The following file is a verbatim transcript of an article by the same name appearing in the December, 1992 issue of NUTS & VOLTS Magazine. Copyright (c) 1992 Damien Thorn and T & L Publications. Permission is granted to freely distribute this file in unmodified form. Identifying board headers may be added as desired. CELLULAR TELEPHONE PROGRAMMING Focusing on Fundamentals By Damien Thorn The ever-increasing use of cellular telephones has created a market for people with the skills to install and program them. Installation is no more difficult than installing a CB radio, and programming is accomplished by entering data via the keypad on the phone. Whether you want to completely reprogram a new or used phone, or simply change your unlock code, there is no reason to pay a dealer to do it when you can do it yourself in a matter of minutes. In the early days of cellular technology, an external device such as a "programming handset" or ROM programmer was required to "burn" the mobile telephone number and service information into the phone. Today's cellular phones incorporate resident software that allows you to key in the required information on the phone itself. When you are finished and satisfied you've entered the correct data, the phone burns it to non-volatile memory with the push of a button. To understand why the simple process of programming a cellular phone seems to be an industry secret, you need to understand that it is a lucrative service offered by cellular dealers. There is no profit to be made selling the phone hardware. Most dealers sell at close to cost just to remain competitive. The real profits are derived from commissions received from the cellular carriers (service providers) for getting customers to sign up with them. Due to the widespread use of surface mount technology within the phone, service centers almost always return them to the manufacturer for repair. Fortunately for these dealers, most service problems are external, involving the antenna, connectors, cables or a need for reprogramming. These are all relatively simple matters that can quickly be diagnosed and repaired in the shop, thus generating income. Aside from the Federal and State regulations governing the sales and service of cellular equipment (because it is a transmitter), only basic electronics skills and minimal equipment are required to begin such a business. INTRODUCTION TO CELLULAR PROGRAMMING The purpose of this article is to present the fundamentals of cellular programming. I've also included brief reviews and sources of publications that are essential to anyone interested in pursuing cellular programming as a hobby or profession. The basic principals of programming are the same from phone to phone. Each manufacturer (or model), however, has a unique sequence of key strokes to access the programming mode as well as a few other programming quirks. If you plan to work with more than one brand of phone, a publication containing programming tables (or "templates") is a must. The phone used for this article is a common Motorola transportable "bag phone." One reason for selecting this phone is because I own one. The other is because Motorola is the most prolific manufacturer of cellular phones. Also, the "universal" nature of the Motorola programming instruction set used as an example can be used on most of their phones as presented herein. Not only do they make gear bearing the Motorola brand name, they custom manufacture phones for a variety of other vendors. Some examples include the brand names Ambassador, America Series, Dynasty, Modar, Nautilus, Pulsar, Tracer, Blaupunkt, Nissan Infiniti, Toyota LEXUS, and models for AUDI and Ford. PRELUDE TO PROGRAMMING Before you even begin to program a phone, you need to obtain the required data. If you just want to change your unlock code, then you need to make up a convenient three-digit number. Activating service on a used phone requires you to obtain certain information from the cellular carrier providing you with service. Here is a description of the data you will need: 01) System Identification Number (SID): A five digit number that has been assigned to identify the particular cellular carrier from whom you are obtaining service. This number identifies your "home" system. 02) Area Code of Mobile Identification Number (MIN): Simply the area code of your cellular telephone number. MIN is the "official" term for the phone number assigned to you by the cellular company. 03) Mobile Identification Number (MIN): The MIN is the actual seven digit cellular telephone number assigned by the cellular carrier exclusively to your phone. 04) Station Class Mark (SCM): A two-digit number that identifies certain capabilities of your phone. How the cellular network handles your call is based on these digits. The SCM tells the system whether your phone transmits at standard power levels or low power levels, if it can utilize the full 832 channels or only the original 666 frequencies. The last attribute identified is whether your phone employs voice-activated transmission (VOX). A phone without VOX is continuously transmitting a carrier back to the cell site the entire time your call is in progress. The VOX operation used in smaller phones allows the phone to transmit only while you are actually talking. This reduces battery drain and enables handheld phones to operate longer on a smaller battery than would be possible without VOX. To determine the proper SCM for your phone, examine Table 1 and use the code that matches the presence (or absence) of each of the attributes described above. 05) Access Overload Class (AOLC or ACCOLC): A two-digit number used to arbitrate who gets dropped from the system (or refused access) when there are more calls in a cell than can be handled at one time. This feature is allegedly disabled in most systems and no preferential treatment is shown to any particular ACCOLC. 