motorolabible

***************************************************************
********************** THE MOTOROLA BIBLE *********************
**************** For all Cellular AND Pager Info **************
************* MOTOROLA USERS AND PROGRAMMING GUIDES ***********
************************ By Mike Larsen ***********************
*************************** Ver. 2.0 **************************
************************* * 12/23/95 * ************************
***************************************************************

Table of Contents:

Section 1 Introduction 7 Phone Pin Outs

2 General User Info 8 Cable Specs

3 Programming Info 9 Channel Number vs. Frequency

4 Test Mode 10 Trik Clip

5 Hacking the FOVC 11 Pager Info

6 Reading the SID 12 Disclaimer

I*N*T*R*O*D*U*C*T*I*O*N************************************S*E*C*T*I*O*N***1

After much deliberation, I decided to include information about

Motorola's pagers and their test mode commands. Since pagers aren't as much

fun as cellular, along with the fact there isn't much to them, this

information is very limited and somewhat brief. I would still like all

information pertaing to all of Motorola's pagers sent to me so this file can

stay current.

GENERAL DISCLAIMER:

This manual is not intended to be an aid in cellular fraud. That is

both illegal and immoral. Would you like someone to make charges on your

phone? If you want free calls, you want to check elsewhere for information

pertaining to BOXES, which is NOT mentioned in the Motorola Bible.

This manual is not intended for use by people with little electronics

experience. This is not a tutorial and not intended to be used except by

people with previous cellular experience and are familiar with programming

cellular phones. There are tons of introductory files all over the net. For

more info get into alt.cellular or alt.2600. If you have specific questions,

those are the places to start.

If you have any additions are corrections about this manual, please

email me at:

Mike.Larsen@bbs.uti.com

Stularsenmic@vax.colsf.edu

p.s. I hope to make this manual more international. However, the U.S.

cellular system greatly differs from other countries and we are all

ignorant here to what others are doing (but isn't that ALWAYS the way?).

Any info on hacking the GSM system (at least being able to use different

SIM cards in different phones). The term is 'SIM locked' and a friend

needs to unlock his phone. Please Email ANY info about this.

Send all related info about the new phones with caller ID - Manuals,

instructions, bugs, etc.

p.s.s. If anyone has ANY type of cellular monitoring software that is

P.C. based (using a scanner and/or Motorola Bag phone) EMAIL me

immediately!

----------------------------------------------------------------------------

************************************************************
* CHECK OUT THE NEW HOME ON THE WEB OF THE MOTOROLA BIBLE! *
************************************************************

This is a kick-ass sight with general info (all phones), cable specs,

software, and other cool stuff. All updates will be posted here first!

http://www.primenet.com/~mtorola

When you get there, send him Email and tell him you saw the site listed here

in the Bible.

G*E*N*E*R*A*L***U*S*E*R***I*N*F*O***************************S*E*C*T*I*O*N***2

Before going in to the programming of the cellular phone, it is

important for the user to know the normal things necessary for day to day

operation. While the majority of the stuff in the users manual is intended

for people that have problems programming their VCR, their are a few things

that are very important and are only mentioned in the users manual.

Turn On: [Pwr]

Place Call: Enter number, [Snd]

Receive Call: [Snd] or open flip fone

End Call: [End] or close flip fone

Store Number: Phone number, [Sto], 2-digit location number

Recall Number: [Rcl], 2-digit location number

Super Speed Dialing: Directory location number, [Snd]

Changing Entries: Press [Rcl] and the 2-digit location number

so that the number to be changed is

displayed. Press and release [Clr] to back

out each of the digits. Enter a new number

and press [Sto].

Call Number Displayed: [Snd]

Microphone Muting: Press [Fcn], [6].

To unmute, press [Fcn], [6]

Lock Unit: [Fcn], [5] or [LOCK]

Unlock: Three digit unlock code. If you make an

error, [Clr] and enter again.

Automatic Lock: [FCN], [6] (not all phones)

"EnAbLE" will appear if compatible.

Display Unlock Code: Press [Fcn], [0], your six-digit security

code, [Rcl].

Changing Your Unlock Code: Press [Fcn], [0], your six-digit security

code, your NEW 3-digit unlock code, [Sto].

Review Battery Meter: Press [Fcn], [4] and release.

Adjust Volume: Earpiece - Press and hold [Vol] to increase.

Release, press again to decrease.

