR 045E 00
   EEWR 045F 00
   EEWR 0460 00
   EEWR 0461 00
   EEWR 0462 00
   EEWR 0463 00
   EEWR 0464 00
   EEWR 0465 00
   EEWR 0466 00
NOTICE: For these you can Download the Procomm Plus Scipt and clear the 
        electronic lock.


                  - Disabling the Service Provider Lock -
   To disable send the following command:
   EEWR 1587 00
   To enable send the following command:
   EEWR 1587 01

 	
                   - Experimental Commands - 
NOTICE: USE THESE COMMANDS AT YOUR OWN RISC!
   To dump the application software send the following:
   PREA <bank> <address> <bytestoread>
Bank range :    00..7F
Address :       0000..BFFF
Bytestoread :   0000..BFFF
   The "additional" value returned at the end are the checksum value for
   the returned program memory bytes. Note, the byte-values are always
   returned in format 0000 and NOT 00.
   PREA FF
   Returns the application checksum, takes a few seconds.


			Ericsson PH 337
                      ~~~~~~~~~~~~~~~~~~~
Some notes on PH377
   1. Calculator mode is NOT available on all PH sw versions.
   2. Invoking Calc/RBS mode not available for GH337 sw versions below
   R2A
   3. SPCK attempts can be changed to 50 instead of the std 5 tries
   4. The instruction LIME returns ERR but does not screw up phone
   5. The instruction IMEI returns the IMEI no.
   6. Pressing YES in response to FLASH? does screw up the unit.
 
o Pin Outs
1  = In Voice
2  = In +5V=External Power, 0V=Battery
3  = Out Ext Speak control
4  = Analog GND
5  = Out Voice
6  = Out +5V=POWER ON, 0V=POWER OFF
7  = Out Charger control
8  = Digital/DC GND
9  = In 0V=normal,+5V=test, +12V=test+flash
10 = In Hook
11 = In TTL serial in
12 = Out TTL serial out
13 = In 0V for aprox 1 sec = POWER ON/OFF
14 = In DC Power supply


			ERICSSON 318/388
                     ~~~~~~~~~~~~~~~~~~~~~
o To view IMEI number *#06#

o To view Software Version enter -> * <- <- * <- * CLR

o To fine tune sound and clean up any echos, place the 388 into the car
   kit HF 2600.
   Then close all windows, engine off and type * # * # 3. The E 388 will
   fine-tune itself in about a few seconds.

o  To activate operator lock <- * * <- (This locks the phone to one
   carriers SIM card - Use with lots of care)
   Press Yes to lock and No to notlock. You can also use the codes below
   to undo this function. USE AT OWN RISK

o About Service Provider Lock
   At least on the 337 there's a
   submenu: Enter SPCK-code. There are 5 attempts, which is showed (05
   attempts). At final attempt the phone beeps as a warning, 'this is the
   final try', when entering the menu... Wrong code exits the menu, so
   you are not stuck in something... When you have tried to enter the
   code (wrong) all five times, the menu is deactivated, and you'll get:
   'Not allowed' when entering <-**<-

o Accessing the Service Program that is not provided with the 388
   1. Connect the 388 to Cable with RS232/TTL converter.
   2. Set Comport to 9600bps, 8 data, 1 stop, no parity.
   3. Power ON, wait for "2" and send "0B" to the phone. DO NOT Press
   ENTER.
   4. R should be on screen.
   5. Send TEST.BIN. (Send as a binary file)
   6. 388 should answer "SP,OK".
   7. R should be on screen.

   DO NOT write or read from the IMEI or SPCK area! If you try that you
   can send the phone to service at once, because you will automatically
   write FE or EF to EVERY cell in the EEPROM. In other words, all the
   calibration values for the radio is overwritten... (NOT good)

   Some commands in the ServiceProg:

   eere <startADR> <NoBytes> read from eeprom

   eewe <adr> <value> write eeprom

   lime xxxx xxxx xxxx xxx Learn imei no. Returns Error.

   imei - Displays IMEI number

o Programming Channel Indicator or RBS
   To enable, send the following command:
   EEWR 3EE 1
   Wait for the OK prompt, power off* the phone and disconnect it from
   the interface cables. Powerup and browse through the menus.
   To diasable, send the following command:
   EEWR 3EE 0

o Clearing Electronic Lock
   To clear the electronic lock you have to clear the EEPROM address
   range 03CF to 03DA by sending the commands:

   EEWR 3CF 00
   EEWR 3D0 00
   EEWR 3D1 00
   EEWR 3D2 00
   EEWR 3D3 00
   EEWR 3D4 00
   EEWR 3D5 00
   EEWR 3D6 00
   EEWR 3D7 00
   EEWR 3D8 00
   EEWR 3D9 00
   EEWR 3DA 00


o Pin Outs

1       In Voice
2       In +5V=External Power, 0V=Battery
3       Out Ext Speak control
4       Analog GND
5       Out Voice
6       Out +5V=POWER ON, 0V=POWER OFF
7       Out Charger control
8       Digital/DC GND
9       In 0V=normal,+5V=test, +12V=test+flash
10      In Hook
11      In TTL serial in
12      Out TTL serial out
13      In 0V for aprox 1 sec = POWER ON/OFF
14      In DC Power supply