06) Group Identification Mark (GIM): The Group ID Mark is a two-digit number used by cellular sites other than your home system to determine if you should be allowed access to the system on "roam" status. This feature is not yet fully implemented. 07) Security Code: This six-digit number is used to prevent unauthorized or accidental alteration of the data programmed in the phone. The factory default is 000000. 08) Unlock Code: This is a three-digit number required to unlock the phone when you have electronically locked it to prevent unauthorized use. The factory default is "123", however many cellular programmers change it to match the last three digits of your MIN (phone number). 09) Initial Paging Channel (IPCH): This is the channel number used by the cellular provider to "page" the phones in use on the system. The term "paging" refers to notifying a particular phone that it has an incoming call. All idle phones on a system monitor the data stream on the IPCH. Non-wireline cellular carriers use channel 0333 as the IPCH, while wireline providers (operated by a telephone company) utilize channel 0334. 10) Options programming byte A 11) Options programming byte B The options bytes are six and three-digit binary numbers used to enable or disable certain options on the phone. Each digit is either a "1" or "0". Options byte A consists of six bits. We'll label them "ABCDEF" for our purposes, where each letter represents a bit set to "1" or "0". Here is what each bit controls: Bit "A" - Handset internal speaker: A "1" in this position disables the internal speaker of your handset to facilitate the use of an external speaker/microphone combination. This bit is set to "0" in a normal installation to allow normal operation of the handset speaker. Bit "B" - Local Use bit provided for certain cellular carrier system requirements. This is normally enabled with a "1". Bit "C" - MIN mark bit: Usually disabled with a "0" in this field. Bit "D" - Auto recall: The auto recall function is always enabled with a "1" in this position. Bit "E" - Second phone number: If the phone has a dual system registration capability, and you are in fact registered with two different cellular carriers, the function is enabled with a "1" in this field. A "0" in this position indicates the standard cellular configuration having just one telephone number. Bit "F" - Diversity: This bit is used to enable diversity if your telephone is equipped with two antenna connections (ports). If your phone uses just one antenna (standard), this bit is set to "1" to disable diversity. If the phone was of a standard configuration, the description above indicates that this option byte would be programmed as "110100" with each bit enabling or disabling the specific option as appropriate. Option byte B operates in the exact same fashion, except the byte consists of only three bits, controlling three options. We'll label the bits "ABC" where each letter represents a specific bit. Bit "A" - Long tone DTMF: A "1" in this position enables long tone DTMF for end-to-end signalling. This means that the phone will transmit a DTMF tone for as long as you depress a key on the key pad. A "0" will disable this feature, causing the phone to send a short burst of DTMF when you dial, no matter how long you hold down the key. Bit "B" - A "0" in this position enables the internal speaker of a transportable phone to act as the "ringer" to signal an incoming call. This feature can be disabled by programming a "1" in this position if you have some ancillary device connected to signal ringing. Bit "C" - Eight hour timeout: This feature is normally enabled with a "0" in this position. When enabled, the phone will timeout and turn off if it has been left on continuously for eight hours. This helps prevent the phone from completely draining the battery of your car if it is inadvertently left on for an extended period without being used. ENTERING PROGRAMMING MODE Once you have determined the proper values for the data fields described above, you can get down to the actual programming of the phone. With the above data in front of you, it becomes a simple matter of punching it all in on the keypad. To begin programming the phone, you need to enter the programming mode. Almost all Motorola phones use one of six possible key stroke sequences to gain access to the programming mode. These are numbered one through six and listed in Table 2. Indexing the exhaustive list of model numbers to the appropriate sequence number is beyond the scope of this article. It is not difficult to figure out, and whether or not the phone has a "Fcn" (function) or "Ctl" (control) key narrows it down to one or two possibilities. The security code used to enter the programming mode consists of six digits. It is keyed in twice, as though it were a twelve digit number, and in a couple of the sequences is prefaced with a zero for a total of thirteen digits. All Motorola phones are shipped new with the factory default security code set to 000000. Most cellular programmers do not change this, as it only makes reprogramming more difficult in the future. Roughly 80% of the phones I've encountered retain the factory default security code. The other 20% had been changed to 123456 by a local cellular dealer. While the security code could conceivably be any six digit number, you should be aware that this code is only useful to prevent idle tampering with the programming, not lock out the personnel at other service centers. The security code is by no means akin to the vault door protecting the contents of Fort Knox. In the next issue