Ringer - [Fcn], then Vol as above.

Recall Last Number Used: [Rcl], [0], [0]

Recall Own Phone Number: [Rcl], [#]

Individual Call Timer: [Rcl], [#], [#]

Resettable Call Timer: [Rcl], [#], [#], [#]

Reset Resettable Call Timer: [Fcn], [0], [7], [Clr]

Cumulative Call Timer: [Rcl], [#], [#], [#], [#]

Access Features: Press [Fcn], [1]. To change features, press

[*] and [#] to scroll and [Clr] to change.

To exit feature menu, press [END].

Review/Scroll Menu Features: Press [*] or [#]

Status Review: [Fcn], [0], [9], [Rcl], [#] or [*] scrolls

messages. To end press [END].

Changing System Type: Press [Rcl], [*]. Repeatedly press [*]

until the desired system type appears. To

select press [Sto].

Outgoing Call Restrictions: Press [Fcn], [0], 6-digit security code,

[1], [Sto]. Phone will place calls only

from memory locations 1-10.

To change back to unrestricted dialing

press [Fcn], [0], 6-digit security code,

[4], [Sto].

I would like to add that while I have extensively worked on finding

additional test mode commands, I (nor anyone else) have never worked with the

normal operation commands as listed above. For example, above you will

notice sequences with [Fcn], [1] or [Fcn], [0], [7]. This is totally

unexplored teritory. Happy hacking :) See entering test mode on the new

95xx phones.

P*R*O*G*R*A*M*M*I*N*G***I*N*F*O****************************S*E*C*T*I*O*N***3

NOTES: Some units have dual NAM's.

The ESN prefix is 130 decimal, 82 hex.

Motorola: 1-800-331-6456

There are MANY different models of Motorola phones sold under various

brand names, if you think it's a Motorola, it probably is.

Determine which access sequence to use:

HAND HELD PORTABLE MODELS

If the phone has a FCN button and no MENU button use sequence 1.

If the phone has no FCN button use sequence 2.

If the phone has a MENU button and a FCN button use sequence 4.

INSTALLED MOBILE PHONES AND TRANSPORTABLE MODELS

If the phone has no FCN button and no RCL button use sequence 3.

If the phone has a FCN button use sequence 4.

If the phone has a MEM button use sequence 5.

If the phone has a RCL button and no FCN button use sequence 6.

SEQUENCE# ACCESS CODE

1 FCN (SECURITY CODE TWICE) RCL

2 STO # (SECURITY CODE TWICE) RCL

3 CTL 0 (SECURITY CODE TWICE) *

4 FCN 0 (SECURITY CODE TWICE) RCL

5 FCN 0 (SECURITY CODE TWICE) MEM

6 CTL 0 (SECURITY CODE TWICE) RCL

The default security code is 000000. The CTL (control) button is the

single black button on the side of the handset.

NAM programing:

1. Turn the power on.

2. Within ten seconds enter the access sequence as determined above.

3. The phone should now show "01" in the left of the display, this is the

first programing entry step number. If it does not the security code

is incorrect, or the programing lock-out counter has been exceeded. In

either case you can still program the unit by following the steps under

TEST MODE PROGRAMING below.

4. The * key is used to increment each step:

Each time you press * the display will increment from the step number,

displayed on the left, to the data stored in that step, displayed on

the right. When the data is displayed make any necessary changes and

press * to increment to the next step number.

5. The SND key is used to complete and exit programing when any STEP

NUMBER is displayed.

If you have enabled the second phone number bit in step 10 below then

pressing SND will switch to NAM 2. Steps 01 thru 06, 09 and 10 will

repeat for NAM 2, the step number will be followed by a "2" to indicate

NAM two.

5. The CLR key will revert the display to the previously stored data.

6. The # key will abort programing at any time.

PROGRAMING DATA:

STEP# #OF DIGITS/RANGE DESCRIPTION

01 00000 - 32767 SYSTEM ID

02 3 DIGITS AREA CODE

03 7 DIGITS TEL NUMBER

04 2 DIGITS STATION CLASS MARK

05 2 DIGITS ACCESS OVERLOAD CLASS

06 2 DIGITS GROUP ID (10 IN USA)

07 6 DIGITS SECURITY CODE

08 3 DIGITS LOCK CODE

09 0333 OR 0334 INITIAL PAGING CHANNEL

10 6 DIGIT BINARY OPTION PROGRAMING (SEE NOTE 1)

11 3 DIGIT BINARY OPTION PROGRAMING (SEE NOTE 2)

NOTES:

Take care with Motorola's use of "0" and "1". Some options use "0" to

enable, some use "1".