			Ericsson GA 628
                      ~~~~~~~~~~~~~~~~~~~
o In order to see the IMEI type: *#06#
  Information that you get from the IMEI:
    XXXXXX  XX  XXXXXX  X
    TAC    FAC  SNR    SP

    TAC = Type Approval Code (The 2 first digits are the countrys code)
    FAC = Final Assembly Code (For Ericsson FAC=51 )
    SNR = Serial Number
    SP = Spare (the SP is always 0)
 
o In order to change the language back in English: *#0000#
 
o For the firmware revision information type: >*<<*<*
  Information that you get, an example:
CXC125065        (Internal Phone Code)
PRG              (Firmware version?)          
970715 1515      (Date and Time that the software was released)

o  Service Provider Lock
   The Service provider (SP) lock is used to lock the cell phone to the
   SP's SIM card. Once the cell phone is locked to a specific operator,
   if one inserts a SIM card from a different operator the phone will
   refuse to accept it. The cell phone will however accept another SIM
   card from the same operator.

   To activate/deactivate this lock one needs a special secret code that
   is not available to the end user. (not even to you, i think so)
   How to activate this:

   <**< to view Lock to Network status if pressing yes you have 5 attempts
   to enter NCK.

   <**<< Lock to Network subset? if pressing yes you have
   5 attempts to enter NSCK.

   Warning: Your phone can be locked to a service provider FOREVER by
   doing this!!! If an invalid code is entered all five times, the menu 
   will exit and be deactivated! Any further attempt to activate the 
   NCK/NSCK lock Menu will result in the response "Not allowed". 
   However the NCK/NSCK lock can be recover through a direct clearing
   in the EEPROM.

o Shortcut for Last Dialed call menu
   If you for some reason don't want to enter the 'Last Dialed
   calls menu' by using the 'YES' key you can use the following
   key stroke instead: First '0' then '#'.

o To see Extended menus (on older versions) go to MISSED CALLS, empty
   directory, press and HOLD right arrow button, choose menu type

o To see Extended menus (on newer versions) go to READ, empty directory,
   press and HOLD left arrow button, choose menu type

o To edit phone book Turn on extended menus and choose "EditPh.Bk".

o Access menu without Sim card
   To access to the menu in your phone without having a card inside do
   the following type 
   **04*0000*0000*0000# 
   When display say "Wrong Pin" press NO and you have access to all 
   menus: Info, Access, Settings, Calculator, Clock, Keylock On?, Mail, 
   Phone book.

o  To fast dial press phone number pos nr and # (Example: 1 5 #)

o  The following commands are recongnized by the phone.
   Use 9600 baud, 1 stopbit, 8 data bits, no parity.
   ATA Pick up phone during ring
   AT+GMI Manufacturer identification
   AT+GMO Request model Identification
   AT+GMR Request revision Identification
   AT+GMM
   ATDxxx; Dial number xxx
   ATH Hangup phone
   AT+CFUN=? Define levels of fuctionality in the order of power consumed
   AT+CFUN=0 Switches off the phone
   AT+CBC Query battery level
   Each command has to be followed by a 0x0A, 0x0D sequence, that is
   carriage return - line feed. These commands will be ackowledged with
   an 'OK' prompt. An
   incoming call is signalled by the string 'RING' sent by the phone at
   9600b in normal mode.

o Alarm Clock Menu
   Go to MissedCall
   Empty the list
   Press the -> key for a second or two
   The option Menu size turns up
   Choose 'yes' and go from there.

o Free phone calls with GA628 ?!?!?!??!?!?!?!?!?!?
  This works mainly in the pre-paid cards (like ala'carte or B-free or 
  CosmoCarta). Here is what to do:
   You dial the number you want and you press YES in order to connect.
    While the phone shows "Connecting" in the screen do the following:
            Press CLR then 0 then # and then NO (twice) 
            so as to switch OFF the phone.
    You can then still speak on the phone while it is switched off but
    the SIM card does not record your calls which will lead to FREE (?)
    phone calls.
NOTICE: From my personal experience i've tried this trick in 5 different
      GA628 and i had these resaults: 
      2 of them didn't react at all
      1 of them didn't charge me while i was talking with the phone switched
        off and i had to remove the battery inorder to hang-up
      2 of them charged me even when the phone was switced off and i had to
        remove the battery inorder to hang-up.
    The reason that i can think of is that they had different software
    version though i can not say for sure yet.

o Yet another trick for free phone calls with GA628 ?!?!?!??!?!?!?!?!?!?
  You dial the number you want and you press YES in order to connect.
  While the phone shows "Connecting" in the screen do the following:
      type 083# 
      the phone should respone "Pos Empty"
      then you must press NO key untill the phone turns off.
  This trick worked in 4 from the above 5 GA628 mobiles that i tried it.