of Nuts & Volts I'll show you how to build manual test adapter from one inexpensive part obtainable at any Radio Shack store. This device will immediately allow you to enter the programming mode without the security code. You can then view and change the security code or all of the programming if you wish. Once in programming mode, the phone will display "01" which indicates the phone is at the first programming step (or field). Table 3 is a template of the programming steps, and you'll notice that the step numbers correspond with the numbers prefacing my descriptions of the required data above. The phone always displays the two-digit field identifier before displaying the data in that particular field. This lets you know where you are in the programming sequence. COFFEE BREAK: TIME FOR AN ASIDE It would not be unusual for you to feel a bit overwhelmed right now. I was confused the first time I attempted to program a cellular phone. If this is your first exposure to cellular programming, may I suggest you grab a cup of coffee and reread the article up to this point before you actually attempt the programming process. At first the idea of security codes and determining the proper sequence necessary to access the programming mode was disconcerting and a bit frustrating. Once this step had been accomplished, I was delighted to discover how easy the actual programming was. If you have difficulty accessing the programming mode, here is a helpful tip: Let's say the phone is quiescent until you've keyed in the entire sequence, including the 13 digits comprising the security code, but fails to display "01" after the final keystroke. This indicates that you are using the correct sequence from Table 2, but the security code is incorrect. If you are using the wrong keystroke sequence to enter programming mode, the phone will abort in the midst of keying in the security code, because it fails to recognize why you are punching in all the digits. If you are using the correct sequence to access the programming mode, the display on the phone will not echo (display) the security code unless you are keying it in too slowly. KEYING IN THE DATA The process leading up to this point is actually the majority of the work involved in programming a cellular phone. Keying in the data is so easy that it's almost disappointing. If you've successfully accessed the programming mode, your phone will display "01" to identify the current field. Pressing "*" advances the display to the data in that field. You can then key in new data and press "*" to advance to step "02", or press "*" without entering data to retain the information currently stored within the field. I just want to change my unlock code, so I need to advance to the field where this data is stored. A quick glance at Table 3 tells me that my current unlock code is stored in field 08. To get to this field, I need only to repeatedly press the "*" key to sequence the phone through the fields without altering any of the data. When "08" is displayed, I know I've arrived at the field containing my unlock code. First I access the programming mode on my transportable phone by turning on the power and keying in sequence number 4 from Table 2. I depress the "control" key on the side of the handset and quickly punch in "0" followed by my security code twice (123456+123456) and finally press the "*" key. The display shows "01" to let me know I am at field 01, the SID. I press "*" to advance to the data, and the display shows "00224" which is my SID. I press "*" again and the software sequences to the next step. "02" is now on the display. Another "*" and the phone displays "209" which is the data in field 02 - my cellular area code. Depressing the star key advances us to step "03" which is my MIN. Pressing "*" displays the contents of field 03, and yes, it certainly is my cellular telephone number (MIN). Each time I press the "*" key the phone continues to advance to the next field number and then displays the data stored there. Since I want to change my unlock code, I repeatedly press the "*" key until the phone displays "08." This is the field containing that code. Another "*" and my display shows "602" which is my current unlock code. I want to change it to "977." With the old code in the display (602), I simply punch in the numbers 9+7+7. The display now reads "977" which will be my new unlock code. If I continued pressing the "*" key, the phone would sequence through the remaining fields until it returned to "01." I could then advance through the fields again. You might want to do this, just scrolling through the data programmed into your phone. Use Table C to identify the fields as you look at the data stored in each. If you accidentally alter the data in any of the fields while you are looking around, press the "#" key to exit programming mode without saving any of the changes to memory. The "#" key will abort the programming mode, leaving the previously stored information intact. Since I changed my unlock code, I need to burn the new information to the Numeric Assignment Module (NAM) in the phone. NAM is the term used to describe the EEPROM chip where the program data is stored. To save the new information, I press "Snd" (Send). This burns the changes to the NAM and exits the programming mode. These are the keys to remember while programming a phone, or just exploring the current programming: The "*" key advances to the next field or step. The "#" key aborts programming without saving any changes. The "Snd" key saves all changes to the NAM and exits programming mode. The "clr" (clear) key will restore a field to the previously stored data if you make a mistake while keying in digits. You can then reenter the data correctly. SUMMARY We've