The Hacker's Encyclopedia 1998

home *** CD-ROM | disk | FTP | other *** search

/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / zines / phrack2 / p48_07.txt < prev next >

Wrap

Text File | 2003-06-11 | 42.2 KB | 1,046 lines

==Phrack Magazine== Volume Seven, Issue Forty-Eight, File 7 of 18 TANDY / RADIO SHACK CELLULAR PHONES REBUILDING ELECTRONIC SERIAL NUMBERS AND OTHER DATA By Damien Thorn LEGAL CRAP (mandated by our cheap-suit, can't afford cigars, polyester-pants-wearing, no-practice-having, almost dis-barred, old-fart legal counsel who only charges us $20 / hour because he meant to retire when he was 70 but lived a few years longer than he expected...hell, we love him!) Contents copyright 1994, 1995 Phoenix Rising Communications. Software copyright 1993, 1994, 1995 as indicated. All Rights Reserved. Distribution of contents in hard-copy form is forbidden. Redistribution in electronic form is permitted only as outlined in the Phrack licensing agreement, provided this article is not segregated from the other editorial contents of Phrack #48. Use caution when rebuilding corrupt serial numbers, and avoid lending your talents to further the goals of unscrupulous people. Altering the serial number of a cellular transceiver is a violation of the FCC rules, and the U.S. Secret Service is charged with the responsibility of investigating fraudulent activity. All of this material was developed in-house and not provided or endorsed by the manufacturer. Brand names and trademarks are used for identification purposes only and are the property of their respective owners. Use of same within this article definitely does not imply agreement with or endorsement of the material presented, and probably aggravates them to no end. There are no guarantees or warranties with regard to the accuracy of this article. Although we've done the best job that we can, we may be wrong. Happens all the time. If you damage a phone or inadvertently start a global thermonuclear war, that's your problem. Don't come crying to us, or make us fork over another twenty bucks to the old shyster. What you do with this information is your responsibility. INTRODUCTION While manufacturers publish service manuals for their cellular transceivers, they have an annoying habit of omitting certain data pertaining to memory devices and the arrangement of the data stored inside them. Since this stored information includes the electronic serial number (ESN), the lack of documentation can easily be excused as a way to avoid unwittingly facilitating fraud. The drawback to the 'security through obscurity' approach is that service technicians who have a legitimate need to reprogram these memory devices are unable to do so. The Nokia-designed transceivers discussed in this article are an excellent example. Since the ESN is stored in the same electrically-erasable programmable read-only memory (EEPROM) device as the numeric assignment module (NAM) information, corruption of the data can be catastrophic to the operation of the phone. Since the handset programming mode of these Nokia units actually write-enables the memory device to store the alterable parameters, an errant pulse from the microprocessor, dropped bits or supply voltages falling out of tolerance can cause the ESN or checksum to become overwritten or otherwise rendered useless. Should this occur, dealers have had little recourse but to ship the transceiver back to the factory for repair. Until now, that is. The goal of Phoenix Rising Communications in producing this documentation is to empower technicians to do the job they have been educated and hired to perform. This guide to Tandy and Radio Shack cellular phones will enable the technician to rebuild the corrupt data within this series of transceivers with confidence. The information in this article was developed from the installed and transportable versions of the most commonly purchased phones from Radio Shack stores. These units were sold for many years, and finally replaced last year with a new, redesigned model. The data presented here can probably be applied to certain compatible Nokia transceivers as indicated later in the text. CHAPTER 1 This publication is designed to provide supplemental information to assist in the servicing of cellular mobile telephones manufactured by Tandy Corporation under license from the Nokia Corporation. It is not meant to be a replacement for the factory service manual. Any shop needing to perform component level repairs should definitely obtain the factory documentation from Tandy National Parts. Our primary goal is to explain the contents of the numeric assignment module, or NAM. In these particular phones, both the NAM parameters and the electronic serial number (ESN) are stored within the same electrically erasable programmable read-only memory (EEPROM) device. The problem inherent with this engineering decision is that the ESN stored within this chip is not necessarily permanent. Since the chip can be erased or reprogrammed, certain