o Small bug?:
  After you turn your phone on it asks for the PIN number. When you press
  the first digit it will be appeared in the screen for less than a second
  and then the asterisc (*) will take it place. The other digits will 
  appear on the screen as asteriscs (*) which is the normall thing.

o Pin Outs
  As you view it from Bottom, keyboard up, counting from the left:
   01 Out Audio from Mobile Station
   02 In Audio to Mobile Station
   03 In External Analog Audio Accessory Sense. Connect to GND to enable
   external mike and speaker
   04 - Audio Signal Ground, 0V reference
   05 In Portable Handsfree.
   06 Out Music Mute (to mute e.g. the car radio) High when calling.
   07 In Flash Memory Voltage and Service Voltage. Phone enters debugmode
   when tied to +5V at power-up.
   08 Out Logic Reference, Status On. Sources over 100mA.
   09 Out Data from Mobile Station. Debug messages appear here at
   112KBaud when in debug mode.
   10 GND Digital Ground and DC return
   11 In Data to Mobile Station
   12 I/O DC positive for battery charging (in)/DC for extenal accessory
   powering (out)

NOTICE: All signals seem to be at 5V logic. Most debug messages are text.
   Like "CB ok!" etc. Debug messages are trailed by 0x0A, 0x0D. Power-up means
   removal of battery, reconnection of battery, depressure of "NO".
 

			

			Ericsson GH 688
                      ~~~~~~~~~~~~~~~~~~~
o In order to see the IMEI type: *#06#
  Information that you get from the IMEI:
    XXXXXX  XX  XXXXXX  X
    TAC    FAC  SNR    SP

    TAC = Type Approval Code (The 2 first digits are the countrys code)
    FAC = Final Assembly Code (For Ericsson FAC=51 )
    SNR = Serial Number
    SP = Spare (the SP is always 0)
 
o In order to change the language back in English: *#0000#

o For the firmware revision information type: >*<<*<*
  Information that you get, an example:
    CXC125065    (Internal Phone Code)
    PRG          (Firmware version?)
    970715 1515  (Date and Time that the software was released)

o  Check the phones text programming:
   Type  >*<<*<*> 1-row text strings. 
   If pressing yes you can check the phones text programming in 
   currently selected language. (298 entries)
 
   Type >*<<*<*>> n-row text strings. 
   If pressing yes you can check the phones text programming in 
   currently selected language. (? entries)
   
o When you want to go fast in the Last Dialed call menu type: 0#

o In order to see the full name of the network: Go in the Network menu and 
  when the fone shows the avaliable networks press the asterisc (*) and 
  the full name of the network will show up.

o In order to see the full operator list: Go in the Networks and then in the
  Edit List. The phone will show "Please Wait" on th screen, when it stops
  showing this type: < and then press the YES twice. The fone will show
  the whole list with the keys < > .

o In order to see how charged is your battery while your phone is closed
  press No fast and then wait for about 2 seconds.

o Free phone calls with GH688 ?!?!?!??!?!?!?!?!?!?
  This works mainly in the pre-paid cards (like ala'carte or B-free or
  CosmoCarta). Here is what to do:
   You dial the number you want and you press YES in order to connect.
    While the phone shows "Connecting" in the screen do the following:
            Press CLR then 0 then # and then NO (twice)
            so as to switch OFF the phone.
    You can then still speak on the phone while it is switched off but
    the SIM card does not record your calls which will lead to FREE (?)
    phone calls.

o Yet another trick for free phone calls with GA628 ?!?!?!??!?!?!?!?!?!?
  You dial the number you want and you press YES in order to connect.
  While the phone shows "Connecting" in the screen do the following:
      type 083#
      the phone should respone "Pos Empty"
      then you must press NO key untill the phone turns off.

o Small bug?:
  After you turn your phone on it asks for the PIN number. When you press
  the first digit it will be appeared in the screen for less than a second
  and then the asterisc (*) will take it place. The other digits will
  appear on the screen as asteriscs (*) which is the normall thing.

o Pin Outs (These infos where send from an IRC guy, i haven't checked them)
   1 = + external power supply
   2 = RS232 input (TTL)
   3 = GND (digital)
   4 = RS232 output (TTL)
   5 = +5V output
   6 = Test
   7 = Mute
   8 = Internal/external
   9 = GND (analogic)
   10 = ?
   11 = BF in
   12 = BF out

   Short description
   1: it is for best external power supply, to charge the phone battery.
   The external power supply alone without the phone battery DOES NOT
   switch on!
   Suggested voltage 7.2V with 600mA at least.

   2: The RS232 serial line input at TTL (0/5V) level.
   When the phone is on, this pin is at "0" (?!?!?), against any logic.
   Connect your interface RS232/TTL even if its output is 1!!!

   3: GND digital....no comment!

