informis/textfiles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Initial commit

Browse Source
This commit is contained in:
root@procul
2021-04-15 13:31:59 -05:00
commit 278a90f7ce
57951 changed files with 34606208 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
phreak/CELLULAR/a_vox01.txt
+90
View File
@@ -0,0 +1,90 @@
AUDIOVOX BC40, 45, CMT400, 405, 410, 450, 550, 600, 605, 750, 1700, SP75
NOTES: This is a single NAM unit.
The ESN prefix is 138 decimal, 8A hex (Toshiba)
You MUST know the lock code to program this unit.
Audiovox: 516-231-6051/213-926-7758
NAM programing:
1. With the power turned on enter N N N FUNC # 1, where NNN is the three
digit lock code. The manufacturers default is 000
2. The # key increments the step number.
3. The * key decrements the step number.
4. STO enters the data for each step.
5. You MAY directly access any step by pressing RCL followed by the step
number.
6. FUNC SND completes programing.
7. FUNC CLR exits programing mode.
PROGRAMING DATA:
STEP# #OF DIGITS/RANGE DESCRIPTION
01 3 DIGITS FIRST THREE DIGITS OF PHONE NUMBER
02 4 DIGITS LAST FOUR DIGITS OF PHONE NUMBER
03 3 DIGITS LOCK CODE
04 3 DIGITS AREA CODE
05 00001 - 32767 SYSTEM ID
06 0 OR 1 HORN ALERT
07 0 OR 1 HANDS FREE
08 0 OR 1 CONTINUOUS DTMF
09 0 OR 1 REPERTORY DIALLING
10 00 TO 15 GROUP ID (10 FOR USA)
11 00 TO 15 ACCESS OVERLOAD CLASS
12 0000 (ONLY) STATION CLASS MARK
13 0 OR 1 LOCAL USE MARK
14 0 OR 1 MIN MARK
15 0333/0334 IPCH, AUTOMATICALLY SET
16 0 OR 1 PREFERRED SYSTEM, AUTOMATICALLY SET
17 000 TO 255 SEE NOTE 1 BELOW
18 000 SET TO 000 ONLY
19 000 SET TO 000 ONLY
20 00001 - 99999 SYSTEM ID INHIBIT
21 0 TO 31 HORN ALERT TIME OUT IN HOURS (CMT 550 ONLY)
22 0 TO 31 ELEC MESSAGE RECORDER TIME OUT IN HOURS
(CMT 550 ONLY). SEE ALSO NOTE 2 BELOW.
23 0 TO 255 NO CHARGE AIR TIME DELAY IN SECS (NOT ALL MODELS)
24 000 TO 999 AIR TIMER CLEAR CODE
25 000 SET TO 000 ONLY
26 CHECKSUM AUTOMATICALLY SET
27 CHECKSUM AUTOMATICALLY SET
NOTES:
1. These options can be selected by adding together the following
codes:
0 = No options,
1 = Preferred system lock (not on CMT 550)
2 = Auto Lock (CMT 550 only),
4 = Call timer beep CMT 550 only),
8 = Home Roam inhibit,
16 = Automatic system redial (CMT 550 only).
Add together the codes of the desired options, for example to select
Call timer beep and auto redial add 4 to 16 for a code of 020.
2. 1 to 31 hours, except that a setting of 0 will turn phone off after
8 hours.
LOCK: F 4. UNLOCK: Enter three digit code.
A/B SYSTEM SELECT:
This procedure only works on models manufactured after September 19, 1987.
The first two digits of the serial number indicate the month (01-12), the
third digit of the serial number indicates the last digit of the year (198n).
FCN 7 STO = PREFERRED SYSTEM,
FCN 8 STO = HOME SYSTEM ONLY,
FCN 9 STO = NON PREFERRED SYSTEM,
FCN 0 SWITCHES BETWEEN A/B AND B/A,
PRESS STO WHEN THE DESIRED OPTION IS DISPLAYED.
phreak/CELLULAR/a_vox02.txt
+99
View File
@@ -0,0 +1,99 @@
AUDIOVOX CTX1500, 2500, 4000, 5000, BC410, 55, SP85, TRANS 410.
NOTES: These are single NAM units.
The ESN prefix is 138 decimal, 8A hex (Toshiba)
You MUST know the lock code to program this unit, see below for
"back door" programing methods.
Audiovox: 516-231-6051/213-926-7758
NAM programing:
1. With the power turned on enter N N N FUNC # 1, where NNN is the three
digit lock code. The manufacturers default is 000
2. The # key increments the step number.
3. The * key decrements the step number.
4. STO enters the data for each step.
5. You MAY directly access any step by pressing RCL followed by the step
number.
6. FUNC SND completes programming.
7. FUNC CLR exits programming mode.
PROGRAMING DATA:
STEP# #OF DIGITS/RANGE DESCRIPTION
01 10 DIGITS MIN (AREA CODE & PHONE NUMBER)
02 3 DIGITS LOCK CODE
03 00000 - 99999 SYSTEM ID
04 00 - 15 ACCESS OVERLOAD CLASS
05 00 - 15 SYSTEM ID (10 FOR USA)
06 0 OR 1 LOCAL USE MARK
07 0 OR 1 MIN MARK
08 0333 OR 0334 INITIAL PAGING CHANNEL
09 0 OR 1 PREFERRED SYSTEM
10 4 DIGITS STATION CLASS MARK
11 8 BINARY DIGITS FUNCTION 1, SEE NOTE 1 BELOW
12 8 BINARY DIGITS FUNCTION 2, SEE NOTE 2 BELOW
13 00 TO 31 HOURS POWER OFF TIMER (CTX 4000 ONLY)
14 000 TO 255 SECS NO CHARGE AIR TIMER DELAY
15 3 DIGITS CALL TIMER RESET CODE
16 - 20 00000 - 99999 SIDH INHIBIT # 1 THRU # 5
21 - 25 NOT USED FUTURE USE
NOTES:
1. This is an eight digit binary field.
10000000 = CALL TIMER BEEP
01000000 = AUTO LOCK
00100000 = AUTO SYSTEM REDIAL
00010000 = CALL RESTRICTION
00001000 = 32 DIGIT DIALING CAPABILITY
11111000 = ALL OF THE ABOVE
2. As above but options are:
10000000 = HANDS FREE
01000000 = CONTINUOUS DTMF
00100000 = REPERTORY DIALING
00010000 = HORN ALERT
00001000 = ALLOWS 911 CALLING WHEN UNIT IS LOCKED
01101000 = ALL OF THE ABOVE
A/B SYSTEM SELECT:
FCN 0 4 DISPLAYS CURRENT MODE,
FCN 0 0 = PREFERRED/NON-PREFERRED,
FCN 0 1 = PREFERRED ONLY,
FCN 0 2 = HOME ONLY
FCN 0 3 = NON PREFERRED ONLY,
"BACK DOOR" PROCEDURES:
We cannot guarantee the accuracy of these procedures, USE CAUTION!
SP 85
The lock code can be reset to 000 be shorting pins 6 and 17 on the handset
control conector.
CTX SERIES
Short pins 6 an 17 on the data cable, turn power on and enter 000 FUNC # 1.
TRANS 55 AND BC 55
Ground pin 1 of the six pin connector next to the modular jack on the
tranceiver. Looking at the tranciever with the modular jack to the right
of the six pin connector, pin one is bottom right.
LOCK: Press LOCK. UNLOCK: Enter three digit code.
SYSTEM SELECT: F 0 4 shows current mode. F 0 0 = Pref/Non pref, F 0 1 = Pref
only, F 0 2 = Home Only, F 0 3 = Non pref only.
phreak/CELLULAR/a_vox03.txt
+110
View File
@@ -0,0 +1,110 @@
AUDIOVOX 3100A,4100A,SP85A,CMT410A,BC55A,CTR1900,PT 300/BC55A,CTR1900
NOTES: These are single NAM units that have user programmable MIN & SIDH,
See below for user instructions.
The ESN prefix is 138 decimal, 8A hex (Toshiba)
These units have an excessive number of "security" features,
You MUST know the lock code or the "reprograming" code and you
may also need an "activation" code. Take care not to program
these options unless you're sure the numbers will not be mislaid.
There is a "back door" for the PT 300 portable, see end.
Audiovox: 516-231-6051/310-926-7758
NAM programing:
1. With the power turned on enter N N N FUNC # 1, where NNN is the three
digit lock code. The manufacturers default is 000. If a reprograming
code has been entered in step 26 (see below) this code must be used in
place of the three digit lock code. If "CODE ?" appears when the phone
is powered up then you must enter the 7 digit "Activation Code" before
entering programing mode, (see step 30).
2. The # key increments the step number.
3. The * key decrements the step number.
4. STO enters the data for each step.
5. You MAY directly access any step by pressing RCL followed by the step
number.
6. FUNC SND completes programing.
7. FUNC CLR exits programing mode.
PROGRAMING DATA:
STEP# #OF DIGITS/RANGE DESCRIPTION
01 10 DIGITS MIN (AREA CODE & PHONE NUMBER)
02 3 DIGITS LOCK CODE
03 00000 - 32767 SYSTEM ID
04 00 - 15 ACCESS OVERLOAD CLASS
05 00 - 15 GROUP ID (10 FOR USA)
06 0 OR 1 LOCAL USE MARK
07 0 OR 1 MIN MARK
08 0333 OR 0334 INITIAL PAGING CHANNEL
09 0 OR 1 PREFERRED SYSTEM
10 4 DIGITS STATION CLASS MARK
11 8 BINARY DIGITS FUNCTION 1, SEE NOTE 1 BELOW
12 8 BINARY DIGITS FUNCTION 2, SEE NOTE 2 BELOW
13 00 TO 31 HOURS POWER OFF TIMER (CTX 4000 ONLY)
14 000 TO 255 SECS NO CHARGE AIR TIMER DELAY
15 3 DIGITS CALL TIMER RESET CODE
16 - 25 00000 - 99999 SIDH INHIBIT # 1 THRU # 5
26 3 DIGITS NAM PROGRAMING CODE (LEAVE BLANK, SEE ABOVE)
27 - 29 NOT USED FUTURE USE
30 7 DIGITS ACTIVATION CODE (LEAVE BLANK, SEE ABOVE)
NOTES:
1. This is an eight digit binary field.
10000000 = CALL TIMER BEEP
01000000 = AUTO LOCK
00100000 = AUTO SYSTEM REDIAL
00010000 = CALL RESTRICTION
00001000 = 32 DIGIT DIALING CAPABILITY
00000100 = AUTO ANSWER
00000010 = AUTO ANSWER FOR DATA
11111000 = ALL OF THE ABOVE
2. As above but options are:
10000000 = HANDS FREE
01000000 = CONTINUOUS DTMF
00100000 = REPERTORY DIALING
00010000 = HORN ALERT
00001000 = ALLOWS 911 CALLING WHEN UNIT IS LOCKED
01101000 = ALL OF THE ABOVE
A/B SYSTEM SELECT:
FCN 0 4 DISPLAYS CURRENT MODE,
FCN 0 0 = PREFERRED/NON-PREFERRED,
FCN 0 1 = PREFERRED ONLY,
FCN 0 2 = HOME ONLY
FCN 0 3 = NON PREFERRED ONLY,
USER PROGRAMING OF MIN & SIDH
Press CLR followed by the new five digit SIDH and ten digit MIN.
Press FUNC 6. The new MIN will be displayed, hold 6 to display the SIDH.
"BACK DOOR" FOR PT-300
1. Remove the battery.
2. Remove the small black square access plate at the lower left of the
phone.
3. Place a 10k resistor between pins 4 and 5.
(Pin 5 is top right, pin 4 is center bottom)
4. Replace battery, power up phone and enter 0 0 0 FUNC # 1.
LOCK: Press LOCK. UNLOCK: Enter three digit code.
SYSTEM SELECT: F 0 4 shows current mode. F 0 0 = Pref/Non pref, F 0 1 = Pref
only, F 0 2 = Home Only, F 0 3 = Non pref only.
phreak/CELLULAR/a_vox04.txt
+89
View File
@@ -0,0 +1,89 @@
AUDIOVOX MVX 500/50, SP95, BC65, TRANS65/420, PRO98, PRT75, CMT420
NOTES: These are single NAM units.
The ESN prefix is 138 decimal, 8A hex (Toshiba)
This unit has an excessive number of "security" features,
You MUST know the lock code or the "reprograming" code and you
may also need an "activation" code. Take care not to program
these options unless you're sure the numbers will not be mislaid.
Audiovox: 516-231-6051/213-926-7758
NAM programing:
1. With the power turned on enter N N N FUNC # 1, where NNN is the three
digit lock code. The manufacturers default is 000. If a reprograming
code has been entered in step 41 (see below) this code must be used in
place of the three digit lock code. If "CODE ?" appears when the phone
is powered up then you must enter the 7 digit "Activation Code" before
entering programing mode, (see step 45).
2. The # key increments the step number.
3. The * key decrements the step number.
4. STO enters the data for each step.
5. You MAY directly access any step by pressing RCL followed by the step
number.
6. FUNC SND completes programing.
7. FUNC CLR exits programing mode.
PROGRAMMING DATA:
STEP# #OF DIGITS/RANGE DESCRIPTION
01 10 DIGITS MIN (AREA CODE & PHONE NUMBER)
02 3 DIGITS LOCK CODE
03 00000 - 99999 SYSTEM ID
04 00 - 15 ACCESS OVERLOAD CLASS
05 00 - 15 GROUP ID (10 FOR USA)
06 0 OR 1 LOCAL USE MARK
07 0 OR 1 MIN MARK
08 0333 OR 0334 INITIAL PAGING CHANNEL, AUTO SET
09 0 OR 1 PREFERRED SYSTEM, AUTO SET
10 4 DIGITS STATION CLASS MARK, AUTO SET
11 8 BINARY DIGITS FUNCTION 1, SEE NOTE 1 BELOW
12 8 BINARY DIGITS FUNCTION 2, SEE NOTE 2 BELOW
13 00 TO 31 HOURS POWER OFF TIMER (NOT USED IN MVX 500)
14 000 TO 255 SECS NO CHARGE AIR TIMER DELAY (NOT USED IN MVX 500)
15 3 DIGITS CALL TIMER RESET CODE
16 - 40 00000 - 99999 SIDH INHIBIT # 1 THRU # 5
41 3 DIGITS NAM PROGRAMMING CODE (LEAVE BLANK, SEE ABOVE)
42 - 44 NOT USED FUTURE USE
45 7 DIGITS ACTIVATION CODE (LEAVE BLANK, SEE ABOVE)
NOTES:
1. This is an eight digit binary field.
10000000 = CALL TIMER BEEP
01000000 = AUTO LOCK
00100000 = AUTO SYSTEM REDIAL
00010000 = CALL RESTRICTION
00001000 = 32 DIGIT DIALING CAPABILITY
00000100 = AUTO ANSWER
00000010 = AUTO ANSWER FOR DATA
00000001 = ANY KEY ANSWER
11111000 = ALL OF THE ABOVE
2. As above but options are:
10000000 = HANDS FREE
01000000 = CONTINUOUS DTMF
00100000 = REPERTORY DIALING
00010000 = HORN ALERT
00001000 = ALLOWS 911 CALLING WHEN UNIT IS LOCKED
01101000 = ALL OF THE ABOVE
A/B SYSTEM SELECT:
FCN 0 4 DISPLAYS CURRENT MODE,
FCN 0 0 = PREFERRED/NON-PREFERRED,
FCN 0 1 = PREFERRED ONLY,
FCN 0 2 = HOME ONLY
FCN 0 3 = NON PREFERRED ONLY,
LOCK: Press LOCK. UNLOCK: Enter three digit code.
phreak/CELLULAR/a_vox05.txt
+51
View File
@@ -0,0 +1,51 @@
AUDIOVOX PR 125.
NOTES: This unit has three NAMS.
The ESN prefix is 138 decimal, 8A hex (Toshiba)
Audiovox: 516-231-6051/213-926-7758
NAM PROGRAMING:
1. Turn on power & within 10 seconds press MUTE 6 2 6 #
2. The phone will display "NAM PROGRAM"
3. Enter 7 8 7 1 3 0 0 RCL
4. The phone will display the ESN in hex format.
5. Press the UP arrow key.
6. The phone will display the ESN in decimal format.
7. Press the UP arrow key to proceed to the first programing step.
8. The UP arrow key is used to store each entry and increment each step.
9. The CLR key can be used to correct an entry prior to the UP arrow key
being pushed.
PROGRAMING DATA:
STEP# #OF DIGITS/RANGE DISPLAY DESCRIPTION
01 10 DIGITS TEL NO MIN (AREA CODE & PHONE NUMBER)
02 00000 - 99999 SID SYSTEM IDENTIFICATION
03 0 OR 1 Local Use LOCAL USE MARK
04 0 OR 1 Min Mark MIN MARK
05 0333 OR 0334 IPCH INITIAL PAGING CHANNEL
06 2 DIGITS Accolc ACCESS OVERLOAD CLASS
07 0 OR 1 Prefer Sys PREFERRED SYSTEM
08 10 OR 15 GIM GROUP ID (10 IN USA)
09 4 DIGITS Lock Code LOCK CODE
10 0 OR 1 End to End DTMF DIALING
11 0 OR 1 A/B SELECT SYSTEM SELECT
12 0 OR 1 AREA CODE DISPLAY AREA CODE
13 0 OR 1 DTX VOX OPERATION
PHONE WILL DISPLAY "STO OR CLR" AT THIS STAGE, ENTER STO TO CONTINUE
OR CLR TO ABORT.
PHONE WILL THEN DISPLAY "SELECT 1-3", PRESS END TO COMPLETE AND EXIT
PROGRAMING, OR SELECT NAM 2 OR 3. STEPS 1 THRU 9 WILL REPEAT FOR
NAM 2 AND/OR 3.
phreak/CELLULAR/a_vox06.txt
+87
View File
@@ -0,0 +1,87 @@
AUDIOVOX CTX 3200, 3200M, 4200
NOTES: These are single NAM units.
The ESN prefix is 138 decimal, 8A hex (Toshiba)
This unit has an excessive number of "security" features,
You MUST know the lock code or the "reprograming" code and you
may also need an "activation" code. Take care not to program
these options unless you're sure the numbers will not be mislaid.
Audiovox: 516-231-6051/213-926-7758
NAM programing:
1. With the power turned on enter N N N FUNC # 1, where NNN is the three
digit lock code. The manufacturers default is 000. If a reprograming
code has been entered in step 41 (see below) this code must be used in
place of the three digit lock code. If "CODE ?" appears when the phone
is powered up then you must enter the 7 digit "Activation Code" before
entering programing mode, (see step 45).
2. The # key increments the step number.
3. The * key decrements the step number.
4. STO enters the data for each step.
5. You MAY directly access any step by pressing RCL followed by the step
number.
6. FUNC SND completes programing.
7. FUNC CLR exits programing mode.
PROGRAMMING DATA:
STEP# #OF DIGITS/RANGE DESCRIPTION
01 10 DIGITS MIN (AREA CODE & PHONE NUMBER)
02 3 DIGITS LOCK CODE
03 00000 - 32767 SYSTEM ID
04 00 - 15 ACCESS OVERLOAD CLASS
05 00 - 15 GROUP ID (10 FOR USA)
06 0 OR 1 LOCAL USE MARK
07 0 OR 1 MIN MARK
08 0333 OR 0334 INITIAL PAGING CHANNEL, AUTO SET
09 0 OR 1 PREFERRED SYSTEM, AUTO SET
10 4 DIGITS STATION CLASS MARK, AUTO SET
11 8 BINARY DIGITS FUNCTION 1, SEE NOTE 1 BELOW
12 8 BINARY DIGITS FUNCTION 2, SEE NOTE 2 BELOW
13 00 TO 31 HOURS POWER OFF TIMER (NOT USED IN MVX 500)
14 000 TO 255 SECS NO CHARGE AIR TIMER DELAY (NOT USED IN MVX 500)
15 3 DIGITS CALL TIMER RESET CODE
16 - 40 00000 - 99999 SIDH INHIBIT # 1 THRU # 5
41 3 DIGITS NAM PROGRAMMING CODE (LEAVE BLANK, SEE ABOVE)
42 - 44 NOT USED FUTURE USE
45 7 DIGITS ACTIVATION CODE (LEAVE BLANK, SEE ABOVE)
NOTES:
1. This is an eight digit binary field.
10000000 = CALL TIMER BEEP
01000000 = AUTO LOCK
00100000 = AUTO SYSTEM REDIAL
00010000 = CALL RESTRICTION
00001000 = 32 DIGIT DIALING CAPABILITY
00000010 = AUTO ANSWER FOR DATA
11111010 = ALL OF THE ABOVE
2. As above but options are:
10000000 = HANDS FREE
01000000 = CONTINUOUS DTMF
00100000 = REPERTORY DIALING
00010000 = HORN ALERT
00001000 = ALLOWS 911 CALLING WHEN UNIT IS LOCKED
01101000 = ALL OF THE ABOVE
A/B SYSTEM SELECT:
FCN 0 4 DISPLAYS CURRENT MODE,
FCN 0 0 = PREFERRED/NON-PREFERRED,
FCN 0 1 = PREFERRED ONLY,
FCN 0 2 = HOME ONLY
FCN 0 3 = NON PREFERRED ONLY,
LOCK: Press LOCK. UNLOCK: Enter three digit code.
phreak/CELLULAR/acous-cell.txt
+139
View File
@@ -0,0 +1,139 @@
UnAuThOrIsEd AcCeSs +44(0)1636-613949 24hrs "information with attitude"
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
<> <>
<> How to connect any cellular phone to a modem <>
<> <>
<> By Phantasm <>
<> <>
<> UnAuThOrIsEd AcCeSs [PRIVATE] <>
<> +44(0)1636-613949 <>
<> <>
<> Release Date: 8th/July/1995 <>
<> <>
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
* Introduction:
Since the days of hacking using a standard telephone line are almost over,
many of todays hacker community are moving towards cellular communications.
ESN/MIN pairs are no longer difficult to obtain and if used carefully will
last much longer than calling cards, codes and most other methods of phone
phreaking.
This text file will explain how to easily connect any cellular phone to a
modem, without the expense of buying a cellular line interface or
similar device.
* What you will require:
To undertake this project you will require the following;
1 desktop telephone
1 telephone doubler socket
4 lengths of wire (30cm long)
1 roll of solder
1 roll of masking tape
You will also require a soldering iron, wire strippers and a screw driver.
* Instructions:
1. Unscrew the screws holding your desktop telephone handset together. Remove
the ear piece speaker and microphone from the plastic moulding and cut
the wires connected to them.
2. Now solder the 30cm long lengths of wire onto the existing handset ear
piece speaker and microphone wires. Once you have done this, simply re-solder
the ear piece speaker and microphone onto the extended handset wiring.
3. Place the extended handset ear piece speaker over the mouth piece on your
cellular telephone and wrap in masking tape. This will not only hold the
extended handset ear piece speaker in position, but also prevent background
noise problems.
4. Now place the extended handset microphone over the ear piece on your
cellular telephone and wrap in masking tape as above.
* How to use the device:
Basically, what you have done is turned your desktop telephone into an
accoustic coupler type device. To use the device, simply follow the
instructions below.
1. Plug your telephone doubler socket into your telephone socket. Plug
your desktop telephone into one socket and your modem line into the other
socket.
2. Leave your telephone handset off the hook until your line is completely
dead. (i.e. after you have listened to "please replace the handset and try
again" or something similar about 10 times.
3. Dial the modem dialup you wish to call on your cellular phone and
press SEND as you would normally.
4. Type ATD into your terminal package and press return. Your modem should
now be off the hook and waiting for a carrier signal from your cellular
telephone.
* Diagram of device:
__
: :
: :
________:__:_
______ : :
/ : /:: ::::: :
/ :---+ +--------------: :: ::::::: : ear piece
/ :-+ : : +------------: :: ::::: :
: ____: : : : : \:: _________ :
: / : : : : : : : :
: : : : : : : :_________: :
: : : : : : : :
: : : +-- : : ---------+ : [1][2][3] :
: : +---- : : -------+ : : [4][5][6] :
: : : : : : : [7][8][9] :
: : : : : : : [*][0][#] :
: : : : : : : _ _ _ :
: \____ : : : : : [_][_][_] :
: : : : : : /:: :
\ :-------+ : : +-: :: ::: : microphone
\ :---------+ +---: :: ::: :
\______: \:: :
: :_____________:
:
: cellular telephone
:
desktop telephone
handset
* How it works:
The carrier signal from the remote modem will be sent out of your cellular
telephone ear piece speaker and into the desktop telephone handset
microphone. Your modem will receive any data send into the desktop telephone
handset after the ATD (off-hook) command has been issued.
In the same way, any carrier signals from your modem will be sent out of the
desktop telephone handset earpiece speaker and into your cellular telephone
microphone.
At the time of writing, I have not connected at speeds higher than 1200 baud
due to the low quality of anologue cellular network telephone lines. I would
expect that those using transportable cellular phones (such as the Motorola
4800 and 6800 series) should have no problems connecting at 2400 baud or
higher.
I did not write this text file so that people could use it to transfer large
amounts of data at high speed. This is simply a guide to explain how easy
it is to use any cellular telephone with a modem. 1200 baud may be slow,
but it is fine for hacking, calling your favourite underground BBS or
transfering text files --- especially if you are not paying for it!
If anyone has any suggestions or comments, leave feedback to 'Phantasm'
on UnAuThOrIsEd AcCeSs BBS.
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
phreak/CELLULAR/acoustic.txt
+139
View File
@@ -0,0 +1,139 @@
UnAuThOrIsEd AcCeSs +44(0)1636-613949 24hrs "information with attitude"
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
<> <>
<> How to connect any cellular phone to a modem <>
<> <>
<> By Phantasm <>
<> <>
<> UnAuThOrIsEd AcCeSs [PRIVATE] <>
<> +44(0)1636-613949 <>
<> <>
<> Release Date: 8th/July/1995 <>
<> <>
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
* Introduction:
Since the days of hacking using a standard telephone line are almost over,
many of todays hacker community are moving towards cellular communications.
ESN/MIN pairs are no longer difficult to obtain and if used carefully will
last much longer than calling cards, codes and most other methods of phone
phreaking.
This text file will explain how to easily connect any cellular phone to a
modem, without the expense of buying a cellular line interface or
similar device.
* What you will require:
To undertake this project you will require the following;
1 desktop telephone
1 telephone doubler socket
4 lengths of wire (30cm long)
1 roll of solder
1 roll of masking tape
You will also require a soldering iron, wire strippers and a screw driver.
* Instructions:
1. Unscrew the screws holding your desktop telephone handset together. Remove
the ear piece speaker and microphone from the plastic moulding and cut
the wires connected to them.
2. Now solder the 30cm long lengths of wire onto the existing handset ear
piece speaker and microphone wires. Once you have done this, simply re-solder
the ear piece speaker and microphone onto the extended handset wiring.
3. Place the extended handset ear piece speaker over the mouth piece on your
cellular telephone and wrap in masking tape. This will not only hold the
extended handset ear piece speaker in position, but also prevent background
noise problems.
4. Now place the extended handset microphone over the ear piece on your
cellular telephone and wrap in masking tape as above.
* How to use the device:
Basically, what you have done is turned your desktop telephone into an
accoustic coupler type device. To use the device, simply follow the
instructions below.
1. Plug your telephone doubler socket into your telephone socket. Plug
your desktop telephone into one socket and your modem line into the other
socket.
2. Leave your telephone handset off the hook until your line is completely
dead. (i.e. after you have listened to "please replace the handset and try
again" or something similar about 10 times.
3. Dial the modem dialup you wish to call on your cellular phone and
press SEND as you would normally.
4. Type ATD into your terminal package and press return. Your modem should
now be off the hook and waiting for a carrier signal from your cellular
telephone.
* Diagram of device:
__
: :
: :
________:__:_
______ : :
/ : /:: ::::: :
/ :---+ +--------------: :: ::::::: : ear piece
/ :-+ : : +------------: :: ::::: :
: ____: : : : : \:: _________ :
: / : : : : : : : :
: : : : : : : :_________: :
: : : : : : : :
: : : +-- : : ---------+ : [1][2][3] :
: : +---- : : -------+ : : [4][5][6] :
: : : : : : : [7][8][9] :
: : : : : : : [*][0][#] :
: : : : : : : _ _ _ :
: \____ : : : : : [_][_][_] :
: : : : : : /:: :
\ :-------+ : : +-: :: ::: : microphone
\ :---------+ +---: :: ::: :
\______: \:: :
: :_____________:
:
: cellular telephone
:
desktop telephone
handset
* How it works:
The carrier signal from the remote modem will be sent out of your cellular
telephone ear piece speaker and into the desktop telephone handset
microphone. Your modem will receive any data send into the desktop telephone
handset after the ATD (off-hook) command has been issued.
In the same way, any carrier signals from your modem will be sent out of the
desktop telephone handset earpiece speaker and into your cellular telephone
microphone.
At the time of writing, I have not connected at speeds higher than 1200 baud
due to the low quality of anologue cellular network telephone lines. I would
expect that those using transportable cellular phones (such as the Motorola
4800 and 6800 series) should have no problems connecting at 2400 baud or
higher.
I did not write this text file so that people could use it to transfer large
amounts of data at high speed. This is simply a guide to explain how easy
it is to use any cellular telephone with a modem. 1200 baud may be slow,
but it is fine for hacking, calling your favourite underground BBS or
transfering text files --- especially if you are not paying for it!
If anyone has any suggestions or comments, leave feedback to 'Phantasm'
on UnAuThOrIsEd AcCeSs BBS.
<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
phreak/CELLULAR/adpcm.txt
+233
View File
@@ -0,0 +1,233 @@
ADPCM Equipment for 9.6-Kbps Data
The ADPCM algorithm proposed by OKI Electric of
Japan seems to be a formidable alternative for the
standard.
(an article taken from Telephony magazine, September 1987)
[+] by Yoshihiko Yokoyama
In 1982, the CCITT started work on developing a second
digital encoding standard for speech, after decades of
extensive use of PCM at 64 kbps in the A-law or u-law
formats. The result of that effort was, the encoding
standard of the 32-kbps ADPCM algorithm, known as CCITT
recommendation G.721. It was recognized from the beginning
that the algorithm should maintain adequate performance for
voice-band data signals, although it was acknowledged that
such signals were limited to data rates of up to 4800 bps for
the state-of-the-art ADPCM algorithms. This has resulted in
a virtual hesitation of widespread application of the
standard in the public switched telephone networks (PSTNs),
for which it was intended. Network operators have concluded
that a fast-growing need exists for transmitting data at 9600
bps for their customers, and using G.721 makes that
impossible.
Susequently, the CCITT has embarked on a course of defining
a digital encoding standard for digital circuit
multiplication equipment (DCME), which combines time
assignment speech interpolation (TASI) and a low-rate
encoding technique such as ADPCM to form a very efficient
means of transmitting speech. How to transmit data in such a
system has been the subject of considerable debate and
extensive effort by many experts in the field. It should be
pointed out that, similar to the transcoding standard of
G.721, interfacing with the DCME must be accomplished by
means of an A-law or u-law encoded PCM signal format.
The need for transmitting data up to 9600 bps has been
recognized, and three algorithms have undergone scrutiny by a
group of experts in the field. Two of the algorithms have
the inherent capability of transmitting 9600-bps voice-band
data at the 32-kbps rate, whereas the third algorithm under
consideration is G.721, which does not have that capability.
[+] PRESENT STANDARDIZATION EFFORTS
DCME Aspects
A DCME system is basically an all-digital implementation of
the old concept of TASI. DCME systems operate on the
statistical behavior of a group of talkers in a communication
system. This is characterized by the average time that a
talker on a connection is actually active, nominally assumed
to be 35-40 percent of the total time the circuit is used for
a call. Thus, the remaining time is available for
time-interleaving the speech of other talkers. On the
average, circuit usage can be increased or multiplied by a
factor called digital speech interpolation (DSI) gain. Gain
factors between 2 and 2.5 are commonly used, but these gain
factors are dependent on the actual speech activity exhibited
by the talkers. The larger the group of talkers, the more
statistical stability is attained, and individual
fluctuations in speech activity can be accommodated by the
system. Long talk spurts by one talker are simultaneously
compensated by silence or shourt spurts by another.
Short durations of active speech, more than can be
accommodated by available transmission capacity, do occur.
Without "special means," this would result in what is known
as clipped speech. In DCME, this special means is provided by
instantly reducing the coding rate of one or more channels
(talkers). That is, when the DCME operates nominally with
ADPCM at 32 kbps during overload, this rate is reduced to
24 kbps for one or more channels. As sampling occurs at 8000
times per second, this means that the nominal channel being
encoded at 4 bits/sample is reduced to encoding at 3
bits/sample during overload. This brings about a small
degradation in performance by increased quantizing noise, but
it occurs only sporadically due to the statistical nature of
the phenomenon. Therefore, it is virtually imperceptible as
long as the signal load to the DCME is strictly speech. When
an appreciable part of the DCME load is data (more than 20
percent), special precaution must be taken to prevent
noticeable degradation, because data signals do not exhibit
the same on-off activity as speech. In fact, data are
considered, generally, as being 100 percent active, thus
providing no bearer circuit-sharing capability.
When the DCME load is a mix of speech and data, it is clear
overload will occur more often for the speech signals,
resulting in an associated decrease in performance in the
form of higher quantizing distortion. The choice of ADPCM
algorithm for the DCME has an important bearing on this
problem.
[+] CCITT EFFORTS
The CCITT is considering using the basic G.721 algorithm
for speech at 32 kbps for DCME, but due to that algorithm's
inablity to handle 9600-bps data at 32 kbps, encoding at 40
kbps per channel is needed for data signals at such rates.
This is clearly having a more profound influence on the use
of available bearer transmission capacity than if encoding of
data could be limited to using the 32-kbps bearer rate per
channel. For example, a 60-channel DCME system employing a
proprietary ADPCM developed by OKI Electric of Japan can
accommodate 10 percent data traffic up to 9.6 kbps, whereas
G.721 ADPCM can only accommodate 6.7 percent data and
maintain the same speech performance. Moreover, the DCME
design is considerably simpler with the proprietary ADPCM,
since there is no need to reconfigure the frame structure for
including 5-bit/sample encoding for data.
Another aspect of ADPCM in DCME systems is the need to
tandem such systems for multilink networking purposes. It
can generally be argued that no more than two DCME links
should be allowed to be switched in any end-to-end
connection. If such switching is performed by an analog
switch (asynchronous tandeming), an accumulation of
distortion will be experienced in the second link.
However, if a digital switch would be employed, directly
operating on the PCM output of the first DCME link, passing
it digitally on to the second link (synchronous tandeming),
no additional distortion will be experienced. Both the OKI
ADPCM and the G.721-related technique in DCME application
will have the "synchronous" capability as an inherent part of
the design. A third algorithm, mentioned earlier, does, not
possess that capability, and it will not be discussed.
Digital switching will increasingly be employed in the
public networks. Therefore, the loss of performance due to
asynchronous tandeming, if it occurs at all, may only be
temporarily experienced and should not pose a serious
concern. This aspect of tandeming is not uniquely related to
DMCE systems. Any application of 32 kbps could encounter the
need for tandeming in a network. As digital switching will
be increasingly applied, either by replacing analog switches
or in new installations, the advantage of the ADPCM technique
will be even more evident because of its capability of
transmitting up to 9.6-kbps voice-band data signals.
The CCITT nevertheless has decided to hold on to the G.721
technique, even though a clearly superior technique in now
available.
[+] OKI ADPCM
PERFORMANCE
Data
Extensive performance measurements have been made in a
carefully assembled test bed at COMSAT Laboratories. (This
test bed received approval by the organizations that
submitted ADPCM equipment for evaluation and comparison in a
CCITT context. This made comparisons between algorithms
valid and accurate.) The circuit in which the ADPCM
equipment was tested included a simulated analog access link
which introduced typical distortion effects (analog
impairments) that a voice-band data signal may experience
before being encoded by the ADPCM link.
The typical performance after encoding by OKI ADPCM of a
CCITT V.29 modem (The V.32 modems will perform even better
than V.29 modems because of their inherent design. Thus,
V.29 performance shown (graphs are not shown here in this
text due to the inablility to draw or copy it here with
this word processor) here is more critical to the user.)
in terms of block error rate (BLER), as a function of S/N
ratio of the data signal in the analog impairment circuit
(i.e, just before being encoded), is illustrated in figure 1.
Ther lower curve shown resulted after a single ADPCM
encoding, whereas the higher curve resulted after a second
ADPCM link was added to the first by means of an analog
interconnection between the two links. Thus, this second
curve is the result of asynchronous tandeming of two links.
The curve showing single encoding perfomance applies also for
the case of multiple encodings via digital switches, referred
to as synchronous tandeming. A reference performance
threshold of BLER = 10-2nd power at S/N =30.5 db (this
reference point was selected by an SG XVIII expert group.) is
well met by both curves. This indicates the excellent
capability of the ADPCM equipment for transmitting 9.6-kbps
V.29 signals.
The performance of a V.29 modem operating at the back-off
rate of 4.8-kbps tandem through four asynchronous encodings
of the ADPCM equipment is shown in figure 2. For comparison,
the dashed curve in fig. 2 shows the performance of the same
modem when four asychronous links of G.721 ADPCM equipment
are substituted for the OKI equipment. At S/N values to be
expected in the networks, the OKI advanced ADPCM can perform
two or more orders of magnitude better than G.721. This may
not be required for this modem speed, but it is simply a
consequence of its inherently more powerful predictor than
that employed in G.721, and, as such, it provides an
increased performance margin.
Voice
When considering ADPCM designs, the primary purpose has
always been to provide high performance for voice signals.
This objective has unquestionably been attained by the
G.721 designers. Extensive subjective tests have proven
the algorithm delivers the speech performance required for
the networks.
Similarly, the OKI ADPCM equipment provides the required
performance when speech is transmitted through it. Tests
similar to those used for evaluating the G.721 algorithm have
been performed with the OKI ADPCM equipment, particulary for
the English and Japanese languages.
DCME Gain
As has been pointed out earlier in the article, when
applied in DCME systems, the proprietary ADPCM technique
offers the advantage of encoding all voice-band data by using
only only 4 bits/sample. This offers a bearer-channel
efficiency advantage of up to 20 percent when transmitting 60
channels with 20 percent data. This includes a
bearer-capacity increase to avoid speech degradation. Such
an advantage may be particularly important for countries that
may want to minimize their cost of communication.
It should be emphasized, however, that without DCME, the
main advantage of the propietary ADPCM resides in its
capability of transmitting up to 9.6-kbps voice-band data.
This has an important bearing on networks, since meeting
this requirement is or will become indispensable.
-------------------------------------------------------------
Yoshihiko Yokoyama is the General Representative for OKI
America, Inc., New York office.
--------------------------------------------------------------
phreak/CELLULAR/alpine01.txt
+95
View File
@@ -0,0 +1,95 @@
ALPINE 9511, 9525 and 9530.
NOTE: These units are manufactured by Fujitsu and have four NAMS.
The ESN prefix is 150 decimal, 96 hex.
New units will remain locked until programed.
Alpine: 310-326-8000, Outside CA 1-800-421-2284
NAM 1 programing:
1: Turn on power.
2. Confirm unit is locked, if not press F + * (LOCK).
3. Turn power off and on again. Press #626#7764726, this spells
#NAM#PROGRAM on the keypad. This code must be entered within
ten seconds of power up.
4. You will hear a continuous tone once the above step has been
completed. Hold down the * key during this tone. The tone
becomes intermittent. Continue to hold * until the tone
stops. Release *.
5. You are now in program mode, the phone will display the NAM
program step number and the data for that step.
6. The STOR key enters data and increments the step number.
7. The SEND key completes and exits programing mode.
8. If all data has been entered correctly the phone will wake
up in the locked mode. Enter the 3 or 4 digit lock code.
9. If any data was entered incorrectly the phone will emit a
short high tone. Scroll thru ALL entries to confirm, then
press SEND again. NOTE: Even if only one step is incorrect
you must step thru all entries for the phone to recycle when
you press SEND.
TO PROGRAM NAMS 2 THRU 4:
1. With phone powered up and unlocked press F+7+N where N = the
NAM number 2, 3 or 4.
2. Lock the phone. (F+*)
3. Program the additional NAM(S) by following the above
procedures from step 3.
PROGRAMING DATA:
STEP# #OF DIGITS/RANGE DESCRIPTION
01 00001-32767 SIDH
02 0 OR 1 LOCAL USE
03 0 OR 1 MIN MARK
04 10 DIGITS MIN (PHONE #)
05 00-15 STATION CLASS
06 0333 OR 0334 INITIAL PAGING CHANNEL
07 2 DIGITS ACCESS OVERLOAD
08 0 OR 1 PREFERRED SYSTEM
09 2 DIGITS GROUP ID (10 FOR USA)
10 3 OR 4 LOCK CODE
11 1 - 4 CALL TIMER
1 = user changeable, timer off.
2 = 6 second increments.
3 = 30 second increments.
4 = 60 second increments.
12 1 - 4 LOCK MODE
1 = user changeable, manual lock, no
outgoing calls.
2 = manual lock, no incoming or
outgoing calls.
3 = Auto lock, no outgoing calls.
4 = Auto lock, no incoming or
outgoing calls.
13 1 - 5 CALL RESTRICTION MODE
1 = No restriction.
2 = No memory access.
3 = No long distance.
4 = 2 & 3 combined
5 = Memory dialling only.
14 0 - 32767 SIDH INHIBIT
15 0 - 32767 SIDH INHIBIT
16 0 - 32767 SIDH INHIBIT
NOTE: Alpine 9511 does not have SIDH inhibit and will return to step
one having completed step 13.
LOCK: F LOCK. UNLOCK: Three or Four digit code.
SYSTEM SELECT: F11 = A/B, F12 = B/A, F13 = A ONLY, F14 = B ONLY,
F15 = HOME ONLY
phreak/CELLULAR/alpine02.txt
+46
View File
@@ -0,0 +1,46 @@
ALPINE 9542, 9545
NOTE: These are four NAM units.
The ESN prefix is 150 decimal, 96 hex.
Alpine: 310-326-8000, Outside CA 1-800-421-2284
NAM PROGRAMING:
1. Turn power on.
2. Press FCN 3 to lock phone.
3. Press and hold FCN until the ROAM comes on, release FCN.
4. Within three seconds press and hold the * key until the first step
(SIDH) appears. You are now in programing mode.
5. The STO key stores and increments each step.
6. The SEND key completes and exits programing.
7. If you press STO six times at step 01 the phone will display the ESN
in hex format. Press STO again to return to the SIDH entry.
8. To select other NAMS: With phone in normal user mode press FCN 4,
use the volume up and down keys to scroll through the NAMS, press STO
when the NAM you want to program is displayed.
PROGRAMING DATA
STEP# #OF DIGITS/RANGE DESCRIPTION
01 0000 - 32767 SYSTEM ID
02 0 or 1 MIN MARK
03 10 DIGITS AREA CODE & TEL NUMBER
04 2 DIGITS ACCESS OVERLOAD CLASS
05 2 DIGITS GROUP ID (10 IN USA)
06 3, 4 OR 5 DIGITS LOCK CODE

phreak/CELLULAR/amstra~1
+1925
View File
File diff suppressed because it is too large Load Diff
phreak/CELLULAR/antel01.txt
+55
View File
@@ -0,0 +1,55 @@
ANTEL STR-300/330/500/550/700/770/950X
NOTES: These units have two NAMS.
The ESN prefix is 146 decimal, 92 hex.
Antel: 516-273-8000
NAM Programing:
1. Enter 04049, FCN, FCN.
2. The phone's ESN (step 01 below) will be displayed.
3. SEND is used to store and increment the step number. If an invalid
entry is made the display will not increment.
4. END is used to complete and exit programing at any time.
5. CLR is used to correct an entry.
PROGRAMING DATA:
STEP# #OF DIGITS/RANGE DISPLAY DESCRIPTION
01 CAN NOT BE CHANGED ESN ESN
02 3 DIGITS AREACD AREA CODE
03 7 DIGITS PHONE MIN (PHONE #)
04 00000 - 32767 SYSID SYSTEM ID
05 0 OR 1 LOCAL LOCAL USE
06 0 OR 1 MINMARK MIN MARK
07 0333 or 0334 IPCH INITIAL PAGING CHANNEL
08 00 TO 15 ACCOLC ACCESS OVERLOAD
09 0 OR 1 PRESYS PREFERRED SYSTEM
10 00 TO 15 GROUP GROUP ID (10 FOR USA)
11 4 DIGITS SEC CODE SECURITY CODE
12 0 OR 1 HANDFREE 1 = YES, 0 = NO
13 0 OR 1 HORNALRT 1 = YES, 0 = NO
14 0 OR 1 AUTONREG SEE NOTE 1
15 0 OR 1 WHERE SEE NOTE 2
16 0 OR 1 BEEP 1 = 60 SEC BEEP, 0 = NO BEEP
17 0 OR 1 CTONE CONTINUOUS DTMF
18 0 OR 1 DUAL NAM DUAL NAM
If dual nam is set to 1 then step 2 thru 10 will alternate between NAM 1
and NAM 2 each time you scroll through the data.
Notes: 1. A "1" enables the phone to auto register when roaming.
2. A "1" makes the phone alert all non home systems upon entry.
LOCK - Press F * and hold * for two seconds. UNLOCK - CLR then three digit
lock code.
SYSTEM SELECT: F51 = A/B, F52 = B/A, F53 = A ONLY, F54 = B ONLY,
F55 = HOME ONLY.
phreak/CELLULAR/antel02.txt
+40
View File
@@ -0,0 +1,40 @@
ANTEL STR-1100
NOTES: This unit has three NAMS.
The ESN prefix is 175 decimal & AF hex.
ANTEL: 516-273-6939
NAM programing:
1. Turn power on.
2. Enter M (mute) 310 #. Step 01 (security code) will be displayed,
press RCL to advance to the ESN display.
3. The up arrow key is used to store and increment each item.
4. The END key is used to complete and exit programing mode.
PROGRAMING DATA:
STEP# #OF DIGITS/RANGE DISPLAY DESCRIPTION
01 2567252 ONLY SEC CODE SECURITY CODE
02 UN CHANGEABLE HEX HEX ESN
03 UN CHANGEABLE DEC DECIMAL ESN
04 1, 2 OR 3 NAM SELECT
05 0 OR 1 PROG EXIST ENTER "1" TO PROCEED
06 10 DIGITS TEL NO AREA CODE & TEL NUMBER
07 00000 - 32767 SYSID SYSTEM ID
08 0 OR 1 LOCAL LOCAL USE MARK
09 0 OR 1 MIN MARK MIN MARK
10 0333 OR 0334 IPCH INITIAL PAGING CHANNEL
11 2 DIGITS ACCOLC ACCESS OVERLOAD CLASS
12 0 OR 1 PRESYS PREFERRED SYSTEM
13 2 DIGITS GIM GROUP ID (10 IN USA)
14 4 DIGITS LOCK LOCK CODE
15 0 OR 1 END TO END DTMF SIGNALLING
16 0 OR 1 A/B ALLOW USER A/B SELECT
17 0 OR 1 AREA ? SET TO "1"
18 0 OR 1 DTX VOX MODE
19 STO OR CLR PRESS STO TO ACCEPT OR CLR TO ABORT.
phreak/CELLULAR/antel03.txt
+39
View File
@@ -0,0 +1,39 @@
ANTEL STR-1300
NOTES: This unit has three NAMS.
The ESN prefix is 175 decimal & AF hex.
ANTEL: 516-273-6939
NAM programing:
1. Turn power on.
2. Enter M (mute) 626 #. Step 01 (security code) will be displayed,
press RCL to advance to the ESN display.
3. The up arrow key is used to store and increment each item.
4. The END key is used to complete and exit programing mode.
PROGRAMING DATA:
STEP# #OF DIGITS/RANGE DISPLAY DESCRIPTION
01 7871300 ONLY SEC CODE SECURITY CODE
02 UN CHANGEABLE HEX HEX ESN
03 UN CHANGEABLE DEC DECIMAL ESN
04 10 DIGITS NAM1 PROG TEL NAM 1 AREA CODE & TEL NUMBER
05 00000 - 32767 NAM1 PROG SID NAM 1 SYSTEM ID
06 0 OR 1 NAM1 PROG LOCAL NAM 1 LOCAL USE MARK
07 0 OR 1 NAM1 MIN MARK NAM 1 MIN MARK
08 0333 OR 0334 NAM1 PROG IPCH NAM 1 INITIAL PAGING CHANNEL
09 2 DIGITS NAM1 PROG ACCOLC NAM 1 ACCESS OVERLOAD CLASS
10 0 OR 1 NAM1 PRESYS NAM 1 PREFERRED SYSTEM
11 2 DIGITS NAM1 PROG GIM NAM 1 GROUP ID (10 IN USA)
12 4 DIGITS NAM PROG LOCK LOCK CODE
13 0 OR 1 NAM PROG END TO END DTMF SIGNALLING
14 0 OR 1 NAM PROG A/B ALLOW USER A/B SELECT
15 0 OR 1 NAM PROG AREA ? USUALLY "1"
16 0 OR 1 NAM PROG DTX VOX OPTION
17 STO OR CLR PRESS STO TO ACCEPT OR CLR TO ABORT
18 END, 2 OR 3 PRESS END TO COMPLETE, 2 OR 3 FOR ADDITIONAL NAMS
phreak/CELLULAR/antel04.txt
+57
View File
@@ -0,0 +1,57 @@
-------------------------------------------------------------------------------
ANTEL LENEX LNX100, NTX 110, LNX200 and NTX220
-------------------------------------------------------------------------------
NAM Type: EEPROM
Manufactuer: General Electric
Programmer: Handset
ESN Prefix DEC: 146
HEX: 92
ESN, S/N Match Required: Yes
Stamped Model Number: 100 series - LENEX 1
200 series - LENEX 2
Available Channels: 832
Programming Sequence: Enter sequence: 04049 + FCN + FCN
ESN will be displayed
Press SEND to increment
Once Parameter has been entered, press SEND
to enter step and increment
Press END to stroe programmed data in NAM and
resume normal operation
# digits
Area Code: 3 XXX + SEND
Mobile Number: 7 XXX-XXXX + SEND
System ID Format: 5 XXXXX + SEND
Local Use Option: 1 1 + SEND
MIN Option: 1 1 + SEND
Initial Paging Channel: 4 0333 or 0334 + SEND
Access Overload Class: 2 XX + SEND
Preferred System: 1 0(B) or 1(A) + SEND
Group ID Format: 2 XX + SEND
Security Code: 4 XXXXX + SEND
Handsfree: 1 0(Disable) + SEND or 1(Enable) + SEND
Horn Alert: 1 0(Disable) + SEND or 1(Enable) + SEND
Antonomous Registration: 1 0(Disable) + SEND or 1(Enable) + SEND
Whereabouts Known: 1 0(Disable) + SEND or 1(Enable) + SEND
One-minute Audible Beep: 1 0(Disable) + SEND or 1(Enable) + SEND
Continuous Tone: 1 0(Disable) + SENd or 1(Enable) + SEND
Dual NAME: 1 0(Disable) + SEND or 1(Enable) + SEND
(When Dual NAM is enable, it begins programming again for second NAM)
Horn Alert: FCN + 9
New Unlock Code: NAM
Systyem Select: FCN + 4 + * or # (to scroll choices)
Selections include: Preferred (AB or BA)
Altr only (Alternate only A only or B only)
Pref only (A only or B only)
Roam only (No Home operation)
Home only
Alternate (Altrernate AB or BA)
Press END to exit and Store Selections
phreak/CELLULAR/ara01.txt
+52
View File
@@ -0,0 +1,52 @@
ARA PRO-COMM 1800
NOTES: This is a single NAM unit.