circumstances could possibly cause the ESN to become corrupt. These include improper signals from the microprocessor, induced currents or a power interruption during NAM programming as the write cycle is taking place. Since the available service literature does not describe the functions of this serial EEPROM or the data contained within, service personnel would have to return the transceiver to the manufacturer for service. This is not cost effective in terms of time or money for either the shop or cellular customer. Technicians who invest a little time to become familiar with the data stored within the NAM circuitry, including the placement of the ESN and checksum byte can service these types of problems in-house and with little difficulty. Basic instructions for peaking the transceiver's RF sections have also been included herein as a convenience. While the phone is open and on the test bench, the customer's transceiver should also be given a quick check for proper alignment. EQUIPMENT REQUIRED Other than basic hand tools, disassembly of the phone requires a soldering iron with a medium sized tip and a vacuum de-soldering tool. Good size solder removal braid may be used in conjunction with, or in lieu of the de-soldering tool. To correct data that has become corrupted within the EEPROM, a programming device is required capable of reading and burning an 8-pin DIP integrated circuit. One such inexpensive device is listed in appendix III. An individual who is familiar with the memory device involved has written a software program in the BASIC language to allow the programming of this chip via the parallel port of an IBM-compatible personal computer. The source code for this program can be found in the appendix, and is provided as a reference only. Such software is subject to the peculiarities of the host PC and therefore cannot be recommended for use in place of a standard PROM programmer. Older versions of GWBASIC are preferred to Microsoft's current QBASIC interpreter. MODELS COVERED The information presented is believed to cover all of the installed and transportable (bag phone) cellular transceivers manufactured by the Tandy Corporation under license from the Nokia Corporation up until about a year ago. Tests have been conducted on a random selection of these phones with manufacture dates ranging from 1989 through early 1994. All versions of the "TP" firmware through January, 1994 should be supported. Although no house-branded OEM Nokia transceivers have been tested, we have surmised that this information is applicable to several models based on the same or a similar design. These models include the Nokia LX-11, M-11, M-10 and the Nokia-Mobira P4000 (PT612). Some of these units, like the very old Radio Shack equivalents, will require a service handset to program. More on that in the next issue of Phrack. HAND-HELD UNITS Only one of the hand-held cellular phones previously sold through Radio Shack utilizes a discrete surface-mounted integrated circuit to store the ESN and NAM parameters. If you have the capability to read and program this SOIC 93C46 memory device you may be able to extrapolate the PROM dumps in this guide to work with this phone. Due to the difficulty in disassembling this unit and the delicate nature of the surface-mounted EEPROM, the reader is cautioned against attempting to service these in-house. DISASSEMBLY Prior to disassembling the transceiver, all antenna and cables, including the handset, should be disconnected from the jacks on the unit. To aid in disassembly and component location, the original hard-copy version of this publication contained several pages of photographs. While the hard-copy version is available (see end of article), you will hopefully be able to figure out what we're talking about without them. Disassembly begins by snapping the plastic end panel from the black transceiver cover. Some units just pop up and off, while others have two small plastic tabs on each side that must be depressed free the end panel for removal. With the end panel removed, the top plastic cover is now free to slide off. With this cover removed, the metal transceiver itself can be dumped from the remaining plastic housing by turning it upside down, or pulling up on the metal heat sink assembly that comprises one side of the transceiver unit. There is a metal shield on each side of the transceiver (top and bottom.) One is a solid piece of thin sheet metal, and the other is broken up in to smaller, individual shields and soldered to the transceiver chassis. The shield that needs to be removed is the solid one. It is only held in place with the friction grips along the edges, and can be pried off with your fingers. Once the shield is removed from the proper side of the transceiver, the solder side of the logic board will be exposed. This board must be removed to gain access to the component side. Take static precautions so as not to fry the CMOS silicon that is currently hidden from view. Other than several