   4: It is the RS232 serial out put at level TTL (0/5V). When the
   phone is switched on this pin is at 1 (this seems logical!).

   5: +5V output with phone on. Usable provided that few mA are absorbed.

   6: Mode test. As a general rule is at 0. To switch in test mode,
   switch the
   cellular off, set the pin at 1 (+5V), switch the phone on.In this mode
   the serial
   line works at 115200 instead of the standard 9600.

   7: Mute. Normally at 0, it goes at 1 while scrolling or during a
   conversation.
   Useful to mute the possible ear breaking radio!

   8: if open, the internal microphone and loudspeaker are on. If at 0,
   the external
   ones are enabled.

   9: GND analogic (no comment).

   10: The function of this pin is a mystery. It seems like a microphone
   and
   loudspeaker attenuates when at 0.

o You can create your own melodies for GF788 GH688 GF768 and SH888
  go check http://www.gsmcom.com/mel.html


			Ericsson GF 788
                      ~~~~~~~~~~~~~~~~~~~
o In order to see the IMEI type: *#06#
  Information that you get from the IMEI:
    XXXXXX  XX  XXXXXX  X
    TAC    FAC  SNR    SP

    TAC = Type Approval Code (The 2 first digits are the countrys code)
    FAC = Final Assembly Code (For Ericsson FAC=51 )
    SNR = Serial Number
    SP = Spare (the SP is always 0)

o For the firmware revision information type: >*<<*<*
  Information that you get, an example:
  CXC125065        (Internal Phone Code)
  PRG              (Firmware version?)
  970715 1515      (Date and Time that the software was released)
NOTICE: LASTEST  Version is <971128>

o  Service Provider Lock
   The Service provider (SP) lock is used to lock the cell phone to the
   SP's SIM card. Once the cell phone is locked to a specific operator,
   if one inserts a SIM card from a different operator the phone will
   refuse to accept it. The cell phone will however accept another SIM
   card from the same operator.

   To activate/deactivate this lock one needs a special secret code that
   is not available to the end user. (not even to you, i think so)
   How to activate this:

   <**< Lock to Network? if pressing yes you have 5 attempts
   to enter NCK.

   <**<< Lock to Network subset? if pressing yes you have
   5 attempts to enter NSCK.

   Warning: Your phone can be locked to a service provider FOREVER by
   doing this!!! If an invalid code is entered all five times, the menu
   will exit and be deactivated! Any further attempt to activate the
   NCK/NSCK lock Menu will result in the response "Not allowed".
   However the NCK/NSCK lock can be recover through a direct clearing
   in the EEPROM.

o Shortcut for Last Dialed call menu
   If you for some reason don't want to enter the 'Last Dialed
   calls menu' by using the 'YES' key you can use the following
   key stroke instead: First '0' then '#'.

o Access menu without Sim card
   To access to the menu in your phone without having a card inside do
   the following type
   **04*0000*0000*0000#
   When display say "Wrong Pin" press NO and you have access to all
   menus: Info, Access, Settings, Calculator, Clock, Keylock On?, Mail,
   Phone book.

o Command set
  The following commands are recongnized by the phone.
  Use 9600 baud, 1 stopbit, 8 data bits, no parity.
   ATA Pick up phone during ring
   AT+GMI Manufacturer identification
   AT+GMO Request model Identification
   AT+GMR Request revision Identification
   AT+GMM
   ATDxxx; Dial number xxx
   ATH Hangup phone
   AT+CFUN=? Define levels of fuctionality in the order of power consumed
   AT+CFUN=0 Switches off the phone
   AT+CBC Query battery level
   Each command has to be followed by a 0x0A, 0x0D sequence, that is
   carriage return - line feed. These commands will be ackowledged with
   an 'OK' prompt. An
   incoming call is signalled by the string 'RING' sent by the phone at
   9600b in normal mode.


o Pin Outs
Left to right, keyboard up.
1       Audio Out
2       Audio In
3       Accessory Sense. GND to enable External Mic and Speaker (Analog)
4       Audio Signal GND.
5       Portable handsfree In.
6       Music Mute Out, High when phone is used.
7       In Flash Memory Voltage and Service Voltage, In 0V=normal,+5V=test,
+12
V=test+flash
8       Logic Out, Status On. Sources over 100mA
9       Data Out from Mobile Station. Debug messages appear here at 112KBaud
wh
en in debug mode.
10      Digital Ground and DC return
11      Data in
12      DC in for battery charging, DC out for accessory power

o Free phone calls with GF788 ?!?!?!??!?!?!?!?!?!?
  This works mainly in the pre-paid cards (like ala'carte or B-free or
  CosmoCarta). Here is what to do:
   You dial the number you want and you press YES in order to connect.
    While the phone shows "Connecting" in the screen do the following:
            Press CLR then 0 then # and then NO (twice)
            so as to switch OFF the phone.
    You can then still speak on the phone while it is switched off but
    the SIM card does not record your calls which will lead to FREE (?)
    phone calls.

