Google+

THE MOTOROLA BIBLE (c)

Leave a comment

June 17, 2008 by Isybel Harto

Table of Contents:
Section
1 Introduction 8 Phone Pin Outs

2 General User Info 9 Cable Specs

3 Programming Info 10 Channel Number vs. Frequency

4 Test Mode 11 Trik Clip

5 GSM Info and Test Mode 12 Pager Info

6 Hacking the FOVC 13 Disclaimer

7 Reading the SID
Before going in to the programming of the cellular phone, it is

important for the user to know the normal things necessary for day to day

operation. While the majority of the stuff in the users manual is intended

for people that have problems programming their VCR, their are a few things

that are very important and are only mentioned in the users manual.

Turn On or Off: [Pwr]

Place Call: Enter number, [Snd]

Receive Call: [Snd] or open flip fone

End Call: [End] or close flip fone

Automatic Redial: To retry call, press [Snd] before ending the

unsuccessful call attempt.

Store Number: Phone number, [Sto], 2-digit location number

or press [*] to autoload.

If phone is Alphanumeric, display will flash

“Alpha_”. Press [Sto] to bypass or use

keypad to enter letter (up to 14). [#]

advances to next position, [*] backspaces.

When finished, press [Sto].

Recall Number: [Rcl], 2-digit location number. Entering

location 01, then hitting [#] will allow

scrolling through all stored locations.

Recall Name: Press [Name/Menu], [#] or [*] to scroll.

[Rcl] will display location number then name,

[Rcl] again will display corresponding phone

number and [Snd] to dial.

Recalling Last 10 Numbers Called: [Rcl], [0], [0]. Display will show “L0′”

followed by the name or number of the most

recently placed call. Use [#] or [*] to

scroll and [Snd] to call displayed number.

Super Speed Dialing: Directory location number, [Snd]

Changing Entries: Press [Rcl] and the 2-digit location number

so that the number to be changed is

displayed. Press and release [Clr] to back

out each of the digits. Enter a new number

and press [Sto].

Call Number Displayed: [Snd]

Microphone Muting: Press [Fcn], [6].

To unmute, press [Fcn], [6]

Lock Unit: [Fcn], [5] or [LOCK]

Unlock: Three digit unlock code. If you make an

error, [Clr] and enter again.

Automatic Lock: [FCN], [6] (not all phones)

“EnAbLE” will appear if compatible.

Display Unlock Code: Press [Fcn], [0], your six-digit security

code, [Rcl].

Changing Your Unlock Code: Press [Fcn], [0], your six-digit security

code, your NEW 3-digit unlock code, [Sto].

Review Battery Meter: Press [Fcn], [4] and release.

Adjust Volume: Earpiece – Press and hold [Vol] to increase.

Release, press again to decrease.

Ringer – [Fcn], then Vol as above.

Recall Own Phone Number: [Rcl], [#]

Individual Call Timer: [Rcl], [#], [#]

Resettable Call Timer: [Rcl], [#], [#], [#]

Reset Resettable Call Timer: [Fcn], [0], [7], [Clr]

Cumulative Call Timer: [Rcl], [#], [#], [#], [#]

Access Features: Press [Fcn], [1]. To change features, press

[*] and [#] to scroll and [Clr] to change.

To exit feature menu, press [END].

Review/Scroll Menu Features: Press [*] or [#]

Status Review: [Fcn], [0], [9], [Rcl], [#] or [*] scrolls

messages. To end press [END].

Changing System Type: Press [Rcl], [*]. Repeatedly press [*]

until the desired system type appears. To

select press [Sto].

Outgoing Call Restrictions: Press [Fcn], [0], 6-digit security code,

[1], [Sto]. Phone will place calls only

from memory locations 1-10.

To change back to unrestricted dialing

press [Fcn], [0], 6-digit security code,

[4], [Sto].

Switch to Second Phone Number: [Rcl], [#], [Sto] (Press [Clr] to finish

viewing newly activated number).

Key 1st Press 2nd Press 3rd Press 4th Press

2 A B C

3 D E F

Alpha 4 G H I

Entry 5 J K L

Mode 6 M N O

7 P Q R S

8 T U V

9 W X Y Z

Menu Features: For a more detailed description or instructions on use, consult

the user manual. Not all features listed are available on all

models.

Message Description

1 Min Beep One Minute Beep

Answer M Key Multiple Key Answer

Auto Answer Automatic Answer

C Scan System Type Selection

Call Screen Incoming Call Screening

Emrcy Off Emergency Dialing

Home System Type Selection

Level 1-6 Call Restrictions (Service Levels)

Lock Auto Automatic Lock

Name Pref’d Memory Recall Preference

Pin Active PIN Code Activation

Pref’d SIDs System Type Selection

Remind Beeps Reminder Beep Off

Ringer Silent Alert Off (Silent Ringer)

Scan A System Type Selection

Scan AB System Type Selection

Scan B System Type Selection

Scan BA System Type Selection

Scrpd Silent Silent Scratch Pad

Signal Off Signal Strength Meter

Silent Keypad Feedback Tones Off

Std Features Set as Standard

Theft Alarm Theft Alarm

Timer Auto Automatic Display Timer

Vox Mode Voice Operated Transmission

Vibrat Mode VibraCall

I would like to add that while I have extensively worked on finding

additional test mode commands, I (nor anyone else) have ever worked with the

normal operation commands as listed above. For example, above you will

notice sequences with [Fcn], [1] or [Fcn], [0], [7]. This is totally

unexplored territory. Happy hacking 🙂 See entering test mode on the new

95xx phones.

——————————————————————————–

Activating the PIN in PIN READY cellfones Thanks to fringe@rndhse.chi.il.us

(You cannot use their fone without the PIN activated)

Activating the PIN Ready feature in Motorola fones:

1. Enter user menu – press FNC,1 or FNC,Menu

2. Select Pin Active in menu and press * once or until “Pin Active”

appears in the fone display.

3. Enable ‘Pin Active’ feature – press CLR.

A small square will appear before ‘Pin Active’ sayings its enabled.

4. Exit user menu – press END

To store the PIN into memory:

1. Enter the specific PIN code – press XXXX

2. Store four digit PIN into memory location 07 – press STO,0,7

3. Return to normal operation – press CLR

To initiate a call using the PIN Ready feature:

1. Enter the phone number you wish to call:

press (XXX)XXX-XXXX, SND

2. You will hear two short rings, then press SND again. The PIN

Ready feature will automatically send the PIN code you previously

stored into memory location 07 and initiate your call.

———

What is EE3??

EE3 is the software that Motorola has added to the cellular

product line which provides feature enhancements and increased

security by restricting ESN transfer…

———

Why did the changes take place…

Due to the FCC Rule change, all new cellular telephones

that were introduced after Jan. 1, 1995 with new FCC IDs must restrict

ESN transfer. Phones introduced prior to this date are “grandfathered”

or not required to be compliant with this rule.

———

How ya can tell the difference between an EE3 and a non-EE3 fone.

These fones will be identified with the marking of EE3 on the

FCC label (look on da back of da fone)

———

How does the fone change?!

Some of the changes EE3 phones have are feature differences,

accessory compatibility, and service differences.

———

Which fones have the PIN CODE feature?!

If the phones has EE3 on the back label, then the fone has the

PIN CODE feature; with the exception of the EE3 TeleTacs and the

pre-AC-P300 boxed contours.

———

Can a 3-watt VA be used with EE3 fones?!

No, the existing 3-watt VA is not compatible with EE3 fones.

The following part numbers are for the new 3-watt booster for EE3 fones

and for conversion kits for existing 3-watt kits. The 3-watt booster

has its own handset that comes with it.

Deluxe Booster w/Micro Car Handsfree Kit (EE3 pocket and flip)

# S-5415

Deluxe Booster w/Micro Car Handsfree Kit (EE3 Elite) <no, eleet!>

# S-5093

Deluxe Booster Conversion Kit (EE3 pocket and flip)

# S-5094

Deluxe Booster Conversion Kit (EE3 Elite)

# TBA

———–

Which Motorola fones have the new Lock feature?!

All EE3 fones have the NEW lock feature – FCN,5 and STO to lock it

——————————————————————————–

Well, it seems a lot of people have been trying to figure out the date of

manufacture of Motorola cellular phones. This is easily accomplished by

locating the MSN (Mechanical Serial Number) somewhere on the telephone. It can

be 10 or 11 digits. If there is no 11th digit, warranty period is one year. If

there is an 11th digit, the warranty period can be determined from the following

charts. Without a proof of purchase, warranty date is determined by adding 3

months to the date of manufacture.

MSN Example: 194GSTxxxxW

194 is the Accounting Product Code (APC) and has little use.

G is the location of manufacture

S is the Year Code of manufacture

T is the Month Code of manufacture

xxxx is the actual serial number (hex) of that telephone

W is the Warranty Period

Year Code Year Month Code Month Warranty Period Definition

H 1983 A or B January A 1 yr w/ possible MCSI coverage

J 1984 C or D February B 3 yrs w/ possible MCSI coverage

K 1985 E or F March C 5 yrs w/ possible MCSI coverage

L 1986 G or H April D 2 yrs w/ possible MCSI coverage

M 1987 J or K May E No Warranty

N 1988 L or M June F 90 Days OEM only

P 1989 N or P July H 3 Years, Canada Only

Q 1990 Q or R August L 3 Years, OEM Only

R 1991 S or T September M 1 Year, OEM Only

S 1992 U or V October N, P, X 5 Yrs

T 1993 W or X November Q, R, S, Y, Z 3 Yrs

U 1994 Y or Z December T OEM Telephone

V 1995 U 90 Days (Reconditioned Units)

W 1996 W 4 Yrs.

X 1997

Y 1998 Location of Manufacture Code Location

Z 1999 G Libertyville, IL.

P*R*O*G*R*A*M*M*I*N*G***I*N*F*O********************************S*E*C*T*I*O*N***3

NOTES: Some units have dual NAM’s.

The ESN prefix is 130 decimal, 82 hex.

Motorola: 1-800-331-6456

There are MANY different models of Motorola phones sold under various

brand names, if you think it’s a Motorola, it probably is.

Determine which access sequence to use:

HAND HELD PORTABLE MODELS

If the phone has a FCN button and no MENU button use sequence 1.

If the phone has no FCN button use sequence 2.

If the phone has a MENU button and a FCN button use sequence 4.

INSTALLED MOBILE PHONES AND TRANSPORTABLE MODELS

If the phone has no FCN button and no RCL button use sequence 3.

If the phone has a FCN button use sequence 4.

If the phone has a MEM button use sequence 5.

If the phone has a RCL button and no FCN button use sequence 6.

SEQUENCE# ACCESS CODE

1 FCN (SECURITY CODE TWICE) RCL

2 STO # (SECURITY CODE TWICE) RCL

3 CTL 0 (SECURITY CODE TWICE) *

4 FCN 0 (SECURITY CODE TWICE) RCL

5 FCN 0 (SECURITY CODE TWICE) MEM

6 CTL 0 (SECURITY CODE TWICE) RCL

The default security code is 000000. The CTL (control) button is the

single black button on the side of the handset.

NAM programming:

1. Turn the power on.

2. Within ten seconds enter the access sequence as determined above.

3. The phone should now show “01” in the left of the display, this is the

first programming entry step number. If it does not the security code

is incorrect, or the programming lock-out counter has been exceeded. In

either case you can still program the unit by following the steps under

TEST MODE PROGRAMING below.

4. The * key is used to increment each step:

Each time you press * the display will increment from the step number,

displayed on the left, to the data stored in that step, displayed on

the right. When the data is displayed make any necessary changes and

press * to increment to the next step number.

5. The SND key is used to complete and exit programming when any STEP

NUMBER is displayed.

If you have enabled the second phone number bit in step 10 below then

pressing SND will switch to NAM 2. Steps 01 thru 06, 09 and 10 will

repeat for NAM 2, the step number will be followed by a “2” to indicate

NAM two.

5. The CLR key will revert the display to the previously stored data.

6. The # key will abort programming at any time.

PROGRAMING DATA:

STEP# #OF DIGITS/RANGE DESCRIPTION

01 00000 – 32767 SYSTEM ID

02 3 DIGITS AREA CODE

03 7 DIGITS TEL NUMBER

04 2 DIGITS STATION CLASS MARK

05 2 DIGITS ACCESS OVERLOAD CLASS

06 2 DIGITS GROUP ID (10 IN USA)

07 6 DIGITS SECURITY CODE

08 3 DIGITS LOCK CODE

09 0333 OR 0334 INITIAL PAGING CHANNEL

10 6 DIGIT BINARY OPTION PROGRAMING (SEE NOTE 1)

11 3 DIGIT BINARY OPTION PROGRAMING (SEE NOTE 2)

NOTES:

Take care with Motorola’s use of “0” and “1”. Some options use “0” to

enable, some use “1”.

1. This is a 6 digit binary field used to select the following options:

Digit 1: Internal handset speaker, 0 to enable.

Digit 2: Local Use Mark, 0 or 1.

Digit 3: MIN Mark, 0 or 1.

Digit 4: Auto Recall, always set to 1 (enabled).

Digit 5: Second phone number (not all phones), 1 to enable.

Digit 6: Diversity (Two antennas, not all phones), 1 to enable.

2. This is a 3 digit binary field used to select the following options:

Digit 1: Continuous DTMF, 1 to enable.

Digit 2: Transportable Ringer/Speaker, 0=Transducer, 1=Handset.

Digit 3: 8 hour time out in transportable mode, 0 to enable.

On newer models, they have added and changed some numbers. The numbers

as of the 3/27/92 manual are as follows:

1. The 6 digit binary field is still the same.

2. The 3 digit binary field has become a 5 digit binary field.

Digit 1: Failed Page Indicator 1=Disabled;0=Enabled

Digit 2: Motorola Enhanced Scan 1=Enabled; 0=Disabled

Digit 3: Long Tone DTMF 1=Enabled; 0=Disabled

Digit 4: Transportable Internal Ringer Speaker 1=Handset; 0=Transdcr

Digit 5: Eight Hour Timeout 1=Disabled;0=Enabled

T*E*S*T***M*O*D*E**********************************************S*E*C*T*I*O*N***4

TEST MODE ACCESS:

NEWER 95xx PHONES (Thank you Motorola!!!)

Many newer phones don’t require grounding. If your software version number

is 9526 (I think) or newer, enter this:

[FCN] [0] [0] [*] [*] [8] [3] [7] [8] [6] [6] [3] [3] [STO]

In case you have trouble remembering the number sequence, it spells out

“TESTMODE.” Leave it to Motorola to make this easier and easier all the time.

I have used this and it does work. This command just backs up my claim even

further that esn changing via handset is a reality. It’s a matter of finding

the correct combination of keys.

Normal test mode commands work like usual from then on.

For some odd reason, this hasn’t been included in all the 95xx phones. I

believe they started it in Software 9526. This is only an estimate, so if

you have a 95xx flip, let me know what software version you have and whether

it works or not so this date can be isolated. Mine is a 9562 that worked.

INSTALLED MOBILE PHONES AND TRANSPORTABLE MODELS

To enter test mode on units with software version 85 and higher you must

short pins 20 and 21 of the transceiver data connector. An RS232 break out

box is useful for this, or construct a test mode adapter from standard

Radio Shack parts.

For MINI TR or Silver Mini Tac transceivers (smaller data connector) you

can either short pins 9 and 14 or simply use a paper clip to short the

hands free microphone connector.

HAND HELD PORTABLE MODELS:

There are two basic types of Motorola portable phones, the Micro-Tac series

“Flip” phones, and the larger 8000 and Ultra Classic phones. Certain newer

Motorola and Pioneer badged Micro-Tac phones do not have a “flip”, but

follow the same procedure as the Micro-Tac.

8000 & ULTRA CLASSIC SERIES:

If you have an 8000 series phone determine the “type” before trying to

enter test mode. On the back of the phone, or on the bottom in certain

older models, locate the F09… number this is the series number. If the

FOURTH digit of this number is a “D” you CAN NOT program the unit through

test mode, a Motorola RTL4154/RTL4153 programmer is required to make any

changes to this unit.

Having determined that you do not have a “D” series phone the following

procedure is used to access test mode:

Remove the battery from the phone and locate the 12 contacts at the top

near the antenna connector. These contacts are numbered 1 through 12 from

top left through bottom right. Pin 6, top right, is the Manual Test Mode

Pin. You must ground this pin while powering up the phone. Pin 7 (lower

left) or the antenna connector should be used for ground. Follow one of

these procedures to gain access to pin 6:

1. The top section of the battery that covers the contacts contains

nothing but air. By careful measuring you can drill a small hole in the

battery to gain access to pin 6, alternately simply cut the top off the

battery with a hack saw. Having gained access use a paper clip to short

pin six to the antenna connector ground while powering up the phone.

2. If you do not want to “destroy” a battery you can apply an external 7.5

volts to the + and – connectors at the bottom of the phone, ground pin 6

while powering up the phone as above.

3. You can also try soldering or jamming a small jumper between pins 6 and

7 (top right to lower left), or between pin 6 and the antenna connector

housing ground. Carefully replace the battery and power up the phone. Use

caution with this method not to short out any other pin.

4. A cigarette lighter adapter, if you have one, also makes a great test

mode adapter as it can be disassembled to give you easier access to pin 6.

Many are pre marked, or even have holes in the right location. This is

because they are often stamped from the same mold that the manufacturer

uses for making hands free adapter kits and these kits require access to

the phone’s connectors.

ULTRA CLASSIC II SERIES:

Ground Pin 2 to pin 4.

MICRO-TAC “FLIP” SERIES:

This phone follows similar methods as outlined for the 8000 series above.

Remove the battery and locate the three contacts at the bottom of the

phone, the two outer contacts are raised and connect with the battery. The

center contact is recessed, this is the Manual Test Mode connector.

Now look at the battery contacts, the two outer ones supply power to the

phone, the center contact is an “extra” ground. This ground needs to be

shorted to the test mode connector on the phone. The easiest way to do

this is to put a small piece of solder wick, wire, aluminum foil or any

other conductive material into the recess on the phone. Having done this

carefully replace the battery and turn on the power, if you have been

successful the phone will wake up in test mode.

GENERAL NOTES:

HANDSETS: Most Motorola handsets are interchangeable, when a handset is

used with a transceiver other than the one it was designed for the display

will show “LOANER”. Some features and buttons may not work, for instance

if the original handset did not have a RCL or STO button, and the

replacement does, you will have to use the control * or control # sequence

to access memory and A/B system select procedures.

LOCK/UNLOCK PROCEDURES:

Phones with “LOCK” buttons: Press lock for at least 1/2 a second.

Phones with a “FCN” button: Press FCN 5, note that 5 has the letter’s

“J,K, and L” for lock.

Phones with no FCN or LOCK button: Press Control 5, control is the black

volume button on the side of the

handset.

SYSTEM SELECT PROCEDURES:

Phones with a RCL button: Press RCL *, then * to select, STO to store.

Phones with no RCL button: Press Control * then * to select, # to store.

Options are: CSCAn: Preferred/Non preferred with system lockout.

Std A/b, or Std b/A: Preferred/Non preferred.

SCAn Ab, or SCAn bA: Non preferred/Preferred

SCAn A: “A” ONLY

SCAn b: “B” ONLY

HOME: Home only

Pref’d SIDS: Service within the entered SIDS (up to 15)

(these are typical options, some phone’s vary. C-Scan is only available

on newer models and does not appear unless programmed, see below.)

——————————————————————————–

TEST MODE

NOTE: Not all commands work on all telephones. If a command is not valid the

display will show “ErrOr.” Not all numbers have been assigned. Not all

numbers have been listed here. Some commands were intended only for

Motorola factory applications. (This is the disclaimer in the

technical training manual. I have included all of the other commands I

have discovered one way or another. Some that say no function do have

a function but it is unknown until it is figured out.)

Three test commands are significant for programming and registering the

the telephone for service: see full descriptions under TEST MODE COMMANDS.

32# Clears the telephone. (Older Motorola allowed either three or fifteen

changes in the MIN. After that, the phone had to be sent to Motorola to reset

the counter. This is the command they use.)

38# Displays the ESN

55# This is the TEST MODE PROGRAMMING (as described below).

TEST MODE DISPLAY:

Test mode consists of two separate levels. When the telephone is first placed

in Test Mode, it is in the STATUS DISPLAY LEVEL. The display will be scrolling

(or flashing), or it will be locked. If locked, enter the unlock code and the

display will begin scrolling. If the unlock code is not known, press #. By

pushing the # key, the technician causes the cellular telephone to change to

its SERVICING LEVEL. The display will be US’ . There are five types of

display, depending on the model of the telephone: a 16 character display, a 14

character display, a 10 digit display (with two versions), an 8 character

display, and a 7 character display. The status display is different in analog

operation than in a TDMA call.

NOTE: Use of a loaner handset is allowed in servicing level, but may not be

allowed in the status display level. A locked telephone will not show the

status display, but will enter the servicing level.

14 Character Analog Call Display 14 Character TDMA Call Display

+—————+ +—————+

| A B C D E F G | | A B C D E F G |

| H I J K L M N | | H I J K L M N |

+—————+ +—————+

ABC = Channel ABC = Channel (“A” in the

D = *Call Processing Mode position indicates a

EFG = RSSI channel above 1000)

H = **(D)SAT D = *Call Processing Mode

I = 1=TX on EFG = RSSI

J = 1=Signalling Tone On HIJ = Digital Verification

K = Power Level (0-7) Color Code (1-255)

L = 1=Control Channel K = Power Level (0-7)

M = 1=RX Audio off L = 1=TX on

N = 1=TX Audio off M = 1=Bit Error Rate (0-7)

N = 1=Audio Muted

*Call Processing Mode: *Call Processing Mode

BLANK = AMPS BLANK = AMPS

A = NAMPS High Sub-Channel 1 = Slot 1, half rate

B = NAMPS Center Sub-Channel 2 = Slot 2, half rate

C = NAMPS Low Sub-Channel 3 = Slot 3, half rate

4 = Slot 4, half rate

**(D)SAT: 5 = Slot 5, half rate

0 = 5970 Hz 6 = Slot 6, half rate

1 = 6000 Hz 7 = Slot 1, full rate

2 = 6030 Hz 8 = Slot 2, full rate

3 = No SAT 9 = Slot 3, full rate

————

0-6 = DSAT Vector NOTE: The Analog Call

7 = No DSAT Display will always

show when on a control

channel.

——————————————————————————–

# Enter SERVICING LEVEL from Test Command Mode.

00# no function

01# Restart (Re-enter DC power start-up routine.) On TDMA telephones, this

command has the same effect as 13#.

02# Display Current Telephone Status (This is a non-altering version of the

STATUS DISPLAY. On a 14 character display, all the information is shown.

On a 7 character display only the information on the second line of a 14

character display is shown. On a 10 character display, all the

information on the second line of a 14 character display plus the last

three characters of the first line are shown.)

STATUS DISPLAY, ALTERNATES BETWEEN:

AAA BBB AAA = Channel Number (decimal) BBB = RSSI reading for channel

CDEFGHI are as follows:

C = SAT frequency (0=5970, 1=6000, 2=6030, 3=no channel lock)

D = Carrier (0=off, 1=on)

E = Signalling tone (0=off, 1=on)

F = Power attenuation level (0 through 7)

G = Channel mode (0=voice channel, 1=control channel)

H = Receive audio mute (0=unmuted, 1=muted)

I = Transmit audio mute (0=unmuted, 1=muted)

Press * to hold display and # to end.

03# Reset Autonomous Timer. This command results in the reset of the

autonomous timer but does not provide any test function on these models.

04# Initializes Telephone to Standard Default Conditions:

Carrier Off, Power Level 0, Receiver Audio Muted, Transmit Audio Muted,

Signalling Tone Off, SAT Off, Resetting of Watch-Dog Timer Enabled,

DTMF and Audio Tones Off, Audio Path Set to Speaker

05# TX Carrier On (Key Transmitter)

06# TX Carrier Off

07# RX Audio Off (Mute Receiver Audio)

08# RX Audio On (Unmute Receiver Audio)

NOTE: It seems Motorola finally discovered that people were using

this command to eaves-drop on cellular converstions. On MOST

of the newer phones (95xx and up), this command when used

with 11xxxx# will only work with the following channels:

11xxxx# Tower Freq. Mobile Freq. Channel

#300 Tx 879.00 Rx 834.00 0300

#333 Tx 879.99 Rx 834.99 0333

#385 Tx 881.55 Rx 836.55 0385

#799 Tx 893.97 Rx 848.97 0799

#991 Tx 869.04 Rx 824.04 0800

09# TX Audio Off

10# TX Audio On

11(Ch.No.)# Set Transceiver to Channel xxxx (Receive and Transmit in Decimal;

accepts 1, 2, 3, or 4 digits)

see Section 9 for detailed information on this command

12x# Set Power Step to x; (0,1-7) 0=Maximum Power (3 Watts) 7=Minimum Power Out

13# Power Off (Shuts off the radio)

14# 10 kHz Signalling Tone On

15# 10 kHz Signalling Tone Off

16# Setup (Transmits a five word RECC message; each of the five words will

be “FF00AA55CC33.” Transmitter de-keys at the end of the message.)

17# Voice (Transmits a two word REVC message; each of the two words will be

“FF00AA55CC33.” Transmitter de-keys at the end of the message.)

18# C-Scan (Allows for entry of as many as 5 negative SID’s for each NAM.)

Newer Motorola phones are equipped with a feature called C-Scan, this is

an option along with the standard A/B system selections. C-Scan allows

the phone to be programmed with up to five inhibited system ID’s per NAM.

This is designed to prevent the phone from roaming onto specified non-home

systems and therefore reduce “accidental” roaming fees.

1. C-Scan can only be programmed from test mode, power phone up with the

relevant test mode contact grounded (see above).

2. Press # to access test mode.

3. Press 18#, the phone will display “0 40000”.

4. Enter the first inhibited system ID and press *.

Continue to enter additional system ID’s if required. After the 5th entry

the phone will display “N2”. Press * to continue and add system ID’s for

NAM 2 as required.

5. If an incorrect entry is made (outside the range of 00000-32767) the

display will not advance, press CLR and re-enter. Use a setting of

40000 for any un-needed locations.

6. When the last entry has been made press * to store and press # to exit,

turn off power.

or

[**Phones without the C-Scan option used this command to SEND NAM.**]

18# SEND NAM. Display shows AA BB. Where AA=Address and BB=Data. Displays

the contents of the NAM, one address at a time, advanced by pressing the

* key. The following data is contained in NAM. The test is exited by

depressing the # key.

SIDH Sec. Code

OPT. (1,2,&3) MIN

MIN1, MIN2 FCHNA

SCM FCHNB

IPCH NDED

ACCOLC CHKSUM GIM

19# Display Software Version Number (4 digits displayed as year and week)

NOTE: Entering commands 20# through 23# or 27# causes the transceiver to begin

a counting sequence or continuos transmission as described below. In

order to exit from the commands to enter another test command, the #

key must be depressed; all other key depressions are ignored.

20# Receive control channel messages counting correctable and uncorrectable

errors. When the command starts, the number of the command will be

displayed in the upper-right corner of the display. Entering a # key

will terminate the command and display two three-digit numbers in the

display. The first number is the number of correctable errors and the

second is the uncorrectable errors.

21# Received voice channel messages counting correctable and uncorrectable

errors. When the command starts, the number of the command will be

displayed in the upper right-hand corner of the display. Entering a #

key terminates the command and will display two three-digit numbers in

display. The first is the number of correctable errors and the second

is the uncorrectable errors.

22# Receive control channel messages counting word sync sequence. When the

command starts, the number of the command will be displayed in the upper

right-hand corner of the display. Entering a # key will terminate the

command and display the number of word sync sequences in the display.

23# Receive voice channel messages counting word sync sequences. When the

command starts, the number of the command will be displayed in the upper

right-hand corner of the display. Entering a # key will terminate the

command and display the number of word sync sequences in the display.

24# Receive control channel data and display the majority voted busy/idle

bit. 0=idle 1=busy

25x# SAT On When x=0, SAT=5970HZ

x=1, SAT=6000HZ

x=2, SAT=6030HZ

26# SAT Off

27# Transmit Data (Transmits continuous control channel data. All words

will be “FF00AA55CC33.” When the command starts, ’27’ will be displayed

in the right side of the display. Entering a # key will terminate the

command. The transmitter de-keys when finished.)

28# Activate the high tone (1150 Hz +/- 55 Hz)

29# De-activate the high tone

30# Activate the low tone (770 Hz +/- 40 Hz)

31# De-activate the low tone

32# Clear (Sets non-volatile memory to zeroes or factory default. This

command will affect all counters, all repertory memory including the last

number called stack, and all user programmable features including the

setting of System Registration. It does not affect the ESN, NAM, phasing

data, or lock code. This takes a minute or so. DO NOT TURN OFF THE

TELEPHONE WHILE THIS IS SHOWING ’32’ ON THE DISPLAY. WAIT UNTIL THE

NORMAL SERVICE LEVEL DISPLAY RESUMES! [maybe a minute or so])

33x# Turn on DTMF for x (1-9, *, 0, #, plus the single tones)

Where x=1 697 Hz + 1209 Hz 14 1150 HZ (not used in cellular)

2 697 Hz + 1336 Hz 15 1209 Hz

3 697 Hz + 1477 Hz 16 1336 Hz

4 770 Hz + 1209 Hz 17 1477 Hz

5 770 Hz + 1336 Hz 18 1633 Hz (not used in cellular)

6 770 Hz + 1477 Hz 19 Turn DTMF off

7 852 Hz + 1209 Hz 20 2087 Hz

8 852 Hz + 1336 Hz 21 2308 Hz

9 852 Hz + 1477 Hz 22 2553 Hz (not used in cellular)

* 941 Hz + 1209 Hz 23 Turn DTMF off

0 941 Hz + 1336 Hz 24 3428 Hz (not used in cellular)

# 941 Hz + 1477 Hz 25 3636 Hz (not used in cellular)

10 697 Hz 26 4000 Hz (not used in cellular)

11 770 Hz 27 3555 Hz (not used in cellular)

12 852 Hz 28 4571 Hz (not used in cellular)

13 941 Hz 29 Turn DTMF off

Someone Please Check Out 24 thru 28 for accuracy. I had weak equipment.

34# Turn DTMF Off

35# Display RSSI (“D” Series Portable Only)

or

35x# Set Audio Path to x x=0, V.S.P Microphone (Applies to mobiles only.)

x=1, Speaker

x=2, Alert

x=3, Handset

x=4, Mute

x=5, External Telephone (Applies to Portables Only)

x=6, External Handset (Applies to NEWER Portables)

36nnn# Scan (TDMA Telephones only. Scans the primary control channels and

attempts to decipher the forward data stream. The display will show PASS1

if the strongest control channel was accessed, PASS2 if the second

strongest was accessed, and FAIL if no control channel could be accessed.)

(nnn=Scan speed in milliseconds). Tunes from channel 1 to 666 in order.

Entering a * pauses the scan and displays current Channel Number and

RSSI reading (AAA=Channel Number and BBB=RSSI Reading). When scan speed

is 300 milliseconds or greater, the current status is displayed during the

scan; when less than 300 milliseconds the status is displayed only during

pause. Entering * during a pause causes the scan to resume. Entering #

aborts the scan and leaves the mobile tuned to the current channel. During

this command only the * and # keys are recognized.

NOTE: While I haven’t heard from ONE single person that this has worked,

Motorola has continued to print this command in all the Technical

Training Books (including the January 96 edition).

37# Sets Low Battery Threshold. Usage: #37#x# where x is any number

from 1 to 255. If set to 1, the Low Battery indicator will come up

when the phone is powered on. If set to 255, it may never come up.

38# Display ESN (Displays ESN in four steps, two hexadecimal digits at a time

in a four digit display. The decimal shows the address, 00 through 03 as

the first two digits, and two digits of the ESN as the last two digits.

Use the ‘*’ to step through the entire hexadecimal ESN.)

Compander OFF (“D” Series Portables)

or

38# SND-SNM. Display shows AA BB. Where AA=Address;BB=Data. Send the SNM

to the display. All 32 bytes of the SNM will be displayed, one byte at

a time. The byte address will be displayed in the upper right-hand

corner and the contents of that address will be displayed in the hex.

The * key is used to step through the address similar to the SEND-NAM

(18#) command.

39# Compander ON (“D” Series Portables)

or

39# RCVSU. Receive one control channel word. When the word is received it

is displayed in hex. This command will be complete when a control channel

word is received or when the # key is entered to abort the command.

40# RCVVC. Receive one voice channel word. When the word is received it is

displayed in hex. This command will be complete when a voice channel

word is received or when the # key is entered to abort the command.

41# Enables Diversity (On F19CTA… Series only.)

42# Disables Diversity (On F19CTA… Series only.)

43# Disable Diversity

USE T/R ANTENNA (On F19CTA… Series only.)

USE R ANTENNA (On D.M.T./ Mini TAC)

44# Disable Diversity

USE R ANTENNA (On F19CTA… Series only.)

USE T/R ANTENNA (On D.M.T./ Mini TAC)

45# Display Current Receive Signal Strength Indicator (Displayed as a 3 digit

decimal number) The strongest signal I have ever received was 179 and I

was sitting directly below the tower WITHOUT an external antenna.

46# Display Cumulative Call Timer

47x# Set RX Audio level to X

(For F19CTA …Series Transceivers)

X=0, Lowest Volume

X=6, Highest Volume

X=7, mute

Normal setting is 4.

(For D.M.T./ Mini TAC Transceivers)

X=0, Lowest Volume

X=7, Highest Volume

Normal setting is 4.

(For TDMA Transceivers and F09F… Series and Higher Portables)

X=0, Lowest Volume

X=15, Highest Volume

Normal setting is 2 to 4. (On TDMA

Transceivers and Micro TAC portables,

settings 8 through 15 are for DTMF

applications only.)

48# Side Tone On. Use this command in conjunction with 350# to test the

entire audio path in hands-free applications.

49# Side Tone Off

50# Maintenance data is transmitted and test results displayed:

PASS=received data is correct

FAIL 1=2second timeout, no data rec.

FAIL 2=received data is incorrect

51# Test of mobile where maintenance data is transmitted and looped back.

Display is as follows:

PASS=looped-back data is correct

FAIL 1=2 second timeout, no looped-back data

FAIL 2=looped-back data is incorrect

52x# SAT Phase Adjustment. A decimal value that corresponds to phase shift

compensation in 4.5 degree increments. Compensation added to inherent

phase shift in transceiver to achieve a total of 0 degrees phase shift.

Do NOT enter any values except those shown below.

