![..[ Phrack Magazine ]..](../../images/phrack-logo.jpg){kind=logo}
.:: Motorola Command Mode Information ::.
Issues:
[ 1 ] [ 2 ] [ 3 ] [ 4 ] [ 5 ] [ 6 ] [ 7 ] [ 8 ] [ 9 ] [ 10 ] [ 11 ] [ 12 ] [ 13 ] [ 14 ] [ 15 ] [ 16 ] [ 17 ] [ 18 ] [ 19 ] [ 20 ] [ 21 ] [ 22 ] [ 23 ] [ 24 ] [ 25 ] [ 26 ] [ 27 ] [ 28 ] [ 29 ] [ 30 ] [ 31 ] [ 32 ] [ 33 ] [ 34 ] [ 35 ] [ 36 ] [ 37 ] [ 38 ] [ 39 ] [ 40 ] [ 41 ] [ 42 ] [ 43 ] [ 44 ] [ 45 ] [ 46 ] [ 47 ] [ 48 ] [ 49 ] [ 50 ] [ 51 ] [ 52 ] [ 53 ] [ 54 ] [ 55 ] [ 56 ] [ 57 ] [ 58 ] [ 59 ] [ 60 ] [ 61 ] [ 62 ] [ 63 ] [ 64 ] [ 65 ] [ 66 ] [ 67 ] [ 68 ] [ 69 ] [ 70 ] [ 71 ]
Current issue : #48 | Release date : 1996-01-09 | Editor : voyager
| Introduction | Phrack Staff |
| Phrack Loopback / Editorial | Phrack Staff |
| Line Noise (Part I) | various |
| Line Noise (Part II) | various |
| Phrack Pro-Philes on the New Editors | Phrack Staff |
| Motorola Command Mode Information | Cherokee |
| Tandy / Radio Shack Cellular Phones | Damien Thorn |
| The Craft Access Terminal | Boss Hogg |
| Information About NT's FMT-150/B/C/D | StaTiC |
| Electronic Telephone Cards (Part I) | unknown |
| Electronic Telephone Cards (Part II) | unknown |
| Keytrap Revisited | Sendai |
| Project Neptune | daemon9 |
| IP-Spoofing Demystified | daemon9 |
| Netmon | daemon9 |
| The Truth...and Nothing but the Truth | Steve Fleming |
| International Scenes | various |
| Phrack World News | Datastream Cowboy |
Title : Motorola Command Mode Information
Author : Cherokee
==Phrack Magazine==
Volume Seven, Issue Forty-Eight, File 6 of 18
Motorola Command Mode Information
Written and typed up by Cherokee
NOTE: The following text is only a few pages from an official Motorola
handbook that I received, thanks to Ob1.
THIS IS NOT A COMPLETE HANDBOOK
but it is very useful as a guide to learning how to use the self
test instructions on the Motorola series of cellular phones.
To actually enter the self test modes, THERE ARE SEVERAL STAGES
BEFORE HAND THAT NEED TO BE DONE. They depend upon what type of
Motorola mobile phone you possess. To my knowledge, the self test
mode instructions are the same on every Motorola phone, the only
difference will be how you enter the test mode. That I leave up to
you to find out as there are lots of help files already out there,
unless, there is a great demand for it.
I will now show you how easy it is to use the test mode to your
advantage.
Say, your the average peeping Tom or Sally (what hacker isn't?),
this is how to listen in on other peoples mobile conversations.
1.Enter the test mode.
2.Turn the speaker on (08#) also called un-muting the receive audio.
3.Tune into a channel(11xxxx#) (where x can range from 0 to
600[TACS] and 1329 to 2047[ETACS].)... Although I'm not 100% sure
of the channel mapping, (theres conversations in the range between
600 to 1329), you'd do best to stick to playing around with these.
You may have to try several different channels, to pick up a
conversation, not every channel is occupied with a user. I
suggest you try 0 to 50, this is almost guaranteed to give you a
result. BTW, it is actually illegal to monitor mobile
communications without the consent of both parties, but hey, whose
going to know? :-)
Displaying information - Some handsets only allow display 1 line,
and therefore you wont be able to see all of the information being
sent to you. There are 2 ways around this. 1. Is to go and get a
handset which can display 2 lines of information. 2. to send the
data to your computer to display on the screen, apparently the
data is sent and received in an unfamiliar packet format, and will
need to be decoded.