o Yet another trick for free phone calls with GF728 ?!?!?!??!?!?!?!?!?!?
  You dial the number you want and you press YES in order to connect.
  While the phone shows "Connecting" in the screen do the following:
      type 083#
      the phone should respone "Pos Empty"
      then you must press NO key untill the phone turns off.

o You can create your own melodies for GF788 GH688 GF768 and SH888
  go check http://www.gsmcom.com/mel.html

		
			Ericsson 888
                      ~~~~~~~~~~~~~~~~
o To view IMEI number *#06#

o To view Software Version enter * -> * <- <- * <- *
  (you also get version of InfraRed driver software and text labels)

o Pin Outs
   1 = + external power supply. 7.2v @ 600mA.
   2 = RS232 input (TTL)
   3 = GND (digital)
   4 = RS232 output (TTL)
   5 = +5V output. Limited.
   6 = Test. Switch phone off and provide +5V and switch back on. (set
   comms at 9600, n,8,1)
   7 = Mute (0 - Normal, 1 - In Call)
   8 = Internal/external (0 - External Mic/Speak, 1 - Internal Mic/Speak)
   9 = GND (analog)
   10 = Related to Mic/Speak
   11 = BF in
   12 = BF out


***************************************************************************
*                                                                         *
*                        P  H  I  L  I  P  S                              *
*                                                                         *
***************************************************************************

                     Philips Genie & Spark & Twist
                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
o In order to see the IMEI type: *#06#

o In order to see the register status of the phone type: *#2254*
  an example of what you'll see:
    C   2 BS   8
    RR  0 MMI   0
    CREAT. 24

o In order to start and stop the Debug Call Mode type: *#2255*#
  It will just show you "Activated" or "Deactivated"
NOTE: when activated, make a call to a busy line an the phone 
      will display some hex-codes on the screen.

o To see how much time that you are connected in the network: *#2558*#
  an example of what you'll see:
    0 day(s)
    17 hour(s)
    35 minute(s)

o In order to re-connect to the network type: *#2562*#

o In order to see and change the Security Code of the phone 
  type: *#7489*# 
  It just shows you the Security Code so you just go to the Menu and type
  63 in order to get you in the Security Code menu and change it to whatever
  you desire.

o To get information about the SIM card type: *#7378*#
  an example to see what you'll get: 
    Name: 0
    Length: 0
    SIM phase: 2

o To get information about the locking of the SIM card type: *#3377*#
  you'll get something like this:
    00000030
    00000000
    00
    IM : 0 LK : 0 - 9

o In order to start and stop the Sleep Mode type: *#7693*#

o In order to see information about the Sleep Mode type: *#8463*#
  you'll get something like this:
    Wake 7.68
    Sleep Req. 3.61
    Sleep 621.87

o (NO) BLOCKING - list (15 items) enter: *#3333*#

o *#2377*# : "BEER": not clear, the phone waits a random time and
   reconnects to the net, sometimes the phone makes a reset or something

o *#3353*# : resets the (NO) BLOCKING - list *#7378*# : Name, Length,
   SIM phase

o *#7787*# : not clear SPURIOUS INTERRUPT 

o *#7948*# : SWITCH OFF: not clear; it is a timer or something
 


			Philips DIGA
		       ~~~~~~~~~~~~~~
o To view IMEI number *#06#

o Connect Time *#2558*#

o (No) Blocking List *#3333*#

o Init, Flags, Sim Lock *#3377*#

o Resets the (No) Blocking List *#3353*#

o Displays the Security Code *#7489*#


			Philips FIZZ
		       ~~~~~~~~~~~~~~
o To view IMEI number *#06#

o To view information on the phone *#8377*#
  "Version : 0916 - EEPROM : 00000000-00 - TDA : 1941 - KISS : 0502"
   Some phones (probably sim-locked) return also text SIM-LCK at
   the end of the string

o To view security code *#1234*# (1234 is the default code...)
          "Security code : XXXXX"

o Service Code *#5644*#
  "Version : 09162205 - EEPROM : 0000000-00 - TDA : 1941 - KISS : 0502"

o Pin Outs

1       GROUND
2       GROUND
3       HANDS FREE ON/OFF
4       MUTE
5       TX
6       RX
7       RTS
8       REPROGRAMMING
9       ON HOOK CHARGER (APPROX 13V? TO 14V)
10      AUX MIC
11      AUX SPEAKER
12      GROUND
13      +VCC for Car Charger
14      +VCC for Car Charger


	
***************************************************************************
*                                                                         *
*                        A  L  C  A  T  E  L                              *
*                                                                         *
***************************************************************************

		     Alcatel  One Touch Easy
                    ~~~~~~~~~~~~~~~~~~~~~~~~~
 o In order to see the IMEI (International Mobile Equipment Identity)
      type:    *#06#
   Information that you get from the IMEI:
     XXXXXX  XX  XXXXXX  X
     TAC    FAC  SNR    SP