0 degrees = 0 121.5 degrees = 59 243.0 degrees = 86

4.5 = 1 126.0 = 60 247.5 = 87

9.0 = 2 130.5 = 61 252.0 = 112

13.5 = 3 135.0 = 62 256.5 = 113

18.0 = 4 139.5 = 63 261.0 = 114

22.5 = 5 144.0 = 40 265.5 = 115

27.0 = 6 148.5 = 41 270.0 = 116

31.5 = 7 153.0 = 42 274.5 = 117

36.0 = 16 157.5 = 43 279.0 = 118

40.5 = 17 162.0 = 44 283.5 = 119

45.0 = 18 166.5 = 45 288.0 = 120

49.5 = 19 171.0 = 46 292.5 = 121

54.0 = 20 175.5 = 47 297.0 = 122

58.5 = 21 180.0 = 64 301.5 = 123

63.0 = 22 184.5 = 65 306.0 = 124

67.5 = 23 189.0 = 66 310.5 = 125

72.0 = 48 193.5 = 67 315.0 = 126

76.5 = 49 198.0 = 68 319.5 = 127

81.0 = 50 202.5 = 69 324.0 = 104

85.5 = 51 207.0 = 70 328.5 = 105

90.0 = 52 211.5 = 71 333.0 = 106

94.5 = 53 216.0 = 80 337.5 = 107

99.0 = 54 220.5 = 81 342.0 = 108

103.5 = 55 225.0 = 82 346.5 = 109

108.0 = 56 229.5 = 83 351.0 = 110

112.5 = 57 234.0 = 84 355.5 = 111

117.0 = 58 238.5 = 85 360.0 = 70

53# Enable scrambler option, when equipped.

54# Disable scrambler option, when equipped.

55# Display/Program N.A.M. (Test Mode Programming)

TEST MODE PROGRAMING:

Assuming you have completed one of the above steps correctly the phone

will wake up in test mode when you turn the power on. When you first

access test mode the phone’s display will alternate between various status

information that includes the received signal strength and channel number.

The phone will operate normally in this mode. You can now access Service

Mode by pressing the # key, the display will clear and a ‘ will appear.

Use the following procedure to program the phone:

1. Enter 55# to access programming mode.

2. The * key advances to the next step. (NOTE that test mode programming

does NOT have step numbers, each time you press the * key the phone

will display the next data entry).

3. The CLR key will revert the display to the previously stored data.

4. The # key aborts programming at any time.

5. To complete programming you must scroll through ALL entries until a ‘

appears in the display.

6. Note that some entries contain more digits than can be displayed by the

phone, in this case only the last part of the data can be seen.

TEST MODE PROGRAMING DATA: For AMPS and NAMPS Cellular Telephones

STEP# #OF DIGITS/RANGE DESCRIPTION

01 00000 – 32767 SYSTEM ID

02 8 DIGIT BINARY OPTION PROGRAMING, SEE NOTE 1 BELOW

03 10 DIGITS MIN (AREA CODE & TEL#)

04 2 DIGITS STATION CLASS MARK, SEE NOTE 2 BELOW

05 2 DIGITS ACCESS OVERLOAD CLASS

06 2 DIGITS GROUP ID (10 IN USA)

07 6 DIGITS SECURITY CODE

08 3 DIGITS UNLOCK CODE

09 3 DIGITS SERVICE LEVEL, SEE NOTE 3 BELOW

10 8 DIGIT BINARY OPTION PROGRAMING, SEE NOTE 4 BELOW

11 8 DIGIT BINARY OPTION PROGRAMING, SEE NOTE 5 BELOW

12 0333 OR 0334 INITIAL PAGING CHANNEL

13 0333 “A” SYSTEM IPCH

14 0334 “B” SYSTEM IPCH

15 3 DIGIT NUMBER PAGING CHANNEL (021 IN USA)

16 8 DIGIT BINARY OPTION PROGRAMING, SEE NOTE 6 BELOW

Steps 01 through 06 and 12 will repeat for NAM 2 if the second phone

number bit has been enabled in step 11.

TEST MODE PROGRAMING DATA: For TDMA Cellular Telephones

STEP# #OF DIGITS/RANGE DESCRIPTION

01 00000 – 32767 SYSTEM ID

02 8 DIGIT BINARY OPTION PROGRAMING, SEE NOTE 1 BELOW

03 10 DIGITS MIN (AREA CODE & TEL#)

04 2 DIGITS STATION CLASS MARK, SEE NOTE 2 BELOW

05 2 DIGITS ACCESS OVERLOAD CLASS

06 2 DIGITS GROUP ID (10 IN USA)

07 6 DIGITS SECURITY CODE

08 3 DIGITS LOCK CODE

09 3 DIGITS SERVICE LEVEL, SEE NOTE 3 BELOW

10 8 DIGIT BINARY OPTION PROGRAMING, SEE NOTE 4 BELOW

11 8 DIGIT BINARY OPTION PROGRAMING, SEE NOTE 5 BELOW

12 0333 OR 0334 INITIAL PAGING CHANNEL

13 0333 “A” SYSTEM IPCH

14 0334 “B” SYSTEM IPCH

15 3 DIGITS DEDICATED PAGING CHANNELS (021 IN USA)

16 3 DIGITS SECONDARY INITIAL PAGING CHANNEL. 708 for

system A, 737 for system B. Allows the TDMA

telephone to be assigned to a TDMA channel in

a call

17 708 SECONDARY INITIAL PAGING CHANNEL FOR SYSTEM A

18 737 SECONDARY INITIAL PAGING CHANNEL FOR SYSTEM B

19 8 DIGITS OPTION PROGRAMMING, SEE NOTE 6 BELOW

NOTES:

Take care with Motorola’s use of “0” and “1”. Some options use “0” to

enable, some use “1”.

These are eight digit binary fields used to select the following options:

1. (step 02 above, suggested entry is: 11101001 for “A” system, 10101001

for “B” sys)

Digit 1: Local use mark, 0 or 1.

Digit 2: Preferred system, 1=system A, 0=system B.

Digit 3: End to end (DTMF) dialing, 1 to enable.

Digit 4: Not used, enter 0. Formerly used for test mobile.

Digit 5: Repertory (speed) dialing, 1 to enable. (Not used in TDMA)

Digit 6: Auxiliary (horn) alert, 1 to enable.

Digit 7: Hands free (VSP) auto mute, 1 to enable (mutes outgoing hands

free audio until the MUTE key is pressed). (Not used in TDMA)

Digit 8: Min mark, 1 = Enabled. NOT CHANGEABLE on series II or III.

2. Station Class Mark

SCM | 666 or 832 Ch. | VOX | Max Power

—–+—————-+—–+———–

00 | 666 | N | 3.0 W

01 | 666 | N | 1.2 W

02 | 666 | N | 0.6 W

03 | | |

04 | 666 | Y | 3.0 W

05 | 666 | Y | 1.2 W

06 | 666 | Y | 0.6 W

07 | | |

08 | 832 | N | 3.0 W

09 | 832 | N | 1.2 W

10 | 832 | N | 0.6 W

11 | | |

12 | 832 | Y | 3.0 W

13 | 832 | Y | 1.2 W

14 | 832 | Y | 0.6 W

15 | | |

3. Service Level Codes:

001 The telephone will only dial numbers in memory locations 01, 02

and 03. No keypad entries or memory storage is possible.

Restrict ALL outgoing calls by clearing locations 01, 02, and 03

and place the phone in servicing level 001. In some phones this

applies to memory locations 01 – 10.

002 The telephone will dial only numbers from memory locations. The

keypad is disabled and super speed dialing is not enabled.

003 Keypad dial only; no memory recall allowed.

004 Unlimited keypad and memory dialing. (DEFAULT)

005 Seven-digit dialing only

006 Full keypad and memory dialing, but memory locations 1 through

10 cannot be changed.

007 The phone will dial only from as many as 50 programmable memory

locations

4. (step 10 above, suggested entry is: 00000100)

Digits 1 – 3: Not used in USA, enter 0.

Digit 4: Extended Field. When enabled, the telephone will scan

more than 32 paging channels. Not used in USA, 0 to disable

Digit 5: Single system scan, 1 to enable (scan A or B system only,

determined by bit 2 of step 02. Set to “0” to allow user the

option).

Digit 6: Super speed dial, 1 to enable (pressing N, or NN SND will

dial the number stored in memory location NN).

Digit 7: User selectable service level, 0 to enable (allows user to

set long distance/memory access dialing restrictions).

Digit 8: Lock function, 0 to enable (allows user to lock/un-lock the

phone, if this is set to 1 the phone can not be locked).

5. (step 11 above, suggested entry is: 00000000)

Digit 1: Handset programming, 0 to enable (allows access to programming

mode without having to enter test mode).

Digit 2: Second phone number (not all phones), 1 to enable.

Digit 3: Call timer access, 0 to enable. (Not used in TDMA)

Digit 4: Auto system busy redial, 0 to enable.

Digit 5: Internal Speaker disable, 1 to enable (use with select VSP

units only, do not use with 2000 series mobiles).

Digit 6: IMTS/Cellular, 1 to enable (rarely used).

Digit 7: User selectable system registration, 0 to enable.

Digit 8: Dual antenna (diversity), 1 to enable.

6. (step 16 and 19 above, suggested entry is: 0011010 for portable and 0011011

for mobile units)

Digit 1: Enhanced Scan, when enabled, four strongest signalling

channels are scanned instead of two. 1=enabled, 0-disabled.

Digit 2: Cellular Connection, used only in series II phones if a

series I cellular connection is used with a series II.

0=series II, 1=series I, 0 for ALL TDMA PHONES

Digit 3: Continuous DTMF, 1 to enable (software version 8735 and later)

Digit 4: Transportable Internal Ringer/Speaker. When set to 0, audio

is routed to the external speaker of the transportable; 1

routes it to the handset.

Digit 5: 8 hour time-out, 0 to enable (software version 8735 and later)

Digit 6: Not used, 0 only.

Digit 7: Failed page indicator, 0 to enable (phone beeps when an

incoming call is detected but signal conditions prevent

completion of the call).

Digit 8: Portable scan, 0 for portable, 1 for mobile units.

56# Illumination Diagnostic. Lights up all lights (except the green in use

light) and displays all “8”‘s. The phone is also muted until repowered.

57x# Call Processing Mode

x=0, AMPS

x=1, NAMPS

x=2-4, RESERVED

x=5, TDMA signalling

x=6, TDMA signalling with loopback before decoding

x=7, TDMA signalling with loopback voice after decoding

x=8, TDMA signalling with loopback FACCH after decoding

x=9, TDMA forced synchronization

58# Compander On (Audio compressor and expander) (See 39#)

59# Compander Off (Audio compressor and expander) (See 38#)

60# no function

61# ESN Transfer (For Series I D.M.T./Mini TAC only)

62# Turn On Ringer Audio Path

63# Turn Off Ringer Audio Path

64# ? Does something, doesn’t display anything

65# ? Does something, doesn’t display anything

66# Identity Transfer (Series II Trancvrs and later mobiles, F09HG…,

F09HL…, F09HY…, F09HR…, F09LF…, F09NF…, F09PY…, F09QY…,

F09RY…, and most retail portables shipping prior to April 1, 1995.)

Does the actual transfer of the ESN and NAM info. See the 80x# command.

67# Displays two 3 digit numbers. If you keep entering this command

repeatedly, the first number will constantly change, the second won’t

(as far as I have seen).

68# Display FLEX and Model Information

69# Used with 66# for Identity Transfer. In models shipped without the 66#

command, this is used with 80x# instead. Reads NAM information, repertory

memory, and C-Scan ID SID’s from old phone.

70# Abbreviated field transmitter audio deviation command, for transceivers

with FCC ID ABZ89FT5668.

71# Abbreviated field power adjustment command, for transceivers with FCC ID

ABZ89FT5668.

72# Field audio phasing commands. The left side of the display should read

“00” followed by a two digit number. The “00” indicates the first

programming step. If you press the *, the 00 changes to 01 and so on until

08. The “06” and “0A” are used to change the audio level (to change:

press the volume up or down keys). Other registers…don’t know.

73# Field power adjustment command.

75# Display ESN (Displays ESN in four steps, two decimal digits at a time

in a three digit display. The decimal shows the address, 0 through 3 as

the first digit, and two digits of the ESN as the last two digits.

Use the ‘*’ to step through the entire hexadecimal ESN.)

38# 75#

00-D4 0 30

01-25 1 16

02-D4 2 13

03-1E 3 54309

80x# Current Identity Transfer Procedure. (Available in telephones shipping

after April 1, 1995.) This does NOT transfer the ESN.

x=0, Transfers NAM information (On TDMA telephones, this

command also transfers C-Scan SID’s.)

x=1, Transfers repertory memory (names & telephone numbers

in memory.)

x=2, Transfers C-Scan SID’s on analog telephones (Not

available on TDMA telephones.)

NOTES: As new fones come out, more commands are added/deleted as needed.

The majority of these commands were figured using VERY old software

versions. Some commands won’t work on some phones. If you find a

command that does something, please inform me as well as the software

version number of the phone it was discovered on.

——————————————————————————–

* NEW SECTION *

COMMANDS THAT DO SOMETHING BUT I DON’T KNOW WHAT!!!

74#

76#

77#

78#

99#

If you have any insight to these commands or if you have any more to add to the

list, please email me promptly. Thank you.

G*S*M***I*N*F*O***A*N*D***T*E*S*T***M*O*D*E********************S*E*C*T*I*O*N***5

Thanks to Janus Krarup (jckrarup@post1.com http://www.ibt.dk/morten/friends/)

for all the information in this section. His web page has all of this

information (and more) and is continually updated. It’s also offered in Italian

and will be available soon in Czech.

TESTMODE for GSM PHONES:

Start with the sequence:

Testmode

Command#

|

|

[pause] [pause] [pause] [1] [1] [3] [pause] [1] [pause] [ok] [MENU] (pause is

accomplished by holding down the [*] key until box appears).

This accomplishes the editing/viewing of the Engineer Field Options. By

substituting different numbers for the [1] [1] [3], many more test mode

commands and functions are available. (see below for an almost complete list)

After pressing [MENU], scroll until the new option appears. Pressing [OK] will

then reveal 3 new options:

ACTIVE CELL: Displays Active Channel and lets you scroll through: RxLev, RxLevAM,

NCC, BCC, MSTxPwr, and C1.

During a call you can see: RxLev, RxLevFull, RxLevSub, RxQualFul,

RxQualSub, Timeslot, TimeAdv, and PwrLev.

The active channel may read “Hopping” during a call.

When establishing a network connection you can see what SDCCH

(Standalone Dedicated Control CHannel) the negotiation takes place

on.

ADJACENT CELLS: Lets you scroll through the adjacent cells (1-6) and view their

channel allocations.

SYSTEM PARAMETERS: Displays the following: Combined, AcsClas, MCC, MNC, LAC,

CellID, T3212, BS-PA-MFRM, and XZQTY.

During a call you can see: Combined, DTX, MCC, MNC, LAC, and

CellID.

——————————————————————————–

Key To The Readouts:

Combined: Haven’t got a clue. The two Danish operators has OFF and Swedish

Comviq has ON.

RxLev: The strength of the received signal (in dBm), normally between -55 and

-90 – the signal drops at RxLevAm

When comparing RxLev’s, remember the logarithmic nature of the dB scale and

that the signal intensity decays by a factor of 4 when the distance from

the BST is doubled (assuming line of sight to the BST, the signal will

drop 6 db when the distance is doubled.)

RxLevAm: Receive signal strength cut off point (around -100 dBm and -110 dBm).

BCC: Broadcast Color Code (0 through 7)

NCC: Network Color Code (0 through 7)

MSTxPwr: BTS transmit power in dBm (see notes on power control)

C1: Measurement of the signal quality (bit failure). A forced handoff will be

made if C1<0. ( I have seen C1 as high as 039). This value is reported

from MS back to the BSC which decides when to make a handoff.

RxLevFull: C1 value with continuous transmission from tower.

RxLevSub: C1 value with discontinuous transmission from tower.

RxQualFull: Bit error rate with continuous transmission from tower.

RxQualSub: Bit error rate with discontinuous transmission from tower.

Timeslot: The current timeslot (0 through 7). TDMA allows eight channels to be

accommodated on a single RF carrier.

TimeAdv: Timing advance (0 through 63). TA can be multiplied with 547 meters

(35 km/64 TA steps) to get the distance to the BTS.

PwrLev: Shows which power step/level the phone is transmitting at (see section

below on power control)

DTX: Discontinuous transmission, a feature used to save battery and reduce

network traffic.

MCC: Mobile Country Code. 238=Denmark

MNC: Mobile Network Code. 1=Tele Denmark, 2=Sonofon (these are the ones for

the MCC 238).

LAC: Local Area Code. (not sure, but I could imagine it being the BSC

identity).

CellID: A unique number that identifies the cell. (BTS identity)

T3212: Time between periodic network updates. Appears to be fixed (010 for

Tele Denmark and 050 for Sonofon).

——————————————————————————–

POWER CONTROL:

To minimize co-channel interference and to conserve power, both the mobiles and

the Base Transceiver Stations operate at the lowest power level that will

maintain an acceptable signal quality. Power levels can be stepped up or down

in steps of 2 db from the peak power for the class down to a minimum of 13 dBm

(20 milliwatts).

Use this table to translate between dBm, PwrLev, and Power:

+–+—-+–+—+—+–+—+—+—+—-+—+—-+—-+—-+—-+—-+

Power Level| 0| 1| 2| 3| 4| 5| 6| 7| 8| 9 | 10| 11| 12| 13| 14| 15|

+–+—-+–+—+—+–+—+—+—+—-+—+—-+—-+—-+—-+—-+

dBm|43| 41|39| 37| 35|33| 31| 29| 27| 25| 23| 21| 19| 17| 15| 13|

+–+—-+–+—+—+–+—+—+—+—-+—+—-+—-+—-+—-+—-+

Watts|16|12.8| 8|5.2|3.2| 2|1.3|0.8|0.5|0.32|0.2|0.13|0.08|0.05|0.03|0.02|

+–+—-+–+—+—+–+—+—+—+—-+—+—-+—-+—-+—-+—-+

If you can help out with deciphering the readouts, additional sequences or

corrections please feel free to contact Janus Krarup at jckrarup@post1.com.

——————————————————————————–

Security Codes on the GSM phones:

The phones are protected by two codes:

The UNLOCK code which consists of 4 digits (default 1234)

This is changed by typing MENU 51 and providing the security code. You can type

in wrong codes until you hit the right one.

The SECURITY code which consists of 6 digits (default 000000)

This is changed by typing MENU 54 and providing the old code. Again, you can

keep hitting bogus codes all day until you get the right one (hope you got

some time to kill).

The SIM card is protected by 2 codes:

The PIN code (Personal Identification Number) which consists of 4 to 8 digits.

The PIN code can only be typed in wrong 3 times (you heard right…3). After

this the SIM card will be blocked until the PUK code is used. The PIN code is

user definable. It can be changed by providing the old PIN code or the PUK

code. There is a menu for changing the PIN code by providing the old one, but

you can also type **04* in order to do so. To enter a whole new PIN on a

blocked card or without knowing the old PIN, you need to use **05* PUK (OK)

NEWPIN (OK) NEWPIN (OK)

The PUK code (Personal Unblocking Key) consists of 8 digits.

This is set by the network provider and can not be changed. If entered wrongly

10 times, the card will become permanently blocked and will need to be replaced.

——————————————————————————–

Undocumented Menu shortcuts (7500, 8200, and maybe the 5200 and 7200)

Menu + XX

11 Status Review

13 Available networks

14 Preferred networks

21 Incoming call alert

22 Select keypad tones

25 Require SIM card PIN

26 Language selection

32 Repetitive timer

33 Single alert timer

34 Show meter during calls

35 Resettable call meters

36 Resettable call meters

37 Set call cost rates

38 Reset all meters

41 Keypad dialing (call restrictions)

43 Restrict incoming calls

44 Phone number length

51 Change unlock code

52 Master reset

53 Master clear

54 New security code

55 Automatic lock

63 Battery saving mode

——————————————————————————–

Test Mode Functions:

3 MENU-phone book

4 MENU-messages

5 mute on/off (menu during call)

6 MENU-Call related features

7 MENU-“arrows”

8 select phone line

9 last ten calls

10 restrict my phone number

11 call diverting

12 divert when available

13 Detailed diverting

14 Divert voice calls

15 Divert ALL voice calls

16 If Busy

17 If no answer

18 If not reachable

19 Divert fax calls

20 Divert Data calls

21 Cancel all diverting

22 Call waiting

23 Call barring

24 Bar outgoing calls

25 Bar incoming calls

26 Change Barr password

27 Call restrictions

28 Restrict incoming calls

29 Phone number length

30 Keypad dialing

31 Call voicemail

32 Received messages

33 Cell broadcast

34 Message settings

35 Message alert tone

36 Voicemail number

37 Incoming call alert

38 No alert

39 Vibrate only

40 Adjust ring volume

41 Lock now

42 Automatic lock

43 Change unlock code

44 Require SIM card PIN

45 Change SIM PIN code

46 New security code

47 Extended menus

48 Language selection

49 Automatic (Language Selection)_

50 Change greeting

51 Battery saving mode

52 Select keypad tones

53 Phone status

54 Status review

55 Master reset

56 Master clear

57 Available networks

58 Network search

59 Registration preferences

60 Frequency of search

61 Preferred networks

62 Add network to list

63 Show list of networks

64 Find new network

65 Show last call

66 Resettable call timers

67 Set audible call timers

68 Single alert timers

69 Repetitive timer

70 **1 = register write lock!!!

71 Show meter during calls

72 Set meter format

73 Set call cost rates

74 Lifetime meter

81 Find entry by name

82 Find entry by location

83 Show services

84 Enter my phone number

85 Show my phone number

86 Add entry

87 Check phone capacity

88 Check SIM capacity

89 Prevent access

90 Edit name (my phone number)

91 Edit number (my phone number)

92 MENU – Call related features

93 MENU – Phone setup

94 MENU – Network selection

95 MENU – Call meters

99 Periodic search

100 Continuous search

101 Slow search

102 Medium search

103 Fast search

104 MENU – Phonebook

105 MENU – Phonebook

106 MENU – Messages

107 MENU – Messages

108 Copy SIM memory

110 Edit number (direct dial key)

111 Edit name (direct dial key)

112 Direct dial key

113 MENU – Eng Field Options

126 erase all numbers (last 10)

ATTENTION: These are but a few of the possible commands. There are 1000

possibilities! Please attempt to find more. And if you do, Email

me to keep this list as accurate as possible.

I know that an add-on setup menu exists. This is used when the phone is

connected to a hands-free car kit.

The HF-setup menu should contain 5 choices: turn off radio/aut. HF answer/aut.

HF/security timer/external alert.

If you have an HF kit, please help me to complete the list (I suspect the menus

to have the numbers from 75 to 80).

Again all correspondence about this entire GSM section should be addressed to

jckrarup@post1.com. He’s the GSM guy. I’ve never used a GSM phone. -MikEY

H*A*C*K*I*N*G***T*H*E***F*O*V*C********************************S*E*C*T*I*O*N***6

Note: This is NOT my hack. Thanks to Patrk@delphi.com for this addition.

HACKING THE FOVC

Problem: When listening to something interesting (a conversation),

just when that sexy sounding horny broad begins to give her

phone number to some lucky guy, HANDOFF!!! then static… DAMN!

Trick: Hack the FOVC.

a quick definition: FOVC = FOward Voice Channel

FOCC = FOward Control Channel

REVC = REverse Voice Channel

RECC = REverse Control Channel

As the phone travels through cells, the FOVC is where the tower tells

the phone to adjust power levels for the current cell or to change to

a new channel for use in the new cell. This info can be hacked apart.

So. When you’ve found a good conversation, don’t be lazy! Enter 40#!

This makes the phone listen for commands on the voice channel

(embedded in the audio portion- you can hear it as a “bump” sound). It

will just sit there and the display will read ’40’ , but the

conversation will still be audible. Now when the phone receives a

FOVC command (a 40 bit sequence) data will flow across the display, in

hex format, and stop. Listen to the phone, if the conversation is

still there, then the command was only to adjust power levels. If the

conversation is gone, then its a handoff. If you only got a power

adjustment command just press # or clr, which ever gets you back to

the ‘ prompt. Enter 40# and keep listening. You can also use the # key

to cancel the 40# command, if you want to change channels or something.

If it was a handoff, its time for some quick math. You have to convert

some of the numbers to binary, and then to decimal. I don’t know how

many characters your phone’s display will show. Mine only shows the

last seven of the ten hex digits. Count left from the end 6 digits.

Write down that digit and the next two on a piece of paper, i.e.:

???j16djjj j=junk numbers (hex numbers range from 0-9,a-f)

/ \

these are lost due to scrolling

write down 16d then convert it to a binary string:

1 = 0001

6 = 0110

d = 1101 (d=13)

now you have a binary string like this: 000101101101

throw away the first 2 bits and get: 0101101101

convert this to decimal and get: 365

365 is the new channel the conversation has moved to! Enter 110365#

and voila! You too, can hear the horny babe’s phone number!

Don’t forget to enter 40# again, as the call may be moving quickly

through cells ( small cells or freeway driving ) or the call can get

bounced around by the tower for cell traffic purposes.

Here’s one more example of the hex>binary>decimal conversion.

???j5aejjj

5 = 0101

a = 1010

e = 1110

full string = 010110101110

truncate 2 msb = 0110101110

convert to decimal = 430

R*E*A*D*I*N*G***T*H*E***S*I*D**********************************S*E*C*T*I*O*N***7

READING THE SID by Doctor Who (drwho@l0pht.com)

The SID (System IDentification) of a control channel can be determined using

the test mode of the Motorola cellular phone. This document assumes the

reader understands cellular technology in general, and how to access

Motorola’s test mode in specific.

Tune the phone to the desired control channel with 11xxxx# where xxxx is the

channel number. Hit 39# to receive one control channel word. One should

appear in less than two seconds, filling up all ten digits on the display with

hexadecimal digits. Do this repeatedly until one is found with the correct

pattern. Digit places start at the left hand side and go to the right.

The first digit should be C,D,E, or F. This letter can be used to determine

the DCC/SAT of the cell. A “C” is SAT 0, D is 1, E is 2, and F is 3. Ignore

digits 8,9, and 10. They are parity bytes. Digit 7 should be “6” or “E”,

though I have never found it to be other than “E”. The hexadecimal value of

represented by digits 2 through 5 is then divided by two, and then 1 added if

the carrier as an “A” side, “non-wireline” carrier. The result is the system

ID.

for example:

E00388EA08

E means this cell has an SAT/DCC of 3. The A08 is ignored. The E to the left

of it is proper and normal, so this is the right kind of message. Ignore the

8 in position 6, that is just to the left E. 0038 in hexadecimal translates

((3*16=48)+8) to 56. 56/2=28. Looking up System ID 28 on my chart indicates

Nynex in Boston. This is correct.

Please be aware that the two SID charts I have seen around the net are very

outdated. I have a more recent version on paper which I may eventually type

in, when I have the time and energy.

The methods used above are only a very crude way to do what could be done much

more efficiently by computer. I am sure that programs will be written to do

exactly this, but I am holding off until I have thoroughly hacked the meaning

of all these types of message before writing such a program. I am also

contemplating the design of a cable to replace the handset, running from the

25 pin connector on the side of my bag phone to a computer.

———=?> Doctor Who <?=——–

P*H*O*N*E***P*I*N*-*O*U*T*S************************************S*E*C*T*I*O*N***8

Before going into the cable specs, here are the pin-outs to all phones as of

now (in the US). A very special thanks go to Motorola for faxing me the new

Ultra Classic II pin-outs!

——————————————————————————–

15 pin cable pinouts

PIN DESIGNATION/FUNCTION

1 Battery A+, red wire

2 Transmit Audio / ON-OFF Function, a shared line between Audio (AC) and

ground. This line will toggle the ON/OFF status of the telephone.

3 Ground (A+ return), black wire

4 Ignition Sense Lead, green with a black tracer

5 Receiver Audio (RX High), to handset connector pin 8

6 Regulated +9.5 volts, to handset connector pin 2

7 T-Data, one of the 3-wire bus lines, to handset connector pin 3

8 C-Data, one of the 3-wire bus lines, to handset connector pin 4

9 Digital Hands-Free Microphone / Manual Test. When the pin is grounded,

which can be done by shorting the two connectors of the Hands-Free

microphone, the unit is enabled to work in TEST MODE.

10 R-Data, one of the 3-wire bus lines, to handset connector pin 5

11 Handset Logic Ground, to handset connector pin 1

12 Speaker High \

| -> Only on SKN4279A and SKN4277A

13 Speaker Low /

14 Handset Audio Ground, to handset connector pin 6

15 Auxiliary Alert, yellow lead with a black tracer, used to blow the horn

or flash the headlights. Provides a ground for the relay; maximum

current is 1/2 amp. It is *N O T* recommended that this circuit be

used to drive the horn or headlights directly.

——————————————————————————–

25 pin cable pinouts (series 2 and 3 transceivers)

PIN DESIGNATION/FUNCTION

1 Transmit Audio/ON – OFF Function

2 Mobile/Transportable Select Line

3 Ground (A + return), one of 2 black wires. Both are required for proper

operation

4 Battery A +, one of 2 red wires. Both are required for proper operation.

5 Ignition Sense Lead, green with red tracer

6 Receiver audio to handset (RX High), pin 8 on the handset connector

7 Ground

8 Regulated +9.5 volts to handset, pin 2 on handset connector

9 Ground

10 Auxiliary Alert, yellow with black tracer, used to blow the horn or

flash the headlights. Provides a ground function. NOTE: 1/2 amps

maximum current. The recommended method is to drive a relay

(e.g. MOT 59K813674). Ignition Sense, pin 5, must be low for this

function to work.

11 T-Data, one of the 3-wire bus lines, to pin 3 of the handset connector

12 C-Data, one of the 3-wire bus lines, to pin 4 of the handset connector

13 Ground

14 Transmit Audio Shield

15 Transmit Audio

16 Battery A+, one of two red wires. Both are required for proper operation

17 Ground, one of two black wires. Both are required for proper operation

18 R-Data, one of the 3-wire bus lines, to pin 5 of the handset connector

19 Receiver audio to external speaker

20 Ground for receiver audio (shield) to external speaker

21 Manual test line. When connected to ground, puts phone in test mode

22 Ground

23 Handset logic ground, to handset connector pin 1

24 Handset audio ground, to handset connector pin 6

25 Accessory ground, to external speaker

——————————————————————————–

OEM 32 pin cable pinouts 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

+———————————————-+

Note: Looking into connector C |* * * * * * * * * * * * * * * *|

on the transceiver with the D |* * * * * * * * * * * * * * * *|

antenna port down. +———————————————-+

Pin# Designation/Function Row C Pin# Designation/Function Row D

1 Battery A+ 1 Not Used

2 Ignition Sense 2 Antenna Drive (for power antenna)

3 Status Display Control 3 Not Used

4 Not Used 4 Auxiliary Alert, used to blow the

horn or flash the headlights

through a relay

5 Ground (A+ Return) 5 Not Used

6 GM Proprietary Serial Data Bus 6 GM proprietary serial bus

7 Audio Ground, from GM Audio bus to 7 Audio Ground (not connected)

telephone

8 Low level audio, from telephone to GM 8 Low Level Audio (not connected)

Audio bus

9 Not used 9 Manual Test Line; when grounded

this line enables TEST MODE

10 Not used 10 RX High

11 Mobile / Transportable select line 11 Ground (TX Shield)

12 Handset Logic Ground 12 Regulated +9.5 volts

13 T-Data, one of the 3-wire bus lines 13 C-Data, one of the 3-wire bus lines

14 R-Data, one of the 3-wire bus lines 14 Audio Ground

15 TX High / ON-OFF 15 Ground (Rx Shield)

16 VSP Microphone High 16 VSP Microphone Ground

——————————————————————————–

Pinouts for the Motorola 8000 brick phone – “N” series

numbering starts on top left 1 2 3 * 4 5 6

7 8 9 * 10 11 12

PIN SIGNAL

* GROUND

1 logic ground

2 not used

3 audio in to phone

4 audio out (and on/off toggle)

5 4.75 Bias

6 Manual test line

7 Ground for audio signals (common)

8 TRU data line

9 not used

10 CMP data line

11 RTN data line

12 ignition sense

——————————————————————————–

CVC BLOCK

[ 1] [ 2] [ 3] [ 4] [ 5] [ 6]

[ 7] [ 8] [ 9] [10] [11] [12]

1 VSP Enable 7 GROUND

2 SPKR Enable 8 S TRU

3 TX HI on/off 9 AUX Alert

4 RX HI 10 S CMP

5 RX HI OPT 11 S RTN

6 MAN TEST 12 IGN

——————————————————————————–

Flip Fones and all fones using the dpc/pt flip cable

J3 Pin Function

1 2 3 4 5 6 7 8 + G – 1 Logic Ground

| | | | | | | | | | | 2 Ext. 7.5V

3 TRU

4 CMP

(looking at back of phone with battery removed) 5 RTN

6 Audio Ground

7 RX Audio OUT (spkr)

8 TX Audio IN (mic)

——————————————————————————–

New External Connector for the Ultra Classic II CVC Pinblocks

\

\

\

\

[] [] \ Pin Designation/Function

\ \

+————————-+ 1 Regulated 8 volts

| 12 10 8 6 4 2 | 3 ext. switched A+ enable

| – – – – – – | 5 ext. spkr/mic enable

| O | 7 TX hi – on/off

| – – – – – – | 9 T Data

\ | 11 9 7 5 3 1 | 11 R Data

+————————-+

| 2 Audio Ground

PHONE / 4 manual test

6 ignition / charger B+

8 RX hi

10 C Data

12 logic ground

C*A*B*L*E***S*P*E*C*S******************************************S*E*C*T*I*O*N***9

OK OK OK. Here are the cable specs. They are 100% correct. Of course I

wouldn’t know because these are for information purposes only. I have been

told however by VERY reliable sources that they are guaranteed, 100%, GRADE-A,

correct. If they don’t work for you, you did something wrong.

——————————————————————————–

Cable Instructions for the bag phones (thanks Jakey)

phone (female 25 pin) computer (male 25 pin) (parallel port)

18 ———————– 1

21 ———————– 2

1 ———————— 4 Below are 10K ohm resistors

12 ———————– 12 —-/\/\/—-.

11 ———————– 13 —-/\/\/—-+

4,5,8 ————————————-‘

2,3,17,20—————– 18 — Ground/black wire (-12 Volts)

16 —————————— Positive/yellow wire (+12 volts)

By the way, Jakey told me to remind you that the handset can NOT be plugged in

while this cable is hooked up.

