Shareware Overload Trio 2

home *** CD-ROM | disk | FTP | other *** search

/ Shareware Overload Trio 2 / Shareware Overload Trio Volume 2 (Chestnut CD-ROM).ISO / dir24 / crcmfhg1.zip / MISC / FRAUD / CELL.TXT next >

Wrap

Text File | 1993-05-06 | 141KB | 3,377 lines

PART XVI. HOME SYSTEM ID LISTING (M-Z) SYSTEM NON(A) WIRE(B) Macon,GA 443 426 Madison,WI 217 210 Manchester,NH 445 428 Mansfield,OH 447 430 Marshall,TX 229 418 Mayaguez 449 432 McAllen,TX 451 434 Medford,OR 061 436 Melbourne,FL 175 068 Memphis,TN 143 062 Miami,FL 037 024 Midland,TX 459 422 Millville,NH TBA 250 Milwaukee,WI 005 044 Minneapolis,MN 023 026 Mobile,AL 081 120 Modesto,CA 233 224 Moline,IL 193 186 Monroe,LA 463 440 Monterey,CA 527 126 Montgomery,AL 465 444 Moorehead,ND TBA 330 Muncie,IN 467 080 Muskegon,MI 021 448 Nashua,NH 445 428 Nashville,TN 179 118 NE Pennsylvania 103 172 New Bedford,MA 119 028 New Brunswick,NY 173 022 New Haven,CT 119 088 New London,CT 119 088 New Orleans,LA 057 036 Newport News,VA 083 168 New York,NY 025 022 Norfolk,VA 083 168 Ocala,FL 473 348 Odessa,TX 475 422 Oklahoma City,OK 169 146 Olympia,WA 047 006 Omaha,NE 137 152 Orange County,NY 479 486 Orlando,FL 175 068 Owensboro,KY 197 190 Oxnard,CA 027 002 Panama City,FL 483 462 Parkersburg,WV 485 032 Pascagoula,MS 487 264 Pasco,WA TBA 500 Pensacola,FL 361 120 Peoria,IL 221 214 Petaluma,CA 031 040 Petersburg,VA 071 472 Philadelphia,PA 029 008 Phoenix,AZ 053 048 Pine Bluff,AR 215 208 Pittsburg,PA 039 032 Pittsfield,MA 119 480 Ponce,PR 497 082 Portland,ME 499 482 Portland,OR 061 030 Portsmouth,NH 501 484 Poughkeepsie,NY 503 486 Providence,RI 119 028 Provo,UT 091 488 Pueblo,CO 045 490 Racine,WI 217 044 Raleigh,NC 069 144 Rapid City,SD 511 494 Reading,PA 103 008 Redding,CA 513 294 Reno,NV 515 498 Richland,WA 517 500 Richmond,VA 071 170 Roanoke,VA 519 502 Rochester,NH 501 484 Rochester,MN 521 504 Rochester,NY 117 154 Rockford,IL 217 506 Sacramento,CA 129 112 Saginaw,MI 021 389 Salem,OR 061 030 Salinas,CA 527 126 Salt Lake City,UT 091 094 San Angelo,TX 529 510 San Antonio,TX 151 122 San Diego,CA 043 004 San Francisco,CA 031 040 San Jose,CA 031 040 Terre Haute,IN 567 080 Texarkana,AR/TX 229 550 Toledo,OH 021 130 Topeka,KS 059 552 Trenton,PA 029 008 Tuscon,AZ 053 140 Tulsa,OK 111 166 Tuscaloosa,AL 577 098 Tyler,TX 579 418 Utica,NY 235 226 Vallejo,CA 031 040 Victoria,TX 581 562 Vineland,NJ 583 250 Visalia,CA 153 162 Waco,TX 587 566 Warren,OH 089 126 Washington,DC 013 018 Waterloo,IA 589 568 Wausau,WI 591 570 West Palm Beach,FL 037 024 Wheeling,WV 039 032 Wichita Falls,TX 595 574 Wichita,KS 165 070 Wilkes Barr,PA 103 172 Williamsport,PA 103 576 Wilmington,DE 123 008 Wilmington,NC 599 578 Winston-Salem,NC 095 142 Worcester,MA 007 028 Yakima,WA 601 580 York,PA 159 096 Youngstown,OH 089 126 Yuba City,CA 129 112 ***************************************************************************** PART I. WHAT IS BROADCAST FROM A CELLULAR TOWER? When a cellular phone makes a call, it normally transmits it's Electronic Security Number(ESN),Mobile Identification Number(MIN),it's Station Class Mark(SCM) and the number called in a short burst of data. This burst is the short buzz you hear after you press the SEND button and before the tower catches the data. These four things are the components the cellular provider uses to ensure that the phone is programmed to be billed and that it also has the identity of both the customer and the phone. There are usually two cellular phone companies in an area. One is the wire-line carrier (Band B), which is usually Bell, and the other is the non-wireline carrier (Band A). Within the two bands are 832 cellular phone channels. Each one has 416 bands, and within the bands are voice channels that actually transmit and receive information from cellular phones. The ESN and the phone number (MIN) are the two primary identifiers for any cellular phone. By changing both, the cellular carrier will accept the call and bill it to either a wrong account or provide service based on the fact that it is NOT a disconnected receiver. It will also look at the other two components, in order to insure that it is actually a cellular phone and to forward billing information to that carrier. The Station Class Mark can also be changed if you wish to prevent the cellular carrier from determining the type of phone that is placing the call. By providing the cellular tower with a false SCM, the cellular carrier, the FCC, or whoever happens to chase down cellular fraud is often looking for a particular phone which in reality is not the phone they are looking for. For example, you can provide the SCM for a Radio Shack phone, when in reality you are using a Novatell (How this is done from changing the SCM I do not know...remember...I didn't write this). The Number Assignment Module (NAM) also has the SIDH (System Identification for Home System) number programmed into it. Refer to SIDH TABLE. The transmittal of the SIDH number tells the carrier where to forward the billing information to in case the user is "roaming". The SIDH table tells the major cities and their identifying numbers. Changing an SIDH is programming job that takes only minutes, but be aware that the ESN is still sent to the cellular phone company. After they realize that the ESN is connected to either a fake number or a phone that is not in the network, they will block service. They only way around this is to reprogram the ESN. ***************************************************************************** PART II. DEFINITIONS The following is a list of commonly used abbreviations used in cellular phones. SIDH A 15-bit field in the NAM designating the System Identification for the Home System. Bit 0 of the SIDH corresponds to the Preferred System flag used elsewhere in the NAM. Bits 6 and 5 of byte 0 are international code bits. Normally the SIDH is entered during programming of the phone as a 5 digit decimal number. Enter 0's to the left-most unused positions when reprogramming. L.U. Local Use Flag. Tells the cellular phone user if it must preregister with the system. Preregistration with the system means that a mobile must transmit its parameters to the Cellular System as soon as the power-up task and the control channel tasks are completed. "1" enables the flag. Usually set to "1". MIN MARK A 1-bit flag designating that MIN2 (area code) is always sent when making system access. "1" enables the flag. Usually set to "1". MIN2 A 10-bit field representing the area code of the mobile ID number. MIN1 A 24-bit field representing the mobile telephone number. MIN2 plus MIN1 equals MIN, the 10-digit phone number. SCM A 4-bit field designating the Station Class Mark. A (3-Watt) 832 channel mobile unit typically will be 1000, a 1.2 Watt portable 1001 or a 0.6 Watt handheld 1010 or 1110 (discontinuous transmission, meaning push-to-talk). These are class I, Class II and Class III power levels respectively. With the SCM the cellular system determines whether or not a cellular phone can be switched to one of the 156 channels. Bit-1 is "0" for 666 and "1" for 832. (See cellular freq. list) Bit-2 is "0" for a mobile unit and "1" for a voice-activated transmit. Bit-3 and -4 identify the power class of the phone: "00" = 3.0 watts "01" = 1.2 watts "10" = 0.6 watts "11" is not assigned IPCH An 11-bit field designating the initial paging channel to be used if in the home system. Normally it is 334 for wireline systems, 333 for non- wireline systems. But most phones allow other settings for test purposes. ACCOLC A 4-bit field designating the overload class for the cellular phone. The intention of this entry is to allow the Cellular System to be able to determine priority in the event of a system overload, however it is currently useless as the system operators have generally not provided guidance for thier installers. The usual (and correct) system now in effect (in U.S.) is to use a "0" plus the last digit of the phone number. Test phones should be set at "10",emergency vehicles at "11","12" through "15" are reserved. (A class 15 system is supposed to be police, fire, or military). P.S. 1 1-bit flag designating the preferred system. If PS is "0", channels 334 through 666(EVIL!!!) are used. If PS is "1" then channels 1 through 333 are used. Even numbered system numbers (B systems) require a PS of "0", odd system numbers (A systems) require a "1". GIM A 4-bit field designating the Group Identification Mark. This number tells the Cellular system how far to look in the SIDH to determine if it is roaming in a system which may have a roam agreement with the phone system. It is usually set to "10". LOCK DIGITS A 4-bit field designating the unlock code. The digit "0" in the lock code is represented by an "A" in the actual NAM hexidecimal data. A lock code of all "0" sometimes unlocks the cellular phone.(Note: Lock codes are 3 digits. When programming a phone use "0" as the first number.) E.E. A 1-bit flag designating that end-to-end signaling is enabled. End-to-end signaling means that the DTMF tones will be transmitted on the voice channel as well as being echoed on the handset. This feature in necessary for such services as Bank by Phone, activating answering machines and in third party long distance services such as Sprint and MCI. A "1" enables the flag. Usually set to "1". REP A 1-bit flag designating that repertory memory (speed dialing) in the cellular phone is enabled. And once a again a "1" enables the flag. H.A. A 1-bit flag designating that the horn alert feature in enabled. "1" enables the flag. H.F. A 1-bit flag designating that the handsfree option is enabled. A "1" enables the flag. Often, transceivers supplied as hands-free units require that this flag be left at "0". ***************************************************************************** PART III. TYPES OF NAMS NAM Types Used in Cellular Phones NAM- Number Assignment Module - A 32 word by 8 bit PROM The NAM contains all the information that can be programmed to the phone directly from the handset. (i.e. SIDH,MIN,LOCK-CODE,etc.). All phones except NEC will accept tri-state NAMs. NEC requires an open collector NAM. Fujitsu phones will accept either open collector or tri- state NAMs. Brand Qualifications: Fujitsu and Alpine phones will not operate properly with any Harris Brand NAM or with any Signetics brand NAMs with a part number NOT ending with an "A". TI NAMs must not be used in GE Star models. Panasonic has suggested only TI NAMs should be used in their phones. NAMs are available in ceramic (F) or plastic encapsulation (N). BRAND OPEN COL. TRI-STATE OPEN COL. TRI-STATE ============================================================================= Signetics 82S23 