     TAC = Type Approval Code 
     FAC = Final Assembly Code 
     SNR = Serial Number
     SP = Spare 

o To Enter Service Menu type: *#000000#

o To view Secret Menu type 000000 then press *

o In the Secret Menu
  After you enter Secret Menu you have these options:
   ARRETS 
   VIDER ARRETS Press OK and the phone responds: This action is executed!
   CTRL CHARGE It show the charger voltage and battery voltage.
   DAMIER display test

o  IMEI 3300 1453 1139 420
   When activated with a Telstra card the Phone boots up with:

   "PRODUCT CODE"
   "VAL. => OK"

   Then we enter 025121992 OK

   "ENTER SPECIAL CODE"

   **05* same as Motorola

   "UNBLOCKING"
   " PUK ? "

   10608CC2*. These two from Vodaphone also work 906081C2* 15900807*

   "UNBLOCKING"
   " PIN ? "
 
   0000*

   "UNBLOCKING"
   "PIN AGAIN "

   0000#

   It seems that you need to find out the PIN because at this point the
   phone reboots.

o Service Provider Lock
    The Service provider (SP) lock is used to lock the cell phone to the
   SP's SIM card. Once the cell phone is locked to a specific operator,
   if one inserts a SIM card from a different operator the phone will
   refuse to accept it. The cell phone will however accept another SIM
   card from the same operator.
    MANY of these phones are sim locked. This can only be deactivated by
   getting the special code from Alcatel or your Service Provider. There
   is a rumor that there is a program floating around the net that allows
   you to calculate the code from the IMEI, number I have not seen nor
   verified the existence so it may be untrue . Please do not email me
   asking for Alcatel codes etc as I will add them to here as soon as I
   find something.

o Removing SP lock on Alcatel Easy
   You wil need a cable, a eeprom device.
   Edit the eeprom:

   Address    Replace with
   -------------    ---------------
   176h             FFh
   177h             FFh

***************************************************************************
*                                                                         *
*                        S  A  G  E  M                                    *
*                                                                         *
***************************************************************************

			Sagem CellPhones
                      ~~~~~~~~~~~~~~~~~~~~
   Type MENU - 5 - 1 - 1 - #  to enter Engineering menu on SAGEM (RC-712)
   phones.

   Submenus:
   1) IMEI
   2) Flash Eeprom etc.
   3) ?
   4) SP unblock
   5) ?
   6) Contrast Settings.


***************************************************************************
*                                                                         *
*                        S   O   N   Y                                    *
*                                                                         *
***************************************************************************

			Sony CMD-Z 1
                      ~~~~~~~~~~~~~~~~
o In order to see the IMEI type: *#06#
  Information that you get from the IMEI:
    XXXXXX  XX  XXXXXX  X
    TAC    FAC  SNR    SP

    TAC = Type Approval Code 
    FAC = Final Assembly Code 
    SNR = Serial Number
    SP = Spare 

o In order to see the software version and released date type:
  #8377466# (which is #version#)
   The above procedure will show on your phone the software 
   version in first row of the display and some CPU and OS info on 
   the second and third one.

NOTICE: On earlier version the above tip may not work, but you can try this,
   In the menu go to

   PHONE SETTINGS

   Jog down to:

   FACTORY SETTINGS and CLICK ONCE

   You will see a display "Factory Setting Yes No" . Don't do anything
   with this display, leave it as it is.

   move the main switch of the phone briefly to the right (briefly means
   long enough to secure a short electric contact BUT short enough not to
   switch off the phone!)

   Now key in the following sequence:

   # * 0 4

          Your display should read the following.

          Version

          DSP : A10380

          CPU: ce 10294

          OS : 1.02.1 ONF

			Sony CMDX 1000
		      ~~~~~~~~~~~~~~~~~~
o In order to see the IMEI type: *#06#
  Information that you get from the IMEI:
    XXXXXX  XX  XXXXXX  X
    TAC    FAC  SNR    SP

    TAC = Type Approval Code
    FAC = Final Assembly Code
    SNR = Serial Number
    SP = Spare

o The following procedure will show you the software version:
   Remove your SIM Card, then press:
   * # 06 #
   and finally press:   left key

o  To enter Monitor Mode on Network Option menu:
   Menu
   9 (Phone Options)
   7 (Phone Status)
   [Left Display Button] (left MENU key) 
   7684666 
   [HangUp Button] (RedHandSet key)

o  Service Provider Lock
   The Service provider (SP) lock is used to lock the cell phone to the
   SP's SIM card. Once the cell phone is locked to a specific operator,
   if one inserts a SIM card from a different operator the phone will
   refuse to accept it. The cell phone will however accept another SIM
   card from the same operator.
 
o Show Credits
   Go and view your own number in the phonebook;
   then delete the number and replace it with
   +12022243121 then press [OK]
   a small scenery with palm trees will appear and the names of the
   people who made the software will scroll upwards ..in some phones you
   may have to enter a name and then press ok!