connectors that mate between the two boards, the board is usually held in place by several blobs of solder spaced along the edge of the board. These small 'solder welds' serve as a ground bond between the board and the transceiver chassis, and are not electrically necessary under normal circumstances. Once the solder ground bonds have been melted and removed with a de-soldering tool or solder wick, use a pair of needle-nose pliers to gently bend back the small metal tabs holding the circuit board in place. Before proceeding, inspect the foil side of the board to ensure that no solder has splashed on the board during de-soldering, and that the foil traces where the work was performed are still intact. This last step is where most trouble arises. These boards are delicate, and a heavy hand while prying or bending will almost ensure that a trace or five will be transected when the tool slips. If this happens, resolder the traces to undo the damage. At this point the logic board is held in place only by pins on the transceiver board sticking up in to sockets on the logic board. Gripping the edges of the logic board with your fingers and pulling straight up will disengage the connectors and allow the logic board to pull free of the transceiver. Slightly rocking the board from each side may aid in the removal. Do not grip the board with pliers or damage can result to the small chip resistors and other components mounted on the solder side of the board. Once dislodged, you'll have two separate circuit boards. THE LOGIC BOARD The board that supplies logic and control functions for the cellular mobile telephone is easily identifiable by the microprocessor and 27C512 EPROM containing the operating firmware. The EPROM's erase window is covered by a protective sticker that identifies the firmware version stored therein. Within the last few years, the version has ranged from TP-2 through TP-8. Also on this board is the serial EEPROM where the ESN and NAM parameters are stored. This chip is an 8-pin DIP located in a socket near pin #1 of the NEC microprocessor. It is usually covered with a small paper sticker bearing the last few digits of the serial number stored inside. While security experts may blast Nokia for designing a phone that stores the ESN in a socketed chip, and then says "here I am" by placing a sticker on it, this is a dream come true for any technician facing issues of data corruption. THE SERIAL EEPROM The Serial EEPROM containing all of this data is a PCD8572 (or 85C72) manufactured by Microchip Technology, Inc. This 8-pin device is a 1k (128x8) CMOS serial electrically erasable PROM. The pin configuration for the device can be found in the appendix. Power is supplied to this chip only when the microprocessor is performing a read or write operation. Transistor Q115 (surface mounted to the underside of the logic board right about in the middle) switches the supply voltage on and off. Should power be interrupted during the write cycle, the ESN may become corrupt. REBUILDING THE ESN To replace the damaged serial number, note the unit's serial number from the cellular service agreement or the phone itself. The ESN (in decimal) is located on a white paper sticker applied to the side of the metal transceiver chassis. It is also stamped into the plastic model identification plate on one side of the plastic outer housing. For reprogramming, the ESN must be converted to hex. A scientific calculator or any number of public domain computer programs will simplify the task. CONTENTS OF NAM Once the original serial number has been determined, carefully remove the 8572 EEPROM from the socket and place it in the adapter required by your PROM programmer. Reading the contents of the chip, you'll see data as depicted below. Note that these data dumps are simulated for illustrative purposes. The ESN and encoded MIN bytes are not legitimate numbers, so don't bother 'testing' them. The first five bytes of data contain the security code. These bytes are the hex values representing ASCII characters 0 through 9, thus represented as "3X" where "X" is the actual digit of the security code. A factory security code of 1 2 3 4 5 would be represented in bytes 00 through 04 as follows: 31 32 33 34 35 Since you will require the security code to enter handset programming mode, please note the current security code or program these bytes with your shop's standard default. UNDERSTANDING ADDRESSES Some cellular technicians have little experience in the digital world. Service monitors and watt-meters are expensive and wonderful devices, but sometimes you need to do a little more than tweak a pot to fix a phone. The digital-literate can skip this oversimplified explanation. To assist those in reading the locations of the various bytes in the EEPROM, understand that each line (as usually displayed on a programmer) contains sixteen (16) bytes. The first line begins with byte 00, then 01, 02, 03, 04, 05, 06, 07, 08, 09, 0A, 0B, 0C, 0D, 0E and finally 0F. The second line