FINAL NOTE:
There are several conflicting sources for some commands, this is
because of different versions of the ROM, so I'm putting all of
the test codes bundled together in this file, and will update the
list if there are any significant changes, or I find out about a
new command in a later ROM version.
Just one last final note to say hi to Davex[thanks for the NAM
guide], Ratscabies, Maelstrom, Hi.T.Moonweed and Ob1.
----------------------------------------------------------------------------
Motorola Self Test Mode Instructions
------------------------------------
1. INTRODUCTION
Portable radio telephones are equipped for self-test, allowing service
personnel to control and monitor radiotelephone functions via the
telephone keypad. The self-test mode operates at two levels:
1) a status display level, which allows the portable telephone to
operate normally while providing status indications in the display and;
2) the service level, which removes the portable telephone from normal
service and allows commands to be entered through the keypad to
'manually' control the operation of the radiotelephone.
2. OPERATING PROCEDURES
2.1 STATUS DISPLAY LEVEL OF SELF-TEST
This level of self-test is entered by momentarily shorting pin 6 of J2
to ground, while turning the radiotelephone on. The self-test mode can
also be entered using the portable radiotelephone test kit (RTL4228A and
RTL4229A).
In this level of self-test mode the radiotelephone will place and
receive calls as normal except the radiotelephone displays status
information. The displayed status information alternates between the
channel number and RSSI status information, and the primary status
information (SAT frequency, carrier state, signaling tone state, power
level, voice/data channel mode, and Rx and Tx audio states). The format
and explanation of this status information is given in Table 1 under 02#
Radio Status Request.
When dialing a phone number, the display of the status in formation
ceases when the first digit of the phone number is entered. When the
Snd button (or End or Clr) is pressed, the status information display
resumes.
2.2 SERVICING LEVEL OF SELF-TEST
|-----------------------------------------------------------
| NOTE
|-----------------------------------------------------------
| While in the servicing level mode of self-test, the
| display does not alternate. Only the primary status
| information is displayed.
|-----------------------------------------------------------
The servicing level allows the servicing personnel to take control of
the radio operation by entering the test commands through the telephone
keypad. Such parameters as operating channel, output power level
muting, and data transmission can all be selected by entering the
corresponding commands. The servicing level is entered from the status
display level by pressing the (#) button. At this time the radio
telephones cease to function automatically in the radiotelephone system.
Table 1 shows the test commands and the corresponding results.
INTERNATIONAL CELLULAR PORTABLE
Table 1. Test Commands For Self-Test Mode
|---------------------------------------------------------------------------
| NOTES:
| 1. Each command consists of at least two digits entered from the telephone
| keypad with the entry terminated using the (#) key.
| 2. If the command relates to a test function with multiple data displays,
| the (#) key is used to pause at scanning data or to step through
| sequential test functions. Entering the (#) key during a pause time
| resumes scanning.
| 3. For commands that initiate an action that requires a response or that
| accumulates error counts, the (#) key terminates the test.
|---------------------------------------------------------------------------
|Keypad Entry | Command Description | Status | Result
| | | Display |
|-------------|-------------------------------------------------------------
| # |Enter Test Command | |
| |Mode | |
|-------------|---------------------|---------|-----------------------------
| 01# |Restart (Re-enter DC | |
| |power startup routine| |
|-------------|---------------------|---------|-----------------------------
| 02# |Radio Status Request | AAAA=BB | AAAA=Channel Number(decimal)
| | | | BB=RSSI reading for channel
| | | CDEFGHI | C=SAT Frequency
| | | | 0=5970 Hz
| | | | 1=6000 Hz
| | | | 2=6030 Hz
| | | | 3=No Lock
| | | | D=Carrier(1=ON)
| | | | E=Signaling Tone(1=ON)
| | | | F=Power Attention Level(0-7)
| | | | G=Mode(1=control channel
| | | | 0=voice channel
| | | | H=Receive Audio Mute(1=muted)
| | | | I=Transmit Audio Mute(1=muted)
| | | | When the radiotelephone is
| | | | operating in the status display
| | | | level of self-test, the
| | | | information that is displayed
| | | | alternates between AAAA BB
| | | | and CDEFGHI. In the servicing
| | | | level of self-test, only the
| | | | information designated by
| | | | CDEFGHI is displayed.