The ESN prefix is 146 decimal, 92 hex.
ARA/H & R Radio: 1-800-523-6605
1. Power unit up by pressing any key.
2. Within 10 seconds press and hold the clear (CL) key while
entering 923885.
3. Most phones will display the ESN in decimal format at this stage.
4. The S (SEND) key is used to store each step and increment the step
number.
5. The CL (CLEAR) key can be used to correct an entry prior to pressing
SEND.
6. The END key is used to exit programing mode and revert to normal
operation at any time.
7. Invalid data will cause the phone to beep, the display will not
increment, press CL and re-enter the data.
PROGRAMING DATA:
STEP# #OF DIGITS/RANGE DESCRIPTION
00 10 DIGITS MIN (AREA CODE & PHONE #)
01 000 - 999 LOCK CODE
02 00000 - 32767 SYSTEM ID
03 0 OR 1 LOCAL USE
04 0 OR 1 MIN MARK
05 333 OR 334 INITIAL PAGING CHANNEL
06 00 - 15 ACCESS OVERLOAD
07 0 OR 1 PREFERRED SYSTEM
08 00 TO 15 GROUP ID (10 FOR USA)
09 0 OR 1 HORN ALERT
10 0 OR 1 HANDS FREE
11 000 - 999 ALTERNATIVE LOCK CODE, MUST BE DIFFERENT FROM
STEP 01
LOCK: Hold END/FCN and press 7. UNLOCK: Enter three digit code and SND, three
incorrect attempts will freeze unit for seven minutes, leave powered up for
seven minutes before trying again.
SYSTEM SELECT: Press and hold E then 4, display will show current mode:
0 = Pref/Non pref, 1 = Pref only, 2 = Home only, 3 = Non home only, 4 = Non
pref/pref, 5 = Non pref only.
Use volume to scroll to desired option, then press CL.
phreak/CELLULAR/ara1800.txt
+52
View File
@@ -0,0 +1,52 @@
ARA PRO-COMM 1800
NOTES: This is a single NAM unit.
The ESN prefix is 146 decimal, 92 hex.
ARA/H & R Radio: 1-800-523-6605
1. Power unit up by pressing any key.
2. Within 10 seconds press and hold the clear (CL) key while
entering 923885.
3. Most phones will display the ESN in decimal format at this stage.
4. The S (SEND) key is used to store each step and increment the step
number.
5. The CL (CLEAR) key can be used to correct an entry prior to pressing
SEND.
6. The END key is used to exit programing mode and revert to normal
operation at any time.
7. Invalid data will cause the phone to beep, the display will not
increment, press CL and re-enter the data.
PROGRAMING DATA:
STEP# #OF DIGITS/RANGE DESCRIPTION
00 10 DIGITS MIN (AREA CODE & PHONE #)
01 000 - 999 LOCK CODE
02 00000 - 32767 SYSTEM ID
03 0 OR 1 LOCAL USE
04 0 OR 1 MIN MARK
05 333 OR 334 INITIAL PAGING CHANNEL
06 00 - 15 ACCESS OVERLOAD
07 0 OR 1 PREFERRED SYSTEM
08 00 TO 15 GROUP ID (10 FOR USA)
09 0 OR 1 HORN ALERT
10 0 OR 1 HANDS FREE
11 000 - 999 ALTERNATIVE LOCK CODE, MUST BE DIFFERENT FROM
STEP 01
LOCK: Hold END/FCN and press 7. UNLOCK: Enter three digit code and SND, three
incorrect attempts will freeze unit for seven minutes, leave powered up for
seven minutes before trying again.
SYSTEM SELECT: Press and hold E then 4, display will show current mode:
0 = Pref/Non pref, 1 = Pref only, 2 = Home only, 3 = Non home only, 4 = Non
pref/pref, 5 = Non pref only.
Use volume to scroll to desired option, then press CL.
phreak/CELLULAR/astra1d.txt
+113
View File
@@ -0,0 +1,113 @@
Upgrading for Astra 1D (set your page width 78)
October 1995
<---------------------------------------------------------------------------->
This article is Copyright 1995 M T Pickering
You may store or print it for your own use but you may not publish it
without permission from the author and you may not sell it.
<---------------------------------------------------------------------------->
Astra 1D is the fourth Astra satellite. The satellites sit together in a
tight cluster out in space (see the promotional video if it is still being
broadcast).
Each satellite broadcasts 16 or more channels.
Each satellite transmits these channels within a certain band of
frequencies.
Astra 1E uses the highest band. 1F is also planned.
Astra 1C uses a high band.
Astra 1B uses a lower band
Astra 1A uses a still lower band
Astra 1D uses the lowest
The old, standard LNB is designed to amplify channels in the middle three
bands.
Some can also amplify channels in the lowest (1D) band but the tuner in
your old receiver probably can't tune low enough to receive them. (Some
receivers can just about tune down to the TOP channel of Astra 1D but no
further).
There are several ways of getting to watch these 1D channels:
Some receivers can't tune lower but they can tune HIGHER. If the numbers in
your tuning display go up to 11.990 then you may be in luck. An "Enhanced"
LNB not only amplifies the 1D channels but it also sends ALL channels down
the cable at a higher frequency. It effectively shifts them all higher by a
count of 250.
So if you fit an "Enhanced" LNB to your dish and tune EVERY channel higher
by 250, you should be able to receive every channel listed, or at least
from NBC Super Channel near the bottom of 1D up to CNN International near
the top of Astra 1C band.
(For example, with your standard LNB you will find CNN tuned to
approximately 11.627 but with an "Enhanced" LNB you must retune to 11.877 -
that is 250 higher. Do this for every channel and the job is done. An
hour's work with a calculator.
Examples of receivers which will work with an "Enhanced" LNB are:
Most Pace SS9200 and derivatives (GIRD3000, SAT1600, BUSH IRD150).
Any Pace PRD800 or 900 which has "2GHz" on the serial number label
underneath -
(Otherwise a small modification may be needed to extend the range)
Almost any receiver whose tuning display goes to 11.999 or higher.
Receivers built in 1995 or later. You may need to change the Installation
Menu LNB Offset from 10.00 to 9.75 or 09.75 in the case of Grundig
GRD150/250.
(Some receivers such as PRD800/900 can have "Enhanced" software fitted so
that the frequency display is correct with an "Enhanced" LNB. In addition,
a PRD800 can be given 199 channels instead of 120. This is also true for
the Amstrad SRD510).
Even if your receiver will not tune high enough, you can still use an
"Enhanced" LNB but you will lose the higher channels, such as Sky Sports,
UK Gold, CMT and CNN.
However, you can get these channels back by fitting a "Global ADX Plus".
When it is switched ON it shifts all the channels DOWN by a count of 500.
So it counteracts the effect of the "Enhanced" LNB which has shifted them
UP by 250.
The "ADX Plus" connects between the satellite receiver and the LNB cable.
There are various ways of switching it ON and OFF, dependent on your
satellite receiver. I won't go into this; just assume that you use the
ON/OFF switch on the "ADX Plus". With a paperclip you have to push in a
little internal switch when you first fit it.
With the "Enhanced" LNB fitted to the dish, tune ALL channels 250 higher,
except channels which are above Sky Movies. Tune these top channels 250
LOWER.
To watch these top channels you will need to switch the "ADX Plus" ON. For
the rest of the channels switch it OFF.
You CAN watch some Astra 1D channels if you use a Standard LNB.
You have to fit an ADX which will shift the channels UP by a count of 500
when it is ON.
All your existing channels remain tuned the same with the ADX off. You
don't need to alter them. Starting with a channel number higher than those
already in use, you can tune in the Astra 1D channels. With the ADX
switched ON, tune all the Astra 1D channels by a count of 500 higher than
the magazine listing says. Switch the ADX ON when you want to watch these
channels. Switch it OFF when you want to watch your existing channels. (In
fact, you don't really need to tune in extra channels for astra 1D. When
you switch the ADX on you will find that they appear instead of some of the
existing ones).
The main drawback of using your old standard LNB is that it was not
designed to amplify the Astra 1D channels. Some channels may be so sparkly
as to be unwatchable.
---------------------------------
Confused? It will be much clearer when you actually try it!
Martin Pickering
Technical Author.
Repairer of receivers, decoders and handsets.
Supplier of spare parts for satellite receivers.
100613,2105@compuserve.com
phreak/CELLULAR/astrotl1.txt
+61
View File
@@ -0,0 +1,61 @@
ASTROTEL 500, 580, 591
NOTES: This is a single NAM unit
These units are manufactured by OKI and follow the same programming
instructions as the 400 series OKI phones.
The ESN prefix is 129 decimal, 81 hex.
Astrotel: 213-869-4041
1. All phones should be initialized prior to programing, this will clear
all user programing functions including memory and solve many units
problems.
2. With the unit powered up press FUNC 9 9 * followed by the last 8 digits
of the units decimal ESN. The handset will display "ALL CLEAR", press
* to complete initialization.
3. Turn phone off then on again and within 10 seconds press END RCL FUNC
CLR SEND. (Ignore the error tone after pressing FUNC).
4. The phone will display "Entr id", enter the access code 08693427.
5. If you have completed the above steps correctly the phone now displays
the first programing entry.
6. # is used to store each step.
7. * is used to increment each step number.
8. CLR will revert display to previous data.
9. END is used to complete programing at any time.
PROGRAMING DATA:
STEP# #OF DIGITS/RANGE DISPLAY DESCRIPTION
01 10 DIGITS PHon MIN (AREA CODE & PHONE NUMBER)
02 5 DIGITS Sid SYSTEM ID
03 4 DIGITS iPCH IPCH AUTOMATICALLY SET
04 2 DIGITS ACColC ACCESS OVERLOAD
05 3 OR 4 DIGITS LoC Cod LOCK CODE
06 2 DIGITS Gid GROUP ID (10 FOR USA)
07 4 DIGITS Stn STATION CLASS MARK, USE 1000.
08 4 DIGITS/0 OR 1 oPc bit OPTION BITS: (1 enables, from left to
right):
Horn Alert
Hands Free
Local Use
MIN Mark
NOTE: The phone number and system ID can also be changed out of programing
mode by using the following procedure.
1. Press FUNC 9 0 *
2. Enter 3 or 4 digit lock code
3. The existing phone number will be displayed
4. Storing, incrementing and exiting follow the same methods as above.
LOCK: Press LOCK, UNLOCK: Enter three or four digit code.
SYSTEM SELECT: F 0 1 *, then RCL to scroll, then * to store desired option.
phreak/CELLULAR/at_tcell
+142
View File
@@ -0,0 +1,142 @@
EDITORS NOTE:
Following the general release is a longer version for trade
publications.
David Arneke
919-279-7680 (office)
Bill Jones
919-279-6511 (office)
FOR RELEASE THURSDAY, DECEMBER 10, 1992
AT&T PROTECTS CELLULAR PHONE CALLS FROM UNWANTED LISTENERS
GREENSBORO, N.C. -- New technology from AT&T is cutting
eavesdroppers out of the loop for cellular phone conversations.
The AT&T Cellular Privacy System protects cellular calls by
scrambling the cellular telephone's over-the-air signal. The
signal is descrambled at the cellular carrier's switch, trans-
mitting a conventional phone signal to the recipient.
If the scrambled over-the-air signal is intercepted, the
eavesdropper will hear only a chirping sound. AT&T's advanced
privacy technology destroys the intelligibility of the over-the-
air signal.
"This system significantly increases the usefulness of cel-
lular phones for anyone in business with a duty of
confidentiality--or anyone who simply wants protection from
eavesdroppers," says Ed Hickey, AT&T Vice President, Secure Com-
munications Systems.
"It enables users to conduct business on their cellular
phone just as they would in their office or home."
The AT&T system is an unprecedented solution to a problem
inherent in cellular technology. Cellular telephone calls,
transmitted as radio signals, are easily interceptable with inex-
pensive, widely available scanners.
The AT&T Cellular Privacy System is the first widely
available, integrated solution to the privacy problem. It offers
benefits far beyond those of any other cellular privacy products.
o It's the first privacy system with technology compact enough
and light enough to be embeddable in today's small, portable
phones.
o The system features an unmatched combination of high voice
quality and an advanced level of privacy.
o It is applicable to all three types of cellular telephones--
portable, transportable ("bag phones") and mobile (car
phones).
The system has two components. The AT&T privacy unit at-
taches to the phone and scrambles the phone's signal. The Mobile
Telephone Switching Office (MTSO) unit is installed at the cel-
lular carrier's switch and descrambles the signal.
The first compatible phone is the AT&T Model 9000 Privacy-
Capable Cellular Telephone, an 8.9-ounce portable model.
Suggested retail price of the Model 9000 is $795. The op-
tional privacy unit retails for $895. The phone, privacy unit
and switch unit will be available in February.
For more information, contact David Arneke, 919 279-7680, or
Bill Jones, 919 279-6511.
# # #
TRADE VERSION
David Arneke
919-279-7680 (office)
Bill Jones
919-279-6511 (office)
FOR RELEASE THURSDAY, DECEMBER 10, 1992
AT&T PROTECTS CELLULAR PHONE CALLS FROM UNWANTED LISTENERS
GREENSBORO, N.C. -- New technology from AT&T is cutting
eavesdroppers out of the loop for cellular phone conversations.
The AT&T Cellular Privacy System protects cellular calls by
scrambling the cellular telephone's over-the-air signal. The
signal is descrambled at the cellular carrier's switch, trans-
mitting a conventional phone signal to the recipient.
If the scrambled over-the-air signal is intercepted, the
eavesdropper will hear only a chirping sound. AT&T's advanced
privacy technology destroys the intelligibility of the over-the-
air signal.
"This system significantly increases the usefulness of cel-
lular phones for anyone in business with a duty of
confidentiality--or anyone who simply wants protection from
eavesdroppers," says Ed Hickey, AT&T Vice President, Secure Com-
munications Systems.
"It enables users to conduct sensitive business on their
cellular phone just as they would in their office or home."
The AT&T system is an unprecedented solution to a problem
inherent in cellular technology. Cellular telephone calls,
transmitted as radio signals, are easily interceptable with inex-
pensive, widely available scanners.
The AT&T Cellular Privacy System is the first widely
available, integrated solution to the cellular privacy problem.
It offers cellular users benefits far beyond those of any other
cellular privacy products.
o It's the first privacy system with technology small enough
and light enough to be embeddable in today's small, portable
phones.
o The system features an unmatched combination of high voice
quality and an advanced level of privacy.
o It is applicable to all three types of cellular telephones--
portable, transportable ("bag phones") and mobile (car
phones).
The system has two components. The AT&T privacy unit at-
taches to the phone and scrambles the phone's signal. The Mobile
Telephone Office Switch (MTSO) unit is installed at the cellular
carrier's switch and descrambles the signal.
The first compatible phone is the AT&T Model 9000 Privacy-
Capable Cellular Telephone, an 8.9-ounce portable model. The op-
tional privacy unit and its extended battery add less than six
ounces to the weight of the phone. The module and battery add
about a half inch to the depth of the phone.
The Model 9000 is a full-featured, third-generation cellular
phone. Other compatible models are in development by AT&T and
other manufacturers. Privacy modules for those phones are being
developed by AT&T.
Suggested retail price of the Model 9000 is $795. The op-
tional privacy unit retails for $895. The phone, privacy unit
and switch unit will be available in February.
The phone will be sold through carriers and by a variety of
retail outlets including cellular telephone agents, consumer
electronics stores and mass merchandisers and through an inter-
national network of distributors.
Because the privacy system scrambles the only over-the-air
portion of the call, no matching unit or special equipment is re-
quired at the receiving end.
Installation of the privacy module is quick and simple.
Once the phone is equipped, privacy is activated by simply
pressing a button anytime during the call.
Service and support for the phone and privacy unit will be
available through the nationwide network of Antel service
centers.
The AT&T Cellular Privacy System was developed by AT&T
Secure Communications Systems, a world leader in the design,
manufacture and integration of encryption and privacy products.
It is a primary supplier of secure products to the governments
of the United States and other nations as well as corporations
around the world.
For more information, contact David Arneke, 919 279-7680, or
Bill Jones, 919 279-6511.
# # #
phreak/CELLULAR/at_tsecu
+51
View File
@@ -0,0 +1,51 @@
Bill Jones - AT&T Secure Communications Systems
919-279-6511 (office)
FOR RELEASE THURSDAY, DECEMBER 17, 1992
ANTEL COMMUNICATIONS TO SUPPLY AT&T SECURE CELLULAR TELEPHONES
GREENSBORO, N.C. -- AT&T has selected Antel Communications
Corp. to supply new cellular telephones that function with AT&T's
recently announced Cellular Privacy System.
Antel, based in Hauppauge, N.Y., will supply a line of cel-
lular telephones specially adapted for use with AT&T's cellular
privacy technology. Antel is a major manufacturer and
distributor of cellular telephones in the United States and
around the world.
"AT&T and Antel make the ideal team to produce our first
privacy-capable cellular telephone, the AT&T Model 9000," said
Ed Hickey, AT&T Vice President, Secure Communications Systems.
The AT&T Model 9000 Privacy-Capable Cellular Phone will be
manufactured to AT&T's specifications by Antel. It will be
available in February.
Antel President Louis Antoniou said the agreement with AT&T
represents a unique opportunity for Antel to combine its exper-
tise in technology sourcing, marketing and distribution with
AT&T's cellular privacy technology."
The AT&T Cellular Privacy System protects calls by
scrambling the cellular telephone's over-the-air signal. The
signal is descrambled at the cellular carrier's switch, trans-
mitting a conventional phone signal to the recipient.
The AT&T Model 9000 Privacy-Capable Cellular Telephone, an
8.9-ounce portable model, is a full-featured third-generation
phone. In addition to its sleek styling and easy operation, the
Model 9000 offers a 100-number alphanumeric memory and multiple
phone number (NAM) operation.
The optional privacy unit and its extended battery add less
than six ounces to the weight of the phone. The module and bat-
tery add about a half inch to the depth of the phone.
Suggested retail price of the Model 9000 is $795. The op-
tional privacy unit retails for $895.
The AT&T Model 9000 will be backed by extensive customer
support and a nationwide network of service centers. The phone
comes with a two-year warranty.
The AT&T Cellular Privacy System was developed by AT&T
Secure Communications Systems, a world leader in the design,
manufacture and integration of encryption and privacy products.
It is a leading supplier of secure products to the governments
of the United States and other nations as well as corporations
around the world.
For more information, contact Bill Jones of AT&T Secure Com-
munications Systems, 919 279-6511.
# # #
phreak/CELLULAR/att01.txt
+41
View File
@@ -0,0 +1,41 @@
AT&T 1710
NOTES: This is a dual NAM unit.
The ESN prefix is 132 decimal & 84 hex (Hitachi).
A T & T west: 213-726-5360, east: 1-800-222-5111
NAM programing:
1. Select the NAM to be programed by entering FCN 6 2 N # FCN. Where "N"
is the NAM number 1 or 2 (ignore the error tone).
2. Enter FCN 6 2 6 RCL to enter programing mode. (626 spells NAM)
3. The DOWN key stores each entry and increments the step number.
4. At any time press FCN 6 2 6 STO to complete and exit programing.
PROGRAMING DATA:
STEP# #OF DIGITS/RANGE DISPLAY DESCRIPTION
01 0000 - 32767 SIDH SYSTEM ID
02 0 OR 1 LOCAL LOCAL USE MARK
03 0 OR 1 MINMK MIN MARK
04 0 OR 1 A-B A/B SWITCH MARK
05 0 OR 1 NROAM ROAM INHIBIT
06 10 DIGITS AREA/TEL MIN (AREA CODE & PHONE NUMBER)
07 2 DIGITS SCM STATION CLASS MARK
08 333 OR 334 IPCH INITIAL PAGING CHANNEL
09 2 DIGITS OLC ACCESS OVERLOAD
10 0 OR 1 SYS PREFERRED SYSTEM
11 2 DIGITS GIM GROUP ID (10 FOR USA)
12 3 DIGITS LCODE LOCK CODE
13 0 OR 1 DTMF CONTINUOUS DTMF
14 0 OR 1 HF HANDS FREE
NOTE: 1 enables, 0 disables in all single digit entries.
LOCK: Press and hold LOCK for 1.5 seconds. UNLOCK: Enter three digit code.
SYSTEM SELECT: F 9 */down to scroll, STO to store.
phreak/CELLULAR/att02.txt
+83
View File
@@ -0,0 +1,83 @@
AT&T 3030, 3035, 3430, 3730
NOTES: These units have five NAM's and are manufactured by OKI.
The ESN prefix is 129 decimal & 81 hex.
AT&T 1-800-232-5179
NAM programing:
1. Turn power on.
2. Within 30 seconds press RCL & MENU keys together and release, enter
* 1 2 3 4 5 6 7 8 #, (or enter dealer password if one has been used).
NOTE: If the dealer password is unknown and the factory default does not
work use the following "back door" code: * 6 2 7 2 9 8 5 4 #.
3. The phone will then display the Software Version followed by the
ESN in hex
NOTE: If you used the dealer password successfully in step 2 go straight
to step 5 below.
3. The phone will display "ENTER NEW PW AND STO" you may enter a ten digit
password at this stage to be used in future re-programings. Press
STO to retain default password or enter a ten digit password and press STO.
4. The phone will display "RE-ENTER PW AND STO" re-enter the password, press
STO to confirm. Again, press STO to retain default password.
5. The following "re-set" options can be bypassed by pressing volume down
to scroll. Each step is followed two seconds later by "Press * to Clear",
you can either press * or press CLR to bypass.
Step# Display Action
01 SSN# Wait 2 seconds.
Press * to Reset Press * to clear social security (not used)
02 SPD MEM CLR Wait 2 seconds.
Press * to Reset Press * to initialize speed dial memories.
03 DEFAULT DATA SET Wait 2 seconds.
Press * to Reset Press * to initialize unit.
POWER ON MESSAGE Wait 2 seconds.
Enter ALPHA Enter up to 8 characters followed by STO,
or press CLR to bypass.
1. The STO key stores each entry.
2. The Volume UP key scrolls down through the steps.
3. The Volume DOWN key scrolls UP through the steps.
4. At any time press CLR to exit program mode. Phone will display
"NAM x Program" press CLR to exit, or continue with additional NAMS.
You may also go directly to any NAM by pressing Volume Down when phone
displays "NAM x Program". NAM's 2 through 5 only have steps 01 - 06
below.
PROGRAMMING DATA:
STEP# #OF DIGITS/RANGE DISPLAY DESCRIPTION
01 10 DIGITS Own# MIN (AREA CODE & PHONE NUMBER)
02 5 DIGITS System ID SYSTEM ID
03 4 DIGITS IPCH NO. IPCH AUTOMATICALLY SET
04 2 DIGITS ACCOLCC ACCESS OVERLOAD
05 2 DIGITS GIM GROUP ID (10 FOR USA)
06 3 OR 4 DIGITS Unlock LOCK CODE
07 4 DIGITS SCM STATION CLASS MARK, USE 1000.
08 4 DIGITS/0 OR 1 OPTION OPTION BITS:
1 enables, from left to right:
MIN Mark
Hands Free
Local Use
NOT USED
9 6 DIGITS SECURITY SECURITY CODE (DEFAULT IS LAST
SIX DIGITS OF ESN)
LOCK: Press MENU until phone displays "LOCK PRESS 0" then 0 to lock.
UNLOCK: Enter lock code.
phreak/CELLULAR/austmobl.phk
+44
View File
@@ -0,0 +1,44 @@
From: U5434122@ucsvc.ucs.unimelb.edu.au
Subject: Cellular Telephones in Australia
Organization: The University of Melbourne
In Australia the Mobile Telephone service is supplied as a monopoly by
Telecom Australia. You can buy a phone unit from anyone, but TA links
you to the PSTN.
The phone numbers of mobile phones all begin with a pseudo area code
018. The next digit reflects the area code of the home area eg
Melbourne is 03, so a mobile phone from Melbourne is 018 3xx xxx.
Since TA monopolises the PSTN for the whole of Australia, roaming is
no problem, except in remote and rural areas which are not covered by
the cellular network.
I don't know the rental on the service, but call rates are as follows:
All charges are paid by the caller, whether to or from a mobile phone.
All calls are charged at the same rate as a normal long distance call,
but with a minimum calling distance of 745km ( 465 miles ).
Distance 1-745km > 745 km
Time
8am-6pm Mon-Fri 39c 57c
6pm-10pm Mon-Fri 26c 38c
10pm-8am Mon-Fri
6pm Sat-8am Mon 15c 23c
Like all calls in Australia the charges are made in multiples of
$0.21, which is the minimum charge per call.
AUD$1.00= USD$0.77 and AUD$1.00 = 48 pence?
Daniel
U5434122@ucsvc.melbuni.edu.au (Melbourne University)
------------------------------
Downloaded From P-80 Systems 304-744-2253
phreak/CELLULAR/bootleg.txt
+4009
View File
File diff suppressed because it is too large Load Diff
phreak/CELLULAR/cell-1.txt
+44
View File
@@ -0,0 +1,44 @@
PART I. WHAT IS BROADCAST FROM A CELLULAR TOWER?
When a cellular phone makes a call, it normally transmits it's
Electronic Security Number(ESN),Mobile Identification Number(MIN),it's
Station Class Mark(SCM) and the number called in a short burst of data.
This burst is the short buzz you hear after you press the SEND button and
before the tower catches the data. These four things are the components
the cellular provider uses to ensure that the phone is programmed to be
billed and that it also has the identity of both the customer and the
phone.
There are usually two cellular phone companies in an area. One is
the wire-line carrier (Band B), which is usually Bell, and the other is the
non-wireline carrier (Band A). Within the two bands are 832 cellular phone
channels. Each one has 416 bands, and within the bands are voice channels
that actually transmit and receive information from cellular phones.
The ESN and the phone number (MIN) are the two primary identifiers
for any cellular phone. By changing both, the cellular carrier will accept
the call and bill it to either a wrong account or provide service based on
the fact that it is NOT a disconnected receiver. It will also look at the
other two components, in order to insure that it is actually a cellular
phone and to forward billing information to that carrier.
The Station Class Mark can also be changed if you wish to prevent
the cellular carrier from determining the type of phone that is placing the
call. By providing the cellular tower with a false SCM, the cellular
carrier, the FCC, or whoever happens to chase down cellular fraud is often
looking for a particular phone which in reality is not the phone they are
looking for. For example, you can provide the SCM for a Radio Shack phone,
when in reality you are using a Novatell (How this is done from changing
the SCM I do not know...remember...I didn't write this).
The Number Assignment Module (NAM) also has the SIDH (System
Identification for Home System) number programmed into it. Refer to SIDH
TABLE. The transmittal of the SIDH number tells the carrier where to forward
the billing information to in case the user is "roaming". The SIDH table
tells the major cities and their identifying numbers. Changing an SIDH is
programming job that takes only minutes, but be aware that the ESN is still
sent to the cellular phone company. After they realize that the ESN is
connected to either a fake number or a phone that is not in the network, they
will block service. They only way around this is to reprogram the ESN.
*****************************************************************************
phreak/CELLULAR/cell-10.txt
+53
View File
@@ -0,0 +1,53 @@
PART X. A FEW COMMON SCANNER MODIFICATIONS
Here a few scanners and what it takes to modify them. If your
scanner is not shown here, don't worry. Ham Radio BBS's are all over the
country. You should be able to find the instructions for modifying your
scanner there.
Restoration of Cellular Frequency Coverage on
Radio Shack PRO-34 Handheld Scanner
1. Remove battery cover and battery, four black screws on rear cover, and volume and squelch knobs.
2. Remove rear cover, lifting back and up to clear controls. Do not remove belt clip or circuit board screws.
3. Unplug the brown volume control connector (grn/yel/blk) and white squelch control connector (wht/blk/red) from the linear circuit board.
4. Unsolder the ground lead from T111 (at corner of linear circuit board above the external power connectors). Unsolder the two power switch leads from the back of the volume control. Unsolder the antenna connector center pin and ground wires from the l
5. Unscrew the four combination screws that hold the linear circuit board and received the back cover screws.
Grasp the linear board at the top and lift it straight away from the front case, unplugging the 16-pin connector.
6. Remove the three screws holding the metal frame assembly which held the linear board to the front panel. Unplug the red-black power lead and lay the frame aside. It is still connected to the battery contacts.
7. Locate diodes D9 - D12 on the volume control side of the of the logic circuit board under T1; D10 and D11 are marked. Clip one lead of D11, separating the gap. This may be resoldered later if desired.
8. Reassemble the board by reversing the disassembly procedures above.
Restoration of Cellular Frequency Coverage on
Radio Shack PRO-2004 Scanner
By cutting diode D513 on the PC 3 sub chassis in the Realistic PRO-2004
Scanner you can re-enable the 825.00 to 845.00 and 870-00 to 890.00 frequency
selection. To scan in 30KHZ steps press "STEP-RESET".
Restoration of Cellular Frequency Coverage on
Radio Shack PRO-2005 Scanner
1. Unplug the radio
2. Remove the screws and take off the top cover.
3. Look for D502 on the inside right hand-side of the front panel.
(No need to unsolder the silver plate protecting the vertical board!)
4. Simply cut the diode and reverse the process.
Aren't you glad I only chose to cover Radio Shack models. I'm sure
you appreciate the fact that I only deal with quality merchandise. If you
have some cash to blow (like $500), I would recommend buying the ICOM R-1
handheld scanner. It scans from 1 to 1400 in 1/2 step increments and already
includes the cellular frequencies. Plus is is about as tall as a box of 3.25
floppies and about as wide as a 16 oz. coke bottle. It is the smallest and
one of the more powerful hand-scanners around.
*****************************************************************************
phreak/CELLULAR/cell-11.txt
+96
View File
@@ -0,0 +1,96 @@
PART XI. THE 40-50 MHZ CELLULAR SCANNER
The cellular phone freqs. occupy the UHF spectrum previously assign
to commercial TV stations. Since a TV channel occupies a Bandwidth(BW) of 6
MHZ and each cellular channel requires 24 KZ (for a plus and minus 12 KHZ
signal) and a 3KHZ guard band for each audio signal (thus the 30KHZ spacing).
200 cellular channels can fit into one UHF TV channel. Thus, with a little
fine tuning, and old TV set with variable VHF tuning can tune in all
cellular freqs. between 824 and 890 MHZ.
UHF TV tuners ares designed to convert these UHF freqa. to intermediate
(difference) freqs. between 41 and 47 MHZ. Thus, by purchasing a commonly
available UHF tuner (check sith a TV shop and try to get a copy of the
SAMS for powering the AFC info, and avoid those with tubes). Tuner voltage
is usually 8-24 volts, and must be correctly connected up. You should also
remove with the tuner, the TV's channel select and fine tuning controls
for ease of use - and they should be in good condition.
Once you have the tuner, you can then wire it between a 30-50 MHZ scanner and
a UHF antenna (highly directional yagi type is preferred). Since the tuner
will probably have a 300 ohm input impedance, a twin antenna cable is
preferred (Yes Radio Shack has 'em). If you are into directional-finding,
the UHF antenna should NOT have AGC (automatic Gain Control) as those with
active AGC will amplify reflections, resulting in readings from so many
directions that the target will be lost. Because of the use of inconspicuous,
commonly available, inexpensive, high-gain UHF antennas, using a good UHF
tuner to scan cellular channels is a good method of doing it.
Tuner output is usually through an RCA-type plug. CAUTION: BE SURE TO COUPLE
YOUR SCANNER TO THE UHF TUNER WITH A 0.01-0.1 mf (50 V min.) CAPACITOR FOR
DC BLOCKING. AND DO NOT TRY TO OPERATE THE TUNER THROUGH ITS TV SET AS THE
DANGER OF HIGH-VOLTAGE DISCHARGE IS HIGH. Also, connect a ground wire
between the tuner and the scanner.
The table below describes how cellular freqs. can be downconverted by a
commonly available UHF TV tuner (all freqs. are in MHZ)
CELLULAR MOBILE FREQS & SCANNER EQUIVALENTS
TV
BAND CELL. CHAN. SCAN TV OSCIL
CHAN. # and FREQ. FREQ. FREQ. LIMIT
----------- ------------ ----- -------- -----
73 (first) 0001-825.03 45.97 871 824-830
73 (last) 0166-829.98 41.02 871 824-830
74 (first) 0167-830.01 46.99 877 830-836
74 (last) 0366-835.98 41.02 877 830-836
75 (first) 0367-836.01 46.99 883 836-842
75 (last) 0566-841.98 41.02 883 836-842
76 (first) 0567-842.01 46.99 889 842-848
76 (last) 0766-847.98 41.02 889 842-848
77 (first) 0767-848.01 46.99 895 848-854
77 (last) 0799-848.97 46.03 895 848-854
CELLULAR PHONE FREQS. HAVE NOT BEEN ASSIGNED
FOR CHANNELS 800-990
73 (first) 0991-824.04 46.96 871 824-830
73 (last) 1023-825.00 46.00 871 824-830
80 (first) 0001-870.03 42.97 913 866-872
80 (last) 0066-871.98 41.02 913 866-972
81 (first) 0067-872.01 46.99 919 872-878
81 (last) 0266-877.98 41.02 919 872-878
82 (first) 0267-878.01 46.99 925 878-884
82 (last) 0466-883.98 41.02 925 878-884
83 (first) 0467-884.01 46.99 931 884-890
83 (last) 0666-889.98 41.02 931 884-890
83 (**) 0667-890.01 46.99 931 884-890
83 (**) 0799-893.97 37.03 931 884-890
CELLULAR PHONE FREQS. HAVE NOT BEEN ASSIGNED
FOR CHANNELS 800-990
80 (first) 0991-869.04 43.96 913 866-872
80 (last) 1023-870.00 43.00 913 866-872
(**) These freqs. are outside of the normal Channel 83 BW. However, most UHF
tuners have a fine tuner that can be adjusted up to about another 6 MHZ.
Note that the term "first" and "last" refers to the first and last cellular
channels receivable by the UHF tuner for the given TV channel. Base voice
channels are monitored when both sides of the conversation is required.
Mobile voice channels or base control channels are monitored to locate a
cellular phone. Tuning is simple:
(1) Decide which cellular channel or freq. you wish to monitor.
(2) Find what UHF channel includes that freq. and switch the TV
to that channel.
(3) Using the table, look up the corresponding TV oscillator freq.
(ex: 919 MHZ for TV channel 81). Subtract the cellular channel
freq. from the TV oscillator freq.
(4) Tune your scanner to the difference freq.
When you select a scanner, you should pick one that will scan in 30 MHZ
increments to efficiently receive cellular transmissions. If you can't get
one like that, then get one that will scan in 15,10 or 5 KHZ increments.
*****************************************************************************
phreak/CELLULAR/cell-12.txt
+42
View File
@@ -0,0 +1,42 @@
PART XII. HOW THE ESN IS REPLACED
It takes some electronics skill to pull or unsolder the ESN. If you
are sketchy about messing around with your phone, I suggest practicing on
something else first, like an old calculator or something. It is also a
good idea to use the proper tools (A very small soldering tip,chip pullers,
It is imperative NOT to touch any of the surrounding connections, soldering
joints, or chips. The job MUST be done right the very first time. After
that it is not so important, because after the first time you should have the
ESN information stored safely to disk. The only dangers remaining are
physically damaging the chip. (Note: There are devices that wipe PROMs
clean in the event of programming errors).
When removing the ESN, try to follow these 5 steps:
A. Remove the PC board containing the ESN from the entire phone unit. The
boards are usually screwed in with Phillips heads. This will insure
against damage to the rest of the unit.
B. Ascertain the correct chip. Find the letters on the chip, and check it
against the letters from the IDENTIFYING THE ESN section. Refer to the .Gif
file included if necessary.
C. It is a good idea to draw a sketch to help you remember which way the chip
went in. You may laugh, but do it anyway.
D. Carefully remove the chip. Take your time and use the proper tools.
E. Solder in a zero insertion force (ZIF) replacement, so that replacement
chip can be changed easily.
After the ZIF socket has been successfully soldered in, reinsert the
ESN and attempt to make a phone call (Be sure the NAM is programmed
correctly). If it doesn't, check the leads on the ZIF to insure that you
have soldered them correctly. After that, insert your ESN into your PROM
reader and make sure it provides some sort of reading. You should use the
search mode to look for the manufacturers serial number.
(see MANUFACTURER'S ESN CODE LISTING) to identify the address on the PROM
where to reprogram the ESN.
*****************************************************************************
phreak/CELLULAR/cell-13.txt
+27
View File
@@ -0,0 +1,27 @@
PART XIII. EQUATIONS FOR PROGRAMMING THE CHIPS
In most instances, you will not be able to tell the code on a PROM
because the manufacturer will have blown the security fuse in order to
prevent people from obtaining the codes to reprogram their own chips.
Therefore, it might be necessary to produce a set of equations that are
programmed into the cip to produce a bogus ESN. The bogus chips must contain
the first three digits of the manufacturer's code listing, which is
consequently the first marker of the actual ESN. Experimentation might be
necessary, but hey, isn't that half the fun?
With the aid of an EPROM emulator, the whole process should be able
to be completed in under an hour - this includes pulling the chip, creating
a new ESN, programming the chip, and replacing it.
So know you're saying "Holy Cow this project is getting expensive!".
Well it can get that way, but the long run payoff is worth it. I have seen
both emulators and burners for under $200 (I'm not talking about those spiffy
models that program RAM, just the basic EPROMs...in fact I can buy them for
under $150. Same with the emulator. Just look around.)
I wouldn't be surprised if actual ESN data started appearing on
boards in the near future. I know when I finsish my phone (Hopefully soon)
I plan on U/L the ESN info somewhere.
****************************************************************************
phreak/CELLULAR/cell-14.txt
+97
View File
@@ -0,0 +1,97 @@
PART XIV. MANUFACTURER'S ESN CODE LISTING
---------------------------------------------------------------------------
MANUFACTURER DECIMAL HEX CODE OCTAL CODE
---------------------------------------------------------------------------
Alpine Electronics # 150 96 226
Antel (see Emptel,Sanyo)
ARA *
AT&T Technologies (see notes) 158 9E 236
Astrotel (see OKI)
Audiovox-Audiotel (see notes) 138 8A 212
Blaupunkt (R. Bosch) # 148 94 224
Clarion Company Ltd. 140 8C 214
Clarion Manufacturing Co. 166 A6 246
CM Communications 153 99 231
Diamondtel (See Mitsubishi)
DI-BAR Electronics 145 91 221
E.F. Johnson # 131 83 203
Emptel Electronics Co. 178 B2 262
Ericsson 143 8F 217
Ericsson GE Mobile 157 9D 235
Fujitsu # 133 85 205
Gateway Telephone 147 93 223
General Electric # (mini is 134)146 92 222
Glenayre (see notes)
Goldstar Products Co. # 141 8D 215
Harris # 137 89 211
Hitachi # 132 84 204
Hughes Network Systems 164 A4 244
Hyundai 160 A0 240
Japan Radio Co. 152 98 230
Kokusai 139 8B 213
Mansoor Electronics 167 A7 247
Mitsubishi (see notes) 134 86 206
Mobira (Nokia-Kinex) # 156 9C 234
Motorola 130 82 202
Motorola Int'l. 168 A8 250
Murata Machinery LTD. 144 90 220
NEC # 135 87 207
Nokia # 165 A5 245
Novatel 142 8E 216
OKI # 129 81 201
Panasonic (Matsushita) # 136 88 210
Phillips Telecom # 170 AA 252
Phillips Circuit 171 AB 253
Qualcomm, Inc. 159 9F 237
Sanyo 175 AF 257
Satellite Technology 161 A1 241
Samsung Communications 176 B0 258
Shintom West (Audio-Vox BC-20)# 174 AE 256
Sony Corp. 154 9A 232
Sun Moon Star # 178 B2 262
Tama Denki Co. 155 9B 233
Tandy/Mobira # 165 A5 245
TacTel (see notes)
Technophone # 162 A2 242
Toshiba 138 8A 212
Uniden Corp. of America # 172 AC 254
Uniden Corp. of Japan 173 AC 255
Universal Cellular 149 95 225
USA Corp. # (see notes)
Walker (JRC, Technophone) 152 98 230
Western Electric # (see notes)
Western Union # (see notes)
Yupiteru Industries 163 A3 243
NOTES:
The hexidecimal ESN is an 11-digit number, first three are manufacturer's
decimal code, next two are reserved (but may contain zeros or numbers);
remaining six are the decimal serial number.
These companies use phones from various manufacturers, code will be of actual
manufacturer.
Alpine 9510 is Fujitsu 362A - Antel, use GE, Emptel, Sanyo - ARA varies- ATT
1300, 1800 use Mitsubishi - AT&T 1100,1400,1440,1700,1710 use Hitachi -
Audiotel 1000,3000,500,BC-40,400,450,550,600 use Toshiba - PC100,200 use
Technophone - BC-20,CMT-125 use Shintom - TacTel use Toshiba,Blaupunkt, most
are Panasonic, some are Blaupunkt - GE Mini, Gelayre 301 , USA A&B
use Mitsubishi - Mitsubishi 460 use Toshiba - Walker Pocketphone use
JRC or Technophone - Western Electric use Hitachi - Western Union use E.F.
Johnson.
# - Chassis number abd ESN correspond to each other.
Decimal ESN conversion is required for serial numbers over 1,000,000 or
2,000,000, etc. Simply drop the millions digit and add 262,144 times the
millions digit to the remaining number. For example, 01,123,456 =
385,600 or 02,123,46 = 647,744. Then affix the Manufacturers Decimal Code plus
two zeros on left to yield 11-digit ESN. The Hex ESN may be found by
converting this number to hexidecimal.
*****************************************************************************
phreak/CELLULAR/cell-15.txt
+195
View File
@@ -0,0 +1,195 @@
PART XV. HOME SYSTEM ID LISTING (A-L)
SYSTEM NON(A) WIRE(B)
Abilene,TX 131 422
Aguadilla 605 188
Aiken,GA 181 084
Akron,OH 073 054
Albany,GA 241 204
Alburquerque,NM 079 110
Alexandria,LA 243 212
Allentown,PA 103 008
Alton,IL 017 046
Altoona,PA 247 032
Amarillo,TX 249 422
Anchorage,AK 251 234
Anderson,IN 253 080
Anderson,SC 139 116
Anniston,AL 113 098
Appleton,WI 217 240
Asheville,NC 263 246
Ashland,WV 307 TBA
Athens,AL 203 198
Athens,GA 041 034
Atlanta,GA 041 034
Atlantic City,NJ 267 250
Augusta,GA 181 084
Aurora,IL 001 020
Austin,TX 107 164
Bakersfield,CA 183 228
Baltimore,MD 013 018
Bangor,ME 271 254
Baton Rouge,LA 085 106
Battle Creek,MI 403 256
Beaumont,TX 185 012
Bellingham,WA 047 006
Beloit,WI 217 210
Benton Harbor,MI 277 260
Biddeford,ME 501 484
Billings,MT 279 262
Biloxi,MS 281 264
Binghamton,NY 283 266
Birmingham,AL 113 098
Bismarck,ND 285 268
Bloomington,IL 455 532
Boise,ID 289 272
Boston,MA 007 028
Bradenton,FL 175 042
Bremerton,WA 047 006
Bridgeport,CT 119 088
Bristol,TN 149 074
Brownsville,TX 451 434
Bryan,TX 297 280
Buffalo,NY 003 056
Burlington,NC 069 144
Burlington,VT 313 300
Canton,OH 073 054
Casper,WY 301 284
Ceder Falls,IA 589 568
Cedar Rapids,IA 303 286
Champaign,IL 305 532
Charleston,WV 307 290
Charleston,SC 127 156
Charlotte,NC 139 114
Charlottesville,VA 309 292
Chattanooga,TN 161 148
Chicago,IL 001 020
Chico,CA 311 294
Cincinnati,OH 051 014
Clarksville,TN 179 296
Cleveland,OH 015 054
College Station,TX 297 280
Colorado Springs,CO 045 180
Columbia,MO 317 298
Columbia,SC 189 182
Columbus,GA 319 302
Columbus,OH 133 138
Corpus Christi,TX 191 184
Council Bluffs,IA 137 152
Cumberland,MD 321 304
Dallas,TX 033 038
Danville,VA 323 306
Davenport,IA 193 186
Dayton, OH 163 134
Daytona Beach,FL 325 308
Decatur,IL 327 532
Dennison,TX 033 038
Denver,CO 045 058
Des Moines,IA 195 150
Detroit, MI 021 010
Dothan,AL 329 312
Dover,NH 501 484
Dubuque,IA 331 314
Duluth,MN 333 316
Durham,NC 069 144
Eau Claire,WI 335 318
Elgin,IL 001 020
El Paso,TX 097 092
Elkhart,IN 549 530
Elmira,NY 283 266
Elyria,OH TBA 054
Enid,OK 341 324
Erie,PA 343 326
Eugene,OR 061 328
Evansville,IN 197 190
Fargo,ND 347 330
Fayettesville,NC 349 100
Fayetteville,AR 607 342
Flint,MI 021 010
Florence,AL 113 334
Florence,SC 377 350
Fort Collins,CO 045 336
Fort Lauderdale,FL 037 024
For Meyers,FL 355 042
Fort Pierce,FL 037 340
Fort Smith,AR 359 342
Fort Walton Bch,FL 361 344
Fort Wayne,IN 199 080
Fort Worth,TX 033 038
Fresno,CA 153 162
Gadsden,AL 113 098
Gainesville,FL 365 348
Galveston,TX 367 012
Gary,IN 001 020
Glens Falls, NY 063 078
Grand Forks,ND 371 356
Grand Rapids,MI 021 244
Granite City,IL 017 046
Great Falls, MT 373 358
Greeley,CO 045 360
Green Bay,WI 217 362
Greensboro,NC 095 142
Greenville,SC 139 116
Gulf of Mexico,LA 171 194
Gulfport,MS TBA 264
Gunterville,AL 203 198
Hagerstown,MD 381 364
Hamilton,OH 383 366
Harlingen,TX 451 434
Harrisburg,PA 159 096
Hartford,CT 119 088
Hickory,NC 385 368
Honolulu,HI 167 060
Houma,LA 387 370
Houston,TX 035 012
Huntington,WV 307 196
Huntsville,AL 203 198
Indianapolis,IN 019 080
Iowa City,IA 389 286
Jackson,MI 391 374
Jackson,MS 205 160
Jacksonville,FL 075 136
Jacksonville,NC 393 376
Janesville, WI 217 210
Johnson City,TN 149 074
Johnstown,PA 039 032
Joliet,IL 001 020
Joplin,MO 401 384
Kalamazoo,MI 403 386
Kankakee,IL 001 020
Kansas City,KS/MO 059 052
Kennewick,WA TBA 500
Kenosha,WI 217 044
Killeen,TX 409 392
Kingsport,TN 149 074
Knoxville,TN 093 104
Kokomo,IN 411 080
La Crosse,WI 413 396
Lafayette,IN 415 080
Lafayette,LA 431 414
Lake Charles,LA 417 400
Lakeland,FL 175 042
Lancaster,PA 159 096
Lansing,MI 021 188
Laredo,TX 419 402
Las Cruces,NM 097 404
Las Vegas,NV 211 064
Lawrence,KS 059 406
Lawton,OK 425 408
Lewiston,ME 427 482
Lexington,KY 213 206
Lima,OH 021 412
Lincoln,NE 433 416
Little Rock,AR 215 208
Long Branch,NY 173 022
Longview,TX 229 418
Lorain,OH 437 054
Los Angeles,CA 027 002
Louisville, KY 065 076
Lubbock,TX 439 422
Lynchberg,VA 441 424
*****************************************************************************
phreak/CELLULAR/cell-16.txt
+130
View File
@@ -0,0 +1,130 @@
PART XVI. HOME SYSTEM ID LISTING (M-Z)
SYSTEM NON(A) WIRE(B)
Macon,GA 443 426
Madison,WI 217 210
Manchester,NH 445 428
Mansfield,OH 447 430
Marshall,TX 229 418
Mayaguez 449 432
McAllen,TX 451 434
Medford,OR 061 436
Melbourne,FL 175 068
Memphis,TN 143 062
Miami,FL 037 024
Midland,TX 459 422
Millville,NH TBA 250
Milwaukee,WI 005 044
Minneapolis,MN 023 026
Mobile,AL 081 120
Modesto,CA 233 224
Moline,IL 193 186
Monroe,LA 463 440
Monterey,CA 527 126
Montgomery,AL 465 444
Moorehead,ND TBA 330
Muncie,IN 467 080
Muskegon,MI 021 448
Nashua,NH 445 428
Nashville,TN 179 118
NE Pennsylvania 103 172
New Bedford,MA 119 028
New Brunswick,NY 173 022
New Haven,CT 119 088
New London,CT 119 088
New Orleans,LA 057 036
Newport News,VA 083 168
New York,NY 025 022
Norfolk,VA 083 168
Ocala,FL 473 348
Odessa,TX 475 422
Oklahoma City,OK 169 146
Olympia,WA 047 006
Omaha,NE 137 152
Orange County,NY 479 486
Orlando,FL 175 068
Owensboro,KY 197 190
Oxnard,CA 027 002
Panama City,FL 483 462
Parkersburg,WV 485 032
Pascagoula,MS 487 264
Pasco,WA TBA 500
Pensacola,FL 361 120
Peoria,IL 221 214
Petaluma,CA 031 040
Petersburg,VA 071 472
Philadelphia,PA 029 008
Phoenix,AZ 053 048
Pine Bluff,AR 215 208
Pittsburg,PA 039 032
Pittsfield,MA 119 480
Ponce,PR 497 082
Portland,ME 499 482
Portland,OR 061 030
Portsmouth,NH 501 484
Poughkeepsie,NY 503 486
Providence,RI 119 028
Provo,UT 091 488
Pueblo,CO 045 490
Racine,WI 217 044
Raleigh,NC 069 144
Rapid City,SD 511 494
Reading,PA 103 008
Redding,CA 513 294
Reno,NV 515 498
Richland,WA 517 500
Richmond,VA 071 170
Roanoke,VA 519 502
Rochester,NH 501 484
Rochester,MN 521 504
Rochester,NY 117 154
Rockford,IL 217 506
Sacramento,CA 129 112
Saginaw,MI 021 389
Salem,OR 061 030
Salinas,CA 527 126
Salt Lake City,UT 091 094
San Angelo,TX 529 510
San Antonio,TX 151 122
San Diego,CA 043 004
San Francisco,CA 031 040
San Jose,CA 031 040
Terre Haute,IN 567 080
Texarkana,AR/TX 229 550
Toledo,OH 021 130
Topeka,KS 059 552
Trenton,PA 029 008
Tuscon,AZ 053 140
Tulsa,OK 111 166
Tuscaloosa,AL 577 098
Tyler,TX 579 418
Utica,NY 235 226
Vallejo,CA 031 040
Victoria,TX 581 562
Vineland,NJ 583 250
Visalia,CA 153 162
Waco,TX 587 566
Warren,OH 089 126
Washington,DC 013 018
Waterloo,IA 589 568
Wausau,WI 591 570
West Palm Beach,FL 037 024
Wheeling,WV 039 032
Wichita Falls,TX 595 574
Wichita,KS 165 070
Wilkes Barr,PA 103 172
Williamsport,PA 103 576
Wilmington,DE 123 008
Wilmington,NC 599 578
Winston-Salem,NC 095 142
Worcester,MA 007 028
Yakima,WA 601 580
York,PA 159 096
Youngstown,OH 089 126
Yuba City,CA 129 112
*****************************************************************************
phreak/CELLULAR/cell-17.txt
+42
View File
@@ -0,0 +1,42 @@
PART XVI. "THE ROAMING SCAM"
Some people who are playing with phones that have been originally
registered but have been turned off for non-payment of bills have used the
"Roaming Scam" to place free calls. NOTE: The cellular carriers will still
have records of these calls, and will prosecute those they eventually catch
up to (yeah,right). However, industry standards have shown that they pursue
less than one percent of the fraudulent calls placed. It is far more
economical for them to build software and hardware traps to prevent unbilled
calls from being placed rather than attempt to collect on the other end
which involves greater amounts of personnel and manpower with smaller actual
collections.