82S123 Texas Inst. 74S188 74S288 TBP18SA030 TBP18S030 AMD AM27LS18 AM27LS19 AM27S18 AM27S19 Texas Inst. TBP38SA030 TBP38S030 Harris HM7602 HM7603 MMI 53/6330 53/6331 MMI 53/63S080 53/63S081 NSC DM54S188 DM54S288 DM74S188 NSC DM82S23 DM82S123 Motorola This is for a special NAM used in some Motorolas. Requires an adapter. Fujitsu MB7056 MB7051 ***************************************************************************** PART IV. NAM FORMAT MAP HEX MARK DEFINITION MOST <- BIT SIGNIFICANCE -> LEAST ADDRESS ---------------------------------------------------------------------------- 0 SIDH (14-8) 00 SIDH (7-0) 01 LU=LOCAL USE** 000000 MIN 02 LU A/B* RI* MIN2(33-28) 03 MIN2(27-24) 0000 04 0000 MIN1(23-20) 05 MIN1(19-12) 06 MIN1(11-4) 07 MIN1(3-0) 0000 08 0000 SCM(3-0) 09 00000 IPCH(10-8) 0A IPCH(7-0) 0B 0000 ACCOLC(3-0) 0C PS=PREFERRED** 0000000 PS 0D SYSTEM 0000 GIM(3-0) 0E LOCK DIGIT 1 LOCK DIGIT 2 0F LOCK DIGIT 3 LOCK SPARE BITS 10 EE=END TO END EE 000000 REP 11 SIGNALING HA 000000 HF 12 REP=REPERTORY ---------------------------------------------- HA=HORN ALERT 13 HF=HANDS FREE 14 15 16 SPARE LOCATIONS (13-1D) 17 CONTAIN ALL ZEROS EXCEPT 18 FOR MANUFACTURERS OPTIONS 19 1A 1B 1C 1D NAM CHECKSUM ADJUSTMENT 1E NAM CHECKSUM 1F The Checksum Adjustment and Checksum are calculated automatically after the data has been edited for the NAM. The sum of all words in the NAM plus the last two must equal a number with "0" in the last two digits. The radio checks this sum and if it isn't correct, the radio assumes the NAM is bad or that it has been tampered with. * - These bits are used only by AT&T,Hitachi and Mitsubishi. They are A/B Enable and Roam Inhibit. They must be "0" for all other models. ** - My information does not agree here. One source claims that address 03 has 6 bits and that address 0D has 7 bits. The other source states the the exact opposite. ***************************************************************************** PART V. STANDARD NAM FORMATS NAMs are generally mapped the same in all cellular phones, and the ones that have no "fancy" options are generally programmed the same. This chart provides the usual digits and settings for almost every NAM. ITEM DESCRIPTION NO. OF DIGITS USUAL SETTING -------------------------------------------------------------------------- 1 First 3 digits 3 XXX of phone number 2 Last 4 digits 4 XXXX of phone number 3 Lock Code(LOCK) 3 or 4 XXXA or XXXX 4 Area Code (MIN2) 3 XXX 5 Home Area System ID No. (SIDH) 4* XXXX 6 Horn Alert (HA) 1 0 or 1 7 Hands Free (HF) 1 0 or 1 8 End-to-End Signaling 1 1 (EE) 9 Repertory Mark (REP) 1 1 10 Group Identification 2 10 Mark (GIM) 11 Access Overload Class 2 XX* (ACCOLC) 12 Station Class Mark (SCM) 4* XXXX 13 Local Use Mark (LU) 1 1 14 Min Mark (MIN) 1 1 15 Initial Paging Channel 3 333 or 334* (IPCH) 16 Preferred System Mark 1 0 or 1* (PS) * Notes- 1. Home Area ID Number normally consists of five digits. However, four are usually sufficient is the U.S. 2. Access Overload Class is generally made up of a "0" plus the last digits of the telephone number. Some systems set at "15" or "00". 3. Station Class Mark is expressed as four binary digits. 4. Initial Paging Channel is 334 for wireline, 333 for non-wireline systems. 5. The Preferred Mark System is set to "0" for wireline, "1" for non- wireline systems. ***************************************************************************** PART VI. NAM Programming (Reprogramming) Instructions For 30+ Cellular Telephones ----------------------------------------------------------------------------- PLEASE NOTE: Area specific numbers contained within these programming instructions may not be accurate for your cellular area. ----------------------------------------------------------------------------- Programming Instructions for: DIAMONDTEL MESA90X HANDHELD ACTION TO STORE DISPLAY USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE - PRESS FCN 7 ENTER 4 DIGIT SECURITY CODE ENTER NEW 3 DIGIT UNLOCK CODE PRESS CLR PWR up unit Press "END" and hold within 10 seconds of pwr up Enter "5132920" Release END key. 0 SEND DUAL NO XXXXXXXXXX SEND NO1 _ _ _ _ _ SEND SID1 1 SEND LU1 1 SEND EX1 334 SEND IPCH1 07 SEND ACCOLC1 0 SEND PREF1 10 SEND GIM1 0 SEND RI1 1 SEND DTX1 1 SEND AR1 1234 SEND SEC 1 SEND EE 1 SEND C TONE 0 SEND AL 0 SEND BO 1 SEND BEEP TO EXIT PROGRAMMING MODE PRESS "END" AT ANY TIME TO RESET NAM FROM THE LIMIT OF 3 PROGRAM ATTEMPTS PWR up unit Press "END" and hold within 10 seconds of pwr up TO RESET NAM OF MESA 90 HANDHELD USE THE CODE "6972814" Programming Instructions for: DIAMONDTEL MESA99X HANDHELD ACTION TO STORE DISPLAY USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE - PRESS FCN 7 ENTER 4 DIGIT SECURITY CODE ENTER NEW 3 DIGIT UNLOCK CODE PRESS CLR PWR up unit Press "END" and hold within 10 seconds of pwr up Enter "5132920" Release END key. 0 SEND DUAL NO XXXXXXXXXX SEND NO1 _ _ _ _ _ SEND SID1 1 SEND LU1 1 SEND MIN MARK1 334 SEND IPCH1 07 SEND ACCOLC1 10 SEND GIM1 0 SEND RI1 0 SEND DTX1 0 SEND AR1 1234 SEND SEC 1 SEND CONTINUE D.T.M.F. 0 SEND AUTO LOCK 0 SEND BOOSTER TO EXIT PROGRAMMING MODE PRESS "END" AT ANY TIME Programming Instructions for: GATEWAY CP 900 HANDHELD USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE - CURRENT UNLOCK CODE CAN NOT BE SEEN AND MUST BE KNOWN TO CHANGE THE CURRENT UNLOCK CODE. PRESS MENU ENTER 03 ENTER CURRENT 4 DIGIT SECURITY CODE ENTER NEW 4 DIGIT SECURITY CODE PHONE WILL AUTO EXIT TO READY ACTION TO STORE DISPLAY PRESS MENU 99 ENTR SCRTY CODE(FCTRY PRST IS 9999) PROGRAM NAM _ _ _ _ _ SEND SID XXXXXXXXXX SEND PHONE NUMBER 0334 SEND IPC 07 SEND ACCOL 10 SEND GIM 1 SEND MOBILE I.D. NUMBER 1 SEND LOCAL USE MARK 2 SEND SYSTEM SELECT (B) UPON PRESSING SEND THE PHONE WILL CYCLE TO WAIT AND THEN RETURN TO THE READY MODE. TO DISPLAY THE NEW PHONE NUMBER: PRESS RCL 00 Programming Instructions for: GENERAL ELECTRIC MINI II ACTION TO STORE DISPLAY USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE - PRESS FCN 7 ENTER 4 DIGIT SECURITY CODE ENTER NEW 3 DIGIT UNLOCK CODE PRESS CLR PWR up unit Press and hold END key within 10 seconds of pwr up Enter "6282905" Release END key 0 Press SEND DUAL NO XXXXXXXXXX Press SEND NO1 _ _ _ _ _ Press SEND SID1 1 Press SEND LU1 1 Press SEND EX1 0334 Press SEND IPCH1 07 Press SEND ACCOLC1 0 Press SEND PREF1 10 Press SEND GIM1 0 Press SEND RI1 1 Press SEND DTX1 1 Press SEND AR1 1234 Press SEND SEC 1 Press SEND EE 1 Press SEND C DTMF 0 Press SEND AL 0 Press SEND BEEP 0 Press SEND BO TO EXIT PROGRAMMING MODE PRESS "END" AT ANY TIME Programming Instructions for: GENERAL ELECTRIC MINI ACTION TO STORE DISPLAY USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE - UNLOCK CODES WILL BE CHANGED ONLY IN PROGRAMMING MODE FOLLOW THE INSTRUCTIONS THAT FOLLOW PWR up unit Press and hold CL key within 10 seconds of pwr up 0Enter "7591122" Release CL key XXXXXXXXXX PRESS SEND MIN 123 PRESS SEND UNLOCK _ _ _ _ _ PRESS SEND SID 1 PRESS SEND LU 1 PRESS SEND MIN MARK 334 PRESS SEND IPCH 07 PRESS SEND ACCOLC 0 PRESS SEND PS 10 PRESS SEND GIM 1 PRESS SEND EE 0 PRESS SEND BOOSTER 1 PRESS SEND AR TO EXIT PROGRAMMING MODE PRESS "END" AT ANY TIME Programming Instructions for: MITSUBISHI 800 ACTION TO STORE DISPLAY PWR up unit Press and Hold STO within 10 Seconds of pwr up Enter "5474432" Release STO 0 Press SEND dUAL XXXXXXXXXX Press SEND NO1 _ _ _ _ _ Press SEND SId1 1 Press SEND LU1 0 Press SEND MIN Mark 0334 Press SEND IPCH 07 Press SEND ACCOLC 0 Press SEND PS1 10 Press SEND GI1 1234 Press SEND SECUrity 1 Press SEND EE 0 Press SEND dt 1 Press SEND HF 0 Press SEND InHIbit 1 Press SEND C tOnE 0 Press SEND SyS A/B 0 Press SEND dUAL HS 0 Press SEND InHibit Ld TO EXIT PROGRAMMING MODE PRESS "END" AT ANY TIME Programming Instructions for: MITSUBISHI 900 ACTION TO STORE DISPLAY PWR up unit Press and Hold END key within 10 seconds of pwr up Enter "6972814" Release END key 0 Press SEND DUAL NO XXXXXXXXXX Press SEND NO1 _ _ _ _ _ Press SEND SID1 1 Press SEND LU1 0 Press SEND EX1 0334 Press SEND IPCH1 07 Press SEND ACCOLC1 0 Press SEND PREF1 10 Press SEND GIM1 0 Press SEND RI1 1 Press SEND DTX1 1 Press SEND AR1 1234 Press SEND SEC 1 Press SEND EE 1 Press SEND C DTMF 0 Press SEND AL 0 Press SEND BO 1 Press SEND BEEP TO EXIT PROGRAMMING MODE PRESS "END" AT ANY TIME TO ENTER TEST MODE HOLD END ON PWR UP-CODE 0944635 Programming Instructions for: MOTOROLA 8000H ACTION TO STORE DISPLAY USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE - THIS FUNCTION IS PROVIDED IN STEP 9 OF THE PROGRAMMING MODE PWR up unit Enter STORE #123456123456 RCL If the phone is fresh from factory then Enter STORE #000000000000 RCL If the phone is used or already programmed then Enter STORE #123456123456 RCL DISPLAY WILL SHOW 01 PRESS * _ _ _ _ _ * 02 (SID) XXX * 03 (Area Code) XXX XXXX * 04 (Phone #) 14 * 05 07 * 06 00 * 07 123456 * 08 123 * 09 334 * 10 010100 * 11 000 * PRESS * TO REVIEW ENTRIES TO BURN NAM: PRESS SEND WHILE 01,02,03, ETC. IS DISPLAYED SET TO SCAN B MODE BY : RCL * : PRESS * UNTIL SCAN B MODE SHOWS then: press store Programming Instructions for: MOTOROLA ULTRA CLASSIC HANDHELD ACTION TO STORE DISPLAY USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE - THE UNLOCK CODE IS PROGRAMMED IN STEP 8 OF THE PROGRAMMING MODE FOR NEW PHONE: Press FCN, 0 + Security code entered twice (Factory preset is 000000), RCL The message 01 will appear in the display to confirm programming mode. Press * 01 Press * 1) _ _ _ _ _ Press * 02 Press * 2) XXX Press * 03 Press * 3) XXX XXXX Press * 04 Press * 4) 14 Press * 05 Press * 5) 07 Press * 06 Press * 6) 10 Press * 07 Press * 7) 123456 Press * 08 Press * 8) 123 Press * 09 Press * 9) 0334 Press * 10 Press * 10) 010101 Press * 11 Press * 11) 101 Press * 12 Press * Review entries by pressing "*" repeatedly. Press SEND to program phone. Programming Instructions for: NEC P300 ACTION TO STORE DISPLAY THESE INSTRUCTIONS FOR SERIAL NUMBERS AFTER 135-839601 Insert NAM Programming Adapter (NECAM #41-2019) into plug connector on P300 phone bottom. PWR On RCL # 0 1 to enter test mode. Phone will display shaded blocks. RCL # 7 6 to select NAM. Phone will show 76- Press 0 # to program NAM 1. (NAM 1=0,NAM 2=1,NAM 3=2,NAM 4=3) RCL # 7 1 to enter programming mode. XXXXXXXXXX PRESS # MIN 1234 PRESS # LOCK CODE _ _ _ _ _ PRESS # SID 10 PRESS # GROUP I.D. 0334 PRESS # INITIAL PAGING CH 0 PRESS # SYSTEM SELECT (1=A) 07 PRESS # ACCOLC 1 PRESS # MIN MARK 1 1 PRESS # LOCAL USE 911 PRESS # EMERGENCY NO. Press Clr (and hold) to exit programming and return to TEST MODE. Press RCL # 0 2 to burn and exit to standby. THESE INSTRUCTIONS FOR SERIAL NUMBERS PRIOR TO 135-839601 Insert NAM Programming Cable (41-2019) PWR on RCL # 7 6 to enter TEST MODE Press 0 # to select NAM. RCL # 7 1 You are now in Programming Mode. Enter NAM info as above. Press and hold CLR to exit. Pwr down. Programming Instructions for: NEC P9100 ACTION TO STORE DISPLAY USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE - UNLOCK CODES WILL BE CHANGED ONLY IN PROGRAMMING MODE FOLLOW THE INSTRUCTIONS THAT FOLLOW Make sure NAM battery is fully charged before attempting programming Switch power on Press RCL #01 display will then show shaded blocks For a USED phone - to clear nam and accumulated call timer Press RCL #39 To program NAM1 Press RCL #760# To enter programming mode Press RCL #71 XXXXXXXXXX Press # MIN 1234 Press # Lock Code _ _ _ _ _ Press # SYS. I.D. 10 Press # G.I. Mark 0334 Press # First Paging Channel 0 Press # System Select 07 Press # ACCOLC 0 Press # MIN Mark 1 Press # Local Use TO EXIT PROGRAM MODE AT THIS TIME PRESS CLR AND HOLD DISPLAY WILL SHOW TEST MODE TO EXIT TEXT MODE PRESS RCL#02 IF THE MEMORY IS CLEARED VIA RCL #39 DURING THE PROGRAMMING THEN THE PHONE WILL AUTOMATICALLY ENTER FULL-LOCK AFTER EXITING THE TEST MODE TO UNLOCK: FCN #XXXX(4 DIGIT LOCK CODE FOR LAST NAM PROGRAMMED). Programming Instructions for: NOKIA P-30 ACTION TO STORE DISPLAY USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE - PRESS SEL 7 UNLCODE APPEARS ON THE DISPLAY ENTER 5 DIGIT SECURITY CODE AND THE CURRENT UNLOCK CODE APPEARS IN THE DISPLAY PRESS CLR AND ENTER THE NEW FOUR DIGIT UNLOCK CODE PRESS SEL TO STORE THE NEW CODE - NOTE: IF YOU DON'T PRESS SEL WITHIN FIVE SECONDS THE DISPLAY WILL CLEAR AND CANCEL THE FUNCTION PWR up unit Enter *17*2001*12345* HO-Id must appear on display Press SEL to view current value Display will be one step behind TO STORE instructions _ _ _ _ _ Press SEL ACCESS (SID) 1 Press SEL LOCAL 1 Press SEL PhonE n XXXXXXXXXX Press SEL CLASS 10 Press SEL PAGE ch 334 Press SEL O-LOAd 07 Press SEL GrouP 10 Press SEL SEC 12345 Press SEL AUTO EXIT PROGRAM MODE TO EXIT PROGRAMMING MODE AT ANY TIME PRESS "END" WHEN THE SEL KEY IS PRESSED FOLLOWING THE LAST PARAMETER VALUE, THE PHONE WILL AUTOMATICALLY EXIT THE NAM PROGRAMMING MODE AND RETURN TO NORMAL OPERATION Programming Instructions for: NOVATEL PTR800 ACTION TO STORE DISPLAY USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE - UNLOCK CODES WILL BE CHANGED ONLY IN PROGRAMMING MODE FOLLOW THE INSTRUCTIONS THAT FOLLOW PWR up unit Press FCN Press FCN again Enter *626776* Display will show CMT REV and a date code - Press Volume Up Display will show NAM SELECT1 Press Volume Up _ _ _ _ _ PRESS # PRESS VOLUME UP SIDH PRESS VOLUME UP SCM XXXXXXXXXX PRESS # PRESS VOLUME UP MIN 0333 PRESS # PRESS VOLUME UP IDCCA 0334 PRESS # PRESS VOLUME UP IDCCB 0334 PRESS # PRESS VOLUME UP IPCH 07 PRESS # PRESS VOLUME UP ACCOLC 10 PRESS # PRESS VOLUME UP GIM 123 PRESS # PRESS VOLUME UP LOCK A 456 PRESS # PRESS VOLUME UP LOCK B 1 PRESS # PRESS VOLUME UP OPTION LC 1 PRESS # PRESS VOLUME UP OPTION EX 0 PRESS # PRESS VOLUME UP OPTION PS 0 PRESS # PRESS VOLUME UP OPTION NSC 1 PRESS # PRESS VOLUME UP OPTION EE 1 PRESS # PRESS VOLUME UP OPTION REP 0 PRESS # PRESS VOLUME UP OPTION HA 0 PRESS # PRESS VOLUME UP OPTION HF 0 PRESS # PRESS VOLUME UP OPTION F1 0 PRESS # PRESS VOLUME UP OPTION F2 0 PRESS # PRESS VOLUME UP OPTION F3 0 PRESS # PRESS VOLUME UP OPTION F4 TO EXIT PROGRAMMING MODE AT ANY TIME PRESS FCN END FCN FCN *6462257* WILL CLEAR THE NAM IF IT HAS BEEN PROGRAMMED MORE THAN 3 TIMES OR IF THE NEED EXISTS TO CLEAR THE MEMORY Programming Instructions for: NOVATEL PTR825 ACTION TO STORE DISPLAY PWR up unit Press FCN Press FCN again Enter *697201* Display will show CMT REV 972 105 Press Volume Up 1 PRESS # VOL UP NAM SELECT 1 _ _ _ _ _ PRESS # VOL UP SIDH 10 PRESS VOL UP SCM XXXXXXXXXX PRESS # VOL UP MIN 0333 PRESS VOL UP IDCCA 0334 PRESS VOL UP IDCCB 0334 PRESS # VOL UP IPCH 07 PRESS # VOL UP ACCOLC 10 PRESS # VOL UP GIM 123 PRESS # VOL UP LOCK A 123 PRESS # VOL UP LOCK B 1 PRESS # VOL UP LC 1 PRESS # VOL UP OPTION EX 0 PRESS # VOL UP PS - PREF SYSTEM 0 PRESS VOL UP OPTION NSC 1 PRESS # VOL UP OPTION EE-END TO END 1 PRESS # VOL UP OPTION REP 0 PRESS # VOL UP HORN ALERT 0 PRESS # VOL UP HANDS FREE 0 PRESS # VOL UP OPTION F1 0 PRESS # VOL UP OPTION F2 0 PRESS # VOL UP OPTION F3 1 PRESS # VOL UP OPTION F4 AIR RND UP 0 PRESS # VOL UP OPTION F5 FUTURE USE 0 PRESS # VOL UP OPTION F6 FUTURE USE 0 PRESS # VOL UP OPTION F7 FUTURE USE Programming will now wrap to beginning SIDH display. Press VOL UP to review entries Programming Instructions for: OKI HANDHELD MODEL # 750 ACTION TO STORE DISPLAY USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE - THIS FUNCTION IS PROVIDED FOR IN THE PROGRAMMING SEQUENCE Pwr up unit Press (*) and (#) simultaneously Enter 10 digit Sec Code as follows: *12345678# What follows can be done only once! The display "Enter NEW PW-Sto" Enter 0123456789 then press STORE Pwr unit down. Pwr up unit Press MENU and RCL simultaneously Enter 0123456789 Software Version and ESN Number in HEX Clears in 2 secs. Spd Dial Mem Clear Press 0 Press STO Def Data Reset Press 0 Press STO NAM 1 Mode Own #111 111-1111 XXX XXX XXXX Press STO Vol Up Security 123456 Press STO Vol Up OPTION 1100 Press STO Vol Up SCM 1010 Press STO Vol Up GIM 10 Press STO Vol Up Unlock # 1234 Press STO Vol Up ACCOLC # 07 Press STO Vol Up IPCH NO. 0334 Press STO Vol Up _ _ _ _ _ Press STO Vol Up System ID: At this time you may exit the programming mode by pressing CLR to bypass the other NAM modules. Programming Instructions for: OKI HANDHELD MODEL # 900 ACTION TO STORE DISPLAY USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE - THIS FUNCTION IS PROVIDED FOR IN THE PROGRAMMING SEQUENCE Pwr up unit Press RCL and MENU simultaneously Enter 10 digit Sec Code as follows: *12345678# What follows can be done only once! The display "Enter NEW PW-Sto" Enter 0123456789 then press STORE. The display "Re-Enter New PW-Sto" Enter 0123456789 then press STORE to enter Programming Mode. IF You don't wish to keep the new password then Pwr unit down. Software Version and ESN Number in HEX Clears in 2 secs. Spd Dial Mem Clear Press * Press STO SPD DIAL MEM CLEAR Press * Press STO DEFAULT DATA CLEAR NAM 1 Mode Own #111 111-1111 XXX XXX XXXX Press STO Vol Up MIN 123456 Press STO Vol Up SECURITY _ _ _ _ _ Press STO Vol Up SYSTEM ID: 0334 Press STO Vol Up IPCH 07 Press STO Vol Up ACCOLC # 15 Press STO Vol Up GROUP I.D. 1234 Press STO Vol Up UNLOCK CODE 1010 Press STO Vol Up STATION CLASS 1110 Press STO Vol Up OPTION At this time you may exit the programming mode by pressing CLR to bypass the other NAM modules. Programming Instructions for: PANASONIC EB3500 Charged Battery and Nam Adaptor are needed. ACTION TO STORE DISPLAY USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE - THIS FUNCTION IS PROVIDED FOR IN THE PROGRAMMING SEQUENCE *0000# to enter program mode *1 Press SND NAM 1 MODE _ _ _ _ _ Press STO 01 SIDH XXXXXXXXXX Press STO 02 OWNDL 0 Press STO 03 PRESYS 334 Press STO 04 IPCH 07 Press STO 05 ACCOLC 10 Press STO 06 GIM 00 Press STO 07 DLMT 10 Press STO 08 SCM 911 Press STO 09 SPDL 1234 Press STO 10 LOCK 1 1 0 1 1 0 0 0 Press STO 11 FCN 1 0 0 0 1 0 1 0 0 Press STO 12 FCN 2 1 1 1 1 0 1 1 1 Press STO 13 FCN 3 STO ** END to program phone Programming Instructions for: COLT TRANSPORTABLE ACTION TO STORE DISPLAY USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE - UNLOCK CODES WILL BE CHANGED ONLY IN PROGRAMMING MODE FOLLOW THE INSTRUCTIONS THAT FOLLOW Phone must be locked, to accomplish: press FUNC 5 Enter: FUNC #626# FUNC The software revision date will be shown. Press SEND This will advance phone through memory locations. E.S.N. will be displayed, press SEND again. XXX Press SEND AREA CODE XXX XXXX Press SEND PHONE NUMBER _ _ _ _ _ Press SEND SYSTEM ID 07 Press SEND ACCOLC 10 Press SEND GIM 1 Press SEND LOCAL USE MARK 1 Press SEND MIN MARK (MOBILE ID) 123 Press SEND LOCK CODE 0 Press SEND AUTOMATIC LOCK 123 Press SEND CALL RESTRICTION 12 Press SEND CALL COUNTER RESET 1 Press SEND ENABLE HANDSFREE 0 Press SEND DISABLE HORN ALERT 0 Press SEND HA TURN OFF TIME 12 Press SEND TOTAL AIRTIME RESET TO REVIEW PROGRAMMING AT THIS TIME PRESS SEND. TO EXIT PROGRAMMING AND STORE DATA AT ANY TIME PRESS END FUNC END - WAKE UP WILL SOUND, PHONE WILL BE LOCKED ENTER UNLOCK CODE- 123 SYSTEM PREFERENCE MUST BE KEYPAD SELECTED! PRESS FUNC 7 FOR "A" NON W/L OR PRESS FUNC 8 FOR "B" W/L SYS. Programming Instructions for: DIAMONDTEL MESA 55 TRANSPORTABLE ACTION TO STORE DISPLAY PWR up unit Press "CL" and hold within 10 seconds of pwr up Enter "1951426" Current Mobile I.D. will display XXXXXXXXXX Press SEND MIN 123 Press SEND 1 SECURITY _ _ _ _ _ Press SEND 2 SID 1 Press SEND 3 LU 1 Press SEND 4 MIN MARK 334 Press SEND 5 IPCH 07 Press SEND 6 ACCOLC 0 Press SEND 7 PREF SYS 10 Press SEND 8 GIM 1 Press SEND 9 EE 1 Press SEND 10 ENBL HANDSFREE 0 Press SEND 11 RI 04 Press SEND 12 AUX 1 07 Press SEND 13 AUX 2 Phone automatically returns to show the 10 digits MIN number at this time and to indicate that the NAM has been programmed. The END key should be pressed to burn the NAM. Programming Instructions for: DIAMONDTEL MESA95 TRANSPORTABLE ACTION TO STORE DISPLAY PWR up unit Press and hold Clr within 10 Seconds of pwr up Enter "1951426" Release Clr 0 Press SEND duaAL no XXXXXXXXXX Press SEND no1 _ _ _ _ _ Press SEND SId1 1 Press SEND LU1 1 Press SEND E1 334 Press SEND IPCH1 07 Press SEND ACCOLC1 0 Press SEND PS1 10 Press SEND GI1 5 Press SEND t InC1 1234 Press SEND SECUrIty 1 Press SEND EE 0 Press SEND dt 0 Press SEND HF 0 Press SEND InHIbIt 1 Press SEND Ctone 0 Press SEND dIS CU 0 Press SEND dIS IGn SEnSE 0 Press SEND DUAL HS TO EXIT PROGRAMMING MODE PRESS "END" AT ANY TIME TO RESET NAM FROM THE LIMIT OF 3 PROGRAM ATTEMPTS FOLLOW THE BLOCK OF INSTRUCTIONS AT TOP USING "8291112" W/CLR TO RESET NAM OF MESA 90 HANDHELD USE THE CODE "6972814" Programming Instructions for: FUJITSU MOBILE PHONE ACTION TO STORE DISPLAY PWR up unit Unit must be locked to program. To lock press F+LOCK PWR down unit. PWR up unit. Within 10 seconds press #626#7764726 (#NAM#PROGRAM) A continuous tone will be heard for 7 seconds. PRESS AND HOLD THE * KEY WHILE THE TONE SOUNDS, DO NOT LET GO! The tone will change to an intermittent tone, then it will stop. Release the * key. CONGRATULATIONS!!! YOU ARE NOW IN PROGRAMMING MODE! _ _ _ _ _ PRESS STOR 1 SIDH 1 PRESS STOR 2 LOCAL 1 PRESS STOR 3 MIN MARK XXXXXXXXXX PRESS STOR 4 MIN 10 PRESS STOR 5 STATION 0334 PRESS STOR 6 IPCH 07 PRESS STOR 7 ACCOLC 0 PRESS STOR 8 PS 10 PRESS STOR 9 GIM 1234 PRESS STOR 10 LOCK 1 PRESS STOR 11 CALL TIME 2 PRESS STOR 12 AUTO LOCK 1 PRESS STOR 13 CALL REST PRESS STOR TO REVIEW ENTRIES. WHEN AT MODE #1 PRESS SEND TO BURN NAM AND RETURN TO NORMAL OPERATION. IF PROGRAMMING WAS DONE INCORRECTLY A SHORT HIGH TONE WILL BE HEARD, YOU MUST THEN REPEAT DATA ENTRY. YOU MUST PRESS STOR AFTER EACH ENTRY FOR THE CHECKSUM FUNCTION TO BE FULFILLED. Programming Instructions for: GENERAL ELECTRIC CARFONE XR3000 ACTION TO STORE DISPLAY USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE - THE UNLOCK CODE IS PROGRAMMED IN STEP 2 OF THE PROGRAMMING MODE PWR up unit Press "CL" and hold within 10 seconds of pwr up Enter "923885" Serial # will display Press Send key to advance to first entry XXXXXXXXXX Press SEND MIN 123 Press SEND UNLOCK _ _ _ _ _ Press SEND SID 1 Press SEND LU 1 Press SEND MIN MARK 334 Press SEND IPCH 07 Press SEND ACCOLC 0 Press SEND PS 10 Press SEND GIM 0 Press SEND AUX 1 Press SEND HANDS PRESS SEND TO REVIEW ENTRIES. NOTE: AREA CODE (402) WILL DISPLAY FOR MIN THEN AUTO SWITCH TO REST OF NUMBER ON DISPLAY - BE PATIENT PRESS "E" KEY TO COMPLETE PROGRAMMING OF THE XR 3000 AT THIS TIME Programming Instructions for: GOLDSTAR SERIES 5000 MOBILE ACTION TO STORE DISPLAY PWR up Unit Press FCN 4 to see the selected NAM. Press * to advance. Select NAM1. Press FCN, 9, 9, * "Enter Code" will be displayed. Enter 1234567890 XXXXXXXXXX PRESS MEM Enter MIN _ _ _ _ _ PRESS MEM Enter System ID 0334 PRESS MEM Enter IPCH 07 (ACCOLC) PRESS MEM Enter OVLD Class 1234 PRESS MEM LOCK CODE 123456 PRESS MEM SECURITY CODE 1234 PRESS MEM ALARM DISARM CODE 0 PRESS MEM PREFFERED SYSTEM 0 PRESS MEM STATION CLASS MARK 1 PRESS MEM HANDS FREE MARK (ON) 1 PRESS MEM LOCAL USE MARK (ON) 1 PRESS MEM MIN MARK (ON) 0 PRESS MEM HORN ALERT (OFF) 0 PRESS MEM OPT. SPEAKER (OFF) TO SAVE TO NAM NOW PRESS MEM TO REVIEW ENTRIES USE THE VOLUME UP OR DOWN KEYS Programming Instructions for: MITSUBISHI 555,560,600 ACTION TO STORE DISPLAY USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE - TO PROGRAM THIS FUNCTION YOU MUST BE OUT OF THE PROGRAMMING MODE ENTER FCN 6 AND THEN ENTER THE NEW 3 DIGIT UNLOCK CODE PRESS CLR. To program from keypad remove and discard Nam Pad PWR up unit Press and Hold STO key within 10 seconds of pwr up Enter "5474432" Release STO key XXXXXXXXXX Press SEND MIN 123 Press SEND SECURITY CODE _ _ _ _ _ Press SEND SID 1 Press SEND LU 1 Press SEND MIN MARK 334 Press SEND IPCH1 07 Press SEND ACCOLC1 0 Press SEND PS1 10 Press SEND GIM 1 Press SEND EE 1 Press SEND HANDS FREE 0 Press SEND ROAM INHIBIT 0 Press SEND A/B SELECT 00 Press SEND f3-f0 DUAL HEAD 00 Press SEND f7-f4 LD INH TO EXIT PROGRAMMING MODE PRESS "END" AT ANY TIME Installing the LOCK CODE To program the customer's lock code, the phone must be out ot the programming mode. To program, enter FCN, 6,3-digit security code, the a 3-digit lock code. Press CLR. Programming Instructions for: NEC M3700 SERIES MOBILE ACTION TO STORE DISPLAY USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE - UNLOCK CODES WILL BE CHANGED ONLY IN PROGRAMMING MODE FOLLOW THE INSTRUCTIONS THAT FOLLOW A NAM PROGRAMMER ADAPTOR (NECAM #41-2012) IS REQUIRED PWR UP TO ENTER TEST MODE: RCL, #,0,1. WILL CYCLE TO SHADED TO CLEAR MEMORY: RCL # 3 9 select nam RCL # 7 6 0 # nam 1 RCL # 7 6 1 # nam 2 TO ENTER PROGRAMMING MODE: RCL #71 XXX XXX XXXX PRESS # Telephone No. (MIN) 1234 PRESS # Lock Code _ _ _ _ _ PRESS # Home Area (SYS I.D.) 10 PRESS # G-NO (Group I.D.) 0334 PRESS # First Paging Channel 0 for wireline PRESS # System Select 07 PRESS # ACCOLC 1 PRESS # ACCESS 1 PRESS # Local Use To exit PROGRAMMING MODE PRESS CLR and hold TEST MODE will show to exit TEST MODE RCL #02 IF MEM WAS CLEARED VIA RCL #39, PHONE WILL AUTOMATICALLY ENTER FULL-LOCK AFTER EXITING THE TEST MODE. TO UNLOCK PRESS FCN # 1234. Programming Instructions for: NOKIA LX-11 ACTION TO STORE DISPLAY USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE - PRESS SEL,5 THEN ENTER 5 DIGIT SECURITY CODE PRESS SEL TO RECEIVE DISPLAY OF CURRENT UNLOCK CODE PRESS 5 NOW TO CLEAR ALL CALL TIMERS ENTER THE NEW UNLOCK CODE PRESS SEL TO ACCEPT PWR up unit Enter *3001#12345 Then - SEL 9 END IdEnt IF InFO should appear on display Pressing END will move you through the parameters Pressing SND will toggle between choices available _ _ _ _ _ Press END HO-Id (SID) 1 Press END ACCESS 1 Press END LOCL OPt XXXXXXXXXX Press END Phonxx 08 Press END St CLASS 334 Press END PAging Ch 07 Press END O-LOAd CLASS B Press END PrEF SyS 10 Press END grOUP Id 12345 Press END SECUrIty -------- (Can't be changed) Press END 1 dAtE 00/00/90 (INSTALLATION DATE) Press END 2 dAtE TO EXIT PROGRAMMING MODE AT ANY TIME PRESS "END" TO STORE LAST PARAMETER THEN POWER DOWN WHEN THE "END" KEY IS PRESSED FOLLOWING THE LAST PARAMETER, THE TEXT Prog donE WILL APPEAR ON DISPLAY Programming Instructions for: NOKIA M-10 ACTION TO STORE DISPLAY USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE - THIS FUNCTION IS PROVIDED BY THE SECURITY CODE PROGRAMMED AT THE TIME OF PROGRAMMING PWR up unit Enter *17*3001*1234* HO-Id must appear on display Press SEL to view current value Display will be one step behind TO STORE instructions _ _ _ _ _ Press SEL ACCESS (SID) 1 Press SEL LOCAL 1 Press SEL PhonE n XXXXXXXXXX Press SEL CLASS 08 Press SEL PAGE ch 334 Press SEL O-LOAd 07 Press SEL GrouP 10 Press SEL SEC 1234 Press SEL AUTO EXIT PROGRAM MODE TO EXIT PROGRAMMING MODE AT ANY TIME PRESS "END" WHEN THE SEL KEY IS PRESSED FOLLOWING THE LAST PARAMETER VALUE, THE PHONE WILL AUTOMATICALLY EXIT THE NAM PROGRAMMING MODE AND RETURN TO NORMAL OPERATION Programming Instructions for: NOVATEL 8305 TRANSPORTABLE CA08 SOFTWARE VERSION USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE - IF EQUIPMENT IS PROVIDED WITH A MENU KEY THEN ENTER THE MENU PORTION OF THE PHONE AND DISPLAY AND IF NECESSARY REPROGRAM THE UNLOCK CODE FROM THERE. IF PHONE DOES NOT HAVE A MENU KEY THEN THERE CAN BE NO PROGRAMMING OF THE UNLOCK CODE... THE SECURITY CODE WILL BE ALL THAT IS PROVIDED Lock Phone by pressing FCN 1 Enter Programming Mode by pressing #259 Screen will display the software revision number Press Volume Up Screen will display Phone's E.S.N. Press Volume Up Screen will display INIT REP USE SND Press SEND to erase any numbers stored in the phones memory Press Volume Up _ _ _ _ _ Send Vol. Up SIDH system I.D. XXX XXX XXXX Send Vol. Up MIN mobile I.D. Must be changed when done Send Vol. Up LOCK CODE 1 programming - BY CUSTOMER Must be changed when done Send Vol. Up LOCK CODE 2 programming - BY CUSTOMER SET Vol. Up Option EX extnd adrss 334 press send to change Vol. Up IPCH initial pge 07 Send Vol. Up ACCOLC overload 10 Send Vol. Up GIM group i.d. 333 Vol. Up IDCCA initl a 334 Vol. Up IDCCB initl b 1 Vol. Up REG TBL SIZE Volume up through the four invalid System I.D. addresses SET Vol. Up OPTION LU local use B press send to change Vol. Up OPTION PS (prefered sys) CLR Vol. Up OPTION IRI rm inhbt CLR Vol. Up OPTION SSD SET Vol. Up OPTION QRC qck rcall SET Vol. Up OPTION QST qck store SET Vol. Up OPTION WUT wake tone SET Vol. Up OPTION EE use dtmf SET Vol. Up OPTION FD use dtmf SET Vol. Up OPTION MFD ext dtmf SET Vol. Up OPTION 32D dgt dial CLR Vol. Up OPTION MLH timer CLR Vol. Up OPTION LHM timer CLR Vol. Up OPTION CRU timer dsp CLR Vol. Up OPTION NLM timer SET for on CLR for off Vol. Up OPTION HA hrn alert CLR Vol. Up OPTION ONL diagnostc END to exit or VOLUME UP to review entries. Programming Instructions for: OKI CDL400 ACTION TO STORE DISPLAY To Enter Programming mode: Press IN SEQUENCE: END RCL FUNC CLR SND Screen shows Entr id Enter 08693427 XXX XXX XXXX PRESS # PRESS * PHon _ _ _ _ _ PRESS # PRESS * S id no 0334 PRESS # PRESS * iPCH 07 PRESS # PRESS * ACC oLC 123 PRESS # PRESS * LoC Cod 10 PRESS # PRESS * G id 0000 PRESS # PRESS * Stn CLS 0111 PRESS # PRESS * HORN ALERT, HANDS FREE, LOCAL USE, MIN. MARK. PRESS END AT THIS TIME TO EXIT PROGRAMMING MODE. __________________________________________________________________________ TO REPROGRAM TELEPHON NUMBER AND SYSTEM I.D. # - PRESS IN SEQUENCE THE FOLLOWING KEYSTROKES: FUNC 90 * 123 (SECURITY CODE) PHon WILL DISPLAY ENTER NEW PHONE NUMBER XXX XXX XXXX PRESS # PRESS * PHon _ _ _ _ _ PRESS # PRESS * S id no PRESS END AT THIS TIME TO EXIT PROGRAMMING MODE. ___________________________________________________________________________ To Re-Initialize Nam Memory for Handset Programmable Models - Func 99* Enter Last 8 digits of S.N. Press * Programming Instructions for: PANASONIC EB362 Charged Battery and Nam Adaptor(Grey Cord w/25pin Connector)are needed. ACTION TO STORE DISPLAY USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE - THIS FUNCTION IS PROVIDED FOR IN THE PROGRAMMING SEQUENCE *0000# to enter program mode *1 Press SND 50 Press SND NAM 1 MODE _ _ _ _ _ Press STO 01 SIDH XXXXXXXXXX Press STO 02 OWNDL 1 2 3 Press STO 03 LOCK 0 0 0 0 0 0 0 0 0 0 0 0 (12) Press STO 04 SPDL 00 Press STO 05 SCM 334 Press STO 06 IPCH 07 Press STO 07 ACCOLC 10 Press STO 08 GIM 1 1 0 1 1 1 0 0 Press STO 09 FEATURE A 0 0 0 0 0 1 0 0 Press STO 10 FEATURE B 1 0 0 0 0 0 1 1 Press STO 11 FEATURE C 00 Press STO 12 DLMT STO ** Turn power off Programming Instructions for: PANASONIC EB-500 OR TP-500 ACTION TO STORE DISPLAY USED EQUIPMENT: TO DISPLAY CURRENT UNLOCK CODE - THIS FUNCTION IS PROVIDED FOR IN THE PROGRAMMING SEQUENCE Attach Nam Programmer Cable (Our Stock # 823) Pwr up unit Enter *0000# 0 *1 SND You are now in the NAM 1 Program mode. _ _ _ _ _ Press STO 01 S.I.D. XXXXXXXXXX Press STO 02 OWN # 0 Press STO 03 O for W/L system 334 Press STO 04 IPCH 07 Press STO 05 ACCOLC 10 Press STO 06 GIM 00 Press STO 07 Digit Dial Limit 08 Press STO 08 SCM (3watt i.d.) 911 Press STO 09 Rcl 00 1234 Press STO 10 Security Code 11000000 Press STO 11 FUNCTION BYTE 1 00010010 Press STO 12 FUNCTION BYTE 2 10010111 Press STO 13 FUNCTION BYTE 3 TO BURN NAM AT THIS TIME Press STO ** NAM is burned Turn off unit Detach programming cable Programming Instructions for: RADIO SHACK 17-1002 TRANSPORTABLE THIS UNIT REQUIRES A SERVICE HANDSET TO BE PROGRAMMED!!! A Mobira Service Handset (Modified) may be used. It is made from an ME53 or ME57 handset by opening and adding a jumper to the left of the one factory installed just below the white 24 pin connector joining the top and bottom PCB's. Also, pins 1 and 14 of the handset connector must be jumpered at the radio end. To disassemble the handset, carefully pry off the plastic earpad retaining housing to expose on hexdrive screw. Two other screws are under the rubber plugs at either side of the microphone. The handset then splits apart. This is a ticklish job and isn't recommended except in an extreme case and not with the customer's handset. The modification does not affect normal operation of the handset. It is not known if a Radio handset will work the same. After the Service Handset has been applied: To enter LOCAL MODE (which takes the phone off the air and allows service commands to be obeyed) press 01#. The display should clear and noise is heard from the earpiece. To enter the NAM programming mode, enter 48#. The display shows 48 briefly and clears. ACTION KEYBOARD ENTRY DISPLAY 0 * (5-digit SID) 1 * 1 * XXXXXXXXXX * 10 * 334 * 07 * 0 * 10 * 12345 * Press * to exit NAM programming mode and return to Local Mode. To enter the NAM reading mode, press 49#. The display will show 49. ***************************************************************************** PART VII. THE ELECTRONIC SERIAL NUMBER - AN INTRODUCTION When a cellular phone is removed from factory packaging, the ESN normally can be found in the document package (or on a sticker stuck to the phone). This ESN is usually correct and system registration procedes quickly. If the phone is used or has been turned off for non-payment of bills, the person who restores the service needs the ESN in order to program the system with an MIN. Every manufacturer assigns their own ESN, consequently it is possible to have a number of the same ESN's, although each may be produced by a seperate manufacturer. For example, there may be a Motorola ESN of 123456, an Audiovox ESN of 123456, etc. With this in mind it is a possibility that a person could broadcast without changing the ESN, but rather changing the SCM and the SIDH. The ESN is a 32-bit number which uniquely identifies each unit. This ESN is factory programmed and installed and cannot be changed in the field without removing it and reprogramming a new chip. The ESN may or may not be related to the serial number stamped on the outside of the transceiver chassis. The ESN is encoded into messages which are interchanged with the cellular tower. The ESN must be provided when the phone is registered for service. The ESN is an 11-digit number. THE FIRST THREE NUMBERS ARE THE MANUFACTURERS DECIMAL CODE, THE NEXT TWO ARE RESERVED (BUT MAY CONTAIN ZEROS OR NUMBERS) AND THE REMAINING SIX ARE THE DECIMAL SERIAL NUMBER. ***************************************************************************** PART VIII. IDENTIFYING THE ESN IN YOUR CELLULAR PHONE Depending on what model phone you have, the ESN will be located on a PROM. The PROM is programmed at the factory, and installed usually with the security fuse blown to prevent tampering. The code on the PROM might possibly be obtained by unsoldering it from the cellular phone, putting it in a PROM reader, and then obtaining a memory map of the chip. The PROM is going to have from sixteen to twenty-eight leads coming from it. It is a bipolar PROM. SEE ESN.GIF FOR ADDITIONAL INFORMATION. The majority of phones will accept the National Semiconductor 32x8 PROM, which will hold the ESN and cannot be reprogrammed. If the ESN is known on the phone, it is possible to trace the memory map by installing the PROM into a reader, and obtaining the fuse map from the PROM by triggering the "READ MASTER" switch of the PROM programmer. In addition, most PROM programming systems include a verify and compare switch to allow you to compare the programming of one PROM with another. As said earlier, the ESN is uniformly black with sixteen to twenty-eight leads emanating from it's rectangular body, or square shaped body. If it is the dual-in-line package chip, (usually found in transportables and installed phones),it is rectangular. If it is the plastic leaded chip carrier (PLCC), it will be square and have a much smaller appearance. Functionally, they are the same chip, but the PLCC is used with hand held cellular phones because of the need for reduced size circuitry. It will have a notch within, and also have writing in small white letters on it. (A black chip with small white letters? Should be easy to spot huh?). Look for the follow letters on the chip: MMI TI NS HARRIS NSC MB DM HM AMD TBP MOTOROLA AMPS Once you have found the chip, try ordering a new one (maybe a couple of new ones) from the businesses in the MERCHANDISE SECTION located at the end of this file. ***************************************************************************** PART IX. SCANNING TO FIND THE ESN/MIN PAIR Well if you haven't guessed by now, the mobiles ESN and MIN must match in the switch or no go. This is required for billing purposes. If one had the ESN and the mobile phone number (MIN), he could call anytime and anyplace without fear of a trace - let alone a bill. The ideal setup would let you listen with a scanner to the reverse control channel, record and display heard working numbers and ESN's, and recall them as one needs to make calls. This would be it, but we are not quite there yet. But some of the hard work has already been done for us. All the aforementioned codes are sent in hex, in NRZ code (phase-key shifting), when a cellular subscriber places a call. But guess what? All phones have an NRZ receiver and transmitter built right into them. All that has to be done is to have a receiver on the reverse control channel, recover the other subscibers data and save it or print it out. Cellular phones operate on a full duplex channel. One frequency is used for transmission from the base to the phone, while another is used for transmission from the phone to the base. The base frequencies are always exactly 45 MHZ higher than the phone frequency, and both of these are incremented by 30 KHZ as the progression of channels increases from Channel #1 to Chanel #1023 (NOTE: There are no channels between 800 and 990). With some systems (not all) the cellular transmission is received by the base and retransmitted on the base frequency. When this is done, a scanner can listen to both sides of the conversation by simply monitoring the base frequency. When this is not the case, two scanners set 45 MHZ apart will work. Here is a list of all Cellular Frequencies: Non-Wireline Wireline Channel Tx Freq Rx Freq Channel Tx Freq Rx Freq Number Mhz Mhz Number Mhz Mhz 1 870.03 825.03 334 880.02 835.02 2 870.06 825.06 335 880.05 835.05 3 870.09 825.09 336 880.08 835.08 4 870.12 825.12 337 880.11 835.11 5 870.15 825.15 338 880.14 835.14 6 870.18 825.18 339 880.17 835.17 7 870.21 825.21 340 880.20 835.20 8 870.24 825.24 341 880.23 835.23 9 870.27 825.27 342 880.26 835.26 10 870.30 825.30 343 880.29 835.29 11 870.33 825.33 344 880.32 835.32 12 870.36 825.36 345 880.35 835.35 13 870.39 825.39 346 880.38 835.38 14 870.42 825.42 347 880.41 835.41 15 870.45 825.45 348 880.44 835.44 16 870.48 825.48 349 880.47 835.47 17 870.51 825.51 350 880.50 835.50 18 870.54 825.54 351 880.53 835.53 19 870.57 825.57 352 880.56 835.56 20 870.60 825.60 353 880.59 835.59 21 870.63 825.63 354 880.62 835.62 22 870.66 825.66 355 880.65 835.65 23 870.69 825.69 356 880.68 835.68 24 870.72 825.72 357 880.71 835.71 25 870.75 825.75 358 880.74 835.74 26 870.78 825.78 359 880.77 835.77 27 870.81 825.81 360 880.80 835.80 28 870.84 825.84 361 880.83 835.83 29 870.87 825.87 362 880.86 835.86 30 870.90 825.90 363 880.89 835.89 31 870.93 825.93 364 880.92 835.92 32 870.96 825.96 365 880.95 835.95 33 870.99 825.99 366 880.98 835.98 34 871.02 826.02 367 881.01 836.01 35 871.05 826.05 368 881.04 836.04 36 871.08 826.08 369 881.07 836.07 37 871.11 826.11 370 881.10 836.10 38 871.14 826.14 371 881.13 836.13 39 871.17 826.17 372 881.16 836.16 40 871.20 826.20 373 881.19 836.19 41 871.23 826.23 374 881.22 836.22 42 871.26 826.26 375 881.25 836.25 43 871.29 826.29 376 881.28 836.28 44 871.32 826.32 377 881.31 836.31 45 871.35 826.35 378 881.34 836.34 46 871.38 826.38 379 881.37 836.37 47 871.41 826.41 380 881.40 836.40 48 871.44 826.44 381 881.43 836.43 49 871.47 826.47 382 881.46 836.46 50 871.50 826.50 383 881.49 836.49 51 871.53 826.53 384 881.52 836.52 52 871.56 826.56 385 881.55 836.55 53 871.59 826.59 386 881.58 836.58 54 871.62 826.62 387 881.61 836.61 55 871.65 826.65 388 881.64 836.64 56 871.68 826.68 389 881.67 836.67 57 871.71 826.71 390 881.70 836.70 58 871.74 826.74 391 881.73 836.73 59 871.77 826.77 392 881.76 836.76 60 871.80 826.80 393 881.79 836.79 61 871.83 826.83 394 881.82 836.82 62 871.86 826.86 395 881.85 836.85 63 871.89 826.89 396 881.88 836.88 64 871.92 826.92 397 881.91 836.91 65 871.95 826.95 398 881.94 836.94 66 871.98 826.98 399 881.97 836.97 67 872.01 827.01 400 882.00 837.00 68 872.04 827.04 401 882.03 837.03 69 872.07 827.07 402 882.06 837.06 70 872.10 827.10 403 882.09 837.09 71 872.13 827.13 404 882.12 837.12 72 872.16 827.16 405 882.15 837.15 73 872.19 827.19 406 882.18 837.18 74 872.22 827.22 407 882.21 837.21 75 872.25 827.25 408 882.24 837.24 76 872.28 827.28 409 882.27 837.27 77 872.31 827.31 410 882.30 837.30 78 872.34 827.34 411 882.33 837.33 79 872.37 827.37 412 882.36 837.36 80 872.40 827.40 413 882.39 837.39 81 872.43 827.43 414 882.42 837.42 82 872.46 827.46 415 882.45 837.45 83 872.49 827.49 416 882.48 837.48 84 872.52 827.52 417 882.51 837.51 85 872.55 827.55 418 882.54 837.54 86 872.58 827.58 419 882.57 837.57 87 872.61 827.61 420 882.60 837.60 88 872.64 827.64 421 882.63 837.63 89 872.67 827.67 422 882.66 837.66 90 872.70 827.70 423 882.69 837.69 91 872.73 827.73 424 882.72 837.72 92 872.76 827.76 425 882.75 837.75 93 872.79 827.79 426 882.78 837.78 94 872.82 827.82 427 882.81 837.81 95 872.85 827.85 428 882.84 837.84 96 872.88 827.88 429 882.87 837.87 97 872.91 827.91 430 882.90 837.90 98 872.94 827.94 431 882.93 837.93 99 872.97 827.97 432 882.96 837.96 100 873.00 828.00 433 882.99 837.99 101 873.03 828.03 434 883.02 838.02 102 873.06 828.06 435 883.05 838.05 103 873.09 828.09 436 883.08 838.08 104 873.12 828.12 437 883.11 838.11 105 873.15 828.15 438 883.14 838.14 106 873.18 828.18 439 883.17 838.17 107 873.21 828.21 440 883.20 838.20 108 873.24 828.24 441 883.23 838.23 109 873.27 828.27 442 883.26 838.26 110 873.30 828.30 443 883.29 838.29 111 873.33 828.33 444 883.32 838.32 112 873.36 828.36 445 883.35 838.35 113 873.39 828.39 446 883.38 838.38 114 873.42 828.42 447 883.41 838.41 115 873.45 828.45 448 883.44 838.44 116 873.48 828.48 449 883.47 838.47 117 873.51 828.51 450 883.50 838.50 118 873.54 828.54 451 883.53 838.53 119 873.57 828.57 452 883.56 838.56 120 873.60 828.60 453 883.59 838.59 121 873.63 828.63 454 883.62 838.62 122 873.66 828.66 455 883.65 838.65 123 873.69 828.69 456 883.68 838.68 124 873.72 828.72 457 883.71 838.71 125 873.75 828.75 458 883.74 838.74 126 873.78 828.78 459 883.77 838.77 127 873.81 828.81 460 883.80 838.80 128 873.84 828.84 461 883.83 838.83 129 873.87 828.87 462 883.86 838.86 130 873.90 828.90 463 883.89 838.89 131 873.93 828.93 464 883.92 838.92 132 873.96 828.96 465 883.95 838.95 133 873.99 828.99 466 883.98 838.98 134 874.02 829.02 467 884.01 839.01 135 874.05 829.05 468 884.04 839.04 136 874.08 829.08 469 884.07 839.07 137 874.11 829.11 470 884.10 839.10 138 874.14 829.14 471 884.13 839.13 139 874.17 829.17 472 884.16 839.16 140 874.20 829.20 473 884.19 839.19 141 874.23 829.23 474 884.22 839.22 142 874.26 829.26 475 884.25 839.25 143 874.29 829.29 476 884.28 839.28 144 874.32 829.32 477 884.31 839.31 145 874.35 829.35 478 884.34 839.34 146 874.38 829.38 479 884.37 839.37 147 874.41 829.41 480 884.40 839.40 148 874.44 829.44 481 884.43 839.43 149 874.47 829.47 482 884.46 839.46 150 874.50 829.50 483 884.49 839.49 151 874.53 829.53 484 884.52 839.52 152 874.56 829.56 485 884.55 839.55 153 874.59 829.59 486 884.58 839.58 154 874.62 829.62 487 884.61 839.61 155 874.65 829.65 488 884.64 839.64 156 874.68 829.68 489 884.67 839.67 157 874.71 829.71 490 884.70 839.70 158 874.74 829.74 491 884.73 839.73 159 874.77 829.77 492 884.76 839.76 160 874.80 829.80 493 884.79 839.79 161 874.83 829.83 494 884.82 839.82 162 874.86 829.86 495 884.85 839.85 163 874.89 829.89 496 884.88 839.88 164 874.92 829.92 497 884.91 839.91 165 874.95 829.95 498 884.94 839.94 166 874.98 829.98 499 884.97 839.97 167 875.01 830.01 500 885.00 840.00 168 875.04 830.04 501 885.03 840.03 169 875.07 830.07 502 885.06 840.06 170 875.10 830.10 503 885.09 840.09 171 875.13 830.13 504 885.12 840.12 172 875.16 830.16 505 885.15 840.15 173 875.19 830.19 506 885.18 840.18 174 875.22 830.22 507 885.21 840.21 175 875.25 830.25 508 885.24 840.24 176 875.28 830.28 509 885.27 840.27 177 875.31 830.31 510 885.30 840.30 178 875.34 830.34 511 885.33 840.33 179 875.37 830.37 512 885.36 840.36 180 875.40 830.40 513 885.39 840.39 181 875.43 830.43 514 885.42 840.42 182 875.46 830.46 515 885.45 840.45 183 875.49 830.49 516 885.48 840.48 184 875.52 830.52 517 885.51 840.51 185 875.55 830.55 518 885.54 840.54 186 875.58 830.58 519 885.57 840.57 187 875.61 830.61 520 885.60 840.60 188 875.64 830.64 521 885.63 840.63 189 875.67 830.67 522 885.66 840.66 190 875.70 830.70 523 885.69 840.69 191 875.73 830.73 524 885.72 840.72 192 875.76 830.76 525 885.75 840.75 193 875.79 830.79 526 885.78 840.78 194 875.82 830.82 527 885.81 840.81 195 875.85 830.85 528 885.84 840.84 196 875.88 830.88 529 885.87 840.87 197 875.91 830.91 530 885.90 840.90 198 875.94 830.94 531 885.93 840.93 199 875.97 830.97 532 885.96 840.96 200 876.00 831.00 533 885.99 840.99 201 876.03 831.03 534 886.02 841.02 202 876.06 831.06 535 886.05 841.05 203 876.09 831.09 536 886.08 841.08 204 876.12 831.12 537 886.11 841.11 205 876.15 831.15 538 886.14 841.14 206 876.18 831.18 539 886.17 841.17 207 876.21 831.21 540 886.20 841.20 208 876.24 831.24 541 886.23 841.23 209 876.27 831.27 542 886.26 841.26 210 876.30 831.30 543 886.29 841.29 211 876.33 831.33 544 886.32 841.32 212 876.36 831.36 545 886.35 841.35 213 876.39 831.39 546 886.38 841.38 214 876.42 831.42 547 886.41 841.41 215 876.45 831.45 548 886.44 841.44 216 876.48 831.48 549 886.47 841.47 217 876.51 831.51 550 886.50 841.50 218 876.54 831.54 551 886.53 841.53 219 876.57 831.57 552 886.56 841.56 220 876.60 831.60 553 886.59 841.59 221 876.63 831.63 554 886.62 841.62 222 876.66 831.66 555 886.65 841.65 223 876.69 831.69 556 886.68 841.68 224 876.72 831.72 557 886.71 841.71 225 876.75 831.75 558 886.74 841.74 226 876.78 831.78 559 886.77 841.77 227 876.81 831.81 560 886.80 841.80 228 876.84 831.84 561 886.83 841.83 229 876.87 831.87 562 886.86 841.86 230 876.90 831.90 563 886.89 841.89 231 876.93 831.93 564 886.92 841.92 232 876.96 831.96 565 886.95 841.95 233 876.99 831.99 566 886.98 841.98 234 877.02 832.02 567 887.01 842.01 235 877.05 832.05 568 887.04 842.04 236 877.08 832.08 569 887.07 842.07 237 877.11 832.11 570 887.10 842.10 238 877.14 832.14 571 887.13 842.13 239 877.17 832.17 572 887.16 842.16 240 877.20 832.20 573 887.19 842.19 241 877.23 832.23 574 887.22 842.22 242 877.26 832.26 575 887.25 842.25 243 877.29 832.29 576 887.28 842.28 244 877.32 832.32 577 887.31 842.31 245 877.35 832.35 578 887.34 842.34 246 877.38 832.38 579 887.37 842.37 247 877.41 832.41 580 887.40 842.40 248 877.44 832.44 581 887.43 842.43 249 877.47 832.47 582 887.46 842.46 250 877.50 832.50 583 887.49 842.49 251 877.53 832.53 584 887.52 842.52 252 877.56 832.56 585 887.55 842.55 253 877.59 832.59 586 887.58 842.58 254 877.62 832.62 587 887.61 842.61 255 877.65 832.65 588 887.64 842.64 256 877.68 832.68 589 887.67 842.67 257 877.71 832.71 590 887.70 842.70 258 877.74 832.74 591 887.73 842.73 259 877.77 832.77 592 887.76 842.76 260 877.80 832.80 593 887.79 842.79 261 877.83 832.83 594 887.82 842.82 262 877.86 832.86 595 887.85 842.85 263 877.89 832.89 596 887.88 842.88 264 877.92 832.92 597 887.91 842.91 265 877.95 832.95 598 887.94 842.94 266 877.98 832.98 599 887.97 842.97 267 878.01 833.01 600 888.00 843.00 268 878.04 833.04 601 888.03 843.03 269 878.07 833.07 602 888.06 843.06 270 878.10 833.10 603 888.09 843.09 271 878.13 833.13 604 888.12 843.12 272 878.16 833.16 605 888.15 843.15 273 878.19 833.19 606 888.18 843.18 274 878.22 833.22 607 888.21 843.21 275 878.25 833.25 608 888.24 843.24 276 878.28 833.28 609 888.27 843.27 277 878.31 833.31 610 888.30 843.30 278 878.34 833.34 611 888.33 843.33 279 878.37 833.37 612 888.36 843.36 280 878.40 833.40 613 888.39 843.39 281 878.43 833.43 614 888.42 843.42 282 878.46 833.46 615 888.45 843.45 283 878.49 833.49 616 888.48 843.48 284 878.52 833.52 617 888.51 843.51 285 878.55 833.55 618 888.54 843.54 286 878.58 833.58 619 888.57 843.57 287 878.61 833.61 620 888.60 843.60 288 878.64 833.64 621 888.63 843.63 289 878.67 833.67 622 888.66 843.66 290 878.70 833.70 623 888.69 843.69 291 878.73 833.73 624 888.72 843.72 292 878.76 833.76 625 888.75 843.75 293 878.79 833.79 626 888.78 843.78 294 878.82 833.82 627 888.81 843.81 295 878.85 833.85 628 888.84 843.84 296 878.88 833.88 629 888.87 843.87 297 878.91 833.91 630 888.90 843.90 298 878.94 833.94 631 888.93 843.93 299 878.97 833.97 632 888.96 843.96 300 879.00 834.00 633 888.99 843.99 301 879.03 834.03 634 889.02 844.02 302 879.06 834.06 635 889.05 844.05 303 879.09 834.09 636 889.08 844.08 304 879.12 834.12 637 889.11 844.11 305 879.15 834.15 638 889.14 844.14 306 879.18 834.18 639 889.17 844.17 307 879.21 834.21 640 889.20 844.20 308 879.24 834.24 641 889.23 844.23 309 879.27 834.27 642 889.26 844.26 310 879.30 834.30 643 889.29 844.29 311 879.33 834.33 644 889.32 844.32 312 879.36 834.36 645 889.35 844.35 313 879.39 834.39 646 889.38 844.38 314 879.42 834.42 647 889.41 844.41 315 879.45 834.45 648 889.44 844.44 316 879.48 834.48 649 889.47 844.47 317 879.51 834.51 650 889.50 844.50 318 879.54 834.54 651 889.53 844.53 319 879.57 834.57 652 889.56 844.56 320 879.60 834.60 653 889.59 844.59 321 879.63 834.63 654 889.62 844.62 322 879.66 834.66 655 889.65 844.65 323 879.69 834.69 656 889.68 844.68 324 879.72 834.72 657 889.71 844.71 325 879.75 834.75 658 889.74 844.74 326 879.78 834.78 659 889.77 844.77 327 879.81 834.81 660 889.80 844.80 328 879.84 834.84 661 889.83 844.83 329 879.87 834.87 662 889.86 844.86 330 879.90 834.90 663 889.89 844.89 331 879.93 834.93 664 889.92 844.92 332 879.96 834.96 665 889.95 844.95 333 879.99 834.99 666 889.98 844.98 667 890.01 845.01 717 891.51 846.51 668 890.04 845.04 718 891.54 846.54 669 890.07 845.07 719 891.57 846.57 670 890.10 845.10 720 891.60 846.60 671 890.13 845.13 721 891.63 846.63 672 890.16 845.16 722 891.66 846.66 673 890.19 845.19 723 891.69 846.69 674 890.22 845.22 724 891.72 846.72 675 890.25 845.25 725 891.75 846.75 676 890.28 845.28 726 891.78 846.78 677 890.31 845.31 727 891.81 846.81 678 890.34 845.34 728 891.84 846.84 679 890.37 845.37 729 891.87 846.87 680 890.40 845.40 730 891.90 846.90 681 890.43 845.43 731 891.93 846.93 682 890.46 845.46 732 891.96 846.96 683 890.49 845.49 733 891.99 846.99 684 890.52 845.52 734 892.02 847.02 685 890.55 845.55 735 892.05 847.05 686 890.58 845.58 736 892.08 847.08 687 890.61 845.61 737 892.11 847.11 688 890.64 845.64 738 892.14 847.14 689 890.67 845.67 739 892.17 847.17 690 890.70 845.70 740 892.20 847.20 691 890.73 845.73 741 892.23 847.23 692 890.76 845.76 742 892.26 847.26 693 890.79 845.79 743 892.29 847.29 694 890.82 845.82 744 892.32 847.32 695 890.85 845.85 745 892.35 847.35 696 890.88 845.88 746 892.38 847.38 697 890.91 845.91 747 892.41 847.41 698 890.94 845.94 748 892.44 847.44 699 890.97 845.97 749 892.47 847.47 700 891.00 846.00 750 892.50 847.50 701 891.03 846.03 751 892.53 847.53 702 891.06 846.06 752 892.56 847.56 703 891.09 846.09 753 892.59 847.59 704 891.12 846.12 754 892.62 847.62 705 891.15 846.15 755 892.65 847.65 706 891.18 846.18 756 892.68 847.68 707 891.21 846.21 757 892.71 847.71 708 891.24 846.24 758 892.74 847.74 709 891.27 846.27 759 892.77 847.77 710 891.30 846.30 760 892.80 847.80 711 891.33 846.33 761 892.83 847.83 712 891.36 846.36 762 892.86 847.86 713 891.39 846.39 763 892.89 847.89 714 891.42 846.42 764 892.92 847.92 715 891.45 846.45 765 892.95 847.95 716 891.48 846.48 766 892.98 847.98 991 869.04 824.04 767 893.01 848.01 992 869.07 824.07 768 893.04 848.04 993 869.10 824.10 769 893.07 848.07 994 869.13 824.13 770 893.10 848.10 995 869.16 824.16 771 893.13 848.13 996 869.19 824.19 772 893.16 848.16 997 869.22 824.22 773 893.19 848.19 998 869.25 824.25 774 893.22 848.22 999 869.28 824.28 775 893.25 848.25 1000 869.31 824.31 776 893.28 848.28 1001 869.34 824.34 777 893.31 848.31 1002 869.37 824.37 778 893.34 848.34 1003 869.40 824.40 779 893.37 848.37 1004 869.43 824.43 780 893.40 848.40 1005 869.46 824.46 781 893.43 848.43 1006 869.49 824.49 782 893.46 848.46 1007 869.52 824.52 783 893.49 848.49 1008 869.55 824.55 784 893.52 848.52 1009 869.58 824.58 785 893.55 848.55 1010 869.61 824.61 786 893.58 848.58 1011 869.64 824.64 787 893.61 848.61 1012 869.67 824.67 788 893.64 848.64 1013 869.70 824.70 789 893.67 848.67 1014 869.73 824.73 790 893.70 848.70 1015 869.76 824.76 791 893.73 848.73 1016 869.79 824.79 792 893.76 848.76 1017 869.82 824.82 793 893.79 848.79 1018 869.85 824.85 794 893.82 848.82 1019 869.88 824.88 795 893.85 848.85 1020 869.91 824.91 796 893.88 848.88 1021 869.94 824.94 797 893.91 848.91 1022 869.97 824.97 798 893.94 848.94 1023 870.00 825.00 799 893.97 848.97 PART X. A FEW COMMON SCANNER MODIFICATIONS Here a few scanners and what it takes to modify them. If your scanner is not shown here, don't worry. Ham Radio BBS's are all over the country. You should be able to find the instructions for modifying your scanner there. Restoration of Cellular Frequency Coverage on Radio Shack PRO-34 Handheld Scanner 1. Remove battery cover and battery, four black screws on rear cover, and volume and squelch knobs. 2. Remove rear cover, lifting back and up to clear controls. Do not remove belt clip or circuit board screws. 3. Unplug the brown volume control connector (grn/yel/blk) and white squelch control connector (wht/blk/red) from the linear circuit board. 4. Unsolder the ground lead from T111 (at corner of linear circuit board above the external power connectors). Unsolder the two power switch leads from the back of the volume control. Unsolder the antenna connector center pin and ground wires from the l 5. Unscrew the four combination screws that hold the linear circuit board and received the back cover screws. Grasp the linear board at the top and lift it straight away from the front case, unplugging the 16-pin connector. 6. Remove the three screws holding the metal frame assembly which held the linear board to the front panel. Unplug the red-black power lead and lay the frame aside. It is still connected to the battery contacts. 7. Locate diodes D9 - D12 on the volume control side of the of the logic circuit board under T1; D10 and D11 are marked. Clip one lead of D11, separating the gap. This may be resoldered later if desired. 8. Reassemble the board by reversing the disassembly procedures above. Restoration of Cellular Frequency Coverage on Radio Shack PRO-2004 Scanner By cutting diode D513 on the PC 3 sub chassis in the Realistic PRO-2004 Scanner you can re-enable the 825.00 to 845.00 and 870-00 to 890.00 frequency selection. To scan in 30KHZ steps press "STEP-RESET". Restoration of Cellular Frequency Coverage on Radio Shack PRO-2005 Scanner 1. Unplug the radio 2. Remove the screws and take off the top cover. 3. Look for D502 on the inside right hand-side of the front panel. (No need to unsolder the silver plate protecting the vertical board!) 4. Simply cut the diode and reverse the process. Aren't you glad I only chose to cover Radio Shack models. I'm sure you appreciate the fact that I only deal with quality merchandise. If you have some cash to blow (like $500), I would recommend buying the ICOM R-1 handheld scanner. It scans from 1 to 1400 in 1/2 step increments and already includes the cellular frequencies. Plus is is about as tall as a box of 3.25 floppies and about as wide as a 16 oz. coke bottle. It is the smallest and one of the more powerful hand-scanners around. ***************************************************************************** PART XI. THE 40-50 MHZ CELLULAR SCANNER The cellular phone freqs. occupy the UHF spectrum previously assign to commercial TV stations. Since a TV channel occupies a Bandwidth(BW) of 6 MHZ and each cellular channel requires 24 KZ (for a plus and minus 12 KHZ signal) and a 3KHZ guard band for each audio signal (thus the 30KHZ spacing). 200 cellular channels can fit into one UHF TV channel. Thus, with a little fine tuning, and old TV set with variable VHF tuning can tune in all cellular freqs. between 824 and 890 MHZ. UHF TV tuners ares designed to convert these UHF freqa. to intermediate (difference) freqs. between 41 and 47 MHZ. Thus, by purchasing a commonly available UHF tuner (check sith a TV shop and try to get a copy of the SAMS for powering the AFC info, and avoid those with tubes). Tuner voltage is usually 8-24 volts, and must be correctly connected up. You should also remove with the tuner, the TV's channel select and fine tuning controls for ease of use - and they should be in good condition. Once you have the tuner, you can then wire it between a 30-50 MHZ scanner and a UHF antenna (highly directional yagi type is preferred). Since the tuner will probably have a 300 ohm input impedance, a twin antenna cable is preferred (Yes Radio Shack has 'em). If you are into directional-finding, the UHF antenna should NOT have AGC (automatic Gain Control) as those with active AGC will amplify reflections, resulting in readings from so many directions that the target will be lost. Because of the use of inconspicuous, commonly available, inexpensive, high-gain UHF antennas, using a good UHF tuner to scan cellular channels is a good method of doing it. Tuner output is usually through an RCA-type plug. CAUTION: BE SURE TO COUPLE YOUR SCANNER TO THE UHF TUNER WITH A 0.01-0.1 mf (50 V min.) CAPACITOR FOR DC BLOCKING. AND DO NOT TRY TO OPERATE THE TUNER THROUGH ITS TV SET AS THE DANGER OF HIGH-VOLTAGE DISCHARGE IS HIGH. Also, connect a ground wire between the tuner and the scanner. The table below describes how cellular freqs. can be downconverted by a commonly available UHF TV tuner (all freqs. are in MHZ) CELLULAR MOBILE FREQS & SCANNER EQUIVALENTS TV BAND CELL. CHAN. SCAN TV OSCIL CHAN. # and FREQ. FREQ. FREQ. LIMIT ----------- ------------ ----- -------- ----- 73 (first) 0001-825.03 45.97 871 824-830 73 (last) 0166-829.98 41.02 871 824-830 74 (first) 0167-830.01 46.99 877 830-836 74 (last) 0366-835.98 41.02 877 830-836 75 (first) 0367-836.01 46.99 883 836-842 75 (last) 0566-841.98 41.02 883 836-842 76 (first) 0567-842.01 46.99 889 842-848 76 (last) 0766-847.98 41.02 889 842-848 77 (first) 0767-848.01 46.99 895 848-854 77 (last) 0799-848.97 46.03 895 848-854 CELLULAR PHONE FREQS. HAVE NOT BEEN ASSIGNED FOR CHANNELS 800-990 73 (first) 0991-824.04 46.96 871 824-830 73 (last) 1023-825.00 46.00 871 824-830 80 (first) 0001-870.03 42.97 913 866-872 80 (last) 0066-871.98 41.02 913 866-972 81 (first) 0067-872.01 46.99 919 872-878 81 (last) 0266-877.98 41.02 919 872-878 82 (first) 0267-878.01 46.99 925 878-884 82 (last) 0466-883.98 41.02 925 878-884 83 (first) 0467-884.01 46.99 931 884-890 83 (last) 0666-889.98 41.02 931 884-890 83 (**) 0667-890.01 46.99 931 884-890 83 (**) 0799-893.97 37.03 931 884-890 CELLULAR PHONE FREQS. HAVE NOT BEEN ASSIGNED FOR CHANNELS 800-990 80 (first) 0991-869.04 43.96 913 866-872 80 (last) 1023-870.00 43.00 913 866-872 (**) These freqs. are outside of the normal Channel 83 BW. However, most UHF tuners have a fine tuner that can be adjusted up to about another 6 MHZ. Note that the term "first" and "last" refers to the first and last cellular channels receivable by the UHF tuner for the given TV channel. Base voice channels are monitored when both sides of the conversation is required. Mobile voice channels or base control channels are monitored to locate a cellular phone. Tuning is simple: (1) Decide which cellular channel or freq. you wish to monitor. (2) Find what UHF channel includes that freq. and switch the TV to that channel. (3) Using the table, look up the corresponding TV oscillator freq. (ex: 919 MHZ for TV channel 81). Subtract the cellular channel freq. from the TV oscillator freq. (4) Tune your scanner to the difference freq. When you select a scanner, you should pick one that will scan in 30 MHZ increments to efficiently receive cellular transmissions. If you can't get one like that, then get one that will scan in 15,10 or 5 KHZ increments. ***************************************************************************** PART XII. HOW THE ESN IS REPLACED It takes some electronics skill to pull or unsolder the ESN. If you are sketchy about messing around with your phone, I suggest practicing on something else first, like an old calculator or something. It is also a good idea to use the proper tools (A very small soldering tip,chip pullers, It is imperative NOT to touch any of the surrounding connections, soldering joints, or chips. The job MUST be done right the very first time. After that it is not so important, because after the first time you should have the ESN information stored safely to disk. The only dangers remaining are physically damaging the chip. (Note: There are devices that wipe PROMs clean in the event of programming errors). When removing the ESN, try to follow these 5 steps: A. Remove the PC board containing the ESN from the entire phone unit. The boards are usually screwed in with Phillips heads. This will insure against damage to the rest of the unit. B. Ascertain the correct chip. Find the letters on the chip, and check it against the letters from the IDENTIFYING THE ESN section. Refer to the .Gif file included if necessary. C. It is a good idea to draw a sketch to help you remember which way the chip went in. You may laugh, but do it anyway. D. Carefully remove the chip. Take your time and use the proper tools. E. Solder in a zero insertion force (ZIF) replacement, so that replacement chip can be changed easily. After the ZIF socket has been successfully soldered in, reinsert the ESN and attempt to make a phone call (Be sure the NAM is programmed correctly). If it doesn't, check the leads on the ZIF to insure that you have soldered them correctly. After that, insert your ESN into your PROM reader and make sure it provides some sort of reading. You should use the search mode to look for the manufacturers serial number. (see MANUFACTURER'S ESN CODE LISTING) to identify the address on the PROM where to reprogram the ESN. ***************************************************************************** PART XIII. EQUATIONS FOR PROGRAMMING THE CHIPS In most instances, you will not be able to tell the code on a PROM because the manufacturer will have blown the security fuse in order to prevent people from obtaining the codes to reprogram their own chips. Therefore, it might be necessary to produce a set of equations that are programmed into the cip to produce a bogus ESN. The bogus chips must contain the first three digits of the manufacturer's code listing, which is consequently the first marker of the actual ESN. Experimentation might be necessary, but hey, isn't that half the fun? With the aid of an EPROM emulator, the whole process should be able to be completed in under an hour - this includes pulling the chip, creating a new ESN, programming the chip, and replacing it. So know you're saying "Holy Cow this project is getting expensive!". Well it can get that way, but the long run payoff is worth it. I have seen both emulators and burners for under $200 (I'm not talking about those spiffy models that program RAM, just the basic EPROMs...in fact I can buy them for under $150. Same with the emulator. Just look around.) I wouldn't be surprised if actual ESN data started appearing on boards in the near future. I know when I finsish my phone (Hopefully soon) I plan on U/L the ESN info somewhere. **************************************************************************** PART XIV. MANUFACTURER'S ESN CODE LISTING --------------------------------------------------------------------------- MANUFACTURER DECIMAL HEX CODE OCTAL CODE --------------------------------------------------------------------------- Alpine Electronics # 150 96 226 Antel (see Emptel,Sanyo) ARA * AT&T Technologies (see notes) 158 9E 236 Astrotel (see OKI) Audiovox-Audiotel (see notes) 138 8A 212 Blaupunkt (R. Bosch) # 148 94 224 Clarion Company