begins with 10, then 11, 12, 13, 14, 15, 16, 17, 18, 19, 1A, 1B, 1C, 1D, 1E, and 1F as the last byte of the line. The third line increments the same way, except as byte 30, 31, etc., to 3F. You now know how to count in base 16 (hex)! As an example, the locations used by the phone end at byte 3D, which contains 00 in the example below. Beginning with the next byte (3E), a repetitive pattern of alternating values of AA and 55 are stored. This is just 'test' data and is never read by the phone. The chip itself ends at byte 7F, and your PROM programmer may display FF following byte 7F to indicate the non-existence of these locations in the chip. 8572 EXAMPLE DATA DUMP 0000 31 32 33 34 35 0A FF 21 A5 38 25 82 0F 25 17 1A 0010 00 00 00 00 24 15 B1 C3 24 04 A3 21 16 2D 11 AA 0020 0A 00 00 64 6C B3 32 00 27 00 01 01 11 11 11 11 0030 11 08 4D 01 0F 01 0F 00 04 00 00 00 FF 00 AA 55 0040 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 0050 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 0060 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 0070 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 THE CRUCIAL SERIAL NUMBER The hex ESN for any given phone consists of four bytes, as we use the term here. Technically it is eight bytes (in hex, 32 bits if expressed in binary form), but we're referring to a 'byte' as a two-digit hex number, rather than each digit (byte) as a single entity. For our example, we're using the fictitious ESN of A521FF0A. All Radio Shack phones will have an ESN beginning with A5 hex. This is the "manufacturers code" prefix that has been assigned to Tandy. Breaking the ESN into four bytes as viewed on the PROM programmer, the ESN would appear as: A5 21 FF 0A Refer back to the example dump of the data within the 8572 IC. Immediately following the security code is the ESN stored in reverse order. With the security code occupying bytes 00 to 04, the ESN is located in bytes 05, 06, 07 and 08. Byte 09 contains the value 38. It should always contain 38. In the example, beginning with byte 05 you can read the ESN (in reverse sequence) as: 0A FF 21 A5 The examples below will assist you in visualizing the bytes containing the security code and the electronic serial number. The programming and placement of these two crucial pieces of data is fairly straight forward. Using the buffer editor function of the PROM programmer, you can simply type over the garbage that may be present in these locations with the correct values for the security code and the ESN. Double check your data entry! OTHER ADDRESSES The entire NAM data is stored in the remaining locations of this chip. Bytes 0A, 0B and 0C contain the firmware revision date, and bytes 0D - 0F contain the installation date as programmed via the handset programming mode. Other bytes contain the encoded Mobile Identification Number (MIN), Station Class Mark (SCM), etc. These various bytes do not need to be reprogrammed through your PROM burner, as they can all be corrected via handset programming. Only the security code and ESN must be properly reprogrammed directly to the chip itself. For more information on the locations of this other data, refer to the source code in Appendix A. It allows you to see where (and how) this other data is stored within the NAM. The last item to program is the checksum. THE SECURITY CODE: BYTES 00 - 04 0000 31 32 33 34 35 XX XX XX XX XX XX XX XX XX XX XX THE ESN: BYTES 05 - 08 0000 XX XX XX XX XX 0A FF 21 A5 XX XX XX XX XX XX XX LOCATING THE CHECKSUM There is a one byte device checksum stored within the 8572 that is used by the phone to check the integrity of the data stored therein. The checksum is located at byte 3D, indicated by "XX" in the example below. The checksum is derived from all the data stored in the NAM, not just the ESN. Computing it is relatively easy as it is simply the sum (in hex) of all the values from bytes 00 through 3C as underlined below. Assuming the PROM programmer has a checksum function, you can enter the beginning address as 0000 and the ending address as 003C. The software will add all of the values between these locations and give you the sum. The alternative is to add the numbers manually using the hex mode of a scientific calculator. Either way, adding the hex values of all the bytes between 00 and 3C of our example yields a sum of 0B5E. The least significant two-digit byte is the actual device checksum that would be programmed in location 3D. In our example, the least significant half is 5E. Ignoring the most significant half of the sum (0B), a value of 5E must be programmed to location 3D. Note that the checksum will be recomputed and change after handset programming. When the MIN or other data is changed, it alters the values in various bytes. The checksum encompasses all of the data stored within the chip used by the transceiver's firmware. CHECKSUM LOCATION 0000 31 32 33 34 35 0A FF 21 A5 38 25 82 0F 25 17 1A 0010 00 00 00 00 24 15 B1 C3 24 04 A3 21 16 2D 11 AA 0020 0A 00 00 64 6C B3 32 00 27 00 01 01 11 11 11 11 0030 11 08 4D 01 0F 01 0F 00 04 00 00 00 FF XX AA 55 0040 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 0050 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 0060 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 0070 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 BYTES SUMMED TO DERIVE CHECKSUM 0000 31 32 33 34 35 0A FF 21 A5 38 25 82 0F 25 17 1A 0010 00 00 00 00 24 15 B1 C3 24 04 A3 21 16 2D 11 AA 0020 0A 00 00 64 6C B3 32 00 27 00 01 01 11 11 11 11 0030 11 08 4D 01 0F 01 0F 00 04 00 00 00 FF .. .. .. 