1. This is a 6 digit binary field used to select the following options:

Digit 1: Internal handset speaker, 0 to enable.

Digit 2: Local Use Mark, 0 or 1.

Digit 3: MIN Mark, 0 or 1.

Digit 4: Auto Recall, always set to 1 (enabled).

Digit 5: Second phone number (not all phones), 1 to enable.

Digit 6: Diversity (Two antennas, not all phones), 1 to enable.

2. This is a 3 digit binary field used to select the following options:

Digit 1: Continuous DTMF, 1 to enable.

Digit 2: Transportable Ringer/Speaker, 0=Transducer, 1=Handset.

Digit 3: 8 hour time out in transportable mode, 0 to enable.

On newer models, they have added and changed some numbers. The numbers

as of the 3/27/92 manual are as follows:

1. The 6 digit binary field is still the same.

2. The 3 digit binary field has become a 5 digit binary field.

Digit 1: Failed Page Indicator 1=Disabled;0=Enabled

Digit 2: Motorola Enhanced Scan 1=Enabled; 0=Disabled

Digit 3: Long Tone DTMF 1=Enabled; 0=Disabled

Digit 4: Transportable Internal Ringer Speaker 1=Handset; 0=Transdcr

Digit 5: Eight Hour Timeout 1=Disabled;0=Enabled

T*E*S*T***M*O*D*E******************************************S*E*C*T*I*O*N***4

TEST MODE ACCESS:

NEWER 95xx PHONES (Thank you Motorola!!!)

Many newer phones don't require grounding. If your software version number

is 9526 (I think) or newer, enter this:

FCN + 0 + 0 + * + * + 8 3 7 8 6 6 3 3 + STO

In case you have trouble remembering the number sequence, it spells out

"TESTMODE." Leave it to Motorola to make this easier and easier all the time.

I have used this and it does work. This command just backs up my claim even

furthar that esn changing via handset is a reality. It's a matter of finding

the correct combination of keys.

Normal test mode commands work like usual from then on.

For some odd reason, this hasn't been included in all the 95xx phones. I

believe they started it in Software 9526. This is only an estimate, so if

you have a 95xx flip, let me know what software version you have and whether

it works or not so this date can be isolated. Mine is a 9562 that worked.

TEST MODE ACCESS:

INSTALLED MOBILE PHONES AND TRANSPORTABLE MODELS

To enter test mode on units with software version 85 and higher you must

short pins 20 and 21 of the transceiver data connector. An RS232 break out

box is useful for this, or construct a test mode adaptor from standard

Radio Shack parts.

For MINI TR or Silver Mini Tac transceivers (smaller data connector) you

can either short pins 9 and 14 or simply use a paper clip to short the

hands free microphone connector.

HAND HELD PORTABLE MODELS:

There are two basic types of Motorola portable phones, the Micro-Tac series

"Flip" phones, and the larger 8000 and Ultra Classic phones. Certain newer

Motorola and Pioneer badged Micro-Tac phones do not have a "flip", but

follow the same procedure as the Micro-Tac.

8000 & ULTRA CLASSIC SERIES:

If you have an 8000 series phone determine the "type" before trying to

enter test mode. On the back of the phone, or on the bottom in certain

older models, locate the F09... number this is the series number. If the

FOURTH digit of this number is a "D" you CAN NOT program the unit through

test mode, a Motorola RTL4154/RTL4153 programer is required to make any

changes to this unit.

Having determined that you do not have a "D" series phone the following

procedure is used to access test mode:

Remove the battery from the phone and locate the 12 contacts at the top

near the antenna connector. These contacts are numbered 1 through 12 from

top left through bottom right. Pin 6, top right, is the Manual Test Mode

Pin. You must ground this pin while powering up the phone. Pin 7 (lower

left) or the antenna connector should be used for ground. Follow one of

these procedures to gain access to pin 6:

1. The top section of the battery that covers the contacts contains

nothing but air. By careful measuring you can drill a small hole in the

battery to gain access to pin 6, alternately simply cut the top off the

battery with a hack saw. Having gained access use a paper clip to short

pin six to the antenna connector ground while powering up the phone.

2. If you do not want to "destroy" a battery you can apply an external 7.5

volts to the + and - connectors at the bottom of the phone, ground pin 6

while powering up the phone as above.

3. You can also try soldering or jamming a small jumper between pins 6 and

7 (top right to lower left), or between pin 6 and the antenna connector

housing ground. Carefully replace the battery and power up the phone. Use

caution with this method not to short out any other pin.

4. A cigarette lighter adaptor, if you have one, also makes a great test

mode adaptor as it can be disassembled to give you easier access to pin 6.

Many are pre marked, or even have holes in the right location. This is

because they are often stamped from the same mold that the manufacturer

uses for making hands free adaptor kits and these kits require access to

the phone's connectors.

/ Antenna Housing

ÚÄÄ¿

ÚÄÄÄÄÄÅÄÄÅÄÄÄÄÄ¿

³* ³ ³ *³

ÃÄÄÄÄÄÁÂÂÁÄÄÄÄÄ´ To enter test mode, ground pin 6 to either pin 7

³H H HÚÙÀ¿H H H³ or the antenna housing. I personally rapped a

³H H HÀÄÄÙH H H³ paper clip around the antenna housing and bent it

ÃÄÄÄÄÄÄÄÄÄÄÄÄÄÄ´ so it *ALMOST* touched the test pin. All I had

³ Back of phone³ to do was push the paper clip a little when I

³ with battery ³ turned the phone on.

³ removed. The³

³ H is a pin. ³

³ ³

³ Counting at ³

³ the top left ³

³ to right. ³

³ ³

³1 2 3 4 5 6³

³7 8 9 101112³

³ ³

³* ÚÄ¿ ÚÄ¿ *³

ÀÄÄÁÄÁÄÄÄ-ÁÄÁÄÄÙ

MICRO-TAC "FLIP" SERIES:

This phone follows similar methods as outlined for the 8000 series above.

Remove the battery and locate the three contacts at the bottom of the

phone, the two outer contacts are raised and connect with the battery. The

center contact is recessed, this is the Manual Test Mode connector.

Now look at the battery contacts, the two outer ones supply power to the

phone, the center contact is an "extra" ground. This ground needs to be

shorted to the test mode connector on the phone. The easiest way to do

this is to put a small piece of solder wick, wire, aluminum foil or any

other conductive material into the recess on the phone. Having done this

carefully replace the battery and turn on the power, if you have been

successful the phone will wake up in test mode.

ÚÄÄÄ¿

³ ³

ÚÄÁÄÄÄÁÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ¿

³ ³

³ÄÄÄÄÄÄÄÄ¿ ÚÄÄÄÄÄÄÄÄ³

³ ÀÄÄÄÄÄÙ ³

³ ³

³ Flip phone with ³

³ battery removed. The ³

³ H's are pins. Pin ³

³ 2 is the test pin and ³

³ is recessed. Put ³

³ something in the ³

³ recess so it touches ³

³ the battery. ³

³ 1 2 3 ³

³ ³

³ H H H ³

ÀÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÙ

GENERAL NOTES:

HANDSETS: Most Motorola handsets are interchangeable, when a handset is

used with a transceiver other than the one it was designed for the display

will show "LOANER". Some features and buttons may not work, for instance

if the original handset did not have a RCL or STO button, and the

replacement does, you will have to use the control * or control # sequence

to access memory and A/B system select procedures.

LOCK/UNLOCK PROCEDURES:

Phones with "LOCK" buttons: Press lock for at least 1/2 a second.

Phones with a "FCN" button: Press FCN 5, note that 5 has the letter's

"J,K, and L" for lock.

Phones with no FCN or LOCK button: Press Control 5, control is the black

volume button on the side of the

handset.

SYSTEM SELECT PROCEDURES:

Phones with a RCL button: Press RCL *, then * to select, STO to store.

Phones with no RCL button: Press Control * then * to select, # to store.

Options are: CSCAn: Preferred/Non preferred with system lockout.

Std A/b, or Std b/A: Preferred/Non preferred.

SCAn Ab, or SCAn bA: Non preferred/Preferred

SCAn A: "A" ONLY

SCAn b: "B" ONLY

HOME: Home only

(these are typical options, some phone's vary. C-Scan is only available

on newer models and does not appear unless programed, see below.)

INSTALLED MOBILE PHONES AND TRANSPORTABLE MODELS- (from de original)