——————————————————————————–

Motorola Cellphone cable construction for flips

————————————-

DB25 FLIP Battery Eliminator cable

—- —- attachment pins up:

1(——–)4

——–=

2(–|<—-)Jump this line to the Center 1 =

Pin on the back of phone. ——–=

=

4(–|<—-)1 “|<” is the IN4001 diode. ——–=

=

12(——–)5 ——–=

4 = –>To phone

13(——–)6 ——–=

5 =

18-25(-+——)8 ——–=

| 6 =

| +-)7 ——–=

| | 7* =

| | ——–=

| | 8* =

NeG PoS —Cig adapter ——–=

DB25 Male Phone Power Connector

(see Note 1)

1-To phone pin 4 1-DB25 pin 4(see note 2) Gnd-To Db25 Pins 18-25 and

2-To Phone test lead 2-NC Phone pin 8

(see note 2)

3-NC 3-NC Tip-To phone pin 7

4-To phone pin 1 4-To DB25 pin 1

(see note 2)

5-NC 5-To DB25 pin 12

6-NC 6-To DB25 pin 13

7-NC 7-To tip on power connector

8-NC 8-GND

9-NC Test Lead-To DB25 pin 2 (See note 2)

10-NC

11-NC

12-To Phone pin 5

13-To Phone pin 6

14-NC

15-NC

16-NC

17-NC

18-GND \

19-GND |

20-GND |

21-GND |–Conn together to GND on 12v conn

22-GND | And pin 8 on phone plug

23-GND |

24-GND |

25-GND /

NOTE 1:

The power adapter on the cable is 12 volt input but is a regulated

7.95 volts out. DO NOT connect 12 volts between pins 7 and 8 on the

phone connector.

NOTE 2:

| /|

DB25 Pin 4—–| < |——Phone pin 1

| \|

| /|

DB25 Pin 2—–| < |——Phone test lead

| \|

——————————————————————————–

Motorola Transceivers

_____________________

4500x,4800x,6800x,Etc.

______________________

Female 25 Pin Male 25 Pin

D-Connector D-connector

To transceiver To P.C.Parallel Port

Pin Pin

1._____________________________________ 4.

2._____________________________________ 18.

___10k______ 13.

/

______4+5._______________________/____10K______ 12.

| 12.____________________________________/

| 11._____________________________________ 13.

| 18._____________________________________ 1.

| 21._____________________________________ 2.

| ___14+17+20+23.____________________________ 18.

| |

| |___ -ve

|

|________ +ve 9 Volt

——————————————————————————–

Motorola 8500x 8800x(early type)

________________________________

25 Pin D-plug(P.C.lpt1) Phone Back(battery removed)

Pin Diodes [] [] [] [] [] []

3.–orange-|<1n4001———————/ / /

4.–blue—|<1n4001—————————-/ /

2.–red—-|<1n4001—————————————/

19.————-\

20.———–\ | [] [] [] [] [] []

18.–black—-+-+————/ / / /

13.–yellow———————–/ / /

12.–brown————————————/ /

1.–gray——————————————-/

[] []

-8 to -12V. +8 to =12V.

NOTE Diode protocol: Cathode—|<diode—Anode

C*H*A*N*N*E*L***N*U*M*B**E*R***V*S*.***F*R*E*Q*U*E*N*C*Y*****S*E*C*T*I*O*N***1*0

Frequency Range for 666 Channels: Reverse (Mobile TX) 825.020 – 844.990 MHz

Forward (Mobile RX) 870.020 – 889.990 MHz

Frequency Range for 832 and 2412 Channels:

Reverse (Mobile TX) 824.030 – 848.980 MHz

Forward (Mobile RX) 869.030 – 893.980 MHz

Frequency Calculation for Channels 1-799:

Reverse (Mobile TX) Frequency = 825.00 MHz + (Ch.# X .030 MHz)

Forward (Mobile RX) Frequency = 870.00 MHz + (Ch.# X .030 MHz)

Frequency Calculation for Channels 991-1023:

Reverse (Mobile TX) Frequency = 825.00 MHz – [.030 MHz X (1023 – Ch.#)]

Forward (Mobile RX) Frequency = 870.00 MHz – [.030 MHz X (1023 – Ch.#)]

To determine the center frequency of an associated NAMPS sub-channel in these

formulas, subtract 10 kHz from the result for the low sub-channel, leave the

result as is for the center sub-channel, and add 10 kHz to the result for the

high sub-channel.

——————————————————————————–

The following text I took from the Poisoned Pen BBS (Hi guys). Thanks Jakey

for taking the time to decipher all of this shit. As far as I know, with

the exception of a post on #cellular and the upload to Poisoned Pen, there is

nothing in print with this compilation. Again, special thanks go to Jakey

(jbs@mcs.net) for the long, seemingly endless work.

CELLULAR PHONE FREQUENCIES AND MOTOROLA

TEST MODE NUMERIC CODES.

( Motorola test mode channel numbers )

( are for use in Motorola test mode )

( with function 11xxxx# )

( All frequencies in Megahertz FM )

Lower Set (1-666)