0040 .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 0050 .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 0060 .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 0070 .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. DEFAULT VALUES In the event that all of the data stored within the NAM becomes corrupt, the technician will need to program the security code, the ESN, and certain default data values to allow the phone to power up. Once powered up, all of the other data can be automatically reconstructed by the phone using the handset programming mode. Since the factory does not provide any information about the contents of the 8572 EEPROM, we are unsure of the function of this 'default data.' It seems to have little significance. The underlined bytes depicted below are fairly typical. Ideally the technician should compare the contents of an operational phone with equivalent firmware to determine the values for the underlined locations, but if this is not possible then the values provided in the example may suffice. Once these defaults have been programmed in the proper locations, and the ESN and security code have been reconstructed, compute the checksum and store it in address 3D. Temporarily reassemble the phone and apply power. The unit should power up and complete it's self-test which will include the operation where the microprocessor computes the NAM checksum and compares it to the value stored in location 3D. Assuming the self-diagnostics pass, the remaining data can now be reconstructed through normal handset programming. The handset programming template applicable to most of these units is located immediately following the appendix detailing the chip programming software included for reference purposes. DEFAULT DATA VALUES 0000 XX XX XX XX XX XX XX XX XX 38 XX XX XX XX XX XX 0010 00 00 00 00 XX XX XX XX XX XX XX XX XX XX XX XX 0020 XX XX XX XX XX XX XX 00 27 00 01 01 11 11 11 11 0030 11 08 4D 01 0F 01 0F 00 04 00 00 00 FF XX AA 55 0040 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 0050 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 0060 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 0070 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 AA 55 ADDITIONAL NOTES As discussed, the parallel port programming software interface has a few quirks, most involving the programming voltage supplied to the chip. If all else fails, and a PROM burner is not available, take the supply voltage (Vcc) directly from the logic board. Run test lead jumpers from pins #4 and #8 of the IC socket on the logic board that held the 8572 EEPROM and connect to the respective pins on the socket attached to the cable to be used for programming. Turn the board over and locate surface mount transistor Q115 which switches the supply voltage to the IC socket on and off. This small chip transistor is directly to the left of pin #8 (of the 8572 socket) and can be positively identified by the circuit trace from socket pin #8 leading directly to the emitter of Q115. By examining this area of the board, you can determine which of the other two traces connects to the transistor's collector. Jumpering the traces and shorting the collector and emitter simply provides a constant, conditioned voltage supply to the socket designed to power the 8572 in programming mode. It may also be necessary to cut the trace to the base of Q115. Once the chip has been programmed with the software, restore the integrity of the cut trace to the base of Q115 and remove the short between the collector and emitter. USING THE SOFTWARE The Cellular Data Repair Utility software requires that you first create a small text file using an ASCII text editor such as DOS's "EDIT" utility program. This text file must contain the data described below in the specific order presented. The data in this image (.img) file will be programmed into the 8572. XXX ESN Prefix (decimal) XXXXXXXX ESN (8 digits decimal) XXXXX SIDH (5 digits decimal) 1 Access Bit 1 Local Option Bit AAAPPPXXXX MIN (10 digits) 08 SCM 0XXX (0333 or 0334) 10 Access Overload Class 1 Pref. System Bit 10 GIM 12345 Security Code EXAMPLE IMAGE FILE Filename: TEST.IMG 165 00246812 00031 1 1 5105551212 08 0334 10 1 10 12345 PROGRAMMING Once the image file containing the appropriate data has been saved, run the software with QBASIC or Microsoft BASIC and follow the prompts. Be sure to set the proper parallel port address in line 1950 to reflect the port to which the interface is connected first. TUNING STEPS 1) With a digital voltmeter attached to the positive terminal of C908, adjust VR908 to provide a reading of 8 vdc (q 0.1 volt). 