Ltd. 140 8C 214 Clarion Manufacturing Co. 166 A6 246 CM Communications 153 99 231 Diamondtel (See Mitsubishi) DI-BAR Electronics 145 91 221 E.F. Johnson # 131 83 203 Emptel Electronics Co. 178 B2 262 Ericsson 143 8F 217 Ericsson GE Mobile 157 9D 235 Fujitsu # 133 85 205 Gateway Telephone 147 93 223 General Electric # (mini is 134)146 92 222 Glenayre (see notes) Goldstar Products Co. # 141 8D 215 Harris # 137 89 211 Hitachi # 132 84 204 Hughes Network Systems 164 A4 244 Hyundai 160 A0 240 Japan Radio Co. 152 98 230 Kokusai 139 8B 213 Mansoor Electronics 167 A7 247 Mitsubishi (see notes) 134 86 206 Mobira (Nokia-Kinex) # 156 9C 234 Motorola 130 82 202 Motorola Int'l. 168 A8 250 Murata Machinery LTD. 144 90 220 NEC # 135 87 207 Nokia # 165 A5 245 Novatel 142 8E 216 OKI # 129 81 201 Panasonic (Matsushita) # 136 88 210 Phillips Telecom # 170 AA 252 Phillips Circuit 171 AB 253 Qualcomm, Inc. 159 9F 237 Sanyo 175 AF 257 Satellite Technology 161 A1 241 Samsung Communications 176 B0 258 Shintom West (Audio-Vox BC-20)# 174 AE 256 Sony Corp. 154 9A 232 Sun Moon Star # 178 B2 262 Tama Denki Co. 155 9B 233 Tandy/Mobira # 165 A5 245 TacTel (see notes) Technophone # 162 A2 242 Toshiba 138 8A 212 Uniden Corp. of America # 172 AC 254 Uniden Corp. of Japan 173 AC 255 Universal Cellular 149 95 225 USA Corp. # (see notes) Walker (JRC, Technophone) 152 98 230 Western Electric # (see notes) Western Union # (see notes) Yupiteru Industries 163 A3 243 NOTES: The hexidecimal ESN is an 11-digit number, first three are manufacturer's decimal code, next two are reserved (but may contain zeros or numbers); remaining six are the decimal serial number. These companies use phones from various manufacturers, code will be of actual manufacturer. Alpine 9510 is Fujitsu 362A - Antel, use GE, Emptel, Sanyo - ARA varies- ATT 1300, 1800 use Mitsubishi - AT&T 1100,1400,1440,1700,1710 use Hitachi - Audiotel 1000,3000,500,BC-40,400,450,550,600 use Toshiba - PC100,200 use Technophone - BC-20,CMT-125 use Shintom - TacTel use Toshiba,Blaupunkt, most are Panasonic, some are Blaupunkt - GE Mini, Gelayre 301 , USA A&B use Mitsubishi - Mitsubishi 460 use Toshiba - Walker Pocketphone use JRC or Technophone - Western Electric use Hitachi - Western Union use E.F. Johnson. # - Chassis number abd ESN correspond to each other. Decimal ESN conversion is required for serial numbers over 1,000,000 or 2,000,000, etc. Simply drop the millions digit and add 262,144 times the millions digit to the remaining number. For example, 01,123,456 = 385,600 or 02,123,46 = 647,744. Then affix the Manufacturers Decimal Code plus two zeros on left to yield 11-digit ESN. The Hex ESN may be found by converting this number to hexidecimal. ***************************************************************************** PART XV. HOME SYSTEM ID LISTING (A-L) SYSTEM NON(A) WIRE(B) Abilene,TX 131 422 Aguadilla 605 188 Aiken,GA 181 084 Akron,OH 073 054 Albany,GA 241 204 Alburquerque,NM 079 110 Alexandria,LA 243 212 Allentown,PA 103 008 Alton,IL 017 046 Altoona,PA 247 032 Amarillo,TX 249 422 Anchorage,AK 251 234 Anderson,IN 253 080 Anderson,SC 139 116 Anniston,AL 113 098 Appleton,WI 217 240 Asheville,NC 263 246 Ashland,WV 307 TBA Athens,AL 203 198 Athens,GA 041 034 Atlanta,GA 041 034 Atlantic City,NJ 267 250 Augusta,GA 181 084 Aurora,IL 001 020 Austin,TX 107 164 Bakersfield,CA 183 228 Baltimore,MD 013 018 Bangor,ME 271 254 Baton Rouge,LA 085 106 Battle Creek,MI 403 256 Beaumont,TX 185 012 Bellingham,WA 047 006 Beloit,WI 217 210 Benton Harbor,MI 277 260 Biddeford,ME 501 484 Billings,MT 279 262 Biloxi,MS 281 264 Binghamton,NY 283 266 Birmingham,AL 113 098 Bismarck,ND 285 268 Bloomington,IL 455 532 Boise,ID 289 272 Boston,MA 007 028 Bradenton,FL 175 042 Bremerton,WA 047 006 Bridgeport,CT 119 088 Bristol,TN 149 074 Brownsville,TX 451 434 Bryan,TX 297 280 Buffalo,NY 003 056 Burlington,NC 069 144 Burlington,VT 313 300 Canton,OH 073 054 Casper,WY 301 284 Ceder Falls,IA 589 568 Cedar Rapids,IA 303 286 Champaign,IL 305 532 Charleston,WV 307 290 Charleston,SC 127 156 Charlotte,NC 139 114 Charlottesville,VA 309 292 Chattanooga,TN 161 148 Chicago,IL 001 020 Chico,CA 311 294 Cincinnati,OH 051 014 Clarksville,TN 179 296 Cleveland,OH 015 054 College Station,TX 297 280 Colorado Springs,CO 045 180 Columbia,MO 317 298 Columbia,SC 189 182 Columbus,GA 319 302 Columbus,OH 133 138 Corpus Christi,TX 191 184 Council Bluffs,IA 137 152 Cumberland,MD 321 304 Dallas,TX 033 038 Danville,VA 323 306 Davenport,IA 193 186 Dayton, OH 163 134 Daytona Beach,FL 325 308 Decatur,IL 327 532 Dennison,TX 033 038 Denver,CO 045 058 Des Moines,IA 195 150 Detroit, MI 021 010 Dothan,AL 329 312 Dover,NH 501 484 Dubuque,IA 331 314 Duluth,MN 333 316 Durham,NC 069 144 Eau Claire,WI 335 318 Elgin,IL 001 020 El Paso,TX 097 092 Elkhart,IN 549 530 Elmira,NY 283 266 Elyria,OH TBA 054 Enid,OK 341 324 Erie,PA 343 326 Eugene,OR 061 328 Evansville,IN 197 190 Fargo,ND 347 330 Fayettesville,NC 349 100 Fayetteville,AR 607 342 Flint,MI 021 010 Florence,AL 113 334 Florence,SC 377 350 Fort Collins,CO 045 336 Fort Lauderdale,FL 037 024 For Meyers,FL 355 042 Fort Pierce,FL 037 340 Fort Smith,AR 359 342 Fort Walton Bch,FL 361 344 Fort Wayne,IN 199 080 Fort Worth,TX 033 038 Fresno,CA 153 162 Gadsden,AL 113 098 Gainesville,FL 365 348 Galveston,TX 367 012 Gary,IN 001 020 Glens Falls, NY 063 078 Grand Forks,ND 371 356 Grand Rapids,MI 021 244 Granite City,IL 017 046 Great Falls, MT 373 358 Greeley,CO 045 360 Green Bay,WI 217 362 Greensboro,NC 095 142 Greenville,SC 139 116 Gulf of Mexico,LA 171 194 Gulfport,MS TBA 264 Gunterville,AL 203 198 Hagerstown,MD 381 364 Hamilton,OH 383 366 Harlingen,TX 451 434 Harrisburg,PA 159 096 Hartford,CT 119 088 Hickory,NC 385 368 Honolulu,HI 167 060 Houma,LA 387 370 Houston,TX 035 012 Huntington,WV 307 196 Huntsville,AL 203 198 Indianapolis,IN 019 080 Iowa City,IA 389 286 Jackson,MI 391 374 Jackson,MS 205 160 Jacksonville,FL 075 136 Jacksonville,NC 393 376 Janesville, WI 217 210 Johnson City,TN 149 074 Johnstown,PA 039 032 Joliet,IL 001 020 Joplin,MO 401 384 Kalamazoo,MI 403 386 Kankakee,IL 001 020 Kansas City,KS/MO 059 052 Kennewick,WA TBA 500 Kenosha,WI 217 044 Killeen,TX 409 392 Kingsport,TN 149 074 Knoxville,TN 093 104 Kokomo,IN 411 080 La Crosse,WI 413 396 Lafayette,IN 415 080 Lafayette,LA 431 414 Lake Charles,LA 417 400 Lakeland,FL 175 042 Lancaster,PA 159 096 Lansing,MI 021 188 Laredo,TX 419 402 Las Cruces,NM 097 404 Las Vegas,NV 211 064 Lawrence,KS 059 406 Lawton,OK 425 408 Lewiston,ME 427 482 Lexington,KY 213 206 Lima,OH 021 412 Lincoln,NE 433 416 Little Rock,AR 215 208 Long Branch,NY 173 022 Longview,TX 229 418 Lorain,OH 437 054 Los Angeles,CA 027 002 Louisville, KY 065 076 Lubbock,TX 439 422 Lynchberg,VA 441 424 ***************************************************************************** PART XVI. "THE ROAMING SCAM" Some people who are playing with phones that have been originally registered but have been turned off for non-payment of bills have used the "Roaming Scam" to place free calls. NOTE: The cellular carriers will still have records of these calls, and will prosecute those they eventually catch up to (yeah,right). However, industry standards have shown that they pursue less than one percent of the fraudulent calls placed. It is far more economical for them to build software and hardware traps to prevent unbilled calls from being placed rather than attempt to collect on the other end which involves greater amounts of personnel and manpower with smaller actual collections. People have performed the roaming scam by taking their phones into areas where the SIDH numbers are different from the ones currently programmed into their phones. Refer to the SIDH listing in this file for the codes for particular cities. By reprogramming the NAM and inserting a fake SIDH, the cellular carrier will often accept the phone call, but on occassion the user will get a message that the phone must have a local code in order to access the system. As cellular carriers grow larger in size, this message is less frequently heard. At this point, the cellular carrier instructs the user to contact them. I don't think so. The cellular service has the best chance of of catching a spoofer who either calls a friend continually at home or by developing traceable trends such as calling the same number from within the same cell at the same time every day. Or doing something stupid like ordering a Pizza. "But I want to hook up the phone to an acoustic coupler, d00d, and call all the k-rad out-state-boards for the latest PyRut WaR3z!4@$$!$@!@" <-lamer. Well, one of the properties of cellular phone systems is that the transmitter freqs. may be changed or "hopped" in the constant effort to allocate freqs. Because of freq. hopping it is very difficult to triangulate a cellular phone using standard directional finding methods (trace you, d00d). Further, it is known that a directional antenna randomly aimed at cellsite repeaters will confuse directional finding equipment being used by them that is synced to their freq. hopping scheme. ***************************************************************************** PART XVIII. MERCHANDISE SHEET CELLULAR PHONE SUPPLIERS NCI R/M Wholesale Communications 744 Roble Road, Suite 185 800-837-5532 Allentown,PA 18103 800-669-5167 215-264-5117 Superior Cellular Products Cellular Enterprises, Inc. 3925 N. Rosemead Blvd. #205 813-885-7766 Rosemead,CA 91770 818-280-6665 Dynatek Communication Dist. Wholesale Cellular, Inc. 340 Constance Dr. 5720 West 71st St. Warminster,PA 18974 Indianapolis, IN 46278 215-672-5000 317-297-6100 CELLULAR SERVICE MONITORS InTouch USA 800-USA-ROAM 800-872-7626 CELLULAR TEST EQUIPMENT WAVETEK 1-800-223-WVTK Ask for free Communications Catalog CELLULAR SERVICE MONITORS Communication Instruments 356 Hillcrest Street El Segundo, CA 90245 800-288-8223 213-322-3666 CELLULAR PHONE REPAIRS Communication Consultants Co. Cellular Phone Services, Inc 16128 Cohasset St. 403 E. Gude Dr. Van Nuys, CA 91406 Rockville, MD 20850 818-901-9711 800-326-7901 ext. 101 PROM EMULATORS Parallax, Inc. Incredible Technologies 6200 Desimone Lane, #69A 708-437-2433 Citrus Heights, CA 95621 916-726-1905 Technical Solutions P.O. Box 462101 Dept. 101 Garland, TX 75046 214-272-9392 PROM PROGRAMMERS BP Microsystems Link Computer Graphics 10681 Haddington 369 Passaic Road, Ste. 100 Houston,TX 77043 Fairfield, NJ 07004 713-461-9430 201-808-8990 MVS Needhamps Electronics Box 994 4539 Orange Grove Ave. Merrimack, NH Sacramento, CA 95841 508-792-9507 916-924-8037 PROM CHIPS National Semiconductor Offices throughout the U.S. 408-721-5000 JDR Microdevices 800-538-5000 Easy Tech 2917 Bayview Drive Fremont, CA 94538 800-582-4044