People have performed the roaming scam by taking their phones into
areas where the SIDH numbers are different from the ones currently programmed
into their phones. Refer to the SIDH listing in this file for the codes for
particular cities. By reprogramming the NAM and inserting a fake SIDH, the
cellular carrier will often accept the phone call, but on occassion the user
will get a message that the phone must have a local code in order to access
the system. As cellular carriers grow larger in size, this message is less
frequently heard. At this point, the cellular carrier instructs the user to
contact them. I don't think so.
The cellular service has the best chance of of catching a spoofer who
either calls a friend continually at home or by developing traceable trends
such as calling the same number from within the same cell at the same time
every day. Or doing something stupid like ordering a Pizza.
"But I want to hook up the phone to an acoustic coupler, d00d, and
call all the k-rad out-state-boards for the latest
PyRut WaR3z!4@$$!$@!@" <-lamer.
Well, one of the properties of cellular phone systems is that the
transmitter freqs. may be changed or "hopped" in the constant effort to
allocate freqs. Because of freq. hopping it is very difficult to
triangulate a cellular phone using standard directional finding methods
(trace you, d00d). Further, it is known that a directional antenna randomly
aimed at cellsite repeaters will confuse directional finding equipment
being used by them that is synced to their freq. hopping scheme.
*****************************************************************************
phreak/CELLULAR/cell-18.txt
+91
View File
@@ -0,0 +1,91 @@
PART XVIII. MERCHANDISE SHEET
CELLULAR PHONE SUPPLIERS
NCI R/M Wholesale Communications
744 Roble Road, Suite 185 800-837-5532
Allentown,PA 18103
800-669-5167
215-264-5117
Superior Cellular Products Cellular Enterprises, Inc.
3925 N. Rosemead Blvd. #205 813-885-7766
Rosemead,CA 91770
818-280-6665
Dynatek Communication Dist. Wholesale Cellular, Inc.
340 Constance Dr. 5720 West 71st St.
Warminster,PA 18974 Indianapolis, IN 46278
215-672-5000 317-297-6100
CELLULAR SERVICE MONITORS
InTouch USA
800-USA-ROAM
800-872-7626
CELLULAR TEST EQUIPMENT
WAVETEK
1-800-223-WVTK
Ask for free Communications Catalog
CELLULAR SERVICE MONITORS
Communication Instruments
356 Hillcrest Street
El Segundo, CA 90245
800-288-8223
213-322-3666
CELLULAR PHONE REPAIRS
Communication Consultants Co. Cellular Phone Services, Inc
16128 Cohasset St. 403 E. Gude Dr.
Van Nuys, CA 91406 Rockville, MD 20850
818-901-9711 800-326-7901
ext. 101
PROM EMULATORS
Parallax, Inc. Incredible Technologies
6200 Desimone Lane, #69A 708-437-2433
Citrus Heights, CA 95621
916-726-1905
Technical Solutions
P.O. Box 462101
Dept. 101
Garland, TX 75046
214-272-9392
PROM PROGRAMMERS
BP Microsystems Link Computer Graphics
10681 Haddington 369 Passaic Road, Ste. 100
Houston,TX 77043 Fairfield, NJ 07004
713-461-9430 201-808-8990
MVS Needhamps Electronics
Box 994 4539 Orange Grove Ave.
Merrimack, NH Sacramento, CA 95841
508-792-9507 916-924-8037
PROM CHIPS
National Semiconductor
Offices throughout the U.S.
408-721-5000
JDR Microdevices
800-538-5000
Easy Tech
2917 Bayview Drive
Fremont, CA 94538
800-582-4044
phreak/CELLULAR/cell-2.txt
+118
View File
@@ -0,0 +1,118 @@
PART II. DEFINITIONS
The following is a list of commonly used abbreviations used in cellular
phones.
SIDH
A 15-bit field in the NAM designating the System Identification for the Home
System. Bit 0 of the SIDH corresponds to the Preferred System flag used
elsewhere in the NAM. Bits 6 and 5 of byte 0 are international code bits.
Normally the SIDH is entered during programming of the phone as a 5 digit
decimal number. Enter 0's to the left-most unused positions when
reprogramming.
L.U.
Local Use Flag. Tells the cellular phone user if it must preregister with
the system. Preregistration with the system means that a mobile must
transmit its parameters to the Cellular System as soon as the power-up
task and the control channel tasks are completed. "1" enables the flag.
Usually set to "1".
MIN MARK
A 1-bit flag designating that MIN2 (area code) is always sent when making
system access. "1" enables the flag. Usually set to "1".
MIN2
A 10-bit field representing the area code of the mobile ID number.
MIN1
A 24-bit field representing the mobile telephone number. MIN2 plus MIN1
equals MIN, the 10-digit phone number.
SCM
A 4-bit field designating the Station Class Mark. A (3-Watt) 832 channel
mobile unit typically will be 1000, a 1.2 Watt portable 1001 or a 0.6 Watt
handheld 1010 or 1110 (discontinuous transmission, meaning push-to-talk).
These are class I, Class II and Class III power levels respectively.
With the SCM the cellular system determines whether or not a cellular phone
can be switched to one of the 156 channels.
Bit-1 is "0" for 666 and "1" for 832. (See cellular freq. list)
Bit-2 is "0" for a mobile unit and "1" for a voice-activated
transmit.
Bit-3 and -4 identify the power class of the phone:
"00" = 3.0 watts
"01" = 1.2 watts
"10" = 0.6 watts
"11" is not assigned
IPCH
An 11-bit field designating the initial paging channel to be used if in
the home system. Normally it is 334 for wireline systems, 333 for non-
wireline systems. But most phones allow other settings for test purposes.
ACCOLC
A 4-bit field designating the overload class for the cellular phone. The
intention of this entry is to allow the Cellular System to be able to
determine priority in the event of a system overload, however it is currently
useless as the system operators have generally not provided guidance for
thier installers. The usual (and correct) system now in effect (in U.S.) is
to use a "0" plus the last digit of the phone number. Test phones should be
set at "10",emergency vehicles at "11","12" through "15" are reserved.
(A class 15 system is supposed to be police, fire, or military).
P.S.
1 1-bit flag designating the preferred system. If PS is "0", channels 334
through 666(EVIL!!!) are used. If PS is "1" then channels 1 through 333 are
used. Even numbered system numbers (B systems) require a PS of "0", odd
system numbers (A systems) require a "1".
GIM
A 4-bit field designating the Group Identification Mark. This number tells
the Cellular system how far to look in the SIDH to determine if it is roaming
in a system which may have a roam agreement with the phone system. It is
usually set to "10".
LOCK DIGITS
A 4-bit field designating the unlock code. The digit "0" in the lock code
is represented by an "A" in the actual NAM hexidecimal data. A lock code of
all "0" sometimes unlocks the cellular phone.(Note: Lock codes are 3 digits.
When programming a phone use "0" as the first number.)
E.E.
A 1-bit flag designating that end-to-end signaling is enabled. End-to-end
signaling means that the DTMF tones will be transmitted on the voice channel
as well as being echoed on the handset. This feature in necessary for
such services as Bank by Phone, activating answering machines and in third
party long distance services such as Sprint and MCI. A "1" enables the flag.
Usually set to "1".
REP
A 1-bit flag designating that repertory memory (speed dialing) in the
cellular phone is enabled. And once a again a "1" enables the flag.
H.A.
A 1-bit flag designating that the horn alert feature in enabled. "1" enables
the flag.
H.F.
A 1-bit flag designating that the handsfree option is enabled. A "1" enables
the flag. Often, transceivers supplied as hands-free units require that
this flag be left at "0".
*****************************************************************************
phreak/CELLULAR/cell-2rdt.phk
+1484
View File
File diff suppressed because it is too large Load Diff
phreak/CELLULAR/cell-3.txt
+46
View File
@@ -0,0 +1,46 @@
PART III. TYPES OF NAMS
NAM Types Used in Cellular Phones
NAM- Number Assignment Module - A 32 word by 8 bit PROM
The NAM contains all the information that can be programmed to the phone
directly from the handset. (i.e. SIDH,MIN,LOCK-CODE,etc.).
All phones except NEC will accept tri-state NAMs. NEC requires an open
collector NAM. Fujitsu phones will accept either open collector or tri-
state NAMs.
Brand Qualifications: Fujitsu and Alpine phones will not operate properly
with any Harris Brand NAM or with any Signetics brand NAMs with a part
number NOT ending with an "A". TI NAMs must not be used in GE Star models.
Panasonic has suggested only TI NAMs should be used in their phones. NAMs
are available in ceramic (F) or plastic encapsulation (N).
BRAND OPEN COL. TRI-STATE OPEN COL. TRI-STATE
=============================================================================
Signetics 82S23 82S123
Texas Inst. 74S188 74S288 TBP18SA030 TBP18S030
AMD AM27LS18 AM27LS19 AM27S18 AM27S19
Texas Inst. TBP38SA030 TBP38S030
Harris HM7602 HM7603
MMI 53/6330 53/6331
MMI 53/63S080 53/63S081
NSC DM54S188 DM54S288 DM74S188
NSC DM82S23 DM82S123
Motorola This is for a special NAM used in some Motorolas. Requires
an adapter.
Fujitsu MB7056 MB7051
*****************************************************************************
phreak/CELLULAR/cell-4.txt
+56
View File
@@ -0,0 +1,56 @@
PART IV. NAM FORMAT MAP
HEX
MARK DEFINITION MOST <- BIT SIGNIFICANCE -> LEAST ADDRESS
----------------------------------------------------------------------------
0 SIDH (14-8) 00
SIDH (7-0) 01
LU=LOCAL USE** 000000 MIN 02
LU A/B* RI* MIN2(33-28) 03
MIN2(27-24) 0000 04
0000 MIN1(23-20) 05
MIN1(19-12) 06
MIN1(11-4) 07
MIN1(3-0) 0000 08
0000 SCM(3-0) 09
00000 IPCH(10-8) 0A
IPCH(7-0) 0B
0000 ACCOLC(3-0) 0C
PS=PREFERRED** 0000000 PS 0D
SYSTEM 0000 GIM(3-0) 0E
LOCK DIGIT 1 LOCK DIGIT 2 0F
LOCK DIGIT 3 LOCK SPARE BITS 10
EE=END TO END EE 000000 REP 11
SIGNALING HA 000000 HF 12
REP=REPERTORY ----------------------------------------------
HA=HORN ALERT 13
HF=HANDS FREE 14
15
16
SPARE LOCATIONS (13-1D) 17
CONTAIN ALL ZEROS EXCEPT 18
FOR MANUFACTURERS OPTIONS 19
1A
1B
1C
1D
NAM CHECKSUM ADJUSTMENT 1E
NAM CHECKSUM 1F
The Checksum Adjustment and Checksum are calculated automatically after
the data has been edited for the NAM. The sum of all words in the NAM plus
the last two must equal a number with "0" in the last two digits. The radio
checks this sum and if it isn't correct, the radio assumes the NAM is bad or
that it has been tampered with.
* - These bits are used only by AT&T,Hitachi and Mitsubishi. They are A/B
Enable and Roam Inhibit. They must be "0" for all other models.
** - My information does not agree here. One source claims that address 03
has 6 bits and that address 0D has 7 bits. The other source states the
the exact opposite.
*****************************************************************************
phreak/CELLULAR/cell-5.txt
+65
View File
@@ -0,0 +1,65 @@
PART V. STANDARD NAM FORMATS
NAMs are generally mapped the same in all cellular phones, and the
ones that have no "fancy" options are generally programmed the same. This
chart provides the usual digits and settings for almost every NAM.
ITEM DESCRIPTION NO. OF DIGITS USUAL SETTING
--------------------------------------------------------------------------
1 First 3 digits 3 XXX
of phone number
2 Last 4 digits 4 XXXX
of phone number
3 Lock Code(LOCK) 3 or 4 XXXA or XXXX
4 Area Code (MIN2) 3 XXX
5 Home Area System
ID No. (SIDH) 4* XXXX
6 Horn Alert (HA) 1 0 or 1
7 Hands Free (HF) 1 0 or 1
8 End-to-End Signaling 1 1
(EE)
9 Repertory Mark (REP) 1 1
10 Group Identification 2 10
Mark (GIM)
11 Access Overload Class 2 XX*
(ACCOLC)
12 Station Class Mark (SCM) 4* XXXX
13 Local Use Mark (LU) 1 1
14 Min Mark (MIN) 1 1
15 Initial Paging Channel 3 333 or 334*
(IPCH)
16 Preferred System Mark 1 0 or 1*
(PS)
* Notes-
1. Home Area ID Number normally consists of five digits. However, four
are usually sufficient is the U.S.
2. Access Overload Class is generally made up of a "0" plus the last
digits of the telephone number. Some systems set at "15" or "00".
3. Station Class Mark is expressed as four binary digits.
4. Initial Paging Channel is 334 for wireline, 333 for non-wireline
systems.
5. The Preferred Mark System is set to "0" for wireline, "1" for non-
wireline systems.
*****************************************************************************
phreak/CELLULAR/cell-6.txt
+1744
View File
File diff suppressed because it is too large Load Diff
phreak/CELLULAR/cell-7.txt
+26
View File
@@ -0,0 +1,26 @@
PART VII. THE ELECTRONIC SERIAL NUMBER - AN INTRODUCTION
When a cellular phone is removed from factory packaging, the ESN
normally can be found in the document package (or on a sticker stuck to the
phone). This ESN is usually correct and system registration procedes
quickly. If the phone is used or has been turned off for non-payment of
bills, the person who restores the service needs the ESN in order to program
the system with an MIN. Every manufacturer assigns their own ESN,
consequently it is possible to have a number of the same ESN's, although
each may be produced by a seperate manufacturer. For example, there may be
a Motorola ESN of 123456, an Audiovox ESN of 123456, etc. With this in mind
it is a possibility that a person could broadcast without changing the ESN,
but rather changing the SCM and the SIDH.
The ESN is a 32-bit number which uniquely identifies each unit. This
ESN is factory programmed and installed and cannot be changed in the field
without removing it and reprogramming a new chip. The ESN may or may not be
related to the serial number stamped on the outside of the transceiver
chassis. The ESN is encoded into messages which are interchanged with the
cellular tower. The ESN must be provided when the phone is registered for
service. The ESN is an 11-digit number. THE FIRST THREE NUMBERS ARE THE
MANUFACTURERS DECIMAL CODE, THE NEXT TWO ARE RESERVED (BUT MAY CONTAIN ZEROS
OR NUMBERS) AND THE REMAINING SIX ARE THE DECIMAL SERIAL NUMBER.
*****************************************************************************
phreak/CELLULAR/cell-8.txt
+49
View File
@@ -0,0 +1,49 @@
PART VIII. IDENTIFYING THE ESN IN YOUR CELLULAR PHONE
Depending on what model phone you have, the ESN will be located on a
PROM. The PROM is programmed at the factory, and installed usually with the
security fuse blown to prevent tampering. The code on the PROM might
possibly be obtained by unsoldering it from the cellular phone, putting it in
a PROM reader, and then obtaining a memory map of the chip.
The PROM is going to have from sixteen to twenty-eight leads coming
from it. It is a bipolar PROM. SEE ESN.GIF FOR ADDITIONAL INFORMATION.
The majority of phones will accept the National Semiconductor 32x8 PROM,
which will hold the ESN and cannot be reprogrammed. If the ESN is known
on the phone, it is possible to trace the memory map by installing the PROM
into a reader, and obtaining the fuse map from the PROM by triggering the
"READ MASTER" switch of the PROM programmer. In addition, most PROM
programming systems include a verify and compare switch to allow you to
compare the programming of one PROM with another.
As said earlier, the ESN is uniformly black with sixteen to
twenty-eight leads emanating from it's rectangular body, or square shaped
body. If it is the dual-in-line package chip, (usually found in
transportables and installed phones),it is rectangular. If it is the plastic
leaded chip carrier (PLCC), it will be square and have a much smaller
appearance. Functionally, they are the same chip, but the PLCC is used with
hand held cellular phones because of the need for reduced size circuitry.
It will have a notch within, and also have writing in small white letters
on it. (A black chip with small white letters? Should be easy to spot huh?).
Look for the follow letters on the chip:
MMI
TI
NS
HARRIS
NSC
MB
DM
HM
AMD
TBP
MOTOROLA
AMPS
Once you have found the chip, try ordering a new one (maybe a couple of new
ones) from the businesses in the MERCHANDISE SECTION located at the end of
this file.
*****************************************************************************
phreak/CELLULAR/cell-9.txt
+1282
View File
File diff suppressed because it is too large Load Diff
phreak/CELLULAR/cell.frd
+313
View File
@@ -0,0 +1,313 @@
Letter 4 of 9, 16770 chars:
From pro-snapp!pro-sol!pnet01!mtbill Fri Jul 10 00:49:45 1987
Date: Thu, 9 Jul 87 18:49:13 PDT
Ppath: essug!chuck
From: mtbill@pnet01.CTS.COM (Mountain Bill)
To: pro-sol!pro-snapp!essug!chuck
Subject: Cellular Telephone Security
The foolowing is fwd'd for addition to your data library. Isn't it
wonderful that Rusty is paying the transmission costs for all these hogger
messages/files? :-)
--------Forwarded Message--------
From crash!hplabs.HP.COM!hp-sdd!seismo!F4.CSL.SRI.COM!GEOFF Wed Jun 17 11:36:09 1987
Received: by crash.CTS.COM (5.54/UUCP-Project/rel-1.0/09-14-86)
id AA15019; Wed, 17 Jun 87 11:28:37 PDT
Reply-To: crash!hplabs.HP.COM!hp-sdd!seismo!F4.CSL.SRI.COM!GEOFF
Received: from hplabs.HP.COM (hplabs) by hp-sdd.HP.COM; Wed, 17 Jun 87 11:27:22 PDT
Return-Path: <hp-sdd!seismo!F4.CSL.SRI.COM!GEOFF@hplabs.HP.COM>
Received: by hplabs.HP.COM ; Wed, 17 Jun 87 11:17:01 pdt
Received: from [192.12.33.99] by seismo.CSS.GOV (5.54/1.14)
id AA17626; Wed, 17 Jun 87 00:11:57 EDT
Date: 16 Jun 1987 16:40-PDT
Sender: crash!hplabs.HP.COM!hp-sdd!seismo!F4.CSL.SRI.COM!GEOFF
Subject: Re: Cellular Telephone Security
From: the tty of Geoffrey S. Goodfellow <crash!hplabs.HP.COM!hp-sdd!seismo!csl.sri.com!Geoff>
Ppath: pnet01!mtbill
To: pnet01!mtbill@hplabs.HP.COM
Message-Id: <[F4.CSL.SRI.COM]16-Jun-87 16:40:13.GEOFF>
In-Reply-To: <8706160157.AA19395@crash.CTS.COM>
--------------------------------------------------------------------------
The following is reprinted from the November 1985 issue of Personal
Communications Technology magazine by permision of the authors and
the publisher, FutureComm Publications Inc., 4005 Williamsburg Ct.,
Fairfax, VA 22032, 703/352-1200.
Copyright 1985 by FutureComm Publications Inc. All rights reserved.
--------------------------------------------------------------------------
THE ELECTRONIC SERIAL NUMBER: A CELLULAR 'SIEVE'?
'SPOOFERS' CAN DEFRAUD USERS AND CARRIERS
by Geoffrey S. Goodfellow, Robert N. Jesse, and Andrew H. Lamothe, Jr.
What's the greatest security problem with cellular phones? Is it privacy of
communications? No.
Although privacy is a concern, it will pale beside an even greater problem:
spoofing.
'Spoofing' is the process through which an agent (the 'spoofer') pretends to
be somebody he isn't by proffering false identification, usually with intent
to defraud. This deception, which cannot be protected against using the
current U.S. cellular standards, has the potential to create a serious
problem--unless the industry takes steps to correct some loopholes in the
present cellular standards.
Compared to spoofing, the common security concern of privacy is not so severe.
Most cellular subscribers would, at worst, be irked by having their
conversational privacy violated. A smaller number of users might actually
suffer business or personal harm if their confidential exchanges were
compromised. For them, voice encryption equipment is becoming increasingly
available if they are willing to pay the price for it.
Thus, even though technology is available now to prevent an interloper from
overhearing sensitive conversations, cellular systems cannot--at any
cost--prevent pirates from charging calls to any account. This predicament is
not new to the industry. Even though cellular provides a modern,
sophisticated quality mobile communications service, it is not fundamentally
much safer than older forms of mobile telephony.
History of Spoofing Vulnerability
The earliest form of mobile telephony, unsquelched manual Mobile Telephone
Service (MTS), was vulnerable to interception and eavesdropping. To place a
call, the user listened for a free channel. When he found one, he would key
his microphone to ask for service: 'Operator, this is Mobile 1234; may I please
have 555-7890.' The operator knew to submit a billing ticket for account
number 1234 to pay for the call. So did anybody else listening to the
channel--hence the potential for spoofing and fraud.
Squelched channel MTS hid the problem only slightly because users ordinarily
didn't overhear channels being used by other parties. Fraud was still easy
for those who turned off the squelch long enough to overhear account numbers.
Direct-dial mobile telephone services such as Improved Mobile Telephone
Service (IMTS) obscured the problem a bit more because subscriber
identification was made automatically rather than by spoken exchange between
caller and operator. Each time a user originated a call, the mobile telephone
transmitted its identification number to the serving base station using some
form of Audio Frequency Shift Keying (AFSK), which was not so easy for
eavesdroppers to understand.
Committing fraud under IMTS required modification of the mobile--restrapping
of jumpers in the radio unit, or operating magic keyboard combinations in
later units--to reprogram the unit to transmit an unauthorized identification
number. Some mobile control heads even had convenient thumb wheel switches
installed on them to facilitate easy and frequent ANI (Automatic Number
Identification) changes.
Cellular Evolution
Cellular has evolved considerably from these previous systems. Signaling
between mobile and base stations uses high-speed digital techniques and
involves many different types of digital messages. As before, the cellular
phone contains its own Mobile Identification Number (MIN), which is programmed
by the seller or service shop and can be changed when, for example, the phones
sold to a new user. In addition, the U.S. cellular standard incorporates a
second number, the 'Electronic Serial Number' (ESN), which is intended to
uniquely and permanently identify the mobile unit.
According to the Electronic Industries Association (EIA) Interim Standard
IS-3-B, Cellular System Mobile Station--Land Station Compatibility
Specification (July 1984), 'The serial number is a 32-bit binary number that
uniquely identifies a mobile station to any cellular system. It must be
factory-set and not readily alterable in the field. The circuitry that
provides the serial number must be isolated from fraudulent contact and
tampering. Attempts to change the serial number circuitry should render the
mobile station inoperative.'
The ESN was intended to solve two problems the industry observed with its
older systems.
First, the number of subscribers that older systems could support fell far
short of the demand in some areas, leading groups of users to share a single
mobile number (fraudulently) by setting several phones to send the same
identification. Carriers lost individual user accountability and their means
of predicting and controlling traffic on their systems.
Second, systems had no way of automatically detecting use of stolen equipment
because thieves could easily change the transmitted identification.
In theory, the required properties of the ESN allow cellular systems to check
to ensure that only the correctly registered unit uses a particular MIN, and
the ESNs of stolen units can be permanently denied service ('hot-listed').
This measure is an improvement over the older systems, but vulnerabilities
remain.
Ease of ESN Tampering
Although the concept of the unalterable ESN is laudable in theory, weaknesses
are apparent in practice. Many cellular phones are not constructed so that
'attempts to change the serial number circuitry renders the mobile station
inoperative.' We have personally witnessed the trivial swapping of one ESN
chip for another in a unit that functioned flawlessly after the switch was
made.
Where can ESN chips be obtained to perform such a swap? We know of one recent
case in the Washington, D.C. area in which an ESN was 'bought' from a local
service shop employee in exchange for one-half gram of cocaine. Making the
matter simpler, most manufacturers are using industry standard Read-Only
Memory (ROM) chips for their ESNs, which are easily bought and programmed or
copied.
Similarly, in the spirit of research, a west coast cellular carrier copied the
ESN from one manufacturer's unit to another one of the same type and
model--thus creating two units with the exact same identity.
The ESN Bulletin Board
For many phones, ESN chips are easy to obtain, program, and install. How does
a potential bootlegger know which numbers to use? Remember that to obtain
service from a system, a cellular unit must transmit a valid MIN (telephone
number) and (usually) the corresponding serial number stored in the cellular
switch's database.
With the right equipment, the ESN/MIN pair can be read right off the air
because the mobile transmits it each time it originates a call. Service shops
can capture this information using test gear that automatically receives and
decodes the reverse, or mobile-to-base, channels.
Service shops keep ESN/MIN records on file for units they have sold or
serviced, and the carriers also have these data on all of their subscribers.
Unscrupulous employees could compromise the security of their customers'
telephones.
In many ways, we predict that 'trade' in compromised ESN/MIN pairs will
resemble what currently transpires in the long distance telephone business
with AT&T credit card numbers and alternate long-distance carrier (such as
MCI, Sprint and Alltel) account codes. Code numbers are swapped among
friends, published on computer 'bulletin boards' and trafficked by career
criminal enterprises.
Users whose accounts are being defrauded might--or might not--eventually
notice higher-than-expected bills and be reassigned new numbers when they
complain to the carrier. Just as in the long distance business, however, this
number 'turnover' (deactivation) won't happen quickly enough to make abuse
unprofitable. Catching pirates in the act will be even tougher than it is in
the wireline telephone industry because of the inherent mobility of mobile
radio.
Automating Fraud
Computer hobbyists and electronics enthusiasts are clever people. Why should
a cellular service thief 'burn ROMs' and muck with hardware just to install
new IDs in his radio? No Herculean technology is required to 'hack' a phone
to allow ESN/MIN programming from a keyboard, much like the IMTS phone thumb
wheel switches described above.
Those not so technically inclined may be able to turn to mail-order
entrepreneurs who will offer modification kits for cellular fraud, much as
some now sell telephone toll fraud equipment and pay-TV decoders.
At least one manufacturer is already offering units with keyboard-programmable
MINs. While intended only for the convenience of dealers and service shops,
and thus not described in customer documentation, knowledgeable and/or
determined end users will likely learn the incantations required to operate
the feature. Of course this does not permit ESN modification, but easy MIN
reprogrammability alone creates a tremendous liability in today's roaming
environment.
The Rolls Royce of this iniquitous pastime might be a 'Cellular Cache-Box.'
It would monitor reverse setup channels and snarf ESN/MIN pairs off the air,
keeping a list in memory. Its owner could place calls as on any other
cellphone. The Cache-Box would automatically select an ESN/MIN pair from its
catalog, use it once and then discard it, thus distributing its fraud over
many accounts. Neither customer nor service provider is likely to detect the
abuse, much less catch the perpetrator.
As the history of the computer industry shows, it is not far-fetched to
predict explosive growth in telecommunications and cellular that will bring
equipment prices within reach of many experimenters. Already we have seen the
appearance of first-generation cellular phones on the used market, and new
units can be purchased for well under $1000 in many markets.
How High The Loss?
Subscribers who incur fraudulent charges on their bills certainly can't be
expected to pay them. How much will fraud cost the carrier? If the charge is
for home-system airtime only, the marginal cost to the carrier of providing
that service is not as high as if toll charges are involved. In the case of
toll charges, the carrier suffers a direct cash loss. The situation is at its
worst when the spoofer pretends to be a roaming user. Most inter-carrier
roaming agreements to date make the user's home carrier (real or spoofed)
responsible for charges, who would then be out hard cash for toll and airtime
charges.
We have not attempted to predict the dollar losses this chicanery might
generate because there isn't enough factual information information for anyone
to guess responsibly. Examination of current estimates of long-distance-toll
fraud should convince the skeptic.
Solutions
The problems we have described are basically of two types. First, the ESN
circuitry in most current mobiles is not tamper-resistant, much less
tamper-proof. Second and more importantly, the determined perpetrator has
complete access to all information necessary for spoofing by listening to the
radio emissions from valid mobiles because the identification information
(ESN/MIN) is not encrypted and remains the same with each transmission.
Manufacturers can mitigate the first problem by constructing mobiles that more
realistically conform to the EIA requirements quoted above. The second
problem is not beyond solution with current technology, either. Well-known
encryption techniques would allow mobiles to identify themselves to the
serving cellular system without transmitting the same digital bit stream each
time. Under this arrangement, an interloper receiving one transmission could
not just retransmit the same pattern and have it work a second time.
An ancillary benefit of encryption is that it would reasonably protect
communications intelligence--the digital portion of each transaction that
identifies who is calling whom when.
The drawback to any such solution is that it requires some re-engineering in
the Mobile-Land Station Compatibility Specification, and thus new software or
hardware for both mobiles and base stations. The complex logistics of
establishing a new standard, implementing it, and retrofitting as much of the
current hardware as possible certainly presents a tough obstacle, complicated
by the need to continue supporting the non-encrypted protocol during a
transition period, possibly forever.
The necessity of solving the problem will, however, become apparent. While we
presently know of no documented cases of cellular fraud, the vulnerability of
the current standards and experience with similar technologies lead us to
conclude that it is inevitable. Failure to take decisive steps promptly will
expose the industry to a far more expensive dilemma. XXX
Geoffrey S. Goodfellow is a member of the senior research staff in the
Computer Science Laboratory at SRI International, 333 Ravenswood Ave., Menlo
Park, CA 94025, 415/859-3098. He is a specialist in computer security and
networking technology and is an active participant in cellular industry
standardization activities. He has provided Congressional testimony on
telecommunications security and privacy issues and has co-authored a book on
the computer 'hacking' culture.
Robert N. Jesse (2221 Saint Paul St., Baltimore, MD 21218, 301/243-8133) is an
independent consultant with expertise in security and privacy, computer
operating systems, telecommunications and technology management. He is an
active participant in cellular standardization efforts. He was previously a
member of the senior staff at The Johns Hopkins University, after he obtained
his BES/EE from Johns Hopkins.
Andrew H. Lamothe, Jr. is executive vice-president of engineering at Cellular
Radio Corporation, 8619 Westwood Center Dr., Vienna, VA 22180, 703/893-2680.
He has played a leading role internationally in cellular technology
development. He was with Motorola for 10 years prior to joining American
TeleServices, where he designed and engineered the Baltimore/Washington market
trial system now operated by Cellular One.
------End Forwarded Message------
UUCP: {cbosgd, hplabs!hp-sdd, sdcsvax, nosc}!crash!pnet01!mtbill
ARPA: crash!pnet01!mtbill@nosc.mil
INET: mtbill@pnet01.CTS.COM
m:
phreak/CELLULAR/cell1.phk
BIN
View File
Binary file not shown.
phreak/CELLULAR/cell1.txt
+35
View File
@@ -0,0 +1,35 @@
O.K. WE ALL KNOW THAT WITH BELL BUSTING PEOPLE ROUND THE COUNTRY,QUITE
NATURALLY THER'RE GONNA START PROTECTING AGAINST THE TECHNIQUES WE HAVE
ALL GROWN TO KNOW SO WELL AND LOVE.
SO-O-O YOU ASK WHATS NEXT???
AH-HA SAYS YE OLE BOOTLEGGER-
LET ME INTRODUCE YOU TO CHAPTER 1 RE. CELLULAR PHREAKING!
QUOTING THE CAMPS 2001 CELLULAL SYSTEM
THE NORMAL ATTENDENT STATION IS SIMPLY A PUSH BUTTON TELEPHONE! CALLS
REQUIRIN G ATTENDENT ASSISTANCE ARE ROUTED TO TH AT PHONE!THE CELLULAR
OFFICE MAY HAVE A REMOTE ATTENDANT EITHER BY USING A DEDICATED 2-WIRE
VOICE FREQUENCY LINE OR BY CONFIGURING THE CELLULAR SWITCH TO
AUTOMATICALLY DIAL UP A TELEPHONE # THROUGH AN EXISTING DIAL-OUT LINE.
THE DATABASE MAINTENANCE FUNCTION, BILLING FUNCTION, MAY BE REMOTED BY
SIMPLY INSTALLING AUTOANSWER 300 BAUD DATA MODEMS AT THE CELL & CENTRAL
LOCATION.(AND IN YOUR HOME COMPUTER) SINCE NONE OF THESE FUNCTIONS REQUIRE
FULL TIME ATTENTION,A NORMAL DIAL-UP LINE IS ENTIRELY ADEQUATE.(BOY-O-BOY)
THUS,SOMEONE AT THE CENTRAL LOCATION (OR ANYWHERE ELSE) CAN DIAL UP THE
SYSTEM IN SAY BEAUMONT AND ADD A CUST OMER TO THE SUBSCRIBER DATA BASE,OR
DELETE ONE!(I LOVE IT)
PERIODICALLY,SHE CAN DIAL UP THE SYSTE M AND INSTRUCT IT TO DUMP ITS
BILLING INFO INTO HER COMPUTER (OR YOURS) FOR BILL PROCESSING.A
MAINTENANCE MAN CAN USE THE SAME MODEMS TO CHECK FOR ERROR LOGS,SYSTEM
OPS,AND MANUALLY EXERCISE CERTAIN FUNCTIONS!
THIS SYSTEM DUE IN SMALL TOWNS IN BOUT
6 MO. ANOTHER FIRST FROM BOOTLEG
NUFF SAID
phreak/CELLULAR/cell2.phk
BIN
View File
Binary file not shown.
phreak/CELLULAR/cell2.txt
+27
View File
@@ -0,0 +1,27 @@
w: CELLULAR II
MSG LEFT BY: SYSTEM OPERATOR
DATE POSTED:
CELLULAR PHREAKING #2
SEEMS LIKE THE WESTERN UNION MOBILE PHONES(JOHNSON MOD 1154) HAVE A COUPLE
OF FEATURES THE MFG NEVER INTENDED! CHIP U1 IS THE SERIAL NUMBER ROM,WHILE
CHIP U706 IS THE PROM THAT CONTAINS THE ID NUMBER,TELEPHONE NUMBER OF THE
MOBILE,PAGE CHANNEL,HOME CELL,LOCK CODE,AND OTHER OPTIONS.
NOW,AFTER EXTENSIVELY READING THE MANUALS ON THIS UNIT,I DONT SEE ANY
REASON THOSE 2 CHIPS CANT BE REPLACED WITH EPROMS PROGRAMED WITH ANY PHONE
NUMBER YOU WANT!!!!!!!!!!!!!!!!!!!
THIS SHOULD ENABLE THIS UNIT TO CALL AND RECEIVE CALLS FROM ANY PHONE #
YOU WANT!!!! (WILL ALSO CHARGE CALLS TO ANY PHONE # )
THIS MAY TURN OUT BETTER THAN OWNING A WHOLE CENTRAL OFFICE-HEE-HEE
NUFF SAID- BOOTLEG
P.S. I HAVE THE CODING SEQUENCES FOR THE ABOVE CHIPS.ALSO-ILL BUY A USED
WESTERN UNION MOBILE OR ANY OTHER MOBILE PHONE FOR THE RIGHT PRICE! CALL
ME VIA VOICE
phreak/CELLULAR/cell3.phk
BIN
View File
Binary file not shown.
phreak/CELLULAR/cell3.txt
+52
View File
@@ -0,0 +1,52 @@
CELLULAR TELEPHONE PHREAKING PHILE VOL 3 by "The Mad Phone-man"
Now that you have become familiar with the technology of cellular phones
its time to discuss what you can do with a phone right now.
Not every system pays attention to a "Roamer" from outside the system as
closely as they do a local suscriber. In their mad rush to offer cellular as
"universal" service, meaning you can place a call in any cellular city any-
where in North America, they fucked up.
OK, heres the poop...I access say..Cleveland Ohio Cellular 1's Ericcson switch
and tell them by my "NAM" info that im a roamer from NYNEX in New York City.
Cleveland will let me make the call, cause it bills back to NYC my number
of minutes used. If the NYC number is bogus, the call goes thru, and the bill
doesn't go anywhere. They do know the exchange data for NYC, thats on a chart
so ya cant tell em yer...555-1212 or such..you must tell em yer a valid roamer
and the System number (two digits) must match NYC's. This is not too hard to
figgure out, (call some of their stupid sales idiots some time and see what
they will let out of the bag)...so now lets see what else you should know.
OK, the system number for the foreign exchange....Nynex in Buffalo is 56,
Chicago nonwireline is 01, Buffalo Nonwireline is 03, All wirelines are even
numbers all non-wirelines are odd.
OK, first three digits of the mobile number....Nynex Buffalo- 863 xxxx
Buffalo Non-wire 861 xxxx, 690 xxxx.
I am sure it wont take much to figgure out the local numbers for your area
like I said the sales people are fucks and will tell ya anything to
make a sale.
Until the companys get a cellular clearinghouse to validate roamers in real
t{w{e this will work out fine. The prospects of such a clearinghouse are
good after the companys get done with their bitching at each other.
But it may be a while before it becomes routine to look up a roamer. There's
simply too many to look up every time service is wanted.
So, steal a cellphone and his antenna, re-nam it as a roamer and when ya get
it setup, make copies of the info with different suscriber numbers (the
last 4 digits) and make free calls till whenever.
More to come...."The NOVATEL series phones "
Uncracking the Maintenance code
This is probibaly the best radio to use to shut down
a cell site completely, it has secret codes in the ctrl
head that allow you to bypass conventional switching
protocols.
phreak/CELLULAR/cell4.phk
BIN
View File
Binary file not shown.
phreak/CELLULAR/cell4.txt
+115
View File
@@ -0,0 +1,115 @@
WHATS IN A NAM by The Mad Phone-man
---------------------------------------------------------
Nam stands for "Number Assignment Module" or to the Teckies a PROM
(Programable Read-Only Memory) A blank Nam usualy costs between $1. to
$2.75. Sometimes its more expensive depending on the operating temperature
and packaging specifications.
Two flavors of NAM's are used for cellular. NEC uses the open colector
(Signetics p/n 82S32 or equivalent). All others use the tri-state (Signetics
82S123 or equivalent). Blank Nams are manufactured by Signetics,National
Semiconductor, Monolithic Memorys, Fujitsu, Texas Instruments, and Advanced
Microdevices. Blank Nams can be purchased at your electronic distribuitor's
and many radios come with a blank included.
The NAM contains the subscriber number and lock code, the home system
identification and other system required information. You may wonder how this
info is arranged.
The NAM is organized into 32 rows and 8 columns. It is 32 words of 8 bits
each. (256 bits total) Starting from the top of the NAM (address 00)
you will find the abreviation SIDH, This means "system identification number
home" , a number starting at 0001 assigned by the FCC.
Each market allows two systems. Even for the wire-line and odd for
the non-wireline.
At address 03 we find LU (Local use) on the left and MIN on the right these
areusualy set to 1. Locations with zeros are reserved. Going down the map,
there's MIN1 and MIN2 the subscriber number and the area code respectivly
Dont try to read them from a raw printout of the NAM data, they are scrambled
beond recognition. The reason? The way they are arranged is the way they must
be transmitted to the cellular systems receivers. The programmer does this to
make the radio's job easier.
Next is the station class mark, which identifys the class and power capability
of the phone. The system will treat a handheld (low power) differently than
a standard 3 watt mobile.
IPCH is the inital paging channel. The radio listens for a page on this
channel. Wirelines use 334 and non-wirelines use 333.
ACCOLC (ACCess Overload Class) is designed in throwing off customers in
the event of an overload. Thru neglect this standard has been largely unused.
(A class 15 station is supposed to be police, fire, or military)
Usualy its set to 0 plus the last digit of the phone number to provide random
loading.
PS- Prefered system. This is always 1 in non-wireline and 0 in wireline.
The lock code is about the only thing you can read directly by studying
the NAM data. The "spare" bit must be a 0 if the radio contains a 3 digit code.
Because the number of clicks when you dial 0 on a (dial) phone equals 10
zeros in the lock code are represented by an "A" the hexadecimal equiv of 10.
EE,REP,HA, and HF correspond to end-to-end signaling (DTMF tones possible
you talk) REPeratory dialing (provision for 10 or more numbers in memory)
Horn Alert and hands free. Like all options, they are 1, if turned on and
0 if turned off.
Addresses 13 thru 1D (all these numbers are in hex) are supposed to be used
by radio mfgrs to store option switches. Usualy 13 is used, 14 sometimes and
the rest less often.
Last you will find checksum adjustment and checksum. These numbers are
calculated automaticly after the data has been edited for the NAM. The sum
of all words in the nam plus these last two must equal a number with 0's
in the last two digits. The radio checks this sum and if it isnt correct
the radio assumes the NAM is bad or tampered with. In the case the radio
refuses to operate until a legal NAM is installed.
MARK most BIT SIGNIFICANCE least Hex
DEFINITION address
----------------------------------------------------------------------------
| 0 SIDH (14-8) | 00
----------------------------------------------------------------------------
| SIDH (7-0) | 01
----------------------------------------------------------------------------
LU=Local use | LU | 0 0 0 0 0 0 | MIN | 02
----------------------------------------------------------------------------
| 0 0 MIN2 (33-28) | 03
----------------------------------------------------------------------------
| MIN2 (27-24) | 0 0 0 0 | 04
----------------------------------------------------------------------------
| 0 0 0 0 | MIN1 (23-20) | 05
----------------------------------------------------------------------------
| MIN1 (19-12) | 06
----------------------------------------------------------------------------
| MIN1 (11-4) | 07
----------------------------------------------------------------------------
| MIN1 (3-0) | 0 0 0 0 | 08
----------------------------------------------------------------------------
| 0 0 0 0 | SCM (3-0) | 09
----------------------------------------------------------------------------
| 0 0 0 0 0 | IPCH (10-8) | 0A
----------------------------------------------------------------------------
| ICPH (7-0) | 0B
----------------------------------------------------------------------------
| 0 0 0 0 | ACCOLC (3-0) | 0C
----------------------------------------------------------------------------
PS=Perf Syst | 0 0 0 0 0 0 0 | PS | 0D
----------------------------------------------------------------------------
| 0 0 0 0 | GIM (3-0) | 0E
----------------------------------------------------------------------------
| LOCK DIGIT 1 | LOCK DIGIT 2 | 0F
----------------------------------------------------------------------------
| LOCK DIGIT 3 | LOCK SPARE BITS | 10
----------------------------------------------------------------------------
EE=End/End | EE | 0 0 0 0 0 0 | REP | 11
----------------------------------------------------------------------------
REP=Reprity | HA | 0 0 0 0 0 0 | HF | 12
----------------------------------------------------------------------------
HF=Handsfree | |
HA=Horn Alt | Spare Locations (13-1D) |
| contain all 0's | 13
| | to
| | 1D
----------------------------------------------------------------------------
| NAM CHECKSUM ADJUSTMENT | 1E
----------------------------------------------------------------------------
| NAM CHECKSUM | 1F
----------------------------------------------------------------------------
phreak/CELLULAR/cell5.txt
+731
View File
@@ -0,0 +1,731 @@
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
THE HIGH TECH HOODS and
A-CORP PRESENTS.....
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%% %%%
%%% THE ULTIMATE CELLULAR %%%
%%% PHONE PHREAKING %%%
%%% MANUAL #1 of 2. %%%
%%% %%%
%%% COMPILED BY %%%
%%% THE RAVEN %%%
%%% %%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
INDEX....
I. Improved Mobile Telephone Service (IMTS)
II. General Information
III. Cellular Freqs. & Channels
IV. The Cell & It's Structure
V. Equipment Description
VI. More General Info.
VII. Roaming
VIII. NOTE
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
CELLULAR PHREAKER TYPES
-----------------------
There are two types of cellular phone phreakers. The first type is the one
whos's intrested in scanning cellular phone channels basically to overhear
conversations. The second type is the one who obtains and modifies cellular
equipment so that he can make free phone calls at someone elese's expense.
I. IMPROVED MOBILE TELEPHONE SERVICE
This system that was used prior to cellular phones was the Improved Mobile
Telephone Service (IMTS), which was much easier to scan for.
Most scanner enthusiasts are familiar with this standard mobile phone
system; this system has gone thru little evolution in the past decade in the
U.S. It has remained a considerably limited service. A large metro area may
only have several hundred users, (New York City has about 900 mobile phone
subscribers) dur largely to limitations imposed by spectral overcroeding.
Land mobile commo has seen a 10-12% annual growth rate for the past two
decades. The result is that the 40, 150 and 450 MHZ bands are overcrowded.
Even the utilization of the new 900 MHZ band (with 30-40 times more channels
available than other bands) is a short-lived solution to the problem.
IMTS freqs (MHZ):
Channel Base Freq. Mobile Freq.
-----------------------------------------
VHF LOW BAND
ZO 35.26 43.26
ZF 35.30 43.30
ZH 35.34 43.34
ZA 35.42 43.32
ZY 35.46 43.46
ZR 35.50 43.50
ZB 35.54 43.54
ZW 35.62 43.62
ZL 35.66 43.66
VHF HIGH-BAND
JL 152.51 157.77
YL 152.54 157.80
JP 152.57 157.83
YP 152.60 157.86
YJ 152.63 157.89
YK 152.66 157.92
JS 152.69 157.95
YS 152.72 157.98
YA 152.75 158.01
JK 152.78 158.04
JA 152.81 158.07
UHF BAND
QC 454.375 459.375
QJ 454.40 459.40
QD 454.425 459.425
QA 454.45 459.45
QE 454.475 459.475
QP 454.50 459.50
QK 454.525 459.525
QB 454.55 459.55
QO 454.575 459.575
QA 454.60 459.60
QY 454.625 459.625
QF 454.650 459.650
The VHF high-band freqs. are the most popular IMTS channels. If you live
within 25-50 miles of even a moderate sized town, you should have at least
one VHF high-band channel. VHF low-band IMTS is used in rural areas and
those with hilly terrain. UHF IMTS is primarily used in cities where the
VHF channels are crowded. If you live in a major city, expect to have most,
if not all, of these channels available to you.
II. GENERAL CELLULAR INFO
This section is a little boring but it's needed to set a basic foundation
of cellular phone phreaking so that part 2 doesn't sound like all
technicial talk!
The FCC originally estaablished 3 cellular bands. One was given to the local
Bell or Telco, (wireline carrier), one to an independent firm (non-wireline
carrier), and one reserved for future use. Originally there were 666 cellular
freqs or channels. In recent years the FCC has tacked on another 156 freqs
for a total of 832 freqs, and all cellular makers have upgraded their phones
to accomodate the new channels. Some of the new channels appears above the
original 666 while others appear below.
The cellular system cannot know whether or not a cellular phone can be
switched to one of the 156 channels without the phone telling it. This is done
by the Station Class Mark (SCM), which is a 4-bit binary number.
(1) Bit #1 is "0" for 666 and "1" for 832
(2) Bit #2 is "0" for a mobile unit and
"1" for a voice activated transmit.
(That saves batteries on portables.)
(3) Bit #3 and #4 identify the power class
of the phone:
"00" = 3 watts
"01" = 1.2 watts
"10" = 0.6 watts
and "11" is not assigned.
The old traditional scheme for handling cellular traffic is the analog
method or Frequency-Divison Multiple Access (FDMA). How the FDMA works is
that free channels are found and each transmitter is assigned to one of them.
When the call finishes, th echannels are freed up for the next call. Also, as
the two parties become physically closer or more distant as they drive or
travhghhggytel the call may be handed off to other freqs assigned to the new cells
they are in.
Newer proposed schemes include Time-Divison Multiple Acess (TDMA) and Code-
Divison Multiple Acess (CDMA). IN TDMA systems, calls may simultaneously use
the same channels but are interspered between the pauses in the conversation.
Many pauses result not only in the way people normally think and talk but when
one party is talking, the other is listening. With TDMA, the Cellular Phone
Company (CPC) injects small delays in parts of conversations to accommodate
other traffic on that channel. This increases the lenght of the average phone
call, which also increases their profits from it - not to mention the fact
that they can increase there output by the factor of 3 and also then expand
their operation.
CDMA is a system that's been used by military for the past 30+ years. CDMA
appears to basically be a system where conversation are compressed into coded
bundles and then decompressed at the other end.
A Cellular Mobile Telephone (CMT) is one that is installed in a vehicle,
aircraft, watercraft or whatever, as opposed to a transporable or portable
unit.
III. CELLULAR FREQS & CHANNELS
There are 832 cellular phone channels. 416 of these are allocated for the
non-wireline services (Band A), and 416 for the wireline services (Band B).
Each of these channels have two freqs, spaced 45 MHZ apart, that operate in
a full-duplex mode. The lower freq is for the phone unit, while the upper is
for the cell or basesite. Of the 416 channels, 21 are digital data control or
"set up" channels and 395 are voice channels. Channels are numbered 1 thru
1023, and there is a gap from 800 to 990.
Rather than producing a list of 1646 cellular freqs, I have provided the math
eqations that can be used to calculate them. These equations can be programmed
into computers and calculators.