Tower Freq. Mobile Freq. 11xxxx# Channel

Tx 870.03 Rx 825.03 Chan 0001 #1

Tx 870.06 Rx 825.06 Chan 0002 #2

Tx 870.09 Rx 825.09 Chan 0003 #3

Tx 870.12 Rx 825.12 Chan 0004 #4

Tx 870.15 Rx 825.15 Chan 0005 #5

Tx 870.18 Rx 825.18 Chan 0006 #6

Tx 870.21 Rx 825.21 Chan 0007 #7

Tx 870.24 Rx 825.24 Chan 0008 #8

Tx 870.27 Rx 825.27 Chan 0009 #9

Tx 870.30 Rx 825.30 Chan 0010 #10

Tx 870.33 Rx 825.33 Chan 0011 #11

Tx 870.36 Rx 825.36 Chan 0012 #12

Tx 870.39 Rx 825.39 Chan 0013 #13

Tx 870.42 Rx 825.42 Chan 0014 #14

Tx 870.45 Rx 825.45 Chan 0015 #15

Tx 870.48 Rx 825.48 Chan 0016 #16

Tx 870.51 Rx 825.51 Chan 0017 #17

Tx 870.54 Rx 825.54 Chan 0018 #18

Tx 870.57 Rx 825.57 Chan 0019 #19

Tx 870.60 Rx 825.60 Chan 0020 #20

Tx 870.63 Rx 825.63 Chan 0021 #21

Tx 870.66 Rx 825.66 Chan 0022 #22

Tx 870.69 Rx 825.69 Chan 0023 #23

Tx 870.72 Rx 825.72 Chan 0024 #24

Tx 870.75 Rx 825.75 Chan 0025 #25

Tx 870.78 Rx 825.78 Chan 0026 #26

Tx 870.81 Rx 825.81 Chan 0027 #27

Tx 870.84 Rx 825.84 Chan 0028 #28

Tx 870.87 Rx 825.87 Chan 0029 #29

Tx 870.90 Rx 825.90 Chan 0030 #30

Tx 870.93 Rx 825.93 Chan 0031 #31

Tx 870.96 Rx 825.96 Chan 0032 #32

Tx 870.99 Rx 825.99 Chan 0033 #33

Tx 871.02 Rx 826.02 Chan 0034 #34

Tx 871.05 Rx 826.05 Chan 0035 #35

Tx 871.08 Rx 826.08 Chan 0036 #36

Tx 871.11 Rx 826.11 Chan 0037 #37

Tx 871.14 Rx 826.14 Chan 0038 #38

Tx 871.17 Rx 826.17 Chan 0039 #39

Tx 871.20 Rx 826.20 Chan 0040 #40

Tx 871.23 Rx 826.23 Chan 0041 #41

Tx 871.26 Rx 826.26 Chan 0042 #42

Tx 871.29 Rx 826.29 Chan 0043 #43

Tx 871.32 Rx 826.32 Chan 0044 #44

Tx 871.35 Rx 826.35 Chan 0045 #45

Tx 871.38 Rx 826.38 Chan 0046 #46

Tx 871.41 Rx 826.41 Chan 0047 #47

Tx 871.44 Rx 826.44 Chan 0048 #48

Tx 871.47 Rx 826.47 Chan 0049 #49

Tx 871.50 Rx 826.50 Chan 0050 #50

Tx 871.53 Rx 826.53 Chan 0051 #51

Tx 871.56 Rx 826.56 Chan 0052 #52

Tx 871.59 Rx 826.59 Chan 0053 #53

Tx 871.62 Rx 826.62 Chan 0054 #54

Tx 871.65 Rx 826.65 Chan 0055 #55

Tx 871.68 Rx 826.68 Chan 0056 #56

Tx 871.71 Rx 826.71 Chan 0057 #57

Tx 871.74 Rx 826.74 Chan 0058 #58

Tx 871.77 Rx 826.77 Chan 0059 #59

Tx 871.80 Rx 826.80 Chan 0060 #60

Tx 871.83 Rx 826.83 Chan 0061 #61

Tx 871.86 Rx 826.86 Chan 0062 #62

Tx 871.89 Rx 826.89 Chan 0063 #63

Tx 871.92 Rx 826.92 Chan 0064 #64

Tx 871.95 Rx 826.95 Chan 0065 #65

Tx 871.98 Rx 826.98 Chan 0066 #66

Tx 872.01 Rx 827.01 Chan 0067 #67

Tx 872.04 Rx 827.04 Chan 0068 #68

Tx 872.07 Rx 827.07 Chan 0069 #69

Tx 872.10 Rx 827.10 Chan 0070 #70

Tx 872.13 Rx 827.13 Chan 0071 #71

Tx 872.16 Rx 827.16 Chan 0072 #72

Tx 872.19 Rx 827.19 Chan 0073 #73

Tx 872.22 Rx 827.22 Chan 0074 #74

Tx 872.25 Rx 827.25 Chan 0075 #75

Tx 872.28 Rx 827.28 Chan 0076 #76

Tx 872.31 Rx 827.31 Chan 0077 #77

Tx 872.34 Rx 827.34 Chan 0078 #78

Tx 872.37 Rx 827.37 Chan 0079 #79

Tx 872.40 Rx 827.40 Chan 0080 #80

Tx 872.43 Rx 827.43 Chan 0081 #81

Tx 872.46 Rx 827.46 Chan 0082 #82

Tx 872.49 Rx 827.49 Chan 0083 #83

Tx 872.52 Rx 827.52 Chan 0084 #84

Tx 872.55 Rx 827.55 Chan 0085 #85

Tx 872.58 Rx 827.58 Chan 0086 #86

Tx 872.61 Rx 827.61 Chan 0087 #87

Tx 872.64 Rx 827.64 Chan 0088 #88

Tx 872.67 Rx 827.67 Chan 0089 #89

Tx 872.70 Rx 827.70 Chan 0090 #90

Tx 872.73 Rx 827.73 Chan 0091 #91

Tx 872.76 Rx 827.76 Chan 0092 #92

Tx 872.79 Rx 827.79 Chan 0093 #93

Tx 872.82 Rx 827.82 Chan 0094 #94

Tx 872.85 Rx 827.85 Chan 0095 #95

Tx 872.88 Rx 827.88 Chan 0096 #96

Tx 872.91 Rx 827.91 Chan 0097 #97

Tx 872.94 Rx 827.94 Chan 0098 #98

Tx 872.97 Rx 827.97 Chan 0099 #99

Tx 873.00 Rx 828.00 Chan 0100 #100

Tx 873.03 Rx 828.03 Chan 0101 #101

Tx 873.06 Rx 828.06 Chan 0102 #102

Tx 873.09 Rx 828.09 Chan 0103 #103

Tx 873.12 Rx 828.12 Chan 0104 #104

Tx 873.15 Rx 828.15 Chan 0105 #105

Tx 873.18 Rx 828.18 Chan 0106 #106

Tx 873.21 Rx 828.21 Chan 0107 #107

Tx 873.24 Rx 828.24 Chan 0108 #108

Tx 873.27 Rx 828.27 Chan 0109 #109

Tx 873.30 Rx 828.30 Chan 0110 #110

Tx 873.33 Rx 828.33 Chan 0111 #111

Tx 873.36 Rx 828.36 Chan 0112 #112

Tx 873.39 Rx 828.39 Chan 0113 #113

Tx 873.42 Rx 828.42 Chan 0114 #114

Tx 873.45 Rx 828.45 Chan 0115 #115

Tx 873.48 Rx 828.48 Chan 0116 #116

Tx 873.51 Rx 828.51 Chan 0117 #117

Tx 873.54 Rx 828.54 Chan 0118 #118

Tx 873.57 Rx 828.57 Chan 0119 #119

Tx 873.60 Rx 828.60 Chan 0120 #120

Tx 873.63 Rx 828.63 Chan 0121 #121

Tx 873.66 Rx 828.66 Chan 0122 #122

Tx 873.69 Rx 828.69 Chan 0123 #123

Tx 873.72 Rx 828.72 Chan 0124 #124

Tx 873.75 Rx 828.75 Chan 0125 #125

Tx 873.78 Rx 828.78 Chan 0126 #126

Tx 873.81 Rx 828.81 Chan 0127 #127

Tx 873.84 Rx 828.84 Chan 0128 #128

Tx 873.87 Rx 828.87 Chan 0129 #129

Tx 873.90 Rx 828.90 Chan 0130 #130

Tx 873.93 Rx 828.93 Chan 0131 #131

Tx 873.96 Rx 828.96 Chan 0132 #132

Tx 873.99 Rx 828.99 Chan 0133 #133

Tx 874.02 Rx 829.02 Chan 0134 #134

Tx 874.05 Rx 829.05 Chan 0135 #135

Tx 874.08 Rx 829.08 Chan 0136 #136

Tx 874.11 Rx 829.11 Chan 0137 #137

Tx 874.14 Rx 829.14 Chan 0138 #138

Tx 874.17 Rx 829.17 Chan 0139 #139

Tx 874.20 Rx 829.20 Chan 0140 #140

Tx 874.23 Rx 829.23 Chan 0141 #141

Tx 874.26 Rx 829.26 Chan 0142 #142

Tx 874.29 Rx 829.29 Chan 0143 #143

Tx 874.32 Rx 829.32 Chan 0144 #144

Tx 874.35 Rx 829.35 Chan 0145 #145

Tx 874.38 Rx 829.38 Chan 0146 #146

Tx 874.41 Rx 829.41 Chan 0147 #147

Tx 874.44 Rx 829.44 Chan 0148 #148

Tx 874.47 Rx 829.47 Chan 0149 #149

Tx 874.50 Rx 829.50 Chan 0150 #150

Tx 874.53 Rx 829.53 Chan 0151 #151

Tx 874.56 Rx 829.56 Chan 0152 #152

Tx 874.59 Rx 829.59 Chan 0153 #153

Tx 874.62 Rx 829.62 Chan 0154 #154

Tx 874.65 Rx 829.65 Chan 0155 #155

Tx 874.68 Rx 829.68 Chan 0156 #156

Tx 874.71 Rx 829.71 Chan 0157 #157

Tx 874.74 Rx 829.74 Chan 0158 #158

Tx 874.77 Rx 829.77 Chan 0159 #159

Tx 874.80 Rx 829.80 Chan 0160 #160

Tx 874.83 Rx 829.83 Chan 0161 #161

Tx 874.86 Rx 829.86 Chan 0162 #162

Tx 874.89 Rx 829.89 Chan 0163 #163

Tx 874.92 Rx 829.92 Chan 0164 #164

Tx 874.95 Rx 829.95 Chan 0165 #165

Tx 874.98 Rx 829.98 Chan 0166 #166

Tx 875.01 Rx 830.01 Chan 0167 #167

Tx 875.04 Rx 830.04 Chan 0168 #168

Tx 875.07 Rx 830.07 Chan 0169 #169

Tx 875.10 Rx 830.10 Chan 0170 #170

Tx 875.13 Rx 830.13 Chan 0171 #171

Tx 875.16 Rx 830.16 Chan 0172 #172

Tx 875.19 Rx 830.19 Chan 0173 #173

Tx 875.22 Rx 830.22 Chan 0174 #174

Tx 875.25 Rx 830.25 Chan 0175 #175

Tx 875.28 Rx 830.28 Chan 0176 #176

Tx 875.31 Rx 830.31 Chan 0177 #177

Tx 875.34 Rx 830.34 Chan 0178 #178

Tx 875.37 Rx 830.37 Chan 0179 #179

Tx 875.40 Rx 830.40 Chan 0180 #180

Tx 875.43 Rx 830.43 Chan 0181 #181

Tx 875.46 Rx 830.46 Chan 0182 #182

Tx 875.49 Rx 830.49 Chan 0183 #183

Tx 875.52 Rx 830.52 Chan 0184 #184

Tx 875.55 Rx 830.55 Chan 0185 #185

Tx 875.58 Rx 830.58 Chan 0186 #186

Tx 875.61 Rx 830.61 Chan 0187 #187

Tx 875.64 Rx 830.64 Chan 0188 #188

Tx 875.67 Rx 830.67 Chan 0189 #189

Tx 875.70 Rx 830.70 Chan 0190 #190

Tx 875.73 Rx 830.73 Chan 0191 #191

Tx 875.76 Rx 830.76 Chan 0192 #192

Tx 875.79 Rx 830.79 Chan 0193 #193

Tx 875.82 Rx 830.82 Chan 0194 #194

Tx 875.85 Rx 830.85 Chan 0195 #195

Tx 875.88 Rx 830.88 Chan 0196 #196

Tx 875.91 Rx 830.91 Chan 0197 #197

Tx 875.94 Rx 830.94 Chan 0198 #198

Tx 875.97 Rx 830.97 Chan 0199 #199

Tx 876.00 Rx 831.00 Chan 0200 #200

Tx 876.03 Rx 831.03 Chan 0201 #201

Tx 876.06 Rx 831.06 Chan 0202 #202

Tx 876.09 Rx 831.09 Chan 0203 #203

Tx 876.12 Rx 831.12 Chan 0204 #204

Tx 876.15 Rx 831.15 Chan 0205 #205

Tx 876.18 Rx 831.18 Chan 0206 #206

Tx 876.21 Rx 831.21 Chan 0207 #207

Tx 876.24 Rx 831.24 Chan 0208 #208

Tx 876.27 Rx 831.27 Chan 0209 #209

Tx 876.30 Rx 831.30 Chan 0210 #210

Tx 876.33 Rx 831.33 Chan 0211 #211

Tx 876.36 Rx 831.36 Chan 0212 #212

Tx 876.39 Rx 831.39 Chan 0213 #213

Tx 876.42 Rx 831.42 Chan 0214 #214

Tx 876.45 Rx 831.45 Chan 0215 #215

Tx 876.48 Rx 831.48 Chan 0216 #216

Tx 876.51 Rx 831.51 Chan 0217 #217

Tx 876.54 Rx 831.54 Chan 0218 #218

Tx 876.57 Rx 831.57 Chan 0219 #219

Tx 876.60 Rx 831.60 Chan 0220 #220

Tx 876.63 Rx 831.63 Chan 0221 #221

Tx 876.66 Rx 831.66 Chan 0222 #222

Tx 876.69 Rx 831.69 Chan 0223 #223

Tx 876.72 Rx 831.72 Chan 0224 #224

Tx 876.75 Rx 831.75 Chan 0225 #225

Tx 876.78 Rx 831.78 Chan 0226 #226

Tx 876.81 Rx 831.81 Chan 0227 #227

Tx 876.84 Rx 831.84 Chan 0228 #228

Tx 876.87 Rx 831.87 Chan 0229 #229

Tx 876.90 Rx 831.90 Chan 0230 #230

Tx 876.93 Rx 831.93 Chan 0231 #231

Tx 876.96 Rx 831.96 Chan 0232 #232

Tx 876.99 Rx 831.99 Chan 0233 #233

Tx 877.02 Rx 832.02 Chan 0234 #234

Tx 877.05 Rx 832.05 Chan 0235 #235

Tx 877.08 Rx 832.08 Chan 0236 #236

Tx 877.11 Rx 832.11 Chan 0237 #237

Tx 877.14 Rx 832.14 Chan 0238 #238

Tx 877.17 Rx 832.17 Chan 0239 #239

Tx 877.20 Rx 832.20 Chan 0240 #240

Tx 877.23 Rx 832.23 Chan 0241 #241

Tx 877.26 Rx 832.26 Chan 0242 #242

Tx 877.29 Rx 832.29 Chan 0243 #243

Tx 877.32 Rx 832.32 Chan 0244 #244

Tx 877.35 Rx 832.35 Chan 0245 #245

Tx 877.38 Rx 832.38 Chan 0246 #246

Tx 877.41 Rx 832.41 Chan 0247 #247

Tx 877.44 Rx 832.44 Chan 0248 #248

Tx 877.47 Rx 832.47 Chan 0249 #249

Tx 877.50 Rx 832.50 Chan 0250 #250

Tx 877.53 Rx 832.53 Chan 0251 #251

Tx 877.56 Rx 832.56 Chan 0252 #252

Tx 877.59 Rx 832.59 Chan 0253 #253

Tx 877.62 Rx 832.62 Chan 0254 #254

Tx 877.65 Rx 832.65 Chan 0255 #255

Tx 877.68 Rx 832.68 Chan 0256 #256

Tx 877.71 Rx 832.71 Chan 0257 #257

Tx 877.74 Rx 832.74 Chan 0258 #258

Tx 877.77 Rx 832.77 Chan 0259 #259

Tx 877.80 Rx 832.80 Chan 0260 #260

Tx 877.83 Rx 832.83 Chan 0261 #261

Tx 877.86 Rx 832.86 Chan 0262 #262

Tx 877.89 Rx 832.89 Chan 0263 #263

Tx 877.92 Rx 832.92 Chan 0264 #264

Tx 877.95 Rx 832.95 Chan 0265 #265

Tx 877.98 Rx 832.98 Chan 0266 #266

Tx 878.01 Rx 833.01 Chan 0267 #267

Tx 878.04 Rx 833.04 Chan 0268 #268

Tx 878.07 Rx 833.07 Chan 0269 #269

Tx 878.10 Rx 833.10 Chan 0270 #270

Tx 878.13 Rx 833.13 Chan 0271 #271

Tx 878.16 Rx 833.16 Chan 0272 #272

Tx 878.19 Rx 833.19 Chan 0273 #273

Tx 878.22 Rx 833.22 Chan 0274 #274

Tx 878.25 Rx 833.25 Chan 0275 #275

Tx 878.28 Rx 833.28 Chan 0276 #276

Tx 878.31 Rx 833.31 Chan 0277 #277

Tx 878.34 Rx 833.34 Chan 0278 #278

Tx 878.37 Rx 833.37 Chan 0279 #279

Tx 878.40 Rx 833.40 Chan 0280 #280

Tx 878.43 Rx 833.43 Chan 0281 #281

Tx 878.46 Rx 833.46 Chan 0282 #282

Tx 878.49 Rx 833.49 Chan 0283 #283

Tx 878.52 Rx 833.52 Chan 0284 #284

Tx 878.55 Rx 833.55 Chan 0285 #285

Tx 878.58 Rx 833.58 Chan 0286 #286

Tx 878.61 Rx 833.61 Chan 0287 #287

Tx 878.64 Rx 833.64 Chan 0288 #288

Tx 878.67 Rx 833.67 Chan 0289 #289

Tx 878.70 Rx 833.70 Chan 0290 #290

Tx 878.73 Rx 833.73 Chan 0291 #291

Tx 878.76 Rx 833.76 Chan 0292 #292

Tx 878.79 Rx 833.79 Chan 0293 #293

Tx 878.82 Rx 833.82 Chan 0294 #294

Tx 878.85 Rx 833.85 Chan 0295 #295

Tx 878.88 Rx 833.88 Chan 0296 #296

Tx 878.91 Rx 833.91 Chan 0297 #297

Tx 878.94 Rx 833.94 Chan 0298 #298

Tx 878.97 Rx 833.97 Chan 0299 #299

Tx 879.00 Rx 834.00 Chan 0300 #300

Tx 879.03 Rx 834.03 Chan 0301 #301

Tx 879.06 Rx 834.06 Chan 0302 #302

Tx 879.09 Rx 834.09 Chan 0303 #303

Tx 879.12 Rx 834.12 Chan 0304 #304

Tx 879.15 Rx 834.15 Chan 0305 #305

Tx 879.18 Rx 834.18 Chan 0306 #306

Tx 879.21 Rx 834.21 Chan 0307 #307

Tx 879.24 Rx 834.24 Chan 0308 #308

Tx 879.27 Rx 834.27 Chan 0309 #309

Tx 879.30 Rx 834.30 Chan 0310 #310

Tx 879.33 Rx 834.33 Chan 0311 #311

Tx 879.36 Rx 834.36 Chan 0312 #312

Tx 879.39 Rx 834.39 Chan 0313 #313

Tx 879.42 Rx 834.42 Chan 0314 #314

Tx 879.45 Rx 834.45 Chan 0315 #315

Tx 879.48 Rx 834.48 Chan 0316 #316

Tx 879.51 Rx 834.51 Chan 0317 #317

Tx 879.54 Rx 834.54 Chan 0318 #318

Tx 879.57 Rx 834.57 Chan 0319 #319

Tx 879.60 Rx 834.60 Chan 0320 #320

Tx 879.63 Rx 834.63 Chan 0321 #321

Tx 879.66 Rx 834.66 Chan 0322 #322

Tx 879.69 Rx 834.69 Chan 0323 #323

Tx 879.72 Rx 834.72 Chan 0324 #324

Tx 879.75 Rx 834.75 Chan 0325 #325

Tx 879.78 Rx 834.78 Chan 0326 #326

Tx 879.81 Rx 834.81 Chan 0327 #327

Tx 879.84 Rx 834.84 Chan 0328 #328

Tx 879.87 Rx 834.87 Chan 0329 #329

Tx 879.90 Rx 834.90 Chan 0330 #330

Tx 879.93 Rx 834.93 Chan 0331 #331

Tx 879.96 Rx 834.96 Chan 0332 #332

Tx 879.99 Rx 834.99 Chan 0333 #333

Tx 880.02 Rx 835.02 Chan 0334 #334

Tx 880.05 Rx 835.05 Chan 0335 #335

Tx 880.08 Rx 835.08 Chan 0336 #336

Tx 880.11 Rx 835.11 Chan 0337 #337

Tx 880.14 Rx 835.14 Chan 0338 #338

Tx 880.17 Rx 835.17 Chan 0339 #339

Tx 880.20 Rx 835.20 Chan 0340 #340

Tx 880.23 Rx 835.23 Chan 0341 #341

Tx 880.26 Rx 835.26 Chan 0342 #342

Tx 880.29 Rx 835.29 Chan 0343 #343

Tx 880.32 Rx 835.32 Chan 0344 #344

Tx 880.35 Rx 835.35 Chan 0345 #345

Tx 880.38 Rx 835.38 Chan 0346 #346

Tx 880.41 Rx 835.41 Chan 0347 #347

Tx 880.44 Rx 835.44 Chan 0348 #348

Tx 880.47 Rx 835.47 Chan 0349 #349

Tx 880.50 Rx 835.50 Chan 0350 #350

Tx 880.53 Rx 835.53 Chan 0351 #351

Tx 880.56 Rx 835.56 Chan 0352 #352

Tx 880.59 Rx 835.59 Chan 0353 #353

Tx 880.62 Rx 835.62 Chan 0354 #354

Tx 880.65 Rx 835.65 Chan 0355 #355

Tx 880.68 Rx 835.68 Chan 0356 #356

Tx 880.71 Rx 835.71 Chan 0357 #357

Tx 880.74 Rx 835.74 Chan 0358 #358

Tx 880.77 Rx 835.77 Chan 0359 #359

Tx 880.80 Rx 835.80 Chan 0360 #360

Tx 880.83 Rx 835.83 Chan 0361 #361

Tx 880.86 Rx 835.86 Chan 0362 #362

Tx 880.89 Rx 835.89 Chan 0363 #363

Tx 880.92 Rx 835.92 Chan 0364 #364

Tx 880.95 Rx 835.95 Chan 0365 #365

Tx 880.98 Rx 835.98 Chan 0366 #366

Tx 881.01 Rx 836.01 Chan 0367 #367

Tx 881.04 Rx 836.04 Chan 0368 #368

Tx 881.07 Rx 836.07 Chan 0369 #369

Tx 881.10 Rx 836.10 Chan 0370 #370

Tx 881.13 Rx 836.13 Chan 0371 #371

Tx 881.16 Rx 836.16 Chan 0372 #372

Tx 881.19 Rx 836.19 Chan 0373 #373

Tx 881.22 Rx 836.22 Chan 0374 #374

Tx 881.25 Rx 836.25 Chan 0375 #375

Tx 881.28 Rx 836.28 Chan 0376 #376

Tx 881.31 Rx 836.31 Chan 0377 #377

Tx 881.34 Rx 836.34 Chan 0378 #378

Tx 881.37 Rx 836.37 Chan 0379 #379

Tx 881.40 Rx 836.40 Chan 0380 #380

Tx 881.43 Rx 836.43 Chan 0381 #381

Tx 881.46 Rx 836.46 Chan 0382 #382

Tx 881.49 Rx 836.49 Chan 0383 #383

Tx 881.52 Rx 836.52 Chan 0384 #384

Tx 881.55 Rx 836.55 Chan 0385 #385

Tx 881.58 Rx 836.58 Chan 0386 #386

Tx 881.61 Rx 836.61 Chan 0387 #387

Tx 881.64 Rx 836.64 Chan 0388 #388

Tx 881.67 Rx 836.67 Chan 0389 #389

Tx 881.70 Rx 836.70 Chan 0390 #390

Tx 881.73 Rx 836.73 Chan 0391 #391

Tx 881.76 Rx 836.76 Chan 0392 #392

Tx 881.79 Rx 836.79 Chan 0393 #393

Tx 881.82 Rx 836.82 Chan 0394 #394

Tx 881.85 Rx 836.85 Chan 0395 #395

Tx 881.88 Rx 836.88 Chan 0396 #396

Tx 881.91 Rx 836.91 Chan 0397 #397

Tx 881.94 Rx 836.94 Chan 0398 #398

Tx 881.97 Rx 836.97 Chan 0399 #399

Tx 882.00 Rx 837.00 Chan 0400 #400

Tx 882.03 Rx 837.03 Chan 0401 #401

Tx 882.06 Rx 837.06 Chan 0402 #402

Tx 882.09 Rx 837.09 Chan 0403 #403

Tx 882.12 Rx 837.12 Chan 0404 #404

Tx 882.15 Rx 837.15 Chan 0405 #405

Tx 882.18 Rx 837.18 Chan 0406 #406

Tx 882.21 Rx 837.21 Chan 0407 #407

Tx 882.24 Rx 837.24 Chan 0408 #408

Tx 882.27 Rx 837.27 Chan 0409 #409

Tx 882.30 Rx 837.30 Chan 0410 #410

Tx 882.33 Rx 837.33 Chan 0411 #411

Tx 882.36 Rx 837.36 Chan 0412 #412

Tx 882.39 Rx 837.39 Chan 0413 #413

Tx 882.42 Rx 837.42 Chan 0414 #414

Tx 882.45 Rx 837.45 Chan 0415 #415

Tx 882.48 Rx 837.48 Chan 0416 #416

Tx 882.51 Rx 837.51 Chan 0417 #417

Tx 882.54 Rx 837.54 Chan 0418 #418

Tx 882.57 Rx 837.57 Chan 0419 #419

Tx 882.60 Rx 837.60 Chan 0420 #420

Tx 882.63 Rx 837.63 Chan 0421 #421

Tx 882.66 Rx 837.66 Chan 0422 #422

Tx 882.69 Rx 837.69 Chan 0423 #423

Tx 882.72 Rx 837.72 Chan 0424 #424

Tx 882.75 Rx 837.75 Chan 0425 #425

Tx 882.78 Rx 837.78 Chan 0426 #426

Tx 882.81 Rx 837.81 Chan 0427 #427

Tx 882.84 Rx 837.84 Chan 0428 #428

Tx 882.87 Rx 837.87 Chan 0429 #429

Tx 882.90 Rx 837.90 Chan 0430 #430

Tx 882.93 Rx 837.93 Chan 0431 #431

Tx 882.96 Rx 837.96 Chan 0432 #432

Tx 882.99 Rx 837.99 Chan 0433 #433

Tx 883.02 Rx 838.02 Chan 0434 #434

Tx 883.05 Rx 838.05 Chan 0435 #435

Tx 883.08 Rx 838.08 Chan 0436 #436

Tx 883.11 Rx 838.11 Chan 0437 #437

Tx 883.14 Rx 838.14 Chan 0438 #438

Tx 883.17 Rx 838.17 Chan 0439 #439

Tx 883.20 Rx 838.20 Chan 0440 #440

Tx 883.23 Rx 838.23 Chan 0441 #441

Tx 883.26 Rx 838.26 Chan 0442 #442

Tx 883.29 Rx 838.29 Chan 0443 #443

Tx 883.32 Rx 838.32 Chan 0444 #444

Tx 883.35 Rx 838.35 Chan 0445 #445

Tx 883.38 Rx 838.38 Chan 0446 #446

Tx 883.41 Rx 838.41 Chan 0447 #447

Tx 883.44 Rx 838.44 Chan 0448 #448

Tx 883.47 Rx 838.47 Chan 0449 #449

Tx 883.50 Rx 838.50 Chan 0450 #450

Tx 883.53 Rx 838.53 Chan 0451 #451

Tx 883.56 Rx 838.56 Chan 0452 #452

Tx 883.59 Rx 838.59 Chan 0453 #453

Tx 883.62 Rx 838.62 Chan 0454 #454

Tx 883.65 Rx 838.65 Chan 0455 #455

Tx 883.68 Rx 838.68 Chan 0456 #456

Tx 883.71 Rx 838.71 Chan 0457 #457

Tx 883.74 Rx 838.74 Chan 0458 #458

Tx 883.77 Rx 838.77 Chan 0459 #459

Tx 883.80 Rx 838.80 Chan 0460 #460

Tx 883.83 Rx 838.83 Chan 0461 #461

Tx 883.86 Rx 838.86 Chan 0462 #462

Tx 883.89 Rx 838.89 Chan 0463 #463

Tx 883.92 Rx 838.92 Chan 0464 #464

Tx 883.95 Rx 838.95 Chan 0465 #465

Tx 883.98 Rx 838.98 Chan 0466 #466

Tx 884.01 Rx 839.01 Chan 0467 #467

Tx 884.04 Rx 839.04 Chan 0468 #468

Tx 884.07 Rx 839.07 Chan 0469 #469

Tx 884.10 Rx 839.10 Chan 0470 #470

Tx 884.13 Rx 839.13 Chan 0471 #471

Tx 884.16 Rx 839.16 Chan 0472 #472

Tx 884.19 Rx 839.19 Chan 0473 #473

Tx 884.22 Rx 839.22 Chan 0474 #474

Tx 884.25 Rx 839.25 Chan 0475 #475

Tx 884.28 Rx 839.28 Chan 0476 #476

Tx 884.31 Rx 839.31 Chan 0477 #477

Tx 884.34 Rx 839.34 Chan 0478 #478

Tx 884.37 Rx 839.37 Chan 0479 #479

Tx 884.40 Rx 839.40 Chan 0480 #480

Tx 884.43 Rx 839.43 Chan 0481 #481

Tx 884.46 Rx 839.46 Chan 0482 #482

Tx 884.49 Rx 839.49 Chan 0483 #483

Tx 884.52 Rx 839.52 Chan 0484 #484

Tx 884.55 Rx 839.55 Chan 0485 #485

Tx 884.58 Rx 839.58 Chan 0486 #486

Tx 884.61 Rx 839.61 Chan 0487 #487

Tx 884.64 Rx 839.64 Chan 0488 #488

Tx 884.67 Rx 839.67 Chan 0489 #489

Tx 884.70 Rx 839.70 Chan 0490 #490

Tx 884.73 Rx 839.73 Chan 0491 #491

Tx 884.76 Rx 839.76 Chan 0492 #492

Tx 884.79 Rx 839.79 Chan 0493 #493

Tx 884.82 Rx 839.82 Chan 0494 #494

Tx 884.85 Rx 839.85 Chan 0495 #495

Tx 884.88 Rx 839.88 Chan 0496 #496

Tx 884.91 Rx 839.91 Chan 0497 #497

Tx 884.94 Rx 839.94 Chan 0498 #498

Tx 884.97 Rx 839.97 Chan 0499 #499

Tx 885.00 Rx 840.00 Chan 0500 #500

Tx 885.03 Rx 840.03 Chan 0501 #501

Tx 885.06 Rx 840.06 Chan 0502 #502

Tx 885.09 Rx 840.09 Chan 0503 #503

Tx 885.12 Rx 840.12 Chan 0504 #504

Tx 885.15 Rx 840.15 Chan 0505 #505

Tx 885.18 Rx 840.18 Chan 0506 #506

Tx 885.21 Rx 840.21 Chan 0507 #507

Tx 885.24 Rx 840.24 Chan 0508 #508

Tx 885.27 Rx 840.27 Chan 0509 #509

Tx 885.30 Rx 840.30 Chan 0510 #510

Tx 885.33 Rx 840.33 Chan 0511 #511

Tx 885.36 Rx 840.36 Chan 0512 #512

Tx 885.39 Rx 840.39 Chan 0513 #513

Tx 885.42 Rx 840.42 Chan 0514 #514

Tx 885.45 Rx 840.45 Chan 0515 #515

Tx 885.48 Rx 840.48 Chan 0516 #516

Tx 885.51 Rx 840.51 Chan 0517 #517

Tx 885.54 Rx 840.54 Chan 0518 #518

Tx 885.57 Rx 840.57 Chan 0519 #519

Tx 885.60 Rx 840.60 Chan 0520 #520

Tx 885.63 Rx 840.63 Chan 0521 #521

Tx 885.66 Rx 840.66 Chan 0522 #522

Tx 885.69 Rx 840.69 Chan 0523 #523

Tx 885.72 Rx 840.72 Chan 0524 #524

Tx 885.75 Rx 840.75 Chan 0525 #525

Tx 885.78 Rx 840.78 Chan 0526 #526

Tx 885.81 Rx 840.81 Chan 0527 #527

Tx 885.84 Rx 840.84 Chan 0528 #528

Tx 885.87 Rx 840.87 Chan 0529 #529

Tx 885.90 Rx 840.90 Chan 0530 #530

Tx 885.93 Rx 840.93 Chan 0531 #531

Tx 885.96 Rx 840.96 Chan 0532 #532

Tx 885.99 Rx 840.99 Chan 0533 #533

Tx 886.02 Rx 841.02 Chan 0534 #534

Tx 886.05 Rx 841.05 Chan 0535 #535

Tx 886.08 Rx 841.08 Chan 0536 #536

Tx 886.11 Rx 841.11 Chan 0537 #537

Tx 886.14 Rx 841.14 Chan 0538 #538

Tx 886.17 Rx 841.17 Chan 0539 #539

Tx 886.20 Rx 841.20 Chan 0540 #540

Tx 886.23 Rx 841.23 Chan 0541 #541

Tx 886.26 Rx 841.26 Chan 0542 #542

Tx 886.29 Rx 841.29 Chan 0543 #543

Tx 886.32 Rx 841.32 Chan 0544 #544

Tx 886.35 Rx 841.35 Chan 0545 #545

Tx 886.38 Rx 841.38 Chan 0546 #546

Tx 886.41 Rx 841.41 Chan 0547 #547

Tx 886.44 Rx 841.44 Chan 0548 #548

Tx 886.47 Rx 841.47 Chan 0549 #549

Tx 886.50 Rx 841.50 Chan 0550 #550

Tx 886.53 Rx 841.53 Chan 0551 #551

Tx 886.56 Rx 841.56 Chan 0552 #552

Tx 886.59 Rx 841.59 Chan 0553 #553

Tx 886.62 Rx 841.62 Chan 0554 #554

Tx 886.65 Rx 841.65 Chan 0555 #555

Tx 886.68 Rx 841.68 Chan 0556 #556

Tx 886.71 Rx 841.71 Chan 0557 #557

Tx 886.74 Rx 841.74 Chan 0558 #558

Tx 886.77 Rx 841.77 Chan 0559 #559

Tx 886.80 Rx 841.80 Chan 0560 #560

Tx 886.83 Rx 841.83 Chan 0561 #561

Tx 886.86 Rx 841.86 Chan 0562 #562

Tx 886.89 Rx 841.89 Chan 0563 #563

Tx 886.92 Rx 841.92 Chan 0564 #564

Tx 886.95 Rx 841.95 Chan 0565 #565

Tx 886.98 Rx 841.98 Chan 0566 #566

Tx 887.01 Rx 842.01 Chan 0567 #567

Tx 887.04 Rx 842.04 Chan 0568 #568

Tx 887.07 Rx 842.07 Chan 0569 #569

Tx 887.10 Rx 842.10 Chan 0570 #570

Tx 887.13 Rx 842.13 Chan 0571 #571

Tx 887.16 Rx 842.16 Chan 0572 #572

Tx 887.19 Rx 842.19 Chan 0573 #573

Tx 887.22 Rx 842.22 Chan 0574 #574

Tx 887.25 Rx 842.25 Chan 0575 #575

Tx 887.28 Rx 842.28 Chan 0576 #576

Tx 887.31 Rx 842.31 Chan 0577 #577

Tx 887.34 Rx 842.34 Chan 0578 #578

Tx 887.37 Rx 842.37 Chan 0579 #579

Tx 887.40 Rx 842.40 Chan 0580 #580

Tx 887.43 Rx 842.43 Chan 0581 #581

Tx 887.46 Rx 842.46 Chan 0582 #582

Tx 887.49 Rx 842.49 Chan 0583 #583

Tx 887.52 Rx 842.52 Chan 0584 #584

Tx 887.55 Rx 842.55 Chan 0585 #585

Tx 887.58 Rx 842.58 Chan 0586 #586

Tx 887.61 Rx 842.61 Chan 0587 #587

Tx 887.64 Rx 842.64 Chan 0588 #588

Tx 887.67 Rx 842.67 Chan 0589 #589

Tx 887.70 Rx 842.70 Chan 0590 #590

Tx 887.73 Rx 842.73 Chan 0591 #591

Tx 887.76 Rx 842.76 Chan 0592 #592

Tx 887.79 Rx 842.79 Chan 0593 #593

Tx 887.82 Rx 842.82 Chan 0594 #594

Tx 887.85 Rx 842.85 Chan 0595 #595

Tx 887.88 Rx 842.88 Chan 0596 #596

Tx 887.91 Rx 842.91 Chan 0597 #597

Tx 887.94 Rx 842.94 Chan 0598 #598

Tx 887.97 Rx 842.97 Chan 0599 #599

Tx 888.00 Rx 843.00 Chan 0600 #600

Tx 888.03 Rx 843.03 Chan 0601 #601

Tx 888.06 Rx 843.06 Chan 0602 #602

Tx 888.09 Rx 843.09 Chan 0603 #603

Tx 888.12 Rx 843.12 Chan 0604 #604

Tx 888.15 Rx 843.15 Chan 0605 #605

Tx 888.18 Rx 843.18 Chan 0606 #606

Tx 888.21 Rx 843.21 Chan 0607 #607

Tx 888.24 Rx 843.24 Chan 0608 #608

Tx 888.27 Rx 843.27 Chan 0609 #609

Tx 888.30 Rx 843.30 Chan 0610 #610

Tx 888.33 Rx 843.33 Chan 0611 #611

Tx 888.36 Rx 843.36 Chan 0612 #612

Tx 888.39 Rx 843.39 Chan 0613 #613

Tx 888.42 Rx 843.42 Chan 0614 #614

Tx 888.45 Rx 843.45 Chan 0615 #615

Tx 888.48 Rx 843.48 Chan 0616 #616

Tx 888.51 Rx 843.51 Chan 0617 #617

Tx 888.54 Rx 843.54 Chan 0618 #618

Tx 888.57 Rx 843.57 Chan 0619 #619

Tx 888.60 Rx 843.60 Chan 0620 #620

Tx 888.63 Rx 843.63 Chan 0621 #621

Tx 888.66 Rx 843.66 Chan 0622 #622

Tx 888.69 Rx 843.69 Chan 0623 #623

Tx 888.72 Rx 843.72 Chan 0624 #624

Tx 888.75 Rx 843.75 Chan 0625 #625

Tx 888.78 Rx 843.78 Chan 0626 #626

Tx 888.81 Rx 843.81 Chan 0627 #627

Tx 888.84 Rx 843.84 Chan 0628 #628

Tx 888.87 Rx 843.87 Chan 0629 #629

Tx 888.90 Rx 843.90 Chan 0630 #630

Tx 888.93 Rx 843.93 Chan 0631 #631

Tx 888.96 Rx 843.96 Chan 0632 #632

Tx 888.99 Rx 843.99 Chan 0633 #633

Tx 889.02 Rx 844.02 Chan 0634 #634

Tx 889.05 Rx 844.05 Chan 0635 #635

Tx 889.08 Rx 844.08 Chan 0636 #636

Tx 889.11 Rx 844.11 Chan 0637 #637

Tx 889.14 Rx 844.14 Chan 0638 #638

Tx 889.17 Rx 844.17 Chan 0639 #639

Tx 889.20 Rx 844.20 Chan 0640 #640

Tx 889.23 Rx 844.23 Chan 0641 #641

Tx 889.26 Rx 844.26 Chan 0642 #642

Tx 889.29 Rx 844.29 Chan 0643 #643

Tx 889.32 Rx 844.32 Chan 0644 #644

Tx 889.35 Rx 844.35 Chan 0645 #645

Tx 889.38 Rx 844.38 Chan 0646 #646

Tx 889.41 Rx 844.41 Chan 0647 #647

Tx 889.44 Rx 844.44 Chan 0648 #648

Tx 889.47 Rx 844.47 Chan 0649 #649

Tx 889.50 Rx 844.50 Chan 0650 #650

Tx 889.53 Rx 844.53 Chan 0651 #651

Tx 889.56 Rx 844.56 Chan 0652 #652

Tx 889.59 Rx 844.59 Chan 0653 #653

Tx 889.62 Rx 844.62 Chan 0654 #654

Tx 889.65 Rx 844.65 Chan 0655 #655

Tx 889.68 Rx 844.68 Chan 0656 #656

Tx 889.71 Rx 844.71 Chan 0657 #657

Tx 889.74 Rx 844.74 Chan 0658 #658

Tx 889.77 Rx 844.77 Chan 0659 #659

Tx 889.80 Rx 844.80 Chan 0660 #660

Tx 889.83 Rx 844.83 Chan 0661 #661

Tx 889.86 Rx 844.86 Chan 0662 #662

Tx 889.89 Rx 844.89 Chan 0663 #663

Tx 889.92 Rx 844.92 Chan 0664 #664

Tx 889.95 Rx 844.95 Chan 0665 #665

Tx 889.98 Rx 844.98 Chan 0666 #666

Upper Set Part 1 (667-799)

Tower Freq. Mobile Freq. 11xxxx# Channel

Tx 890.01 Rx 845.01 Chan 0667 #667

Tx 890.04 Rx 845.04 Chan 0668 #668

Tx 890.07 Rx 845.07 Chan 0669 #669

Tx 890.10 Rx 845.10 Chan 0670 #670

Tx 890.13 Rx 845.13 Chan 0671 #671

Tx 890.16 Rx 845.16 Chan 0672 #672

Tx 890.19 Rx 845.19 Chan 0673 #673

Tx 890.22 Rx 845.22 Chan 0674 #674

Tx 890.25 Rx 845.25 Chan 0675 #675

Tx 890.28 Rx 845.28 Chan 0676 #676

Tx 890.31 Rx 845.31 Chan 0677 #677

Tx 890.34 Rx 845.34 Chan 0678 #678

Tx 890.37 Rx 845.37 Chan 0679 #679

Tx 890.40 Rx 845.40 Chan 0680 #680

Tx 890.43 Rx 845.43 Chan 0681 #681

Tx 890.46 Rx 845.46 Chan 0682 #682

Tx 890.49 Rx 845.49 Chan 0683 #683

Tx 890.52 Rx 845.52 Chan 0684 #684

Tx 890.55 Rx 845.55 Chan 0685 #685

Tx 890.58 Rx 845.58 Chan 0686 #686

Tx 890.61 Rx 845.61 Chan 0687 #687

Tx 890.64 Rx 845.64 Chan 0688 #688

Tx 890.67 Rx 845.67 Chan 0689 #689

Tx 890.70 Rx 845.70 Chan 0690 #690

Tx 890.73 Rx 845.73 Chan 0691 #691

Tx 890.76 Rx 845.76 Chan 0692 #692

Tx 890.79 Rx 845.79 Chan 0693 #693

Tx 890.82 Rx 845.82 Chan 0694 #694

Tx 890.85 Rx 845.85 Chan 0695 #695

Tx 890.88 Rx 845.88 Chan 0696 #696

Tx 890.91 Rx 845.91 Chan 0697 #697

Tx 890.94 Rx 845.94 Chan 0698 #698

Tx 890.97 Rx 845.97 Chan 0699 #699

Tx 891.00 Rx 846.00 Chan 0700 #700

Tx 891.03 Rx 846.03 Chan 0701 #701

Tx 891.06 Rx 846.06 Chan 0702 #702

Tx 891.09 Rx 846.09 Chan 0703 #703

Tx 891.12 Rx 846.12 Chan 0704 #704

Tx 891.15 Rx 846.15 Chan 0705 #705

Tx 891.18 Rx 846.18 Chan 0706 #706

Tx 891.21 Rx 846.21 Chan 0707 #707

Tx 891.24 Rx 846.24 Chan 0708 #708

Tx 891.27 Rx 846.27 Chan 0709 #709

Tx 891.30 Rx 846.30 Chan 0710 #710

Tx 891.33 Rx 846.33 Chan 0711 #711

Tx 891.36 Rx 846.36 Chan 0712 #712

Tx 891.39 Rx 846.39 Chan 0713 #713

Tx 891.42 Rx 846.42 Chan 0714 #714

Tx 891.45 Rx 846.45 Chan 0715 #715

Tx 891.48 Rx 846.48 Chan 0716 #716

Tx 891.51 Rx 846.51 Chan 0717 #717

Tx 891.54 Rx 846.54 Chan 0718 #718

Tx 891.57 Rx 846.57 Chan 0719 #719

Tx 891.60 Rx 846.60 Chan 0720 #720

Tx 891.63 Rx 846.63 Chan 0721 #721

Tx 891.66 Rx 846.66 Chan 0722 #722

Tx 891.69 Rx 846.69 Chan 0723 #723

Tx 891.72 Rx 846.72 Chan 0724 #724

Tx 891.75 Rx 846.75 Chan 0725 #725

Tx 891.78 Rx 846.78 Chan 0726 #726

Tx 891.81 Rx 846.81 Chan 0727 #727

Tx 891.84 Rx 846.84 Chan 0728 #728

Tx 891.87 Rx 846.87 Chan 0729 #729

Tx 891.90 Rx 846.90 Chan 0730 #730

Tx 891.93 Rx 846.93 Chan 0731 #731

Tx 891.96 Rx 846.96 Chan 0732 #732

Tx 891.99 Rx 846.99 Chan 0733 #733

Tx 892.02 Rx 847.02 Chan 0734 #734

Tx 892.05 Rx 847.05 Chan 0735 #735

Tx 892.08 Rx 847.08 Chan 0736 #736

Tx 892.11 Rx 847.11 Chan 0737 #737

Tx 892.14 Rx 847.14 Chan 0738 #738

Tx 892.17 Rx 847.17 Chan 0739 #739

Tx 892.20 Rx 847.20 Chan 0740 #740

Tx 892.23 Rx 847.23 Chan 0741 #741

Tx 892.26 Rx 847.26 Chan 0742 #742

Tx 892.29 Rx 847.29 Chan 0743 #743

Tx 892.32 Rx 847.32 Chan 0744 #744

Tx 892.35 Rx 847.35 Chan 0745 #745

Tx 892.38 Rx 847.38 Chan 0746 #746

Tx 892.41 Rx 847.41 Chan 0747 #747

Tx 892.44 Rx 847.44 Chan 0748 #748

Tx 892.47 Rx 847.47 Chan 0749 #749

Tx 892.50 Rx 847.50 Chan 0750 #750

Tx 892.53 Rx 847.53 Chan 0751 #751

Tx 892.56 Rx 847.56 Chan 0752 #752

Tx 892.59 Rx 847.59 Chan 0753 #753

Tx 892.62 Rx 847.62 Chan 0754 #754

Tx 892.65 Rx 847.65 Chan 0755 #755

Tx 892.68 Rx 847.68 Chan 0756 #756

Tx 892.71 Rx 847.71 Chan 0757 #757

Tx 892.74 Rx 847.74 Chan 0758 #758

Tx 892.77 Rx 847.77 Chan 0759 #759

Tx 892.80 Rx 847.80 Chan 0760 #760

Tx 892.83 Rx 847.83 Chan 0761 #761

Tx 892.86 Rx 847.86 Chan 0762 #762

Tx 892.89 Rx 847.89 Chan 0763 #763

Tx 892.92 Rx 847.92 Chan 0764 #764

Tx 892.95 Rx 847.95 Chan 0765 #765

Tx 892.98 Rx 847.98 Chan 0766 #766

Tx 893.01 Rx 848.01 Chan 0767 #767

Tx 893.04 Rx 848.04 Chan 0768 #768

Tx 893.07 Rx 848.07 Chan 0769 #769

Tx 893.10 Rx 848.10 Chan 0770 #770

Tx 893.13 Rx 848.13 Chan 0771 #771

Tx 893.16 Rx 848.16 Chan 0772 #772

Tx 893.19 Rx 848.19 Chan 0773 #773

Tx 893.22 Rx 848.22 Chan 0774 #774

Tx 893.25 Rx 848.25 Chan 0775 #775

Tx 893.28 Rx 848.28 Chan 0776 #776

Tx 893.31 Rx 848.31 Chan 0777 #777

Tx 893.34 Rx 848.34 Chan 0778 #778

Tx 893.37 Rx 848.37 Chan 0779 #779

Tx 893.40 Rx 848.40 Chan 0780 #780

Tx 893.43 Rx 848.43 Chan 0781 #781

Tx 893.46 Rx 848.46 Chan 0782 #782

Tx 893.49 Rx 848.49 Chan 0783 #783

Tx 893.52 Rx 848.52 Chan 0784 #784

Tx 893.55 Rx 848.55 Chan 0785 #785

Tx 893.58 Rx 848.58 Chan 0786 #786

Tx 893.61 Rx 848.61 Chan 0787 #787

Tx 893.64 Rx 848.64 Chan 0788 #788

Tx 893.67 Rx 848.67 Chan 0789 #789

Tx 893.70 Rx 848.70 Chan 0790 #790

Tx 893.73 Rx 848.73 Chan 0791 #791

Tx 893.76 Rx 848.76 Chan 0792 #792

Tx 893.79 Rx 848.79 Chan 0793 #793

Tx 893.82 Rx 848.82 Chan 0794 #794

Tx 893.85 Rx 848.85 Chan 0795 #795

Tx 893.88 Rx 848.88 Chan 0796 #796

Tx 893.91 Rx 848.91 Chan 0797 #797

Tx 893.94 Rx 848.94 Chan 0798 #798

Tx 893.97 Rx 848.97 Chan 0799 #799

Upper Set Part 2 (991-1023)

Tower Freq. Mobile Freq. 11xxxx# Channel

Tx 869.04 Rx 824.04 Chan 0991 #800

Tx 869.07 Rx 824.07 Chan 0992 #801

Tx 869.10 Rx 824.10 Chan 0993 #802

Tx 869.13 Rx 824.13 Chan 0994 #803

Tx 869.16 Rx 824.16 Chan 0995 #804

Tx 869.19 Rx 824.19 Chan 0996 #805

Tx 869.22 Rx 824.22 Chan 0997 #806

Tx 869.25 Rx 824.25 Chan 0998 #807

Tx 869.28 Rx 824.28 Chan 0999 #808

Tx 869.31 Rx 824.31 Chan 1000 #809

Tx 869.34 Rx 824.34 Chan 1001 #810

Tx 869.37 Rx 824.37 Chan 1002 #811

Tx 869.40 Rx 824.40 Chan 1003 #812

Tx 869.43 Rx 824.43 Chan 1004 #813

Tx 869.46 Rx 824.46 Chan 1005 #814

Tx 869.49 Rx 824.49 Chan 1006 #815

Tx 869.52 Rx 824.52 Chan 1007 #816

Tx 869.55 Rx 824.55 Chan 1008 #817

Tx 869.58 Rx 824.58 Chan 1009 #818

Tx 869.61 Rx 824.61 Chan 1010 #819

Tx 869.64 Rx 824.64 Chan 1011 #820

Tx 869.67 Rx 824.67 Chan 1012 #821

Tx 869.70 Rx 824.70 Chan 1013 #822

Tx 869.73 Rx 824.73 Chan 1014 #823

Tx 869.76 Rx 824.76 Chan 1015 #824

Tx 869.79 Rx 824.79 Chan 1016 #825

Tx 869.82 Rx 824.82 Chan 1017 #826

Tx 869.85 Rx 824.85 Chan 1018 #827

Tx 869.88 Rx 824.88 Chan 1019 #828

Tx 869.91 Rx 824.91 Chan 1020 #829

Tx 869.94 Rx 824.94 Chan 1021 #830

Tx 869.97 Rx 824.97 Chan 1022 #831

Tx 870.00 Rx 825.00 Chan 1023 #832 or #0

T*R*I*K*-*C*L*I*P********************************************S*E*C*T*I*O*N***1*1

I got this from a BBS in the (708) are code. It had no name associated

with it. Since NOONE has mailed me any other info on it, I will keep this

in the bible until someone bitches or sends me something tangible. Besides,

with Loadkit so readily available, who has the time to mess with it?

-ML

MOTOROLA “TRIK-CLIP”

This is the plans I received for the Flip. Supposedly if one knew the

pinouts on the other moto phones one could transpose. (maybe!) I never

tested this so I don’t know if it works. The chip in the flip the text

is talking about is a 32 pin square plcc

After Phone Disassembly Locate 27c512 EPROM on phone board. This is

On The Upper Right Side Of The Display Next To The Roam Indicator.

This Is a 32 pin Square device. **Note the dot and beveled edge

for pin orientation (the dot is pin 1) Count to the left

counter clock wise 2 3 4 5 and so on. To the Right or clockwise

of the dot is pin 32 Vcc. This will aid you in your count to find

pin 25 which is the EPROM output enable. This pin is at ground or

Vss – Level. **Note Pin 25 on EPROM in phone must be lifted from

the phone board ground or Vss state. Use an X-acto Knife and or

soldering iron and tools to cut pin at board level where pin

narrows. Do not bend wide part of pin up on EPROM as this could

break off of EPROM. Also Wide Part of pin Will be used to make

contact with EPROM test clip adapter. The EPROM test clip adapter

will take pin 25 to logic high through an 8 to 10 thousand

resistor to pin 32 Vcc. This will Gate off all data Commands from

the phone board EPROM and allow the EPROM test clip adapter to

take over. **Note test clip could touch narrow part of cut off

pin on board and cause phone not to power up please remove or fold

down as low as possible so test clip only touches side of EPROM.

After programming is complete put pin 25 back together or find a

suitable ground or Vss – source. The phone will power up and work

without pin 25 put back together but for long term precaution

put back to a logic zero or ground to enable the output enable.

To use the EPROM test clip adapter pull the locking wedge on the

test clip into the upper position. Seat the EPROM test clip adapter

onto the EPROM in the phone. Make sure to orient the dot and

beveled edge with each other. Push the locking wedge down to lock

the EPROM test clip adapter onto the EPROM in the phone. Hook up

the programming cable to the computer and plug into the jack on the

base of the phone. Also hook up the loose lead with a jumper to the

center terminal between the battery contacts. Turn power on green

light on phone display should come on then a complete display test

will light up after that the no service will blink along with the

signal level mark in corner of display. If the antenna is still on

the phone it could change to roam or something else. I suggest

remove the antenna so the cell sight will not see you. If you do

not get a power on test with the display there are 3 possible

things (1) pin 25 on phone board is touching the test clip this

can be checked by looking with a volt meter at pin 25 where

resistor connects for 4 to 5 volts pos with reference to ground.

(2) Test clip is not sitting on chip good some times you have pull

the test clip up off of the EPROM a 64th of an inch all the way

around. (3) there is corrupt data, Pull the EPROM test clip off

Phone check to see if power on display is there.

Computer see if data or phone number or cell sight code or data

whole is ok I’ve seen the cell sight ID corrupt and the phone play

dead on the power on test. The test clip sometimes needs

maintenance look at the gold pins.

Make sure all the pins are level with the edge of it. If not take

an X-acto or pin and lightly bend them out so they are along the

edge of the plastic of the test clip.

Always check to see if EPROM in phone contacts are clean before

putting test clip on. **Note when test clip is on phone – only

change the ESN only. *The other data phone number lock and so on

can be changed without the test clip and should be done so.

The software version in the test clip is 9148 you will see this in

the right corner of the computer. Sometimes the program will crash

during the ESN write this will put all zeros in the ESN field

check the test clip try again. Sometimes I’ve had to do this 3 or 4

times. Also watch the phone display for codes I’ve seen at the end

of a write the code (FO8) just before power down I’ve had no

problem there but during the key write (FO8) means I’ve crashed.

Also during the time when the program is counting back into the

phone I’ve had (F1O) show up in the display of the phone this

problem means the next time you may not get the power on display

test pull test clip read phone check data to see if cell sight

code is corrupt or some other data correct try again. A word of

caution do not push on EPROM on top of test clip as this could

seat EPROM lower into adapter and cause bad contact. To remove

test clip pull locking wedge up to unlock the EPROM test clip

adapter from the EPROM in the phone. Continue pulling up to lift

the EPROM test clip adapter from the EPROM in the phone.

P*A*G*E*R*S**************************************************S*E*C*T*I*O*N***1*2

Subject: BRAVO pagers – undocumented test features

SELF TEST:

TO PUT UNIT INTO A SELF TEST TURN OFF PAGER. NOW HOLD DOWN THE

GRAY ARROW KEY AND BLACK LOCK KEY AT THE SAME TIME AND TURN ON

PAGER. THIS TELLS THE CPU IN PAGER TO GO INTO A SELF TEST. YOU WILL

GET A 2 SECOND LONG BEEP, RELEASE THE GRAY & BLACK BUTTON AND PUSH

THE GRAY BUTTON BEFORE THE 2 SECOND BEEP ENDS. IF YOU DID ALL THIS

IN TIME YOU WILL HAVE “SPL” OR “PAGING P?” AND NOT THE DOTTED LINE

YOU ARE USED TO SEEING WHEN YOU TURN ON PAGER . BY PRESSING THE

GRAY KEY IT WILL GO TO A DISPLAY TEST, PRESS AGAIN AND YOU WILL GET

THE PAGERS CAPCODE (CAPCODE IS THE UNIQUE SERIAL NUMBER WHICH THE

PAGING TRANSMITTERS TRANSMITS TO YOUR PAGER TO TURN ON YOUR PAGER

WHEN SOMEONE PAGES YOU). WAIT AND IN ABOUT 3 SECONDS IT WILL

DISPLAY YOUR SECOND CAPCODE (IF YOU HAVE ONE-MOST DON’T) PRESS THE

GRAY KEY AGAIN AND IT WILL CHECK CONTROLS, PRESS IT AGAIN AND IT

WILL TEST VIBRATOR FUNCTION (IF YOUR PAGER HAS IT). TURN OFF PAGER

AND TURN ON AGAIN TO DISABLE SELF TEST.

SPECIAL PROGRAMMED FEATURES:

TAKE OFF BATTERIES CLIP AND IN CENTER TOWARD THE FRONT OF

PAGER YOU WILL SEE A PRINTED CIRCUIT BOARD EDGE PINS (JUST LIKE THE

BACK SIDE OF A NETENDO CARTAGE. THIS EDGE PINS ARE PLUGGED INTO A

CORE PROGRAMMER. THE PROGRAMMER CAN CHANGE.

CAPCODES: SEE ABOVE

AUTORESET TO MANUAL: YOUR PAGER IN AUTORESET WILL BEEP 8 TIMES

THEN STOP BEEPING. MANUAL RESET THE BEEPER WILL KEEP BEEPING TILL

THE COWS COME HOME OR YOU PUSH A BUTTON TO LOOK AT THE MESSAGE.

DISPLAY: ENGLISH PROMPTS OR INTERNATIONAL-SYMBOL SCREENS

DISPLAYED.

SILENT MODE CHIRP: FOR A SINGLE BEEP WHEN YOUR PAGED. NOT FOR

USE ON VIBRATOR PAGERS.

BEEP ON BAD DATA: YOUR PAGER HEARS IT’S CAPCODE BUT RECEIVED

BAD DISPLAY MESSAGE, IT WILL PUT “EEE” ACROSS DISPLAY TO SHOW BAD

RECEIVE. IF THIS IS FEATURE IS NOT ENABLED AND YOU RECEIVE BAD DATA

YOUR PAGER WILL NOT BEEP AND YOU WILL HAVE NO IDEA SOMEONE TRYED TO

PAGE YOU.

******************************************************************

NOW LETS SAY YOU ARE UNHAPPY WITH YOUR PAGING COMPANY “A” BUT OWN

YOUR PAGER. YOUR $200.00+ PAGER IS TUNED TO THEIR FREQUENCY AND YOU

WANT TO GO TO ANOTHER PAwriteOMPANY BUT NOT LOSE ALL THE MONEY YOU

SPENT FOR YOUR PAGER. THE ANSWER IS TO RECRYSTAL PAGER TO THE NEW

FREQUENCY OF COMPANY “B”. BUT WE MUST ANSWER SOME QUESTIONS FIRST

TO SEE WHAT IT WILL COST.

1. WHAT IS YOUR PAGERS CODING FORMAT (POCSAG) OR (GSC)

THE EASY WAY TO TELL IS TO DO A SELF TEST AND READ

CAPCODE. IF IT’S 7 NUMBERS IT’S POCSAG. IF IT’S 6 NUMBERS

AND 1 LETTER IT’S GSC. IF YOUR PAGER DOES NOT MATCH THE

SAME CODING FORMAT AS COMPANY “B” IT WILL COST MORE THEN

IT’S WORTH TO CHANGE.

2. WHAT BAUD RATE IS YOUR PAGER WORKING AT ? DO SELF TEST AND

IF DISPLAY SHOWS PAGING P1 PAGER IS WORKING AT 1200 BAUD OTHER WISE

YOU ARE SAFE TO ASSUME 512 BAUD IT MUST MATCH COMPANY “B” BAUD RATE

TO BE WORTH YOUR TIME.

3. ARE YOU IN THE SAME FREQUENCY BAND 931 MHz OR 450 MHz ETC.

IF COMPANY “A” AND COMPANY “B” ARE NOT IN SAME BAND IT WILL TAKE A

NEW RECEIVER BOARD TO CONVERT PAGER AND COST TO MUCH TO TRY.

IF ALL THE ANSWERS ABOVE SHOW YOU ARE COMPATIBLE YOU CAN CALL

COMPANY “B” AND TELL THEM YOU WANT TO DO BUSINESS WITH THEM AND

NEED A CAPCODE NUMBER SO YOU CAN GET PAGER RECRYSTALED AND HAVE A

CAPCODE PROGRAMMED AT THE SAME TIME.

NOW YOU CAN HAVE COMPANY “B” RECOMMEND A SHOP THAT WILL

RECRYSTAL PAGER OR LOOK UP ONE YOURSELF.

(sorry for the all caps, that was how I received it and I am lazy. -ML)

D*I*S*C*L*A*I*M*E*R******************************************S*E*C*T*I*O*N***1*3

DISCLAIMER: I, Mike Larsen, accept NO responsibility for people using any

info within this text for fraudulent purposes. I did not intend for the info

to be used towards fraud or theft of services. The main reason I spent

hundreds of hours creating and compiling this information is because

programming fees are BULLSHIT and they know it. Programming fees are the

equivalent to the Refrigerator installer guy charging 50 bucks to plug the

damn thing in to the wall.

Oh, by the way, I forgot to mention in the above disclaimer that I do

nothing fraudulent with MY fone. I pay a bill and everything and can prove

it. So will the “feds” or whoever the Internet Gestapo is that’s been sending

me mail about me being under their “watchful eye”, please go for someone else

that’s dealing child pornography or asking for WaReZ? Thanks.

The sole reason I compiled this info into book form is to let people

that are capable, work on their phone. Again, I did not compile this for the

purpose of fraud.

********************************************************************************

* *

* THE MOTOROLA BIBLE (c) *

* For all Cellular AND Pager Info *

* *

* MOTOROLA USERS AND PROGRAMMING GUIDES *

* By Mike Larsen *

* Ver. 3.0 ************

* * 1/14/97 *

********************************************************************************

Table of Contents:

Section 1 Introduction 8 Phone Pin Outs

2 General User Info 9 Cable Specs

3 Programming Info 10 Channel Number vs. Frequency

4 Test Mode 11 Trik Clip

5 GSM Info and Test Mode 12 Pager Info

6 Hacking the FOVC 13 Disclaimer

7 Reading the SID

I*N*T*R*O*D*U*C*T*I*O*N****************************************S*E*C*T*I*O*N***1

GENERAL DISCLAIMER:

I, Mike Larsen, am in no way affiliated with Motorola or the Motorola

Cellular Subscriber Group or any other subsidiaries. I offer this guide free to

the public not to encourage fraudulent use, but to give others the same

information I obtained for free (and sometimes for money). Use of any

information from this text (in part or whole) is encouraged provided proper

credit is given to the author (Mike Larsen) and the work (The Motorola Bible).