o Pin Outs
   1. Power ( + 9 volt )
   2. Battery charge
   3.* Handsfree sos
   4. Handsfree extern (10K resistor to +9 to enable handsfree functions)
   5.* TXE
   6.* RXE
   7. Ignition (10K resistor to +9 to illuminate the display
   continiously)
   8. Antenna extern (10K resistor to ground to enable external
   microphone and antenna)
   9.* Audio 1
   10. Audio 2 (loudspeaker amplifier output)
   11. Microphone (use electrect microfoon and 46 db preamp.)
   12. Audio ground (do not connect to 13 and 14 )
   13. Ground (supply)
   14. Ground (supply)

***************************************************************************
*                                                                         *
*                        M O T O R O L A                                  *
*                                                                         *
***************************************************************************


			MOTOROLA CELLPHONES
                      ~~~~~~~~~~~~~~~~~~~~~~~
For Cellphones d460, 2500, 6200 (Flare), 7500, 8200, 8400 & 8700

o  To view IMEI (International Mobile Equipment Identity) number enter
   *#06# (displays IMEI on 8700, But NOT on 6200, 7500, 8200)

o Activate RBS (Note: pause means the * key held in until box appears)
   To activate RBS type: [pause] [pause] [pause] 1 1 3 [pause] 1 [pause]
   [ok]

   You now have to press the [MENU] and scroll to the 'Eng Field Options'
   function with the keys, and enable it.

   De-activate RBS

   To de-activate RBS type: [pause] [pause] [pause] 1 1 3 [pause] 0
   [pause] [ok]

   This only works with some versions of software.

o  What's the use of RBS:
   Get Distance From Base Station - Place a call, when it is answered,
   press [MENU] until 'Eng Field Option' is displayed, press [OK], select
   'Active Cell', press [OK], press [MENU] until 'Time Adv xxx' appears,
   where xxx is a number. Multiply this number by 550, and the result is
   the distance from the RBS (Radio Base Station), in meters.

   Get Signal Quality - press [MENU] until 'Eng Field Option' is
   displayed, press [OK], select 'Active Cell', press [OK], press [MENU]
   until 'C1' appears. This is the signal quality. If it becomes negative
   for longer than 5 seconds, a new cell is selected.

o Pin Outs
   Motorola Flip Pinout:
   ANT- (O) | | | | | | | | | |
   10 9 8 7 6 5 4 3 2 1
   Top of phone (screen)
   1) Audio Ground
   2) Ext b+
   3) T Data
   4) C Data
   5) R Data
   6) Logic Ground
   7) Audio Out - on/off
   8) Audio In
   9) Manual Test
   10) Battery Feedback

o TIPS FOR Motorola CD-160
   Press menu and type one of these numbers and press OK:
   11 = Status Review
   13 = Available Networks
   14 = Preferred Networks
   22 = Select Keypad Tones
   25 = Require SIM Card PIN
   26 = Language Selection
   32 = Repetitive Timer
   33 = Single Alert Timer
   34 = Set IN-Call Display
   35 = Show Call Timers
   36 = Show Call Charges
   37 = Call Charge Settings
   38 = Reset All Timers
   43 = Reset All Timers
   45 = Show Last Call
   46 = Total For All Calls
   47 = Lifetime Timer
   51 = Change Unlock Code
   52 = Master Reset
   53 = Master Clear (Warning!! May result in deleting the Message
                      Editor!!!)
   54 = New Security Code
   55 = Automatic Lock
   63 = Battery Saving Mode
 

***************************************************************************
*                                                                         *
*                        P A N A S O N I C                                *
*                                                                         *
***************************************************************************

			Panasonic G500
                       ~~~~~~~~~~~~~~~~
o To view IMEI number *#06#

o PIN OUTS
   1 - Ground
   2 - TX_Audio
   3 - Audio_Ground
   4 - HF_ON (L=ON) -> L=H/F ON
   5 - AOP_Sense <- Data Adaptor Select
   6 - Serial_Up <- UART up (9600,33.8kbps)
   7 - Serial_Down -> UART down
   8 - External_Power <- POWER FOR CHARGING
   9 - Ground
   10 - RX_Audio
   11 - Radio_Mute -> L=MUTE
   12 - HF_Sense <- L=H/F MODE
   13 - Reserved L=FLASH WRITE ENABLE
   14 - Ignition <- H=ON
   15 - Logic_Power -> H=HANDSET ON
   16 - PAON -> Power Amplifier Control Signal.