N = Cellular Channel # F = Cellular Freq
B = 0 (mobile), or B = 1 (base)
CELLULAR FREQS from CHANNEL #S:
-------------------------------
F = 825.030 + B*45 + (N-1)*.03
WHERE: n = 1 to 799
F = 824.040 + b*45 + (N-1)*.03
where: N = 991 to 1023
CELLULAR CHANNEL #s from FREQS:
-------------------------------
N = 1 + (F-825.030-B*45)/.03
Where: F > = 825.030 (mobile)
or F > = 870.030 (base)
N = 991 + (F-824.040-B*45)/.03
Where: F < = 825.000 (mobile)
or F < = 870.000 (base)
If the system uses OMNICELLS, as most do, you can readily find all the
channels in a cell if you know just one of them, using tables constructed
from these equations. Band A uses channels 1-333 under the old 666-channel
system. To that have been added 667-716 and 991-1023 under the new 832-channel
system. Band B uses channels from 334-666 under the old system, plus 717-799
under the new system.
IV. CONTROL & VOICE CHANNEL ALLOCATIONS
---------------------------------------
(D=DESIGNATOR, CC=CONTROL CHANNEL, VC=VOICE CHANNEL)
NON-WIRLELINE SERVICES (BAND A)
-------------------------------
D = 1A : CC = 313 : VC = 1,22,43,64,85,106,127,148,169,190,211,232,253,274,
295,667,688,709,1003
D = 2A : CC = 314 : VC = 2,23,44,65,86,107,128,149,170,191,212,233,254,275
296,668,689,710,1004
D = 3A : CC = 315 : VC = 3,24,45,66,87,108,129,150,171,192,213,234,255,276
297,669,690,711,1005
D = 4A : CC = 316 : VC = 4,25,46,67,88,109,130,151,172,193,214,235,256,277
298,670,691,712,1006
D = 5A : CC = 317 : VC = 5,26,47,68,89,110,131,152,173,194,215,236,257,278
299,671,692,713,1007
D = 6A : CC = 318 : VC = 6,27,48,69,90,111,132,153,174,195,216,237,258,279
300,672,693,714,1008
D = 7A : CC = 319 : VC = 7,28,49,70,91,112,133,154,175,196,217,238,259,280
301,673,694,715,1009
D = 1B : CC = 320 : VC = 8,29,50,71,92,113,134,155,176,197,218,239,260,281
302,674,695,716,1010
D = 2B : CC = 321 : VC = 9,30,51,72,93,114,135,156,177,198,219,240,261,282
303,675,696,1011
D = 3B : CC = 322 : VC = 10,31,52,73,94,115,136,157,178,199,220,241,262,283
304,676,697,991,1012
D = 4B : CC = 323 : VC = 11,32,53,74,95,116,137,158,179,200,221,242,263,284
305,677,698,992,1013
D = 5B : CC = 324 : VC = 12,33,54,75,96,117,138,159,180,201,222,243,264,285
306,678,699,993,1014
D = 6B : CC = 325 : VC = 13,34,55,76,97,118,139,160,181,202,223,244,265,286
307,679,700,994,1015
D = 7B : CC = 326 : VC = 14,35,56,77,98,119,140,161,182,203,224,245,266,287
308,680,701,995,1016
D = 1C : CC = 327 : VC = 15,36,57,78,99,120,141,162,183,204,225,246,267,288
309,681,702,996,1017
D = 2C : CC = 328 : VC = 16,37,58,79,100,121,142,163,184,205,226,247,268,289
310,682,703,997,1018
D = 3C : CC = 329 : VC = 17,38,59,80,101,122,143,164,185,206,227,248,269,290
311,683,704,998,1019
D = 4C : CC = 330 : VC = 18,39,60,81,102,123,144,165,186,207,228,249,270,291
312,684,705,999,1020
D = 5C : CC = 331 : VC = 19,40,61,82,103,124,145,166,187,208,229,250,271,292
685,706,1000,1021
D = 6C : CC = 332 : VC = 20,41,62,83,104,125,146,167,188,209,230,251,272,293
686,707,1001,1002
D = 7C : CC = 333 : VC = 21,42,63,84,105,126,147,168,189,210,231,252,273,294
687,708,1002,1023
WIRELINE SERVICES (BAND B)
--------------------------
D = 1A : CC = 334 : VC = 355,376,397,418,439,460,481,502,523,544,565,586,607
628,649,720,741,762,783
D = 2A : CC = 335 : VC = 356,377,398,419,440,461,482,503,524,545,566,587,608
629,650,721,742,763,784
D = 3A : CC = 336 : VC = 357,378,399,420,441,462,483,504,525,546,567,588,609
630,651,722,743,764,785
D = 4A : CC = 337 : VC = 358,379,400,421,442,463,484,505,526,547,568,589,610
631,652,723,744,765,786
D = 5A : CC = 338 : VC = 359,380,401,422,443,464,485,506,527,548,569,590,611
632,653,724,745,766,787
D = 6A : CC = 339 : VC = 360,381,402,423,444,465,486,507,528,549,570,591,612
633,654,725,746,767,788
D = 7A : CC = 340 : VC = 361,382,403,424,445,466,487,508,529,550,571,592,613
634,655,726,747,768,789
D = 1B : CC = 341 : VC = 362,383,404,425,446,467,488,509,530,551,572,593,614
635,656,727,748,769,790
D = 2B : CC = 342 : VC = 363,384,405,426,447,468,489,510,531,552,573,594,615
636,657,728,749,770,791
D = 3B : CC = 343 : VC = 364,385,406,427,448,469,490,511,532,553,574,595,616
637,658,729,750,771,792
D = 4B : CC = 344 : VC = 365,386,407,428,449,470,491,512,533,554,575,596,617
638,659,730,751,772,793
D = 5B : CC = 345 : VC = 366,387,408,429,450,471,492,513,534,555,576,597,618
639,660,731,752,773,794
D = 6B : CC = 346 : VC = 367,388,409,430,451,472,493,514,535,556,577,598,619
640,661,732,753,774,795
D = 7B : CC = 347 : VC = 368,389,410,431,452,473,494,515,536,557,578,599,620
641,662,733,754,775,796
D = 1C : CC = 348 : VC = 369,390,411,432,453,474,495,515,537,558,579,600,621
642,663,734,755,776,797
D = 2C : CC = 349 : VC = 370,391,412,433,454,475,496,516,538,559,580,601,622
643,664,735,756,777,798
D = 3C : CC = 350 : VC = 371,392,413,434,455,476,497,517,539,560,581,602,623
644,665,736,757,778,799
D = 4C : CC = 351 : VC = 372,393,414,435,456,477,498,518,540,561,582,603,624
645,667,737,758,779
D = 5C : CC = 352 : VC = 373,394,415,436,457,478,499,519,541,562,583,604,625
646,668,738,759,780
D = 6C : CC = 353 : VC = 374,395,416,437,458,479,500,520,542,563,584,605,626
647,669,739,760,781
D = 7C : CC = 354 : VC = 375,396,417,438,459,480,501,522,543,564,585,606,627
648,719,740,761,782
To summarize how a cellular call is made: A mobile unit wishing to make a
call will go off-hook and then transmit the digital source and destination
codes on a control channel (used to set-up and monitor the call), and are
just strong enough to reach the base station in the local cell. Upon getting
this data, the base, thru its control freq (same channel), validates the
mobile unit.
The base station then fowards a message to the central switching office on
a land line, which in turn sends the paging signal to all cells in search of
the second mobile unit whos number has been dialed. When the destination unit
is finally found, it responds to the paging signal by transmitting an
acknowledgement code to its local base station on a control channel.
The switching center then assigns a pair of unused freqs (called the,
"channel Pair") to each of the unit for actual voice commo to take place.
These channel pairs are not neccesarily the same for the respective cells
that each mobile unit is in. These freqs are also relayed thru the base
stations and to the central switching office.
When a unit moves into another cell, things get very interesting. Upon
entry into another cell, the mobile unit must transmit thru a new base
station. An automatic handoff to the new base station is carried out by
another exchange of data thru the control channel.
Termination of the call is a simple matter. When the call ends,ON-hook
signals are exchanged via the control channels between the mobile unit and
the base station. The voice channels are then cleared.
IV. THE CELL & IT'S STRUCTURE
The cellular phone system uses a "honeycombed" hexagonal cell architure.
Each of the cell types (A-G) differ from each other only in the freqs.
allocated for them. This represents how a cellular system might be laid out.
Cells A and B never share a common border. Neither do B and C, A and G,
etc. Cells that are next to each other are never assigned adjacent freqs.
They always differbu\y at least 60 KHZ. To track a mobile phone as it
changes cells, lets put the mobile in a B cell. When the mobile switches
freqs. you know that it could only go to a D, E, F, or G cell because A and
C have adjacent freqs. The two tables below will help you determine which
Channel cell can go next to each other. You can contact your local cellular
phone company and see if they have any maps of the cell available in your
area (please get a copy for us also). They're not obligated to give you maps
but it's worth the try.
ADJACENT CELLS
--------------
Cell Adjacent cells
A C,D,E,F
B D,E,F,G
C E,F,G,A
D F,G,A,B
E G,A,B,C
F A,B,C,D
G B,C,D,E
The only fundamental point of cellular technology actually agreed upon to
date is that a given service area will be divided into identical adjacent
cells with no overlaps and no gaps. The hexagon is the standard cell
patteren. At the center of an individual cell is a base station which is
conected via land line to a local mobile phone switching office. Certain
freq bands are assigned to certain cells, but not shared with adjacent cells
to avoid mutual interference.
In 1979, AT&T began test marketing its version of a cellular phone system
in Chicago. This system is call the Advanced Mobile Phone System (AMPS)
Some 2100 sq miles of the metro Chicago area are divided into 10 cells to
serve about 2000 customers. Full duplex is possible by using a pair of one
way channels separated by 45 MHZ to connect the mobile units with the base
stations. The RF range is 825-890 MHZ and normal narrow band FM is used to
transmit voice. Hand-off to adjacent cells is accomplished by monitoring
signal strengths. When the central switching office determines that a new
base station receives the mobile signal better than the previous one, the
switching office signals thru the voice channel for the mobile phone to
switch to a new channel. Commo distruption thru the switching process is
typically 50 milliseconds.
As with IMTS, there is the possibility of phreaking calls with IMTS or AMPS
simply by monitoring the control channels since they are in dial pulse form.
After you have a nice set of numbers, you will neeed a transmitter of
sufficient strenght to reach the base station (unlicenced transmitter of
course!). Duhh
Many regulatory and implementation issues remain unsolved. Modulation issues
are the biggest problem to be solved. Single sideband AM, narrow band FM,
digital and spread-spectrum techniques are all being considered. If you have
any info that may be able to break this down for fellow hackers/phreaks
please leave me mail.
V. EQUIPMENT DESCRIPTION
Most mobile phones have two primary pieces of equipment. These are the
transceiver (transmitter-receiver pair) and the control head.
The transceiver is usually a metal box with three connectors. They usually
contain two circuit boards. One is the transceiver unit itself, and the other
is a logic board consisting of a uP, ADC and DAC, and control logic. The
transceiver is usually mounted in the trunk or sometimes under the hood, and
is connected to both the ignition switch and car battery. A control/audio
(shielded) links the equipment together.
The control head is a touch-tone phone handset with the extended keypad,
alphanumeric display and controls (i.e. mike, volume). Usually there is a
separate speaker installed in the cradle for on-hook dialing, call progress
monitoring and speakerphone operation. If the CMT has a speaker phone option
a small mike is usually mounted to the sun visor. Some cellular phones are
voice-activated. If battery-operated, this saves the battery and also makes
answering the phone easier. The control head and cradle assembly is usually
bolted to the hump between the two front seats for security purposes.
Most early CMT's use the AMPS bus (developed by AT&T) which uses a system
of 36 wires in a rather bulky and stiff control/audio cable. Some makers now
use their own bus, such as Novatel's serial bus, which specifies a thin cable
consisting of a few wires, and is much easier to install and dependable to
use. In almost all cases, a CMT is powered by regulated 12 volts from standard
13.8 volt car battery. At least 5 amps (continuous) is required.
Mobile cellular antennas are usually short (less than one foot long),
vertically-mounted stiff wire with a few turns in the middle that acts as a
phasing coil in a 5/8-wave configuration. The antenna is generally mounted
either thru a hole in the roof or at the top of the rear winshield using
silicone rubber cement with conductive plates on both sides to pass the RF
thru the glass (some RF losses result from this method but you don't have to
maim your vehcle). A 50 ohm coax cable (ex: RG-58/U) links the antenna to the
transceiver with a male TNC type UHF connector. A ceramic duplexer permits
the transmitter and receiver to share the same antennas at the same time.
CMT roof-mounted monopole antennas are designed to work with the ground
plane (ie: the vehicle's body, if metal). However, for fixed (ie: home-base)
use, an "extended-feed" or voltage-fed coaxial antenna (requires no ground
plane) can be used. A capped PVC pipe makes an ideal rooftop housing for
this type of antenna-both weatherprofing and concealing it. Note that altho
cellular systems are designed for inefficient antennas, for fixed use it is
preferred that you use the best antenna you can get.
Interfacing audio devices (ex Blue Boxes, other tone generators) to a CMT
can be done by coupling the device's output thru an audio coupling
transformer wired across the control head's mike lines. A 600-ohm audio
coupling antenna is availble from Radio Shack (273-1374). Be sure to DC
isolate the phon circuity by wiring the transformer in series with a
non-polarized capacitor of at least 1.0 uF and 50 volts. If you can locate
the bus that carries the audio, then coupling across it is preferred.
An acoustic modem can be coupled to a CMT eithrer thru the mouthpiece or by
connecting the mike and speaker wires to those in the control head or bus
lines. Any direct-connect devices (ex: answering machines, modems, standard
phones, etc) can be connected to a CMT thru the AB1X cellular interface
made by : Morrison & Dempsey (818 993-0195). This expensive device is
basically a 1-line PBX that connects between the transceiver and control
head and provides an RJ-11C (quick-connect) jack that accepts any direct-
connect phone accessory. It recognizes both touch-tone and pulse dialing,
provides the ringing voltage and generates dial and busy tones as needed.
VI. GENERAL PHREAKING INFO
----------------------
Some Definitions:
* Control Channel: The channel the phone and cell base first communicate on.
* Reverse Control Channel: The opposite freq, 45MHZ lower then the control
channel. This is where the mobile unit is.
* Voice Channel: The channel you are assigned by the switch to start the call
after the exchange of suscriber data.
* Revese Voice Channel: Again 45 MHZ lower.
* Switch: The computer that places the calls, and takes and receiver data
from the subcriber or from the PSTN. (Pubic Swithced Telephone Network). That
should get things started. A suscriber picks up his handset to place a call.
QUESTIONS AND ANSWERS
---------------------
The following questions & answers were taken from THE SOURCE BBS a.k.a.
THE NEW YORK HACK EXCHANGE
BCOM> I want to get into cellular phone phreaking but I dont know anything so
I'm depending on you guys to help me out from the VERY basics!
What is cellular; a cellular phone?
RAVEN> A 800 MHZ radiotelephone, running 3 watts, with the ability to change
channel on computer command from the central swith. This happens when
you travel thru the service area and your signal becomes stronger at a
neighboring cell base station.
BCOM> They are marketed as a high security device with no possibility of
anyone making a phoney call & charging it to someone else, how can it
be phreaked?
RAVEN> An understanding of the phone revels that every time a call is made,
the phone number, an electronic serial number, and oother data is sent
to the switch. If you were to listen to the opposite side of the
control channel as the cell is being "set up" you would hear this data
being transmitted to the switdch in NRZ (Non-Return to Zero) code.
All one has to do, is record this info and program the bogus phone to
these params, and then a free call is possible thru the switch.
BCOM> Has anyone done this yet?
RAVEN> HELL YEA! about 6 months after the first cellular phone system was
"turned-up", a technician programmed a Panasonic telephone with a
NEC ESN (Electronic Serial Number). And there have been many other
cases since then. With the popular ROM programmers avaible today,
almost any NAM (NUmeric Assignment Module) can be duplicated or
copied with changes. (The NAM is the heart of the billing info and
contains the phone number but not the ESN) The most popular integrated
circut for NAMs is the 74LS123.
BCOM> Sounds like a lot of trouble, is there easier ways to get service?
RAVEN> SURE, the cellphone companies have been their own downfall, In an
effort to market their wares as a universal service. Nobody can tell
if a phone from another city (that has a roaming agreement) is valid
until its too late. The only thing they could do after finding out is
block any call with bad ESN because as we know, the phone number is
easy to change, but the ESN is not.
So here's a likely scenario====> A roamer identifying itself as a number
from a Chicago non-wireline accesses a cellular system in Dallas. An operator
may intervene but you can usually BS or "Social Engineer" them as long as
you know the data you have programmed into your phone. Then you make calls
just like your a local user. If your found out, you change the number to
another, and see if that works.
The phone is locked onto the strongest control channel in the area by a
computerized scanner in the phone. As the user drives thru the service, a
computer constantly picks out the strongest control channel and stays on it,
altho more than one cell site can actually be herd. The subcriber enters
the number to call on the keypad, and presses the "send" button.
At this time the following data is transmitted to the cell site by the
mobile. The callers ESN, his home system number (two digits), his mobile's
area code and phone number, and the called number. The cellular switch now
picks up an outgoing line, places the call for him and tells the mobile unit
to switch to a voice channel. The two ends are linked in the central switch
and the two parties are connected up in about 3 seconds.
I have purposely over-simplified the whole process to point out the moment
of truth. The mobile's ESN and phone number and data in the switch must match
or no go. This is required for billing purposes. If one had the ESN and the
mobile phone number, he could then calll anytime anyplace without fear of a
trace - let alone a bill. The ideal setup would let you listen to the reverse
control channel, record and display herd working numbers and ESN's, and
recall them as one needs them to make calls.
This would be it but we are not quite there yet. But some hard work has
already been done for us. All the aforementioned codes are sent in hex, in
NRZ code (phancy term for phase shift keying), but the phone already has, for
example, a NRZ receiver and transmitter built right into it. All that has to
be done is to have a receiver on the reverse control channel, recover the
other users data and save it or at least print it out.
The mobile radio data book show some good technical info on the systems used
and chip part numbers for the NRZ stuff. For example, at least one cellular
phone maker uses the 8085 chip for the control head functions - a popular
and well understood chip by many.
Most cellular phones include a crude password system to keep unauthorized
users from using the phone - however, dealers often set the password (usually
a 3 to 5 digit code) to the last four digits of the mobile phone or there
home phone. If you can find it somewhere on the phone then your in luck!!
If you can't find it then I guess you gotta hack it. It souldn't be that
hard since most people aren't smart enogh to use something besides "11111",
"12345", or whatever, it will be like Hacking a VMB.
If you want to modify the chip set in the cellular phoneyou got, there are
two chips (of course this depends on the model and maker - your may be
different) that will need to be changed - one installed by the maker usually
eepoxied in with the phone's ID number, and one installed by the dealer with
the phone number, and possible the security code. To do this youll obviously
need an EPROM (Erasable Programmable Read-Only Memory) burner, as well as the
same type of chips used in the phone (or a friendly & unscruplus dealer!).
As to recording the numbers of other mobile phone customers and using them;
as far as I know it is quite possible, if you got the equipment to record and
decode it. The cellular system would possibly freak out if two phones (with
valid ID/phone number combinations) were both present in the network at once,
but it remains to be seen what will happen.
The MIN is the Mobile Identification Number (includes the phone number, and
it is stored on the NAM ROM). Stolen and spoofed ESN's and MINs are good for
about a month. Once a bad MIN is revealed, the legit user's MIN is changed
by the Mobile Telephone Switching Office (MTSO) and they arrange for a new
NAM ROM to be installed in the users legit unit. Of course MTSO keeps a
database of all legit,illegit and deadbeat MIN/ESN pairs. However, the MTSO
will allow a illegit MIN/ESN pair to continue to function beyond its
discovery in hopes of discovering who the phreaks are.
One of the properties of cellular phone system is that the transmitter
freqs may be changed or "hopped" in the constant effort to allocate freqs.
Because of freq. hopping it is very difficult triangulate a CMT using
standard RF directional finding methods. It is known that a directional
antenna randomly aimed at cellsite repeaters will confuse directional finding
equipment being used by them that is synced to their freq. hopping scheme.
ROAMING
Since cellular technology often results in physical seperation between the
caller and-or callled party from landlines, because it offers thousands of
lines to choose from, because freq. hopping occurs, and because the caller
and-or called party can be rapidly moving from one location to another,
cellular phnes are the safest form of phreaking. "Roaming" is one form of
cellular phreaking.
Roaming occurs when a CMT is used in a cellular system other than the one
indicated in the NAMs SID. This is called "ROAMmode", and the ROAM indicator
on the control head will light. A CMT can roam into any system its home CPC
has a roaming agreement with, and most CPC's now have roam agreements with
each other. Not every system pays attention to a "Roamer" from outside the
system as cosely as they do a local suscriber. In their mad rush to offer
cellular as "universal" service, they screwed up. If there's no roam
agreement, the MTSO will transmit a recorded message to the CMT with some
instructions to call the CPC, and gives his name ,MIN,ESN and credit card
number. All roamed calls will then be completed by the MTSO and billed to the
credit card account. This procedure is becomming less common as more roam
agreements are made.
Usually, CPC can only determine if a roamer came from a system with which
it has a roaming agreement - nit the creditworthiness of the roamer.
Consequently, many CPCs have been ripped-off by roamers who've been denied
service on their home system because they are deadbeats. Once the home CPC
is billed for the roaming services provided by the remote CPC to the phreaker
or deadbeat, it will notify the same to add that ESN/MIN pair to their
MTSO's "negative verify" file to prevent future abuses.
Several independent firms are establishing systems software and data
networks to allow POSITIVE ROAMER VERIFICATION (PRV), which allow near real
time roamer validation bt sharing data between CPCs. Until PRV becomes
universal, even bogus ESNs and MINs can roam if they follow the standard
format, alto some CPCs are sharing roam data on a limited basis to prevent
this. Even with PRV, ESN/MIN pairs that are spoofed to match valid accounts
will be accepted both by thier home CPC and roamed CPCs, until the legit
customer complains about the calls he didn't make. And even without PRV,
some CPCs automatically share ESN and MIN data. This frequently occurs
between the CPCs in major cities and those in their bedroom communities.
To call a roaming CMT, the caller must know which system that unit is in,
which can be a real trick since he may be on the road at the time. He then
calls the CPC's roaming number. Roaming numbers vary but usually are in the
phone number format (with area code, with the last four digits being
"ROAM", and with the 3 middle digits being the remote CPC's exchange).
When that number is called, a dial or ready tone is returned, after
which the roaming CMT's full MIN is entered in Touch-Tone. After several
seconds, the CMT will ring or the caller will hear a recording stating
that the roaming CMT is out of range or busy. Telocator Publications
(202) 467-4770 publishes a nationwide roaming directory for travellers
with celluar phones.
For example: I access the Cleveland Ohio Cellular 1's Ericcson switch
and I tell them by my NAM INfo that I'm a roamer from NYNEX in New York
City. Cleveland will let me make the call, bacause it bills back to NYC
for the number of minutes I use. If the NYC number is bogus , the call
goes thru anyway, and the bill doesn't go anywhere. They do know the
exchange data for NYC (that's on a chart) so you can't tell them a wrong
system number (two digits) but one that a valid roamer would have from
his area. This is not too hard to figure out, call some of their stupid
sales idiots some time and see what they let out of the bag.
The system number for the foreign exchange, NYNEX in Buffalo is 56,
Chicago nonwireline is 01, and Buffalo nonwireline is 03. All wirelines
are even numbers and all nonwirelines are odd. The first three digits
of the mobile number: NYNEX Buffalo 863-XXXX. Buffalo Non-wirelines
are 861-XXXX and 690-XXXX.
You dont have to be a rocket scientist to figure out the local numbers
for your area, again by conning the sales people. Until the CPC's get a
cellular clearinghouse to validate roamers in real time, this method
will work out fine. It will be awhile before it becomes routine to look
up a roamer. There's simply to many to look up every time service is
wanted. And this problem is increasing because of the expanding use of
cellular phones.
If a cellular phone and its antenna happen to fall into your hands, you
could re-nam it as a roamer and when you get it setup, make copies of the
info with different suscriber numbers (the last 4 digits) and make free
calls as long as you can.
THe Novatel series phone a re probaly the best radios to use to shut down
a cell site completely as it has secret codes in the control head that
allow you to bypass conventional switching protocols.
NOTE
I hope that this file has lived up the all the boasting I've put into it.
But if there are any problems with the freqs. or anything you can leave me
mail on the bbs's I've listed. At this time Demon Roach and Nihilism dont
carry my files but you can still leave me mail on those boards!
THE RAVEN
+=======+
=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-==-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Thats it for part 1 but look out for part 2!!
Part 2 will cover: What's in a NAM, NAM reprogramming and how to
reprogram the following phones: DIAMONDTEL MESA90X & MESA99X HANDHELD,
GATEWAY CP 900 HANDHELD, GENERAL ELECTRIC MINI II & MINI ,
MITSUBISHI 800 & 900 , MOTOROLA 8000H & ULTRA CLASSIC HANDHELD,
NEC P300 & NEC P9100 , NOVATEL PTR800 & 825 , OKI HANDHELD MODEL #750,
OKI HANDHELD MODEL #900 , PANASONIC EB3500 , COLT TRANSPORTABLE ,
DIAMONDTEL MESA 55 & MESA 95 TRANSPORTABLE , FUJITSU MOBILE PHONE ,
GENERAL ELECTRIC CARFONE XR3000 , GOLDSTAR SERIES 5000 MOBILE ,
MITSUBUSHI 555,560,600 , NEC M3700 SERIES MOBILE , NOKIA LX-11 & M-10 ,
NOVATEL 8305 TRANSPORTABLE CA08 SOFTWARE VERSION , OKI CDL400 ,
PANASONIC EB362 , PANASONIC EB500 OR TP-500 , RADIO SHACK 17-1002 & -1003 ,
AND GE CARFONE MODELS CF-1000, CF-2000 & CF-2500
So look for it at a BBS near you!!
THE RAVEN
+=======+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
And as for all of you guys that wanted to know how I got money for most of
the thing I have well all I can say is look for me next file:
Check Fraud (ckfraud.txt)
to put it simple $32,000 in one day! And as you know...No BullShit!!
-----------------------------------------------------------------------------
Call the following BBS's to get my files 1st run!:
THE SOURCE (212) PRI-VATE
RIPCO (312) 528-5020
Bliterkrieg (502) 499-8933
The Hawks Nest (201) 347-6969
You can leave me mail on those boards and on the following:
The Demon Roach Underground (806) 794-4362
Nihilism (517-546-0585
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
HIGH TECH HOODS 1992 (c)opyright A-CORP. LATER.......THE RAVEN!
phreak/CELLULAR/cell9411.txt
+384
View File
@@ -0,0 +1,384 @@
====================================================
Stargate's Cell Hackers Journal
Vol 94.11 NOV,1994
====================================================
"Oh course, our system guarantees a fast, clear secure connection"
-Cell 1 sales dweeb
Well due to some small demand, heres the first issue of mag
dedicated to exploring the ins and outs of Cell Phones, I'll try to
be as simple as I can and wont dwell with some of the irrelevancies
of the operations of the cells, just basically genuine hacking
information, some which I will gather from tech manuals and actual
testing, now granted I'm just a hobbyist, and it is not my intent
for this information to be used in any illegal manner, especially
for any persons attempting to defraud any cellular company, and
any other of the illegal shit that goes along with that. I am
looking for any authors, (cuz I sure as shit don't know
everything!) to contribute to this spread of forbidden knowledge.
I intend to send out this mag at least quarterly or as any information
of great importance is presented , so the size of these texts may vary
greatly. What I really like to include is some back door test modes
for *any phonez, especially the ESN modification type.
I would like to say thanx to everyone who encouraged me and
got me started in this great form of technology. And I will strive
to keep the information as correct as possible, but 'member I cant
test everything, if it sounds logical and can be done, then I'll
present it here for your approval, if ya have any text ya want to
send , or any comments, please email me at TECHMAN@ANON.PENET.FI
(until I get a real internet account!). Enjoy *
-----------------------------------------------------------------
I. The Software Question (for popular Motorola fones)
The most popular fone among the hackers is obviously the
motorola mircrotac of "flip fone" (which is characteristic of its
microphone flipping mechanism). Early in the cell game a ware was
released by Cellular Press (a.k.a Spy Supply) which could mod all
of the motorolas using a simple made cable and a PC. Well as time
went on and motorola wanted to add more features and better
handling of the hardware, they started to change they're firmware
of the fones to accommodate the changes, along with the changes was
an inability of the software to modify the ESN data of these fones,
thus other ways had to be implemented , one such method was a
firmware replacement, this was a easy chore for the Bags and totes,
but a pain in the ass for the flips, the bags and totes used the
regular DIP package 27c512 Prom, while the equivalent on the flips
was in a plcc surface mount package, which could only be removed
with real skill, and some expensive soldering equipment, not to
mention reprogramming a Eprom / prom of the same type , and then
replacing it, now anyone (like me) who has popped open one of those
flip fones know how crappy that method is, you risk destroying your
fone, and losing some of the features. Well HTH came out with
a "trick clip" which consisted of a plcc test socket, and a
reprogrammed chip. This procedure still required you to disable the
firmware on yer fone , by cutting a trace (*ouch) sticking the
trick clip in the chip, jumpering a pin on the socket to a place on
the board, and then attaching your cable and using the old ware.
Still this was a tedious, expensive (hth wanted $295 for the clip)
and dangerous procedure. And sometimes with certain fone revs this
didn't work. As time went on and the demand grew to do these phones
software solutions began to emerge, one was called TRANS-2, and/or
MPC which was a package available from C.G.C (California Grapevine
Communications), this package was also available from a company
called Cellsoft, both houses sold the ware for a ridiculous $700
and protected it copyright infringement by making it dependant on
a dongle to operate. Well after talking to C.G.C about the software
and basically getting the brushoff from Cellsoft (they may be
another Spy supply house), the MPC / Trans-2 ware was describe as
"horrible and buggy" by greg at C.G.C (the guy with the british
accent). Well the package was purchased and now is being
distributed in its uncraked state to various crak groups for repair
;), but this has either proved a challenge for the guys, or they
have been reduced to money grubbers by re-selling the packages, in
my opinion these are the lowest of lamers, theres nothing worse
than a thief of thieves.
As a point of ID, if you can get your hands on the old style
flip fone (which were usually tan in color and had a membrane
keyboard), these are ready modible , having a firmware rev up to
9012.
Now theres one last ware out there that's supposed to the be
the most reliable of ones to mod the new fones (up to 9340) is
called AMPS/G2. This is now being sold by C.G.C for $700 and is now
floating around the internet waiting to be cracked. (sorry greg,
but your price is ridiculous). I recently Emailed DrDamien for some
new info on moding the new stuff, and found out from him that some
places are selling firmware/cable kits for $50 which is not a big
bite at all, now he didn't go into detail on what they were,
whether they were the old firmware switch (mentioned above, which
in some instances caused yer fone to power up saying "loaner" and
disabling all your cool functions, like storage and other shit) or
the firms that take advantage of the "Identity Transfer" function
of theses fones, which simply put xfers your fones NAM/ESN data to
another fone by executing a #66 and #69 (see the MOTCODEZ.TXT file)
on each fone, one is called a LOADER fone (contains the new info)
and the TARGET fone (the fone to get the goodies), now this is
proven to work with ALL motorola fones even the new 94F firmware
series.
C.G.C offers a package consisting of a LOADER fone with special
firmware, plus a cable with a switch for $995. From what I've heard
this is a nice setup, but way too expensive, remember the true
idea of cloning tries to *SAVE the user money by having two lines
on one bill, and $1000 bux is just not cost effective now, maybe
over a few years perhaps. But you know how the underground works,
as soon as someone gets one, they'll copy the firmware , dissect
the cable and u/l the info to yer local site. (I'm waiting to see
it!)
None the less there are some (expensive) options for those who
wish to master the new motorola fones, its just a matter of what
purpose and how often will you use it, now for those who wish to
open your own cell-fone cloning house , good luck, laws are
developing as you read this to outlaw that, (you didn't honestly
think that they would continue to allow that), and if you can
justify spending the $1000 for the loader fone (the most reliable
way to date), then more power to ya, as for us regular hackers, who
want to learn more about these , then that's outrageous. You'll be
better off getting one legit. (*shudder) (tm).
* And Also note, the roaming scam is almost non existent, this
method consisted of changing the ESN/MIN to a bogus out-of-state
number, then making a call, since the subscriber info could not be
validate real-time, the first call would go through, but subsequent
calls would be blocked until this information was changed again,
thus someone developed a "tumbler fone" which changed this info to
some random quotient, before each call was place, this drove the
Cellcos and Fedz nutz, so they just simply forward your call to a
special cell provider who lets you make your call using a Credit
card or do it collect, usually at a ridiculous rate i.e. $2.00 per
minute. (some allow calling cards)
-----------------------------------------------------------------
II. What does the Cellwarez do?
Cell Software Review (just the old stuff that's out, cuz there is
some confusion on what can do what.)
Cellsoft.zip ... This is original stuff that was sold as
package from Cellular press, A.K.A Spy
Supply, it was priced at $500 and now can
be yanked from any good H/P board, it
contains the warez to do the Motorolas
Panasonics and NEC p300/301/200/201/400.
Newphones.arj .. This package is the Shareware (?!?!) release
of Cellular press's moding ware. It contains
all the files aforementioned plus wiring
diagrams, and some warez to do NEC9A/11A
NOKIAs , TANDY, R-SHACKS, and MITSUS MT3/MT4
interesting note about this one is that it
asks you to upload to various bbs's and then
call them (Robert Carp) and Narc em out to
receive registration (?!?) and more info on
their services, maybe they feel guilty for
screwing all those folks around. * Also
contains ROMS from the old firms of MOT
phones for the ESN replacement technique.
UNICHIP.ZIP .. This is another package containing moding
wares for the MOTS/NEC/PANS, but this one
also contains new software for doing the
p400/401/600/601 firms before and after
V.34, offered by unisoft. Also has Wiring
Digrams for building the cables
UNICELL.EXE .. Another package similar to the unichip.zip
except this one contains a better Checksum
calculator for programming the 9346-16911
eprom, and does a larger variety of fones
(Sony/Phillips/Nokia/Cleartone/Novatel/mobira)
A-Z.zip .. C.G.Cs intensive programming guide for 110 +
cellfones, also has some (little) information
on back door test modes and other goodies,
such as a definition file and a FAQ on
ESN emulation.
Cellmon.zip .. Now this one is interesting, it seems to want
to interface with a MOT Mircotac, and
supposedly, scans the channels to monitor the
the frequency, this also may be a simple form
of a DDi, (digital Data interface) which is
used to read the RCC (reverse control
channel). *The RCC is a channel the fone uses
to communicate with the tower, ESN/MIN/SCM
data is xfered through this chan.
Honorable Mention : P3tst001.txt, a text on the test commands for
the NEC p300/301/600/601/400/401 phones,
includes instructions for ESN modification :
NOVATEL1.TXT, this file has information for
moding the novatel 83XX series fone, including
changing the ESN info, (*warning, can only be
done 3 times), OKITEST.TXT , this is a listing
of test commands for the OKI series fones,
which is considered to be a "HACKER PHONE!"
MOTCODEZ.TXT, is a file which has the current
test mode commands on motorola phones.
-------------------------------------------------------------
III. Current Mod-ible fones
This is a short list of the phones that can currently be
altered. (ESN wise that is) If I come short on this, please
by all means let me know what fones can be altered and how, but
this list is comprised mostly of the ones I moded personally.
The purpose of this list is for you who are out trying to buy
a cellfone, and wanna know which ones can be used. Theres a
shitload of fones out there that *cant be modified currently,
the big ones are the Audiovoxs (new), judging by the programming
and ic's in the phone, Audiovox's engineers were overly security
conscious, but as you well know this may and will change as new
ways of exploiting technology becomes evident.
Currently Modiable HOW
================== ===
Motorola BAG* Cable, Software
Motorola FLIP* Cable, Software
Motorola Brick* Cable, Software
Panasonic D,E,F,G,H Cable, Software
NEC p300/301/600/601/400/401 Cable, Software
Nokia (all) Chip Removal
NEC 11/9a Cable, Software
Novatel (83XX) Keyboard/ROM
Mitsubishi MT3/MT4 Chip Removal
Sony CM-H333 Chip Removal
Phillips PR-92 Chip Removal
Nokia 100/190 Chip Removal
BT / Ivory Chip Removal
Novatel 4400 Chip Removal
Cityman 100 Chip Removal
Ameritech (motorola) Cable, software
NOTES: * indicates that new software or a new method is needed to
mod fones with firmware revs higher that 9122. Chip removal refers
to removing the 9346-16911 serial eprom, and programming with the
Unichip and Unicell software
---------------------------------------------------------------
IV. How to get ESN/MIN pairs, the magic stuff
Now Methods for obtaining this valuable information varies,
I'll give you a few personal examples on how I was able to get some
pairs. One method (which was lo-risk and cheap) was to do the
old infamous trashing, I cased out a local cell provider branch
office, found out what were there days/hours of operation, snooped
and asked some questions on how they deal with fraud, (social
engineering skills were needed of course), to which the only answer
they could provide was "oh , well if you didn't make the calls, we
will not require you to pay for them, and we'll change your number"
which gave me two good pieces of information, 1 they just chalk it
up to loss , to appease the customers, and two, they don't give a
fuck in finding out who made the calls. Now that was good to hear,
so on the day before trash collection I simply parked my car by the
dumpster, (flashlight in my pocket), and simulated taking a leak
behind the trash bin, quickly I open the side access panel, and did
a quick search, I found 3 bags with words (cellular, contract)
clearly visible in the bags, I grabbed them, look around, and
tossed them in the trunk. After getting them to my garage (it was
about 11:30 pm too) and sifting through the coffee filters, and
salad containers, I walked off with about 100 pairs. (written
contract info which is discarded after its entered into the
computer). The cons to this is that you got a lot of explaining to
do to the cops if they see you toss some bags of trash in your
trunk, and some states have laws governing trash, to the effect of
the trash being the property of the company until its collected by
a designated trash refuge agency, non-the-less , this works for
some places, Cell-1's here, have a company called 'Document
Services' which pick up their trash, and shred the ESN/personal
papers and contracts, thus this is ineffective in some areas.
Another more expensive way, is to obtain a device called a
DDi, Digital Data Interface, this thing comes in various formats
from the more expensive stand-alone box, to a device which
interfaces with your 800 mhz capable scanner and a PC, the cheapest
standalone I seen was $1295, also I saw a kit for a simple one for
about 1-$200, this is the safest way do get pairs, simply make the
device mobile, and sit in a busy traffic area (freeway overpass)
and collect all the data you need.
These are just a couple of examples on obtaining the 'magic
numbers' , some other ways (trading, inside help) does work too,
but are sometimes not effective, try to be creative, the Fedz know
about the trashing from back to the Captain Crunch days, the DDi
seems to be the logical choice for snarfing.
----------------------------------------------------------------
V. Ways of Detection
Well this is another concern that the astute phreaker must
know is how to avoid detection, what you must remember is that the
only way you can be physically traced, is by having the phone
powered up and registered within the system, and all the cops have
to do is some rudimentary triangulation and you're snagged, as long
as you remember some basic rules, you can slim your chances of
being discovered.
1. Never reveal your location or describe yourself over the
airwaves, this is a real common mistake, just a simple as you
turning on a scanner to monitor conversations, the cops have even
more sophisticated equipment to do so. A cell phreaker once told me
to just pretend you're in a crowed room when you speak on the fone,
so the information that you relay should not be something that you
would want that crowd to hear. You are just handing yourself over
when you make this mistake.
2. Never leave your phone powered up or battery pack left on,
this reason is simple, you turn the phone on, you're registered in
the system, every phone transmits the ESN/MIN/SCM data to the cell
tower to become registered so that when you place a call , the fone
will be ready, some phones (motorola bags/totes/installed) transmit
this data, even when its powered off, only the power adapter or
battery need be connected, the effect varies when 2 fones with the
same ESN/MIN/SCM data are registered at the same time, but most of
the time a Fraud Flag goes off, and your calls (the #'s) are
recorded or the system denies you access to place calls.
3. Never give any personal information out over the phone,
this is a relative mistake as mentioned in #1, except this is
mainly geared towards those, who like to make reservations at a
restaurant or order a pizza, all the fedz need do is call the
number and asked who placed a order at such and such day and time
(these places usually keep a record of this), and wham, youre
busted.
-------------------------------------------------------------------
VI. Internet Sites to get Cell info
Here is a list of Anon. FTP sites where Cell info is stored,
I've checked them all in the past month, and they're still up.
SPY.ORG /pub/SECURITY/SECTEC/cellular
Corrupt.Sekurity.com /pub/phones and /pub/incoming
l0pht.com /pub/blackcrwl/cell
src.doc.ic.ac.uk
wiretap.spies.com
ftp.winternet.com /users/craigb
quartz.rutgers.edu
Ftp.Netcom.com
siam.unibe.ch
ftp.eff.org
ftp.cic.net
If you got any more, don't hold out, email em, or upload em to
me at the above email address.
-----------------------------------------------------------------
VII. Last notes
Well this will end my first issue of the Cellhackers journal,
I need anyone who knows anything, and would like to contribute ,
please email me or contact me on the stargate BBS, you can find the
# and nup on quality boardz, or chat with me on the IRC, I use the
handle TECHMAN / CELLFONE / or MICROTAC, usually in the #STARGATE
, #CELLULAR, #PHREAK channels, the next issue we'll get into some
more ESN moding Back Doors on some popular phones, and I'm trying
to get some generic plans for building a cheap DDi, a flip fone and
scanner (moded to receive 800 mhz cell freqs) will be needed. I'll
try to have the next issue out in JAN, it'll prob be right after
new years, hack on gentlemen.
Some Greetz go out to:
DrDamien for Breaking the Barrier on writing about Cell
Phreaking, a lot of shit here I learned from you.
PMF the man who supplied MPC to me, thanks man, sorry about
our little ESN fandango, but we're clearing it up.
PaTcH NET, (Code REd, Thranduil) for starting this cool net,
we need to X-pand this shit tho'
Drunkfux, for all his late-breaking info and cool t-files, how
come you wont validate me on your board man, and I hope your band
is working out.
MOTOROLA for making a damn good (and modifiable) fone, I hope
you guys keep it up.
Cybertron , my boy with the gutz. Peaches my girl, Nutz and
Voltz mag, WayWard (for his skillz) , TACACS, Chr0nic, Terminal
Man, Alphabits, The Raven of HTH, and anyone else I didn't mention.
PEACE
TECHMAN
phreak/CELLULAR/cellcode.car
+765
View File
@@ -0,0 +1,765 @@
Cellular Carrier SID BID Listings by Company
This data was extracted from two listings sent to me by the Chicago Cellular
One, dated 23MAR90 and 23MAY90. There was no indication of copyright notice or
other restriction in the telephone conversation when I requested the data or in
the listings. One listing was in alphabetical order by city name. The other
listing was in numerical order by SID major and BID minor.
I expect that there are errors in this data. I detected and corrected several
typographical errors in my data entry and discovered several mismatches between
the two listings. Please, send corrections and expansions to me by e-mail.
The columns of this plain text database are separated by colon (:) characters.
The columns are, from left to right:
1: the SID, system Identification number,
(Note: odd numbers are "A" or non-wireline carriers; and,
even numbers are "B" or wireline carriers.)
2: the BID, the billing identification number, or = if same as the SID,
3: a City in the area of the service (multiple cities may be listed),
4: the Postal Code for the State or Province of the City in column 3,
(Note: BH was used for Bahamas.)
5: the telephone company name,
6: a customer service number for the area indicated by columns 3 and 4,
7: the clearing house that handles roamers' billing records.
The data was presented in this form to reduce the size of the database for
transmission. You may want to use the enclosed scripts and awk programs to
format the database for easier viewing.