Sale of this work (in whole or in part) is not discouraged provided proper

credit is given, names are left intact, and Email notice is given. After all,

if someone is stupid enough to give money for something that is available on

the web for free, well…

This manual is not intended to be an aid in cellular fraud. Cell fraud

is both illegal and immoral. Would you like someone to make charges on your

phone? If you want free calls, you want to check elsewhere for that information

because that type of information is NOT mentioned in the Motorola Bible.

This manual is not intended for use by people with little electronics

experience. This is not a tutorial and not intended to be used except by

people with previous cellular experience and are familiar with programming

cellular phones.

If you have any additions or corrections about this manual, please

email me at:

mjlarsen@hotmail.com

Additional Info:

It has come to my attention that this has been sold at ham fests and

my name removed throughout the text. This will no longer happen. As of July

10, 1996, this is copyrighted work. All rights are reserved and I will

prosecute. If you want to sell it, fine. I don’t ask for any of the profits.

All I ask is you leave the entire text intact with my name as it appears.

Also, Dr. Who has been crying about the fact I removed a little

anecdotal story from the beginning of his portion in the bible. He released

version 2.3 and put the story back in. Since it was not pertinent to cellular,

it will not be included. I have given him credit for what I have used and I

am within my legal right to publish his little section provided I give him

credit (which I have). I do find it very amusing that he failed to give me

any credit on his web page, considering his Motorola section is just my bible

in HTML format…and I didn’t cry. (Hah!)

G*E*N*E*R*A*L***U*S*E*R***I*N*F*O******************************S*E*C*T*I*O*N***2

Before going in to the programming of the cellular phone, it is

important for the user to know the normal things necessary for day to day

operation. While the majority of the stuff in the users manual is intended

for people that have problems programming their VCR, their are a few things

that are very important and are only mentioned in the users manual.

Turn On or Off: [Pwr]

Place Call: Enter number, [Snd]

Receive Call: [Snd] or open flip fone

End Call: [End] or close flip fone

Automatic Redial: To retry call, press [Snd] before ending the

unsuccessful call attempt.

Store Number: Phone number, [Sto], 2-digit location number

or press [*] to autoload.

If phone is Alphanumeric, display will flash

“Alpha_”. Press [Sto] to bypass or use

keypad to enter letter (up to 14). [#]

advances to next position, [*] backspaces.

When finished, press [Sto].

Recall Number: [Rcl], 2-digit location number. Entering

location 01, then hitting [#] will allow

scrolling through all stored locations.

Recall Name: Press [Name/Menu], [#] or [*] to scroll.

[Rcl] will display location number then name,

[Rcl] again will display corresponding phone

number and [Snd] to dial.

Recalling Last 10 Numbers Called: [Rcl], [0], [0]. Display will show “L0′”

followed by the name or number of the most

recently placed call. Use [#] or [*] to

scroll and [Snd] to call displayed number.

Super Speed Dialing: Directory location number, [Snd]

Changing Entries: Press [Rcl] and the 2-digit location number

so that the number to be changed is

displayed. Press and release [Clr] to back

out each of the digits. Enter a new number

and press [Sto].

Call Number Displayed: [Snd]

Microphone Muting: Press [Fcn], [6].

To unmute, press [Fcn], [6]

Lock Unit: [Fcn], [5] or [LOCK]

Unlock: Three digit unlock code. If you make an

error, [Clr] and enter again.

Automatic Lock: [FCN], [6] (not all phones)

“EnAbLE” will appear if compatible.

Display Unlock Code: Press [Fcn], [0], your six-digit security

code, [Rcl].

Changing Your Unlock Code: Press [Fcn], [0], your six-digit security

code, your NEW 3-digit unlock code, [Sto].

Review Battery Meter: Press [Fcn], [4] and release.

Adjust Volume: Earpiece – Press and hold [Vol] to increase.

Release, press again to decrease.

Ringer – [Fcn], then Vol as above.

Recall Own Phone Number: [Rcl], [#]

Individual Call Timer: [Rcl], [#], [#]

Resettable Call Timer: [Rcl], [#], [#], [#]

Reset Resettable Call Timer: [Fcn], [0], [7], [Clr]

Cumulative Call Timer: [Rcl], [#], [#], [#], [#]

Access Features: Press [Fcn], [1]. To change features, press

[*] and [#] to scroll and [Clr] to change.

To exit feature menu, press [END].

Review/Scroll Menu Features: Press [*] or [#]

Status Review: [Fcn], [0], [9], [Rcl], [#] or [*] scrolls

messages. To end press [END].

Changing System Type: Press [Rcl], [*]. Repeatedly press [*]

until the desired system type appears. To

select press [Sto].

Outgoing Call Restrictions: Press [Fcn], [0], 6-digit security code,

[1], [Sto]. Phone will place calls only

from memory locations 1-10.

To change back to unrestricted dialing

press [Fcn], [0], 6-digit security code,

[4], [Sto].

Switch to Second Phone Number: [Rcl], [#], [Sto] (Press [Clr] to finish

viewing newly activated number).

Key 1st Press 2nd Press 3rd Press 4th Press

2 A B C

3 D E F

Alpha 4 G H I

Entry 5 J K L

Mode 6 M N O

7 P Q R S

8 T U V

9 W X Y Z

Menu Features: For a more detailed description or instructions on use, consult

the user manual. Not all features listed are available on all

models.

Message Description

1 Min Beep One Minute Beep

Answer M Key Multiple Key Answer

Auto Answer Automatic Answer

C Scan System Type Selection

Call Screen Incoming Call Screening

Emrcy Off Emergency Dialing

Home System Type Selection

Level 1-6 Call Restrictions (Service Levels)

Lock Auto Automatic Lock

Name Pref’d Memory Recall Preference

Pin Active PIN Code Activation

Pref’d SIDs System Type Selection

Remind Beeps Reminder Beep Off

Ringer Silent Alert Off (Silent Ringer)

Scan A System Type Selection

Scan AB System Type Selection

Scan B System Type Selection

Scan BA System Type Selection

Scrpd Silent Silent Scratch Pad

Signal Off Signal Strength Meter

Silent Keypad Feedback Tones Off

Std Features Set as Standard

Theft Alarm Theft Alarm

Timer Auto Automatic Display Timer

Vox Mode Voice Operated Transmission

Vibrat Mode VibraCall

I would like to add that while I have extensively worked on finding

additional test mode commands, I (nor anyone else) have ever worked with the

normal operation commands as listed above. For example, above you will

notice sequences with [Fcn], [1] or [Fcn], [0], [7]. This is totally

unexplored territory. Happy hacking 🙂 See entering test mode on the new

95xx phones.

——————————————————————————–

Activating the PIN in PIN READY cellfones Thanks to fringe@rndhse.chi.il.us

(You cannot use their fone without the PIN activated)

Activating the PIN Ready feature in Motorola fones:

1. Enter user menu – press FNC,1 or FNC,Menu

2. Select Pin Active in menu and press * once or until “Pin Active”

appears in the fone display.

3. Enable ‘Pin Active’ feature – press CLR.

A small square will appear before ‘Pin Active’ sayings its enabled.

4. Exit user menu – press END

To store the PIN into memory:

1. Enter the specific PIN code – press XXXX

2. Store four digit PIN into memory location 07 – press STO,0,7

3. Return to normal operation – press CLR

To initiate a call using the PIN Ready feature:

1. Enter the phone number you wish to call:

press (XXX)XXX-XXXX, SND

2. You will hear two short rings, then press SND again. The PIN

Ready feature will automatically send the PIN code you previously

stored into memory location 07 and initiate your call.

———

What is EE3??

EE3 is the software that Motorola has added to the cellular

product line which provides feature enhancements and increased

security by restricting ESN transfer…

———

Why did the changes take place…

Due to the FCC Rule change, all new cellular telephones

that were introduced after Jan. 1, 1995 with new FCC IDs must restrict

ESN transfer. Phones introduced prior to this date are “grandfathered”

or not required to be compliant with this rule.

———

How ya can tell the difference between an EE3 and a non-EE3 fone.

These fones will be identified with the marking of EE3 on the

FCC label (look on da back of da fone)

———

How does the fone change?!

Some of the changes EE3 phones have are feature differences,

accessory compatibility, and service differences.

———

Which fones have the PIN CODE feature?!

If the phones has EE3 on the back label, then the fone has the

PIN CODE feature; with the exception of the EE3 TeleTacs and the

pre-AC-P300 boxed contours.

———

Can a 3-watt VA be used with EE3 fones?!

No, the existing 3-watt VA is not compatible with EE3 fones.

The following part numbers are for the new 3-watt booster for EE3 fones

and for conversion kits for existing 3-watt kits. The 3-watt booster

has its own handset that comes with it.

Deluxe Booster w/Micro Car Handsfree Kit (EE3 pocket and flip)

# S-5415

Deluxe Booster w/Micro Car Handsfree Kit (EE3 Elite) <no, eleet!>

# S-5093

Deluxe Booster Conversion Kit (EE3 pocket and flip)

# S-5094

Deluxe Booster Conversion Kit (EE3 Elite)

# TBA

———–

Which Motorola fones have the new Lock feature?!

All EE3 fones have the NEW lock feature – FCN,5 and STO to lock it

——————————————————————————–

Well, it seems a lot of people have been trying to figure out the date of

manufacture of Motorola cellular phones. This is easily accomplished by

locating the MSN (Mechanical Serial Number) somewhere on the telephone. It can

be 10 or 11 digits. If there is no 11th digit, warranty period is one year. If

there is an 11th digit, the warranty period can be determined from the following

charts. Without a proof of purchase, warranty date is determined by adding 3

months to the date of manufacture.

MSN Example: 194GSTxxxxW

194 is the Accounting Product Code (APC) and has little use.

G is the location of manufacture

S is the Year Code of manufacture

T is the Month Code of manufacture

xxxx is the actual serial number (hex) of that telephone

W is the Warranty Period

Year Code Year Month Code Month Warranty Period Definition

H 1983 A or B January A 1 yr w/ possible MCSI coverage

J 1984 C or D February B 3 yrs w/ possible MCSI coverage

K 1985 E or F March C 5 yrs w/ possible MCSI coverage

L 1986 G or H April D 2 yrs w/ possible MCSI coverage

M 1987 J or K May E No Warranty

N 1988 L or M June F 90 Days OEM only

P 1989 N or P July H 3 Years, Canada Only

Q 1990 Q or R August L 3 Years, OEM Only

R 1991 S or T September M 1 Year, OEM Only

S 1992 U or V October N, P, X 5 Yrs

T 1993 W or X November Q, R, S, Y, Z 3 Yrs

U 1994 Y or Z December T OEM Telephone

V 1995 U 90 Days (Reconditioned Units)

W 1996 W 4 Yrs.

X 1997

Y 1998 Location of Manufacture Code Location

Z 1999 G Libertyville, IL.

P*R*O*G*R*A*M*M*I*N*G***I*N*F*O********************************S*E*C*T*I*O*N***3

NOTES: Some units have dual NAM’s.

The ESN prefix is 130 decimal, 82 hex.

Motorola: 1-800-331-6456

There are MANY different models of Motorola phones sold under various

brand names, if you think it’s a Motorola, it probably is.

Determine which access sequence to use:

HAND HELD PORTABLE MODELS

If the phone has a FCN button and no MENU button use sequence 1.

If the phone has no FCN button use sequence 2.

If the phone has a MENU button and a FCN button use sequence 4.

INSTALLED MOBILE PHONES AND TRANSPORTABLE MODELS

If the phone has no FCN button and no RCL button use sequence 3.

If the phone has a FCN button use sequence 4.

If the phone has a MEM button use sequence 5.

If the phone has a RCL button and no FCN button use sequence 6.

SEQUENCE# ACCESS CODE

1 FCN (SECURITY CODE TWICE) RCL

2 STO # (SECURITY CODE TWICE) RCL

3 CTL 0 (SECURITY CODE TWICE) *

4 FCN 0 (SECURITY CODE TWICE) RCL

5 FCN 0 (SECURITY CODE TWICE) MEM

6 CTL 0 (SECURITY CODE TWICE) RCL

The default security code is 000000. The CTL (control) button is the

single black button on the side of the handset.

NAM programming:

1. Turn the power on.

2. Within ten seconds enter the access sequence as determined above.

3. The phone should now show “01” in the left of the display, this is the

first programming entry step number. If it does not the security code

is incorrect, or the programming lock-out counter has been exceeded. In

either case you can still program the unit by following the steps under

TEST MODE PROGRAMING below.

4. The * key is used to increment each step:

Each time you press * the display will increment from the step number,

displayed on the left, to the data stored in that step, displayed on

the right. When the data is displayed make any necessary changes and

press * to increment to the next step number.

5. The SND key is used to complete and exit programming when any STEP

NUMBER is displayed.

If you have enabled the second phone number bit in step 10 below then

pressing SND will switch to NAM 2. Steps 01 thru 06, 09 and 10 will

repeat for NAM 2, the step number will be followed by a “2” to indicate

NAM two.

5. The CLR key will revert the display to the previously stored data.

6. The # key will abort programming at any time.

PROGRAMING DATA:

STEP# #OF DIGITS/RANGE DESCRIPTION

01 00000 – 32767 SYSTEM ID

02 3 DIGITS AREA CODE

03 7 DIGITS TEL NUMBER

04 2 DIGITS STATION CLASS MARK

05 2 DIGITS ACCESS OVERLOAD CLASS

06 2 DIGITS GROUP ID (10 IN USA)

07 6 DIGITS SECURITY CODE

08 3 DIGITS LOCK CODE

09 0333 OR 0334 INITIAL PAGING CHANNEL

10 6 DIGIT BINARY OPTION PROGRAMING (SEE NOTE 1)

11 3 DIGIT BINARY OPTION PROGRAMING (SEE NOTE 2)

NOTES:

Take care with Motorola’s use of “0” and “1”. Some options use “0” to

enable, some use “1”.

1. This is a 6 digit binary field used to select the following options:

Digit 1: Internal handset speaker, 0 to enable.

Digit 2: Local Use Mark, 0 or 1.

Digit 3: MIN Mark, 0 or 1.

Digit 4: Auto Recall, always set to 1 (enabled).

Digit 5: Second phone number (not all phones), 1 to enable.

Digit 6: Diversity (Two antennas, not all phones), 1 to enable.

2. This is a 3 digit binary field used to select the following options:

Digit 1: Continuous DTMF, 1 to enable.

Digit 2: Transportable Ringer/Speaker, 0=Transducer, 1=Handset.

Digit 3: 8 hour time out in transportable mode, 0 to enable.

On newer models, they have added and changed some numbers. The numbers

as of the 3/27/92 manual are as follows:

1. The 6 digit binary field is still the same.

2. The 3 digit binary field has become a 5 digit binary field.

Digit 1: Failed Page Indicator 1=Disabled;0=Enabled

Digit 2: Motorola Enhanced Scan 1=Enabled; 0=Disabled

Digit 3: Long Tone DTMF 1=Enabled; 0=Disabled

Digit 4: Transportable Internal Ringer Speaker 1=Handset; 0=Transdcr

Digit 5: Eight Hour Timeout 1=Disabled;0=Enabled

T*E*S*T***M*O*D*E**********************************************S*E*C*T*I*O*N***4

TEST MODE ACCESS:

NEWER 95xx PHONES (Thank you Motorola!!!)

Many newer phones don’t require grounding. If your software version number

is 9526 (I think) or newer, enter this:

[FCN] [0] [0] [*] [*] [8] [3] [7] [8] [6] [6] [3] [3] [STO]

In case you have trouble remembering the number sequence, it spells out

“TESTMODE.” Leave it to Motorola to make this easier and easier all the time.

I have used this and it does work. This command just backs up my claim even

further that esn changing via handset is a reality. It’s a matter of finding

the correct combination of keys.

Normal test mode commands work like usual from then on.

For some odd reason, this hasn’t been included in all the 95xx phones. I

believe they started it in Software 9526. This is only an estimate, so if

you have a 95xx flip, let me know what software version you have and whether

it works or not so this date can be isolated. Mine is a 9562 that worked.

INSTALLED MOBILE PHONES AND TRANSPORTABLE MODELS

To enter test mode on units with software version 85 and higher you must

short pins 20 and 21 of the transceiver data connector. An RS232 break out

box is useful for this, or construct a test mode adapter from standard

Radio Shack parts.

For MINI TR or Silver Mini Tac transceivers (smaller data connector) you

can either short pins 9 and 14 or simply use a paper clip to short the

hands free microphone connector.

HAND HELD PORTABLE MODELS:

There are two basic types of Motorola portable phones, the Micro-Tac series

“Flip” phones, and the larger 8000 and Ultra Classic phones. Certain newer

Motorola and Pioneer badged Micro-Tac phones do not have a “flip”, but

follow the same procedure as the Micro-Tac.

8000 & ULTRA CLASSIC SERIES:

If you have an 8000 series phone determine the “type” before trying to

enter test mode. On the back of the phone, or on the bottom in certain

older models, locate the F09… number this is the series number. If the

FOURTH digit of this number is a “D” you CAN NOT program the unit through

test mode, a Motorola RTL4154/RTL4153 programmer is required to make any

changes to this unit.

Having determined that you do not have a “D” series phone the following

procedure is used to access test mode:

Remove the battery from the phone and locate the 12 contacts at the top

near the antenna connector. These contacts are numbered 1 through 12 from

top left through bottom right. Pin 6, top right, is the Manual Test Mode

Pin. You must ground this pin while powering up the phone. Pin 7 (lower

left) or the antenna connector should be used for ground. Follow one of

these procedures to gain access to pin 6:

1. The top section of the battery that covers the contacts contains

nothing but air. By careful measuring you can drill a small hole in the

battery to gain access to pin 6, alternately simply cut the top off the

battery with a hack saw. Having gained access use a paper clip to short

pin six to the antenna connector ground while powering up the phone.

2. If you do not want to “destroy” a battery you can apply an external 7.5

volts to the + and – connectors at the bottom of the phone, ground pin 6

while powering up the phone as above.

3. You can also try soldering or jamming a small jumper between pins 6 and

7 (top right to lower left), or between pin 6 and the antenna connector

housing ground. Carefully replace the battery and power up the phone. Use

caution with this method not to short out any other pin.

4. A cigarette lighter adapter, if you have one, also makes a great test

mode adapter as it can be disassembled to give you easier access to pin 6.

Many are pre marked, or even have holes in the right location. This is

because they are often stamped from the same mold that the manufacturer

uses for making hands free adapter kits and these kits require access to

the phone’s connectors.

ULTRA CLASSIC II SERIES:

Ground Pin 2 to pin 4.

MICRO-TAC “FLIP” SERIES:

This phone follows similar methods as outlined for the 8000 series above.

Remove the battery and locate the three contacts at the bottom of the

phone, the two outer contacts are raised and connect with the battery. The

center contact is recessed, this is the Manual Test Mode connector.

Now look at the battery contacts, the two outer ones supply power to the

phone, the center contact is an “extra” ground. This ground needs to be

shorted to the test mode connector on the phone. The easiest way to do

this is to put a small piece of solder wick, wire, aluminum foil or any

other conductive material into the recess on the phone. Having done this

carefully replace the battery and turn on the power, if you have been

successful the phone will wake up in test mode.

GENERAL NOTES:

HANDSETS: Most Motorola handsets are interchangeable, when a handset is

used with a transceiver other than the one it was designed for the display

will show “LOANER”. Some features and buttons may not work, for instance

if the original handset did not have a RCL or STO button, and the

replacement does, you will have to use the control * or control # sequence

to access memory and A/B system select procedures.

LOCK/UNLOCK PROCEDURES:

Phones with “LOCK” buttons: Press lock for at least 1/2 a second.

Phones with a “FCN” button: Press FCN 5, note that 5 has the letter’s

“J,K, and L” for lock.

Phones with no FCN or LOCK button: Press Control 5, control is the black

volume button on the side of the

handset.

SYSTEM SELECT PROCEDURES:

Phones with a RCL button: Press RCL *, then * to select, STO to store.

Phones with no RCL button: Press Control * then * to select, # to store.

Options are: CSCAn: Preferred/Non preferred with system lockout.

Std A/b, or Std b/A: Preferred/Non preferred.

SCAn Ab, or SCAn bA: Non preferred/Preferred

SCAn A: “A” ONLY

SCAn b: “B” ONLY

HOME: Home only

Pref’d SIDS: Service within the entered SIDS (up to 15)

(these are typical options, some phone’s vary. C-Scan is only available

on newer models and does not appear unless programmed, see below.)

——————————————————————————–

TEST MODE

NOTE: Not all commands work on all telephones. If a command is not valid the

display will show “ErrOr.” Not all numbers have been assigned. Not all

numbers have been listed here. Some commands were intended only for

Motorola factory applications. (This is the disclaimer in the

technical training manual. I have included all of the other commands I

have discovered one way or another. Some that say no function do have

a function but it is unknown until it is figured out.)

Three test commands are significant for programming and registering the

the telephone for service: see full descriptions under TEST MODE COMMANDS.

32# Clears the telephone. (Older Motorola allowed either three or fifteen

changes in the MIN. After that, the phone had to be sent to Motorola to reset

the counter. This is the command they use.)

38# Displays the ESN

55# This is the TEST MODE PROGRAMMING (as described below).

TEST MODE DISPLAY:

Test mode consists of two separate levels. When the telephone is first placed

in Test Mode, it is in the STATUS DISPLAY LEVEL. The display will be scrolling

(or flashing), or it will be locked. If locked, enter the unlock code and the

display will begin scrolling. If the unlock code is not known, press #. By

pushing the # key, the technician causes the cellular telephone to change to

its SERVICING LEVEL. The display will be US’ . There are five types of

display, depending on the model of the telephone: a 16 character display, a 14

character display, a 10 digit display (with two versions), an 8 character

display, and a 7 character display. The status display is different in analog

operation than in a TDMA call.

NOTE: Use of a loaner handset is allowed in servicing level, but may not be

allowed in the status display level. A locked telephone will not show the

status display, but will enter the servicing level.

14 Character Analog Call Display 14 Character TDMA Call Display

+—————+ +—————+

| A B C D E F G | | A B C D E F G |

| H I J K L M N | | H I J K L M N |

+—————+ +—————+

ABC = Channel ABC = Channel (“A” in the

D = *Call Processing Mode position indicates a

EFG = RSSI channel above 1000)

H = **(D)SAT D = *Call Processing Mode

I = 1=TX on EFG = RSSI

J = 1=Signalling Tone On HIJ = Digital Verification

K = Power Level (0-7) Color Code (1-255)

L = 1=Control Channel K = Power Level (0-7)

M = 1=RX Audio off L = 1=TX on

N = 1=TX Audio off M = 1=Bit Error Rate (0-7)

N = 1=Audio Muted

*Call Processing Mode: *Call Processing Mode

BLANK = AMPS BLANK = AMPS

A = NAMPS High Sub-Channel 1 = Slot 1, half rate

B = NAMPS Center Sub-Channel 2 = Slot 2, half rate

C = NAMPS Low Sub-Channel 3 = Slot 3, half rate

4 = Slot 4, half rate

**(D)SAT: 5 = Slot 5, half rate

0 = 5970 Hz 6 = Slot 6, half rate

1 = 6000 Hz 7 = Slot 1, full rate

2 = 6030 Hz 8 = Slot 2, full rate

3 = No SAT 9 = Slot 3, full rate

————

0-6 = DSAT Vector NOTE: The Analog Call

7 = No DSAT Display will always

show when on a control

channel.

——————————————————————————–

# Enter SERVICING LEVEL from Test Command Mode.

00# no function

01# Restart (Re-enter DC power start-up routine.) On TDMA telephones, this

command has the same effect as 13#.

02# Display Current Telephone Status (This is a non-altering version of the

STATUS DISPLAY. On a 14 character display, all the information is shown.

On a 7 character display only the information on the second line of a 14

character display is shown. On a 10 character display, all the

information on the second line of a 14 character display plus the last

three characters of the first line are shown.)

STATUS DISPLAY, ALTERNATES BETWEEN:

AAA BBB AAA = Channel Number (decimal) BBB = RSSI reading for channel

CDEFGHI are as follows:

C = SAT frequency (0=5970, 1=6000, 2=6030, 3=no channel lock)

D = Carrier (0=off, 1=on)

E = Signalling tone (0=off, 1=on)

F = Power attenuation level (0 through 7)

G = Channel mode (0=voice channel, 1=control channel)

H = Receive audio mute (0=unmuted, 1=muted)

I = Transmit audio mute (0=unmuted, 1=muted)

Press * to hold display and # to end.

03# Reset Autonomous Timer. This command results in the reset of the

autonomous timer but does not provide any test function on these models.

04# Initializes Telephone to Standard Default Conditions:

Carrier Off, Power Level 0, Receiver Audio Muted, Transmit Audio Muted,

Signalling Tone Off, SAT Off, Resetting of Watch-Dog Timer Enabled,

DTMF and Audio Tones Off, Audio Path Set to Speaker

05# TX Carrier On (Key Transmitter)

06# TX Carrier Off

07# RX Audio Off (Mute Receiver Audio)

08# RX Audio On (Unmute Receiver Audio)

NOTE: It seems Motorola finally discovered that people were using

this command to eaves-drop on cellular converstions. On MOST

of the newer phones (95xx and up), this command when used

with 11xxxx# will only work with the following channels:

11xxxx# Tower Freq. Mobile Freq. Channel

#300 Tx 879.00 Rx 834.00 0300

#333 Tx 879.99 Rx 834.99 0333

#385 Tx 881.55 Rx 836.55 0385

#799 Tx 893.97 Rx 848.97 0799

#991 Tx 869.04 Rx 824.04 0800

09# TX Audio Off

10# TX Audio On

11(Ch.No.)# Set Transceiver to Channel xxxx (Receive and Transmit in Decimal;

accepts 1, 2, 3, or 4 digits)

see Section 9 for detailed information on this command

12x# Set Power Step to x; (0,1-7) 0=Maximum Power (3 Watts) 7=Minimum Power Out

13# Power Off (Shuts off the radio)

14# 10 kHz Signalling Tone On

15# 10 kHz Signalling Tone Off

16# Setup (Transmits a five word RECC message; each of the five words will

be “FF00AA55CC33.” Transmitter de-keys at the end of the message.)

17# Voice (Transmits a two word REVC message; each of the two words will be

“FF00AA55CC33.” Transmitter de-keys at the end of the message.)

18# C-Scan (Allows for entry of as many as 5 negative SID’s for each NAM.)

Newer Motorola phones are equipped with a feature called C-Scan, this is

an option along with the standard A/B system selections. C-Scan allows

the phone to be programmed with up to five inhibited system ID’s per NAM.

This is designed to prevent the phone from roaming onto specified non-home

systems and therefore reduce “accidental” roaming fees.

1. C-Scan can only be programmed from test mode, power phone up with the

relevant test mode contact grounded (see above).

2. Press # to access test mode.

3. Press 18#, the phone will display “0 40000”.

4. Enter the first inhibited system ID and press *.

Continue to enter additional system ID’s if required. After the 5th entry

the phone will display “N2”. Press * to continue and add system ID’s for

NAM 2 as required.

5. If an incorrect entry is made (outside the range of 00000-32767) the

display will not advance, press CLR and re-enter. Use a setting of

40000 for any un-needed locations.

6. When the last entry has been made press * to store and press # to exit,

turn off power.

or

[**Phones without the C-Scan option used this command to SEND NAM.**]

18# SEND NAM. Display shows AA BB. Where AA=Address and BB=Data. Displays

the contents of the NAM, one address at a time, advanced by pressing the

* key. The following data is contained in NAM. The test is exited by

depressing the # key.

SIDH Sec. Code

OPT. (1,2,&3) MIN

MIN1, MIN2 FCHNA

SCM FCHNB

IPCH NDED

ACCOLC CHKSUM GIM

19# Display Software Version Number (4 digits displayed as year and week)

NOTE: Entering commands 20# through 23# or 27# causes the transceiver to begin

a counting sequence or continuos transmission as described below. In

order to exit from the commands to enter another test command, the #

key must be depressed; all other key depressions are ignored.

20# Receive control channel messages counting correctable and uncorrectable

errors. When the command starts, the number of the command will be

displayed in the upper-right corner of the display. Entering a # key

will terminate the command and display two three-digit numbers in the

display. The first number is the number of correctable errors and the

second is the uncorrectable errors.

21# Received voice channel messages counting correctable and uncorrectable

errors. When the command starts, the number of the command will be

displayed in the upper right-hand corner of the display. Entering a #

key terminates the command and will display two three-digit numbers in

display. The first is the number of correctable errors and the second

is the uncorrectable errors.

22# Receive control channel messages counting word sync sequence. When the

command starts, the number of the command will be displayed in the upper

right-hand corner of the display. Entering a # key will terminate the

command and display the number of word sync sequences in the display.

23# Receive voice channel messages counting word sync sequences. When the

command starts, the number of the command will be displayed in the upper

right-hand corner of the display. Entering a # key will terminate the

command and display the number of word sync sequences in the display.

24# Receive control channel data and display the majority voted busy/idle

bit. 0=idle 1=busy

25x# SAT On When x=0, SAT=5970HZ

x=1, SAT=6000HZ

x=2, SAT=6030HZ

26# SAT Off

27# Transmit Data (Transmits continuous control channel data. All words

will be “FF00AA55CC33.” When the command starts, ’27’ will be displayed

in the right side of the display. Entering a # key will terminate the

command. The transmitter de-keys when finished.)

28# Activate the high tone (1150 Hz +/- 55 Hz)

29# De-activate the high tone

30# Activate the low tone (770 Hz +/- 40 Hz)

31# De-activate the low tone

32# Clear (Sets non-volatile memory to zeroes or factory default. This

command will affect all counters, all repertory memory including the last

number called stack, and all user programmable features including the

setting of System Registration. It does not affect the ESN, NAM, phasing

data, or lock code. This takes a minute or so. DO NOT TURN OFF THE

TELEPHONE WHILE THIS IS SHOWING ’32’ ON THE DISPLAY. WAIT UNTIL THE

NORMAL SERVICE LEVEL DISPLAY RESUMES! [maybe a minute or so])

33x# Turn on DTMF for x (1-9, *, 0, #, plus the single tones)

Where x=1 697 Hz + 1209 Hz 14 1150 HZ (not used in cellular)

2 697 Hz + 1336 Hz 15 1209 Hz

3 697 Hz + 1477 Hz 16 1336 Hz

4 770 Hz + 1209 Hz 17 1477 Hz

5 770 Hz + 1336 Hz 18 1633 Hz (not used in cellular)

6 770 Hz + 1477 Hz 19 Turn DTMF off

7 852 Hz + 1209 Hz 20 2087 Hz

8 852 Hz + 1336 Hz 21 2308 Hz

9 852 Hz + 1477 Hz 22 2553 Hz (not used in cellular)

* 941 Hz + 1209 Hz 23 Turn DTMF off

0 941 Hz + 1336 Hz 24 3428 Hz (not used in cellular)

# 941 Hz + 1477 Hz 25 3636 Hz (not used in cellular)

10 697 Hz 26 4000 Hz (not used in cellular)

11 770 Hz 27 3555 Hz (not used in cellular)

12 852 Hz 28 4571 Hz (not used in cellular)

13 941 Hz 29 Turn DTMF off

Someone Please Check Out 24 thru 28 for accuracy. I had weak equipment.

34# Turn DTMF Off

35# Display RSSI (“D” Series Portable Only)

or

35x# Set Audio Path to x x=0, V.S.P Microphone (Applies to mobiles only.)

x=1, Speaker

x=2, Alert

x=3, Handset

x=4, Mute

x=5, External Telephone (Applies to Portables Only)

x=6, External Handset (Applies to NEWER Portables)

36nnn# Scan (TDMA Telephones only. Scans the primary control channels and

attempts to decipher the forward data stream. The display will show PASS1

if the strongest control channel was accessed, PASS2 if the second

strongest was accessed, and FAIL if no control channel could be accessed.)

(nnn=Scan speed in milliseconds). Tunes from channel 1 to 666 in order.

Entering a * pauses the scan and displays current Channel Number and

RSSI reading (AAA=Channel Number and BBB=RSSI Reading). When scan speed

is 300 milliseconds or greater, the current status is displayed during the

scan; when less than 300 milliseconds the status is displayed only during

pause. Entering * during a pause causes the scan to resume. Entering #

aborts the scan and leaves the mobile tuned to the current channel. During

this command only the * and # keys are recognized.

NOTE: While I haven’t heard from ONE single person that this has worked,

Motorola has continued to print this command in all the Technical

Training Books (including the January 96 edition).

37# Sets Low Battery Threshold. Usage: #37#x# where x is any number

from 1 to 255. If set to 1, the Low Battery indicator will come up

when the phone is powered on. If set to 255, it may never come up.

38# Display ESN (Displays ESN in four steps, two hexadecimal digits at a time

in a four digit display. The decimal shows the address, 00 through 03 as

the first two digits, and two digits of the ESN as the last two digits.

Use the ‘*’ to step through the entire hexadecimal ESN.)

Compander OFF (“D” Series Portables)

or

38# SND-SNM. Display shows AA BB. Where AA=Address;BB=Data. Send the SNM

to the display. All 32 bytes of the SNM will be displayed, one byte at

a time. The byte address will be displayed in the upper right-hand

corner and the contents of that address will be displayed in the hex.

The * key is used to step through the address similar to the SEND-NAM

(18#) command.

39# Compander ON (“D” Series Portables)

or

39# RCVSU. Receive one control channel word. When the word is received it

is displayed in hex. This command will be complete when a control channel

word is received or when the # key is entered to abort the command.

40# RCVVC. Receive one voice channel word. When the word is received it is

displayed in hex. This command will be complete when a voice channel

word is received or when the # key is entered to abort the command.

41# Enables Diversity (On F19CTA… Series only.)

42# Disables Diversity (On F19CTA… Series only.)

43# Disable Diversity

USE T/R ANTENNA (On F19CTA… Series only.)

USE R ANTENNA (On D.M.T./ Mini TAC)

44# Disable Diversity

USE R ANTENNA (On F19CTA… Series only.)

USE T/R ANTENNA (On D.M.T./ Mini TAC)

45# Display Current Receive Signal Strength Indicator (Displayed as a 3 digit

decimal number) The strongest signal I have ever received was 179 and I

was sitting directly below the tower WITHOUT an external antenna.

46# Display Cumulative Call Timer

47x# Set RX Audio level to X

(For F19CTA …Series Transceivers)

X=0, Lowest Volume

X=6, Highest Volume

X=7, mute

Normal setting is 4.

(For D.M.T./ Mini TAC Transceivers)

X=0, Lowest Volume

X=7, Highest Volume

Normal setting is 4.

(For TDMA Transceivers and F09F… Series and Higher Portables)

X=0, Lowest Volume

X=15, Highest Volume

Normal setting is 2 to 4. (On TDMA

Transceivers and Micro TAC portables,

settings 8 through 15 are for DTMF

applications only.)