covered a lot of material, and I commend your tenacity. Cellular programming is actually an easy process. You now have a decent understanding of the fundamentals, and I assure you that a bit of practice will lead to a surprising proficiency. The information in this article is specific to cellular equipment manufactured by Motorola. Other manufacturers use somewhat different templates and methods to access the programming mode. If you want a deeper understanding of cellular programming or need the exact programming templates and instructions for a variety of phones, I suggest you buy one of the publications reviewed here. If you own just one model of phone and need a template or other basic assistance, I don't mind helping you out. You can contact me directly via mail at 6333 Pacific Avenue, Suite 203, Stockton, CA 95207-3713. If you need me to provide detailed information, I would appreciate it if you'd enclose a few dollars to help offset my expense. I welcome all comments, and encourage suggestions for future articles. Building a test adapter for Motorola phones is the subject of my article next month in Nuts & Volts. Placing a phone in test mode will allow you to bypass the keystroke sequence and security code to access programming mode. This is a device every cellular service person should have. In addition to getting around a security code long forgotten by a customer, you'll learn how to reset the cumulative call timer, reset the NAM programming to default values and a host of other interesting test functions such as accessing the built-in relative signal strength indicator (RSSI) and channel number display available only when the phone is in test mode. # # # Table 1 DETERMINING YOUR STATION CLASS MARK (SCM) Proper SCM Value Attributes of Your Phone 00 Standard power output; 666 channel capability; no VOX operation. 04 Standard power output; 666 channel capability; uses VOX. 06 Low power output; 666 channel capability. 08 Standard power output; 832 channel capability; no VOX operation. 10 Low power output; 832 channel capability; no VOX operation. 12 Standard power output; 832 channel capability; uses VOX. 14 Low power output; 832 channel capability; uses VOX. The SCM value appropriate to your cellular phone should be entered in programming field "04." "Standard power" as used above refers to the RF output level of a transportable phone, or one installed in a vehicle. "Low power" refers to the reduced RF output of handheld units. Handheld phones utilize a lower power level not just because of their size and battery capacity. Since the transmitter and antenna are a part of the handset, it was determined that radiating a full three watts of RF just a few inches from your head might be unhealthy. # # # Table 2 PROGRAMMING MODE ACCESS SEQUENCES #1 - Fcn + [six digit security code] + [six digit security code] + Rcl #2 - Sto + # + [six digit security code] + [six digit security code] + Rcl #3 - Ctl + 0 + [six digit security code] + [six digit security code] + Rcl #4 - Control + 0 + [six digit security code] + [six digit security code] + * #5 - Fcn + 0 + [six digit security code] + [six digit security code] + Mem #6 - Fcn + 0 + [six digit security code] + [six digit security code] + Rcl Note: In sequence #4 the "control" key refers to the audio and ringer volume control button on the side of the handset if no "Ctl" key is present on the handset keypad. Example: If the appropriate sequence for my phone is #3, and my security code is 123456, I would key in the sequence as follows: A) Turn power on. Display reads "ON." B) Press: [Ctl], [0], [1], [2], [3], [4], [5], [6], [1], [2], [3], [4], [5], [6], [Rcl]. C) If entered correctly programming mode is active. Display reads "01." # # # Table 3 TEMPLATE: SEQUENCE OF PROGRAMMING STEPS Field Description Digits Typical Example 01 System ID Number (SID) 5 000233 02 Area Code of Mobile ID Number (MIN) 3 209 03 Mobile Identification Number (MIN) 7 555-1212 04 Station Class Mark (SCM) 2 12 05 Access Overload Class (ACCOLC) 2 06 06 Group ID Mark (GIM) 2 10 07 Security Code 6 000000 or 123456 08 Unlock Code 3 123 or last 3 digits of MIN 09 Initial Paging Channel (IPCH) 4 0333 or 0334 10 Options programming byte "A" 6 011100 (binary) Internal Speaker (1 = disable) X----- Local Use bit (1 = enable) -X---- MIN Mark bit (usually disabled = 0) --0--- Auto-Recall bit (always set to 1) ---1-- Second Phone Number (0 = disable) ----X- Diversity option bit (0 = disable) -----X 11 Options programming byte "B" 3 010 (binary) Long tone DTMF (0 = disable) X-- Ringer/speaker (1 = handset / 2 = transducer) -X- Timeout (8 hour) (0 = enabled) --X If second phone number option is enabled and supported by the hardware, this programming template will repeat for the second phone number. Each field identifier (step) number will be displayed with a "2" to indicate data for the second number. (e.g. "01 2"). ****************************************************************************** SOURCES: A Review of Available Publications Every month I peruse the pages of Nuts & Volts with an eye for detail unmatched by the best Revenue Agents employed by the IRS. Why? Because I have an insatiable appetite for information - especially information surrounding technology that seems "inaccessible" to you and me. As a result, I've purchased all four publications advertised herein that deal with cellular communications. Each has unique features and all were worth the money. Here is my opinion of each: Cellular Programmer's Bible The Cellular Programmer's Bible definitely lives up to it's name. Over 300 pages of nothing but programming instructions for every conceivable cellular telephone manufactured. This tome includes the factory preset security codes to greatly simplify