Randolph J. Herber,
@ home: {att|mcdchg|laidbak|obdient|uunet!tellab5|wheaton}!yclept!rjh,
rjh@yclept.chi.il.us
-------------------- Cut Here ----------------------
#!/bin/sh
cat - <<\!EOF! >SIDS.sh
#!/bin/sh
# 1-SID:2-BID:3-City:4-State:5-Company:6-Service#:7-ClearingHouse
cut -d: -f1,2,5,7 SIDS | \
sort -u -t: +2 -4 +0n -1 +1n -2 >SIDS.co.tmp
awk -F: -f SIDS.f1.awk SIDS.co.tmp >SIDS.co.alf
sort -t: +0n -1 +1n -2 +2 -4 SIDS.co.tmp | \
awk -F: -f SIDS.f1.awk >SIDS.co.num
rm SIDS.co.tmp
cut -d: -f1,2,3,4,5,6 SIDS | \
sort -u -t: +2 -4 +0n -1 +1n -2 | \
awk -F: -f SIDS.f2.awk >SIDS.city.alf
cut -d: -f1,2,3,4,5,6 SIDS | \
sort -u -t: +3 -4 +2 -3 +0n -1 +1n -2 | \
awk -F: -f SIDS.f2.awk >SIDS.st.alf
!EOF!
cat - <<\!EOF! >SIDS.f1.awk
{printf("%5.5s|%5.5s|%-26.26s|%s\n",$1,$2,$3,$4);}
!EOF!
cat - <<\!EOF! >SIDS.f2.awk
{printf("%5.5s|%5.5s|%-18.18s|%2.2s|%-26.26s|%s\n",$1,$2,$3,$4,$5,$6);}
!EOF!
cat - <<\!EOF! >SIDS
1:=:Chicago:IL:Cellular One:800 235 5663:GTEDS
2:=:Los Angles:CA:Pactel Cellular:714 553 6100:GTEDS
2:=:Palm Springs:CA:Pactel Cellular:714 553 6100:GTEDS
3:=:Buffalo:NY:Buffalo Telephone Company:716 854 5076:BANK/IL
4:=:San Diego:CA:Pactel Cellular:619 535 6464:GTEDS
5:=:Milwaukee:WI:Cellular One:414 783 5500:APPEX
6:=:Seattle:WA:US West Cellular:800 626 6611:GTEDS
6:=:Tacoma:WA:US West Cellular:800 626 6611:GTEDS
7:=:Boston:MA:Cellular One:617 890 1555:(Boston)
8:=:Allentown:PA:Bell Atlantic Mobile:800 922 0204:GTEDS
8:=:Philadelphia:PA:Bell Atlantic Mobile:800 953 2200:GTEDS
8:=:Reading:PA:Bell Atlantic Mobile:800 922 0204:GTEDS
8:=:Trenton:NJ:Bell Atlantic Mobile:800 922 0204:GTEDS
8:=:Wilmington:DE:Bell Atlantic Mobile:800 922 0204:GTEDS
12:=:Beaumont:TX:GTE Mobile:800 347 5665:GTEDS
12:=:Bryan:TX:GTE Mobile:800 347 5665:GTEDS
12:=:College Station:TX:GTE Mobile:800 347 5665:GTEDS
12:=:Galveston:TX:GTE Mobile:800 347 5665:GTEDS
12:=:Houston:TX:GTE Mobile:800 347 5665:GTEDS
12:=:Port Arthur:TX:GTE Mobile:800 347 5665:GTEDS
13:=:Baltimore:MD:Cellular One:301 220 0060:(Baltimore)
13:=:Washington:DC:Cellular One:301 220 0060:(Baltimore)
15:=:Cleveland:OH:Cellular One:216 351 1414:Commonwealth
15:=:Elyria:OH:Cellular One:216 351 1414:Commonwealth
15:=:Lorain:OH:Cellular One:216 351 1414:Commonwealth
17:=:St. Louis:MO:Cybertel Cellular:314 423 6500:GTEDS
18:=:Alexandria:VA:Bell Atlantic Mobile:800 922 0204:GTEDS
18:=:Baltimore:MD:Bell Atlantic Mobile:800 922 0204:GTEDS
18:30016:Frederick:MD:Bell Atlantic Mobile::GTEDS
18:=:Silver Spring:MD:Bell Atlantic Mobile:800 922 0204:GTEDS
18:=:Washington:DC:Bell Atlantic Mobile:800 922 0204:GTEDS
19:=:Indianapolis:IN:Cellular One:317 252 5367:CBIS
20:=:Chicago:IL:Ameritech Mobile:800 221 0994:GTEDS
21:=:Detroit:MI:Cellular One:313 737 5123:APPEX
21:=:Flint:MI:Cellular One:313 239 6661:APPEX
21:=:Grand Rapids:MI:Cellular One:616 451 3523:APPEX
21:=:Lansing:MI:Cellular One:517 323 9462:APPEX
21:=:Lima:OH:Cellular One:419 234 1091:APPEX
21:=:Muskegon:WI:Cellular One:517 323 9492:APPEX
21:=:Saginaw:MI:Cellular One:517 323 9462:APPEX
21:=:Toledo:OH:Cellular One:419 243 1091:APPEX
22:=:Brooklyn:NY:Nynex Mobile Com:800 227 1069:Nynex
22:=:Congers:NY:Nynex Mobile Com:800 227 1069:Nynex
22:=:Freehold:NJ:Nynex Mobile Com:800 227 1069:Nynex
22:=:Hackensack:NJ:Nynex Mobile Com:800 227 1069:Nynex
22:=:Madison:NJ:Nynex Mobile Com:800 227 1069:Nynex
22:=:Morristown:NJ:Nynex Mobile Com:800 227 1069:Nynex
22:=:Nassau County:NY:Nynex Mobile Com:800 227 1069:Nynex
22:=:New Brunswick:NJ:Nynex Mobile Com:800 227 1069:Nynex
22:=:Newark:NJ:Nynex Mobile Com:800 227 1069:Nynex
22:=:Paterson:NJ:Nynex Mobile Com:800 227 1069:Nynex
22:=:Pleasantville:NY:Nynex Mobile Com:800 227 1069:Nynex
22:=:Rahway:NY:Nynex Mobile Com:800 227 1069:Nynex
22:=:Suffolk County:NY:Nynex Mobile Com:800 227 1069:Nynex
22:=:White Plains:NY:Nynex Mobile Com:800 227 1069:Nynex
22:=:World Trade Center:NY:Nynex Mobile Com:800 227 1069:Nynex
23:=:Minneapolis:MN:Cellular One:612 867 2273:APPEX
24:=:Maimi:FL:Bell South Mobile:800 351 2400:GTEDS
24:=:West Palm Beach:FL:Bell South Mobile:305 577 4975:GTEDS
25:=:New York:NY:Metro One:201 587 8000:APPEX
26:=:Minneapolis:MN:US West Cellular:800 626 6611:GTEDS
27:=:Los Angles:CA:LA Cellular Telephone Co.:213 721 8722:APPEX
27:=:Oxnard:CA:Cellular One:805 987 0955:APPEX
28:=:Auburn:MA:Nynex Mobile Com::Nynex
28:=:Boston:MA:Nynex Mobile Com::Nynex
28:=:Brockton:MA:Nynex Mobile Com::Nynex
28:=:Framington:MA:Nynex Mobile Com::Nynex
28:=:Lawrence:MA:Nynex Mobile Com::Nynex
28:=:Lowell:MA:Nynex Mobile Com::Nynex
28:=:Lynn:MA:Nynex Mobile Com::Nynex
28:=:New Bedford:MA:Nynex Mobile Com::Nynex
28:=:Providence:RI:Nynex Mobile Com::Nynex
28:=:Worchester:MA:Nynex Mobile Com::Nynex
29:=:Philadelphia:PA:Metrophone:800 327 9666:APPEX
30:=:Portland:OR:GTE Mobile:800 366 5665:GTEDS
30:=:Salem:OR:GTE Mobile:800 366 5665:GTEDS
31:30015:Napa:CA:Cellular One:800 331 4322:APPEX
31:30017:Santa Cruz:CA:Cellular One:415 344 1999:GTEDS
31:=:Oakland:CA:Cellular One:415 344 1999:APPEX
31:=:San Francisco:CA:Cellular One:415 344 1999:GTEDS
31:=:San Jose:CA:Cellular One:415 344 1999:GTEDS
31:=:San Rosa:CA:Cellular One:800 331 4322:GTEDS
31:=:Vallejo:CA:Cellular One:800 331 4322:GTEDS
32:=:Pittsburgh:PA:Bell Atlantic Mobile:800 922 0204:GTEDS
32:30020:Altoona:PA:Bell Atlantic Mobile:814 944 3011:GTEDS
32:30022:Charleston:WV:Bell Atlantic Mobile:304 925 4000:GTEDS
32:30024:Huntington:WV:Bell Atlantic Mobile:304 525 4101:GTEDS
32:30026:Johnstown:PA:Bell Atlantic Mobile:814 467 5521:GTEDS
32:30030:Parkesburg:PA:Bell Atlantic Mobile:800 922 0204:GTEDS
32:30034:State College:PA:Bell Atlantic Mobile:814 231 3900:GTEDS
32:30032:Steubenville:OH:Bell Atlantic Mobile:614 282 6202:GTEDS
32:30032:Weirton:WV:Bell Atlantic Mobile:614 282 6202:GTEDS
32:30028:Wheeling:WV:Bell Atlantic Mobile:614 695 9611:GTEDS
33:=:Dallas:TX:Metrocell Cellular:214 263 4921:APPEX
33:=:Ft. Worth:TX:Metrocell Cellular:214 263 4921:APPEX
33:=:Denton:TX:Metrocell Cellular:214 263 4921:APPEX
34:=:Athens:GA:Bell South Mobile:800 351 2400:GTEDS
34:=:Atlanta:GA:Bell South Mobile:800 351 2400:GTEDS
35:=:Houston:TX:Houston Cellular Telephone:713 688 8020:APPEX
36:=:New Orleans:LA:Bell South Mobile:800 351 2400:GTEDS
37:=:Ft. Lauderdale:FL:McCaw Cellular:407 655 1948:APPEX
37:=:Maimi:FL:Cellular One:305 792 2355:APPEX
37:=:Stuart:FL:Cellular One:407 833 1111:APPEX
37:=:West Palm Beach:FL:Cellular One:407 833 1111:APPEX
38:=:Ft. Worth:TX:Southwestern Bell Mobile:800 331 0500:GTEDS
38:=:Dallas:TX:Southwestern Bell Mobile:800 331 0500:GTEDS
38:=:Denison:TX:Southwestern Bell Mobile:800 331 0500:GTEDS
38:=:Sherman:TX:Southwestern Bell Mobile:800 331 0500:GTEDS
39:=:Johnstown:PA:Cellular One:814 242 0100:APPEX
39:=:Pittsburgh:PA:Cellular One:412 471 3922:APPEX
39:30059:Wheeling:WV:Cellular One:304 281 0100:APPEX
40:=:Salinas:CA:GTE Mobile:800 366 5665:GTEDS
40:=:San Francisco:CA:GTE Mobile:800 366 5665:GTEDS
40:=:San Jose:CA:GTE Mobile:800 366 5665:GTEDS
40:=:San Rosa:CA:GTE Mobile:800 366 5665:GTEDS
40:30002:Santa Barbara:CA:GTE Mobile:800 366 5665:GTEDS
41:=:Athens:GA:Pactel Cellular:404 449 3900:GTEDS
41:=:Atlanta:GA:Pactel Cellular:404 449 3900:GTEDS
42:=:Brandenton:FL:GTE Mobile:813 221 1662:GTEDS
42:=:Ft. Meyers:FL:GTE Mobile:800 877 5665:GTEDS
42:=:Lakeland:FL:GTE Mobile:800 877 5665:GTEDS
42:=:Sarasota:FL:GTE Mobile:800 877 5665:GTEDS
42:=:Tampa:FL:GTE Mobile:800 877 5665:GTEDS
42:=:Venice:FL:GTE Mobile:800 877 5665:GTEDS
42:=:Winter Haven:FL:GTE Mobile:800 877 5665:GTEDS
43:=:San Diego:CA:US West Cellular:800 626 6611:GTEDS
45:=:Colorado Springs:CO:Cellular One:303 831 1200:APPEX
45:=:Denver:CO:Cellular One:303 831 1200:APPEX
45:=:Ft. Collins:CO:Cellular One:303 831 1200:APPEX
45:=:Greely:CO:Cellular One:303 831 1200:APPEX
46:=:St. Louis:MO:Southwestern Bell Mobile:314 542 9999:GTEDS
47:=:Bellingham:WA:Cellular One:206 285 2273:APPEX
47:=:Bremerton:WA:Cellular One:206 285 2273:APPEX
47:=:Olympia:WA:Cellular One:206 285 2273:APPEX
47:=:Seattle:WA:Cellular One:206 285 2273:APPEX
47:=:Tacoma:WA:Cellular One:206 285 2273:APPEX
48:=:Phoenix:AZ:US West Cellular:800 626 6611:GTEDS
51:=:Cincinnati:OH:Cellular One:513 733 5515:Commonwealth
51:=:Hamilton:OH:Cellular One:513 733 5515:Commonwealth
52:=:Kansas City:KS:Southwestern Bell Mobile:913 894 1600:GTEDS
52:=:Kansas City:MO:Southwestern Bell Mobile:913 894 1600:GTEDS
52:=:Lawrence:KS:Southwestern Bell Mobile:913 894 1600:GTEDS
52:=:St. Joseph:MO:Southwestern Bell Mobile:913 894 1600:GTEDS
52:=:Topeka:KS:Southwestern Bell Mobile:913 894 1600:GTEDS
53:=:Phoenix:AZ:Metro Mobile:602 731 6000:APPEX
53:30053:Tuscon:AZ:Metro Mobile:602 628 9541:APPEX
54:=:Akron:OH:GTE Mobile:800 669 5665:GTEDS
54:=:Canton:OH:GTE Mobile:800 669 5665:GTEDS
54:=:Cleveland:OH:GTE Mobile:800 669 5665:GTEDS
54:=:Elyria:OH:GTE Mobile:800 669 5665:GTEDS
54:=:Erie:PA:GTE Mobile:800 669 5665:GTEDS
54:=:Lorain:OH:GTE Mobile:800 669 5665:GTEDS
56:=:Buffalo:NY:Nynex Mobile Com::Nynex
57:=:New Orleans:LA:Cellular One:504 830 5400:GTEDS
58:=:Denver:CO:US West Cellular:800 626 6611:GTEDS
59:30057:Kansas City:KS:Cellular One:913 432 3141:APPEX
59:30057:Kansas City:MO:Cellular One:913 432 3141:APPEX
59:=:Lawrence:KS:Cellular One:913 842 0577:APPEX
59:=:Topeka:KS:Cellular One:913 234 4984:APPEX
60:=:Honolulu:HI:GTE Mobile:808 941 9934:GTEDS
61:=:Eugene:OR:Cellular One:503 345 1818:APPEX
61:=:Medford:OR:Cellular One:503 944 5555:APPEX
61:=:Portland:OR:Cellular One:503 228 1717:APPEX
61:=:Salem:OR:Cellular One:503 364 3335:APPEX
62:=:Memphis:TN:Bell South Mobile:800 351 2400:GTEDS
63:=:Albany:NY:Cellular One:518 465 7300:BANK/IL
64:=:Las Vegas:NV:Centel Cellular:702 365 6500:GTEDS
65:=:Louisville:KY:Cellular One:502 582 2355:APPEX
68:=:Orlando:FL:Bell South Mobile:305 577 4975:GTEDS
69:=:Durham:NC:Cellular One:919 481 1181:GTEDS
69:=:Raleigh:NC:Cellular One:919 481 1181:GTEDS
70:=:Wichita:KS:Southwestern Bell Mobile:316 687 2355:GTEDS
71:=:Richmond:VA:Cellular One:804 288 3805:GTEDS
73:=:Akron:OH:Cellular One:216 867 3900:Commonwealth
73:=:Canton:OH:Cellular One:216 867 3900:Commonwealth
74:=:Bristol:TX:Centel Cellular::GTEDS
74:=:Johnson City:TN:Centel Cellular::GTEDS
74:=:Kingsport:TN:Centel Cellular::GTEDS
75:=:Jacksonville:FL:Cellular One:904 731 2355:APPEX
76:=:Louisville:KY:Bell South Mobile:800 351 2400:GTEDS
77:=:Syracuse:NY:Cellular One:315 446 0400:Cell-T
78:=:Albany:NY:Nynex Mobile Com::Nynex
79:=:Albuquerque:NM:Metro Mobile:505 266 9000:APPEX
80:=:Anderson:IN:GTE Mobile:800 669 3001:GTEDS
80:=:Bloomington:IN:GTE Mobile:800 669 3001:GTEDS
80:=:Ft. Wayne:IN:GTE Mobile:800 669 3001:GTEDS
80:=:Indianapolis:IN:GTE Mobile:800 669 3001:GTEDS
80:=:Kokomo:IN:GTE Mobile:800 669 3001:GTEDS
80:=:Lafayette:IN:GTE Mobile:800 669 3001:GTEDS
80:=:Muncie:IN:GTE Mobile:800 669 3001:GTEDS
80:=:Terre Haute:IN:GTE Mobile:800 669 3001:GTEDS
81:=:Mobile:AL:Gulf Coast Cellular:205 343 9700:Cell-T
83:=:Newport News:VA:Centel Cellular:804 473 9600:GTEDS
83:=:Norfolk:VA:Centel Cellular:804 473 9600:GTEDS
83:=:Virginia Beach:VA:Centel Cellular:804 473 9600:GTEDS
84:=:Aiken:GA:Cellular Phone of:404 738 2355:GTEDS
84:=:Augusta:GA:Cellular Phone of:404 738 2355:GTEDS
85:=:Baton Rouge:LA:Cellular One:504 291 9703:GTEDS
86:=:Syracuse:NY:Nynex Mobile Com::Nynex
88:=:SNET:CT:SNET Cellular:203 553 7594:GTEDS
88:30006:Springfield:MA:SNET Cellular:203 553 7594:GTEDS
89:=:Sharon:PA:Cellular One:412 866 5000:APPEX
89:=:Warren:OH:Cellular One:216 565 5000:APPEX
89:=:Youngstown:OH:Cellular One:216 565 5000:APPEX
91:=:Provo:UT:Cellular One:801 359 2273:APPEX
91:=:Salt Lake City:UT:Cellular One:801 359 2273:APPEX
92:=:El Paso:TX:Contel Cellular:800 792 8400:GTEDS
92:=:Las Cruces:NM:Contel Cellular:800 792 8400:GTEDS
93:=:Knoxville:TN:Cellular One:615 584 2355:APPEX
94:=:Salt Lake City:UT:US West Cellular:800 626 6611:GTEDS
95:=:Greensboro:NC:Cellular One:919 668 3600:GTEDS
96:=:Harrisburg:PA:Centel Cellular:717 545 3300:GTEDS
96:=:Lancaster:PA:Centel Cellular:717 545 3300:GTEDS
96:=:York:PA:Centel Cellular:717 545 3300:GTEDS
97:30097:El Paso:TX:Metro Mobile:915 532 5559:APPEX
97:30097:Las Cruces:NM:Metro Mobile:505 526 2233:APPEX
98:=:Anniston:AL:Bell South Mobile:800 351 2400:GTEDS
98:=:Birmingham:AL:Bell South Mobile:800 351 2400:GTEDS
98:=:Tuscaloosa:AL:Bell South Mobile:800 351 2400:GTEDS
100:=:Fayetteville:NC:Centel Cellular:919 833 7494:GTEDS
103:=:Allentown:PA:Cellular One:215 434 2355:GTEDS
103:30023:Reading:PA:Cellular One:215 434 2355:GTEDS
103:=:York:PA:Cellular One:717 579 2355:GTEDS
104:=:Knoxville:TN:US Cellular:615 584 9500:GTEDS
105:=:NE PA:PA:Cellular One:717 434 2355:GTEDS
106:=:Baton Rouge:LA:Bell South Mobile:800 351 2400:GTEDS
107:=:Austin:TX:Cellular One:512 388 6777:APPEX
110:=:Albuquerque:NM:US West Cellular:800 626 6611:GTEDS
111:=:Tulsa:OK:Cellular One:918 584 7722:APPEX
112:=:Sacramemto:CA:Pactel Cellular:916 520 0645:GTEDS
113:30043:Anniston:AL:Cellular One:205 942 2355:APPEX
113:=:Birmingham:AL:Cellular One:205 942 2355:APPEX
113:30025:Florence:AL:Cellular One:205 942 2355:APPEX
113:30029:Gadsden:AL:Cellular One:205 942 2355:APPEX
114:=:Charlotte:NC:Alltel Mobile:704 529 0001:GTEDS
116:=:Anderson:SC:Centel Cellular:803 297 8860:GTEDS
116:=:Greenville:SC:Centel Cellular:803 297 8860:GTEDS
116:=:Spartanburg:SC:Centel Cellular:803 297 8860:GTEDS
117:=:Rochester:NY:Genesse Telephone:716 232 6600:BANK/IL
118:=:Clarksville:TN:Bell South Mobile:800 351 2400:GTEDS
118:=:Nashville:TN:Bell South Mobile:800 351 2400:GTEDS
119:=:Bridgeport:CT:Metro Mobile:203 852 9292:APPEX
119:=:Danbury:CT:Metro Mobile:203 852 9292:APPEX
119:30119:Fairfield County:CT:Metro Mobile:203 852 9292:APPEX
119:=:Hartford:CT:Metro Mobile:203 688 3737:APPEX
119:=:New Bedford:MA:Metro Mobile:401 272 3800:APPEX
119:=:New Haven:CT:Metro Mobile:203 852 9292:APPEX
119:=:North Bedford:CT:Metro Mobile:203 852 9292:APPEX
119:=:Norwalk:CT:Metro Mobile:203 852 9292:APPEX
119:=:Norwich:CT:Metro Mobile:203 688 3737:APPEX
119:=:Pittsfield:MA:Metro Mobile:203 688 3737:APPEX
119:=:Providence:RI:Metro Mobile:401 272 3800:APPEX
119:31119:Springfield:MA:Metro Mobile:203 688 3737:APPEX
119:=:Waterbury:CT:Metro Mobile:203 852 9292:APPEX
120:=:Mobile:AL:Contel Cellular:800 792 8400:GTEDS
120:=:Pensacola:FL:Contel Cellular:800 792 8400:GTEDS
122:=:San Antonio:TX:Southwestern Bell Mobile:512 646 9955:GTEDS
123:=:Wilmington:DE:Cellular One:302 737 3333:APPEX
126:=:Sharon:PA:Centel Cellular:216 758 4502:GTEDS
126:=:Warren:OH:Centel Cellular:216 758 4502:GTEDS
126:=:Youngstown:OH:Centel Cellular:216 758 4502:GTEDS
127:=:Charleston:SC:Cellular One:803 763 6363:GTEDS
129:=:Sacramemto:CA:Cellular One:916 923 2400:APPEX
129:=:Yuba City:CA:Cellular One:916 923 2400:APPEX
130:=:Toledo:OH:Centel Cellular:419 893 1077:GTEDS
131:=:Abilene:TX:Cellular One::GTEDS
133:=:Columbus:OH:Cellular One:614 846 7317:Commonwealth
136:=:Jacksonville:FL:Bell South Mobile:305 577 4975:GTEDS
137:=:Omaha:NE:US West Cellular:800 626 6611:GTEDS
139:=:Anderson:SC:Metro Mobile:803 234 7954:APPEX
139:30139:Charlotte:NC:Metro Mobile:704 552 5185:APPEX
139:31139:Greenville:SC:Metro Mobile:803 234 7954:APPEX
140:=:Tuscon:AZ:US West Cellular:800 626 6611:GTEDS
142:=:Greensboro:NC:Centel Cellular:919 299 3333:GTEDS
142:=:Winston-Salem:NC:Centel Cellular:919 299 3333:GTEDS
143:=:Memphis:TN:Cellular One:901 683 2355:APPEX
144:=:Burlington:NC:Centel Cellular:919 833 7494:GTEDS
144:=:Durham:NC:Centel Cellular:919 833 7494:GTEDS
144:=:Raleigh:NC:Centel Cellular:919 833 7494:GTEDS
146:=:Oklahoma City:OK:Southwestern Bell Mobile:405 720 2212:GTEDS
148:=:Chattanooga:TN:Bell South Mobile:800 351 2400:GTEDS
149:=:Bristol:TX:Cellular One:615 349 4500:APPEX
149:=:Johnson City:TN:Cellular One:615 349 4500:APPEX
149:=:Kingsport:TN:Cellular One:615 349 4500:APPEX
150:=:Des Moines:IA:US West Cellular:800 626 6611:GTEDS
151:=:San Antonio:TX:Cellular One:512 349 2600:APPEX
152:=:Omaha:NE:Centel Cellular:402 330 6500:GTEDS
153:=:Fresno:CA:Cellular One:209 438 8888:APPEX
153:=:Visilia:CA:Cellular One:209 738 0999:APPEX
156:=:Charleston:SC:Centel Cellular:803 767 1340:GTEDS
159:=:Harrisburg:PA:Cellular One:717 579 2355:GTEDS
159:30011:Lancaster:PA:Cellular One:717 579 2355:GTEDS
159:30013:York:PA:Cellular One:717 579 2355:GTEDS
160:=:Jackson:MS:Alltel Mobile:601 354 1212:GTEDS
161:=:Chattanooga:TN:Cellular One:615 892 2355:APPEX
162:=:Fresno:CA:Contel Cellular:800 792 8400:GTEDS
162:=:Visilia:CA:Contel Cellular:800 792 8400:GTEDS
163:=:Dayton:OH:Cellular One:513 477 1999:GTEDS
163:=:Springfield:OH:Cellular One:513 434 2355:Commonwealth
164:=:Austin:TX:GTE Mobile:800 347 5665:GTEDS
165:=:Wichita:KS:Cellular One:316 686 8811:APPEX
166:=:Tulsa:OK:US Cellular:918 665 0101:GTEDS
167:=:Honolulu:HI:Honolulu Cellular:808 545 4755:APPEX
168:=:Newport News:VA:Contel Cellular:800 792 8400:GTEDS
168:=:Norfolk:VA:Contel Cellular:800 792 8400:GTEDS
169:=:Oklahoma City:OK:Cellular One:405 843 9113:APPEX
170:=:Petersburg:VA:Contel Cellular:800 792 8400:GTEDS
170:=:Richmond:VA:Contel Cellular:800 792 8400:GTEDS
171:=:Gulf of Mexico:XX:Petrocomm:800 257 3876:GTEDS
173:=:Long Branch:NJ:Cellular One:800 227 9222:APPEX
173:=:New Brunswick:NJ:Cellular One:800 227 9222:APPEX
175:=:Brandenton:FL:Cellular One:813 221 1662:APPEX
175:=:Lakeland:FL:Cellular One:813 221 1662:APPEX
175:=:Melbourne:FL:Cellular One:407 258 7100:APPEX
175:=:Orlando:FL:Cellular One:407 425 2355:APPEX
175:=:Sarasota:FL:Cellular One:813 221 1662:APPEX
175:=:Tampa:FL:Cellular One:813 221 1662:APPEX
179:=:Clarksville:TN:Cellular One:615 645 2200:APPEX
179:=:Mt. Juliet:TN:Cellular One:615 269 2273:APPEX
179:=:Nashville:TN:Cellular One:615 269 2273:APPEX
180:=:Colorado Springs:CO:US West Cellular:800 626 6611:GTEDS
181:=:Augusta:GA:Cellular One:404 868 0086:GTEDS
182:=:Columbia:SC:Bell South Mobile:800 351 2400:GTEDS
183:=:Bakersfield:CA:Bakersfield Cellular:805 327 8700:Cell-T
184:=:Corpus Christi:TX:Southwestern Bell Mobile:512 854 5678:GTEDS
185:=:Beaumont:TX:Cellular One:409 898 8000:Cell-T
186:=:Davenport:IA:Contel Cellular:800 792 8400:GTEDS
186:=:Bettendorf:IA:Contel Cellular:800 792 8400:GTEDS
186:=:Rock Island:IL:Contel Cellular:800 792 8400:GTEDS
186:=:Moline:IL:Contel Cellular:800 792 8400:GTEDS
188:=:Lansing:MI:Century Cellunet:517 393 0311:GTEDS
189:=:Columbia:SC:Metro Mobile:803 731 8300:APPEX
190:=:Evansville:IN:Contel Cellular:800 792 8400:GTEDS
190:=:Henderson:KY:Contel Cellular:800 792 8400:GTEDS
190:=:Owensboro:KY:Contel Cellular:800 792 8400:GTEDS
191:=:Corpus Christi:TX:Cellular One:512 937 8243:APPEX
193:=:Davenport:IA:Cellular One:319 388 8000:GTEDS
193:=:Bettendorf:IA:Cellular One:319 388 8000:GTEDS
193:=:Rock Island:IL:Cellular One:319 388 8000:GTEDS
193:=:Moline:IL:Cellular One:319 388 8000:GTEDS
194:=:Gulf of Mexico:XX:Coastel Cellular:800 822 8400:GTEDS
195:=:Des Moines:IA:Cellular One:515 223 6611:GTEDS
197:=:Evansville:IN:Cellular One:812 464 5111:GTEDS
198:=:Huntsville:AL:Bell South Mobile:800 351 2400:GTEDS
199:=:Ft. Wayne:IN:Cellular One:219 484 2500:CBIS
203:=:Huntsville:AL:Cellular One:205 830 6633:APPEX
204:=:Albany:GA:Alltel Mobile:912 888 8200:GTEDS
206:=:Georgetown:KY:Bell South Mobile:800 351 2400:GTEDS
206:=:Lexington:KY:Bell South Mobile:800 351 2400:GTEDS
208:=:Little Rock:AR:Alltel Mobile:501 666 6688:GTEDS
211:=:Las Vegas:NV:Cellular One:702 732 2240:APPEX
212:=:Alexandria:LA:US Cellular:318 445 2065:GTEDS
213:=:Lexington:KY:Cellular One:606 223 3700:APPEX
214:=:Peoria:IL:Centel Cellular:309 693 3800:GTEDS
215:=:Little Rock:AR:Cellular One:501 225 2355:APPEX
215:=:Pine Bluff:AR:Cellular One:501 221 1771:APPEX
216:=:Saginaw:MI:Century Cellunet:517 792 1556:GTEDS
217:30039:Appleton:WI:Cellular One:414 738 0110:APPEX
217:30041:Beloit:WI:Cellular One:608 751 2273:APPEX
217:30031:Green Bay:WI:Cellular One:414 496 2273:APPEX
217:30041:Janesville:WI:Cellular One:608 751 2273:APPEX
217:30035:Kenosha:WI:Cellular One:414 652 2022:APPEX
217:=:Madison:WI:Cellular One:608 271 2273:APPEX
217:=:Oshkosh:WI:Cellular One:414 738 0110:APPEX
217:30037:Racine:WI:Cellular One:414 939 2273:APPEX
217:30033:Rockford:IL:Cellular One:815 494 2273:APPEX
220:=:Shreveport:LA:Century Cellunet:318 687 8502:GTEDS
221:=:Peoria:IL:US Cellular:309 685 1234:GTEDS
222:=:Spokane:WA:US West Cellular:800 626 6611:GTEDS
224:=:Modesto:CA:Pactel Cellular:916 520 0645:GTEDS
224:=:Stockton:CA:Pactel Cellular:916 520 0645:GTEDS
226:=:Rome:NY:Avantage Cellular:315 797 2041:GTEDS
226:=:Utica:NY:Avantage Cellular:315 797 2041:GTEDS
228:=:Bakersfield:CA:Contel Cellular:800 792 8400:GTEDS
229:=:Longview:TX:Cellular One:318 636 9888:APPEX
229:=:Marshall:TX:Cellular One:318 636 9888:APPEX
229:=:Shreveport:LA:Cellular One:318 636 9888:APPEX
229:=:Texarkana:TX:Cellular One:318 636 9888:APPEX
231:=:Spokane:WA:Cellular One:509 838 2273:APPEX
233:=:Modesto:CA:Cellular One:209 572 1004:APPEX
233:=:Stockton:CA:Cellular One:209 476 1500:APPEX
235:=:Rome:NY:Cellular One:315 768 4400:Cell-T
235:=:Utica:NY:Cellular One:315 768 4400:Cell-T
240:=:Appleton:WI:Cellulink:414 735 9707:GTEDS
240:=:Oshkosh:WI:Cellulink:414 735 9797:GTEDS
241:=:Albany:GA:Cellular One:912 888 8228:APPEX
244:=:Grand Rapids:MI:Century Cellunet:616 940 0985:GTEDS
246:=:Asheville:NC:US Cellular:704 258 0000:GTEDS
247:=:Altoona:PA:Cellular One:814 946 4535:GTEDS
249:=:Amarillo:TX:Cellular One:806 374 1900:Cell-T
250:=:Atlantic City:NJ:Bell Atlantic Mobile:800 922 0204:GTEDS
250:=:Vineland:NJ:Bell Atlantic Mobile:800 922 0204:GTEDS
251:=:Anchorage:AK:Cellular One:907 561 1122:APPEX
255:=:Anniston:AL:Cellular One:205 942 2355:Cell-T
256:=:Battle Creek:MI:Century Cellunet:616 342 6655:GTEDS
258:=:Bellingham:WA:US West Cellular:800 626 6611:GTEDS
260:=:Benton Harbor:MI:Century Cellunet:616 342 6655:GTEDS
264:=:Gulfport:MS:Cellular South::GTEDS
266:=:Binghamton:NY:Contel Cellular:800 792 8400:GTEDS
266:=:Elmira:NY:Contel Cellular:800 792 8400:GTEDS
267:=:Atlantic City:NJ:Cellular One::APPEX
268:=:Bismark:ND:US West Cellular:800 626 6611:GTEDS
269:=:Asheville:NC:Cellular One::Cell-T
271:=:Bangor:ME:US Cellular:207 942 0700:GTEDS
272:=:Boise:ID:US West Cellular:800 626 6611:GTEDS
276:=:Bremerton:WA:Cellular One:800 626 6611:GTEDS
277:=:Benton Harbor:MI:Cellular One:616 982 9900:Cincin
278:=:Brownsville:TX:Southwestern Bell Mobile:512 541 6200:GTEDS
278:=:Harlingen:TX:Southwestern Bell Mobile:512 428 6200:GTEDS
278:=:McAllen:TX:Southwestern Bell Mobile:512 380 6200:GTEDS
279:=:Billings:MT:Cellular One:406 652 0466:GTEDS
281:=:Biloxi:MS:Cellular One::GTEDS
283:30007:Binghamton:NY:Cellular One:607 771 8000:APPEX
283:30009:Elmira:NY:Cellular One:607 737 1000:APPEX
284:=:Casper:WY:US West Cellular:800 626 6611:GTEDS
285:=:Bismark:ND:Cellular One:701 224 1616:GTEDS
286:=:Cedar Rapids:IA:Centel Cellular:319 366 5700:GTEDS
286:=:Iowa City:IA:Centel Cellular:319 366 5700:GTEDS
287:=:Bloomington:IN:Cellular One:502 528 2355:APPEX
289:=:Boise:ID:Cellular One:208 345 2355:GTEDS
292:=:Charlottesville:VA:Centel Cellular:804 973 9100:GTEDS
294:=:Chico:CA:Pactel Cellular:916 920 0645:GTEDS
294:=:Redding:CA:Pactel Cellular:916 920 0645:GTEDS
297:=:Bryan:TX:Cellular One:409 696 2264:APPEX
297:=:College Station:TX:Cellular One:512 338 6777:GTEDS
298:=:Columbia:MO:US Cellular:314 474 0400:GTEDS
299:=:Burlington:NC:Gencell:800 888 7868:GTEDS
300:=:Burlington:VT:Contel Cellular:800 792 8400:GTEDS
301:=:Casper:WY:Cellular One:307 235 0110:GTEDS
302:=:Columbus:GA:Public Service Cellular:912 841 4117:GTEDS
303:=:Cedar Rapids:IA:US Cellular:319 365 1000:GTEDS
304:=:Cumberland:MD:Gencell:800 888 7868:GTEDS
306:=:Danville:VA:Centel Cellular:804 791 3100:GTEDS
307:=:Charleston:WV:Cellular One:304 345 2355:GTEDS
307:30047:Huntington:WV:Cellular One:304 345 2355:GTEDS
308:=:Daytona Beach:FL:Bell South Mobile:305 577 4975:GTEDS
308:=:New Smyrna:FL:Bell South Mobile:800 351 2400:GTEDS
312:=:Dothan:AL:Graceba Cellular:205 793 9148:GTEDS
314:=:Dubuque:IA:Centel Cellular:319 580 0010:GTEDS
316:=:Duluth:MN:US West Cellular:800 626 6611:GTEDS
318:=:Eau Claire:WI:Cellulink:715 835 7370:GTEDS
319:=:Columbus:GA:Cellular One:404 596 9041:APPEX
321:=:Cumberland:MD:Cellular One:814 946 4535:GTEDS
323:=:Danville:VA:Cellular One:804 791 3453:GTEDS
324:=:Enid:OK:Enid Cellular:405 375 4111:GTEDS
325:=:Daytona Beach:FL:Cellular One:904 257 2355:APPEX
328:=:Eugene:OR:US West Cellular:800 626 6611:GTEDS
329:=:Dothan:AL:Cellular One:205 671 4111:Cell-T
330:=:Fargo:ND:US West Cellular:800 626 6611:GTEDS
331:=:Dubuque:IA:US Cellular::GTEDS
333:=:Duluth:MN:Cellular One:218 727 4700:GTEDS
334:=:Muscle Shoals:LA:Shoals Cellular:205 383 5111:GTEDS
336:=:Ft. Collins:CO:US West Cellular:800 626 6611:GTEDS
336:=:Loveland:CO:US West Cellular:800 626 6611:GTEDS
340:=:Ft. Pierce:FL:US Cellular:305 287 7888:GTEDS
342:=:Fayetteville:AR:Contel Cellular:800 792 8400:GTEDS
342:=:Ft. Smith:AR:Contel Cellular:800 792 8400:GTEDS
342:=:Rogers:AR:Contel Cellular:800 792 8400:GTEDS
343:=:Erie:PA:Cellular One:814 881 0100:APPEX
344:=:Ft. Walton Beach:FL:Centel Cellular:904 664 2000:GTEDS
348:=:Gainesville:FL:Alltel Cellular:904 374 8500:GTEDS
348:=:Ocala:FL:Alltel Mobile:904 237 1100:GTEDS
349:=:Fayetteville:NC:Cellular One:919 483 1181:GTEDS
350:=:Florence:SC:Bell South Mobile:800 351 2400:GTEDS
355:=:Ft. Meyers:FL:Cellular One:813 936 4534:APPEX
356:=:Grand Forks:ND:US West Cellular:800 626 6611:GTEDS
357:=:Ft. Pierce:FL:Cellular One:407 833 1111:APPEX
358:=:Great Falls:MT:US West Cellular:800 626 6611:GTEDS
359:=:Ft. Smith:AR:Cellular One:501 783 4600:GTEDS
360:=:Greely:CO:US West Cellular:800 626 6611:GTEDS
361:=:Ft. Walton Beach:FL:Cellular One:904 433 7300:GTEDS
361:30021:Pensacola:FL:Cellular One:904 433 7300:GTEDS
362:=:Green Bay:WI:Cellcom:414 494 2355:GTEDS
364:=:Hagerstown:MD:Bell Atlantic Mobile:800 922 0204:GTEDS
365:=:Gainesville:FL:Centel Cellular:904 374 8100:GTEDS
368:=:Hickory:NC:Centel Cellular:704 327 4000:GTEDS
370:=:Houma:LA:Mobiletel:504 798 7894:GTEDS
370:=:Thibodaux:LA:Mobiletel:504 798 7894:GTEDS
370:=:Larose:LA:Mobiletel:504 798 7894:GTEDS
370:=:Leeville:LA:Mobiletel:504 798 7894:GTEDS
373:=:Great Falls:MT:Cellular One:406 727 2355:GTEDS
374:=:Jackson:MI:Century Cellunet:517 393 0311:GTEDS
376:=:Jacksonville:NC:Centel Cellular:919 833 7494:GTEDS
377:=:Florence:SC:Cellular One:803 664 2898:GTEDS
381:=:Hagerstown:MD:Cellular One:301 331 2355:GTEDS
384:=:Joplin:MO:US Cellular:417 624 2255:GTEDS
385:=:Hickory:NC:Cellcom:704 322 7557:APPEX
386:=:Kalamazoo:MI:Century Cellunet:616 342 6655:GTEDS
387:=:Houma:LA:Cellular One:504 686 0220:GTEDS
387:=:Thibodaux:LA:Cellular One:504 686 0220:GTEDS
389:=:Iowa City:IA:Allcell Cellular:319 351 5888:CBIS
392:=:Killeen:TX:Centel Cellular:817 771 0077:GTEDS
392:=:Temple:TX:Centel Cellular:817 771 0077:GTEDS
393:=:Jacksonville:NC:Cellular One:919 455 9300:C-Tech
396:=:La Crosse:WI:Century Cellunet:608 788 8000:GTEDS
400:=:Lake Charles:LA:Mercury Cellular:318 433 6298:Lake Charles
401:=:Joplin:MO:Cellular One:417 862 6611:APPEX
402:=:Laredo:TX:Laredo Cellular:512 722 2333:GTEDS
403:=:Kalamazoo:MI:Cellular One:616 388 8066:CBIS
408:=:Lawton:OK:US Cellular:405 355 3535:GTEDS
409:=:Killeen:TX:Cellular One:817 526 6800:APPEX
409:=:Temple:TX:Cellular One:817 526 6800:APPEX
412:=:Lima:OH:Centel Cellular:419 893 1077:GTEDS
413:=:La Crosse:WI:US Cellular:608 781 2600:GTEDS
414:=:Lafayette:LA:Bell South Mobile:305 577 4975:GTEDS
415:=:Lafayette:IN:McCaw Cellular:502 582 2273:GTEDS
416:=:Lincoln:NE:Lincoln Telephone Cellular:402 486 7266:GTEDS
417:=:Lake Charles:LA:Celltelco:318 279 6532:GTEDS
418:=:Longview:TX:Centel Cellular:214 561 5575:GTEDS
418:=:Marshall:TX:Centel Cellular:214 561 5575:GTEDS
418:=:Tyler:TX:Centel Cellular:214 561 5575:GTEDS
422:=:Abilene:TX:Southwestern Bell Mobile:915 698 7626:GTEDS
422:=:Amarillo:TX:Southwestern Bell Mobile:806 353 7447:GTEDS
422:=:Lubbock:TX:Southwestern Bell Mobile:806 791 0011:GTEDS
422:=:Midland:TX:Southwestern Bell Mobile:915 563 4611:GTEDS
422:=:Odessa:TX:Southwestern Bell Mobile:915 563 4611:GTEDS
424:=:Lynchburg:VA:Centel Cellular:804 528 3500:GTEDS
426:=:Macon:GA:Bell South Mobile:800 351 2400:GTEDS
427:=:Auburn:ME:US Cellular:207 782 8010:GTEDS
427:=:Lewiston:ME:US Cellular:207 782 8010:GTEDS
428:=:Manchester:NH:Contel Cellular:800 792 8400:GTEDS
428:=:Nashua:NH:Contel Cellular:800 792 8400:GTEDS
430:=:Mansfield:OH:Centel Cellular:419 893 1077:GTEDS
431:=:Lafayette:LA:Cellular One:318 984 1777:APPEX
436:=:Medford:OR:US Cellular::GTEDS
439:=:Lubbock:TX:Cellular One:806 797 2355:GTEDS
440:=:Monroe:LA:Century Cellunet:318 325 3600:GTEDS
443:=:Macon:GA:Cellular One:912 742 2355:GTEDS
443:=:Warner Robins:GA:Cellular One::GTEDS
444:=:Montgomery:AL:Alltel Mobile:800 255 8351:GTEDS
445:=:Manchester:NH:US Cellular:603 624 8000:GTEDS
447:=:Mansfield:OH:Cellular One:419 564 5000:Commonwealth
448:=:Muskegon:WI:Century Cellunet:616 940 0985:GTEDS
451:=:Jackson:MS:Cellular One:512 686 2355:Cell-T
451:=:McAllen:TX:Cellular One:512 686 2355:Cell-T
456:=:Olympia:WA:US West Cellular:800 626 6611:GTEDS
462:=:Palm Springs:FL:Centel Cellular:904 785 7000:GTEDS
462:=:Panama City:FL:Centel Cellular:904 785 7000:GTEDS
465:=:Montgomery:AL:Montgomery Cellular:205 265 2355:GTEDS
467:=:Muncie:IN:Cellular One:502 582 2355:APPEX
473:=:Ocala:FL:Cellular One:407 425 2355:GTEDS
475:=:Odessa:TX:Cellular One:806 797 2355:GTEDS
476:=:Melbourne:FL:Bell South Mobile:800 351 2400:GTEDS
478:30018:Pine Bluff:AK:Pine Bluff Cellular:501 536 4200:GTEDS
479:=:Orange County:NY:Cellular One:914 564 4447:GTEDS
480:=:Pittsfield:NY:Nynex Mobile Com::Nynex
481:=:Owensboro:KY:US Cellular:502 685 5111:GTEDS
483:=:Palm Springs:FL:Palmer Comm:904 769 2269:GTEDS
484:=:Biddeford:ME:Star Cellular:800 346 9172:GTEDS
484:=:Dover:NH:Star Cellular:800 346 9172:GTEDS
484:=:Portsmouth:NH:Star Cellular:800 346 9172:GTEDS
484:=:Saco:ME:Star Cellular:800 346 9172:GTEDS
486:=:Orange County:NY:Nynex Mobile Com::Nynex
486:=:Poughkeepsie:NY:Nynex Mobile Com::Nynex
488:=:Provo:UT:US West Cellular:800 626 6611:GTEDS
494:=:Rapid City:SD:Contel Cellular:800 792 8400:GTEDS
498:=:Reno:NV:Pactel Cellular:916 920 0645:GTEDS
499:=:Portland:ME:Cellular One:207 772 9805:GTEDS
500:=:Richland:WA:US Cellular::GTEDS
501:=:Portsmouth:NH:Cellular One:617 890 1555:(Boston)
502:=:Roanke:VA:Contel Cellular:800 792 8400:GTEDS
503:=:Poughkeepsie:NY:US Cellular:914 297 3444:GTEDS
504:=:Rochester:MN:US Cellular:507 388 3000:GTEDS
506:=:Rockford:IL:Contel Cellular:800 792 8400:GTEDS
510:=:San Angelo:TX:West Central Cellular:915 944 9016:GTEDS
511:=:Rapid City:SD:Cellular One::GTEDS
513:=:Redding:CA:Cellular One:916 923 2222:APPEX
515:=:Reno:NV:Cellular One:702 322 5511:APPEX
519:=:Roanke:VA:Cellular One:703 345 0808:Cell-T
520:=:Savannah:GA:Savannah Cellular:912 356 5224:GTEDS
521:=:Rochester:MN:Cellular One:507 254 2273:APPEX
527:=:Monterey:CA:Cellular One:408 754 8888:APPEX
527:=:Salinas:CA:Cellular One:408 647 8888:APPEX
530:=:Elkhart:IN:Centel Cellular:219 288 2355:GTEDS
530:=:South Bend:IN:Centel Cellular:219 288 2355:GTEDS
531:=:Santa Barbara:CA:Santa Barbara Cellular:800 722 7464:Cell-T
534:=:St. Cloud:MN:US Cellular:612 252 9000:GTEDS
539:=:Savannah:GA:Cellular One:912 352 3456:GTEDS
540:=:Sioux Falls:SD:US West Cellular:800 626 6611:GTEDS
544:=:Talahassee:FL:Centel Cellular:904 668 2200:GTEDS
545:=:Denison:TX:Metrocell Cellular:214 263 4921:APPEX
545:=:Sherman:TX:Metrocell Cellular:214 263 4921:APPEX
546:=:Springfield:MO:Alltel Mobile:417 882 2020:GTEDS
547:=:Sioux City:IA:Centel Cellular:712 274 2494:
549:=:South Bend:IN:Cellular One:219 289 0933:Micro-T
550:=:Texarkana:TX:Century Cellunet:214 793 0500:GTEDS
551:30045:Bloomington:IL:Cellular One:217 744 3000:APPEX
551:30005:Champaign:IL:Cellular One:217 744 3000:APPEX
551:30003:Decatur:IL:Cellular One:217 744 3000:APPEX
551:30001:Springfield:IL:Cellular One:217 744 3000:APPEX
551:30005:Urbana:IL:Cellular One:217 744 3000:APPEX
555:=:Sioux Falls:SD:Cellular One:605 336 0520:Cell-T
557:=:St. Joseph:MO:Cellular One:816 232 6158:APPEX
561:30019:State College:PA:Cellular One:717 579 2355:GTEDS
562:=:Victoria:TX:GTE Mobile:800 347 5665:GTEDS
565:=:Talahassee:FL:Cellular One:904 386 8999:APPEX
566:=:Waco:TX:Centel Cellular:817 771 0077:GTEDS
567:=:Terre Haute:IN:Cellular One:502 582 2355:APPEX
568:=:Waterloo:IA:Centel Cellular:319 236 0400:GTEDS
570:=:Wausau:WI:US Cellular:715 842 4200:GTEDS
574:=:Wichita Falls:TX:US Cellular:817 696 5500:GTEDS
575:=:Trenton:NJ:Cellular One:800 227 9222:APPEX
576:=:Williamsport:PA:US Cellular:707 321 9500:GTEDS
577:30027:Tuscaloosa:AL:Cellular One:205 942 2355:APPEX
578:=:Wilmington:NC:Centel Cellular:919 833 7494:GTEDS
579:=:Tyler:TX:Cellular One:214 561 2355:GTEDS
580:=:Yakima:WA:US Cellular:509 248 3000:GTEDS
581:=:Victoria:TX:Cellular One:512 573 1100:Cell-T
583:=:Vineland:NJ:Cellular One:609 272 0900:GTEDS
587:=:Waco:TX:Cellular One:817 776 3933:APPEX
589:=:Waterloo:IA:Cellular One:319 234 4000:GTEDS
591:=:Wausau:WI:Cellular One:715 842 7900:GTEDS
595:=:Wichita Falls:TX:Cellular One:817 691 9100:Cell-T
599:=:Wilmington:NC:Cellular One:919 799 5000:GTEDS
601:=:Yakima:WA:Cellular One:509 454 2663:APPEX
607:=:Fayetteville:AR:Cellular One:501 783 4600:Cell-T
1161:=:Hawaii:HI:US Cellular::GTEDS
1177:=:Lasalle:IL:Cellular One:815 224 4470:GTEDS
1216:=:Batavia:IA:US Cellular:515 662 7000:GTEDS
1704:=:Gainesville:TX:Southwestern Bell Mobile:214 988 8484:GTEDS
1774:=:North Sound:WA:US West:800 238 7848:GTEDS
1784:=:Longview:WA:US Cellular::GTEDS
16384:=:Calgary:AB:AGT Cellular:403 248 2355:GTEDS
16384:=:Lethbridge:AB:AGT Cellular:403 248 2355:GTEDS
16384:=:Medicine Hat:AB:AGT Cellular:403 248 2355:GTEDS
16387:=:Calgary:AB:Cantel, Inc.:403 266 1300:GTEDS
16389:=:Chicoutimi:QU:Cantel, Inc.:514 340 9220:GTEDS
16390:=:Amherst:NS:MT&T Cellular:902 421 2355:GTEDS
16390:=:Bridgewater:NS:MT&T Cellular:902 421 2355:GTEDS
16390:=:Chester:NS:MT&T Cellular:902 421 2355:GTEDS
16390:=:Halifax:NS:MT&T Cellular:902 421 2355:GTEDS
16390:=:Hantsport:NS:MT&T Cellular:902 421 2355:GTEDS
16390:=:Kentville:NS:MT&T Cellular:902 421 2355:GTEDS
16390:=:Moncton:NB:MT&T Cellular:902 421 2355:GTEDS
16390:=:Sydney:NS:MT&T Cellular:902 421 2355:GTEDS
16390:=:Truro:NS:MT&T Cellular:902 421 2355:GTEDS
16390:=:Windsor:NS:MT&T Cellular:902 421 2355:GTEDS
16391:=:Edmonton:AB:Cantel, Inc.:416 440 1300:GTEDS
16393:=:Halifax:NS:Cantel, Inc.:416 440 1300:GTEDS
16395:=:Hamilton:ON:Cantel, Inc.:416 440 1300:GTEDS
16397:=:Hespler:ON:Cantel, Inc.:416 440 1300:GTEDS
16397:=:Kitchener:ON:Cantel, Inc.:416 440 1300:GTEDS
16399:=:London:ON:Cantel, Inc.:416 440 1300:GTEDS
16401:=:Montreal:QU:Cantel, Inc.:514 340 9220:GTEDS
16403:=:Oshawa:ON:Cantel, Inc.:416 440 1300:GTEDS
16405:=:Ottawa:ON:Cantel, Inc.:514 340 9220:GTEDS
16407:=:Quebec City:QU:Cantel, Inc.:514 340 9220:GTEDS
16408:=:Bathurst:NB:MT&T Cellular::GTEDS
16408:=:Newcastle:NB:MT&T Cellular::GTEDS
16409:=:Regina:SK:Cantel, Inc.:403 266 1300:GTEDS
16411:=:St. John:NB:Cantel, Inc.:416 440 1300:GTEDS
16413:=:Saskatoon:SK:Cantel, Inc.:403 266 1300:GTEDS
16415:=:St. Catharines:ON:Cantel, Inc.:416 440 1300:GTEDS
16419:=:Sudbury:ON:Cantel, Inc.:416 440 1300:GTEDS
16423:=:Newmarket:ON:Cantel, Inc.:416 440 1300:GTEDS
16423:=:Toronto:ON:Cantel, Inc.:416::GTEDS
16425:=:Abbotsford:BC:Cantel, Inc.:604 687 1440:GTEDS
16427:=:Vancouver:BC:Cantel, Inc.:604 687 1440:GTEDS
16428:=:Winnipeg:MB:MTS Cellular:204 941 7910:GTEDS
16431:=:Windsor:ON:Cantel, Inc.:416 440 1300:GTEDS
16431:=:Winnipeg:MB:Cantel, Inc.:403 266 1300:GTEDS
16433:=:Trois Rivieres:QU:Cantel, Inc.:416 440 1300:GTEDS
16435:=:Barrie:ON:Cantel, Inc.:416 440 1300:GTEDS
16437:=:Brantford:ON:Cantel, Inc.:416 440 1300:GTEDS
16439:=:Sherbrooke:QU:Cantel, Inc.:514 340 9220:GTEDS
16441:=:Peterborough:ON:Cantel, Inc.:416 440 1300:GTEDS
16443:=:Kingston:ON:Cantel, Inc.:416 440 1300:GTEDS
16445:=:Red Deer:AB:Cantel, Inc.:403 266 1300:GTEDS
16447:=:Nanaimo:BC:Cantel, Inc.:604 687 1440:GTEDS
16449:=:Belleville:ON:Cantel, Inc.:416 440 1300:GTEDS
16451:=:Cornwall:ON:Cantel, Inc.:514 340 9220:GTEDS
16453:=:Portage:AB:Cantel, Inc.:403 266 1300:GTEDS
16455:=:Selkirk:AB:Cantel, Inc.:403 266 1300:GTEDS
16457:=:Chatham:ON:Cantel, Inc.:416 440 1300:GTEDS
16459:=:Sarnia:ON:Cantel, Inc.:416 440 1300:GTEDS
16461:=:Chiliwack:BC:Cantel, Inc.:604 687 1440:GTEDS
16463:=:Whistler:BC:Cantel, Inc.:604 687 1440:GTEDS
16465:=:Steinbach:MB:Cantel, Inc.:403 266 1300:GTEDS
16467:=:Moncton:NB:Cantel, Inc.:416 440 1300:GTEDS
16469:=:Fredericton:NB:Cantel, Inc.::GTEDS
16471:=:Brandon:MB:Cantel, Inc.:403 266 1300:GTEDS
16473:=:Lethbridge:AB:Cantel, Inc.:403 266 1300:GTEDS
16475:=:Truro:NS:Cantel, Inc.:416 440 1300:GTEDS
16477:=:Collingwood:ON:Cantel, Inc.::GTEDS
16481:=:St. Marie:QU:Cantel, Inc.:514 340 9220:GTEDS
16485:=:Coburg:ON:Cantel, Inc.:415 440 1300:GTEDS
16485:=:Newtonville:ON:Cantel, Inc.:415 440 1300:GTEDS
16487:=:Brockville:QU:Cantel, Inc.:514 340 9220:GTEDS
16491:=:Ponoka:AB:Cantel, Inc.:604 687 1440:GTEDS
16493:=:Bowden:QU:Cantel, Inc.:604 687 1440:GTEDS
16509:=:Orillia:ON:Cantel, Inc.:416 440 1300:GTEDS
16521:=:Kelowna:BC:Cantel, Inc.::GTEDS
16525:=:Penticton:BC:Cantel, Inc.::GTEDS
16527:=:Kamloops:BC:Cantel, Inc.::GTEDS
16531:=:Canmore:ON:Cantel, Inc.::GTEDS
32752:=:Nassau:BH:Batelco:809 322 4848:GTEDS
!EOF!
exit 0
-------------------- Cut Here ----------------------
phreak/CELLULAR/cellcomp.phk
+269
View File
@@ -0,0 +1,269 @@
The following file is a verbatim transcript of an article by the same name appearing in the
November, 1992 issue of NUTS & VOLTS Magazine. Copyright (c) 1992 Damien Thorn and
T & L Publications. Permission is granted to freely distribute this file in unmodified form.
Identifying board headers may be added as desired.
A CELLULAR COMMUNICATIONS PRIMER
By Damien Thorn
INTRODUCTION
The specific technologies involved in the cellular network are highly complex, comprised of a
vast array of computers, control equipment, transceivers, multiplexers, switching equipment, etc.
The theory and principals of operation which we'll cover here are much easier to comprehend.
With this article you'll learn the basics, and how you can profit from that understanding. Next
month I'll show you how to reprogram a cellular phone through the keypad.
Cellular telephones are viewed by most users as simply another phone, albeit cordless. A cellular
mobile telephone (CMT) emulates a landline set so credibly that the deepest technical concern
for most people is remembering how to make the phone dial a frequently called number stored
in memory. The comfort and familiarity of the phones are by design, I'm sure. To a public that
has difficulty programming a VCR, the reality of cellular technology would be overwhelming and
perhaps somewhat frightening.
Cellular phones are little more than low power transceivers capable of transmitting and receiving
a total of 666 or 832 frequencies, depending on the model. They operate in a full-duplex mode,
transmitting the mobile side of the conversation on one frequency while simultaneously receiving
the other side from the cell site on a different frequency. A basic multi-channel two-way radio
under the control of some powerful software. The network itself is where the engineering genius
becomes apparent.
OVERVIEW OF NETWORK ARCHITECTURE
The cellular network consists of a honeycomb of transceiver sites (towers), each capable of
handling up to about 40 separate cellular calls. Each site has an effective range of 3-5 miles.
The term "cell" is derived from the size and shape of the site's coverage pattern, and the
arrangement of the cell sites. The various sites in each city are all linked together through the
mobile telephone switching office (MTSO). The MTSO not only coordinates the use of the radio
spectrum, but utilizes computers to authenticate a subscriber's phone before making the
connection and maintains billing records. The MTSO also serves as the interface point with the
landline telephone company for cellular calls.
As you drive through town the MTSO monitors the relative signal strength of the transmission
from your phone. When the signal strength becomes higher in any cell other than the one
handling your call, the MTSO uses a frequency known as a control channel to transmit data to
your phone telling it to switch frequencies and lock into another cell. This "hand off" from one
cell to another happens so quickly that most people never notice the transition from one
frequency or cell site to the next. This is noteworthy because the hand off required your phone
to change transmit and receive frequencies, while the cellular network not only reestablished
radio contact with you on another transceiver, but rerouted the landline audio to that cell site as
well.
The cell site is generally located in the center of the cell. This is where the antennas,
transceivers and control equipment are located that serve that cell. Due to the limited coverage
area of the cell, these cell sites are located a maximum of ten miles from each other to provide
uninterrupted coverage without "dead spots" - areas where your phone cannot operate because
you're out of range of a cell.
Since most markets are served by two cellular service providers who do not share cell sites, there
are actually twice as many cells (and cell sites) than would be required for one provider to supply
service. In the past I've worked at radio station transmitter sites that leased tower space to
cellular companies, but I never realized how prolific these cell sites were until I studied the
technology and looked closely at the antennas around me. Where ever your phone works, you're
within three to five (line of sight) miles of a at least two sites, and probably more since coverage
areas overlap. The adjacent cells never share common frequencies to avoid interference.
Cellular sites come in different forms. In congested metropolitan areas the transceiver sites may
be located on taller buildings. In other areas they are located on stand alone towers. Towers can
either be built by the cellular carrier for their exclusive use, or the cellular antenna array can
share a common tower (an "antenna farm") with other radio and broadcast services.
No matter where the antennas are located, they can be recognized easily by their unique three-
sided configuration. Refer to the accompanying photos for examples of two common types of
cellular arrays. When I asked both cellular carriers based in Sacramento to disclose the location
of their cell sites in my area, they refused. The customer relations representatives indicated the
information was confidential - almost a trade secret. I left voice mail messages with their
engineers describing the information I wanted. Neither even returned my call.
The implications of this guarded attitude are interesting, and more than a bit disconcerting.
Fortunately the FCC maintains public records on all transmitter licensees, and the California
Public Utilities Commission (CPUC) requires cellular companies to file abstracts with them
containing the information I wanted. The CPUC even told me the name of the person who
would be available to help me dig through the abstracts and make photocopies. I didn't bother,
but it was nice to see my tax dollars at work for my benefit.
OPERATING FREQUENCIES
The frequency spectrum allocated by the FCC used by the phone to transmit voice and data to
the cell site is 824.000 - 849.000 Mhz. The tower transmits to the phone on a spectrum of the
same size from 869.000 to 894.000 Mhz. The cellular frequencies are narrow band FM, all
spaced 30 Khz apart, so determining every specific frequency is a matter of simple addition.
For example, knowing the lowest frequency used by a cell site is 869.000 Mhz, simply increment
upward in 30 Khz steps: 869.030, 869.060, 869.090, 869.120, etc. The frequencies used by the
phone for transmission to the tower increment upward the same way from 824.000 Mhz.
The frequencies are paired so that the phone is always transmitting to the tower on a frequency
exactly 45 Mhz lower than the frequency the tower is using. If the landline (base) side of the
call is transmitted to the phone on 887.940 Mhz, then the phone is simultaneously transmitting
the mobile side of the call back to the cell site on 842.940 Mhz.
Cell sites generally transmit the mobile side of the call at reduced gain back to the cellular phone
along with the audio from the landline side of the call. This can be intentional, as in the "side
tone" present in a standard landline telephone receiver, or the result of poor nulling where the
cellular network interfaces with the Telco lines. This means anyone with a receiver or scanner
capable of tuning the upper frequency in the pair can monitor both sides of the conversation.
It is illegal to do so, however.
CELLULAR COMMUNICATIONS PRIVACY
To calm fears that cellular calls were not private, the cellular industry lobbied congress into
passing legislation known today as the Electronic Communication Privacy Act (ECPA) of 1986
which makes it a crime to monitor cellular phone calls and a host of other transmissions like
digital pagers. This law is used by cellular equipment dealers and service providers to reassure
customers that their conversations will remain private.
A person using a cellular phone is broadcasting his private conversation on airwaves owned by
the general public. These radio signals permeate our homes, bodies, and scanning receivers. Yet
so complete is the cellular transceiver's emulation of an actual telephone that the general public
not only expects privacy, but feels confident that the call is secure. Nobody could possibly be
sitting in the privacy of their living room monitoring the conversation. That would be a Federal
crime.
The ECPA has been described as a "toothless tiger" as it is virtually unenforceable. A growing
number of scanner enthusiasts are monitoring cellular calls rather than the local fire department
because it is much more entertaining. The ECPA is ignored by the public and law enforcement
alike, just like the laws remaining on the books that make it illegal to work on Sunday.
The bottom line is that it is up to you and I to ensure the privacy of our cellular calls. If you
don't want to use a scrambling system, simply don't talk about anything on a cellular phone that
you wouldn't discuss using your rig on the amateur bands.
TELEPHONE CONTROL DATA
With this simplified overview of the cellular network under your belt, let's dig a little deeper into
the data exchanged by the cellular carrier and your phone. Obviously there is more information
being sent by your phone to the cellular company than your conversation. The service provider
needs to identify your physical phone, cellular phone number, etc. This is accomplished via data
transmitted by your phone on a frequency set aside as a "data channel" in each cell every time
you turn it on or use it.
Your phone transmits six pieces of information to the cellular provider. One is the Electronic
Serial Number (ESN) of your phone.
Every cellular phone is assigned an ESN when manufactured. This ESN consists of numerical
data which identify the manufacturer of the phone as well as the actual unique serial number of
the specific phone. The ESN is an eleven digit (decimal) number which has been burned into
a PROM chip permanently installed in the phone. Like the Vehicle ID Number (VIN) on your
car, it is not designed to be removed or modified, although hackers occasionally do in order to
circumvent billing procedures (see sidebar).
One other item transmitted is your Mobile Identification Number (MIN) which is the actual ten
digit area code and telephone number assigned to your phone. The remainder are numerical
codes used by the cell site to identify things like your class of service and the specific
capabilities of your phone hardware. This data is supplied when you activate service with the
carrier.
The ESN and MIN are matched and checked by computer against a database each time you use
the phone to ensure that you are a valid subscriber, or roaming from a system the carrier can bill
for your calls.
All of this information (except the ESN) is provided by the cellular carrier and programmed into
your phone when you subscribed to their service. The vast majority of cellular phones
manufactured today are reprogrammable through the handset. This means that you can change
(reprogram) this information yourself without costly programming devices simply by entering the
proper keystrokes on the telephone handset, and punching in the data.
This knowledge opens up a number of possibilities. If you activate or change your cellular
service, you can program the phone yourself with data supplied by the cellular carrier and save
paying any type of reprogramming fee. If you're looking to acquire equipment, you can canvass
flea markets, swap meets and the pages of classified ad magazines such as Nuts & Volts for great
deals on used phones. Not only will you enjoy savings on the hardware, but you'll only need
to pay the cellular company to activate service, since you can program the phone yourself.
In my article next month in Nuts & Volts I'll explain all the data programmed into a phone,
explain what it means, and lead you step by step through the handset programming of a popular
phone. This information is an important reference for those who may just want to do something
simple like change the unlock code on the phone. We'll also take a look at the publications
available through Nuts & Volts advertisers that explain cellular telephone reprogramming and
modification in depth.
******************************************************************************
BUYING USED CELLULAR GEAR
A FEW CAVEATS
When shopping the classifieds, flea markets and electronics swap meets for great deals on used
cellular telephones, keep the following points in mind to avoid getting "burned."
Cellular phones are a major target of theft in some cities. They appeal to criminals such as drug
dealers because they allow anonymous and virtually untraceable communication from a vehicle
or street corner. The phone is discarded as useless when the service is disconnected, and such
units may unwittingly be resold with other used equipment. There is no real way to discern this
other than to phone your local cellular service provider to see if the phone's ESN is flagged in
their computer as having been stolen.
The other type of phone to avoid is one that has been physically modified. Hackers have been
known to replace the factory PROM chip containing the ESN with a custom burned chip, thus
changing the ESN. If this is done for the purpose of fraudulently making free calls, the ESN
chip must be changed periodically as the cellular carrier discovers the fraud associated with that
ESN.
Detection of this type of modification is easy. Cellular manufacturers as a rule do NOT use a
socket to hold the ESN chip. The PROM is usually not only soldered to the board, but sealed
in epoxy or "air welded" to the circuit board to discourage this type of modification. An IC
socket is usually installed by the hacker to facilitate easy insertion of updated PROM as
necessary.
No reputable service center will repair a phone if it appears someone has tampered with the ESN,
and might call the police if presented with such a phone.
The vast majority of equipment you'll find on the open market is genuine surplus or used
merchandise. With the above information in mind you can examine the phone and be confident
about your decision to make a purchase.
******************************************************************************
AUTHOR BIOGRAPHY
(For publication)
Damien Thorn's interest in electronics has deep roots. A noted "hacker" and "phone phreak" by
age sixteen, he contributed regularly to the underground newsletter "TAP." Today Damien is
an on-air radio personality and FCC licensed engineer in California's San Joaquin Valley. His
interests include computers, communications, security and privacy issues. He welcomes questions
and comments. You can reach him at 6333 Pacific Ave. #203, Stockton, CA 95207-3713 or via
E-Mail at one of the following: DrDamien@Delphi.com via Internet mail, on CompuServe at
75720,2104, or on Delphi as DrDamien.

phreak/CELLULAR/cellconv.phk
BIN
View File
Binary file not shown.
phreak/CELLULAR/cellfone.txt
+3621
View File
File diff suppressed because it is too large Load Diff
phreak/CELLULAR/cellfrd.txt
+233
View File
@@ -0,0 +1,233 @@
cat cell
Some Articles on Cellular Fraud from the Telecom Digest on the Usenet
Uploaded by Elric of Imrryr (lll-lcc!csustan!elric)
Article #1
Well, although Cellular is "untraceable" in the same way that regular phones
are, it still is not the ideal system to commit toll fraud on.
>From what I understand about how the cellular system works, a new
subscriber is assigned a phone number, and then given a 4 digit code
that is unique to his cellular phone. Thus, the chip that is placed
into a cell phone to identify it may have a # like this:
212-909-1234-5555. The 5555 is the 4 digit ID code, very much like the
PIN number on Bell System Calling Cards.
When you request service, you have to have your number "turned on" at the
Cellular Company. And, like a calling card, the Cell Co. checks to see if the
special ID # matches before it puts the call through (It checks a lot of other
things too, like signal strength and stuff, but that's not important now...).
So in order for someone to make free calls, he has to know an active number,
and then go to the dealer who sold the phone with that number and ask the
dealer what the ID number is. If the dealer is unscrupulous, he will give out
the ID number, and THEN you can make free calls.
However, in no more than a month, if the customer finds that there are a lot
of calls which he did not make, he can call the Cell. Co. and demand that they
remove the calls from his bill. The Cell. Co. will also change the ID number,
and if they are smart will check out the Cellular phone dealer to see if he
gave away the ID code to that specific number.
So what free Cellular service will get you is at best a month's worth of calls,
and that's about it. Also, you will have to go to different dealers all the
time, since if it happened with the same dealer a lot the Cell Co. might
investigate the Cellular phone dealer. Also, you would have to change your
number every month if you wanted people to call you.
Stolen Bell Cards work the same way, although faster. If you steal a Bell
System Calling Card, and you use it a lot, the local Bell Company (or, heaven
forbid, the GTE company if you can
manage to use a calling card there! :-) ) will call the paying customer and
ask "did you make 300 calls today?". Usually, the customer says no, so they
just cancel the card and issue a new PIN number to the customer, usually right
away. (The system to assign PIN numbers is almost instantaneous, it seems. The
minute they assign you a PIN # you can use it!). Assuming the free calls were
made from a payphone, the Bell Co. will still call the destination numbers to
see if anyone knows who called them, in hopes of catching the person. If they
get enough people to say "Sure, I know Mr. so-and-so", then they may go after
the person who stole the card.
The point is that Bell Calling Cards have a built in safety system to
protect against fraud. (The alternates don't have anything quite as
sophisticated...). It would not be very hard to put a similar "excessive use"
system of cellular phones. Thus, if cell fraud becomes pervasive, it should be
a relatively simple manner to end it, and thus Cell Fraud is really not much
better than the standard stuff people do at payphones.
Also, Bell System Calling Cards can be used as frequently as you like. The
normal "warning" occurs if you have more that 30 calls in 3 hours (or is it
36?). However, if you use your Bell Card a lot (like I do), then you can ask
your local Bell Co. to put a little note on your account that you are a heavy
user of the card. That way, if you make more than 30 calls in 3 hours (or
whatever), you don't get the card turned off. This is VERY convenient if you
are away from home and don't want to worry about how many calls you make.
Basically then, the people who designed the Cellular System were smart,
and they made sure you can't cheat it too easily or too long. Seeing how easy
it is for them to stop Calling Card fraud, I see no reason why with the
Cellular system set up the way it is that they can't prevent Cell fraud as
well...
(I'm sure I made a few mistakes there, so any corrections are welcome...)
Well, that's my two cents worth! -
-Doug
REUBEN@WESLYN.BITNET
S.D-REUBEN%KLA.WESLYN%WESLEYAN.BITNET@WISCVM.ARPA
...seismo!weslyn.bitnet!reuben (UUCP)
-------
Article #2
Excuse me...YOU ARE WRONG!
The Electronic Serial Number is an 8 digit Hexidecimal number. It is not
easily changed. Both the MIN, (Mobil Id Number, your phone number) and the
ESN are sent out when you press the send key. Your MIN is easily changed
by reprogramming your phone, but the ESN is not easily changed. To change
your phone number, both the phone, and the cell system must be changed.
Depending on the cell system you are trying to commit fraud on, you may
get several months of free calls, or just one. If you are using one of
the systems that participate in the fraud detection systems in use, (the
name slips my mind at the moment), your service will be cut off after the
first fraudulent call--in all of those systems.
You may have gotten the 5 digit code from the lock feature that comes with
most cell phones these days. This is just a security feature to keep
your phone from being used while it's unattended. It has nothing to do
with the cell system itself. My phone only has a 3 digit security code.
I usually see this security code set to the last n digits of the phone's
phone number.
-Mike
Article #3
The "PIN" on the telephone number is NOT assigned by the Cellular
Phone company, but rather is the serial number of the radio you
are using. Every radio has a unique serial number, supposedly on
a chip that is epoxied onto the radio's PC board. The number is
in the format XX-0-XXXX where X represents hex digits. The first
XX is the manufacturer's code (e.g. for EF Johnson phones it is
83) and the last XXXX is the manufacturer's serial number for your
phone.
The PROM which has your cellular phone number, features, etc., is
removable, of course. The only "security" thing on this PROM
(sometimes called a NAM) is the lock-code for your phone, which of
course can be easily read (the main purpose of the lock-code is to
keep away randoms who might try to use your phone in your car.
When your phone initiates a call it transmits the phone number and
the radio serial number. They must match for the call to go through.
That is why if you change the radio on your phone you (or your dealer)
must call your cellular phone company to tell them about the new
radio.
The weakness in this system is that a thief could get ahold of a
phone without a epoxied serial number (either by building one or by
buying one of the cheapos that don't epoxy the serial number chip in
it) and then change it. I suspect the easiest instance of fraud is
to use an out-of-service-area phone number (e.g. a San Diego phone
number in San Francisco) that has roamer privileges. Generally, the
companies don't have serial number records for roamers (consider the
problems of keeping records of some other company's customers!) and
rely upon hot-listing known bad guys. So you pick a fraudulant
phone number and serial number pair, and change it periodically when
the company finds out it ain't real.
This must be what the drug pushers and similar slime are doing. They
aren't particularly clever, they're relying upon the deregulation
mania of the present US regime to guarantee poor communication between
telephone service providers.
-------
Article #4
If the cellular ID numbers are sent from the car are unencrypted, someone
with the right (underground) connections could make quite a fortune by
building a box that pulls these numbers "out of the air".
Are protocols used by cellular phones published anywhere?
Mike
Article #5
Path: csustan!lll-lcc!ames!ucbcad!ucbvax!TOPAZ.RUTGERS.EDU!ron
From: ron@TOPAZ.RUTGERS.EDU (Ron Natalie)
Newsgroups: comp.dcom.telecom
Subject: Re: Cellular Fraud
Date: 2 Jun 87 15:29:25 GMT
Organization: Rutgers Univ., New Brunswick, N.J.
Lines: 17
> The Electronic Serial Number is an 8 digit Hexidecimal number. It is not
> easily changed. Both the MIN, (Mobil Id Number, your phone number) and the
> ESN are sent out when you press the send key. Your MIN is easily changed
> by reprogramming your phone, but the ESN is not easily changed. To change
Make that, it is not supposed to be easily changed. While the ESN is not
in that NAM (the EPROM with the phone number) in it's nice ZIF socket, many
manufacturers just put it in another ROM which anybody with a small amount
of electronics background can change.
I would expect the most common sort of Cellular fraud involves using
phones from another system through automatic ROAM agreements. Presumably
the ESN/Phone number checking isn't as rigourous or as up-to-date in remote
systems as it is in your home system.
-Ron
Article #6
Path: csustan!lll-lcc!ames!ucbcad!ucbvax!hoptoad.UUCP!gnu
From: gnu@hoptoad.UUCP (John Gilmore)
Subject: Re: Cellular Fraud -- trivial
Date: 4 Jun 87 10:53:18 GMT
Organization: The ARPA Internet
Lines: 32
Approved: telecom@buit1.bu.edu
In article <8705312136.AA01347@mimsy.umd.edu>, mgrant@MIMSY.UMD.EDU (Michael Grant) writes:
> The Electronic Serial Number is an 8 digit Hexidecimal number. It is not
> easily changed. Both the MIN, (Mobil Id Number, your phone number) and the
> ESN are sent out when you press the send key. Your MIN is easily changed
> by reprogramming your phone, but the ESN is not easily changed. To change
> your phone number, both the phone, and the cell system must be changed.
The whole thing is pretty silly. Each unit has a serial number
and the serial number is "supposed to be" impossible to change.
Actually in many systems it is in a PROM in a socket, so no biggy.
Even if it was impossible to change, it's not impossible to change
the ROMs that hold the program that runs the phone, so you could
always reprogram it to ignore the ROM. You could embed the whole
phone in epoxy, but who would buy a $2000 phone that you have to throw
away if any little thing breaks?
The best deal would be to make a program ROM where if you put it in
this mode, it would listen on the control channel for phones making
calls or answering rings, and save away 10 or 20 of their phone number/
serial number pairs. Anytime you wanted to make a call, it would pick
one at random and pretend to be that phone. The load on any
individual's bill would be light enough that you'd be hard to catch.
This would not let you receive calls for free, but I seem to recall
some scheme for that, too. Geoff Goodfellow, Bob Jesse, and Andrew
Lamothe published a paper on this in the November 1985 issue of
Personal Communications Technology magazine (FutureComm Publications
Inc., 4005 Williamsburg Ct., Fairfax, VA 22032, 703/352-1200).
The cellular phone standard is called "EIA IS-3-B" though I think they
recently upgraded it to "-C". You can get a copy from Global Engineering
Documents (call 800 information). It is not lucid but it is readable
if you flip around a lot and think about it.
well? 
phreak/CELLULAR/cellfreq.phk
+866
View File
@@ -0,0 +1,866 @@
Cellular Phone Band A (Channel 1 is Data)
Cell # 1
--------------------------------------------------
Channel 1 (333) Tx 879.990 Rx 834.990
Channel 2 (312) Tx 879.360 Rx 834.360
Channel 3 (291) Tx 878.730 Rx 833.730
Channel 4 (270) Tx 878.100 Rx 833.100
Channel 5 (249) Tx 877.470 Rx 832.470
Channel 6 (228) Tx 876.840 Rx 831.840
Channel 7 (207) Tx 876.210 Rx 831.210
Channel 8 (186) Tx 875.580 Rx 830.580
Channel 9 (165) Tx 874.950 Rx 829.950
Channel 10 (144) Tx 874.320 Rx 829.320
Channel 11 (123) Tx 873.690 Rx 828.690
Channel 12 (102) Tx 873.060 Rx 828.060
Channel 13 (81) Tx 872.430 Rx 827.430
Channel 14 (60) Tx 871.800 Rx 826.800
Channel 15 (39) Tx 871.170 Rx 826.170
Channel 16 (18) Tx 870.540 Rx 825.540
Cell # 2
--------------------------------------------------
Channel 1 (332) Tx 879.960 Rx 834.960
Channel 2 (311) Tx 879.330 Rx 834.330
Channel 3 (290) Tx 878.700 Rx 833.700
Channel 4 (269) Tx 878.070 Rx 833.070
Channel 5 (248) Tx 877.440 Rx 832.440
Channel 6 (227) Tx 876.810 Rx 831.810
Channel 7 (206) Tx 876.180 Rx 831.180
Channel 8 (185) Tx 875.550 Rx 830.550
Channel 9 (164) Tx 874.920 Rx 829.920
Channel 10 (143) Tx 874.290 Rx 829.290
Channel 11 (122) Tx 873.660 Rx 828.660
Channel 12 (101) Tx 873.030 Rx 828.030
Channel 13 (80) Tx 872.400 Rx 827.400
Channel 14 (59) Tx 871.770 Rx 826.770
Channel 15 (38) Tx 871.140 Rx 826.140
Channel 16 (17) Tx 870.510 Rx 825.510
Cell # 3
--------------------------------------------------
Channel 1 (331) Tx 879.930 Rx 834.930
Channel 2 (310) Tx 879.300 Rx 834.300
Channel 3 (289) Tx 878.670 Rx 833.670
Channel 4 (268) Tx 878.040 Rx 833.040
Channel 5 (247) Tx 877.410 Rx 832.410
Channel 6 (226) Tx 876.780 Rx 831.780
Channel 7 (205) Tx 876.150 Rx 831.150
Channel 8 (184) Tx 875.520 Rx 830.520
Channel 9 (163) Tx 874.890 Rx 829.890
Channel 10 (142) Tx 874.260 Rx 829.260
Channel 11 (121) Tx 873.630 Rx 828.630
Channel 12 (100) Tx 873.000 Rx 828.000
Channel 13 (79) Tx 872.370 Rx 827.370
Channel 14 (58) Tx 871.740 Rx 826.740
Channel 15 (37) Tx 871.110 Rx 826.110
Channel 16 (16) Tx 870.480 Rx 825.480
Cell # 4
--------------------------------------------------
Channel 1 (330) Tx 879.900 Rx 834.900
Channel 2 (309) Tx 879.270 Rx 834.270
Channel 3 (288) Tx 878.640 Rx 833.640
Channel 4 (267) Tx 878.010 Rx 833.010
Channel 5 (246) Tx 877.380 Rx 832.380
Channel 6 (225) Tx 876.750 Rx 831.750
Channel 7 (204) Tx 876.120 Rx 831.120
Channel 8 (183) Tx 875.490 Rx 830.490
Channel 9 (162) Tx 874.860 Rx 829.860
Channel 10 (141) Tx 874.230 Rx 829.230
Channel 11 (120) Tx 873.600 Rx 828.600
Channel 12 (99) Tx 872.970 Rx 827.970
Channel 13 (78) Tx 872.340 Rx 827.340
Channel 14 (57) Tx 871.710 Rx 826.710
Channel 15 (36) Tx 871.080 Rx 826.080
Channel 16 (15) Tx 870.450 Rx 825.450
Cell # 5
--------------------------------------------------
Channel 1 (329) Tx 879.870 Rx 834.870
Channel 2 (308) Tx 879.240 Rx 834.240
Channel 3 (287) Tx 878.610 Rx 833.610
Channel 4 (266) Tx 877.980 Rx 832.980
Channel 5 (245) Tx 877.350 Rx 832.350
Channel 6 (224) Tx 876.720 Rx 831.720
Channel 7 (203) Tx 876.090 Rx 831.090
Channel 8 (182) Tx 875.460 Rx 830.460
Channel 9 (161) Tx 874.830 Rx 829.830
Channel 10 (140) Tx 874.200 Rx 829.200
Channel 11 (119) Tx 873.570 Rx 828.570
Channel 12 (98) Tx 872.940 Rx 827.940
Channel 13 (77) Tx 872.310 Rx 827.310
Channel 14 (56) Tx 871.680 Rx 826.680
Channel 15 (35) Tx 871.050 Rx 826.050
Channel 16 (14) Tx 870.420 Rx 825.420
Cell # 6
--------------------------------------------------
Channel 1 (328) Tx 879.840 Rx 834.840
Channel 2 (307) Tx 879.210 Rx 834.210
Channel 3 (286) Tx 878.580 Rx 833.580
Channel 4 (265) Tx 877.950 Rx 832.950
Channel 5 (244) Tx 877.320 Rx 832.320
Channel 6 (223) Tx 876.690 Rx 831.690
Channel 7 (202) Tx 876.060 Rx 831.060
Channel 8 (181) Tx 875.430 Rx 830.430
Channel 9 (160) Tx 874.800 Rx 829.800
Channel 10 (139) Tx 874.170 Rx 829.170
Channel 11 (118) Tx 873.540 Rx 828.540
Channel 12 (97) Tx 872.910 Rx 827.910
Channel 13 (76) Tx 872.280 Rx 827.280
Channel 14 (55) Tx 871.650 Rx 826.650
Channel 15 (34) Tx 871.020 Rx 826.020
Channel 16 (13) Tx 870.390 Rx 825.390
Cell # 7
--------------------------------------------------
Channel 1 (327) Tx 879.810 Rx 834.810
Channel 2 (306) Tx 879.180 Rx 834.180
Channel 3 (285) Tx 878.550 Rx 833.550
Channel 4 (264) Tx 877.920 Rx 832.920
Channel 5 (243) Tx 877.290 Rx 832.290
Channel 6 (222) Tx 876.660 Rx 831.660
Channel 7 (201) Tx 876.030 Rx 831.030
Channel 8 (180) Tx 875.400 Rx 830.400
Channel 9 (159) Tx 874.770 Rx 829.770
Channel 10 (138) Tx 874.140 Rx 829.140
Channel 11 (117) Tx 873.510 Rx 828.510
Channel 12 (96) Tx 872.880 Rx 827.880
Channel 13 (75) Tx 872.250 Rx 827.250
Channel 14 (54) Tx 871.620 Rx 826.620
Channel 15 (33) Tx 870.990 Rx 825.990
Channel 16 (12) Tx 870.360 Rx 825.360
Cell # 8
--------------------------------------------------
Channel 1 (326) Tx 879.780 Rx 834.780
Channel 2 (305) Tx 879.150 Rx 834.150
Channel 3 (284) Tx 878.520 Rx 833.520
Channel 4 (263) Tx 877.890 Rx 832.890
Channel 5 (242) Tx 877.260 Rx 832.260
Channel 6 (221) Tx 876.630 Rx 831.630
Channel 7 (200) Tx 876.000 Rx 831.000
Channel 8 (179) Tx 875.370 Rx 830.370
Channel 9 (158) Tx 874.740 Rx 829.740
Channel 10 (137) Tx 874.110 Rx 829.110
Channel 11 (116) Tx 873.480 Rx 828.480
Channel 12 (95) Tx 872.850 Rx 827.850
Channel 13 (74) Tx 872.220 Rx 827.220
Channel 14 (53) Tx 871.590 Rx 826.590
Channel 15 (32) Tx 870.960 Rx 825.960
Channel 16 (11) Tx 870.330 Rx 825.330
Cell # 9
--------------------------------------------------
Channel 1 (325) Tx 879.750 Rx 834.750
Channel 2 (304) Tx 879.120 Rx 834.120
Channel 3 (283) Tx 878.490 Rx 833.490
Channel 4 (262) Tx 877.860 Rx 832.860
Channel 5 (241) Tx 877.230 Rx 832.230
Channel 6 (220) Tx 876.600 Rx 831.600
Channel 7 (199) Tx 875.970 Rx 830.970
Channel 8 (178) Tx 875.340 Rx 830.340
Channel 9 (157) Tx 874.710 Rx 829.710
Channel 10 (136) Tx 874.080 Rx 829.080
Channel 11 (115) Tx 873.450 Rx 828.450
Channel 12 (94) Tx 872.820 Rx 827.820
Channel 13 (73) Tx 872.190 Rx 827.190
Channel 14 (52) Tx 871.560 Rx 826.560
Channel 15 (31) Tx 870.930 Rx 825.930
Channel 16 (10) Tx 870.300 Rx 825.300
Cell # 10
--------------------------------------------------
Channel 1 (324) Tx 879.720 Rx 834.720
Channel 2 (303) Tx 879.090 Rx 834.090
Channel 3 (282) Tx 878.460 Rx 833.460
Channel 4 (261) Tx 877.830 Rx 832.830
Channel 5 (240) Tx 877.200 Rx 832.200
Channel 6 (219) Tx 876.570 Rx 831.570
Channel 7 (198) Tx 875.940 Rx 830.940
Channel 8 (177) Tx 875.310 Rx 830.310
Channel 9 (156) Tx 874.680 Rx 829.680
Channel 10 (135) Tx 874.050 Rx 829.050
Channel 11 (114) Tx 873.420 Rx 828.420
Channel 12 (93) Tx 872.790 Rx 827.790
Channel 13 (72) Tx 872.160 Rx 827.160
Channel 14 (51) Tx 871.530 Rx 826.530
Channel 15 (30) Tx 870.900 Rx 825.900
Channel 16 (9) Tx 870.270 Rx 825.270
Cell # 11
--------------------------------------------------
Channel 1 (323) Tx 879.690 Rx 834.690
Channel 2 (302) Tx 879.060 Rx 834.060
Channel 3 (281) Tx 878.430 Rx 833.430
Channel 4 (260) Tx 877.800 Rx 832.800
Channel 5 (239) Tx 877.170 Rx 832.170
Channel 6 (218) Tx 876.540 Rx 831.540
Channel 7 (197) Tx 875.910 Rx 830.910
Channel 8 (176) Tx 875.280 Rx 830.280
Channel 9 (155) Tx 874.650 Rx 829.650
Channel 10 (134) Tx 874.020 Rx 829.020
Channel 11 (113) Tx 873.390 Rx 828.390
Channel 12 (92) Tx 872.760 Rx 827.760
Channel 13 (71) Tx 872.130 Rx 827.130
Channel 14 (50) Tx 871.500 Rx 826.500
Channel 15 (29) Tx 870.870 Rx 825.870
Channel 16 (8) Tx 870.240 Rx 825.240
Cell # 12
--------------------------------------------------
Channel 1 (322) Tx 879.660 Rx 834.660
Channel 2 (301) Tx 879.030 Rx 834.030
Channel 3 (280) Tx 878.400 Rx 833.400
Channel 4 (259) Tx 877.770 Rx 832.770
Channel 5 (238) Tx 877.140 Rx 832.140
Channel 6 (217) Tx 876.510 Rx 831.510
Channel 7 (196) Tx 875.880 Rx 830.880
Channel 8 (175) Tx 875.250 Rx 830.250
Channel 9 (154) Tx 874.620 Rx 829.620
Channel 10 (133) Tx 873.990 Rx 828.990
Channel 11 (112) Tx 873.360 Rx 828.360
Channel 12 (91) Tx 872.730 Rx 827.730
Channel 13 (70) Tx 872.100 Rx 827.100
Channel 14 (49) Tx 871.470 Rx 826.470
Channel 15 (28) Tx 870.840 Rx 825.840
Channel 16 (7) Tx 870.210 Rx 825.210
Cell # 13
--------------------------------------------------
Channel 1 (321) Tx 879.630 Rx 834.630
Channel 2 (300) Tx 879.000 Rx 834.000
Channel 3 (279) Tx 878.370 Rx 833.370
Channel 4 (258) Tx 877.740 Rx 832.740
Channel 5 (237) Tx 877.110 Rx 832.110
Channel 6 (216) Tx 876.480 Rx 831.480
Channel 7 (195) Tx 875.850 Rx 830.850
Channel 8 (174) Tx 875.220 Rx 830.220
Channel 9 (153) Tx 874.590 Rx 829.590
Channel 10 (132) Tx 873.960 Rx 828.960
Channel 11 (111) Tx 873.330 Rx 828.330
Channel 12 (90) Tx 872.700 Rx 827.700
Channel 13 (69) Tx 872.070 Rx 827.070
Channel 14 (48) Tx 871.440 Rx 826.440
Channel 15 (27) Tx 870.810 Rx 825.810
Channel 16 (6) Tx 870.180 Rx 825.180
Cell # 14
--------------------------------------------------
Channel 1 (320) Tx 879.600 Rx 834.600
Channel 2 (299) Tx 878.970 Rx 833.970
Channel 3 (278) Tx 878.340 Rx 833.340
Channel 4 (257) Tx 877.710 Rx 832.710
Channel 5 (236) Tx 877.080 Rx 832.080
Channel 6 (215) Tx 876.450 Rx 831.450
Channel 7 (194) Tx 875.820 Rx 830.820
Channel 8 (173) Tx 875.190 Rx 830.190
Channel 9 (152) Tx 874.560 Rx 829.560
Channel 10 (131) Tx 873.930 Rx 828.930
Channel 11 (110) Tx 873.300 Rx 828.300
Channel 12 (89) Tx 872.670 Rx 827.670
Channel 13 (68) Tx 872.040 Rx 827.040
Channel 14 (47) Tx 871.410 Rx 826.410
Channel 15 (26) Tx 870.780 Rx 825.780
Channel 16 (5) Tx 870.150 Rx 825.150
Cell # 15
--------------------------------------------------
Channel 1 (319) Tx 879.570 Rx 834.570
Channel 2 (298) Tx 878.940 Rx 833.940
Channel 3 (277) Tx 878.310 Rx 833.310
Channel 4 (256) Tx 877.680 Rx 832.680
Channel 5 (235) Tx 877.050 Rx 832.050
Channel 6 (214) Tx 876.420 Rx 831.420
Channel 7 (193) Tx 875.790 Rx 830.790
Channel 8 (172) Tx 875.160 Rx 830.160
Channel 9 (151) Tx 874.530 Rx 829.530
Channel 10 (130) Tx 873.900 Rx 828.900
Channel 11 (109) Tx 873.270 Rx 828.270
Channel 12 (88) Tx 872.640 Rx 827.640
Channel 13 (67) Tx 872.010 Rx 827.010
Channel 14 (46) Tx 871.380 Rx 826.380
Channel 15 (25) Tx 870.750 Rx 825.750
Channel 16 (4) Tx 870.120 Rx 825.120
Cell # 16
--------------------------------------------------
Channel 1 (318) Tx 879.540 Rx 834.540
Channel 2 (297) Tx 878.910 Rx 833.910
Channel 3 (276) Tx 878.280 Rx 833.280
Channel 4 (255) Tx 877.650 Rx 832.650
Channel 5 (234) Tx 877.020 Rx 832.020
Channel 6 (213) Tx 876.390 Rx 831.390
Channel 7 (192) Tx 875.760 Rx 830.760
Channel 8 (171) Tx 875.130 Rx 830.130
Channel 9 (150) Tx 874.500 Rx 829.500
Channel 10 (129) Tx 873.870 Rx 828.870
Channel 11 (108) Tx 873.240 Rx 828.240
Channel 12 (87) Tx 872.610 Rx 827.610
Channel 13 (66) Tx 871.980 Rx 826.980
Channel 14 (45) Tx 871.350 Rx 826.350
Channel 15 (24) Tx 870.720 Rx 825.720
Channel 16 (3) Tx 870.090 Rx 825.090
Cell # 17
--------------------------------------------------
Channel 1 (317) Tx 879.510 Rx 834.510
Channel 2 (296) Tx 878.880 Rx 833.880
Channel 3 (275) Tx 878.250 Rx 833.250
Channel 4 (254) Tx 877.620 Rx 832.620
Channel 5 (233) Tx 876.990 Rx 831.990
Channel 6 (212) Tx 876.360 Rx 831.360
Channel 7 (191) Tx 875.730 Rx 830.730
Channel 8 (170) Tx 875.100 Rx 830.100
Channel 9 (149) Tx 874.470 Rx 829.470
Channel 10 (128) Tx 873.840 Rx 828.840
Channel 11 (107) Tx 873.210 Rx 828.210
Channel 12 (86) Tx 872.580 Rx 827.580
Channel 13 (65) Tx 871.950 Rx 826.950
Channel 14 (44) Tx 871.320 Rx 826.320
Channel 15 (23) Tx 870.690 Rx 825.690
Channel 16 (2) Tx 870.060 Rx 825.060
Cell # 18
--------------------------------------------------
Channel 1 (316) Tx 879.480 Rx 834.480
Channel 2 (295) Tx 878.850 Rx 833.850
Channel 3 (274) Tx 878.220 Rx 833.220
Channel 4 (253) Tx 877.590 Rx 832.590
Channel 5 (232) Tx 876.960 Rx 831.960
Channel 6 (211) Tx 876.330 Rx 831.330
Channel 7 (190) Tx 875.700 Rx 830.700
Channel 8 (169) Tx 875.070 Rx 830.070
Channel 9 (148) Tx 874.440 Rx 829.440
Channel 10 (127) Tx 873.810 Rx 828.810
Channel 11 (106) Tx 873.180 Rx 828.180
Channel 12 (85) Tx 872.550 Rx 827.550
Channel 13 (64) Tx 871.920 Rx 826.920
Channel 14 (43) Tx 871.290 Rx 826.290
Channel 15 (22) Tx 870.660 Rx 825.660
Channel 16 (1) Tx 870.030 Rx 825.030
Cell # 19
--------------------------------------------------
Channel 1 (315) Tx 879.450 Rx 834.450
Channel 2 (294) Tx 878.820 Rx 833.820
Channel 3 (273) Tx 878.190 Rx 833.190
Channel 4 (252) Tx 877.560 Rx 832.560
Channel 5 (231) Tx 876.930 Rx 831.930
Channel 6 (210) Tx 876.300 Rx 831.300
Channel 7 (189) Tx 875.670 Rx 830.670
Channel 8 (168) Tx 875.040 Rx 830.040
Channel 9 (147) Tx 874.410 Rx 829.410
Channel 10 (126) Tx 873.780 Rx 828.780
Channel 11 (105) Tx 873.150 Rx 828.150
Channel 12 (84) Tx 872.520 Rx 827.520
Channel 13 (63) Tx 871.890 Rx 826.890
Channel 14 (42) Tx 871.260 Rx 826.260
Channel 15 (21) Tx 870.630 Rx 825.630
Cell # 20
--------------------------------------------------
Channel 1 (314) Tx 879.420 Rx 834.420
Channel 2 (293) Tx 878.790 Rx 833.790
Channel 3 (272) Tx 878.160 Rx 833.160
Channel 4 (251) Tx 877.530 Rx 832.530
Channel 5 (230) Tx 876.900 Rx 831.900
Channel 6 (209) Tx 876.270 Rx 831.270
Channel 7 (188) Tx 875.640 Rx 830.640
Channel 8 (167) Tx 875.010 Rx 830.010
Channel 9 (146) Tx 874.380 Rx 829.380
Channel 10 (125) Tx 873.750 Rx 828.750
Channel 11 (104) Tx 873.120 Rx 828.120
Channel 12 (83) Tx 872.490 Rx 827.490
Channel 13 (62) Tx 871.860 Rx 826.860
Channel 14 (41) Tx 871.230 Rx 826.230
Channel 15 (20) Tx 870.600 Rx 825.600
Cell # 21
--------------------------------------------------
Channel 1 (313) Tx 879.390 Rx 834.390
Channel 2 (292) Tx 878.760 Rx 833.760
Channel 3 (271) Tx 878.130 Rx 833.130
Channel 4 (250) Tx 877.500 Rx 832.500
Channel 5 (229) Tx 876.870 Rx 831.870
Channel 6 (208) Tx 876.240 Rx 831.240
Channel 7 (187) Tx 875.610 Rx 830.610
Channel 8 (166) Tx 874.980 Rx 829.980
Channel 9 (145) Tx 874.350 Rx 829.350
Channel 10 (124) Tx 873.720 Rx 828.720
Channel 11 (103) Tx 873.090 Rx 828.090
Channel 12 (82) Tx 872.460 Rx 827.460
Channel 13 (61) Tx 871.830 Rx 826.830
Channel 14 (40) Tx 871.200 Rx 826.200
Channel 15 (19) Tx 870.570 Rx 825.570
Cellular Phone Band B (Channel 1 is Data)
Cell # 1
--------------------------------------------------
Channel 1 (334) Tx 880.020 Rx 835.020
Channel 2 (355) Tx 880.650 Rx 835.650
Channel 3 (376) Tx 881.280 Rx 836.280
Channel 4 (397) Tx 881.910 Rx 836.910
Channel 5 (418) Tx 882.540 Rx 837.540
Channel 6 (439) Tx 883.170 Rx 838.170
Channel 7 (460) Tx 883.800 Rx 838.800
Channel 8 (481) Tx 884.430 Rx 839.430
Channel 9 (502) Tx 885.060 Rx 840.060
Channel 10 (523) Tx 885.690 Rx 840.690
Channel 11 (544) Tx 886.320 Rx 841.320
Channel 12 (565) Tx 886.950 Rx 841.950
Channel 13 (586) Tx 887.580 Rx 842.580
Channel 14 (607) Tx 888.210 Rx 843.210
Channel 15 (628) Tx 888.840 Rx 843.840
Channel 16 (649) Tx 889.470 Rx 844.470
Cell # 2
--------------------------------------------------
Channel 1 (335) Tx 880.050 Rx 835.050
Channel 2 (356) Tx 880.680 Rx 835.680
Channel 3 (377) Tx 881.310 Rx 836.310
Channel 4 (398) Tx 881.940 Rx 836.940
Channel 5 (419) Tx 882.570 Rx 837.570
Channel 6 (440) Tx 883.200 Rx 838.200
Channel 7 (461) Tx 883.830 Rx 838.830
Channel 8 (482) Tx 884.460 Rx 839.460
Channel 9 (503) Tx 885.090 Rx 840.090
Channel 10 (524) Tx 885.720 Rx 840.720
Channel 11 (545) Tx 886.350 Rx 841.350
Channel 12 (566) Tx 886.980 Rx 841.980
Channel 13 (587) Tx 887.610 Rx 842.610
Channel 14 (608) Tx 888.240 Rx 843.240
Channel 15 (629) Tx 888.870 Rx 843.870
Channel 16 (650) Tx 889.500 Rx 844.500
Cell # 3
--------------------------------------------------
Channel 1 (336) Tx 880.080 Rx 835.080
Channel 2 (357) Tx 880.710 Rx 835.710
Channel 3 (378) Tx 881.340 Rx 836.340
Channel 4 (399) Tx 881.970 Rx 836.970
Channel 5 (420) Tx 882.600 Rx 837.600
Channel 6 (441) Tx 883.230 Rx 838.230
Channel 7 (462) Tx 883.860 Rx 838.860
Channel 8 (483) Tx 884.490 Rx 839.490
Channel 9 (504) Tx 885.120 Rx 840.120
Channel 10 (525) Tx 885.750 Rx 840.750
Channel 11 (546) Tx 886.380 Rx 841.380
Channel 12 (567) Tx 887.010 Rx 842.010
Channel 13 (588) Tx 887.640 Rx 842.640
Channel 14 (609) Tx 888.270 Rx 843.270
Channel 15 (630) Tx 888.900 Rx 843.900
Channel 16 (651) Tx 889.530 Rx 844.530
Cell # 4
--------------------------------------------------
Channel 1 (337) Tx 880.110 Rx 835.110
Channel 2 (358) Tx 880.740 Rx 835.740
Channel 3 (379) Tx 881.370 Rx 836.370
Channel 4 (400) Tx 882.000 Rx 837.000
Channel 5 (421) Tx 882.630 Rx 837.630
Channel 6 (442) Tx 883.260 Rx 838.260
Channel 7 (463) Tx 883.890 Rx 838.890
Channel 8 (484) Tx 884.520 Rx 839.520
Channel 9 (505) Tx 885.150 Rx 840.150
Channel 10 (526) Tx 885.780 Rx 840.780
Channel 11 (547) Tx 886.410 Rx 841.410
Channel 12 (568) Tx 887.040 Rx 842.040
Channel 13 (589) Tx 887.670 Rx 842.670
Channel 14 (610) Tx 888.300 Rx 843.300
Channel 15 (631) Tx 888.930 Rx 843.930
Channel 16 (652) Tx 889.560 Rx 844.560
Cell # 5
--------------------------------------------------
Channel 1 (338) Tx 880.140 Rx 835.140
Channel 2 (359) Tx 880.770 Rx 835.770
Channel 3 (380) Tx 881.400 Rx 836.400
Channel 4 (401) Tx 882.030 Rx 837.030
Channel 5 (422) Tx 882.660 Rx 837.660
Channel 6 (443) Tx 883.290 Rx 838.290
Channel 7 (464) Tx 883.920 Rx 838.920
Channel 8 (485) Tx 884.550 Rx 839.550
Channel 9 (506) Tx 885.180 Rx 840.180
Channel 10 (527) Tx 885.810 Rx 840.810
Channel 11 (548) Tx 886.440 Rx 841.440
Channel 12 (569) Tx 887.070 Rx 842.070
Channel 13 (590) Tx 887.700 Rx 842.700
Channel 14 (611) Tx 888.330 Rx 843.330
Channel 15 (632) Tx 888.960 Rx 843.960
Channel 16 (653) Tx 889.590 Rx 844.590
Cell # 6
--------------------------------------------------
Channel 1 (339) Tx 880.170 Rx 835.170
Channel 2 (360) Tx 880.800 Rx 835.800
Channel 3 (381) Tx 881.430 Rx 836.430
Channel 4 (402) Tx 882.060 Rx 837.060
Channel 5 (423) Tx 882.690 Rx 837.690
Channel 6 (444) Tx 883.320 Rx 838.320
Channel 7 (465) Tx 883.950 Rx 838.950
Channel 8 (486) Tx 884.580 Rx 839.580
Channel 9 (507) Tx 885.210 Rx 840.210
Channel 10 (528) Tx 885.840 Rx 840.840
Channel 11 (549) Tx 886.470 Rx 841.470
Channe 12 (570) Tx 887.100 Rx 842.100
Channel 13 (591) Tx 887.730 Rx 842.730
Channel 14 (612) Tx 888.360 Rx 843.360
Channel 15 (633) Tx 888.990 Rx 843.990
Channel 16 (654) Tx 889.620 Rx 844.620
Cell # 7
--------------------------------------------------
Channel 1 (340) Tx 880.200 Rx 835.200
Channel 2 (361) Tx 880.830 Rx 835.830
Channel 3 (382) Tx 881.460 Rx 836.460
Channel 4 (403) Tx 882.090 Rx 837.090
Channel 5 (424) Tx 882.720 Rx 837.720
Channel 6 (445) Tx 883.350 Rx 838.350
Channel 7 (466) Tx 883.980 Rx 838.980
Channel 8 (487) Tx 884.610 Rx 839.610
Channel 9 (508) Tx 885.240 Rx 840.240
Channel 10 (529) Tx 885.870 Rx 840.870
Channel 11 (550) Tx 886.500 Rx 841.500
Channel 12 (571) Tx 887.130 Rx 842.130
Channel 13 (592) Tx 887.760 Rx 842.760
Channel 14 (613) Tx 888.390 Rx 843.390
Channel 15 (634) Tx 889.020 Rx 844.020
Channel 16 (655) Tx 889.650 Rx 844.650
Cell # 8
--------------------------------------------------
Channel 1 (341) Tx 880.230 Rx 835.230
Channel 2 (362) Tx 880.860 Rx 835.860
Channel 3 (383) Tx 881.490 Rx 836.490
Channel 4 (404) Tx 882.120 Rx 837.120
Channel 5 (425) Tx 882.750 Rx 837.750
Channel 6 (446) Tx 883.380 Rx 838.380
Channel 7 (467) Tx 884.010 Rx 839.010
Channel 8 (488) Tx 884.640 Rx 839.640
Channel 9 (509) Tx 885.270 Rx 840.270
Channel 10 (530) Tx 885.900 Rx 840.900
Channel 11 (551) Tx 886.530 Rx 841.530
Channel 12 (572) Tx 887.160 Rx 842.160
Channel 13 (593) Tx 887.790 Rx 842.790
Channel 14 (614) Tx 888.420 Rx 843.420
Channel 15 (635) Tx 889.050 Rx 844.050
Channel 16 (656) Tx 889.680 Rx 844.680
Cell # 9
--------------------------------------------------
Channel 1 (342) Tx 880.260 Rx 835.260
Channel 2 (363) Tx 880.890 Rx 835.890
Channel 3 (384) Tx 881.520 Rx 836.520
Channel 4 (405) Tx 882.150 Rx 837.150
Channel 5 (426) Tx 882.780 Rx 837.780
Channel 6 (447) Tx 883.410 Rx 838.410
Channel 7 (468) Tx 884.040 Rx 839.040
Channel 8 (489) Tx 884.670 Rx 839.670
Channel 9 (510) Tx 885.300 Rx 840.300
Channel 10 (531) Tx 885.930 Rx 840.930
Channel 11 (552) Tx 886.560 Rx 841.560
Channel 12 (573) Tx 887.190 Rx 842.190
Channel 13 (594) Tx 887.820 Rx 842.820
Channel 14 (615) Tx 888.450 Rx 843.450
Channel 15 (636) Tx 889.080 Rx 844.080
Channel 16 (657) Tx 889.710 Rx 844.710
Cell # 10
--------------------------------------------------
Channel 1 (343) Tx 880.290 Rx 835.290
Channel 2 (364) Tx 880.920 Rx 835.920
Channel 3 (385) Tx 881.550 Rx 836.550
Channel 4 (406) Tx 882.180 Rx 837.180
Channel 5 (427) Tx 882.810 Rx 837.810
Channel 6 (448) Tx 883.440 Rx 838.440
Channel 7 (469) Tx 884.070 Rx 839.070
Channel 8 (490) Tx 884.700 Rx 839.700
Channel 9 (511) Tx 885.330 Rx 840.330
Channel 10 (532) Tx 885.960 Rx 840.960
Channel 11 (553) Tx 886.590 Rx 841.590
Channel 12 (574) Tx 887.220 Rx 842.220
Channel 13 (595) Tx 887.850 Rx 842.850
Channel 14 (616) Tx 888.480 Rx 843.480
Channel 15 (637) Tx 889.110 Rx 844.110
Channel 16 (658) Tx 889.740 Rx 844.740
Cell # 11
--------------------------------------------------
Channel 1 (344) Tx 880.320 Rx 835.320
Channel 2 (365) Tx 880.950 Rx 835.950
Channel 3 (386) Tx 881.580 Rx 836.580
Channel 4 (407) Tx 882.210 Rx 837.210
Channel 5 (428) Tx 882.840 Rx 837.840
Channel 6 (449) Tx 883.470 Rx 838.470
Channel 7 (470) Tx 884.100 Rx 839.100
Channel 8 (491) Tx 884.730 Rx 839.730
Channel 9 (512) Tx 885.360 Rx 840.360
Channel 10 (533) Tx 885.990 Rx 840.990
Channel 11 (554) Tx 886.620 Rx 841.620
Channel 12 (575) Tx 887.250 Rx 842.250
Channel 13 (596) Tx 887.880 Rx 842.880
Channel 14 (617) Tx 888.510 Rx 843.510
Channel 15 (638) Tx 889.140 Rx 844.140
Channel 16 (659) Tx 889.770 Rx 844.770
Cell # 12
--------------------------------------------------
Channel 1 (345) Tx 880.350 Rx 835.350
Channel 2 (366) Tx 880.980 Rx 835.980
Channel 3 (387) Tx 881.610 Rx 836.610
Channel 4 (408) Tx 882.240 Rx 837.240
Channel 5 (429) Tx 882.870 Rx 837.870
Channel 6 (450) Tx 883.500 Rx 838.500
Channel 7 (471) Tx 884.130 Rx 839.130
Channel 8 (492) Tx 884.760 Rx 839.760
Channel 9 (513) Tx 885.390 Rx 840.390
Channel 10 (534) Tx 886.020 Rx 841.020
Channel 11 (555) Tx 886.650 Rx 841.650
Channel 12 (576) Tx 887.280 Rx 842.280
Channel 13 (597) Tx 887.910 Rx 842.910
Channel 14 (618) Tx 888.540 Rx 843.540
Channel 15 (639) Tx 889.170 Rx 844.170
Channel 16 (660) Tx 889.800 Rx 844.800
Cell # 13
--------------------------------------------------
Channel 1 (346) Tx 880.380 Rx 835.380
Channel 2 (367) Tx 881.010 Rx 836.010
Channel 3 (388) Tx 881.640 Rx 836.640
Channel 4 (409) Tx 882.270 Rx 837.270
Channel 5 (430) Tx 882.900 Rx 837.900
Channel 6 (451) Tx 883.530 Rx 838.530
Channel 7 (472) Tx 884.160 Rx 839.160
Channel 8 (493) Tx 884.790 Rx 839.790
Channel 9 (514) Tx 885.420 Rx 840.420
Channel 10 (535) Tx 886.050 Rx 841.050
Channel 11 (556) Tx 886.680 Rx 841.680
Channel 12 (577) Tx 887.310 Rx 842.310
Channel 13 (598) Tx 887.940 Rx 842.940
Channel 14 (619) Tx 888.570 Rx 843.570
Channel 15 (640) Tx 889.200 Rx 844.200
Channel 16 (661) Tx 889.830 Rx 844.830
Cell # 14
--------------------------------------------------
Channel 1 (347) Tx 880.410 Rx 835.410
Channel 2 (368) Tx 881.040 Rx 836.040
Channel 3 (389) Tx 881.670 Rx 836.670
Channel 4 (410) Tx 882.300 Rx 837.300
Channel 5 (431) Tx 882.930 Rx 837.930
Channel 6 (452) Tx 883.560 Rx 838.560
Channel 7 (473) Tx 884.190 Rx 839.190
Channel 8 (494) Tx 884.820 Rx 839.820
Channel 9 (515) Tx 885.450 Rx 840.450
Channel 10 (536) Tx 886.080 Rx 841.080
Channel 11 (557) Tx 886.710 Rx 841.710
Channel 12 (578) Tx 887.340 Rx 842.340
Channel 13 (599) Tx 887.970 Rx 842.970
Channel 14 (620) Tx 888.600 Rx 843.600
Channel 15 (641) Tx 889.230 Rx 844.230
Channel 16 (662) Tx 889.860 Rx 844.860
Cell # 15
--------------------------------------------------
Channel 1 (348) Tx 880.440 Rx 835.440
Channel 2 (369) Tx 881.070 Rx 836.070
Channel 3 (390) Tx 881.700 Rx 836.700
Channel 4 (411) Tx 882.330 Rx 837.330
Channel 5 (432) Tx 882.960 Rx 837.960
Channel 6 (453) Tx 883.590 Rx 838.590
Channel 7 (474) Tx 884.220 Rx 839.220
Channel 8 (495) Tx 884.850 Rx 839.850
Channel 9 (516) Tx 885.480 Rx 840.480
Channel 10 (537) Tx 886.110 Rx 841.110
Channel 11 (558) Tx 886.740 Rx 841.740
Channel 12 (579) Tx 887.370 Rx 842.370
Channel 13 (600) Tx 888.000 Rx 843.000
Channel 14 (621) Tx 888.630 Rx 843.630
Channel 15 (642) Tx 889.260 Rx 844.260
Channel 16 (663) Tx 889.890 Rx 844.890
Cell # 16
--------------------------------------------------
Channel 1 (349) Tx 880.470 Rx 835.470
Channel 2 (370) Tx 881.100 Rx 836.100
Channel 3 (391) Tx 881.730 Rx 836.730
Channel 4 (412) Tx 882.360 Rx 837.360
Channel 5 (433) Tx 882.990 Rx 837.990
Channel 6 (454) Tx 883.620 Rx 838.620
Channel 7 (475) Tx 884.250 Rx 839.250
Channel 8 (496) Tx 884.880 Rx 839.880
Channel 9 (517) Tx 885.510 Rx 840.510
Channel 10 (538) Tx 886.140 Rx 841.140
Channel 11 (559) Tx 886.770 Rx 841.770
Channel 12 (580) Tx 887.400 Rx 842.400
Channel 13 (601) Tx 888.030 Rx 843.030
Channel 14 (622) Tx 888.660 Rx 843.660
Channel 15 (643) Tx 889.290 Rx 844.290
Channel 16 (664) Tx 889.920 Rx 844.920
Cell # 17
--------------------------------------------------
Channel 1 (350) Tx 880.500 Rx 835.500
Channel 2 (371) Tx 881.130 Rx 836.130
Channel 3 (392) Tx 881.760 Rx 836.760
Channel 4 (413) Tx 882.390 Rx 837.390
Channel 5 (434) Tx 883.020 Rx 838.020
Channel 6 (455) Tx 883.650 Rx 838.650
Channel 7 (476) Tx 884.280 Rx 839.280
Channel 8 (497) Tx 884.910 Rx 839.910
Channel 9 (518) Tx 885.540 Rx 840.540
Channel 10 (539) Tx 886.170 Rx 841.170
Channel 11 (560) Tx 886.800 Rx 841.800
Channel 12 (581) Tx 887.430 Rx 842.430
Channel 13 (602) Tx 888.060 Rx 843.060
Channel 14 (623) Tx 888.690 Rx 843.690
Channel 15 (644) Tx 889.320 Rx 844.320
Channel 16 (665) Tx 889.950 Rx 844.950
Cell # 18
--------------------------------------------------
Channel 1 (351) Tx 880.530 Rx 835.530
Channel 2 (372) Tx 881.160 Rx 836.160
Channel 3 (393) Tx 881.790 Rx 836.790
Channel 4 (414) Tx 882.420 Rx 837.420
Channel 5 (435) Tx 883.050 Rx 838.050
Channel 6 (456) Tx 883.680 Rx 838.680
Channel 7 (477) Tx 884.310 Rx 839.310
Channel 8 (498) Tx 884.940 Rx 839.940
Channel 9 (519) Tx 885.570 Rx 840.570
Channel 10 (540) Tx 886.200 Rx 841.200
Channel 11 (561) Tx 886.830 Rx 841.830
Channel 12 (582) Tx 887.460 Rx 842.460
Channel 13 (603) Tx 888.090 Rx 843.090
Channel 14 (624) Tx 888.720 Rx 843.720
Channel 15 (645) Tx 889.350 Rx 844.350
Channel 16 (666) Tx 889.980 Rx 844.980
Cell # 19
--------------------------------------------------
Channel 1 (352) Tx 880.560 Rx 835.560
Channel 2 (373) Tx 881.190 Rx 836.190
Channel 3 (394) Tx 881.820 Rx 836.820
Channel 4 (415) Tx 882.450 Rx 837.450
Channel 5 (436) Tx 883.080 Rx 838.080
Channel 6 (457) Tx 883.710 Rx 838.710
Channel 7 (478) Tx 884.340 Rx 839.340
Channel 8 (499) Tx 884.970 Rx 839.970
Channel 9 (520) Tx 885.600 Rx 840.600
Channel 10 (541) Tx 886.230 Rx 841.230
Channel 11 (562) Tx 886.860 Rx 841.860
Channel 12 (583) Tx 887.490 Rx 842.490
Channel 13 (604) Tx 888.120 Rx 843.120
Channel 14 (625) Tx 888.750 Rx 843.750
Channel 15 (646) Tx 889.380 Rx 844.380
Cell # 20
--------------------------------------------------
Channel 1 (353) Tx 880.590 Rx 835.590
Channel 2 (374) Tx 881.220 Rx 836.220
Channel 3 (395) Tx 881.850 Rx 836.850
Channel 4 (416) Tx 882.480 Rx 837.480
Channel 5 (437) Tx 883.110 Rx 838.110
Channel 6 (458) Tx 883.740 Rx 838.740
Channel 7 (479) Tx 884.370 Rx 839.370
Channel 8 (500) Tx 885.000 Rx 840.000
Channel 9 (521) Tx 885.630 Rx 840.630
Channel 10 (542) Tx 886.260 Rx 841.260
Channel 11 (563) Tx 886.890 Rx 841.890
Channel 12 (584) Tx 887.520 Rx 842.520
Channel 13 (605) Tx 888.150 Rx 843.150
Channel 14 (626) Tx 888.780 Rx 843.780
Channel 15 (647) Tx 889.410 Rx 844.410
Cell # 21
--------------------------------------------------
Channel 1 (354) Tx 880.620 Rx 835.620
Channel 2 (375) Tx 881.250 Rx 836.250
Channel 3 (396) Tx 881.880 Rx 836.880
Channel 4 (417) Tx 882.510 Rx 837.510
Channel 5 (438) Tx 883.140 Rx 838.140
Channel 6 (459) Tx 883.770 Rx 838.770
Channel 7 (480) Tx 884.400 Rx 839.400
Channel 8 (501) Tx 885.030 Rx 840.030
Channel 9 (522) Tx 885.660 Rx 840.660
Channel 10 (543) Tx 886.290 Rx 841.290
Channel 11 (564) Tx 886.920 Rx 841.920
Channel 12 (585) Tx 887.550 Rx 842.550
Channel 13 (606) Tx 888.180 Rx 843.180
Channel 14 (627) Tx 888.810 Rx 843.810
Channel 15 (648) Tx 889.440 Rx 844.440
Courtesy of AV-Sync Atlanta (404) 320-6202
phreak/CELLULAR/cellfreq.txt
+878
View File
@@ -0,0 +1,878 @@
The THC Hack/Phreak Archives: CELLULAR.FRQ (850 lines)
Note: I did not write any of these textfiles. They are being posted from
the archive as a public service only - any copyrights belong to the
authors. See the footer for important information.
==========================================================================
Complete List of Cellular Channel Numbers and Frequencies 03/30/93
The Researcher
Band A
Chan Mobile Cell Site
-------------------------
1 -- 825.03 -- 870.03
2 -- 825.06 -- 870.06
3 -- 825.09 -- 870.09
4 -- 825.12 -- 870.12
5 -- 825.15 -- 870.15
6 -- 825.18 -- 870.18
7 -- 825.21 -- 870.21
8 -- 825.24 -- 870.24
9 -- 825.27 -- 870.27
10 -- 825.30 -- 870.30
11 -- 825.33 -- 870.33
12 -- 825.36 -- 870.36
13 -- 825.39 -- 870.39
14 -- 825.42 -- 870.42
15 -- 825.45 -- 870.45
16 -- 825.48 -- 870.48
17 -- 825.51 -- 870.51
18 -- 825.54 -- 870.54
19 -- 825.57 -- 870.57
20 -- 825.60 -- 870.60
21 -- 825.63 -- 870.63
22 -- 825.66 -- 870.66
23 -- 825.69 -- 870.69
24 -- 825.72 -- 870.72
25 -- 825.75 -- 870.75
26 -- 825.78 -- 870.78
27 -- 825.81 -- 870.81
28 -- 825.84 -- 870.84
29 -- 825.87 -- 870.87
30 -- 825.90 -- 870.90
31 -- 825.93 -- 870.93
32 -- 825.96 -- 870.96
33 -- 825.99 -- 870.99
34 -- 826.02 -- 871.02
35 -- 826.05 -- 871.05
36 -- 826.08 -- 871.08
37 -- 826.11 -- 871.11
38 -- 826.14 -- 871.14
39 -- 826.17 -- 871.17
40 -- 826.20 -- 871.20
41 -- 826.23 -- 871.23
42 -- 826.26 -- 871.26
43 -- 826.29 -- 871.29
44 -- 826.32 -- 871.32
45 -- 826.35 -- 871.35
46 -- 826.38 -- 871.38
47 -- 826.41 -- 871.41
48 -- 826.44 -- 871.44
49 -- 826.47 -- 871.47
50 -- 826.50 -- 871.50
51 -- 826.53 -- 871.53
52 -- 826.56 -- 871.56
53 -- 826.59 -- 871.59
54 -- 826.62 -- 871.62
55 -- 826.65 -- 871.65
56 -- 826.68 -- 871.68
57 -- 826.71 -- 871.71
58 -- 826.74 -- 871.74
59 -- 826.77 -- 871.77
60 -- 826.80 -- 871.80
61 -- 826.83 -- 871.83
62 -- 826.86 -- 871.86
63 -- 826.89 -- 871.89
64 -- 826.92 -- 871.92
65 -- 826.95 -- 871.95
66 -- 826.98 -- 871.98
67 -- 827.01 -- 872.01
68 -- 827.04 -- 872.04
69 -- 827.07 -- 872.07
70 -- 827.10 -- 872.10
71 -- 827.13 -- 872.13
72 -- 827.16 -- 872.16
73 -- 827.19 -- 872.19
74 -- 827.22 -- 872.22
75 -- 827.25 -- 872.25
76 -- 827.28 -- 872.28
77 -- 827.31 -- 872.31
78 -- 827.34 -- 872.34
79 -- 827.37 -- 872.37
80 -- 827.40 -- 872.40
81 -- 827.43 -- 872.43
82 -- 827.46 -- 872.46
83 -- 827.49 -- 872.49
84 -- 827.52 -- 872.52
85 -- 827.55 -- 872.55
86 -- 827.58 -- 872.58
87 -- 827.61 -- 872.61
88 -- 827.64 -- 872.64
89 -- 827.67 -- 872.67
90 -- 827.70 -- 872.70
91 -- 827.73 -- 872.73
92 -- 827.76 -- 872.76
93 -- 827.79 -- 872.79
94 -- 827.82 -- 872.82
95 -- 827.85 -- 872.85
96 -- 827.88 -- 872.88
97 -- 827.91 -- 872.91
98 -- 827.94 -- 872.94
99 -- 827.97 -- 872.97
100 -- 828.00 -- 873.00
101 -- 828.03 -- 873.03
102 -- 828.06 -- 873.06
103 -- 828.09 -- 873.09
104 -- 828.12 -- 873.12
105 -- 828.15 -- 873.15
106 -- 828.18 -- 873.18
107 -- 828.21 -- 873.21
108 -- 828.24 -- 873.24
109 -- 828.27 -- 873.27
110 -- 828.30 -- 873.30
111 -- 828.33 -- 873.33
112 -- 828.36 -- 873.36
113 -- 828.39 -- 873.39
114 -- 828.42 -- 873.42
115 -- 828.45 -- 873.45
116 -- 828.48 -- 873.48
117 -- 828.51 -- 873.51
118 -- 828.54 -- 873.54
119 -- 828.57 -- 873.57
120 -- 828.60 -- 873.60
121 -- 828.63 -- 873.63
122 -- 828.66 -- 873.66
123 -- 828.69 -- 873.69
124 -- 828.72 -- 873.72
125 -- 828.75 -- 873.75
126 -- 828.78 -- 873.78
127 -- 828.81 -- 873.81
128 -- 828.84 -- 873.84
129 -- 828.87 -- 873.87
130 -- 828.90 -- 873.90
131 -- 828.93 -- 873.93
132 -- 828.96 -- 873.96
133 -- 828.99 -- 873.99
134 -- 829.02 -- 874.02
135 -- 829.05 -- 874.05
136 -- 829.08 -- 874.08
137 -- 829.11 -- 874.11
138 -- 829.14 -- 874.14
139 -- 829.17 -- 874.17
140 -- 829.20 -- 874.20
141 -- 829.23 -- 874.23
142 -- 829.26 -- 874.26
143 -- 829.29 -- 874.29
144 -- 829.32 -- 874.32
145 -- 829.35 -- 874.35
146 -- 829.38 -- 874.38
147 -- 829.41 -- 874.41
148 -- 829.44 -- 874.44
149 -- 829.47 -- 874.47
150 -- 829.50 -- 874.50
151 -- 829.53 -- 874.53
152 -- 829.56 -- 874.56
153 -- 829.59 -- 874.59
154 -- 829.62 -- 874.62
155 -- 829.65 -- 874.65
156 -- 829.68 -- 874.68
157 -- 829.71 -- 874.71
158 -- 829.74 -- 874.74
159 -- 829.77 -- 874.77
160 -- 829.80 -- 874.80
161 -- 829.83 -- 874.83
162 -- 829.86 -- 874.86
163 -- 829.89 -- 874.89
164 -- 829.92 -- 874.92
165 -- 829.95 -- 874.95
166 -- 829.98 -- 874.98
167 -- 830.01 -- 875.01
168 -- 830.04 -- 875.04
169 -- 830.07 -- 875.07
170 -- 830.10 -- 875.10
171 -- 830.13 -- 875.13
172 -- 830.16 -- 875.16
173 -- 830.19 -- 875.19
174 -- 830.22 -- 875.22
175 -- 830.25 -- 875.25
176 -- 830.28 -- 875.28
177 -- 830.31 -- 875.31
178 -- 830.34 -- 875.34
179 -- 830.37 -- 875.37
180 -- 830.40 -- 875.40
181 -- 830.43 -- 875.43
182 -- 830.46 -- 875.46
183 -- 830.49 -- 875.49
184 -- 830.52 -- 875.52
185 -- 830.55 -- 875.55
186 -- 830.58 -- 875.58
187 -- 830.61 -- 875.61
188 -- 830.64 -- 875.64
189 -- 830.67 -- 875.67
190 -- 830.70 -- 875.70
191 -- 830.73 -- 875.73
192 -- 830.76 -- 875.76
193 -- 830.79 -- 875.79
194 -- 830.82 -- 875.82
195 -- 830.85 -- 875.85
196 -- 830.88 -- 875.88
197 -- 830.91 -- 875.91
198 -- 830.94 -- 875.94
199 -- 830.97 -- 875.97
200 -- 831.00 -- 876.00
201 -- 831.03 -- 876.03
202 -- 831.06 -- 876.06
203 -- 831.09 -- 876.09
204 -- 831.12 -- 876.12
205 -- 831.15 -- 876.15
206 -- 831.18 -- 876.18
207 -- 831.21 -- 876.21
208 -- 831.24 -- 876.24
209 -- 831.27 -- 876.27
210 -- 831.30 -- 876.30
211 -- 831.33 -- 876.33
212 -- 831.36 -- 876.36
213 -- 831.39 -- 876.39
214 -- 831.42 -- 876.42
215 -- 831.45 -- 876.45
216 -- 831.48 -- 876.48
217 -- 831.51 -- 876.51
218 -- 831.54 -- 876.54
219 -- 831.57 -- 876.57
220 -- 831.60 -- 876.60
221 -- 831.63 -- 876.63
222 -- 831.66 -- 876.66
223 -- 831.69 -- 876.69
224 -- 831.72 -- 876.72
225 -- 831.75 -- 876.75
226 -- 831.78 -- 876.78
227 -- 831.81 -- 876.81
228 -- 831.84 -- 876.84
229 -- 831.87 -- 876.87
230 -- 831.90 -- 876.90
231 -- 831.93 -- 876.93
232 -- 831.96 -- 876.96
233 -- 831.99 -- 876.99
234 -- 832.02 -- 877.02
235 -- 832.05 -- 877.05
236 -- 832.08 -- 877.08
237 -- 832.11 -- 877.11
238 -- 832.14 -- 877.14
239 -- 832.17 -- 877.17
240 -- 832.20 -- 877.20
241 -- 832.23 -- 877.23
242 -- 832.26 -- 877.26
243 -- 832.29 -- 877.29
244 -- 832.32 -- 877.32
245 -- 832.35 -- 877.35
246 -- 832.38 -- 877.38
247 -- 832.41 -- 877.41
248 -- 832.44 -- 877.44
249 -- 832.47 -- 877.47
250 -- 832.50 -- 877.50
251 -- 832.53 -- 877.53
252 -- 832.56 -- 877.56
253 -- 832.59 -- 877.59
254 -- 832.62 -- 877.62
255 -- 832.65 -- 877.65
256 -- 832.68 -- 877.68
257 -- 832.71 -- 877.71
258 -- 832.74 -- 877.74
259 -- 832.77 -- 877.77
260 -- 832.80 -- 877.80
261 -- 832.83 -- 877.83
262 -- 832.86 -- 877.86
263 -- 832.89 -- 877.89
264 -- 832.92 -- 877.92
265 -- 832.95 -- 877.95
266 -- 832.98 -- 877.98
267 -- 833.01 -- 878.01
268 -- 833.04 -- 878.04
269 -- 833.07 -- 878.07
270 -- 833.10 -- 878.10
271 -- 833.13 -- 878.13
272 -- 833.16 -- 878.16
273 -- 833.19 -- 878.19
274 -- 833.22 -- 878.22
275 -- 833.25 -- 878.25
276 -- 833.28 -- 878.28
277 -- 833.31 -- 878.31
278 -- 833.34 -- 878.34
279 -- 833.37 -- 878.37
280 -- 833.40 -- 878.40
281 -- 833.43 -- 878.43
282 -- 833.46 -- 878.46
283 -- 833.49 -- 878.49
284 -- 833.52 -- 878.52
285 -- 833.55 -- 878.55
286 -- 833.58 -- 878.58
287 -- 833.61 -- 878.61
288 -- 833.64 -- 878.64
289 -- 833.67 -- 878.67
290 -- 833.70 -- 878.70
291 -- 833.73 -- 878.73
292 -- 833.76 -- 878.76
293 -- 833.79 -- 878.79
294 -- 833.82 -- 878.82
295 -- 833.85 -- 878.85
296 -- 833.88 -- 878.88
297 -- 833.91 -- 878.91
298 -- 833.94 -- 878.94
299 -- 833.97 -- 878.97
300 -- 834.00 -- 879.00
301 -- 834.03 -- 879.03
302 -- 834.06 -- 879.06
303 -- 834.09 -- 879.09
304 -- 834.12 -- 879.12
305 -- 834.15 -- 879.15
306 -- 834.18 -- 879.18
307 -- 834.21 -- 879.21
308 -- 834.24 -- 879.24
309 -- 834.27 -- 879.27
310 -- 834.30 -- 879.30
311 -- 834.33 -- 879.33
312 -- 834.36 -- 879.36
313 -- 834.39 -- 879.39
314 -- 834.42 -- 879.42
315 -- 834.45 -- 879.45
316 -- 834.48 -- 879.48
317 -- 834.51 -- 879.51
318 -- 834.54 -- 879.54
319 -- 834.57 -- 879.57
320 -- 834.60 -- 879.60
321 -- 834.63 -- 879.63
322 -- 834.66 -- 879.66
323 -- 834.69 -- 879.69
324 -- 834.72 -- 879.72
325 -- 834.75 -- 879.75
326 -- 834.78 -- 879.78
327 -- 834.81 -- 879.81
328 -- 834.84 -- 879.84
329 -- 834.87 -- 879.87
330 -- 834.90 -- 879.90
331 -- 834.93 -- 879.93
332 -- 834.96 -- 879.96
333 -- 834.99 -- 879.99
334 -- 835.02 -- 880.02
335 -- 835.05 -- 880.05
336 -- 835.08 -- 880.08
337 -- 835.11 -- 880.11
338 -- 835.14 -- 880.14
339 -- 835.17 -- 880.17
340 -- 835.20 -- 880.20
341 -- 835.23 -- 880.23
342 -- 835.26 -- 880.26
343 -- 835.29 -- 880.29
344 -- 835.32 -- 880.32
345 -- 835.35 -- 880.35
346 -- 835.38 -- 880.38
347 -- 835.41 -- 880.41
348 -- 835.44 -- 880.44
349 -- 835.47 -- 880.47
350 -- 835.50 -- 880.50
351 -- 835.53 -- 880.53
352 -- 835.56 -- 880.56
353 -- 835.59 -- 880.59
354 -- 835.62 -- 880.62
355 -- 835.65 -- 880.65
356 -- 835.68 -- 880.68
357 -- 835.71 -- 880.71
358 -- 835.74 -- 880.74
359 -- 835.77 -- 880.77
360 -- 835.80 -- 880.80
361 -- 835.83 -- 880.83
362 -- 835.86 -- 880.86
363 -- 835.89 -- 880.89
364 -- 835.92 -- 880.92
365 -- 835.95 -- 880.95
366 -- 835.98 -- 880.98
367 -- 836.01 -- 881.01
368 -- 836.04 -- 881.04
369 -- 836.07 -- 881.07
370 -- 836.10 -- 881.10
371 -- 836.13 -- 881.13
372 -- 836.16 -- 881.16
373 -- 836.19 -- 881.19
374 -- 836.22 -- 881.22
375 -- 836.25 -- 881.25
376 -- 836.28 -- 881.28
377 -- 836.31 -- 881.31
378 -- 836.34 -- 881.34
379 -- 836.37 -- 881.37
380 -- 836.40 -- 881.40
381 -- 836.43 -- 881.43
382 -- 836.46 -- 881.46
383 -- 836.49 -- 881.49
384 -- 836.52 -- 881.52
385 -- 836.55 -- 881.55
386 -- 836.58 -- 881.58
387 -- 836.61 -- 881.61
388 -- 836.64 -- 881.64
389 -- 836.67 -- 881.67
390 -- 836.70 -- 881.70
391 -- 836.73 -- 881.73
392 -- 836.76 -- 881.76
393 -- 836.79 -- 881.79
394 -- 836.82 -- 881.82
395 -- 836.85 -- 881.85
396 -- 836.88 -- 881.88
397 -- 836.91 -- 881.91
398 -- 836.94 -- 881.94
399 -- 836.97 -- 881.97
400 -- 837.00 -- 882.00
401 -- 837.03 -- 882.03
402 -- 837.06 -- 882.06
403 -- 837.09 -- 882.09
404 -- 837.12 -- 882.12
405 -- 837.15 -- 882.15
406 -- 837.18 -- 882.18
407 -- 837.21 -- 882.21
408 -- 837.24 -- 882.24
409 -- 837.27 -- 882.27
410 -- 837.30 -- 882.30
411 -- 837.33 -- 882.33
412 -- 837.36 -- 882.36
413 -- 837.39 -- 882.39
414 -- 837.42 -- 882.42
415 -- 837.45 -- 882.45
416 -- 837.48 -- 882.48
417 -- 837.51 -- 882.51
418 -- 837.54 -- 882.54
419 -- 837.57 -- 882.57
420 -- 837.60 -- 882.60
421 -- 837.63 -- 882.63
422 -- 837.66 -- 882.66
423 -- 837.69 -- 882.69
424 -- 837.72 -- 882.72
425 -- 837.75 -- 882.75
426 -- 837.78 -- 882.78
427 -- 837.81 -- 882.81
428 -- 837.84 -- 882.84
429 -- 837.87 -- 882.87
430 -- 837.90 -- 882.90
431 -- 837.93 -- 882.93
432 -- 837.96 -- 882.96
433 -- 837.99 -- 882.99
434 -- 838.02 -- 883.02
435 -- 838.05 -- 883.05
436 -- 838.08 -- 883.08
437 -- 838.11 -- 883.11
438 -- 838.14 -- 883.14
439 -- 838.17 -- 883.17
440 -- 838.20 -- 883.20
441 -- 838.23 -- 883.23
442 -- 838.26 -- 883.26
443 -- 838.29 -- 883.29
444 -- 838.32 -- 883.32
445 -- 838.35 -- 883.35
446 -- 838.38 -- 883.38
447 -- 838.41 -- 883.41
448 -- 838.44 -- 883.44
449 -- 838.47 -- 883.47
450 -- 838.50 -- 883.50
451 -- 838.53 -- 883.53
452 -- 838.56 -- 883.56
453 -- 838.59 -- 883.59
454 -- 838.62 -- 883.62
455 -- 838.65 -- 883.65
456 -- 838.68 -- 883.68
457 -- 838.71 -- 883.71
458 -- 838.74 -- 883.74
459 -- 838.77 -- 883.77
460 -- 838.80 -- 883.80
461 -- 838.83 -- 883.83
462 -- 838.86 -- 883.86
463 -- 838.89 -- 883.89
464 -- 838.92 -- 883.92
465 -- 838.95 -- 883.95
466 -- 838.98 -- 883.98
467 -- 839.01 -- 884.01
468 -- 839.04 -- 884.04
469 -- 839.07 -- 884.07
470 -- 839.10 -- 884.10
471 -- 839.13 -- 884.13
472 -- 839.16 -- 884.16
473 -- 839.19 -- 884.19
474 -- 839.22 -- 884.22
475 -- 839.25 -- 884.25
476 -- 839.28 -- 884.28
477 -- 839.31 -- 884.31
478 -- 839.34 -- 884.34
479 -- 839.37 -- 884.37
480 -- 839.40 -- 884.40
481 -- 839.43 -- 884.43
482 -- 839.46 -- 884.46
483 -- 839.49 -- 884.49
484 -- 839.52 -- 884.52
485 -- 839.55 -- 884.55
486 -- 839.58 -- 884.58
487 -- 839.61 -- 884.61
488 -- 839.64 -- 884.64
489 -- 839.67 -- 884.67
490 -- 839.70 -- 884.70
491 -- 839.73 -- 884.73
492 -- 839.76 -- 884.76
493 -- 839.79 -- 884.79
494 -- 839.82 -- 884.82
495 -- 839.85 -- 884.85
496 -- 839.88 -- 884.88
497 -- 839.91 -- 884.91
498 -- 839.94 -- 884.94
499 -- 839.97 -- 884.97
500 -- 840.00 -- 885.00
501 -- 840.03 -- 885.03
502 -- 840.06 -- 885.06
503 -- 840.09 -- 885.09
504 -- 840.12 -- 885.12
505 -- 840.15 -- 885.15
506 -- 840.18 -- 885.18
507 -- 840.21 -- 885.21
508 -- 840.24 -- 885.24
509 -- 840.27 -- 885.27
510 -- 840.30 -- 885.30
511 -- 840.33 -- 885.33
512 -- 840.36 -- 885.36
513 -- 840.39 -- 885.39
514 -- 840.42 -- 885.42
515 -- 840.45 -- 885.45
516 -- 840.48 -- 885.48
517 -- 840.51 -- 885.51
518 -- 840.54 -- 885.54
519 -- 840.57 -- 885.57
520 -- 840.60 -- 885.60
521 -- 840.63 -- 885.63
522 -- 840.66 -- 885.66
523 -- 840.69 -- 885.69
524 -- 840.72 -- 885.72
525 -- 840.75 -- 885.75
526 -- 840.78 -- 885.78
527 -- 840.81 -- 885.81
528 -- 840.84 -- 885.84
529 -- 840.87 -- 885.87
530 -- 840.90 -- 885.90
531 -- 840.93 -- 885.93
532 -- 840.96 -- 885.96
533 -- 840.99 -- 885.99
534 -- 841.02 -- 886.02
535 -- 841.05 -- 886.05
536 -- 841.08 -- 886.08
537 -- 841.11 -- 886.11
538 -- 841.14 -- 886.14
539 -- 841.17 -- 886.17
540 -- 841.20 -- 886.20
541 -- 841.23 -- 886.23
542 -- 841.26 -- 886.26
543 -- 841.29 -- 886.29
544 -- 841.32 -- 886.32
545 -- 841.35 -- 886.35
546 -- 841.38 -- 886.38
547 -- 841.41 -- 886.41
548 -- 841.44 -- 886.44
549 -- 841.47 -- 886.47
550 -- 841.50 -- 886.50
551 -- 841.53 -- 886.53
552 -- 841.56 -- 886.56
553 -- 841.59 -- 886.59
554 -- 841.62 -- 886.62
555 -- 841.65 -- 886.65
556 -- 841.68 -- 886.68
557 -- 841.71 -- 886.71
558 -- 841.74 -- 886.74
559 -- 841.77 -- 886.77
560 -- 841.80 -- 886.80
561 -- 841.83 -- 886.83
562 -- 841.86 -- 886.86
563 -- 841.89 -- 886.89
564 -- 841.92 -- 886.92
565 -- 841.95 -- 886.95
566 -- 841.98 -- 886.98
567 -- 842.01 -- 887.01
568 -- 842.04 -- 887.04
569 -- 842.07 -- 887.07
570 -- 842.10 -- 887.10
571 -- 842.13 -- 887.13
572 -- 842.16 -- 887.16
573 -- 842.19 -- 887.19
574 -- 842.22 -- 887.22
575 -- 842.25 -- 887.25
576 -- 842.28 -- 887.28
577 -- 842.31 -- 887.31
578 -- 842.34 -- 887.34
579 -- 842.37 -- 887.37
580 -- 842.40 -- 887.40
581 -- 842.43 -- 887.43
582 -- 842.46 -- 887.46
583 -- 842.49 -- 887.49
584 -- 842.52 -- 887.52
585 -- 842.55 -- 887.55
586 -- 842.58 -- 887.58
587 -- 842.61 -- 887.61
588 -- 842.64 -- 887.64
589 -- 842.67 -- 887.67
590 -- 842.70 -- 887.70
591 -- 842.73 -- 887.73
592 -- 842.76 -- 887.76
593 -- 842.79 -- 887.79
594 -- 842.82 -- 887.82
595 -- 842.85 -- 887.85
596 -- 842.88 -- 887.88
597 -- 842.91 -- 887.91
598 -- 842.94 -- 887.94
599 -- 842.97 -- 887.97
600 -- 843.00 -- 888.00
601 -- 843.03 -- 888.03
602 -- 843.06 -- 888.06
603 -- 843.09 -- 888.09
604 -- 843.12 -- 888.12
605 -- 843.15 -- 888.15
606 -- 843.18 -- 888.18
607 -- 843.21 -- 888.21
608 -- 843.24 -- 888.24
609 -- 843.27 -- 888.27
610 -- 843.30 -- 888.30
611 -- 843.33 -- 888.33
612 -- 843.36 -- 888.36
613 -- 843.39 -- 888.39
614 -- 843.42 -- 888.42
615 -- 843.45 -- 888.45
616 -- 843.48 -- 888.48
617 -- 843.51 -- 888.51
618 -- 843.54 -- 888.54
619 -- 843.57 -- 888.57
620 -- 843.60 -- 888.60
621 -- 843.63 -- 888.63
622 -- 843.66 -- 888.66
623 -- 843.69 -- 888.69
624 -- 843.72 -- 888.72
625 -- 843.75 -- 888.75
626 -- 843.78 -- 888.78
627 -- 843.81 -- 888.81
628 -- 843.84 -- 888.84
629 -- 843.87 -- 888.87
630 -- 843.90 -- 888.90
631 -- 843.93 -- 888.93
632 -- 843.96 -- 888.96
633 -- 843.99 -- 888.99
634 -- 844.02 -- 889.02
635 -- 844.05 -- 889.05
636 -- 844.08 -- 889.08
637 -- 844.11 -- 889.11
638 -- 844.14 -- 889.14
639 -- 844.17 -- 889.17
640 -- 844.20 -- 889.20
641 -- 844.23 -- 889.23
642 -- 844.26 -- 889.26
643 -- 844.29 -- 889.29
644 -- 844.32 -- 889.32
645 -- 844.35 -- 889.35
646 -- 844.38 -- 889.38
647 -- 844.41 -- 889.41
648 -- 844.44 -- 889.44
649 -- 844.47 -- 889.47
650 -- 844.50 -- 889.50
651 -- 844.53 -- 889.53
652 -- 844.56 -- 889.56
653 -- 844.59 -- 889.59
654 -- 844.62 -- 889.62
655 -- 844.65 -- 889.65
656 -- 844.68 -- 889.68
657 -- 844.71 -- 889.71
658 -- 844.74 -- 889.74
659 -- 844.77 -- 889.77
660 -- 844.80 -- 889.80
661 -- 844.83 -- 889.83
662 -- 844.86 -- 889.86
663 -- 844.89 -- 889.89
664 -- 844.92 -- 889.92
665 -- 844.95 -- 889.95
666 -- 844.98 -- 889.98
667 -- 845.01 -- 890.01
668 -- 845.04 -- 890.04
669 -- 845.07 -- 890.07
670 -- 845.10 -- 890.10
671 -- 845.13 -- 890.13
672 -- 845.16 -- 890.16
673 -- 845.19 -- 890.19
674 -- 845.22 -- 890.22
675 -- 845.25 -- 890.25
676 -- 845.28 -- 890.28
677 -- 845.31 -- 890.31
678 -- 845.34 -- 890.34
679 -- 845.37 -- 890.37
680 -- 845.40 -- 890.40
681 -- 845.43 -- 890.43
682 -- 845.46 -- 890.46
683 -- 845.49 -- 890.49
684 -- 845.52 -- 890.52
685 -- 845.55 -- 890.55
686 -- 845.58 -- 890.58
687 -- 845.61 -- 890.61
688 -- 845.64 -- 890.64
689 -- 845.67 -- 890.67
690 -- 845.70 -- 890.70
691 -- 845.73 -- 890.73
692 -- 845.76 -- 890.76
693 -- 845.79 -- 890.79
694 -- 845.82 -- 890.82
695 -- 845.85 -- 890.85
696 -- 845.88 -- 890.88
697 -- 845.91 -- 890.91
698 -- 845.94 -- 890.94
699 -- 845.97 -- 890.97
700 -- 846.00 -- 891.00
701 -- 846.03 -- 891.03
702 -- 846.06 -- 891.06
703 -- 846.09 -- 891.09
704 -- 846.12 -- 891.12
705 -- 846.15 -- 891.15
706 -- 846.18 -- 891.18
707 -- 846.21 -- 891.21
708 -- 846.24 -- 891.24
709 -- 846.27 -- 891.27
710 -- 846.30 -- 891.30
711 -- 846.33 -- 891.33
712 -- 846.36 -- 891.36
713 -- 846.39 -- 891.39
714 -- 846.42 -- 891.42
715 -- 846.45 -- 891.45
716 -- 846.48 -- 891.48
717 -- 846.51 -- 891.51
718 -- 846.54 -- 891.54
719 -- 846.57 -- 891.57
720 -- 846.60 -- 891.60
721 -- 846.63 -- 891.63
722 -- 846.66 -- 891.66
723 -- 846.69 -- 891.69
724 -- 846.72 -- 891.72
725 -- 846.75 -- 891.75
726 -- 846.78 -- 891.78
727 -- 846.81 -- 891.81
728 -- 846.84 -- 891.84
729 -- 846.87 -- 891.87
730 -- 846.90 -- 891.90
731 -- 846.93 -- 891.93
732 -- 846.96 -- 891.96
733 -- 846.99 -- 891.99
734 -- 847.02 -- 892.02
735 -- 847.05 -- 892.05
736 -- 847.08 -- 892.08
737 -- 847.11 -- 892.11
738 -- 847.14 -- 892.14
739 -- 847.17 -- 892.17
740 -- 847.20 -- 892.20
741 -- 847.23 -- 892.23
742 -- 847.26 -- 892.26
743 -- 847.29 -- 892.29
744 -- 847.32 -- 892.32
745 -- 847.35 -- 892.35
746 -- 847.38 -- 892.38
747 -- 847.41 -- 892.41
748 -- 847.44 -- 892.44
749 -- 847.47 -- 892.47
750 -- 847.50 -- 892.50
751 -- 847.53 -- 892.53
752 -- 847.56 -- 892.56
753 -- 847.59 -- 892.59
754 -- 847.62 -- 892.62
755 -- 847.65 -- 892.65
756 -- 847.68 -- 892.68
757 -- 847.71 -- 892.71
758 -- 847.74 -- 892.74
759 -- 847.77 -- 892.77
760 -- 847.80 -- 892.80
761 -- 847.83 -- 892.83
762 -- 847.86 -- 892.86
763 -- 847.89 -- 892.89
764 -- 847.92 -- 892.92
765 -- 847.95 -- 892.95
766 -- 847.98 -- 892.98
767 -- 848.01 -- 893.01
768 -- 848.04 -- 893.04
769 -- 848.07 -- 893.07
770 -- 848.10 -- 893.10
771 -- 848.13 -- 893.13
772 -- 848.16 -- 893.16
773 -- 848.19 -- 893.19
774 -- 848.22 -- 893.22
775 -- 848.25 -- 893.25
776 -- 848.28 -- 893.28
777 -- 848.31 -- 893.31
778 -- 848.34 -- 893.34
779 -- 848.37 -- 893.37
780 -- 848.40 -- 893.40
781 -- 848.43 -- 893.43
782 -- 848.46 -- 893.46
783 -- 848.49 -- 893.49
784 -- 848.52 -- 893.52
785 -- 848.55 -- 893.55
786 -- 848.58 -- 893.58
787 -- 848.61 -- 893.61
788 -- 848.64 -- 893.64
789 -- 848.67 -- 893.67
790 -- 848.70 -- 893.70
791 -- 848.73 -- 893.73
792 -- 848.76 -- 893.76
793 -- 848.79 -- 893.79
794 -- 848.82 -- 893.82
795 -- 848.85 -- 893.85
796 -- 848.88 -- 893.88
797 -- 848.91 -- 893.91
798 -- 848.94 -- 893.94
799 -- 848.97 -- 893.97
There are no existing channel
numbers in the range 800-990.
Band B
Chan Mobile Cell Site
-------------------------
991 -- 824.04 -- 869.04
992 -- 824.07 -- 869.07
993 -- 824.10 -- 869.10
994 -- 824.13 -- 869.13
995 -- 824.16 -- 869.16
996 -- 824.19 -- 869.19
997 -- 824.22 -- 869.22
998 -- 824.25 -- 869.25
999 -- 824.28 -- 869.28
1000 -- 824.31 -- 869.31
1001 -- 824.34 -- 869.34
1002 -- 824.37 -- 869.37
1003 -- 824.40 -- 869.40
1004 -- 824.43 -- 869.43
1005 -- 824.46 -- 869.46
1006 -- 824.49 -- 869.49
1007 -- 824.52 -- 869.52
1008 -- 824.55 -- 869.55
1009 -- 824.58 -- 869.58
1010 -- 824.61 -- 869.61
1011 -- 824.64 -- 869.64
1012 -- 824.67 -- 869.67
1013 -- 824.70 -- 869.70
1014 -- 824.73 -- 869.73
1015 -- 824.76 -- 869.76
1016 -- 824.79 -- 869.79
1017 -- 824.82 -- 869.82
1018 -- 824.85 -- 869.85
1019 -- 824.88 -- 869.88
1020 -- 824.91 -- 869.91
1021 -- 824.94 -- 869.94
1022 -- 824.97 -- 869.97
1023 -- 825.00 -- 870.00
----------------------------------------------------------------------------
Please don't send requests for reposts, missing parts, GIFs, FTP sites,
technical advice, codes, etc. If you find getting text files from this
newsgroup inconvenient, the archive is available on disk. Send a blank email
to hplist@f26.n340.z1.fidonet.org for more information. Authors wishing to
have files added to or removed from the THC Public archive should contact
me at: tommy@f26.n340.z1.fidonet.org.
Please help keep clutter to a minimum - refer comments to e-mail. Thank you.
-=( Tommy )=-
--
/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
-=- CandyMan -=-
http://www.mcs.net/~candyman/
candyman@mcs.com
"If in other lands the press and books and literature of all kinds are
censored, we must redouble our efforts here to keep them free."
-- Franklin Delano Roosevelt
/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
phreak/CELLULAR/cellguide.txt
+216
View File
@@ -0,0 +1,216 @@
*****************
A Cellular Guide*
By: Downtime *
*****************
Contents
~~~~~~~~
1) Some of the Cellular Phone Basics
2) The reason for the name Cellular.
3) Review of the Cellular System.
4) What goes on during Cellular Calling.
5) Cellular Cloning and Other Features.
6) Basic Test Mode Programming
7) What kind of Cellular is Best?
8) Where is the Cellular Technology Going?
9) Closing
_____________________________________________________________________________
" " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " "
Introduction
~~~~~~~~~~~~
We have all seen them, heard about them, and most people use them. What am I
talking about? None other than the Cellular Phone. One of the most interesting
things ever that is associated with the Phreaking Community. This guide will
not tell you how to do illegal things with your cell but this will give you a
basic view of how the cellular phone works. Enjoy!
_____________________________________________________________________________
" " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " "
1) Some of the Cellular Phone Basics
The main thing to remember about a cellular phone is that it is a
radio. It is basically like a hand held walkie talkie except with a cellular
phone you have alot more capabilities and can talk and listen at the same
time. Remember though that when you are talking on a cellular phone what you
say may and possibly will be monitored very easily. There are two main types
of Cellular Phones Analog and Digital.
1) Analog: On this the audio is modulated directly onto a carrier
2) Digital: On Digital, these are converted to digitized samples.
These are transmitted as 1's and 0's. Then it is converted
back to voltage so you get the audio signal.
Each Cellular Phone has to identify itself to its cell site before
service is allowed. They are identified by what is known as an ESN and a MIN.
1) ESN: This stands for Electronic Serial Number. This is a 32-bit
Binary Number if I am not mistaken.
2) MIN: Mobile Identification Number. This is the phone number of the
Cellular Phone. 10 digits including area code and all.
_____________________________________________________________________________
" " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " "
2) The Reason for the name Cellular.
The reason for this is that in each city the Cellular Phone System is
divided into smaller sections also referred to as cells. These usually have an
antenna on top of a high surface that gives out strong signals therefore giving
you clear service.
_____________________________________________________________________________
" " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " "
3) Review of the Cellular System.
The main system operating in the United States is the AMPS, Advanced
Mobile Phone System. The AMPS are composed of two different things:
1) EAMPS: This system has 832 channels.
2) NAMPS: This system has three times the amount with very clear
signals.
All these have 42 channels that are used to setup calls the rest are
for talking over the Cellular Phone.
_____________________________________________________________________________
" " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " "
4) What goes on during Cellular Calling.
Just imagine if you are stranded somewhere or possibly just want to
use your cellular phone to call someone. Have you ever wondered how it worked?
Why it worked? If so then I will explain how and why in this section here.
Enjoy!
1) Scan Channels: In this step the cellular phone scans for the
closest cell site near you so that you can get
the strongest signals possible due to your location
at the moment.
2) Choose Strongest: As stated above the cellular phone finds the
closest site to give you the best performance.
3) Send Message: The phone sends a short message to the cell site
verifying the MIN, ESN, and the number that you
have just entered to call.
4) Assign Channel: After verifying the above information and they
know that you are a legal paying customer, the
base assigns a mesage to your phone, telling it
where the conversation is.
5) Talk: Phone then gets on that channel and begins to ring. Then
you begin to talk like normal. The easiest step of them all.
_____________________________________________________________________________
" " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " "
5) Cellular Cloning and Other Features.
Cellular Cloning is one of the newest and more popular things going
on now a days. What you are basically doing is programming someone else's
MIN and ESN into your phone in the process of fooling your cellsite into
thinking that you are actually them. Is this legal? Well it depends on which
way you use it. If you use it to clone one of your own phones where you can
have two phones exactly the same then no, but if you are cloning someone
else's then yes it is very illegal. The philosophy of a cellular phone phreak
as stated in another text written by John Markoff is to push the machines as
far as they would go. The possibilites with a cellular phone are practically
endless. You can make one into a scanner as well as many other things.
The first step of being able to do ANY of this is getting the cellular
phone into what people call test mode. This is where you can practically change
the whole phone's features. The main way to get into this is to crack the access
code. There is a good site that deals with that at the following URL:
http://www.radiophone.com They have great information. Another way to get a
cellular phone is by taking the battery pack off of the back and look in the
lower corner. Here you will see some little prongs, you can get a small piece
of tin foil and place it in the center of the prong like so: |*|
then put the battery pack back on the back of the phone. Then turn the phone
on and when you turn it on you should see an array of flashing numbers. If
so you are in luck because you are in test mode! :)~
_____________________________________________________________________________
" " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " "
6) Basic Test Mode Programming
This section will tell you what to do once you get into the test mode.
This part comes from 1993 Cellular Subscriber Technical Training Manual. I
give full credit to them for this information. I am not going to include all
of it because it would take forever. Here are some of the basics. Enjoy!