48# Side Tone On. Use this command in conjunction with 350# to test the

entire audio path in hands-free applications.

49# Side Tone Off

50# Maintenance data is transmitted and test results displayed:

PASS=received data is correct

FAIL 1=2second timeout, no data rec.

FAIL 2=received data is incorrect

51# Test of mobile where maintenance data is transmitted and looped back.

Display is as follows:

PASS=looped-back data is correct

FAIL 1=2 second timeout, no looped-back data

FAIL 2=looped-back data is incorrect

52x# SAT Phase Adjustment. A decimal value that corresponds to phase shift

compensation in 4.5 degree increments. Compensation added to inherent

phase shift in transceiver to achieve a total of 0 degrees phase shift.

Do NOT enter any values except those shown below.

0 degrees = 0 121.5 degrees = 59 243.0 degrees = 86

4.5 = 1 126.0 = 60 247.5 = 87

9.0 = 2 130.5 = 61 252.0 = 112

13.5 = 3 135.0 = 62 256.5 = 113

18.0 = 4 139.5 = 63 261.0 = 114

22.5 = 5 144.0 = 40 265.5 = 115

27.0 = 6 148.5 = 41 270.0 = 116

31.5 = 7 153.0 = 42 274.5 = 117

36.0 = 16 157.5 = 43 279.0 = 118

40.5 = 17 162.0 = 44 283.5 = 119

45.0 = 18 166.5 = 45 288.0 = 120

49.5 = 19 171.0 = 46 292.5 = 121

54.0 = 20 175.5 = 47 297.0 = 122

58.5 = 21 180.0 = 64 301.5 = 123

63.0 = 22 184.5 = 65 306.0 = 124

67.5 = 23 189.0 = 66 310.5 = 125

72.0 = 48 193.5 = 67 315.0 = 126

76.5 = 49 198.0 = 68 319.5 = 127

81.0 = 50 202.5 = 69 324.0 = 104

85.5 = 51 207.0 = 70 328.5 = 105

90.0 = 52 211.5 = 71 333.0 = 106

94.5 = 53 216.0 = 80 337.5 = 107

99.0 = 54 220.5 = 81 342.0 = 108

103.5 = 55 225.0 = 82 346.5 = 109

108.0 = 56 229.5 = 83 351.0 = 110

112.5 = 57 234.0 = 84 355.5 = 111

117.0 = 58 238.5 = 85 360.0 = 70

53# Enable scrambler option, when equipped.

54# Disable scrambler option, when equipped.

55# Display/Program N.A.M. (Test Mode Programming)

TEST MODE PROGRAMING:

Assuming you have completed one of the above steps correctly the phone

will wake up in test mode when you turn the power on. When you first

access test mode the phone’s display will alternate between various status

information that includes the received signal strength and channel number.

The phone will operate normally in this mode. You can now access Service

Mode by pressing the # key, the display will clear and a ‘ will appear.

Use the following procedure to program the phone:

1. Enter 55# to access programming mode.

2. The * key advances to the next step. (NOTE that test mode programming

does NOT have step numbers, each time you press the * key the phone

will display the next data entry).

3. The CLR key will revert the display to the previously stored data.

4. The # key aborts programming at any time.

5. To complete programming you must scroll through ALL entries until a ‘

appears in the display.

6. Note that some entries contain more digits than can be displayed by the

phone, in this case only the last part of the data can be seen.

TEST MODE PROGRAMING DATA: For AMPS and NAMPS Cellular Telephones

STEP# #OF DIGITS/RANGE DESCRIPTION

01 00000 – 32767 SYSTEM ID

02 8 DIGIT BINARY OPTION PROGRAMING, SEE NOTE 1 BELOW

03 10 DIGITS MIN (AREA CODE & TEL#)

04 2 DIGITS STATION CLASS MARK, SEE NOTE 2 BELOW

05 2 DIGITS ACCESS OVERLOAD CLASS

06 2 DIGITS GROUP ID (10 IN USA)

07 6 DIGITS SECURITY CODE

08 3 DIGITS UNLOCK CODE

09 3 DIGITS SERVICE LEVEL, SEE NOTE 3 BELOW

10 8 DIGIT BINARY OPTION PROGRAMING, SEE NOTE 4 BELOW

11 8 DIGIT BINARY OPTION PROGRAMING, SEE NOTE 5 BELOW

12 0333 OR 0334 INITIAL PAGING CHANNEL

13 0333 “A” SYSTEM IPCH

14 0334 “B” SYSTEM IPCH

15 3 DIGIT NUMBER PAGING CHANNEL (021 IN USA)

16 8 DIGIT BINARY OPTION PROGRAMING, SEE NOTE 6 BELOW

Steps 01 through 06 and 12 will repeat for NAM 2 if the second phone

number bit has been enabled in step 11.

TEST MODE PROGRAMING DATA: For TDMA Cellular Telephones

STEP# #OF DIGITS/RANGE DESCRIPTION

01 00000 – 32767 SYSTEM ID

02 8 DIGIT BINARY OPTION PROGRAMING, SEE NOTE 1 BELOW

03 10 DIGITS MIN (AREA CODE & TEL#)

04 2 DIGITS STATION CLASS MARK, SEE NOTE 2 BELOW

05 2 DIGITS ACCESS OVERLOAD CLASS

06 2 DIGITS GROUP ID (10 IN USA)

07 6 DIGITS SECURITY CODE

08 3 DIGITS LOCK CODE

09 3 DIGITS SERVICE LEVEL, SEE NOTE 3 BELOW

10 8 DIGIT BINARY OPTION PROGRAMING, SEE NOTE 4 BELOW

11 8 DIGIT BINARY OPTION PROGRAMING, SEE NOTE 5 BELOW

12 0333 OR 0334 INITIAL PAGING CHANNEL

13 0333 “A” SYSTEM IPCH

14 0334 “B” SYSTEM IPCH

15 3 DIGITS DEDICATED PAGING CHANNELS (021 IN USA)

16 3 DIGITS SECONDARY INITIAL PAGING CHANNEL. 708 for

system A, 737 for system B. Allows the TDMA

telephone to be assigned to a TDMA channel in

a call

17 708 SECONDARY INITIAL PAGING CHANNEL FOR SYSTEM A

18 737 SECONDARY INITIAL PAGING CHANNEL FOR SYSTEM B

19 8 DIGITS OPTION PROGRAMMING, SEE NOTE 6 BELOW

NOTES:

Take care with Motorola’s use of “0” and “1”. Some options use “0” to

enable, some use “1”.

These are eight digit binary fields used to select the following options:

1. (step 02 above, suggested entry is: 11101001 for “A” system, 10101001

for “B” sys)

Digit 1: Local use mark, 0 or 1.

Digit 2: Preferred system, 1=system A, 0=system B.

Digit 3: End to end (DTMF) dialing, 1 to enable.

Digit 4: Not used, enter 0. Formerly used for test mobile.

Digit 5: Repertory (speed) dialing, 1 to enable. (Not used in TDMA)

Digit 6: Auxiliary (horn) alert, 1 to enable.

Digit 7: Hands free (VSP) auto mute, 1 to enable (mutes outgoing hands

free audio until the MUTE key is pressed). (Not used in TDMA)

Digit 8: Min mark, 1 = Enabled. NOT CHANGEABLE on series II or III.

2. Station Class Mark

SCM | 666 or 832 Ch. | VOX | Max Power

—–+—————-+—–+———–

00 | 666 | N | 3.0 W

01 | 666 | N | 1.2 W

02 | 666 | N | 0.6 W

03 | | |

04 | 666 | Y | 3.0 W

05 | 666 | Y | 1.2 W

06 | 666 | Y | 0.6 W

07 | | |

08 | 832 | N | 3.0 W

09 | 832 | N | 1.2 W

10 | 832 | N | 0.6 W

11 | | |

12 | 832 | Y | 3.0 W

13 | 832 | Y | 1.2 W

14 | 832 | Y | 0.6 W

15 | | |

3. Service Level Codes:

001 The telephone will only dial numbers in memory locations 01, 02

and 03. No keypad entries or memory storage is possible.

Restrict ALL outgoing calls by clearing locations 01, 02, and 03

and place the phone in servicing level 001. In some phones this

applies to memory locations 01 – 10.

002 The telephone will dial only numbers from memory locations. The

keypad is disabled and super speed dialing is not enabled.

003 Keypad dial only; no memory recall allowed.

004 Unlimited keypad and memory dialing. (DEFAULT)

005 Seven-digit dialing only

006 Full keypad and memory dialing, but memory locations 1 through

10 cannot be changed.

007 The phone will dial only from as many as 50 programmable memory

locations

4. (step 10 above, suggested entry is: 00000100)

Digits 1 – 3: Not used in USA, enter 0.

Digit 4: Extended Field. When enabled, the telephone will scan

more than 32 paging channels. Not used in USA, 0 to disable

Digit 5: Single system scan, 1 to enable (scan A or B system only,

determined by bit 2 of step 02. Set to “0” to allow user the

option).

Digit 6: Super speed dial, 1 to enable (pressing N, or NN SND will

dial the number stored in memory location NN).

Digit 7: User selectable service level, 0 to enable (allows user to

set long distance/memory access dialing restrictions).

Digit 8: Lock function, 0 to enable (allows user to lock/un-lock the

phone, if this is set to 1 the phone can not be locked).

5. (step 11 above, suggested entry is: 00000000)

Digit 1: Handset programming, 0 to enable (allows access to programming

mode without having to enter test mode).

Digit 2: Second phone number (not all phones), 1 to enable.

Digit 3: Call timer access, 0 to enable. (Not used in TDMA)

Digit 4: Auto system busy redial, 0 to enable.

Digit 5: Internal Speaker disable, 1 to enable (use with select VSP

units only, do not use with 2000 series mobiles).

Digit 6: IMTS/Cellular, 1 to enable (rarely used).

Digit 7: User selectable system registration, 0 to enable.

Digit 8: Dual antenna (diversity), 1 to enable.

6. (step 16 and 19 above, suggested entry is: 0011010 for portable and 0011011

for mobile units)

Digit 1: Enhanced Scan, when enabled, four strongest signalling

channels are scanned instead of two. 1=enabled, 0-disabled.

Digit 2: Cellular Connection, used only in series II phones if a

series I cellular connection is used with a series II.

0=series II, 1=series I, 0 for ALL TDMA PHONES

Digit 3: Continuous DTMF, 1 to enable (software version 8735 and later)

Digit 4: Transportable Internal Ringer/Speaker. When set to 0, audio

is routed to the external speaker of the transportable; 1

routes it to the handset.

Digit 5: 8 hour time-out, 0 to enable (software version 8735 and later)

Digit 6: Not used, 0 only.

Digit 7: Failed page indicator, 0 to enable (phone beeps when an

incoming call is detected but signal conditions prevent

completion of the call).

Digit 8: Portable scan, 0 for portable, 1 for mobile units.

56# Illumination Diagnostic. Lights up all lights (except the green in use

light) and displays all “8”‘s. The phone is also muted until repowered.

57x# Call Processing Mode

x=0, AMPS

x=1, NAMPS

x=2-4, RESERVED

x=5, TDMA signalling

x=6, TDMA signalling with loopback before decoding

x=7, TDMA signalling with loopback voice after decoding

x=8, TDMA signalling with loopback FACCH after decoding

x=9, TDMA forced synchronization

58# Compander On (Audio compressor and expander) (See 39#)

59# Compander Off (Audio compressor and expander) (See 38#)

60# no function

61# ESN Transfer (For Series I D.M.T./Mini TAC only)

62# Turn On Ringer Audio Path

63# Turn Off Ringer Audio Path

64# ? Does something, doesn’t display anything

65# ? Does something, doesn’t display anything

66# Identity Transfer (Series II Trancvrs and later mobiles, F09HG…,

F09HL…, F09HY…, F09HR…, F09LF…, F09NF…, F09PY…, F09QY…,

F09RY…, and most retail portables shipping prior to April 1, 1995.)

Does the actual transfer of the ESN and NAM info. See the 80x# command.

67# Displays two 3 digit numbers. If you keep entering this command

repeatedly, the first number will constantly change, the second won’t

(as far as I have seen).

68# Display FLEX and Model Information

69# Used with 66# for Identity Transfer. In models shipped without the 66#

command, this is used with 80x# instead. Reads NAM information, repertory

memory, and C-Scan ID SID’s from old phone.

70# Abbreviated field transmitter audio deviation command, for transceivers

with FCC ID ABZ89FT5668.

71# Abbreviated field power adjustment command, for transceivers with FCC ID

ABZ89FT5668.

72# Field audio phasing commands. The left side of the display should read

“00” followed by a two digit number. The “00” indicates the first

programming step. If you press the *, the 00 changes to 01 and so on until

08. The “06” and “0A” are used to change the audio level (to change:

press the volume up or down keys). Other registers…don’t know.

73# Field power adjustment command.

75# Display ESN (Displays ESN in four steps, two decimal digits at a time

in a three digit display. The decimal shows the address, 0 through 3 as

the first digit, and two digits of the ESN as the last two digits.

Use the ‘*’ to step through the entire hexadecimal ESN.)

38# 75#

00-D4 0 30

01-25 1 16

02-D4 2 13

03-1E 3 54309

80x# Current Identity Transfer Procedure. (Available in telephones shipping

after April 1, 1995.) This does NOT transfer the ESN.

x=0, Transfers NAM information (On TDMA telephones, this

command also transfers C-Scan SID’s.)

x=1, Transfers repertory memory (names & telephone numbers

in memory.)

x=2, Transfers C-Scan SID’s on analog telephones (Not

available on TDMA telephones.)

NOTES: As new fones come out, more commands are added/deleted as needed.

The majority of these commands were figured using VERY old software

versions. Some commands won’t work on some phones. If you find a

command that does something, please inform me as well as the software

version number of the phone it was discovered on.

——————————————————————————–

* NEW SECTION *

COMMANDS THAT DO SOMETHING BUT I DON’T KNOW WHAT!!!

74#

76#

77#

78#

99#

If you have any insight to these commands or if you have any more to add to the

list, please email me promptly. Thank you.

G*S*M***I*N*F*O***A*N*D***T*E*S*T***M*O*D*E********************S*E*C*T*I*O*N***5

Thanks to Janus Krarup (jckrarup@post1.com http://www.ibt.dk/morten/friends/)

for all the information in this section. His web page has all of this

information (and more) and is continually updated. It’s also offered in Italian

and will be available soon in Czech.

TESTMODE for GSM PHONES:

Start with the sequence:

Testmode

Command#

|

|

[pause] [pause] [pause] [1] [1] [3] [pause] [1] [pause] [ok] [MENU] (pause is

accomplished by holding down the [*] key until box appears).

This accomplishes the editing/viewing of the Engineer Field Options. By

substituting different numbers for the [1] [1] [3], many more test mode

commands and functions are available. (see below for an almost complete list)

After pressing [MENU], scroll until the new option appears. Pressing [OK] will

then reveal 3 new options:

ACTIVE CELL: Displays Active Channel and lets you scroll through: RxLev, RxLevAM,

NCC, BCC, MSTxPwr, and C1.

During a call you can see: RxLev, RxLevFull, RxLevSub, RxQualFul,

RxQualSub, Timeslot, TimeAdv, and PwrLev.

The active channel may read “Hopping” during a call.

When establishing a network connection you can see what SDCCH

(Standalone Dedicated Control CHannel) the negotiation takes place

on.

ADJACENT CELLS: Lets you scroll through the adjacent cells (1-6) and view their

channel allocations.

SYSTEM PARAMETERS: Displays the following: Combined, AcsClas, MCC, MNC, LAC,

CellID, T3212, BS-PA-MFRM, and XZQTY.

During a call you can see: Combined, DTX, MCC, MNC, LAC, and

CellID.

——————————————————————————–

Key To The Readouts:

Combined: Haven’t got a clue. The two Danish operators has OFF and Swedish

Comviq has ON.

RxLev: The strength of the received signal (in dBm), normally between -55 and

-90 – the signal drops at RxLevAm

When comparing RxLev’s, remember the logarithmic nature of the dB scale and

that the signal intensity decays by a factor of 4 when the distance from

the BST is doubled (assuming line of sight to the BST, the signal will

drop 6 db when the distance is doubled.)

RxLevAm: Receive signal strength cut off point (around -100 dBm and -110 dBm).

BCC: Broadcast Color Code (0 through 7)

NCC: Network Color Code (0 through 7)

MSTxPwr: BTS transmit power in dBm (see notes on power control)

C1: Measurement of the signal quality (bit failure). A forced handoff will be

made if C1<0. ( I have seen C1 as high as 039). This value is reported

from MS back to the BSC which decides when to make a handoff.

RxLevFull: C1 value with continuous transmission from tower.

RxLevSub: C1 value with discontinuous transmission from tower.

RxQualFull: Bit error rate with continuous transmission from tower.

RxQualSub: Bit error rate with discontinuous transmission from tower.

Timeslot: The current timeslot (0 through 7). TDMA allows eight channels to be

accommodated on a single RF carrier.

TimeAdv: Timing advance (0 through 63). TA can be multiplied with 547 meters

(35 km/64 TA steps) to get the distance to the BTS.

PwrLev: Shows which power step/level the phone is transmitting at (see section

below on power control)

DTX: Discontinuous transmission, a feature used to save battery and reduce

network traffic.

MCC: Mobile Country Code. 238=Denmark

MNC: Mobile Network Code. 1=Tele Denmark, 2=Sonofon (these are the ones for

the MCC 238).

LAC: Local Area Code. (not sure, but I could imagine it being the BSC

identity).

CellID: A unique number that identifies the cell. (BTS identity)

T3212: Time between periodic network updates. Appears to be fixed (010 for

Tele Denmark and 050 for Sonofon).

——————————————————————————–

POWER CONTROL:

To minimize co-channel interference and to conserve power, both the mobiles and

the Base Transceiver Stations operate at the lowest power level that will

maintain an acceptable signal quality. Power levels can be stepped up or down

in steps of 2 db from the peak power for the class down to a minimum of 13 dBm

(20 milliwatts).

Use this table to translate between dBm, PwrLev, and Power:

+–+—-+–+—+—+–+—+—+—+—-+—+—-+—-+—-+—-+—-+

Power Level| 0| 1| 2| 3| 4| 5| 6| 7| 8| 9 | 10| 11| 12| 13| 14| 15|

+–+—-+–+—+—+–+—+—+—+—-+—+—-+—-+—-+—-+—-+

dBm|43| 41|39| 37| 35|33| 31| 29| 27| 25| 23| 21| 19| 17| 15| 13|

+–+—-+–+—+—+–+—+—+—+—-+—+—-+—-+—-+—-+—-+

Watts|16|12.8| 8|5.2|3.2| 2|1.3|0.8|0.5|0.32|0.2|0.13|0.08|0.05|0.03|0.02|

+–+—-+–+—+—+–+—+—+—+—-+—+—-+—-+—-+—-+—-+

If you can help out with deciphering the readouts, additional sequences or

corrections please feel free to contact Janus Krarup at jckrarup@post1.com.

——————————————————————————–

Security Codes on the GSM phones:

The phones are protected by two codes:

The UNLOCK code which consists of 4 digits (default 1234)

This is changed by typing MENU 51 and providing the security code. You can type

in wrong codes until you hit the right one.

The SECURITY code which consists of 6 digits (default 000000)

This is changed by typing MENU 54 and providing the old code. Again, you can

keep hitting bogus codes all day until you get the right one (hope you got

some time to kill).

The SIM card is protected by 2 codes:

The PIN code (Personal Identification Number) which consists of 4 to 8 digits.

The PIN code can only be typed in wrong 3 times (you heard right…3). After

this the SIM card will be blocked until the PUK code is used. The PIN code is

user definable. It can be changed by providing the old PIN code or the PUK

code. There is a menu for changing the PIN code by providing the old one, but

you can also type **04* in order to do so. To enter a whole new PIN on a

blocked card or without knowing the old PIN, you need to use **05* PUK (OK)

NEWPIN (OK) NEWPIN (OK)

The PUK code (Personal Unblocking Key) consists of 8 digits.

This is set by the network provider and can not be changed. If entered wrongly

10 times, the card will become permanently blocked and will need to be replaced.

——————————————————————————–

Undocumented Menu shortcuts (7500, 8200, and maybe the 5200 and 7200)

Menu + XX

11 Status Review

13 Available networks

14 Preferred networks

21 Incoming call alert

22 Select keypad tones

25 Require SIM card PIN

26 Language selection

32 Repetitive timer

33 Single alert timer

34 Show meter during calls

35 Resettable call meters

36 Resettable call meters

37 Set call cost rates

38 Reset all meters

41 Keypad dialing (call restrictions)

43 Restrict incoming calls

44 Phone number length

51 Change unlock code

52 Master reset

53 Master clear

54 New security code

55 Automatic lock

63 Battery saving mode

——————————————————————————–

Test Mode Functions:

3 MENU-phone book

4 MENU-messages

5 mute on/off (menu during call)

6 MENU-Call related features

7 MENU-“arrows”

8 select phone line

9 last ten calls

10 restrict my phone number

11 call diverting

12 divert when available

13 Detailed diverting

14 Divert voice calls

15 Divert ALL voice calls

16 If Busy

17 If no answer

18 If not reachable

19 Divert fax calls

20 Divert Data calls

21 Cancel all diverting

22 Call waiting

23 Call barring

24 Bar outgoing calls

25 Bar incoming calls

26 Change Barr password

27 Call restrictions

28 Restrict incoming calls

29 Phone number length

30 Keypad dialing

31 Call voicemail

32 Received messages

33 Cell broadcast

34 Message settings

35 Message alert tone

36 Voicemail number

37 Incoming call alert

38 No alert

39 Vibrate only

40 Adjust ring volume

41 Lock now

42 Automatic lock

43 Change unlock code

44 Require SIM card PIN

45 Change SIM PIN code

46 New security code

47 Extended menus

48 Language selection

49 Automatic (Language Selection)_

50 Change greeting

51 Battery saving mode

52 Select keypad tones

53 Phone status

54 Status review

55 Master reset

56 Master clear

57 Available networks

58 Network search

59 Registration preferences

60 Frequency of search

61 Preferred networks

62 Add network to list

63 Show list of networks

64 Find new network

65 Show last call

66 Resettable call timers

67 Set audible call timers

68 Single alert timers

69 Repetitive timer

70 **1 = register write lock!!!

71 Show meter during calls

72 Set meter format

73 Set call cost rates

74 Lifetime meter

81 Find entry by name

82 Find entry by location

83 Show services

84 Enter my phone number

85 Show my phone number

86 Add entry

87 Check phone capacity

88 Check SIM capacity

89 Prevent access

90 Edit name (my phone number)

91 Edit number (my phone number)

92 MENU – Call related features

93 MENU – Phone setup

94 MENU – Network selection

95 MENU – Call meters

99 Periodic search

100 Continuous search

101 Slow search

102 Medium search

103 Fast search

104 MENU – Phonebook

105 MENU – Phonebook

106 MENU – Messages

107 MENU – Messages

108 Copy SIM memory

110 Edit number (direct dial key)

111 Edit name (direct dial key)

112 Direct dial key

113 MENU – Eng Field Options

126 erase all numbers (last 10)

ATTENTION: These are but a few of the possible commands. There are 1000

possibilities! Please attempt to find more. And if you do, Email

me to keep this list as accurate as possible.

I know that an add-on setup menu exists. This is used when the phone is

connected to a hands-free car kit.

The HF-setup menu should contain 5 choices: turn off radio/aut. HF answer/aut.

HF/security timer/external alert.

If you have an HF kit, please help me to complete the list (I suspect the menus

to have the numbers from 75 to 80).

Again all correspondence about this entire GSM section should be addressed to

jckrarup@post1.com. He’s the GSM guy. I’ve never used a GSM phone. -MikEY

H*A*C*K*I*N*G***T*H*E***F*O*V*C********************************S*E*C*T*I*O*N***6

Note: This is NOT my hack. Thanks to Patrk@delphi.com for this addition.

HACKING THE FOVC

Problem: When listening to something interesting (a conversation),

just when that sexy sounding horny broad begins to give her

phone number to some lucky guy, HANDOFF!!! then static… DAMN!

Trick: Hack the FOVC.

a quick definition: FOVC = FOward Voice Channel

FOCC = FOward Control Channel

REVC = REverse Voice Channel

RECC = REverse Control Channel

As the phone travels through cells, the FOVC is where the tower tells

the phone to adjust power levels for the current cell or to change to

a new channel for use in the new cell. This info can be hacked apart.

So. When you’ve found a good conversation, don’t be lazy! Enter 40#!

This makes the phone listen for commands on the voice channel

(embedded in the audio portion- you can hear it as a “bump” sound). It

will just sit there and the display will read ’40’ , but the

conversation will still be audible. Now when the phone receives a

FOVC command (a 40 bit sequence) data will flow across the display, in

hex format, and stop. Listen to the phone, if the conversation is

still there, then the command was only to adjust power levels. If the

conversation is gone, then its a handoff. If you only got a power

adjustment command just press # or clr, which ever gets you back to

the ‘ prompt. Enter 40# and keep listening. You can also use the # key

to cancel the 40# command, if you want to change channels or something.

If it was a handoff, its time for some quick math. You have to convert

some of the numbers to binary, and then to decimal. I don’t know how

many characters your phone’s display will show. Mine only shows the

last seven of the ten hex digits. Count left from the end 6 digits.

Write down that digit and the next two on a piece of paper, i.e.:

???j16djjj j=junk numbers (hex numbers range from 0-9,a-f)

/ \

these are lost due to scrolling

write down 16d then convert it to a binary string:

1 = 0001

6 = 0110

d = 1101 (d=13)

now you have a binary string like this: 000101101101

throw away the first 2 bits and get: 0101101101

convert this to decimal and get: 365

365 is the new channel the conversation has moved to! Enter 110365#

and voila! You too, can hear the horny babe’s phone number!

Don’t forget to enter 40# again, as the call may be moving quickly

through cells ( small cells or freeway driving ) or the call can get

bounced around by the tower for cell traffic purposes.

Here’s one more example of the hex>binary>decimal conversion.

???j5aejjj

5 = 0101

a = 1010

e = 1110

full string = 010110101110

truncate 2 msb = 0110101110

convert to decimal = 430

R*E*A*D*I*N*G***T*H*E***S*I*D**********************************S*E*C*T*I*O*N***7

READING THE SID by Doctor Who (drwho@l0pht.com)

The SID (System IDentification) of a control channel can be determined using

the test mode of the Motorola cellular phone. This document assumes the

reader understands cellular technology in general, and how to access

Motorola’s test mode in specific.

Tune the phone to the desired control channel with 11xxxx# where xxxx is the

channel number. Hit 39# to receive one control channel word. One should

appear in less than two seconds, filling up all ten digits on the display with

hexadecimal digits. Do this repeatedly until one is found with the correct

pattern. Digit places start at the left hand side and go to the right.

The first digit should be C,D,E, or F. This letter can be used to determine

the DCC/SAT of the cell. A “C” is SAT 0, D is 1, E is 2, and F is 3. Ignore

digits 8,9, and 10. They are parity bytes. Digit 7 should be “6” or “E”,

though I have never found it to be other than “E”. The hexadecimal value of

represented by digits 2 through 5 is then divided by two, and then 1 added if

the carrier as an “A” side, “non-wireline” carrier. The result is the system

ID.

for example:

E00388EA08

E means this cell has an SAT/DCC of 3. The A08 is ignored. The E to the left

of it is proper and normal, so this is the right kind of message. Ignore the

8 in position 6, that is just to the left E. 0038 in hexadecimal translates

((3*16=48)+8) to 56. 56/2=28. Looking up System ID 28 on my chart indicates

Nynex in Boston. This is correct.

Please be aware that the two SID charts I have seen around the net are very

outdated. I have a more recent version on paper which I may eventually type

in, when I have the time and energy.

The methods used above are only a very crude way to do what could be done much

more efficiently by computer. I am sure that programs will be written to do

exactly this, but I am holding off until I have thoroughly hacked the meaning

of all these types of message before writing such a program. I am also

contemplating the design of a cable to replace the handset, running from the

25 pin connector on the side of my bag phone to a computer.

———=?> Doctor Who <?=——–

P*H*O*N*E***P*I*N*-*O*U*T*S************************************S*E*C*T*I*O*N***8

Before going into the cable specs, here are the pin-outs to all phones as of

now (in the US). A very special thanks go to Motorola for faxing me the new

Ultra Classic II pin-outs!

——————————————————————————–

15 pin cable pinouts

PIN DESIGNATION/FUNCTION

1 Battery A+, red wire

2 Transmit Audio / ON-OFF Function, a shared line between Audio (AC) and

ground. This line will toggle the ON/OFF status of the telephone.

3 Ground (A+ return), black wire

4 Ignition Sense Lead, green with a black tracer

5 Receiver Audio (RX High), to handset connector pin 8

6 Regulated +9.5 volts, to handset connector pin 2

7 T-Data, one of the 3-wire bus lines, to handset connector pin 3

8 C-Data, one of the 3-wire bus lines, to handset connector pin 4

9 Digital Hands-Free Microphone / Manual Test. When the pin is grounded,

which can be done by shorting the two connectors of the Hands-Free

microphone, the unit is enabled to work in TEST MODE.

10 R-Data, one of the 3-wire bus lines, to handset connector pin 5

11 Handset Logic Ground, to handset connector pin 1

12 Speaker High \

| -> Only on SKN4279A and SKN4277A

13 Speaker Low /

14 Handset Audio Ground, to handset connector pin 6

15 Auxiliary Alert, yellow lead with a black tracer, used to blow the horn

or flash the headlights. Provides a ground for the relay; maximum

current is 1/2 amp. It is *N O T* recommended that this circuit be

used to drive the horn or headlights directly.

——————————————————————————–

25 pin cable pinouts (series 2 and 3 transceivers)

PIN DESIGNATION/FUNCTION

1 Transmit Audio/ON – OFF Function

2 Mobile/Transportable Select Line

3 Ground (A + return), one of 2 black wires. Both are required for proper

operation

4 Battery A +, one of 2 red wires. Both are required for proper operation.

5 Ignition Sense Lead, green with red tracer

6 Receiver audio to handset (RX High), pin 8 on the handset connector

7 Ground

8 Regulated +9.5 volts to handset, pin 2 on handset connector

9 Ground

10 Auxiliary Alert, yellow with black tracer, used to blow the horn or

flash the headlights. Provides a ground function. NOTE: 1/2 amps

maximum current. The recommended method is to drive a relay

(e.g. MOT 59K813674). Ignition Sense, pin 5, must be low for this

function to work.

11 T-Data, one of the 3-wire bus lines, to pin 3 of the handset connector

12 C-Data, one of the 3-wire bus lines, to pin 4 of the handset connector

13 Ground

14 Transmit Audio Shield

15 Transmit Audio

16 Battery A+, one of two red wires. Both are required for proper operation

17 Ground, one of two black wires. Both are required for proper operation

18 R-Data, one of the 3-wire bus lines, to pin 5 of the handset connector

19 Receiver audio to external speaker

20 Ground for receiver audio (shield) to external speaker

21 Manual test line. When connected to ground, puts phone in test mode

22 Ground

23 Handset logic ground, to handset connector pin 1

24 Handset audio ground, to handset connector pin 6

25 Accessory ground, to external speaker

——————————————————————————–

OEM 32 pin cable pinouts 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

+———————————————-+

Note: Looking into connector C |* * * * * * * * * * * * * * * *|

on the transceiver with the D |* * * * * * * * * * * * * * * *|

antenna port down. +———————————————-+

Pin# Designation/Function Row C Pin# Designation/Function Row D

1 Battery A+ 1 Not Used

2 Ignition Sense 2 Antenna Drive (for power antenna)

3 Status Display Control 3 Not Used

4 Not Used 4 Auxiliary Alert, used to blow the

horn or flash the headlights

through a relay

5 Ground (A+ Return) 5 Not Used

6 GM Proprietary Serial Data Bus 6 GM proprietary serial bus

7 Audio Ground, from GM Audio bus to 7 Audio Ground (not connected)

telephone

8 Low level audio, from telephone to GM 8 Low Level Audio (not connected)

Audio bus

9 Not used 9 Manual Test Line; when grounded

this line enables TEST MODE

10 Not used 10 RX High

11 Mobile / Transportable select line 11 Ground (TX Shield)

12 Handset Logic Ground 12 Regulated +9.5 volts

13 T-Data, one of the 3-wire bus lines 13 C-Data, one of the 3-wire bus lines

14 R-Data, one of the 3-wire bus lines 14 Audio Ground

15 TX High / ON-OFF 15 Ground (Rx Shield)

16 VSP Microphone High 16 VSP Microphone Ground

——————————————————————————–

Pinouts for the Motorola 8000 brick phone – “N” series

numbering starts on top left 1 2 3 * 4 5 6

7 8 9 * 10 11 12

PIN SIGNAL

* GROUND

1 logic ground

2 not used

3 audio in to phone

4 audio out (and on/off toggle)

5 4.75 Bias

6 Manual test line

7 Ground for audio signals (common)

8 TRU data line

9 not used

10 CMP data line

11 RTN data line

12 ignition sense

——————————————————————————–

CVC BLOCK

[ 1] [ 2] [ 3] [ 4] [ 5] [ 6]

[ 7] [ 8] [ 9] [10] [11] [12]

1 VSP Enable 7 GROUND

2 SPKR Enable 8 S TRU

3 TX HI on/off 9 AUX Alert

4 RX HI 10 S CMP

5 RX HI OPT 11 S RTN

6 MAN TEST 12 IGN

——————————————————————————–

Flip Fones and all fones using the dpc/pt flip cable

J3 Pin Function

1 2 3 4 5 6 7 8 + G – 1 Logic Ground

| | | | | | | | | | | 2 Ext. 7.5V

3 TRU

4 CMP

(looking at back of phone with battery removed) 5 RTN

6 Audio Ground

7 RX Audio OUT (spkr)

8 TX Audio IN (mic)

——————————————————————————–

New External Connector for the Ultra Classic II CVC Pinblocks

\

\

\

\

[] [] \ Pin Designation/Function

\ \

+————————-+ 1 Regulated 8 volts

| 12 10 8 6 4 2 | 3 ext. switched A+ enable

| – – – – – – | 5 ext. spkr/mic enable

| O | 7 TX hi – on/off

| – – – – – – | 9 T Data

\ | 11 9 7 5 3 1 | 11 R Data

+————————-+

| 2 Audio Ground

PHONE / 4 manual test

6 ignition / charger B+

8 RX hi

10 C Data

12 logic ground

C*A*B*L*E***S*P*E*C*S******************************************S*E*C*T*I*O*N***9

OK OK OK. Here are the cable specs. They are 100% correct. Of course I

wouldn’t know because these are for information purposes only. I have been

told however by VERY reliable sources that they are guaranteed, 100%, GRADE-A,

correct. If they don’t work for you, you did something wrong.