2) With the voltmeter attached to the positive terminal of C913, adjust VR918 for a reading of 8 vdc (q 0.1 volt). 3) Connect the voltmeter to test point TXV and enter diagnostic command 0, 1, SEL, 9, END. Adjust C676 to achieve a reading of 5 vdc control voltage (q 0.1 volt). 4) Check receiver control voltage with test point RXV. Adjust C614 for a reading of 4 vdc (q 0.1 volt). 5) With a power meter connected to the antenna connector of the transceiver through an attenuator, enter command SEL, 1, 2, SND, END to turn on the transmitter at high power. VR814 should then be adjusted to show 3 watts (34.8 dBm) on the power meter. 6) Using the same power meter, enter command SEL, 1, 3, 7, END. Adjust VR846 for a low power maximum reading of 4 milliwatts (6 dBm). 7) Using a frequency counter to measure the output of the antenna connector, adjust X600 for a reading of 836.4000 MHz (q 0.1 kHz). 8) Using a deviation meter, activate DTMF tones with command SEL, 2, 1, END, 1, 1, END and adjust VR259 for 8.4 kHz q 0.1 kHz DTMF deviation. 9) End DTMF signaling with command 1, 0, END. Enable SAT transmission by entering SEL, 2, 8, SND, END and adjust VR261 for 7.8 kHz deviation (q 0.1 kHz). 10) Enter SND, END to discontinue SAT signaling. ADDITIONAL ADJUSTMENT The level of audio fed to the earphone via the "ear" line (pin #7 on the handset connector) can be adjusted via VR215. 1.2 Vrms is the factory specified level with the volume turned up to it's maximum setting. Received audio signals can be adjusted for minimal distortion by peaking L703. Frequency deviation of voice audio can be fine tuned with VR260. Factory spec. is for 8 kHz deviation. POWER LOSS If the transceiver refuses to even power up and begin self-diagnostics, check the traces on the underside of the board near the power connector. Most of these units 'protect' themselves against reverse polarity being present on the power cables with fusible traces. If the phone is connected to a vehicle or battery power supply backwards, one of these very small circuit traces will vaporize, leaving the phone inoperative. While inconvenient for the customer and service technician alike, repairing the trace is an additional source of revenue for the shop that might not be generated had a standard replaceable fuse or rectifier been utilized in the design. APPENDIX III TECHNICAL RESOURCES EEPROM PROGRAMMER In preparing this article and performing other research involving various types of firmware, we used the EPROM+ programming system from Andromeda Research. This small, portable device is housed in a carrying case and requires no internal card to operate with your PC. Once the software is installed on the computer, the EPROM+ programmer is simply plugged into an available parallel printer port. To program the PCD8572 series EEPROMs, a small adapter is required. You can construct this yourself from the included instructions, or purchase it already built for about $35 extra. The EPROM+ programming system is available for $289 from the manufacturer: Andromeda Research P.O. Box 222 Milford, Ohio 45150 (513) 831-9708 - voice (513) 831-7562 - fax SERVICE MANUALS Service manuals are available for most Radio Shack or Tandy products from Tandy National Parts. Ordering these publications requires that you visit your local Radio Shack store. Tell the clerk that you want him (or her) to call National Parts and order a service manual for catalog number.... National Parts no longer accepts calls from consumers and will only ship to a recognized Radio Shack retail outlet. NOKIA - MOBIRA Service handsets, manuals and other parts can be ordered from Nokia-Mobira in Largo, Florida. Their toll-free technical assistance number is (800) 666-5553. TANDY FAX-BACK SERVICE Tandy Support Services offers technical information via fax-back server. There is no mention that the service is restricted to Radio Shack stores. Although ANI can be hell, the toll-free number is (800) 323-6586 if you want to be faxed product info on assorted 'Shack products. The server makes neat video game noises, and thanks you for using the service. For an index of the cellular specification sheets available via fax-back, request document #8882. Programming instructions are also available from this automated fax server: DOCUMENT # PHONE MODEL 9009 Current List [index] 8728 CT-105, 1050, 1055 9004 CT-350 9005 CT-302 9006 CT-102, 103, 104, 1030, 1033 9007 CT-300, 301 9008 CT-100, 101, 200, 201 9020 CT-351 9665 BC901ST [170-1015] 9579 CP-1700 [170-1016] 9577 CP-4600/5600 [170-1067 / 170-1056] 14493 Ericsson AH-210 [170-1064] 9581 EZ-400 [170-1057] 9743 Motorola 12822 [170-1058] 9583 Motorola DPC550 [170-1059] This information provided for reference purposes only. Use of this fax-back service may be restricted to authorized personnel. No one has ever faxed me to complain, however. THE