|-------------|---------------------|---------|-----------------------------
| 03# | (NOT USED) | |
|-------------|---------------------|---------|-----------------------------
| 04# | Initialize | | Carrier=OFF
| | Transceiver | | Power Level=0
| | | | Receive Audio=MUTED
| | | | Transmit Audio=MUTED
| | | | Signaling Tone=OFF
| | | | SAT=OFF
| | | | DTMF & Audio Tones=OFF
| | | | Audio Path=TO SPEAKER
|-------------|---------------------|---------|-----------------------------
| 05# | Carrier On | | Turn carrier on
|-------------|---------------------|---------|-----------------------------
| 06# | Carrier Off | | Turn carrier off
|-------------|---------------------|---------|-----------------------------
| NOTE: Use the PATH command (35A#) to select the audio path to test before
| using commands 07# through 10#.
|-------------|---------------------|---------|-----------------------------
| 07# | Rx Mute | | Mute the receive audio
|-------------|---------------------|---------|-----------------------------
| 08# | Rx Un-mute | | Un-mute the receive audio
|-------------|---------------------|---------|-----------------------------
| 09# | Tx Mute | | Mute the transmit audio
|-------------|---------------------|---------|-----------------------------
| 10# | Tx Un-mute | | Un-mute the transmit audio
|-------------|---------------------|---------|-----------------------------
| 11ABCD# | Load Synth | | Load synthesizer with ABCD
| | | | where ABCD = channel number
| | | | in decimal (1329-2047, 0-600)
|-------------|---------------------|---------|-----------------------------
| 12# | Set ATTN | | Set RF power attention to A
| | | | where A=attention level(0-7;
| | | | 0=maximum power)
|-------------|---------------------|---------|-----------------------------
| 13# | RESET OFF | | This command should cause the
| | | | Logic Unit to set WATCH DOG
| | | | low and result in power-down
| | | | of the radiotelephone.
|-------------|---------------------|---------|-----------------------------
| 14# | STON | | Transmit signaling tone 10khz
|-------------|---------------------|---------|-----------------------------
| 15# | STOFF | | Stop transmitting signaling
| | | | tone 10khz
|-------------|---------------------|---------|-----------------------------
| 16# | SETUP | | Transmit a five word reverse
| | | | control channel message; each
| | | | of the five words will be
| | | | "FF00AA55CC33". The trans-
| | | | mitter de-keys at end of
| | | | message
|-------------|---------------------|---------|-----------------------------
| 17# | VOICE | | Transmit a two word reverse
| | | | voice channel message; both
| | | | words will be "FF00AA55CC33".
| | | | The transmitter de-keys at end
| | | | of message.
|-------------|---------------------|---------|-----------------------------
| 18# | SEND NAM | | AA = Address BB = Data
| | | | Displays contents of NAM, one
| | | | address at a time, advanced
| | | | by pressing the (*) key.
| | | | Note the address goes up to 1f
|-------------|---------------------|---------|-----------------------------
| 19# | VERSION | | Displays software version
| | | | number as "year, week"
|-------------|---------------------|---------|-----------------------------
| NOTE: Entering commands 20# through 23# or 27# causes the transceiver to
| begin a counting sequence or continuous transmission as described below.
| In order to exit from the commands to enter another test command, the (#)
| key must be depressed; all other key depressions are ineffectual.
|---------------------------------------------------------------------------
| 20# | RCVS 1 | | Receive control channel
| | | | messages counting correctable
| | | | and uncorrectable errors.
| | | | When the command starts, the
| | | | number of the command will be
| | | | displayed in the right hand
| | | | side of the display. Entering
| | | | a # key will terminate the
| | | | command and display a two
| | | | three digit number in the
| | | | display. The first number
| | | | is the number of correctable
| | | | errors and the second is the
| | | | uncorrectable errors.