——————————————————————————–

Cable Instructions for the bag phones (thanks Jakey)

phone (female 25 pin) computer (male 25 pin) (parallel port)

18 ———————– 1

21 ———————– 2

1 ———————— 4 Below are 10K ohm resistors

12 ———————– 12 —-/\/\/—-.

11 ———————– 13 —-/\/\/—-+

4,5,8 ————————————-‘

2,3,17,20—————– 18 — Ground/black wire (-12 Volts)

16 —————————— Positive/yellow wire (+12 volts)

By the way, Jakey told me to remind you that the handset can NOT be plugged in

while this cable is hooked up.

——————————————————————————–

Motorola Cellphone cable construction for flips

————————————-

DB25 FLIP Battery Eliminator cable

—- —- attachment pins up:

1(——–)4

——–=

2(–|<—-)Jump this line to the Center 1 =

Pin on the back of phone. ——–=

=

4(–|<—-)1 “|<” is the IN4001 diode. ——–=

=

12(——–)5 ——–=

4 = –>To phone

13(——–)6 ——–=

5 =

18-25(-+——)8 ——–=

| 6 =

| +-)7 ——–=

| | 7* =

| | ——–=

| | 8* =

NeG PoS —Cig adapter ——–=

DB25 Male Phone Power Connector

(see Note 1)

1-To phone pin 4 1-DB25 pin 4(see note 2) Gnd-To Db25 Pins 18-25 and

2-To Phone test lead 2-NC Phone pin 8

(see note 2)

3-NC 3-NC Tip-To phone pin 7

4-To phone pin 1 4-To DB25 pin 1

(see note 2)

5-NC 5-To DB25 pin 12

6-NC 6-To DB25 pin 13

7-NC 7-To tip on power connector

8-NC 8-GND

9-NC Test Lead-To DB25 pin 2 (See note 2)

10-NC

11-NC

12-To Phone pin 5

13-To Phone pin 6

14-NC

15-NC

16-NC

17-NC

18-GND \

19-GND |

20-GND |

21-GND |–Conn together to GND on 12v conn

22-GND | And pin 8 on phone plug

23-GND |

24-GND |

25-GND /

NOTE 1:

The power adapter on the cable is 12 volt input but is a regulated

7.95 volts out. DO NOT connect 12 volts between pins 7 and 8 on the

phone connector.

NOTE 2:

| /|

DB25 Pin 4—–| < |——Phone pin 1

| \|

| /|

DB25 Pin 2—–| < |——Phone test lead

| \|

——————————————————————————–

Motorola Transceivers

_____________________

4500x,4800x,6800x,Etc.

______________________

Female 25 Pin Male 25 Pin

D-Connector D-connector

To transceiver To P.C.Parallel Port

Pin Pin

1._____________________________________ 4.

2._____________________________________ 18.

___10k______ 13.

/

______4+5._______________________/____10K______ 12.

| 12.____________________________________/

| 11._____________________________________ 13.

| 18._____________________________________ 1.

| 21._____________________________________ 2.

| ___14+17+20+23.____________________________ 18.

| |

| |___ -ve

|

|________ +ve 9 Volt

——————————————————————————–

Motorola 8500x 8800x(early type)

________________________________

25 Pin D-plug(P.C.lpt1) Phone Back(battery removed)

Pin Diodes [] [] [] [] [] []

3.–orange-|<1n4001———————/ / /

4.–blue—|<1n4001—————————-/ /

2.–red—-|<1n4001—————————————/

19.————-\

20.———–\ | [] [] [] [] [] []

18.–black—-+-+————/ / / /

13.–yellow———————–/ / /

12.–brown————————————/ /

1.–gray——————————————-/

[] []

-8 to -12V. +8 to =12V.

NOTE Diode protocol: Cathode—|<diode—Anode

C*H*A*N*N*E*L***N*U*M*B**E*R***V*S*.***F*R*E*Q*U*E*N*C*Y*****S*E*C*T*I*O*N***1*0

Frequency Range for 666 Channels: Reverse (Mobile TX) 825.020 – 844.990 MHz

Forward (Mobile RX) 870.020 – 889.990 MHz

Frequency Range for 832 and 2412 Channels:

Reverse (Mobile TX) 824.030 – 848.980 MHz

Forward (Mobile RX) 869.030 – 893.980 MHz

Frequency Calculation for Channels 1-799:

Reverse (Mobile TX) Frequency = 825.00 MHz + (Ch.# X .030 MHz)

Forward (Mobile RX) Frequency = 870.00 MHz + (Ch.# X .030 MHz)

Frequency Calculation for Channels 991-1023:

Reverse (Mobile TX) Frequency = 825.00 MHz – [.030 MHz X (1023 – Ch.#)]

Forward (Mobile RX) Frequency = 870.00 MHz – [.030 MHz X (1023 – Ch.#)]

To determine the center frequency of an associated NAMPS sub-channel in these

formulas, subtract 10 kHz from the result for the low sub-channel, leave the

result as is for the center sub-channel, and add 10 kHz to the result for the

high sub-channel.

——————————————————————————–

The following text I took from the Poisoned Pen BBS (Hi guys). Thanks Jakey

for taking the time to decipher all of this shit. As far as I know, with

the exception of a post on #cellular and the upload to Poisoned Pen, there is

nothing in print with this compilation. Again, special thanks go to Jakey

(jbs@mcs.net) for the long, seemingly endless work.

CELLULAR PHONE FREQUENCIES AND MOTOROLA

TEST MODE NUMERIC CODES.

( Motorola test mode channel numbers )

( are for use in Motorola test mode )

( with function 11xxxx# )

( All frequencies in Megahertz FM )

Lower Set (1-666)