INTERFACE The uuencoded drawing which accompanies this article describes the interface required to use the programming software to rebuild the data stored within the serial EEPROM. Because there are a number of variables that can affect the performance of this software and interface, prepare yourself for a bit of trial and error. A standard programming device is recommended over the use of this software. Since the original publication of this manual in hard-copy, we've heard reports that the software does not work well with the PCD8572, but does favor the PCD85C72 (CMOS version). The DB-25 connector is wired to an 8-pin DIP socket to accommodate the 8572 integrated circuit. A regulated, well-filtered source of 5 volts must be connected to pin #8 of the DIP socket, and Pin #4 must be tied to ground. If the PC used for programming and the power source to the IC socket share a common ground, you may be able to use pin #25 of the parallel port connector as shown in the diagram. Please be careful not to cause any shorts in this instance or you may damage your computer by sinking too much current through the parallel port. If you are unsure of what you are doing, eliminate the connection between pin #4 of the IC socket and pin #25 of the DB-25 connector. Instead, connect pin #4 directly to ground. The resistor shown in the circuit is used as an optional voltage divider. Depending on the voltage provided by pin #2 of your parallel port, a resistor between 100 and 1k ohms may be required to drop it to a level within the nominal range required by the EEPROM. TUNING THE RADIO The diagrams in the uuencoded .zip file will assist in identifying and locating the various adjustment points on the logic board and transceiver (RF) PC board. Alignment should not be attempted by technicians unfamiliar with the principles involved, or in the absence of calibrated radio frequency measurement equipment. A diagnostic (service) handset may be required to access service-level commands within the transceiver. If the phone does not respond properly to the commands documented herein, you'll need to obtain a service handset from Tandy National Parts. This handset is actually a Nokia "programming handset" which can be obtained directly from the factory. PROGRAMMING TEMPLATE For Tandy / Radio Shack Cellular Mobile Telephones Models CT-102, 302, 1030, 1033, etc. 1) Power up phone. After the phone cycles through it's self-test mode and the display clears, enter the following keystrokes from the keypad: *, 3, 0, 0, 1, #, X, X, X, X, X, SEL, 9, END The X, X, X, X, X represents the five-digit security code stored in EEPROM. The factory default is 1, 2, 3, 4, 5. This security code is required to access handset programming mode. 2) The display will now read: IdEnt IF InFO Pri 3) Press END to program NAM 1. Display will show first programming step. 4) To program NAM 2, press SND twice instead of END. Display will cycle through: OPt InFO diSAbLEd then OPt InFO EnAbLEd 5) Use the END key to step through each step. The SND key toggles the state of single-digit options. To enter new information, use END to step through the display until the old data is displayed. Key in the new data and press END to increment to the next step. 6) When programming has been completed, press SEL, CLR to save changes. Step # Desired Input Display Data Description 01 5 digits HO-Id SIDH (Home System Identification) 02 0 or 1 MIN Mark MIN Mark (Toggle with SND) 03 0 or 1 LOCL OPt Local Use Mark (Toggle with SND) 04 10 digits Phon MIN (Area Code + Mobile Number) 05 08 St CLASS SCM (Station Class Mark) 06 333 or 334 PAging Ch IPCH (Initial Paging Channel) 07 2 digits O-LOAd CL Access Overload Class 08 A or B PrEF SyS Preferred System (Toggle with SND) 09 2 digits grOUP Id GIM Mark (Set to 10 in U.S.) 10 5 digits SECUrity Security Code 11 ------- 1 dAtE Firmware Date - not changeable 12 mmddyy 2 dAtE Installation Date Press SEL, CLR to save & exit. Turn Power off and back on for model CT-302. [Begin Editorial] -------------------------------------------------------------------------- HOW TO OBTAIN A HARD-COPY VERSION OF THIS FILE - WITH ALL PHOTOS: -------------------------------------------------------------------------- "The Complete Guide to Tandy / Radio Shack Cellular Hardware" is available for $15 prepaid. We keep $5 of the price to cover the cost of printing and the Priority mail postage. The remaining $10 of the purchase price will be donated to Boston's The L0pht to help them cover the cost of upgrading their Internet connection for l0pht.com.... The guys at the L0pht have always been cool with us, and maintain what amounts to one of the best cellular archives accessible on the 'net. We want to do what we can to assist them in providing this public source of enlightenment. Now you can help them, and get something for it in return. If nothing else, you can sit back and enjoy all my great close-up photos of the chips <g>! -- Damien Thorn Here's the address: Phoenix Rising Communications 3422 W. Hammer Lane, Suite C-110 Stockton, California 95219 [end editorial] ----------------------------------------------------------------------------- You can reach me via e-mail at: damien@prcomm.com ----------------------------------------------------------------------------- 1000 ' CELLULAR DATA REPAIR UTILITY 1005 ' Form image and program PCD8572 IC via LPT port. 1010 ' (c) 1993, 1994, 1995 WarpCoreBreachGroup - All rights reserved. 1015 ' 1020 ' This program is not shareware/freeware. 1025 ' 1030 DATA xx,xx,xx,xx,xx,xx,xx,xx ' Bytes 00-07 1040 DATA xx,38,xx,xx,xx,xx,xx,xx ' Bytes 08-15 1050 DATA 00,00,00,00,xx,xx,xx,xx ' Bytes 16-23 1060 DATA xx,xx,xx,xx,xx,xx,xx,xx ' Bytes 24-31 1070 DATA xx,xx,xx,D6,C5,5C,C6,00 ' Bytes 32-39 1080 DATA 27,00,01,01,11,11,11,11 ' Bytes 40-47 1090 DATA 11,08,4D,01,0F,01,0F,00 ' Bytes 48-55 1100 DATA 04,00,00,00,FF ' Bytes 56-60 1105 UNIT1$="050490" 1110 DIM BYTE$(60),BYTE(61) 1120 FOR I=0 TO 60:READ BYTE$(I):NEXT 1130 FILES "*.IMG" 1140 LINE INPUT "Which file do you want to read? ";F$ 1150 OPEN "I",#1,F$+".IMG" 1160 INPUT#1,ESNPREFIX 1170 INPUT#1,ESN# 1180 INPUT#1,HOMEID 1190 INPUT#1,ACCESS 1200 INPUT#1,LOCALOPT 1210 INPUT#1,PHONE$ 1220 INPUT#1,STATCLASS 1230 INPUT#1,PGCH 1240 INPUT#1,OVERLDCL 1250 INPUT#1,PREFSYS 1260 INPUT#1,GROUPID 1270 INPUT#1,SEC$ 1280 ' Building binary image 1290 UNIT2$=MID$(UNIT$,1,2)+MID$(UNIT$,4,2)+MID$(UNIT$,9,2) 1300 CLOSE #1 1310 FOR I=1 TO 5:BYTE$(I-1)="3"+MID$(SEC$,I,1):NEXT 1320 FOR I=0 TO 2:BYTE$(10+I)=RIGHT$("0"+HEX$(VAL(MID$(UNIT1$,I*2+1,2))),2) 1325 NEXT 1330 FOR I=0 TO 2:BYTE$(13+I)=RIGHT$("0"+HEX$(VAL(MID$(UNIT2$,I*2+1,2))),2) 1335 NEXT 1340 FOR I=0 TO 4:BYTE$(24+I)=MID$(PHONE$,2*I+1,2):NEXT 1350 FOR I=5 TO 0 STEP -1 1360 Q=INT(ESN#/(16^I)) 1370 ESN#=ESN#-Q*(16^I) 1380 IF Q>9 THEN Q=Q+7 1390 ESN$=ESN$+CHR$(48+Q) 1400 NEXT 1410 BYTE$(8)=RIGHT$("0"+HEX$(ESNPREFIX),2) 1420 BYTE$(5)=MID$(ESN$,5,2) 1430 BYTE$(6)=MID$(ESN$,3,2) 1440 BYTE$(7)=MID$(ESN$,1,2) 1450 FOR I=0 TO 60:Q$=BYTE$(I) 1460 QH=ASC(LEFT$(Q$,1))-48:IF QH>9 THEN QH=QH-7:IF QH>15 THEN QH=QH-32 1470 QL=ASC(RIGHT$(Q$,1))-48:IF QL>9 THEN QL=QL-7:IF QL>15 THEN QL=QL-32 1480 Q=QH*16+QL 1490 BYTE(I)=Q:CHECK=CHECK+Q 1500 NEXT 1510 BYTE(20)=HOMEID AND 255:BYTE(21)=INT(HOMEID/256) 1520 BYTE(22)=ACCESS 1530 BYTE(23)=LOCALOPT 1540 BYTE(29)=STATCLASS 1550 BYTE(30)=PGCH AND 255:BYTE(31)=INT(PGCH/256) 1560 BYTE(32)=OVERLDCL 1570 BYTE(33)=PREFSYS 1580 BYTE(34)=GROUPID 1590 AC$=MID$(PHONE$,1,3) 1600 PRE$=MID$(PHONE$,4,3) 1610 PH$=MID$(PHONE$,7,4) 1620 AC=VAL(AC$) 1630 IF MID$(AC$,2,2)="00" THEN AC2=AC-1:GOTO 1670 1640 IF MID$(AC$,3,1)="0" THEN AC2=AC-101:GOTO 1670 1650 IF MID$(AC$,2,1)="0" THEN AC2=AC-11:GOTO 1670 1660 AC2=AC-111 1670 PRE=VAL(PRE$) 1680 IF MID$(PRE$,2,2)="00" THEN PRE2=PRE-1:GOTO 1720 1690 IF MID$(PRE$,2,1)="0" THEN PRE2=PRE-11:GOTO 1720 1700 IF MID$(PRE$,3,1)="0" THEN PRE2=PRE-101:GOTO 1720 1710 PRE2=PRE-111 1720 IF PRE2<0 THEN PRE2=1000+PRE2 1730 IF LEFT$(PH$,1)="0" THEN D=-24:GOTO 1750 1740 D=87-24*(ASC(PH$)-49) 1750 IF MID$(PH$,4,1)="0" THEN D=D-10 1760 IF MID$(PH$,3,1)="0" THEN D=D-100 1770 IF MID$(PH$,2,1)="0" THEN D=D-1000 1780 IF MID$(PH$,1,1)="0" THEN D=D-10105 1790 PH2=VAL(PH$)-D 1800 C=INT(PRE2/4) 1810 B=64*(PRE2 AND 3) 1820 A=PH2 AND 255 1830 B=B OR INT(PH2/256) 1840 BYTE(35)=A 1850 BYTE(36)=B 1860 BYTE(37)=C 1870 BYTE(38)=AC2 AND 255 1880 BYTE(39)=INT(AC2/256) 1890 CHECK=0 1900 FOR I=0 TO 60 1910 CHECK=CHECK+BYTE(I) 1920 NEXT 1930 BYTE(61)=CHECK AND 255 1940 DEV$="1010":ADDR$="000" 1945 ' Select the base address for your printer port with the next line. 1950 BASE=&H378 ' Which is LPT2. &h378 is LPT1 and &h3bc is LPT3. 1960 GOTO 2120 1970 OUT BASE,(DOUT AND 1) OR 2*(CLK AND 1) OR 4*(RELAY) 1980 FOR DELAY=0 TO 9:NEXT 1990 DIN=INP(BASE) AND 1 2000 RETURN 2010 FOR I=1 TO LEN(B$) 2020 B=ASC(MID$(B$,I,1))-48 2030 DOUT=B:CLK=0:GOSUB 1970 2040 DOUT=B:CLK=1:GOSUB 1970 2050 DOUT=B:CLK=0:GOSUB 1970 2060 NEXT 2070 T=0 2080 DOUT=1:CLK=1:GOSUB 1970 2090 IF DIN=0 THEN RETURN 2100 IF T=200 THEN BEEP:PRINT "Nack timeout error":STOP 2105 ' Is voltage applied to the chip? 2110 T=T+1:GOTO 2080 2120 MAX=61:RELAY=1:DOUT=1:CLK=1:GOSUB 1970 2130 T$=TIME$ 2140 IF T$=TIME$ GOTO 2140 2150 FOR J=0 TO MAX 2160 DOUT=1:CLK=1:GOSUB 1970 ' Start bit 2170 IF DIN=0 THEN BEEP:PRINT "Bus not free error":STOP ' Bad! 2180 DOUT=0:CLK=1:GOSUB 1970 2190 DOUT=0:CLK=0:GOSUB 1970 2200 B$=DEV$+ADDR$+"0" 2210 GOSUB 2010 2220 B$="" 2230 FOR I=7 TO 0 STEP -1 2240 IF (J AND (2^I)) THEN B$=B$+"1" ELSE B$=B$+"0" 2250 NEXT 2260 GOSUB 2010 2270 Z=BYTE(J) 2280 B$="":FOR I=7 TO 0 STEP -1 2290 IF (Z AND (2^I)) THEN B$=B$+"1" ELSE B$=B$+"0" 2300 NEXT 2310 GOSUB 2010 2320 DOUT=0:CLK=0:GOSUB 1970 2330 DOUT=0:CLK=1:GOSUB 1970 ' Stop bit 2340 DOUT=1:CLK=1:GOSUB 1970 2350 PRINT USING "###% programmed";100*J/MAX 2360 PRINT STRING$(80*J/MAX,46) 2370 LOCATE CSRLIN-2,POS(0) 2380 GOSUB 1970 2390 IF DIN=0 GOTO 2380 2400 NEXT 2410 RELAY=0:DOUT=1:CLK=1:GOSUB 1970 2420 PRINT:PRINT 2430 'This is the end in case you though the code was truncated somehow...