|-------------|---------------------|---------|-----------------------------
| 21# | RCVV 1 | | Receive voice channel
| | | | messages counting correctable
| | | | and uncorrectable errors.
| | | | When the command starts, the
| | | | number of the command will be
| | | | displayed in the right hand
| | | | side of the display. Entering
| | | | a # key will terminate the
| | | | command and display a two
| | | | three digit number in the
| | | | display. The first number
| | | | is the number of correctable
| | | | errors and the second is the
| | | | uncorrectable errors.
|-------------|---------------------|---------|-----------------------------
| 22# | WSTS | | Receive control channel
| | | | messages counting word sync
| | | | sequence. When the command
| | | | starts, the number of the
| | | | command will be displayed in
| | | | the right side of the display.
| | | | Entering a # key will
| | | | terminate the command and
| | | | display the number of word
| | | | sync sequences in the display.
|-------------|---------------------|---------|-----------------------------
| 23# | WSTV | | Receive voice channel
| | | | messages counting word sync
| | | | sequence. When the command
| | | | starts, the number of the
| | | | command will be displayed in
| | | | the right side of the display.
| | | | Entering a # key will
| | | | terminate the command and
| | | | display the number of word
| | | | sync sequences in the display.
|-------------|---------------------|---------|-----------------------------
| 24# | (NOT USED) | |
|-------------|---------------------|---------|-----------------------------
| 25A# | SATON | | Enable the transmission of
| | | | SAT where A = SAT frequency.
| | | | See chart below.
| | | | A SAT Freq.
| | | | 0 5970 Hz
| | | | 1 6000 Hz
| | | | 2 6030 Hz
|-------------|---------------------|---------|-----------------------------
| 26# | SATOFF | | Disable the transmission of
| | | | SAT.
|-------------|---------------------|---------|-----------------------------
| 27# | TRANSMIT DATA | | TX continuous control channel
| | | | data.
|-------------|---------------------|---------|-----------------------------
| 32# | CLEAR | | Clears non-volatile memory.
| | | | Clears all stored numbers.
|-------------|---------------------|---------|-----------------------------
| 33# | DTMF | | Turn DTMF on.
|-------------|---------------------|---------|-----------------------------
| 34# | DTMF | | Turn DTMF off.
|-------------|---------------------|---------|-----------------------------
| 35# | DISPLAY RSSI | | 'D' series portable only.
|-------------|---------------------|---------|-----------------------------
| 35A# | SET AUDIO PATH | | Where A = the following...
| | | | 1 = Speaker
| | | | 2 = Microphone
| | | | 3 = Earpiece
|-------------|---------------------|---------|-----------------------------
| 38# | DISPLAY ESN | | Displays ESN in four steps,
| | | | hit * till back at start.
|-------------|---------------------|---------|-----------------------------
| 41# | (NOT USED) | | Enables diversity.
|-------------|---------------------|---------|-----------------------------
| 42# | (NOT USED) | | Disables diversity.
|-------------|---------------------|---------|-----------------------------
| 43# | (NOT USED) | | Disables diversity.
|-------------|---------------------|---------|-----------------------------
| 44# | (NOT USED) | | Disables diversity.
|-------------|---------------------|---------|-----------------------------
| 45# | READ RSSI | | Returns the RSSI reading
| | | | taken on the current channel.
| | | | The number is displayed as a
| | | | three digit decimal number.
|-------------|---------------------|---------|-----------------------------
| 46# | (NOT USED) | |
|-------------|---------------------|---------|-----------------------------
| 47A# | AUDLEV | | Set audio level where A=level
| | | | (0=lowest, 15=highest). The
| | | | normal level is 2.
| | | | NOTE: Use 8 to 12 only for
| | | | DTMF applications.
|-------------|---------------------|---------|-----------------------------
| 48# | SIDETONE ON | | Enable sidetone(Command 05#
| | | | must also be executed.
|-------------|---------------------|---------|-----------------------------
| 49# | SIDETONE OFF | | Disable sidetone(Command 06#
| | | | must also be executed.
|-------------|---------------------|---------|-----------------------------
| 50# | MAINN | | Not normally used. Tests data
| | | | transmission/reception with
| | | | transmit path connected
| | | | externally to receive path.
| | | | Maintenance data is trans-
| | | | mitted and test results
| | | | displayed:
| | | | PASS= received data is correct
| | | | FAIL=2-second timeout, no data
| | | | received, or received data is
| | | | incorrect.
|-------------|---------------------|---------|-----------------------------
| 51# | MAINL | | Tests data paths internal to
| | | | the logic unit, where
| | | | maintenance data is trans-
| | | | mitted and looped back.
| | | | Display is as follows:
| | | | PASS= received data is correct
| | | | FAIL=2-second timeout, no
| | | | looped-back data, or
| | | | looped-back data is incorrect.
|-------------|---------------------|---------|-----------------------------
| 52A# | (NOT USED) | |
|-------------|---------------------|---------|-----------------------------
| 53# | (NOT USED) | |
|-------------|---------------------|---------|-----------------------------
| 54# | (NOT USED) | |
|-------------|---------------------|---------|-----------------------------
| 55# | DISPLAY/PROGRAM | NAM | Displays the contents of the
| | | | NAM, one step at a time, ad-
| | | | vanced by depressing the (*)
| | | | key. Only the last 7 digits
| | | | of data are displayed. Refer
| | | | to NAM programming instruct-
| | | | ions in this manual for progr-
| | | | amming details.
|
| 01. 02051 - System ID umber. Vodaphone=02051 Cellnet=03600
| 02. xxxxxxxx - A option byte (in binary)
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Local use (bit A7) if set to 1 mobile will |
| | 0 | respond to local control orders in the home|
| | | area. Assigned by system operator. |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Preferred system (bit A6) applies to units |
| | 0 | capable of operating on two service systems|
| | | 0 = system B 1 = system A |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | End-to-end signaling (bit A5) when enabled|
| | 1 | indicates mobile is equipped for DTMF via |
| | | the keys after the landline connection is |
| | | made. 1 = enabled 0 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | Bit not used (bit A4) |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Repertory (bit A3) indicates the mobile is |
| | 1 | equipped with speed-dialing storage. |
| | | 1 = enabled 0 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Aux alert (bit A2) when enabled, user can |
| | 1 | place the mobile in aux alert mode and be |
| | | notified of incoming call via an aux device|
| | | 1 = enabled 0 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | H/F auto mute (bit A1) when enabled, mobile|
| | 0 | will automatically be in the mute mode when|
| | | a call is made using the hands-free mode |
| | | 1 = enabled 0 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Minmark (bit A0)supplied by system operator|
| | 0 | when enabled the users MIN2 will be sent |
| | | with each call initiated or answered. |
| | | 1 = enabled 0 = disabled |
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| 03. xxxxxxxxxx - Mobile phone number
| 04. xxxxxxxxxx - 10 digit min
| 05. 17 - Station class mark
| 06. 09 - Access overload class (15 highest priority)
| 07. xxxxxx - Security code
| 08. xxx - Lock code
| 09. xxxxxxxx - B option byte (in binary)
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | bit b7 not used |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | bit b6 not used |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | bit b5 not used |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Extended field (bit b4) when enabled, the |
| | 0 | mobile would scan more than 32 paging ch. |
| | | currently not used in UK. |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Single system scan (bit b3) if set to 1 |
| | 1 | the mobile will scan only 1 system based |
| | | on the setting of option byte A bit 6 |
| | | 1 = enabled 0 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Auto recall (bit b2) this option allows the|
| | 1 | user to access repertory by a 1 or 2 digit |
| | | send sequence |
| | | 1 = enabled 0 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Disable service levels (bit b1) if set to 1|
| | 0 | service levels couldn't be changed from the|
| | | control unit. |
| | | 0 = enabled 1 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Lock code (bit b0) when enabled, allows the|
| | 0 | user to lock and unlock the mobile using |
| | | the three digit lock code. |
| | | 0 = enabled 1 = disabled |
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| 10. xxxxxxxx - C option byte (in binary)
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | User NAM programming (bit c7) when enabled |
| | 0 | allows user to program NAM from handset |
| | | 0 = enabled 1 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | Single/Dual system (bit c6) 0=single 1=dual|
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Call timer (bit c5) when enabled, the user |
| | 0 | can access the call timer. |
| | | 0 = enabled 1 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 1 | Auto re-dial (bit c4) |