Tower Freq. Mobile Freq. 11xxxx# Channel

Tx 870.03 Rx 825.03 Chan 0001 #1

Tx 870.06 Rx 825.06 Chan 0002 #2

Tx 870.09 Rx 825.09 Chan 0003 #3

Tx 870.12 Rx 825.12 Chan 0004 #4

Tx 870.15 Rx 825.15 Chan 0005 #5

Tx 870.18 Rx 825.18 Chan 0006 #6

Tx 870.21 Rx 825.21 Chan 0007 #7

Tx 870.24 Rx 825.24 Chan 0008 #8

Tx 870.27 Rx 825.27 Chan 0009 #9

Tx 870.30 Rx 825.30 Chan 0010 #10

Tx 870.33 Rx 825.33 Chan 0011 #11

Tx 870.36 Rx 825.36 Chan 0012 #12

Tx 870.39 Rx 825.39 Chan 0013 #13

Tx 870.42 Rx 825.42 Chan 0014 #14

Tx 870.45 Rx 825.45 Chan 0015 #15

Tx 870.48 Rx 825.48 Chan 0016 #16

Tx 870.51 Rx 825.51 Chan 0017 #17

Tx 870.54 Rx 825.54 Chan 0018 #18

Tx 870.57 Rx 825.57 Chan 0019 #19

Tx 870.60 Rx 825.60 Chan 0020 #20

Tx 870.63 Rx 825.63 Chan 0021 #21

Tx 870.66 Rx 825.66 Chan 0022 #22

Tx 870.69 Rx 825.69 Chan 0023 #23

Tx 870.72 Rx 825.72 Chan 0024 #24

Tx 870.75 Rx 825.75 Chan 0025 #25

Tx 870.78 Rx 825.78 Chan 0026 #26

Tx 870.81 Rx 825.81 Chan 0027 #27

Tx 870.84 Rx 825.84 Chan 0028 #28

Tx 870.87 Rx 825.87 Chan 0029 #29

Tx 870.90 Rx 825.90 Chan 0030 #30

Tx 870.93 Rx 825.93 Chan 0031 #31

Tx 870.96 Rx 825.96 Chan 0032 #32

Tx 870.99 Rx 825.99 Chan 0033 #33

Tx 871.02 Rx 826.02 Chan 0034 #34

Tx 871.05 Rx 826.05 Chan 0035 #35

Tx 871.08 Rx 826.08 Chan 0036 #36

Tx 871.11 Rx 826.11 Chan 0037 #37

Tx 871.14 Rx 826.14 Chan 0038 #38

Tx 871.17 Rx 826.17 Chan 0039 #39

Tx 871.20 Rx 826.20 Chan 0040 #40

Tx 871.23 Rx 826.23 Chan 0041 #41

Tx 871.26 Rx 826.26 Chan 0042 #42

Tx 871.29 Rx 826.29 Chan 0043 #43

Tx 871.32 Rx 826.32 Chan 0044 #44

Tx 871.35 Rx 826.35 Chan 0045 #45

Tx 871.38 Rx 826.38 Chan 0046 #46

Tx 871.41 Rx 826.41 Chan 0047 #47

Tx 871.44 Rx 826.44 Chan 0048 #48

Tx 871.47 Rx 826.47 Chan 0049 #49

Tx 871.50 Rx 826.50 Chan 0050 #50

Tx 871.53 Rx 826.53 Chan 0051 #51

Tx 871.56 Rx 826.56 Chan 0052 #52

Tx 871.59 Rx 826.59 Chan 0053 #53

Tx 871.62 Rx 826.62 Chan 0054 #54

Tx 871.65 Rx 826.65 Chan 0055 #55

Tx 871.68 Rx 826.68 Chan 0056 #56

Tx 871.71 Rx 826.71 Chan 0057 #57

Tx 871.74 Rx 826.74 Chan 0058 #58

Tx 871.77 Rx 826.77 Chan 0059 #59

Tx 871.80 Rx 826.80 Chan 0060 #60

Tx 871.83 Rx 826.83 Chan 0061 #61

Tx 871.86 Rx 826.86 Chan 0062 #62

Tx 871.89 Rx 826.89 Chan 0063 #63

Tx 871.92 Rx 826.92 Chan 0064 #64

Tx 871.95 Rx 826.95 Chan 0065 #65

Tx 871.98 Rx 826.98 Chan 0066 #66

Tx 872.01 Rx 827.01 Chan 0067 #67

Tx 872.04 Rx 827.04 Chan 0068 #68

Tx 872.07 Rx 827.07 Chan 0069 #69

Tx 872.10 Rx 827.10 Chan 0070 #70

Tx 872.13 Rx 827.13 Chan 0071 #71

Tx 872.16 Rx 827.16 Chan 0072 #72

Tx 872.19 Rx 827.19 Chan 0073 #73

Tx 872.22 Rx 827.22 Chan 0074 #74

Tx 872.25 Rx 827.25 Chan 0075 #75

Tx 872.28 Rx 827.28 Chan 0076 #76

Tx 872.31 Rx 827.31 Chan 0077 #77

Tx 872.34 Rx 827.34 Chan 0078 #78

Tx 872.37 Rx 827.37 Chan 0079 #79

Tx 872.40 Rx 827.40 Chan 0080 #80

Tx 872.43 Rx 827.43 Chan 0081 #81

Tx 872.46 Rx 827.46 Chan 0082 #82

Tx 872.49 Rx 827.49 Chan 0083 #83

Tx 872.52 Rx 827.52 Chan 0084 #84

Tx 872.55 Rx 827.55 Chan 0085 #85

Tx 872.58 Rx 827.58 Chan 0086 #86

Tx 872.61 Rx 827.61 Chan 0087 #87

Tx 872.64 Rx 827.64 Chan 0088 #88

Tx 872.67 Rx 827.67 Chan 0089 #89

Tx 872.70 Rx 827.70 Chan 0090 #90

Tx 872.73 Rx 827.73 Chan 0091 #91

Tx 872.76 Rx 827.76 Chan 0092 #92

Tx 872.79 Rx 827.79 Chan 0093 #93

Tx 872.82 Rx 827.82 Chan 0094 #94

Tx 872.85 Rx 827.85 Chan 0095 #95

Tx 872.88 Rx 827.88 Chan 0096 #96

Tx 872.91 Rx 827.91 Chan 0097 #97

Tx 872.94 Rx 827.94 Chan 0098 #98

Tx 872.97 Rx 827.97 Chan 0099 #99

Tx 873.00 Rx 828.00 Chan 0100 #100

Tx 873.03 Rx 828.03 Chan 0101 #101

Tx 873.06 Rx 828.06 Chan 0102 #102

Tx 873.09 Rx 828.09 Chan 0103 #103

Tx 873.12 Rx 828.12 Chan 0104 #104

Tx 873.15 Rx 828.15 Chan 0105 #105

Tx 873.18 Rx 828.18 Chan 0106 #106

Tx 873.21 Rx 828.21 Chan 0107 #107

Tx 873.24 Rx 828.24 Chan 0108 #108

Tx 873.27 Rx 828.27 Chan 0109 #109

Tx 873.30 Rx 828.30 Chan 0110 #110

Tx 873.33 Rx 828.33 Chan 0111 #111

Tx 873.36 Rx 828.36 Chan 0112 #112

Tx 873.39 Rx 828.39 Chan 0113 #113

Tx 873.42 Rx 828.42 Chan 0114 #114

Tx 873.45 Rx 828.45 Chan 0115 #115

Tx 873.48 Rx 828.48 Chan 0116 #116

Tx 873.51 Rx 828.51 Chan 0117 #117

Tx 873.54 Rx 828.54 Chan 0118 #118

Tx 873.57 Rx 828.57 Chan 0119 #119

Tx 873.60 Rx 828.60 Chan 0120 #120

Tx 873.63 Rx 828.63 Chan 0121 #121

Tx 873.66 Rx 828.66 Chan 0122 #122

Tx 873.69 Rx 828.69 Chan 0123 #123

Tx 873.72 Rx 828.72 Chan 0124 #124

Tx 873.75 Rx 828.75 Chan 0125 #125

Tx 873.78 Rx 828.78 Chan 0126 #126

Tx 873.81 Rx 828.81 Chan 0127 #127

Tx 873.84 Rx 828.84 Chan 0128 #128

Tx 873.87 Rx 828.87 Chan 0129 #129

Tx 873.90 Rx 828.90 Chan 0130 #130

Tx 873.93 Rx 828.93 Chan 0131 #131

Tx 873.96 Rx 828.96 Chan 0132 #132

Tx 873.99 Rx 828.99 Chan 0133 #133

Tx 874.02 Rx 829.02 Chan 0134 #134

Tx 874.05 Rx 829.05 Chan 0135 #135

Tx 874.08 Rx 829.08 Chan 0136 #136

Tx 874.11 Rx 829.11 Chan 0137 #137

Tx 874.14 Rx 829.14 Chan 0138 #138

Tx 874.17 Rx 829.17 Chan 0139 #139

Tx 874.20 Rx 829.20 Chan 0140 #140

Tx 874.23 Rx 829.23 Chan 0141 #141

Tx 874.26 Rx 829.26 Chan 0142 #142

Tx 874.29 Rx 829.29 Chan 0143 #143

Tx 874.32 Rx 829.32 Chan 0144 #144

Tx 874.35 Rx 829.35 Chan 0145 #145

Tx 874.38 Rx 829.38 Chan 0146 #146

Tx 874.41 Rx 829.41 Chan 0147 #147

Tx 874.44 Rx 829.44 Chan 0148 #148

Tx 874.47 Rx 829.47 Chan 0149 #149

Tx 874.50 Rx 829.50 Chan 0150 #150

Tx 874.53 Rx 829.53 Chan 0151 #151

Tx 874.56 Rx 829.56 Chan 0152 #152

Tx 874.59 Rx 829.59 Chan 0153 #153

Tx 874.62 Rx 829.62 Chan 0154 #154

Tx 874.65 Rx 829.65 Chan 0155 #155

Tx 874.68 Rx 829.68 Chan 0156 #156

Tx 874.71 Rx 829.71 Chan 0157 #157

Tx 874.74 Rx 829.74 Chan 0158 #158

Tx 874.77 Rx 829.77 Chan 0159 #159

Tx 874.80 Rx 829.80 Chan 0160 #160

Tx 874.83 Rx 829.83 Chan 0161 #161

Tx 874.86 Rx 829.86 Chan 0162 #162

Tx 874.89 Rx 829.89 Chan 0163 #163

Tx 874.92 Rx 829.92 Chan 0164 #164

Tx 874.95 Rx 829.95 Chan 0165 #165

Tx 874.98 Rx 829.98 Chan 0166 #166

Tx 875.01 Rx 830.01 Chan 0167 #167

Tx 875.04 Rx 830.04 Chan 0168 #168

Tx 875.07 Rx 830.07 Chan 0169 #169

Tx 875.10 Rx 830.10 Chan 0170 #170

Tx 875.13 Rx 830.13 Chan 0171 #171

Tx 875.16 Rx 830.16 Chan 0172 #172

Tx 875.19 Rx 830.19 Chan 0173 #173

Tx 875.22 Rx 830.22 Chan 0174 #174

Tx 875.25 Rx 830.25 Chan 0175 #175

Tx 875.28 Rx 830.28 Chan 0176 #176

Tx 875.31 Rx 830.31 Chan 0177 #177

Tx 875.34 Rx 830.34 Chan 0178 #178

Tx 875.37 Rx 830.37 Chan 0179 #179

Tx 875.40 Rx 830.40 Chan 0180 #180

Tx 875.43 Rx 830.43 Chan 0181 #181

Tx 875.46 Rx 830.46 Chan 0182 #182

Tx 875.49 Rx 830.49 Chan 0183 #183

Tx 875.52 Rx 830.52 Chan 0184 #184

Tx 875.55 Rx 830.55 Chan 0185 #185

Tx 875.58 Rx 830.58 Chan 0186 #186

Tx 875.61 Rx 830.61 Chan 0187 #187

Tx 875.64 Rx 830.64 Chan 0188 #188

Tx 875.67 Rx 830.67 Chan 0189 #189

Tx 875.70 Rx 830.70 Chan 0190 #190

Tx 875.73 Rx 830.73 Chan 0191 #191

Tx 875.76 Rx 830.76 Chan 0192 #192

Tx 875.79 Rx 830.79 Chan 0193 #193

Tx 875.82 Rx 830.82 Chan 0194 #194

Tx 875.85 Rx 830.85 Chan 0195 #195

Tx 875.88 Rx 830.88 Chan 0196 #196

Tx 875.91 Rx 830.91 Chan 0197 #197

Tx 875.94 Rx 830.94 Chan 0198 #198

Tx 875.97 Rx 830.97 Chan 0199 #199

Tx 876.00 Rx 831.00 Chan 0200 #200

Tx 876.03 Rx 831.03 Chan 0201 #201

Tx 876.06 Rx 831.06 Chan 0202 #202

Tx 876.09 Rx 831.09 Chan 0203 #203

Tx 876.12 Rx 831.12 Chan 0204 #204

Tx 876.15 Rx 831.15 Chan 0205 #205

Tx 876.18 Rx 831.18 Chan 0206 #206

Tx 876.21 Rx 831.21 Chan 0207 #207

Tx 876.24 Rx 831.24 Chan 0208 #208

Tx 876.27 Rx 831.27 Chan 0209 #209

Tx 876.30 Rx 831.30 Chan 0210 #210

Tx 876.33 Rx 831.33 Chan 0211 #211

Tx 876.36 Rx 831.36 Chan 0212 #212

Tx 876.39 Rx 831.39 Chan 0213 #213

Tx 876.42 Rx 831.42 Chan 0214 #214

Tx 876.45 Rx 831.45 Chan 0215 #215

Tx 876.48 Rx 831.48 Chan 0216 #216

Tx 876.51 Rx 831.51 Chan 0217 #217

Tx 876.54 Rx 831.54 Chan 0218 #218

Tx 876.57 Rx 831.57 Chan 0219 #219

Tx 876.60 Rx 831.60 Chan 0220 #220

Tx 876.63 Rx 831.63 Chan 0221 #221

Tx 876.66 Rx 831.66 Chan 0222 #222

Tx 876.69 Rx 831.69 Chan 0223 #223

Tx 876.72 Rx 831.72 Chan 0224 #224

Tx 876.75 Rx 831.75 Chan 0225 #225

Tx 876.78 Rx 831.78 Chan 0226 #226

Tx 876.81 Rx 831.81 Chan 0227 #227

Tx 876.84 Rx 831.84 Chan 0228 #228

Tx 876.87 Rx 831.87 Chan 0229 #229

Tx 876.90 Rx 831.90 Chan 0230 #230

Tx 876.93 Rx 831.93 Chan 0231 #231

Tx 876.96 Rx 831.96 Chan 0232 #232

Tx 876.99 Rx 831.99 Chan 0233 #233

Tx 877.02 Rx 832.02 Chan 0234 #234

Tx 877.05 Rx 832.05 Chan 0235 #235

Tx 877.08 Rx 832.08 Chan 0236 #236

Tx 877.11 Rx 832.11 Chan 0237 #237

Tx 877.14 Rx 832.14 Chan 0238 #238

Tx 877.17 Rx 832.17 Chan 0239 #239

Tx 877.20 Rx 832.20 Chan 0240 #240

Tx 877.23 Rx 832.23 Chan 0241 #241

Tx 877.26 Rx 832.26 Chan 0242 #242

Tx 877.29 Rx 832.29 Chan 0243 #243

Tx 877.32 Rx 832.32 Chan 0244 #244

Tx 877.35 Rx 832.35 Chan 0245 #245

Tx 877.38 Rx 832.38 Chan 0246 #246

Tx 877.41 Rx 832.41 Chan 0247 #247

Tx 877.44 Rx 832.44 Chan 0248 #248

Tx 877.47 Rx 832.47 Chan 0249 #249

Tx 877.50 Rx 832.50 Chan 0250 #250

Tx 877.53 Rx 832.53 Chan 0251 #251

Tx 877.56 Rx 832.56 Chan 0252 #252

Tx 877.59 Rx 832.59 Chan 0253 #253

Tx 877.62 Rx 832.62 Chan 0254 #254

Tx 877.65 Rx 832.65 Chan 0255 #255

Tx 877.68 Rx 832.68 Chan 0256 #256

Tx 877.71 Rx 832.71 Chan 0257 #257

Tx 877.74 Rx 832.74 Chan 0258 #258

Tx 877.77 Rx 832.77 Chan 0259 #259

Tx 877.80 Rx 832.80 Chan 0260 #260

Tx 877.83 Rx 832.83 Chan 0261 #261

Tx 877.86 Rx 832.86 Chan 0262 #262

Tx 877.89 Rx 832.89 Chan 0263 #263

Tx 877.92 Rx 832.92 Chan 0264 #264

Tx 877.95 Rx 832.95 Chan 0265 #265

Tx 877.98 Rx 832.98 Chan 0266 #266

Tx 878.01 Rx 833.01 Chan 0267 #267

Tx 878.04 Rx 833.04 Chan 0268 #268

Tx 878.07 Rx 833.07 Chan 0269 #269

Tx 878.10 Rx 833.10 Chan 0270 #270

Tx 878.13 Rx 833.13 Chan 0271 #271

Tx 878.16 Rx 833.16 Chan 0272 #272

Tx 878.19 Rx 833.19 Chan 0273 #273

Tx 878.22 Rx 833.22 Chan 0274 #274

Tx 878.25 Rx 833.25 Chan 0275 #275

Tx 878.28 Rx 833.28 Chan 0276 #276

Tx 878.31 Rx 833.31 Chan 0277 #277

Tx 878.34 Rx 833.34 Chan 0278 #278

Tx 878.37 Rx 833.37 Chan 0279 #279

Tx 878.40 Rx 833.40 Chan 0280 #280

Tx 878.43 Rx 833.43 Chan 0281 #281

Tx 878.46 Rx 833.46 Chan 0282 #282

Tx 878.49 Rx 833.49 Chan 0283 #283

Tx 878.52 Rx 833.52 Chan 0284 #284

Tx 878.55 Rx 833.55 Chan 0285 #285

Tx 878.58 Rx 833.58 Chan 0286 #286

Tx 878.61 Rx 833.61 Chan 0287 #287

Tx 878.64 Rx 833.64 Chan 0288 #288

Tx 878.67 Rx 833.67 Chan 0289 #289

Tx 878.70 Rx 833.70 Chan 0290 #290

Tx 878.73 Rx 833.73 Chan 0291 #291

Tx 878.76 Rx 833.76 Chan 0292 #292

Tx 878.79 Rx 833.79 Chan 0293 #293

Tx 878.82 Rx 833.82 Chan 0294 #294

Tx 878.85 Rx 833.85 Chan 0295 #295

Tx 878.88 Rx 833.88 Chan 0296 #296

Tx 878.91 Rx 833.91 Chan 0297 #297

Tx 878.94 Rx 833.94 Chan 0298 #298

Tx 878.97 Rx 833.97 Chan 0299 #299

Tx 879.00 Rx 834.00 Chan 0300 #300

Tx 879.03 Rx 834.03 Chan 0301 #301

Tx 879.06 Rx 834.06 Chan 0302 #302

Tx 879.09 Rx 834.09 Chan 0303 #303

Tx 879.12 Rx 834.12 Chan 0304 #304

Tx 879.15 Rx 834.15 Chan 0305 #305

Tx 879.18 Rx 834.18 Chan 0306 #306

Tx 879.21 Rx 834.21 Chan 0307 #307

Tx 879.24 Rx 834.24 Chan 0308 #308

Tx 879.27 Rx 834.27 Chan 0309 #309

Tx 879.30 Rx 834.30 Chan 0310 #310

Tx 879.33 Rx 834.33 Chan 0311 #311

Tx 879.36 Rx 834.36 Chan 0312 #312

Tx 879.39 Rx 834.39 Chan 0313 #313

Tx 879.42 Rx 834.42 Chan 0314 #314

Tx 879.45 Rx 834.45 Chan 0315 #315

Tx 879.48 Rx 834.48 Chan 0316 #316

Tx 879.51 Rx 834.51 Chan 0317 #317

Tx 879.54 Rx 834.54 Chan 0318 #318

Tx 879.57 Rx 834.57 Chan 0319 #319

Tx 879.60 Rx 834.60 Chan 0320 #320

Tx 879.63 Rx 834.63 Chan 0321 #321

Tx 879.66 Rx 834.66 Chan 0322 #322

Tx 879.69 Rx 834.69 Chan 0323 #323

Tx 879.72 Rx 834.72 Chan 0324 #324

Tx 879.75 Rx 834.75 Chan 0325 #325

Tx 879.78 Rx 834.78 Chan 0326 #326

Tx 879.81 Rx 834.81 Chan 0327 #327

Tx 879.84 Rx 834.84 Chan 0328 #328

Tx 879.87 Rx 834.87 Chan 0329 #329

Tx 879.90 Rx 834.90 Chan 0330 #330

Tx 879.93 Rx 834.93 Chan 0331 #331

Tx 879.96 Rx 834.96 Chan 0332 #332

Tx 879.99 Rx 834.99 Chan 0333 #333

Tx 880.02 Rx 835.02 Chan 0334 #334

Tx 880.05 Rx 835.05 Chan 0335 #335

Tx 880.08 Rx 835.08 Chan 0336 #336

Tx 880.11 Rx 835.11 Chan 0337 #337

Tx 880.14 Rx 835.14 Chan 0338 #338

Tx 880.17 Rx 835.17 Chan 0339 #339

Tx 880.20 Rx 835.20 Chan 0340 #340

Tx 880.23 Rx 835.23 Chan 0341 #341

Tx 880.26 Rx 835.26 Chan 0342 #342

Tx 880.29 Rx 835.29 Chan 0343 #343

Tx 880.32 Rx 835.32 Chan 0344 #344

Tx 880.35 Rx 835.35 Chan 0345 #345

Tx 880.38 Rx 835.38 Chan 0346 #346

Tx 880.41 Rx 835.41 Chan 0347 #347

Tx 880.44 Rx 835.44 Chan 0348 #348

Tx 880.47 Rx 835.47 Chan 0349 #349

Tx 880.50 Rx 835.50 Chan 0350 #350

Tx 880.53 Rx 835.53 Chan 0351 #351

Tx 880.56 Rx 835.56 Chan 0352 #352

Tx 880.59 Rx 835.59 Chan 0353 #353

Tx 880.62 Rx 835.62 Chan 0354 #354

Tx 880.65 Rx 835.65 Chan 0355 #355

Tx 880.68 Rx 835.68 Chan 0356 #356

Tx 880.71 Rx 835.71 Chan 0357 #357

Tx 880.74 Rx 835.74 Chan 0358 #358

Tx 880.77 Rx 835.77 Chan 0359 #359

Tx 880.80 Rx 835.80 Chan 0360 #360

Tx 880.83 Rx 835.83 Chan 0361 #361

Tx 880.86 Rx 835.86 Chan 0362 #362

Tx 880.89 Rx 835.89 Chan 0363 #363

Tx 880.92 Rx 835.92 Chan 0364 #364

Tx 880.95 Rx 835.95 Chan 0365 #365

Tx 880.98 Rx 835.98 Chan 0366 #366

Tx 881.01 Rx 836.01 Chan 0367 #367

Tx 881.04 Rx 836.04 Chan 0368 #368

Tx 881.07 Rx 836.07 Chan 0369 #369

Tx 881.10 Rx 836.10 Chan 0370 #370

Tx 881.13 Rx 836.13 Chan 0371 #371

Tx 881.16 Rx 836.16 Chan 0372 #372

Tx 881.19 Rx 836.19 Chan 0373 #373

Tx 881.22 Rx 836.22 Chan 0374 #374

Tx 881.25 Rx 836.25 Chan 0375 #375

Tx 881.28 Rx 836.28 Chan 0376 #376

Tx 881.31 Rx 836.31 Chan 0377 #377

Tx 881.34 Rx 836.34 Chan 0378 #378

Tx 881.37 Rx 836.37 Chan 0379 #379

Tx 881.40 Rx 836.40 Chan 0380 #380

Tx 881.43 Rx 836.43 Chan 0381 #381

Tx 881.46 Rx 836.46 Chan 0382 #382

Tx 881.49 Rx 836.49 Chan 0383 #383

Tx 881.52 Rx 836.52 Chan 0384 #384

Tx 881.55 Rx 836.55 Chan 0385 #385

Tx 881.58 Rx 836.58 Chan 0386 #386

Tx 881.61 Rx 836.61 Chan 0387 #387

Tx 881.64 Rx 836.64 Chan 0388 #388

Tx 881.67 Rx 836.67 Chan 0389 #389

Tx 881.70 Rx 836.70 Chan 0390 #390

Tx 881.73 Rx 836.73 Chan 0391 #391

Tx 881.76 Rx 836.76 Chan 0392 #392

Tx 881.79 Rx 836.79 Chan 0393 #393

Tx 881.82 Rx 836.82 Chan 0394 #394

Tx 881.85 Rx 836.85 Chan 0395 #395

Tx 881.88 Rx 836.88 Chan 0396 #396

Tx 881.91 Rx 836.91 Chan 0397 #397

Tx 881.94 Rx 836.94 Chan 0398 #398

Tx 881.97 Rx 836.97 Chan 0399 #399

Tx 882.00 Rx 837.00 Chan 0400 #400

Tx 882.03 Rx 837.03 Chan 0401 #401

Tx 882.06 Rx 837.06 Chan 0402 #402

Tx 882.09 Rx 837.09 Chan 0403 #403

Tx 882.12 Rx 837.12 Chan 0404 #404

Tx 882.15 Rx 837.15 Chan 0405 #405

Tx 882.18 Rx 837.18 Chan 0406 #406

Tx 882.21 Rx 837.21 Chan 0407 #407

Tx 882.24 Rx 837.24 Chan 0408 #408

Tx 882.27 Rx 837.27 Chan 0409 #409

Tx 882.30 Rx 837.30 Chan 0410 #410

Tx 882.33 Rx 837.33 Chan 0411 #411

Tx 882.36 Rx 837.36 Chan 0412 #412

Tx 882.39 Rx 837.39 Chan 0413 #413

Tx 882.42 Rx 837.42 Chan 0414 #414

Tx 882.45 Rx 837.45 Chan 0415 #415

Tx 882.48 Rx 837.48 Chan 0416 #416

Tx 882.51 Rx 837.51 Chan 0417 #417

Tx 882.54 Rx 837.54 Chan 0418 #418

Tx 882.57 Rx 837.57 Chan 0419 #419

Tx 882.60 Rx 837.60 Chan 0420 #420

Tx 882.63 Rx 837.63 Chan 0421 #421

Tx 882.66 Rx 837.66 Chan 0422 #422

Tx 882.69 Rx 837.69 Chan 0423 #423

Tx 882.72 Rx 837.72 Chan 0424 #424

Tx 882.75 Rx 837.75 Chan 0425 #425

Tx 882.78 Rx 837.78 Chan 0426 #426

Tx 882.81 Rx 837.81 Chan 0427 #427

Tx 882.84 Rx 837.84 Chan 0428 #428

Tx 882.87 Rx 837.87 Chan 0429 #429

Tx 882.90 Rx 837.90 Chan 0430 #430

Tx 882.93 Rx 837.93 Chan 0431 #431

Tx 882.96 Rx 837.96 Chan 0432 #432

Tx 882.99 Rx 837.99 Chan 0433 #433

Tx 883.02 Rx 838.02 Chan 0434 #434

Tx 883.05 Rx 838.05 Chan 0435 #435

Tx 883.08 Rx 838.08 Chan 0436 #436

Tx 883.11 Rx 838.11 Chan 0437 #437

Tx 883.14 Rx 838.14 Chan 0438 #438

Tx 883.17 Rx 838.17 Chan 0439 #439

Tx 883.20 Rx 838.20 Chan 0440 #440

Tx 883.23 Rx 838.23 Chan 0441 #441

Tx 883.26 Rx 838.26 Chan 0442 #442

Tx 883.29 Rx 838.29 Chan 0443 #443

Tx 883.32 Rx 838.32 Chan 0444 #444

Tx 883.35 Rx 838.35 Chan 0445 #445

Tx 883.38 Rx 838.38 Chan 0446 #446

Tx 883.41 Rx 838.41 Chan 0447 #447

Tx 883.44 Rx 838.44 Chan 0448 #448

Tx 883.47 Rx 838.47 Chan 0449 #449

Tx 883.50 Rx 838.50 Chan 0450 #450

Tx 883.53 Rx 838.53 Chan 0451 #451

Tx 883.56 Rx 838.56 Chan 0452 #452

Tx 883.59 Rx 838.59 Chan 0453 #453

Tx 883.62 Rx 838.62 Chan 0454 #454

Tx 883.65 Rx 838.65 Chan 0455 #455

Tx 883.68 Rx 838.68 Chan 0456 #456

Tx 883.71 Rx 838.71 Chan 0457 #457

Tx 883.74 Rx 838.74 Chan 0458 #458

Tx 883.77 Rx 838.77 Chan 0459 #459

Tx 883.80 Rx 838.80 Chan 0460 #460

Tx 883.83 Rx 838.83 Chan 0461 #461

Tx 883.86 Rx 838.86 Chan 0462 #462

Tx 883.89 Rx 838.89 Chan 0463 #463

Tx 883.92 Rx 838.92 Chan 0464 #464

Tx 883.95 Rx 838.95 Chan 0465 #465

Tx 883.98 Rx 838.98 Chan 0466 #466

Tx 884.01 Rx 839.01 Chan 0467 #467

Tx 884.04 Rx 839.04 Chan 0468 #468

Tx 884.07 Rx 839.07 Chan 0469 #469

Tx 884.10 Rx 839.10 Chan 0470 #470

Tx 884.13 Rx 839.13 Chan 0471 #471

Tx 884.16 Rx 839.16 Chan 0472 #472

Tx 884.19 Rx 839.19 Chan 0473 #473

Tx 884.22 Rx 839.22 Chan 0474 #474

Tx 884.25 Rx 839.25 Chan 0475 #475

Tx 884.28 Rx 839.28 Chan 0476 #476

Tx 884.31 Rx 839.31 Chan 0477 #477

Tx 884.34 Rx 839.34 Chan 0478 #478

Tx 884.37 Rx 839.37 Chan 0479 #479

Tx 884.40 Rx 839.40 Chan 0480 #480

Tx 884.43 Rx 839.43 Chan 0481 #481

Tx 884.46 Rx 839.46 Chan 0482 #482

Tx 884.49 Rx 839.49 Chan 0483 #483

Tx 884.52 Rx 839.52 Chan 0484 #484

Tx 884.55 Rx 839.55 Chan 0485 #485

Tx 884.58 Rx 839.58 Chan 0486 #486

Tx 884.61 Rx 839.61 Chan 0487 #487

Tx 884.64 Rx 839.64 Chan 0488 #488

Tx 884.67 Rx 839.67 Chan 0489 #489

Tx 884.70 Rx 839.70 Chan 0490 #490

Tx 884.73 Rx 839.73 Chan 0491 #491

Tx 884.76 Rx 839.76 Chan 0492 #492

Tx 884.79 Rx 839.79 Chan 0493 #493

Tx 884.82 Rx 839.82 Chan 0494 #494

Tx 884.85 Rx 839.85 Chan 0495 #495

Tx 884.88 Rx 839.88 Chan 0496 #496

Tx 884.91 Rx 839.91 Chan 0497 #497

Tx 884.94 Rx 839.94 Chan 0498 #498

Tx 884.97 Rx 839.97 Chan 0499 #499

Tx 885.00 Rx 840.00 Chan 0500 #500

Tx 885.03 Rx 840.03 Chan 0501 #501

Tx 885.06 Rx 840.06 Chan 0502 #502

Tx 885.09 Rx 840.09 Chan 0503 #503

Tx 885.12 Rx 840.12 Chan 0504 #504

Tx 885.15 Rx 840.15 Chan 0505 #505

Tx 885.18 Rx 840.18 Chan 0506 #506

Tx 885.21 Rx 840.21 Chan 0507 #507

Tx 885.24 Rx 840.24 Chan 0508 #508

Tx 885.27 Rx 840.27 Chan 0509 #509

Tx 885.30 Rx 840.30 Chan 0510 #510

Tx 885.33 Rx 840.33 Chan 0511 #511

Tx 885.36 Rx 840.36 Chan 0512 #512

Tx 885.39 Rx 840.39 Chan 0513 #513

Tx 885.42 Rx 840.42 Chan 0514 #514

Tx 885.45 Rx 840.45 Chan 0515 #515

Tx 885.48 Rx 840.48 Chan 0516 #516

Tx 885.51 Rx 840.51 Chan 0517 #517

Tx 885.54 Rx 840.54 Chan 0518 #518

Tx 885.57 Rx 840.57 Chan 0519 #519

Tx 885.60 Rx 840.60 Chan 0520 #520

Tx 885.63 Rx 840.63 Chan 0521 #521

Tx 885.66 Rx 840.66 Chan 0522 #522

Tx 885.69 Rx 840.69 Chan 0523 #523

Tx 885.72 Rx 840.72 Chan 0524 #524

Tx 885.75 Rx 840.75 Chan 0525 #525

Tx 885.78 Rx 840.78 Chan 0526 #526

Tx 885.81 Rx 840.81 Chan 0527 #527

Tx 885.84 Rx 840.84 Chan 0528 #528

Tx 885.87 Rx 840.87 Chan 0529 #529

Tx 885.90 Rx 840.90 Chan 0530 #530

Tx 885.93 Rx 840.93 Chan 0531 #531

Tx 885.96 Rx 840.96 Chan 0532 #532

Tx 885.99 Rx 840.99 Chan 0533 #533

Tx 886.02 Rx 841.02 Chan 0534 #534

Tx 886.05 Rx 841.05 Chan 0535 #535

Tx 886.08 Rx 841.08 Chan 0536 #536

Tx 886.11 Rx 841.11 Chan 0537 #537

Tx 886.14 Rx 841.14 Chan 0538 #538

Tx 886.17 Rx 841.17 Chan 0539 #539

Tx 886.20 Rx 841.20 Chan 0540 #540

Tx 886.23 Rx 841.23 Chan 0541 #541

Tx 886.26 Rx 841.26 Chan 0542 #542

Tx 886.29 Rx 841.29 Chan 0543 #543

Tx 886.32 Rx 841.32 Chan 0544 #544

Tx 886.35 Rx 841.35 Chan 0545 #545

Tx 886.38 Rx 841.38 Chan 0546 #546

Tx 886.41 Rx 841.41 Chan 0547 #547

Tx 886.44 Rx 841.44 Chan 0548 #548

Tx 886.47 Rx 841.47 Chan 0549 #549

Tx 886.50 Rx 841.50 Chan 0550 #550

Tx 886.53 Rx 841.53 Chan 0551 #551

Tx 886.56 Rx 841.56 Chan 0552 #552

Tx 886.59 Rx 841.59 Chan 0553 #553

Tx 886.62 Rx 841.62 Chan 0554 #554

Tx 886.65 Rx 841.65 Chan 0555 #555

Tx 886.68 Rx 841.68 Chan 0556 #556

Tx 886.71 Rx 841.71 Chan 0557 #557

Tx 886.74 Rx 841.74 Chan 0558 #558

Tx 886.77 Rx 841.77 Chan 0559 #559

Tx 886.80 Rx 841.80 Chan 0560 #560

Tx 886.83 Rx 841.83 Chan 0561 #561

Tx 886.86 Rx 841.86 Chan 0562 #562

Tx 886.89 Rx 841.89 Chan 0563 #563

Tx 886.92 Rx 841.92 Chan 0564 #564

Tx 886.95 Rx 841.95 Chan 0565 #565

Tx 886.98 Rx 841.98 Chan 0566 #566

Tx 887.01 Rx 842.01 Chan 0567 #567

Tx 887.04 Rx 842.04 Chan 0568 #568

Tx 887.07 Rx 842.07 Chan 0569 #569

Tx 887.10 Rx 842.10 Chan 0570 #570

Tx 887.13 Rx 842.13 Chan 0571 #571

Tx 887.16 Rx 842.16 Chan 0572 #572

Tx 887.19 Rx 842.19 Chan 0573 #573

Tx 887.22 Rx 842.22 Chan 0574 #574

Tx 887.25 Rx 842.25 Chan 0575 #575

Tx 887.28 Rx 842.28 Chan 0576 #576

Tx 887.31 Rx 842.31 Chan 0577 #577

Tx 887.34 Rx 842.34 Chan 0578 #578

Tx 887.37 Rx 842.37 Chan 0579 #579

Tx 887.40 Rx 842.40 Chan 0580 #580

Tx 887.43 Rx 842.43 Chan 0581 #581

Tx 887.46 Rx 842.46 Chan 0582 #582

Tx 887.49 Rx 842.49 Chan 0583 #583

Tx 887.52 Rx 842.52 Chan 0584 #584

Tx 887.55 Rx 842.55 Chan 0585 #585

Tx 887.58 Rx 842.58 Chan 0586 #586

Tx 887.61 Rx 842.61 Chan 0587 #587

Tx 887.64 Rx 842.64 Chan 0588 #588

Tx 887.67 Rx 842.67 Chan 0589 #589

Tx 887.70 Rx 842.70 Chan 0590 #590

Tx 887.73 Rx 842.73 Chan 0591 #591

Tx 887.76 Rx 842.76 Chan 0592 #592

Tx 887.79 Rx 842.79 Chan 0593 #593

Tx 887.82 Rx 842.82 Chan 0594 #594

Tx 887.85 Rx 842.85 Chan 0595 #595

Tx 887.88 Rx 842.88 Chan 0596 #596

Tx 887.91 Rx 842.91 Chan 0597 #597

Tx 887.94 Rx 842.94 Chan 0598 #598

Tx 887.97 Rx 842.97 Chan 0599 #599

Tx 888.00 Rx 843.00 Chan 0600 #600

Tx 888.03 Rx 843.03 Chan 0601 #601

Tx 888.06 Rx 843.06 Chan 0602 #602

Tx 888.09 Rx 843.09 Chan 0603 #603

Tx 888.12 Rx 843.12 Chan 0604 #604

Tx 888.15 Rx 843.15 Chan 0605 #605

Tx 888.18 Rx 843.18 Chan 0606 #606

Tx 888.21 Rx 843.21 Chan 0607 #607

Tx 888.24 Rx 843.24 Chan 0608 #608

Tx 888.27 Rx 843.27 Chan 0609 #609

Tx 888.30 Rx 843.30 Chan 0610 #610

Tx 888.33 Rx 843.33 Chan 0611 #611

Tx 888.36 Rx 843.36 Chan 0612 #612

Tx 888.39 Rx 843.39 Chan 0613 #613

Tx 888.42 Rx 843.42 Chan 0614 #614

Tx 888.45 Rx 843.45 Chan 0615 #615

Tx 888.48 Rx 843.48 Chan 0616 #616

Tx 888.51 Rx 843.51 Chan 0617 #617

Tx 888.54 Rx 843.54 Chan 0618 #618

Tx 888.57 Rx 843.57 Chan 0619 #619

Tx 888.60 Rx 843.60 Chan 0620 #620

Tx 888.63 Rx 843.63 Chan 0621 #621

Tx 888.66 Rx 843.66 Chan 0622 #622

Tx 888.69 Rx 843.69 Chan 0623 #623

Tx 888.72 Rx 843.72 Chan 0624 #624

Tx 888.75 Rx 843.75 Chan 0625 #625

Tx 888.78 Rx 843.78 Chan 0626 #626

Tx 888.81 Rx 843.81 Chan 0627 #627

Tx 888.84 Rx 843.84 Chan 0628 #628

Tx 888.87 Rx 843.87 Chan 0629 #629

Tx 888.90 Rx 843.90 Chan 0630 #630

Tx 888.93 Rx 843.93 Chan 0631 #631

Tx 888.96 Rx 843.96 Chan 0632 #632

Tx 888.99 Rx 843.99 Chan 0633 #633

Tx 889.02 Rx 844.02 Chan 0634 #634

Tx 889.05 Rx 844.05 Chan 0635 #635

Tx 889.08 Rx 844.08 Chan 0636 #636

Tx 889.11 Rx 844.11 Chan 0637 #637

Tx 889.14 Rx 844.14 Chan 0638 #638

Tx 889.17 Rx 844.17 Chan 0639 #639

Tx 889.20 Rx 844.20 Chan 0640 #640

Tx 889.23 Rx 844.23 Chan 0641 #641

Tx 889.26 Rx 844.26 Chan 0642 #642

Tx 889.29 Rx 844.29 Chan 0643 #643

Tx 889.32 Rx 844.32 Chan 0644 #644

Tx 889.35 Rx 844.35 Chan 0645 #645

Tx 889.38 Rx 844.38 Chan 0646 #646

Tx 889.41 Rx 844.41 Chan 0647 #647

Tx 889.44 Rx 844.44 Chan 0648 #648

Tx 889.47 Rx 844.47 Chan 0649 #649

Tx 889.50 Rx 844.50 Chan 0650 #650

Tx 889.53 Rx 844.53 Chan 0651 #651

Tx 889.56 Rx 844.56 Chan 0652 #652

Tx 889.59 Rx 844.59 Chan 0653 #653

Tx 889.62 Rx 844.62 Chan 0654 #654

Tx 889.65 Rx 844.65 Chan 0655 #655

Tx 889.68 Rx 844.68 Chan 0656 #656

Tx 889.71 Rx 844.71 Chan 0657 #657

Tx 889.74 Rx 844.74 Chan 0658 #658

Tx 889.77 Rx 844.77 Chan 0659 #659

Tx 889.80 Rx 844.80 Chan 0660 #660

Tx 889.83 Rx 844.83 Chan 0661 #661

Tx 889.86 Rx 844.86 Chan 0662 #662

Tx 889.89 Rx 844.89 Chan 0663 #663

Tx 889.92 Rx 844.92 Chan 0664 #664

Tx 889.95 Rx 844.95 Chan 0665 #665

Tx 889.98 Rx 844.98 Chan 0666 #666

Upper Set Part 1 (667-799)

Tower Freq. Mobile Freq. 11xxxx# Channel

Tx 890.01 Rx 845.01 Chan 0667 #667

Tx 890.04 Rx 845.04 Chan 0668 #668

Tx 890.07 Rx 845.07 Chan 0669 #669

Tx 890.10 Rx 845.10 Chan 0670 #670

Tx 890.13 Rx 845.13 Chan 0671 #671

Tx 890.16 Rx 845.16 Chan 0672 #672

Tx 890.19 Rx 845.19 Chan 0673 #673

Tx 890.22 Rx 845.22 Chan 0674 #674

Tx 890.25 Rx 845.25 Chan 0675 #675

Tx 890.28 Rx 845.28 Chan 0676 #676

Tx 890.31 Rx 845.31 Chan 0677 #677

Tx 890.34 Rx 845.34 Chan 0678 #678

Tx 890.37 Rx 845.37 Chan 0679 #679

Tx 890.40 Rx 845.40 Chan 0680 #680

Tx 890.43 Rx 845.43 Chan 0681 #681

Tx 890.46 Rx 845.46 Chan 0682 #682

Tx 890.49 Rx 845.49 Chan 0683 #683

Tx 890.52 Rx 845.52 Chan 0684 #684

Tx 890.55 Rx 845.55 Chan 0685 #685

Tx 890.58 Rx 845.58 Chan 0686 #686

Tx 890.61 Rx 845.61 Chan 0687 #687

Tx 890.64 Rx 845.64 Chan 0688 #688

Tx 890.67 Rx 845.67 Chan 0689 #689

Tx 890.70 Rx 845.70 Chan 0690 #690

Tx 890.73 Rx 845.73 Chan 0691 #691

Tx 890.76 Rx 845.76 Chan 0692 #692

Tx 890.79 Rx 845.79 Chan 0693 #693

Tx 890.82 Rx 845.82 Chan 0694 #694

Tx 890.85 Rx 845.85 Chan 0695 #695

Tx 890.88 Rx 845.88 Chan 0696 #696

Tx 890.91 Rx 845.91 Chan 0697 #697

Tx 890.94 Rx 845.94 Chan 0698 #698

Tx 890.97 Rx 845.97 Chan 0699 #699

Tx 891.00 Rx 846.00 Chan 0700 #700

Tx 891.03 Rx 846.03 Chan 0701 #701

Tx 891.06 Rx 846.06 Chan 0702 #702

Tx 891.09 Rx 846.09 Chan 0703 #703

Tx 891.12 Rx 846.12 Chan 0704 #704

Tx 891.15 Rx 846.15 Chan 0705 #705

Tx 891.18 Rx 846.18 Chan 0706 #706

Tx 891.21 Rx 846.21 Chan 0707 #707

Tx 891.24 Rx 846.24 Chan 0708 #708

Tx 891.27 Rx 846.27 Chan 0709 #709

Tx 891.30 Rx 846.30 Chan 0710 #710

Tx 891.33 Rx 846.33 Chan 0711 #711

Tx 891.36 Rx 846.36 Chan 0712 #712

Tx 891.39 Rx 846.39 Chan 0713 #713

Tx 891.42 Rx 846.42 Chan 0714 #714

Tx 891.45 Rx 846.45 Chan 0715 #715

Tx 891.48 Rx 846.48 Chan 0716 #716

Tx 891.51 Rx 846.51 Chan 0717 #717

Tx 891.54 Rx 846.54 Chan 0718 #718

Tx 891.57 Rx 846.57 Chan 0719 #719

Tx 891.60 Rx 846.60 Chan 0720 #720

Tx 891.63 Rx 846.63 Chan 0721 #721

Tx 891.66 Rx 846.66 Chan 0722 #722

Tx 891.69 Rx 846.69 Chan 0723 #723

Tx 891.72 Rx 846.72 Chan 0724 #724

Tx 891.75 Rx 846.75 Chan 0725 #725

Tx 891.78 Rx 846.78 Chan 0726 #726

Tx 891.81 Rx 846.81 Chan 0727 #727

Tx 891.84 Rx 846.84 Chan 0728 #728

Tx 891.87 Rx 846.87 Chan 0729 #729

Tx 891.90 Rx 846.90 Chan 0730 #730

Tx 891.93 Rx 846.93 Chan 0731 #731

Tx 891.96 Rx 846.96 Chan 0732 #732

Tx 891.99 Rx 846.99 Chan 0733 #733

Tx 892.02 Rx 847.02 Chan 0734 #734

Tx 892.05 Rx 847.05 Chan 0735 #735

Tx 892.08 Rx 847.08 Chan 0736 #736

Tx 892.11 Rx 847.11 Chan 0737 #737

Tx 892.14 Rx 847.14 Chan 0738 #738

Tx 892.17 Rx 847.17 Chan 0739 #739

Tx 892.20 Rx 847.20 Chan 0740 #740

Tx 892.23 Rx 847.23 Chan 0741 #741

Tx 892.26 Rx 847.26 Chan 0742 #742

Tx 892.29 Rx 847.29 Chan 0743 #743

Tx 892.32 Rx 847.32 Chan 0744 #744

Tx 892.35 Rx 847.35 Chan 0745 #745

Tx 892.38 Rx 847.38 Chan 0746 #746

Tx 892.41 Rx 847.41 Chan 0747 #747

Tx 892.44 Rx 847.44 Chan 0748 #748

Tx 892.47 Rx 847.47 Chan 0749 #749

Tx 892.50 Rx 847.50 Chan 0750 #750

Tx 892.53 Rx 847.53 Chan 0751 #751

Tx 892.56 Rx 847.56 Chan 0752 #752

Tx 892.59 Rx 847.59 Chan 0753 #753

Tx 892.62 Rx 847.62 Chan 0754 #754

Tx 892.65 Rx 847.65 Chan 0755 #755

Tx 892.68 Rx 847.68 Chan 0756 #756

Tx 892.71 Rx 847.71 Chan 0757 #757

Tx 892.74 Rx 847.74 Chan 0758 #758

Tx 892.77 Rx 847.77 Chan 0759 #759

Tx 892.80 Rx 847.80 Chan 0760 #760

Tx 892.83 Rx 847.83 Chan 0761 #761

Tx 892.86 Rx 847.86 Chan 0762 #762

Tx 892.89 Rx 847.89 Chan 0763 #763

Tx 892.92 Rx 847.92 Chan 0764 #764

Tx 892.95 Rx 847.95 Chan 0765 #765

Tx 892.98 Rx 847.98 Chan 0766 #766

Tx 893.01 Rx 848.01 Chan 0767 #767

Tx 893.04 Rx 848.04 Chan 0768 #768

Tx 893.07 Rx 848.07 Chan 0769 #769

Tx 893.10 Rx 848.10 Chan 0770 #770

Tx 893.13 Rx 848.13 Chan 0771 #771

Tx 893.16 Rx 848.16 Chan 0772 #772

Tx 893.19 Rx 848.19 Chan 0773 #773

Tx 893.22 Rx 848.22 Chan 0774 #774

Tx 893.25 Rx 848.25 Chan 0775 #775

Tx 893.28 Rx 848.28 Chan 0776 #776

Tx 893.31 Rx 848.31 Chan 0777 #777

Tx 893.34 Rx 848.34 Chan 0778 #778

Tx 893.37 Rx 848.37 Chan 0779 #779

Tx 893.40 Rx 848.40 Chan 0780 #780

Tx 893.43 Rx 848.43 Chan 0781 #781

Tx 893.46 Rx 848.46 Chan 0782 #782

Tx 893.49 Rx 848.49 Chan 0783 #783

Tx 893.52 Rx 848.52 Chan 0784 #784

Tx 893.55 Rx 848.55 Chan 0785 #785

Tx 893.58 Rx 848.58 Chan 0786 #786

Tx 893.61 Rx 848.61 Chan 0787 #787

Tx 893.64 Rx 848.64 Chan 0788 #788

Tx 893.67 Rx 848.67 Chan 0789 #789

Tx 893.70 Rx 848.70 Chan 0790 #790

Tx 893.73 Rx 848.73 Chan 0791 #791

Tx 893.76 Rx 848.76 Chan 0792 #792

Tx 893.79 Rx 848.79 Chan 0793 #793

Tx 893.82 Rx 848.82 Chan 0794 #794

Tx 893.85 Rx 848.85 Chan 0795 #795

Tx 893.88 Rx 848.88 Chan 0796 #796

Tx 893.91 Rx 848.91 Chan 0797 #797

Tx 893.94 Rx 848.94 Chan 0798 #798

Tx 893.97 Rx 848.97 Chan 0799 #799

Upper Set Part 2 (991-1023)

Tower Freq. Mobile Freq. 11xxxx# Channel

Tx 869.04 Rx 824.04 Chan 0991 #800

Tx 869.07 Rx 824.07 Chan 0992 #801

Tx 869.10 Rx 824.10 Chan 0993 #802

Tx 869.13 Rx 824.13 Chan 0994 #803

Tx 869.16 Rx 824.16 Chan 0995 #804

Tx 869.19 Rx 824.19 Chan 0996 #805

Tx 869.22 Rx 824.22 Chan 0997 #806

Tx 869.25 Rx 824.25 Chan 0998 #807

Tx 869.28 Rx 824.28 Chan 0999 #808

Tx 869.31 Rx 824.31 Chan 1000 #809

Tx 869.34 Rx 824.34 Chan 1001 #810

Tx 869.37 Rx 824.37 Chan 1002 #811

Tx 869.40 Rx 824.40 Chan 1003 #812

Tx 869.43 Rx 824.43 Chan 1004 #813

Tx 869.46 Rx 824.46 Chan 1005 #814

Tx 869.49 Rx 824.49 Chan 1006 #815

Tx 869.52 Rx 824.52 Chan 1007 #816

Tx 869.55 Rx 824.55 Chan 1008 #817

Tx 869.58 Rx 824.58 Chan 1009 #818

Tx 869.61 Rx 824.61 Chan 1010 #819

Tx 869.64 Rx 824.64 Chan 1011 #820

Tx 869.67 Rx 824.67 Chan 1012 #821

Tx 869.70 Rx 824.70 Chan 1013 #822

Tx 869.73 Rx 824.73 Chan 1014 #823

Tx 869.76 Rx 824.76 Chan 1015 #824

Tx 869.79 Rx 824.79 Chan 1016 #825

Tx 869.82 Rx 824.82 Chan 1017 #826

Tx 869.85 Rx 824.85 Chan 1018 #827

Tx 869.88 Rx 824.88 Chan 1019 #828

Tx 869.91 Rx 824.91 Chan 1020 #829

Tx 869.94 Rx 824.94 Chan 1021 #830

Tx 869.97 Rx 824.97 Chan 1022 #831

Tx 870.00 Rx 825.00 Chan 1023 #832 or #0

T*R*I*K*-*C*L*I*P********************************************S*E*C*T*I*O*N***1*1

I got this from a BBS in the (708) are code. It had no name associated

with it. Since NOONE has mailed me any other info on it, I will keep this

in the bible until someone bitches or sends me something tangible. Besides,

with Loadkit so readily available, who has the time to mess with it?

-ML

MOTOROLA “TRIK-CLIP”

This is the plans I received for the Flip. Supposedly if one knew the

pinouts on the other moto phones one could transpose. (maybe!) I never

tested this so I don’t know if it works. The chip in the flip the text

is talking about is a 32 pin square plcc

After Phone Disassembly Locate 27c512 EPROM on phone board. This is

On The Upper Right Side Of The Display Next To The Roam Indicator.

This Is a 32 pin Square device. **Note the dot and beveled edge

for pin orientation (the dot is pin 1) Count to the left

counter clock wise 2 3 4 5 and so on. To the Right or clockwise

of the dot is pin 32 Vcc. This will aid you in your count to find

pin 25 which is the EPROM output enable. This pin is at ground or

Vss – Level. **Note Pin 25 on EPROM in phone must be lifted from

the phone board ground or Vss state. Use an X-acto Knife and or

soldering iron and tools to cut pin at board level where pin

narrows. Do not bend wide part of pin up on EPROM as this could

break off of EPROM. Also Wide Part of pin Will be used to make

contact with EPROM test clip adapter. The EPROM test clip adapter

will take pin 25 to logic high through an 8 to 10 thousand

resistor to pin 32 Vcc. This will Gate off all data Commands from

the phone board EPROM and allow the EPROM test clip adapter to

take over. **Note test clip could touch narrow part of cut off

pin on board and cause phone not to power up please remove or fold

down as low as possible so test clip only touches side of EPROM.

After programming is complete put pin 25 back together or find a

suitable ground or Vss – source. The phone will power up and work

without pin 25 put back together but for long term precaution

put back to a logic zero or ground to enable the output enable.

To use the EPROM test clip adapter pull the locking wedge on the

test clip into the upper position. Seat the EPROM test clip adapter

onto the EPROM in the phone. Make sure to orient the dot and

beveled edge with each other. Push the locking wedge down to lock

the EPROM test clip adapter onto the EPROM in the phone. Hook up

the programming cable to the computer and plug into the jack on the

base of the phone. Also hook up the loose lead with a jumper to the

center terminal between the battery contacts. Turn power on green

light on phone display should come on then a complete display test

will light up after that the no service will blink along with the

signal level mark in corner of display. If the antenna is still on

the phone it could change to roam or something else. I suggest

remove the antenna so the cell sight will not see you. If you do

not get a power on test with the display there are 3 possible

things (1) pin 25 on phone board is touching the test clip this

can be checked by looking with a volt meter at pin 25 where

resistor connects for 4 to 5 volts pos with reference to ground.

(2) Test clip is not sitting on chip good some times you have pull

the test clip up off of the EPROM a 64th of an inch all the way

around. (3) there is corrupt data, Pull the EPROM test clip off

Phone check to see if power on display is there.

Computer see if data or phone number or cell sight code or data

whole is ok I’ve seen the cell sight ID corrupt and the phone play

dead on the power on test. The test clip sometimes needs

maintenance look at the gold pins.

Make sure all the pins are level with the edge of it. If not take

an X-acto or pin and lightly bend them out so they are along the

edge of the plastic of the test clip.

Always check to see if EPROM in phone contacts are clean before

putting test clip on. **Note when test clip is on phone – only

change the ESN only. *The other data phone number lock and so on

can be changed without the test clip and should be done so.

The software version in the test clip is 9148 you will see this in

the right corner of the computer. Sometimes the program will crash

during the ESN write this will put all zeros in the ESN field

check the test clip try again. Sometimes I’ve had to do this 3 or 4

times. Also watch the phone display for codes I’ve seen at the end

of a write the code (FO8) just before power down I’ve had no

problem there but during the key write (FO8) means I’ve crashed.

Also during the time when the program is counting back into the

phone I’ve had (F1O) show up in the display of the phone this

problem means the next time you may not get the power on display

test pull test clip read phone check data to see if cell sight

code is corrupt or some other data correct try again. A word of

caution do not push on EPROM on top of test clip as this could

seat EPROM lower into adapter and cause bad contact. To remove

test clip pull locking wedge up to unlock the EPROM test clip

adapter from the EPROM in the phone. Continue pulling up to lift

the EPROM test clip adapter from the EPROM in the phone.

P*A*G*E*R*S**************************************************S*E*C*T*I*O*N***1*2

Subject: BRAVO pagers – undocumented test features

SELF TEST:

TO PUT UNIT INTO A SELF TEST TURN OFF PAGER. NOW HOLD DOWN THE

GRAY ARROW KEY AND BLACK LOCK KEY AT THE SAME TIME AND TURN ON

PAGER. THIS TELLS THE CPU IN PAGER TO GO INTO A SELF TEST. YOU WILL

GET A 2 SECOND LONG BEEP, RELEASE THE GRAY & BLACK BUTTON AND PUSH

THE GRAY BUTTON BEFORE THE 2 SECOND BEEP ENDS. IF YOU DID ALL THIS

IN TIME YOU WILL HAVE “SPL” OR “PAGING P?” AND NOT THE DOTTED LINE

YOU ARE USED TO SEEING WHEN YOU TURN ON PAGER . BY PRESSING THE

GRAY KEY IT WILL GO TO A DISPLAY TEST, PRESS AGAIN AND YOU WILL GET

THE PAGERS CAPCODE (CAPCODE IS THE UNIQUE SERIAL NUMBER WHICH THE

PAGING TRANSMITTERS TRANSMITS TO YOUR PAGER TO TURN ON YOUR PAGER

WHEN SOMEONE PAGES YOU). WAIT AND IN ABOUT 3 SECONDS IT WILL

DISPLAY YOUR SECOND CAPCODE (IF YOU HAVE ONE-MOST DON’T) PRESS THE

GRAY KEY AGAIN AND IT WILL CHECK CONTROLS, PRESS IT AGAIN AND IT

WILL TEST VIBRATOR FUNCTION (IF YOUR PAGER HAS IT). TURN OFF PAGER

AND TURN ON AGAIN TO DISABLE SELF TEST.

SPECIAL PROGRAMMED FEATURES:

TAKE OFF BATTERIES CLIP AND IN CENTER TOWARD THE FRONT OF

PAGER YOU WILL SEE A PRINTED CIRCUIT BOARD EDGE PINS (JUST LIKE THE

BACK SIDE OF A NETENDO CARTAGE. THIS EDGE PINS ARE PLUGGED INTO A

CORE PROGRAMMER. THE PROGRAMMER CAN CHANGE.

CAPCODES: SEE ABOVE

AUTORESET TO MANUAL: YOUR PAGER IN AUTORESET WILL BEEP 8 TIMES

THEN STOP BEEPING. MANUAL RESET THE BEEPER WILL KEEP BEEPING TILL

THE COWS COME HOME OR YOU PUSH A BUTTON TO LOOK AT THE MESSAGE.

DISPLAY: ENGLISH PROMPTS OR INTERNATIONAL-SYMBOL SCREENS

DISPLAYED.

SILENT MODE CHIRP: FOR A SINGLE BEEP WHEN YOUR PAGED. NOT FOR

USE ON VIBRATOR PAGERS.

BEEP ON BAD DATA: YOUR PAGER HEARS IT’S CAPCODE BUT RECEIVED

BAD DISPLAY MESSAGE, IT WILL PUT “EEE” ACROSS DISPLAY TO SHOW BAD

RECEIVE. IF THIS IS FEATURE IS NOT ENABLED AND YOU RECEIVE BAD DATA

YOUR PAGER WILL NOT BEEP AND YOU WILL HAVE NO IDEA SOMEONE TRYED TO

PAGE YOU.

******************************************************************

NOW LETS SAY YOU ARE UNHAPPY WITH YOUR PAGING COMPANY “A” BUT OWN

YOUR PAGER. YOUR $200.00+ PAGER IS TUNED TO THEIR FREQUENCY AND YOU

WANT TO GO TO ANOTHER PAwriteOMPANY BUT NOT LOSE ALL THE MONEY YOU

SPENT FOR YOUR PAGER. THE ANSWER IS TO RECRYSTAL PAGER TO THE NEW

FREQUENCY OF COMPANY “B”. BUT WE MUST ANSWER SOME QUESTIONS FIRST

TO SEE WHAT IT WILL COST.

1. WHAT IS YOUR PAGERS CODING FORMAT (POCSAG) OR (GSC)

THE EASY WAY TO TELL IS TO DO A SELF TEST AND READ

CAPCODE. IF IT’S 7 NUMBERS IT’S POCSAG. IF IT’S 6 NUMBERS

AND 1 LETTER IT’S GSC. IF YOUR PAGER DOES NOT MATCH THE

SAME CODING FORMAT AS COMPANY “B” IT WILL COST MORE THEN

IT’S WORTH TO CHANGE.

2. WHAT BAUD RATE IS YOUR PAGER WORKING AT ? DO SELF TEST AND

IF DISPLAY SHOWS PAGING P1 PAGER IS WORKING AT 1200 BAUD OTHER WISE

YOU ARE SAFE TO ASSUME 512 BAUD IT MUST MATCH COMPANY “B” BAUD RATE

TO BE WORTH YOUR TIME.

3. ARE YOU IN THE SAME FREQUENCY BAND 931 MHz OR 450 MHz ETC.

IF COMPANY “A” AND COMPANY “B” ARE NOT IN SAME BAND IT WILL TAKE A

NEW RECEIVER BOARD TO CONVERT PAGER AND COST TO MUCH TO TRY.

IF ALL THE ANSWERS ABOVE SHOW YOU ARE COMPATIBLE YOU CAN CALL

COMPANY “B” AND TELL THEM YOU WANT TO DO BUSINESS WITH THEM AND

NEED A CAPCODE NUMBER SO YOU CAN GET PAGER RECRYSTALED AND HAVE A

CAPCODE PROGRAMMED AT THE SAME TIME.

NOW YOU CAN HAVE COMPANY “B” RECOMMEND A SHOP THAT WILL

RECRYSTAL PAGER OR LOOK UP ONE YOURSELF.

(sorry for the all caps, that was how I received it and I am lazy. -ML)

D*I*S*C*L*A*I*M*E*R******************************************S*E*C*T*I*O*N***1*3

DISCLAIMER: I, Mike Larsen, accept NO responsibility for people using any

info within this text for fraudulent purposes. I did not intend for the info

to be used towards fraud or theft of services. The main reason I spent

hundreds of hours creating and compiling this information is because

programming fees are BULLSHIT and they know it. Programming fees are the

equivalent to the Refrigerator installer guy charging 50 bucks to plug the

damn thing in to the wall.

Oh, by the way, I forgot to mention in the above disclaimer that I do

nothing fraudulent with MY fone. I pay a bill and everything and can prove

it. So will the “feds” or whoever the Internet Gestapo is that’s been sending

me mail about me being under their “watchful eye”, please go for someone else

that’s dealing child pornography or asking for WaReZ? Thanks.

The sole reason I compiled this info into book form is to let people

that are capable, work on their phone. Again, I did not compile this for the

purpose of fraud.

******T*H*E***E*N*D*****T*H*E***E*N*D******T*H*E***E*N*D*****T*H*E***E*N*D******

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Statistic

  • 66,000 hits

Publication

Event

June 2008
M T W T F S S
« Mar   Apr »
 1
2345678
9101112131415
16171819202122
23242526272829
30  
%d bloggers like this: