Cellular Programming Data
by Threc (threc@li.net)
By this point in time almost everyone knows at least some information on cell fones. The most common knowledge associated with cells is related to Motorola and larger brand names. Not to mention this knowledge is varied from pin outs to SIDs in scarce bits.
There seems to be little detailed information covered about NAM programming on specific phones or a variety of phones, at least as far as I've seen. So I've decided to do a write-up of a fair amount of fones and how to enter program mode, with some instructions and a little background.
Later on in the future, I hope to reverse engineer a few cells. By the way, I find it ironic how the law has decided it's okay for someone to reverse engineer something, but it's not okay to just rip the information out of their server. Oh well, enjoy - I hope this helps at least someone.
RadioShack/Tandy CT-352/55
The first of the fones I'd like to cover is the CT-352/55, including the CT-350/351. I'm going to try to be as specific as possible.
1.) To enter program mode:
Type: * 3 0 0 1 # 1 2 3 4 5 <STO> 0 0
Response: Store not done
2.) To program the phone number:
Press: <RCL> 0 2
Response: 1111111111 (or the previously programmed number in the fone)
Press and HOLD until the display is empty: <CLR>
Response: Gee, I wonder... a cleared screen?
Type: [Fone Number] + <STO> 0 2
Response: Replace Contents?
Now considering you just went through all this, I'm guessing that you want to replace. If you don't, well that's your problem.
Type: <STO>
Response: Stored3.) This part is more interesting than the other two - now you enter the carrier parameters. Oh, by the way, if you people are doing this in steps of 1, 2, 3, etc., you can jump around. It's not encouraged unless you have some prior knowledge or experience with cells, or you catch on quick.
Type: <RCL> 0 3
Response: 3 8 * 1 * 1 * 3 3 4 * 1 5 * 1 5 (or whatever it was before)
Press and HOLD until the display is empty again: <CLR>
Response: Figure it out.
Type: [Parameters] + <STO> + 0 3 (on the CT-352, add the long distance and International code)
Response: Replace Contents?If you don't know exactly what the parameters mean, here's a brief overview.
Say for example we have a string of: 0 0 0 3 8 * 1 * 1 * 3 3 3 * 0 1 * 1 0
The 00038 represents your Home or System ID (SID). Don't bother with the ones, you won't really need to mess with them. If you're interested though, I believe them to be just a terminator for the string, or MIN MARK and something else. Hack it out, if you're interested.
333 represents the channel. There are two basic channels - 333, which is System A and 334, which is System B. The 01 is a representation of what should always have the format of 0 and the last digit of the phone number you chose before. This is based upon my experiences with these types of cells. This would seem to be the overload class. The only exception is ACCOL (Access Overload Class) can be a value from 00 to 15, but these always seem to have the zero and last number. 10 is simply the Group ID (Examples: 10, 12, 15).
Extras for the CT-352/355: for the above example it's the same - just stick a pound sign on the end of the 10 and then add 0111 * 1 after it: 00038 * 1 * 1 * 333 * 01 * 10 # 0111 * 1
This 0111 is the international code. The 1 is unfamiliar to me...
4.) Now we go on to enter the security code parameters. By this point, things should be almost simple enough where you really shouldn't need to read along, but can figure it out for yourself. Even though, I'll include a commentary.
Type: <RCL> 0 1
This isn't a definite response: 911 # * 911 # 0 * 1234
Hold down until the screen is empty: <CLR>
Response: A blank little screen
Type: 911 # * 911 # 0 *If you have a CT-350, the default is 1234. If you have a CT-351/352 it would be 12345. Also, the 0 denotes that you want English. If you want Spanish, put in 1. For French, put in 2.
Type: <STO> 0 1
Response: Replace contents?
To accept, press: <STO>
Now that you're done programming this particular phone, you should turn it off for the parameters to be recognized. From what I've heard, you should wait two hours before testing the phone. I've also heard you should wait several hours from another source. So my suggestion is to just let the thing sit for a day. If you're not exactly sure why you are supposed to leave it off, I'll tell you. It takes the cell carrier an exponential amount of time to activate cell phone numbers. So you will just have to wait a bit before it's activated.
By the way, the settings list is:
Uniden CP-170
The next phone we're going to be talking about is the Uniden CP-170. (Note: To determine the correct ESN for Uniden phones add 172 to the serial number.)
I hope, sincerely, that you're not so technically impaired you don't know how to turn on the cell, or other fundamentals covered or not in the previous section.
Determine which NAM you'd like to choose:
For NAM 1, press: 1 <STO> 9 0
Response: 1
For NAM 2, press: 2 <STO> 9 0
Response: 2Simple ain't it? Here's the strange part. Turn it off now... Now press and hold the * and # (reminds me of the Bravo pager), and press <PWR>. Now continue to hold the * and # for several seconds. Wait till you see "NO SVC IN USE PWR ROAM" on the screen. Make sure you don't get jumpy and hit it when it shows all of them except ROAM!
Now enter the code: 32218591
After all that crap we get put into programming mode. If you hear any noise, you messed up. So turn the thing off and start with the * and # again.
Now a SID will appear... Figure out your SID and enter it. Then press <STO> and enter the next item number to be programmed. Press the single digit number of the area you want to move to, displayed below. After you're done with each area, press <STO>.
Continue doing this until you're all done getting everything in there. When you're done doing this, press <Send> to write to the NAM. If everything worked out, you'll see the word "PASS" appear. Otherwise, press <CLR> and start over.
Area Description Valid Data 0 SID 3 digits (00000 through 32767) 1 LU - Tells the mobile if it must be preregistered with the 1 digit (0 or 1) system 2 Determines whether or not to have an area code sent each 1 digit (0 or 1) time a call is made 3 MIN 1 + 2 10 digits 4 IPCH (Initial Paging Channel) 4 digits (non-wireline - 0333 for "A") (wireline - 0334 for "B") 5 ACCOL (Access Overload Class), determine priority in an overload. 2 digits (00 through 15) The Government thought it would be nice in case of an emergency for police, etc. to have priority over other subscribers. No standard used in the U.S. at this time 6 PS - Should identify the initial paging channel 1 digit (0 for "B" or 1 for "A") 7 GIM (Group ID Mark) - indicates how many bits of the SID 2 digits starting with the most significant comprises the Group ID 8 Lock Mode 4 digits (0000 to 9999) 9 DTMF Duration 1 digit (0 for 100 msec or 1 for end-to-end)Technophone 901
Now it comes time for the Technophone 901's NAM info to be revealed.
Similar to the CT's, this is fairly easy to program. Remember to turn the phone on first:
Press: # 0 0 0 0 0 0 # # 9 5 3 7 3 9 # + <STO> + 9 9 + <STO> + <STO>
Response: None
Press: <PWR>
Response: It's off, it can't respond.
Press: <PWR>
Response: Which NAM?
Press: [1 - 3] + <STO> (which NAM you want to program)
Response: System IDRemember, that means 1 through 3. Don't go pressing 1 2 3. You pick one, not all of them!
Press: [System Number (5 digits)] + <STO>
Response: NO
Press: [MIN 2 (area code) + MIN 1 (telephone number)] + <STO>
Response: Group ID MarkWithin the brackets, you should have 10-digits, comprised of the area code and the telephone number.
Press: [Group ID Mark] + <STO>
Response: Save NAM?The GIM is generally 2-digits long. See the CP-170 section for more details.
Press: <SEND>
Response: Continue?So technically you just agreed to save the information you provided. If you don't want to save it, I think you can figure out what you're supposed to hit.
Press: <END>
Response: Which NAM?This just ended your current programming session with the NAM you were working on. If you wanted to do something to another, this would be the point where you'd enter the number.
Press: <END>
Response: NoneExits programming altogether. I personally like this phone because it has three NAMs. Not all too many phones have this. Generally you're lucky to get dual NAMs. It's got other nice features as well.
CT-100/101/200/201
Now that it's been a bit since we've discussed the CT line of cells, I thought it'd be nice to continue with a few other series that are "more complex." These phones are the CT-100/101/200/201.
The CT-200 line are fun because most of them require programming via a computer. To do this we're also going to need a NAM adapter, programming disk, and serial cable. It's probably easiest if you have a laptop lying around to hook it up to that.
On the CT-100/101, type: * 17 * 3001 * [Lock Code] *
On the CT-200/201, type: * 17 * 1003 * [Lock Code] *
The default lock code is, like most cells, is: 1234
The cell will go through the list of all the things it wants you to enter. They should be easy to figure out since I've already discussed each part of a NAM previously. It'll go through asking: HO-Id, ACCESS, LOCAL, Phone n, Class, PAGE ch,, O-Load, Group, SEC.
HO-Id (Home System ID) is required, Phone n (Phone Number) is required, PAGE ch (Paging Channel) is required, and Group is required. The only one that might seem a tad obscure is SEC. This is the 4-digit security code. After each choice, for example HO-Id, you hit <SEL> to complete your choice and move on to the next.
Ericsson
To continue, I'll discuss Ericsson.
This phone has a neat feature in that it has "short" NAM programming and "long" NAM programming. Short is for something that needs a quick fix, which comes in handy.
"Short" Mode:
Press and hold down: <FCN> + 9 8 7
Response: SER NUMBER [with the telephone's ESN]The ESN has 11-digits and "isn't" changeable. Nothing in the world of electronics can't be changed. Some things are just harder than others.
Press: * [or] #
Response: MIN and SIDThis "short" mode has three things. It displays the ESN, the MIN, and SID. To cycle through them just press the star or pound sign.
Press: <END>
Response: NoneThis exits short programming mode.
"Long" Mode:
Press and hold down: <FCN> + 9 2 3 8 8 5
Response: ESNNow, like before, you'll be brought to a display of items. It will show ESN, Emergency?, MIN x?, SUB No x, SID x, MARK x OFF/ON, IPCH x, ACCOLC x, and GIM x. The x represents the NAM number you want. To change the setting, press any key.
A few items here that might be obscure to you would be ESN and/or SUB NO x. ESN is the electronic serial number, which I explained a little bit before. SUB NO x is a subscriber phone number. You also specify a phone number in MIN x.
This is a dual-NAM cell. So your choices for x would be 1 or 2. To switch through options, press the pound (#) sign. When you're done just press <PWR>.
Technophone EZ400
The last phone I'm going to write on is the EZ400 produced by the Technophone Corporation. This is just your normal cell, nothing really special. Actually, I really can't say that, because there may be some features I've yet to come across that are dazzling.
Always remember - you turn on your units before you follow any of the instructions.
Press: * 3 0 0 1 # 1 2 3 4 5 <STO> 0 0
Response: No Response
Press: <Clear> Response: Store not done
Press: 911 # * 911 # [Language Code] * [Security Code] + <STO> + 0 1 + <STO>
Response: Normal DisplayRemember from the other Technophone that the language codes are 0, 1, and 2. The default security code is: 1234
You should really cross-reference similar brands since they always seem to share similar if not the same technique to access the NAM. I do believe that the 911 is the emergency number which can be changed, to whatever you please (3-10 digits?).
Press: [MIN 1 + MIN 2] + <STO> + [NAM] + <STO>
Response: Normal DisplayTo save it to NAM 1, you would enter: [10-Digit Phone Number] + <STO> + 02 + <STO>
To save to NAM 2, you would do the same thing, except change 02 to 04.
Press: [System ID] * 1 * 1 * [IPCH] * [ACCOL] * [GIM] + <STO> + [NAM] + <STO>
Response: Normal DisplayFor NAM 1, enter 03 for [NAM]. For NAM 2, enter 05.
Now turn off the unit and wait 10 seconds. Turn the unit back on. If you made some sort of error, it will let you know by displaying "NAM ERROR" on the screen. You will have to do it over if this happens.
If requested by others, or for my own reference, I will add to this list of cell phones. I'm also looking for a way to access NAM programming in Nokia's and Audiovox's.
If anyone has this information, I'd appreciate it if they would forward it to threc@li.net. As I mentioned before, I intend to reverse engineer some cells, specifically a Motorola DPC 550.
If this has already been accomplished, I don't feel like re-inventing the wheel. Please notify me so I can work on another model. I hope this is helpful and informational.