***************************************************************************
*                                                                         *
*                        S I E M E N S                                    *
*                                                                         *
***************************************************************************


                              Siemens S1 / S3
                            ~~~~~~~~~~~~~~~~~~~

o  Tetris: Power on phone and enter PIN. before phone has locked onto
   network, F9, send own number, hit right button, hit 9. left is 2,
   right is 8, rotate is 5, and drop is 4.
 
o  Monitor Mode: Menu, 9 (Phone Options), 7 (Phone Status), Left Display
   Button (left MENU key), 5553756, HangUp Button (Red HandSet key)
   Now "Monitor" should appear at the bottom of the Network Options menu.
   Pressing the right Display Button when in monitor mode will show a
   list of the six cells with the strongest signals.

o Test Mode Indicators:   (* = only available when call in progress )

CH      Channel Number
RX      Signal Strength (dB)
N       NCC (Color Code)
B       BCC (Color Code)
CI      Cell ID (in Hex)
C1+     how long before phone does forced hand over. (see RX and RXAM)
LAI     Location Area Identity. Display Network ID code (42F010 = 240.01)
        and MSC
TXPWR   Transmit Power (dB)
RXAM    Reeceive signal strength cut-off point
TS*     Time Slot Number
TA*     Timing Advance. Distance from tower in Km X 2
PL*     Power Level

        Power Table
        PL:     5    6     7    8    9   10    11   12   13   14   15
        dB:     33  31    29   27   25   23    21   19   17   15   13
        Watts:  2   1.3   .8   .5   .3   .2   .13  .08  .05  .03  .02

LF*     C1 value with continuous transmisson from tower
LS*     C1 Value with discontinuous tranmission from tower
QF*     Bit Error Rate with continuous transmission from tower
QS*     Bit Error Rate with discontinuous transmission from tower

        BER (bit error rate) table
        QF/QS register:  0     1     2     3     4     5     6     7
        % of bit sent:  0.2   0.8   0.4   1.6   3.2   6.4  12.8  25.6



			Siemens S3:comfort
                      ~~~~~~~~~~~~~~~~~~~~~~
o Monitor Mode: 
     The Siemens S3 Com series have a Monitor mode that can be activated
     directly from the standard user keypad. In order to activate this
     mode, you must enter the special access code currently programmed
     into the phone.
TO ACTIVATE MONITOR MODE:
    1. Turn the phone on.
    2. Enter the PIN access code on press OK. (Only if is enabled).
    3. Press Menu. (Left top button).
    4. Press 9. (Phone Options).
    5. Press 8. (Phone Status) (May be button 7 in some phones).
       You may see your IMEI Number
    6. Left Display Button (Top left MENU key).
    7. 7684666
    8. HangUp Button. (Red HandSet key).

     Note: Monitor should appear now at the bottom of the Network
     Options menu.
MONITOR MODE
     Pressing the right Display Button when in monitor mode will toggle
     into 1 and 2 modes


			Siemens S4
                      ~~~~~~~~~~~~~~

o MONITOR MODE
     The Siemens S4 series have a Monitor mode that can be activated
     directly from the standard user keypad. In order to activate this
     mode, you must enter the special access code currently programmed
     into the phone.
 
TO ACTIVATE MONITOR MODE:
   Menu, 9 (Phone Options), 7 (Phone Status), Left Display Button (left
   MENU key), 7684666, HangUp Button (Red HandSet key)
   Now "Monitor" should appear at the bottom of the Network Options menu.
   Pressing the right Display Button when in monitor mode will show a
   list of the six cells with the strongest signals.

o Test Mode Indicators:   (* = only available when call in progress )
CH      Channel Number
RX      Signal Strength (dB)
N       NCC (Color Code)
B       BCC (Color Code)
CI      Cell ID (in Hex)
C1+     how long before phone does forced hand over. (see RX and RXAM)
LAI     Location Area Identity. Display Network ID code (42F010 = 240.01)
        and MSC
TXPWR   Transmit Power (dB)
RXAM    Reeceive signal strength cut-off point
TS*     Time Slot Number
TA*     Timing Advance. Distance from tower in Km X 2
PL*     Power Level

        Power Table
        PL:     5    6     7    8    9   10    11   12   13   14   15
        dB:     33  31    29   27   25   23    21   19   17   15   13
        Watts:  2   1.3   .8   .5   .3   .2   .13  .08  .05  .03  .02

LF*     C1 value with continuous transmisson from tower
LS*     C1 Value with discontinuous tranmission from tower
QF*     Bit Error Rate with continuous transmission from tower
QS*     Bit Error Rate with discontinuous transmission from tower

        BER (bit error rate) table
        QF/QS register:  0     1     2     3     4     5     6     7
        % of bit sent:  0.2   0.8   0.4   1.6   3.2   6.4  12.8  25.6

***************************************************************************
*                                                                         *
*                        M  A  X  O  N                                    *
*                                                                         *
***************************************************************************

			MAXON MX3000
                      ~~~~~~~~~~~~~~~~
o To view the IMEI number enter: *#06#

o To view software version enter: *#9900#

o *#9901# Batch

o *#9908# Developer Team names

o *#9911# L1 Debug on/off

o *#9912# Forbidden List

o *#9913# bDAC

o *#9916# Text (scroll trough with up/down)

o *#9917# Service Active

o *#9919..9922# Names Maxxon , Audioloop , GCS ..

o *#9924# Forced Location Update

o *#9931# Backlight off when charging

***********EOF******EOF******EOF******EOF*****EOF*****EOF*****EOF**************
 