access to the programming modes of various phones. In addition to precisely detailing every programming sequence, each entry includes invaluable technical information on channel capabilities, test modes, and other unique tidbits applicable to the specific model of phone being described. This volume is mandatory for anyone considering offering programming services to the public. I discovered my Pac Tel Cellular customer service rep uses this same publication as his programming reference, although he carries it in a nondescript binder. Approximately 400 spiral bound 8.5 x 11" pages. $84.45. Available from: TeleCode, P.O. Box 6426, Yuma, AZ, 85366-6426. (602) 782-2316. Cellular Hacker's Bible The Cellular Hacker's Bible is TeleCode's other cellular publication. About one third of this book is devoted to programming templates for over thirty popular phones. The balance consists of an elaborate technical dissertation describing the operation of the cellular network which reads like a Bellcore technical document (coincidence?). From switching to timing and signalling protocols - it's all here. The attention to technical detail can be an engineer's dream or mind-numbing to the casual reader. Although I occasionally became bogged down in things like "wink start signalling" and multi-frequency (MF) call routing codes, I appreciated the excruciating detail when I came to the 18 pages listing each and every frequency in the radio spectrum allocated to the cellular network by the FCC. The reprogramming instructions are easy to follow, but not as comprehensive as the templates in TeleCode's other publication (above). Approximately 180 spiral bound 8.5 x 11" pages. $53.45. Available from: TeleCode, P.O. Box 6426, Yuma, AZ, 85366-6426. (602) 782-2316. Cellular Phone Phreaking Technical documents published "for educational purposes only" by Consumertronics have a unique format and tone not generally found in other books. John J. Williams, MSEE and proprietor of the company, has a gift for presenting detailed technical information in an almost conversational manner full of examples and anecdotes. Cellular Phone Phreaking is no exception. The programming instructions are equivalent to those contained within TeleCode's Cellular Hacker's Bible. The technical description of the cellular network is brief, and Williams includes an abundance of information on how individuals have been known to perpetrate cellular fraud. Included are relevant excerpts from various communications privacy laws, including the text of the Electronic Communications Privacy Act (ECPA). Of value to the technician or monitoring enthusiast are the mathematical algorithms necessary to determine the cellular channel numbers based on the radio frequencies used. While informative and entertaining, this book is a bit thin compared to the others, but Williams crams in a lot of information by using small type and not wasting an inch of space. Approximately 41 spiral bound 8.5 x 11" pages. $39.00. Available from: Consumertronics, 2011 Crescent Drive, P.O. Box 88310, Alamogordo, NM 88310, (505) 434-0234. Cellular Telephone Modification Handbook The Cellular Telephone Modification Handbook is the one publication reviewed that is not really a programming manual per se. It is a book explaining in detail how a hacker would change the Electronic Serial Number (ESN) of a cellular phone. As a "security manual," the book holds nothing back in precisely demonstrating how criminals can defraud the system by doing so. I should note that a legitimate application for this information would be to "clone" a phone that you already own. By duplicating the ESN of your existing phone into another phone, you could use either unit at any given time and avoid having to pay for an additional number and service for the second phone. This seems analogous to adding an extension phone to your telephone service at home. Why have a separate number for each "extension?" Cellular companies don't like it, but it doesn't appear to be illegal. Emulating the phone of your local bank president in order to make free calls is another story entirely. In addition to basic "universal" programming guidelines, this book includes "screen dumps" of PROM emulation software, lists of manufacturers' ESN prefixes and System Identification Numbers (SIDs). Complete with sources for parts and equipment, as well as books and magazines related to the field of cellular communications. The representative I spoke with at Spy Supply provides programming support for their customers. If you need assistance with a specific phone, he'll provide you with programming information for that particular model at no charge. After purchasing the manual, I tested this service and found that he could answer every question I threw at him without hesitation. The availability of this invaluable resource elevates Spy Supply above the ranks of a typical publisher. Approximately 52 spiral bound 8.5 x 11" pages. $79.95. Available from: Spy Supply, 7 Colby Court, Suite 215, Bedford, NH 03110, (617) 327-7272. ****************************************************************************** AUTHOR BIOGRAPHY (For publication) Damien Thorn's interest in electronics has deep roots. A noted "hacker" and "phone phreak" by age sixteen, he contributed regularly to the underground newsletter "TAP." Today Damien is an on-air radio personality and FCC licensed engineer in California's San Joaquin Valley. His interests include computers, communications, security and privacy issues. He welcomes questions and comments. You can reach him at 6333 Pacific Ave. #203, Stockton, CA 95207-3713 or via E-Mail at one of the following: DrDamien@Delphi.com via Internet mail, on CompuServe at 75720,2104, or on Delphi as DrDamien.