| | | 0 = enabled 1 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Speaker disable (bit c3) enable or disable |
| | 1 | handset speaker when fitting hands free |
| | | 0 = enabled 1 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | bit c2 not used |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Selectable system (bit c1) allows user to |
| | 1 | select primary system. |
| | | 0 = enabled 1 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | bit c0 not used |
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| 11. xxxxxxxx - D option byte (in binary)
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | Max volume (bit d7) sets max vol to step 4 |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | Theft disable (bit d6) when set to 1, theft|
| | | alarm is not accessible. |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | Beeper disable (bit d5) 1=disable |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 1 | EXT DTMF(bit d4) when clear, DTMF is routed|
| | | directly through APC. |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | Flashing roam (bit d3) if enabled, roam |
| | | light will flash when home area roaming. |
| | | 1 = enabled 0 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Audio convenience (bit d2) if disabled, |
| | 0 | audio levels are re-centered on power up. |
| | | 0 = enabled 1 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Time rx calls (bit d1) call timers will |
| | 0 | accumulate on incoming calls when enabled |
| | | 1 = enabled 0 = disabled |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | | Charge rate (bit d0) when enabled,telephone|
| | 1 | will respond to charge rate information |
| | | 1 = enabled 0 = disabled |
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| 12. 0023 - Initial paging system 0023=Vodaphone 0323=Cellnet
| 13. 0023 - Initial paging channel A
| 14. 0323 - Initial paging channel B
| 15. 021 - Dedicated paging channels
| 16. xxxxxxxx - E option bytes (in binary)
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | bit e7 not used |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | bit e6 not used |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | bit e5 not used |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | bit e4 transportable speaker present |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | bit e3 not used |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | bit e2 not used |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 0 | bit e1 not used |
| |~~~~~~~~~~~~|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| | 1 | Word sync scan disable (bit e0) portable |
| | | use only. |
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|-------------|---------------------|---------|-----------------------------
| 56# | (NOT USED) | |
|-------------|---------------------|---------|-----------------------------
| 57# | (NOT USED) | |
|-------------|---------------------|---------|-----------------------------
| 58# | COMPANDER ON | | Turn compander ON
|-------------|---------------------|---------|-----------------------------
| 59# | COMPANDER OFF | | Turn compander OFF
|-------------|---------------------|---------|-----------------------------
| 60# and 61# | (NOT USED) | |
|-------------|---------------------|---------|-----------------------------
| 61# | ESN TRANSFER | | For series I or 1? and MINI
| | | | TACS - Probably Micro TACS.
|-------------|---------------------|---------|-----------------------------
| 62# | RNG-ON | | Turn the APC ringer audio
| | | | path ON.
|-------------|---------------------|---------|-----------------------------
| 63# | RNG-OFF | | Turn the APC ringer audio
| | | | path OFF.
|-------------|---------------------|---------|-----------------------------
| 64# | PLT-ON | | Turn the APC transmit pilot
| | | | path on.
|-------------|---------------------|---------|-----------------------------
| 65# | PLT-OFF | | Turn the APC transmit pilot
| | | | path off.
|-------------|---------------------|---------|-----------------------------
| 66# thru 71#| (NOT USED) | |
|-------------|---------------------|---------|-----------------------------
| 66# | IDENTITY TRANSFER | | Series II and some current
| | | | portables.
|-------------|---------------------|---------|-----------------------------
| 68# | DISPLAY FLEX AND | |
| | MODEL INFO | |
|-------------|---------------------|---------|-----------------------------
| 69# | USED WITH IDENTITY | |
| | TRANSFER | |
|-------------|---------------------|---------|-----------------------------
| 72# | MODULATION GAIN | | Refer to the Portable
| | ADJUST | | Telephone Phasing section for
| | | | use of this command.
|-------------|---------------------|---------|-----------------------------
| 73# | POWER OUTPUT ADJUST | | Refer to the Portable
| | | | Telephone Phasing section for
| | | | use of this command.
| | | | (0 to 7.)
|-------------|---------------------|---------|-----------------------------
© Copyleft 1985-2024, Phrack Magazine.