32# = clear the phone
38# = displays the ESN
55# = test mode programming
01# = restart
13# = power off
16# = setup
18# = send NAM
34# = turn DTMF off
61# ESN transfer
That is jsut some of the very basics. Of course there is alot more
and if I ever write another article with Cellular Phones I will include some
more. Don't want to get very much ahead of ourselves. :)
_____________________________________________________________________________
" " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " "
7) What kind of Cellular is Best?
There are different kinds of cellular phones for different kind of
people. Me personally I have experience so far with only Motorola. I plan to
get a Nokia soon. Nokia are very advanced and have many options. There is also
the OKI those have been stated to be good. The one that interests me at the
moment are these new ones that are Java based. If you would like to read more
about these go to the following URL:
http://www.nortel.com/cool/norteledge/edge298/N._IP_N.html
But as stated above many people like many different things, there is
also a new Motorla that is the IDEN I10000. These have two-way radio and
alphanumeric pager in one. These weigh in at around 5 oz. as well.
They also include: One touch call back, a speakerphone, and a multilanguage
operation that displays prompts in one to four different languages. For more
information on this you can call: 1.800.453.0920
_____________________________________________________________________________
" " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " "
8) Where is the Cellular Technology Going?
This is a very interesting thing to think about including all the
things that they already have out and available at this point in time. There
is no way to actually predict what is going to come out next due to people
having new ideas with each and every passing day. It should be an interesting
thing to think forward about. Whatever it is, it will turn heads I am sure!
_____________________________________________________________________________
" " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " "
9) Closing
We have seemed to read the end of this guide. I hope this has been
an informative source and you enjoyed it. I will probably write another cellular
guide in the future but am not sure at the moment. Remember "Push the Machine
as Far as it will Go!" =)
_____________________________________________________________________________
" " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " " "
10) Shout Outs
1) DarkCyde: Keeping it real!
2) #9x: Great channel
3) Slinker aka _14k4: For getting me interesting
4) T0n3 K1LL4H: For being there for me
5) GrinnDaddy: Helping me along the way
6) Sparky: Being a good friend
7) Twisted Nickel:
Sim
Digital Fokus
Voltage
Vyle
If I left any of ya guys out, ya know who ya are!
EOF
phreak/CELLULAR/cellhow.txt
+39
View File
@@ -0,0 +1,39 @@
Here is a method of determining which freqs are used in a cellular
system, and which ones are in what cells. If the system uses
OMNICELLS, as most do, you can readily find all the channels in a
cell if you know just one of them, using tables constructed with
the instructions below.
Cellular frequencies are assigned by channel number, and for all
channel numbers, in both wireline and non-wireline systems, the
formula is:
Transmit Freq = (channel number x .030 MHz) + 870 MHz
Receive Freq = (channel number x .030 Mhz) + 825 Mhz
"Band A" (one of the two blocks) uses channels 1 - 333. To
construct a table showing frequency by cells, use ch 333 as the
top left corner of a table. The next entry to the right of
ch 333 is 332, the next is 331, etc., down to ch 313. Enter
ch 312 underneath 333, 311 under 332, etc. Each channel across
the top row is the 1st chan in each CELL of the system; each
channel DOWN from the column from the the first channel is the
next freq assigned to that Cell. You may have noted that each
channel down is 21 channels lower in number. Usually the data
channel used is the highest numbered channel in a cell.
"Band B" uses channels from 334 to 666. Construct your table in a
similar way, with ch 334 in the upper left corner, 335 the next
entry to the right. The data channel should be the lowest numbered
channel in each cell this time.
The tables generated by these instructions are found in the file
named "CELLPLAN.TXT"
Channel 3 (394) Tx 881.820 Rx 836.820
Channel 4 (415) Tx 882.450 Rx 837.
End of list.

phreak/CELLULAR/cellinfo.phk
+84
View File
@@ -0,0 +1,84 @@
Cellular Phreaking Theory
The cellular/mobile phone system is one that is perfectly set up to be
exploited by phreaks with the proper knowledge and equipment. Thanks to
deregulation, the regional BOC's (Bell Operating Companies) are scattered and
do not communicate much with each other. Phreaks can take advantage of this
by pretending to be mobile phone customers whose "home base" is a city served
by a different BOC, known as a "roamer". Since it is impractical for each BOC
to keep track of the customers of all the other BOC's, they will usually allow
the customer to make the calls he wishes, often with a surcharge of some sort.
The bill is then forwarded to the roamer's home BOC for collection. However,
it is fairly simple (with the correct tools) to create a bogus ID number for
your mobile phone, and pretend to be a roamer from some other city and state,
that's "just visiting". When your BOC tries to collect for the calls from
your alleged "home BOC", they will discover you are not a real customer; but
by then, you can create an entirely new electronic identity, and use that
instead.
How does the cellular system know who is calling, and where they are?
When a mobile phone enters a cell's area of transmission, it transmits its
phone number and its 8 digit ID number to that cell, who will keep track of it
until it gets far enough away that the sound quality is sufficiently
diminished, and then the phone is "handed off" to the cell that the customer
has walked or driven into. This process continues as long as the phone has
power and is turned on. If the phone is turned off (or the car is), someone
attempting to call the mobile phone will receive a recording along the lines
of "The mobile phone customer you have dialed has left the vehicle or driven
out of the service area." When a call is made to a mobile phone, the
switching equipment will check to see if the mobile phone being called is
"logged in", so to speak, or present in one of the cells. If it is, the call
will then act (to the speaking parties) just like a normal call - the caller
may hear a busy tone, the phone may just ring, or the call may be answered.
How does the switching equipment know whether or not a particular
phone is authorized to use the network? Many times, it doesn't. When a
dealer installs a mobile phone, he gives the phone's ID number (an 8 digit
hexadecimal number) to the local BOC, as well as the phone number the BOC
assigned to the customer. Thereafter, whenever a phone is present in one of
the cells, the two numbers are checked - they should be registered to the same
person. If they don't match, the telco knows that an attempted fraud is
taking place (or at best, some transmission error) and will not allow calls to
be placed or received at that phone. However, it is impractical (especially
given the present state of deregulation) for the telco to have records of
every cellular customer of every BOC. Therefore, if you're going to create a
fake ID/phone number combination, it will need to be "based" in an area that
has a cellular system (obviously), has a different BOC than your local area
does, and has some sort of a "roamer" agreement with your local BOC.
How can one "phreak" a cellular phone? There are three general areas
when phreaking cellular phones; using one you found in an unlocked car (or an
unattended walk-about model), modifying your own chip set to look like a
different phone, or recording the phone number/ID number combinations sent by
other local cellular phones, and using those as your own. Most cellular
phones include a crude "password" system to keep unauthorized users from using
the phone - however, dealers often set the password (usually a 3 to 5 digit
code) to the last four digits of the customer's mobile phone number. If you
can find that somewhere on the phone, you're in luck. If not, it shouldn't be
TOO hard to hack, since most people aren't smart enough to use something
besides "1111", "1234", or whatever. If you want to modify the chip set in a
cellular phone you bought (or stole), there are two chips (of course, this
depends on the model and manufacturer, yours may be different) that will need
to be changed - one installed at the manufacturer (often epoxied in) with the
phone's ID number, and one installed by the dealer with the phone number, and
possible the security code. To do this, you'll obviously need an EPROM burner
as well as the same sort of chips used in the phone (or a friendly and
unscrupulous dealer!). As to recording the numbers of other mobile phone
customers and using them; as far as I know, this is just theory... but it
seems quite possible, if you've got the equipment to record and decode it.
The cellular system would probably freak out if two phones (with valid
ID/phone number combinations) were both present in the network at once, but it
remains to be seen what will happen.
Note/Disclaimer: Ok, I don't pretend to know everything about
cellular phones; I've screwed around with them a little, but I figured I'd
make a file with the things I've learned about them, to at least share what I
know and possible bring about further discussion.
Downloaded From P-80 Systems - 304-744-2253 - Since Halloween 1980
phreak/CELLULAR/cellman.txt
+757
View File
@@ -0,0 +1,757 @@
--->> LEECHED FROM - THE RaDiANCE US HEADQUARTERS - LEECHED FROM <<---
__/\______________________________ _________ _______________ _________/\__
\/ ___________ \ | Y | | _/ \ |/
_\____ \| | /\____| | |____ | | |___\____| |
| ø| \ _____/ / ø|ø \ / | | | / ø|
| :| / \ / | :|: \\ | / | :|
|___________/|______\ \__________|_______\\_________|_______\__________|
::: __/\_______ _______________ ___ ___/\__ :::
:: SySoP: \/ | _/ Y | |/ C0's: ::
: IlluVaTaR / |____| | |____ | | REMOTE :
. .:/ | | ø|ø \ \_____ |:. & HALFAST .
. . . ::::\ | | :|: \ | | |:::: . . .
[RiP!] . . :::::::\__________|_____|_______\|__________|:::::: . . [RiP!]
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:::: NODE 1: +1-707-451-2835 ::>-RINGDOWN->:: NODE 2: +1-707-453-0210 ::::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
!21.6k HST DUAL, 68030 POWER, 677 MeGZ <-> C0NSOLE / AMiGA / H-P-A ONLiNE!
::: 0-1 DaY WaReZ OnLy! SiGMA-X BeTa, PluS ThE CoOleST UsErS aNd UtiLs!:::
:::::::::::::::::: ALWaYZ FaST, DON'T CALL iF Ya AiN'T! ::::::::::::::::::
:NuP : SaFE:::::::::::::::::::::::::::::::::::::::::::::::::::NuP : SaFE :
--------------------------------------------------------------------------
@BEGIN_FILE_ID.DIZthe ultimate cellular phone phreaking man
@END_FILE_ID.DIZ
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
THE HIGH TECH HOODS and
A-CORP PRESENTS.....
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%% %%%
%%% THE ULTIMATE CELLULAR %%%
%%% PHONE PHREAKING %%%
%%% MANUAL #1 of 2. %%%
%%% %%%
%%% COMPILED BY %%%
%%% THE RAVEN %%%
%%% %%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
INDEX....
I. Improved Mobile Telephone Service (IMTS)
II. General Information
III. Cellular Freqs. & Channels
IV. The Cell & It's Structure
V. Equipment Description
VI. More General Info.
VII. Roaming
VIII. NOTE
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
CELLULAR PHREAKER TYPES
-----------------------
There are two types of cellular phone phreakers. The first type is the one
whos's intrested in scanning cellular phone channels basically to overhear
conversations. The second type is the one who obtains and modifies cellular
equipment so that he can make free phone calls at someone elese's expense.
I. IMPROVED MOBILE TELEPHONE SERVICE
This system that was used prior to cellular phones was the Improved Mobile
Telephone Service (IMTS), which was much easier to scan for.
Most scanner enthusiasts are familiar with this standard mobile phone
system; this system has gone thru little evolution in the past decade in the
U.S. It has remained a considerably limited service. A large metro area may
only have several hundred users, (New York City has about 900 mobile phone
subscribers) dur largely to limitations imposed by spectral overcroeding.
Land mobile commo has seen a 10-12% annual growth rate for the past two
decades. The result is that the 40, 150 and 450 MHZ bands are overcrowded.
Even the utilization of the new 900 MHZ band (with 30-40 times more channels
available than other bands) is a short-lived solution to the problem.
IMTS freqs (MHZ):
Channel Base Freq. Mobile Freq.
-----------------------------------------
VHF LOW BAND
ZO 35.26 43.26
ZF 35.30 43.30
ZH 35.34 43.34
ZA 35.42 43.32
ZY 35.46 43.46
ZR 35.50 43.50
ZB 35.54 43.54
ZW 35.62 43.62
ZL 35.66 43.66
VHF HIGH-BAND
JL 152.51 157.77
YL 152.54 157.80
JP 152.57 157.83
YP 152.60 157.86
YJ 152.63 157.89
YK 152.66 157.92
JS 152.69 157.95
YS 152.72 157.98
YA 152.75 158.01
JK 152.78 158.04
JA 152.81 158.07
UHF BAND
QC 454.375 459.375
QJ 454.40 459.40
QD 454.425 459.425
QA 454.45 459.45
QE 454.475 459.475
QP 454.50 459.50
QK 454.525 459.525
QB 454.55 459.55
QO 454.575 459.575
QA 454.60 459.60
QY 454.625 459.625
QF 454.650 459.650
The VHF high-band freqs. are the most popular IMTS channels. If you live
within 25-50 miles of even a moderate sized town, you should have at least
one VHF high-band channel. VHF low-band IMTS is used in rural areas and
those with hilly terrain. UHF IMTS is primarily used in cities where the
VHF channels are crowded. If you live in a major city, expect to have most,
if not all, of these channels available to you.
II. GENERAL CELLULAR INFO
This section is a little boring but it's needed to set a basic foundation
of cellular phone phreaking so that part 2 doesn't sound like all
technicial talk!
The FCC originally estaablished 3 cellular bands. One was given to the local
Bell or Telco, (wireline carrier), one to an independent firm (non-wireline
carrier), and one reserved for future use. Originally there were 666 cellular
freqs or channels. In recent years the FCC has tacked on another 156 freqs
for a total of 832 freqs, and all cellular makers have upgraded their phones
to accomodate the new channels. Some of the new channels appears above the
original 666 while others appear below.
The cellular system cannot know whether or not a cellular phone can be
switched to one of the 156 channels without the phone telling it. This is done
by the Station Class Mark (SCM), which is a 4-bit binary number.
(1) Bit #1 is "0" for 666 and "1" for 832
(2) Bit #2 is "0" for a mobile unit and
"1" for a voice activated transmit.
(That saves batteries on portables.)
(3) Bit #3 and #4 identify the power class
of the phone:
"00" = 3 watts
"01" = 1.2 watts
"10" = 0.6 watts
and "11" is not assigned.
The old traditional scheme for handling cellular traffic is the analog
method or Frequency-Divison Multiple Access (FDMA). How the FDMA works is
that free channels are found and each transmitter is assigned to one of them.
When the call finishes, th echannels are freed up for the next call. Also, as
the two parties become physically closer or more distant as they drive or
travhghhggytel the call may be handed off to other freqs assigned to the new cells
they are in.
Newer proposed schemes include Time-Divison Multiple Acess (TDMA) and Code-
Divison Multiple Acess (CDMA). IN TDMA systems, calls may simultaneously use
the same channels but are interspered between the pauses in the conversation.
Many pauses result not only in the way people normally think and talk but when
one party is talking, the other is listening. With TDMA, the Cellular Phone
Company (CPC) injects small delays in parts of conversations to accommodate
other traffic on that channel. This increases the lenght of the average phone
call, which also increases their profits from it - not to mention the fact
that they can increase there output by the factor of 3 and also then expand
their operation.
CDMA is a system that's been used by military for the past 30+ years. CDMA
appears to basically be a system where conversation are compressed into coded
bundles and then decompressed at the other end.
A Cellular Mobile Telephone (CMT) is one that is installed in a vehicle,
aircraft, watercraft or whatever, as opposed to a transporable or portable
unit.
III. CELLULAR FREQS & CHANNELS
There are 832 cellular phone channels. 416 of these are allocated for the
non-wireline services (Band A), and 416 for the wireline services (Band B).
Each of these channels have two freqs, spaced 45 MHZ apart, that operate in
a full-duplex mode. The lower freq is for the phone unit, while the upper is
for the cell or basesite. Of the 416 channels, 21 are digital data control or
"set up" channels and 395 are voice channels. Channels are numbered 1 thru
1023, and there is a gap from 800 to 990.
Rather than producing a list of 1646 cellular freqs, I have provided the math
eqations that can be used to calculate them. These equations can be programmed
into computers and calculators.
N = Cellular Channel # F = Cellular Freq
B = 0 (mobile), or B = 1 (base)
CELLULAR FREQS from CHANNEL #S:
-------------------------------
F = 825.030 + B*45 + (N-1)*.03
WHERE: n = 1 to 799
F = 824.040 + b*45 + (N-1)*.03
where: N = 991 to 1023
CELLULAR CHANNEL #s from FREQS:
-------------------------------
N = 1 + (F-825.030-B*45)/.03
Where: F > = 825.030 (mobile)
or F > = 870.030 (base)
N = 991 + (F-824.040-B*45)/.03
Where: F < = 825.000 (mobile)
or F < = 870.000 (base)
If the system uses OMNICELLS, as most do, you can readily find all the
channels in a cell if you know just one of them, using tables constructed
from these equations. Band A uses channels 1-333 under the old 666-channel
system. To that have been added 667-716 and 991-1023 under the new 832-channel
system. Band B uses channels from 334-666 under the old system, plus 717-799
under the new system.
IV. CONTROL & VOICE CHANNEL ALLOCATIONS
---------------------------------------
(D=DESIGNATOR, CC=CONTROL CHANNEL, VC=VOICE CHANNEL)
NON-WIRLELINE SERVICES (BAND A)
-------------------------------
D = 1A : CC = 313 : VC = 1,22,43,64,85,106,127,148,169,190,211,232,253,274,
295,667,688,709,1003
D = 2A : CC = 314 : VC = 2,23,44,65,86,107,128,149,170,191,212,233,254,275
296,668,689,710,1004
D = 3A : CC = 315 : VC = 3,24,45,66,87,108,129,150,171,192,213,234,255,276
297,669,690,711,1005
D = 4A : CC = 316 : VC = 4,25,46,67,88,109,130,151,172,193,214,235,256,277
298,670,691,712,1006
D = 5A : CC = 317 : VC = 5,26,47,68,89,110,131,152,173,194,215,236,257,278
299,671,692,713,1007
D = 6A : CC = 318 : VC = 6,27,48,69,90,111,132,153,174,195,216,237,258,279
300,672,693,714,1008
D = 7A : CC = 319 : VC = 7,28,49,70,91,112,133,154,175,196,217,238,259,280
301,673,694,715,1009
D = 1B : CC = 320 : VC = 8,29,50,71,92,113,134,155,176,197,218,239,260,281
302,674,695,716,1010
D = 2B : CC = 321 : VC = 9,30,51,72,93,114,135,156,177,198,219,240,261,282
303,675,696,1011
D = 3B : CC = 322 : VC = 10,31,52,73,94,115,136,157,178,199,220,241,262,283
304,676,697,991,1012
D = 4B : CC = 323 : VC = 11,32,53,74,95,116,137,158,179,200,221,242,263,284
305,677,698,992,1013
D = 5B : CC = 324 : VC = 12,33,54,75,96,117,138,159,180,201,222,243,264,285
306,678,699,993,1014
D = 6B : CC = 325 : VC = 13,34,55,76,97,118,139,160,181,202,223,244,265,286
307,679,700,994,1015
D = 7B : CC = 326 : VC = 14,35,56,77,98,119,140,161,182,203,224,245,266,287
308,680,701,995,1016
D = 1C : CC = 327 : VC = 15,36,57,78,99,120,141,162,183,204,225,246,267,288
309,681,702,996,1017
D = 2C : CC = 328 : VC = 16,37,58,79,100,121,142,163,184,205,226,247,268,289
310,682,703,997,1018
D = 3C : CC = 329 : VC = 17,38,59,80,101,122,143,164,185,206,227,248,269,290
311,683,704,998,1019
D = 4C : CC = 330 : VC = 18,39,60,81,102,123,144,165,186,207,228,249,270,291
312,684,705,999,1020
D = 5C : CC = 331 : VC = 19,40,61,82,103,124,145,166,187,208,229,250,271,292
685,706,1000,1021
D = 6C : CC = 332 : VC = 20,41,62,83,104,125,146,167,188,209,230,251,272,293
686,707,1001,1002
D = 7C : CC = 333 : VC = 21,42,63,84,105,126,147,168,189,210,231,252,273,294
687,708,1002,1023
WIRELINE SERVICES (BAND B)
--------------------------
D = 1A : CC = 334 : VC = 355,376,397,418,439,460,481,502,523,544,565,586,607
628,649,720,741,762,783
D = 2A : CC = 335 : VC = 356,377,398,419,440,461,482,503,524,545,566,587,608
629,650,721,742,763,784
D = 3A : CC = 336 : VC = 357,378,399,420,441,462,483,504,525,546,567,588,609
630,651,722,743,764,785
D = 4A : CC = 337 : VC = 358,379,400,421,442,463,484,505,526,547,568,589,610
631,652,723,744,765,786
D = 5A : CC = 338 : VC = 359,380,401,422,443,464,485,506,527,548,569,590,611
632,653,724,745,766,787
D = 6A : CC = 339 : VC = 360,381,402,423,444,465,486,507,528,549,570,591,612
633,654,725,746,767,788
D = 7A : CC = 340 : VC = 361,382,403,424,445,466,487,508,529,550,571,592,613
634,655,726,747,768,789
D = 1B : CC = 341 : VC = 362,383,404,425,446,467,488,509,530,551,572,593,614
635,656,727,748,769,790
D = 2B : CC = 342 : VC = 363,384,405,426,447,468,489,510,531,552,573,594,615
636,657,728,749,770,791
D = 3B : CC = 343 : VC = 364,385,406,427,448,469,490,511,532,553,574,595,616
637,658,729,750,771,792
D = 4B : CC = 344 : VC = 365,386,407,428,449,470,491,512,533,554,575,596,617
638,659,730,751,772,793
D = 5B : CC = 345 : VC = 366,387,408,429,450,471,492,513,534,555,576,597,618
639,660,731,752,773,794
D = 6B : CC = 346 : VC = 367,388,409,430,451,472,493,514,535,556,577,598,619
640,661,732,753,774,795
D = 7B : CC = 347 : VC = 368,389,410,431,452,473,494,515,536,557,578,599,620
641,662,733,754,775,796
D = 1C : CC = 348 : VC = 369,390,411,432,453,474,495,515,537,558,579,600,621
642,663,734,755,776,797
D = 2C : CC = 349 : VC = 370,391,412,433,454,475,496,516,538,559,580,601,622
643,664,735,756,777,798
D = 3C : CC = 350 : VC = 371,392,413,434,455,476,497,517,539,560,581,602,623
644,665,736,757,778,799
D = 4C : CC = 351 : VC = 372,393,414,435,456,477,498,518,540,561,582,603,624
645,667,737,758,779
D = 5C : CC = 352 : VC = 373,394,415,436,457,478,499,519,541,562,583,604,625
646,668,738,759,780
D = 6C : CC = 353 : VC = 374,395,416,437,458,479,500,520,542,563,584,605,626
647,669,739,760,781
D = 7C : CC = 354 : VC = 375,396,417,438,459,480,501,522,543,564,585,606,627
648,719,740,761,782
To summarize how a cellular call is made: A mobile unit wishing to make a
call will go off-hook and then transmit the digital source and destination
codes on a control channel (used to set-up and monitor the call), and are
just strong enough to reach the base station in the local cell. Upon getting
this data, the base, thru its control freq (same channel), validates the
mobile unit.
The base station then fowards a message to the central switching office on
a land line, which in turn sends the paging signal to all cells in search of
the second mobile unit whos number has been dialed. When the destination unit
is finally found, it responds to the paging signal by transmitting an
acknowledgement code to its local base station on a control channel.
The switching center then assigns a pair of unused freqs (called the,
"channel Pair") to each of the unit for actual voice commo to take place.
These channel pairs are not neccesarily the same for the respective cells
that each mobile unit is in. These freqs are also relayed thru the base
stations and to the central switching office.
When a unit moves into another cell, things get very interesting. Upon
entry into another cell, the mobile unit must transmit thru a new base
station. An automatic handoff to the new base station is carried out by
another exchange of data thru the control channel.
Termination of the call is a simple matter. When the call ends,ON-hook
signals are exchanged via the control channels between the mobile unit and
the base station. The voice channels are then cleared.
IV. THE CELL & IT'S STRUCTURE
The cellular phone system uses a "honeycombed" hexagonal cell architure.
Each of the cell types (A-G) differ from each other only in the freqs.
allocated for them. This represents how a cellular system might be laid out.
Cells A and B never share a common border. Neither do B and C, A and G,
etc. Cells that are next to each other are never assigned adjacent freqs.
They always differbu\y at least 60 KHZ. To track a mobile phone as it
changes cells, lets put the mobile in a B cell. When the mobile switches
freqs. you know that it could only go to a D, E, F, or G cell because A and
C have adjacent freqs. The two tables below will help you determine which
Channel cell can go next to each other. You can contact your local cellular
phone company and see if they have any maps of the cell available in your
area (please get a copy for us also). They're not obligated to give you maps
but it's worth the try.
ADJACENT CELLS
--------------
Cell Adjacent cells
A C,D,E,F
B D,E,F,G
C E,F,G,A
D F,G,A,B
E G,A,B,C
F A,B,C,D
G B,C,D,E
The only fundamental point of cellular technology actually agreed upon to
date is that a given service area will be divided into identical adjacent
cells with no overlaps and no gaps. The hexagon is the standard cell
patteren. At the center of an individual cell is a base station which is
conected via land line to a local mobile phone switching office. Certain
freq bands are assigned to certain cells, but not shared with adjacent cells
to avoid mutual interference.
In 1979, AT&T began test marketing its version of a cellular phone system
in Chicago. This system is call the Advanced Mobile Phone System (AMPS)
Some 2100 sq miles of the metro Chicago area are divided into 10 cells to
serve about 2000 customers. Full duplex is possible by using a pair of one
way channels separated by 45 MHZ to connect the mobile units with the base
stations. The RF range is 825-890 MHZ and normal narrow band FM is used to
transmit voice. Hand-off to adjacent cells is accomplished by monitoring
signal strengths. When the central switching office determines that a new
base station receives the mobile signal better than the previous one, the
switching office signals thru the voice channel for the mobile phone to
switch to a new channel. Commo distruption thru the switching process is
typically 50 milliseconds.
As with IMTS, there is the possibility of phreaking calls with IMTS or AMPS
simply by monitoring the control channels since they are in dial pulse form.
After you have a nice set of numbers, you will neeed a transmitter of
sufficient strenght to reach the base station (unlicenced transmitter of
course!). Duhh
Many regulatory and implementation issues remain unsolved. Modulation issues
are the biggest problem to be solved. Single sideband AM, narrow band FM,
digital and spread-spectrum techniques are all being considered. If you have
any info that may be able to break this down for fellow hackers/phreaks
please leave me mail.
V. EQUIPMENT DESCRIPTION
Most mobile phones have two primary pieces of equipment. These are the
transceiver (transmitter-receiver pair) and the control head.
The transceiver is usually a metal box with three connectors. They usually
contain two circuit boards. One is the transceiver unit itself, and the other
is a logic board consisting of a uP, ADC and DAC, and control logic. The
transceiver is usually mounted in the trunk or sometimes under the hood, and
is connected to both the ignition switch and car battery. A control/audio
(shielded) links the equipment together.
The control head is a touch-tone phone handset with the extended keypad,
alphanumeric display and controls (i.e. mike, volume). Usually there is a
separate speaker installed in the cradle for on-hook dialing, call progress
monitoring and speakerphone operation. If the CMT has a speaker phone option
a small mike is usually mounted to the sun visor. Some cellular phones are
voice-activated. If battery-operated, this saves the battery and also makes
answering the phone easier. The control head and cradle assembly is usually
bolted to the hump between the two front seats for security purposes.
Most early CMT's use the AMPS bus (developed by AT&T) which uses a system
of 36 wires in a rather bulky and stiff control/audio cable. Some makers now
use their own bus, such as Novatel's serial bus, which specifies a thin cable
consisting of a few wires, and is much easier to install and dependable to
use. In almost all cases, a CMT is powered by regulated 12 volts from standard
13.8 volt car battery. At least 5 amps (continuous) is required.
Mobile cellular antennas are usually short (less than one foot long),
vertically-mounted stiff wire with a few turns in the middle that acts as a
phasing coil in a 5/8-wave configuration. The antenna is generally mounted
either thru a hole in the roof or at the top of the rear winshield using
silicone rubber cement with conductive plates on both sides to pass the RF
thru the glass (some RF losses result from this method but you don't have to
maim your vehcle). A 50 ohm coax cable (ex: RG-58/U) links the antenna to the
transceiver with a male TNC type UHF connector. A ceramic duplexer permits
the transmitter and receiver to share the same antennas at the same time.
CMT roof-mounted monopole antennas are designed to work with the ground
plane (ie: the vehicle's body, if metal). However, for fixed (ie: home-base)
use, an "extended-feed" or voltage-fed coaxial antenna (requires no ground
plane) can be used. A capped PVC pipe makes an ideal rooftop housing for
this type of antenna-both weatherprofing and concealing it. Note that altho
cellular systems are designed for inefficient antennas, for fixed use it is
preferred that you use the best antenna you can get.
Interfacing audio devices (ex Blue Boxes, other tone generators) to a CMT
can be done by coupling the device's output thru an audio coupling
transformer wired across the control head's mike lines. A 600-ohm audio
coupling antenna is availble from Radio Shack (273-1374). Be sure to DC
isolate the phon circuity by wiring the transformer in series with a
non-polarized capacitor of at least 1.0 uF and 50 volts. If you can locate
the bus that carries the audio, then coupling across it is preferred.
An acoustic modem can be coupled to a CMT eithrer thru the mouthpiece or by
connecting the mike and speaker wires to those in the control head or bus
lines. Any direct-connect devices (ex: answering machines, modems, standard
phones, etc) can be connected to a CMT thru the AB1X cellular interface
made by : Morrison & Dempsey (818 993-0195). This expensive device is
basically a 1-line PBX that connects between the transceiver and control
head and provides an RJ-11C (quick-connect) jack that accepts any direct-
connect phone accessory. It recognizes both touch-tone and pulse dialing,
provides the ringing voltage and generates dial and busy tones as needed.
VI. GENERAL PHREAKING INFO
----------------------
Some Definitions:
* Control Channel: The channel the phone and cell base first communicate on.
* Reverse Control Channel: The opposite freq, 45MHZ lower then the control
channel. This is where the mobile unit is.
* Voice Channel: The channel you are assigned by the switch to start the call
after the exchange of suscriber data.
* Revese Voice Channel: Again 45 MHZ lower.
* Switch: The computer that places the calls, and takes and receiver data
from the subcriber or from the PSTN. (Pubic Swithced Telephone Network). That
should get things started. A suscriber picks up his handset to place a call.
QUESTIONS AND ANSWERS
---------------------
The following questions & answers were taken from THE SOURCE BBS a.k.a.
THE NEW YORK HACK EXCHANGE
BCOM> I want to get into cellular phone phreaking but I dont know anything so
I'm depending on you guys to help me out from the VERY basics!
What is cellular; a cellular phone?
RAVEN> A 800 MHZ radiotelephone, running 3 watts, with the ability to change
channel on computer command from the central swith. This happens when
you travel thru the service area and your signal becomes stronger at a
neighboring cell base station.
BCOM> They are marketed as a high security device with no possibility of
anyone making a phoney call & charging it to someone else, how can it
be phreaked?
RAVEN> An understanding of the phone revels that every time a call is made,
the phone number, an electronic serial number, and oother data is sent
to the switch. If you were to listen to the opposite side of the
control channel as the cell is being "set up" you would hear this data
being transmitted to the switdch in NRZ (Non-Return to Zero) code.
All one has to do, is record this info and program the bogus phone to
these params, and then a free call is possible thru the switch.
BCOM> Has anyone done this yet?
RAVEN> HELL YEA! about 6 months after the first cellular phone system was
"turned-up", a technician programmed a Panasonic telephone with a
NEC ESN (Electronic Serial Number). And there have been many other
cases since then. With the popular ROM programmers avaible today,
almost any NAM (NUmeric Assignment Module) can be duplicated or
copied with changes. (The NAM is the heart of the billing info and
contains the phone number but not the ESN) The most popular integrated
circut for NAMs is the 74LS123.
BCOM> Sounds like a lot of trouble, is there easier ways to get service?
RAVEN> SURE, the cellphone companies have been their own downfall, In an
effort to market their wares as a universal service. Nobody can tell
if a phone from another city (that has a roaming agreement) is valid
until its too late. The only thing they could do after finding out is
block any call with bad ESN because as we know, the phone number is
easy to change, but the ESN is not.
So here's a likely scenario====> A roamer identifying itself as a number
from a Chicago non-wireline accesses a cellular system in Dallas. An operator
may intervene but you can usually BS or "Social Engineer" them as long as
you know the data you have programmed into your phone. Then you make calls
just like your a local user. If your found out, you change the number to
another, and see if that works.
The phone is locked onto the strongest control channel in the area by a
computerized scanner in the phone. As the user drives thru the service, a
computer constantly picks out the strongest control channel and stays on it,
altho more than one cell site can actually be herd. The subcriber enters
the number to call on the keypad, and presses the "send" button.
At this time the following data is transmitted to the cell site by the
mobile. The callers ESN, his home system number (two digits), his mobile's
area code and phone number, and the called number. The cellular switch now
picks up an outgoing line, places the call for him and tells the mobile unit
to switch to a voice channel. The two ends are linked in the central switch
and the two parties are connected up in about 3 seconds.
I have purposely over-simplified the whole process to point out the moment
of truth. The mobile's ESN and phone number and data in the switch must match
or no go. This is required for billing purposes. If one had the ESN and the
mobile phone number, he could then calll anytime anyplace without fear of a
trace - let alone a bill. The ideal setup would let you listen to the reverse
control channel, record and display herd working numbers and ESN's, and
recall them as one needs them to make calls.
This would be it but we are not quite there yet. But some hard work has
already been done for us. All the aforementioned codes are sent in hex, in
NRZ code (phancy term for phase shift keying), but the phone already has, for
example, a NRZ receiver and transmitter built right into it. All that has to
be done is to have a receiver on the reverse control channel, recover the
other users data and save it or at least print it out.
The mobile radio data book show some good technical info on the systems used
and chip part numbers for the NRZ stuff. For example, at least one cellular
phone maker uses the 8085 chip for the control head functions - a popular
and well understood chip by many.
Most cellular phones include a crude password system to keep unauthorized
users from using the phone - however, dealers often set the password (usually
a 3 to 5 digit code) to the last four digits of the mobile phone or there
home phone. If you can find it somewhere on the phone then your in luck!!
If you can't find it then I guess you gotta hack it. It souldn't be that
hard since most people aren't smart enogh to use something besides "11111",
"12345", or whatever, it will be like Hacking a VMB.
If you want to modify the chip set in the cellular phoneyou got, there are
two chips (of course this depends on the model and maker - your may be
different) that will need to be changed - one installed by the maker usually
eepoxied in with the phone's ID number, and one installed by the dealer with
the phone number, and possible the security code. To do this youll obviously
need an EPROM (Erasable Programmable Read-Only Memory) burner, as well as the
same type of chips used in the phone (or a friendly & unscruplus dealer!).
As to recording the numbers of other mobile phone customers and using them;
as far as I know it is quite possible, if you got the equipment to record and
decode it. The cellular system would possibly freak out if two phones (with
valid ID/phone number combinations) were both present in the network at once,
but it remains to be seen what will happen.
The MIN is the Mobile Identification Number (includes the phone number, and
it is stored on the NAM ROM). Stolen and spoofed ESN's and MINs are good for
about a month. Once a bad MIN is revealed, the legit user's MIN is changed
by the Mobile Telephone Switching Office (MTSO) and they arrange for a new
NAM ROM to be installed in the users legit unit. Of course MTSO keeps a
database of all legit,illegit and deadbeat MIN/ESN pairs. However, the MTSO
will allow a illegit MIN/ESN pair to continue to function beyond its
discovery in hopes of discovering who the phreaks are.
One of the properties of cellular phone system is that the transmitter
freqs may be changed or "hopped" in the constant effort to allocate freqs.
Because of freq. hopping it is very difficult triangulate a CMT using
standard RF directional finding methods. It is known that a directional
antenna randomly aimed at cellsite repeaters will confuse directional finding
equipment being used by them that is synced to their freq. hopping scheme.
ROAMING
Since cellular technology often results in physical seperation between the
caller and-or callled party from landlines, because it offers thousands of
lines to choose from, because freq. hopping occurs, and because the caller
and-or called party can be rapidly moving from one location to another,
cellular phnes are the safest form of phreaking. "Roaming" is one form of
cellular phreaking.
Roaming occurs when a CMT is used in a cellular system other than the one
indicated in the NAMs SID. This is called "ROAMmode", and the ROAM indicator
on the control head will light. A CMT can roam into any system its home CPC
has a roaming agreement with, and most CPC's now have roam agreements with
each other. Not every system pays attention to a "Roamer" from outside the
system as cosely as they do a local suscriber. In their mad rush to offer
cellular as "universal" service, they screwed up. If there's no roam
agreement, the MTSO will transmit a recorded message to the CMT with some
instructions to call the CPC, and gives his name ,MIN,ESN and credit card
number. All roamed calls will then be completed by the MTSO and billed to the
credit card account. This procedure is becomming less common as more roam
agreements are made.
Usually, CPC can only determine if a roamer came from a system with which
it has a roaming agreement - nit the creditworthiness of the roamer.
Consequently, many CPCs have been ripped-off by roamers who've been denied
service on their home system because they are deadbeats. Once the home CPC
is billed for the roaming services provided by the remote CPC to the phreaker
or deadbeat, it will notify the same to add that ESN/MIN pair to their
MTSO's "negative verify" file to prevent future abuses.
Several independent firms are establishing systems software and data
networks to allow POSITIVE ROAMER VERIFICATION (PRV), which allow near real
time roamer validation bt sharing data between CPCs. Until PRV becomes
universal, even bogus ESNs and MINs can roam if they follow the standard
format, alto some CPCs are sharing roam data on a limited basis to prevent
this. Even with PRV, ESN/MIN pairs that are spoofed to match valid accounts
will be accepted both by thier home CPC and roamed CPCs, until the legit
customer complains about the calls he didn't make. And even without PRV,
some CPCs automatically share ESN and MIN data. This frequently occurs
between the CPCs in major cities and those in their bedroom communities.
To call a roaming CMT, the caller must know which system that unit is in,
which can be a real trick since he may be on the road at the time. He then
calls the CPC's roaming number. Roaming numbers vary but usually are in the
phone number format (with area code, with the last four digits being
"ROAM", and with the 3 middle digits being the remote CPC's exchange).
When that number is called, a dial or ready tone is returned, after
which the roaming CMT's full MIN is entered in Touch-Tone. After several
seconds, the CMT will ring or the caller will hear a recording stating
that the roaming CMT is out of range or busy. Telocator Publications
(202) 467-4770 publishes a nationwide roaming directory for travellers
with celluar phones.
For example: I access the Cleveland Ohio Cellular 1's Ericcson switch
and I tell them by my NAM INfo that I'm a roamer from NYNEX in New York
City. Cleveland will let me make the call, bacause it bills back to NYC
for the number of minutes I use. If the NYC number is bogus , the call
goes thru anyway, and the bill doesn't go anywhere. They do know the
exchange data for NYC (that's on a chart) so you can't tell them a wrong
system number (two digits) but one that a valid roamer would have from
his area. This is not too hard to figure out, call some of their stupid
sales idiots some time and see what they let out of the bag.
The system number for the foreign exchange, NYNEX in Buffalo is 56,
Chicago nonwireline is 01, and Buffalo nonwireline is 03. All wirelines
are even numbers and all nonwirelines are odd. The first three digits
of the mobile number: NYNEX Buffalo 863-XXXX. Buffalo Non-wirelines
are 861-XXXX and 690-XXXX.
You dont have to be a rocket scientist to figure out the local numbers
for your area, again by conning the sales people. Until the CPC's get a
cellular clearinghouse to validate roamers in real time, this method
will work out fine. It will be awhile before it becomes routine to look
up a roamer. There's simply to many to look up every time service is
wanted. And this problem is increasing because of the expanding use of
cellular phones.
If a cellular phone and its antenna happen to fall into your hands, you
could re-nam it as a roamer and when you get it setup, make copies of the
info with different suscriber numbers (the last 4 digits) and make free
calls as long as you can.
THe Novatel series phone a re probaly the best radios to use to shut down
a cell site completely as it has secret codes in the control head that
allow you to bypass conventional switching protocols.
NOTE
I hope that this file has lived up the all the boasting I've put into it.
But if there are any problems with the freqs. or anything you can leave me
mail on the bbs's I've listed. At this time Demon Roach and Nihilism dont
carry my files but you can still leave me mail on those boards!
THE RAVEN
+=======+
=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-==-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Thats it for part 1 but look out for part 2!!
Part 2 will cover: What's in a NAM, NAM reprogramming and how to
reprogram the following phones: DIAMONDTEL MESA90X & MESA99X HANDHELD,
GATEWAY CP 900 HANDHELD, GENERAL ELECTRIC MINI II & MINI ,
MITSUBISHI 800 & 900 , MOTOROLA 8000H & ULTRA CLASSIC HANDHELD,
NEC P300 & NEC P9100 , NOVATEL PTR800 & 825 , OKI HANDHELD MODEL #750,
OKI HANDHELD MODEL #900 , PANASONIC EB3500 , COLT TRANSPORTABLE ,
DIAMONDTEL MESA 55 & MESA 95 TRANSPORTABLE , FUJITSU MOBILE PHONE ,
GENERAL ELECTRIC CARFONE XR3000 , GOLDSTAR SERIES 5000 MOBILE ,
MITSUBUSHI 555,560,600 , NEC M3700 SERIES MOBILE , NOKIA LX-11 & M-10 ,
NOVATEL 8305 TRANSPORTABLE CA08 SOFTWARE VERSION , OKI CDL400 ,
PANASONIC EB362 , PANASONIC EB500 OR TP-500 , RADIO SHACK 17-1002 & -1003 ,
AND GE CARFONE MODELS CF-1000, CF-2000 & CF-2500
So look for it at a BBS near you!!
THE RAVEN
+=======+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
And as for all of you guys that wanted to know how I got money for most of
the thing I have well all I can say is look for me next file:
Check Fraud (ckfraud.txt)
to put it simple $32,000 in one day! And as you know...No BullShit!!
-----------------------------------------------------------------------------
Call the following BBS's to get my files 1st run!:
THE SOURCE (212) PRI-VATE
RIPCO (312) 528-5020
Bliterkrieg (502) 499-8933
The Hawks Nest (201) 347-6969
You can leave me mail on those boards and on the following:
The Demon Roach Underground (806) 794-4362
Nihilism (517-546-0585
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
HIGH TECH HOODS 1992 (c)opyright A-CORP. LATER.......THE RAVEN!
ÿ

phreak/CELLULAR/cellpdoc.txt
+1057
View File
File diff suppressed because it is too large Load Diff
phreak/CELLULAR/cellphon.mod
+4252
View File
File diff suppressed because it is too large Load Diff
phreak/CELLULAR/cellphr.txt
+91
View File
@@ -0,0 +1,91 @@
________________________________
/// \
||| Cellular Phreaking |
||| Written by: |
||| The Bootlegger |
||| |
||| Distributed by: |
||| Thirteenth Floor Enterprises |
||| |
\\\________________________________/
6/85
\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\
Though not written specifically for
13th Floor Enterprises, the members of
the 13th Floor believed the information
to be very interesting and, thus, should
be distributed.
\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\
O.K. WE ALL KNOW THAT WITH BELL BUSTING PEOPLE ROUND THE COUNTRY, QUITE
NATURALLY THEY'RE GONNA START PROTECTING AGAIN THE TECHNIQUES WE HAVE ALL
GROWN TO KNOW SO WELL AND LOVE.
SO-O-O YOU ASK WHATS NEXT???
AH-HA SAYS YE OLE BOOTLEGGER-
LET ME INTRODUCE YOU TO CHAPTER 1 OF CELLULAR PHREAKING!
QUOTING THE CAMPS 2001 CELLULAL SYSTEM:
"THE NORMAL ATTENDENT STATION IS SIMPLY A PUSH BUTTON TELEPHONE! CALLS
REQUIRING ATTENDENT ASSISTANCE ARE ROUTED TO THAT PHONE! THE CELLULAR OFFICE
MAY HAVE A REMOTE ATTENDANT EITHER BY USING A DEDICATED 2-WIRE VOICE FREQUENCY
LINE OR BY CONFIGURING THE CELLULAR SWITCH TO AUTOMATICALLY DIAL UP A
TELEPHONE # THROUGH AN EXISTING DIAL-OUT LINE."
THE DATABASE MAINTENANCE FUNCTION, BILLING FUNCTION, MAY BE REMOTED BY
SIMPLY INSTALLING AUTOANSWER 300 BAUD DATA MODEMS AT THE CELL & CENTRAL
LOCATION.(AND IN YOUR HOME COMPUTER) SINCE NONE OF THESE FUNCTIONS REQUIRE
FULL TIME ATTENTION, A NORMAL DIAL-UP LINE IS ENTIRELY ADEQUATE.(BOY-O-BOY)
THUS, SOMEONE AT THE CENTRAL LOCATION (OR ANYWHERE ELSE) CAN DIAL UP THE
SYSTEM IN SAY BEAUMONT AND ADD A CUSTOMER TO THE SUBSCRIBER DATA BASE, OR
DELETE ONE! (I LOVE IT)
PERIODICALLY, SHE CAN DIAL UP THE SYSTEM AND INSTRUCT IT TO DUMP ITS BILLING
INFO INTO HER COMPUTER (OR YOURS) FOR BILL PROCESSING. A MAINTENANCE MAN CAN
USE THE SAME MODEMS TO CHECK FOR ERROR LOGS, SYSTEM OPS, AND MANUALLY EXERCISE
CERTAIN FUNCTIONS!
THIS SYSTEM DUE IN SMALL TOWNS IN ABOUT 6 MO. - ANOTHER FIRST FROM BOOTLEG
NUFF SAID FOR PART 1
CELLULAR PHREAKING #2
SEEMS LIKE THE WESTERN UNION MOBILE PHONES(JOHNSON MOD 1154) HAVE A COUPLE OF
FEATURES THE MFG NEVER INTENDED! CHIP U1 IS THE SERIAL NUMBER ROM,WHILE CHIP
U706 IS THE PROM THAT CONTAINS THE ID NUMBER, TELEPHONE NUMBER OF THE MOBILE,
PAGE CHANNEL, HOME CELL, LOCK CODE, AND OTHER OPTIONS.
NOW, AFTER EXTENSIVELY READING THE MANUALS ON THIS UNIT, I DON'T SEE ANY
REASON THOSE 2 CHIPS CANT BE REPLACED WITH EPROMS PROGRAMED WITH ANY PHONE
NUMBER YOU WANT!!!!
THIS SHOULD ENABLE THIS UNIT TO CALL AND RECEIVE CALLS FROM ANY PHONE # YOU
WANT!!!! (WILL ALSO CHARGE CALLS TO ANY PHONE # )
THIS MAY TURN OUT BETTER THAN OWNING A WHOLE CENTRAL OFFICE (HEE-HEE)
NUFF SAID- BOOTLEG
P.S. I HAVE THE CODING SEQUENCES FOR THE ABOVE CHIPS.ALSO-I'LL BUY A USED
WESTERN UNION MOBILE OR ANY OTHER MOBILE PHONE FOR THE RIGHT PRICE! CALL ME
VIA VOICE.
\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\
o Thirteenth Floor Enterprises and its members neither condone or suggest
the use of cellular phreaking, yet merely distribute this article for the
information of its readers.
\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\
A 13th Floor Enterprises Distribution
phreak/CELLULAR/cellphrk1.txt
+83
View File
@@ -0,0 +1,83 @@
The THC Hack/Phreak Archives: CELPHRK1.TXT (55 lines)
Note: I did not write any of these textfiles. They are being posted from
the archive as a public service only - any copyrights belong to the
authors. See the footer for important information.
==========================================================================
CELLULAR TELEPHONE PHREAKING PHILE SERIES VOL 1 by The Mad Phone-man
How would ya like to have a phone that no body could locate? How bout free
phone service on it too? Well Cellular telephones have the potential to do
all this and more. First lets discuss some basics of the service.
QUESTIONS & ANSWERS:
--------------------
Q:What is cellular; a cellular phone?
A: A 800 mhz radiotelephone, running 3 watts, with the ability to change
channel on computer command from the central switch. This happens when you
travel thru the service area and your signal becomes stronger at a neighboring
cell base station.
Q: They are marketed as a high security device with no possibility of anyone
making a phoney call and charging it to someone else, how can it be phreaked?
A: An understanding of the phone reveals that every time a call is made, the
phone number,an electronic serial number, and other data is sent to the switch.
If you were to listen to the oposite side of the control channel as the call
is being "set-up" you would hear this data being transmitted to the switch in
NRZ code (non-return to zero). All one has to do, is record this info and
program the bogus phone to these params and a free call is possible thru the
switch.
Q: Has anyone done this yet?
A: YES, about 6 months after the first cellular phone system was "turned-up"
a technician programmed a panasonic telephone with a NEC E.S.N. (Electronic
serial number) this was reportedly done for a gram of coke. With the popular
ROM programmers available today, almost any NAM (Numeric Assignment Module)
can be duplicated or copied with changes. (The NAM is the heart of the billing
information and contains the phone number but not the ESN) The most popular
integrated circut for NAMs is the 74LS123.
Q: This sounds like a lot of trouble, is there easier ways to get service?
A: SURE, the cellphone companies have been their own downfall. In an effort
market their wares as a universal service (Your phone will work in any system)
they have let the cart get before the horse. Nobody can tell if a phone from
another city (that has a roaming agreement) is valid till its too late. The
only thing they could do after finding out is block any call with the bad
ESN because as we know, the phone number is easy to change, but the ESN is
not. So heres a likely plot...a roamer identifying itself as a number from
Chicago non-wireline accesses a Cellular system in Dallas. Sometimes an
operator intervienes but you can bullshit them as long as you know the
information you have programmed into your phone. Then you make calls just
like you are a local user. If you're found out, you remove the number,
change it to another, and see if that works. Usualy it will require the
radio's ESN chip to be changed, but thats a lot easier if you have a ZIF
(zero insertion force) socket installed, thats what I use.
Upcomming soon, more good info on particular mfgrs ESN codes.
Cracking the Motorola switch, Shortcommings of the Ericcson AXE-10 switch.
>>> The Mad Phone-man <<<
Downloaded from The Land of Fa-II [716]/773-7526
----------------------------------------------------------------------------
Please don't send requests for reposts, missing parts, GIFs, FTP sites,
technical advice, codes, etc. If you find getting text files from this
newsgroup inconvenient, the archive is available on disk. Send a blank email
to hplist@f26.n340.z1.fidonet.org for more information. Authors wishing to
have files added to or removed from the THC Public archive should contact
me at: tommy@f26.n340.z1.fidonet.org.
Please help keep clutter to a minimum - refer comments to e-mail. Thank you.
-=( Tommy )=-
--
/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
-=- CandyMan -=-
http://www.mcs.net/~candyman/
candyman@mcs.com
"If in other lands the press and books and literature of all kinds are
censored, we must redouble our efforts here to keep them free."
-- Franklin Delano Roosevelt
/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
phreak/CELLULAR/cellphrk2.txt
+78
View File
@@ -0,0 +1,78 @@
The THC Hack/Phreak Archives: CELPHRK2.TXT (50 lines)
Note: I did not write any of these textfiles. They are being posted from
the archive as a public service only - any copyrights belong to the
authors. See the footer for important information.
==========================================================================
CELLULAR TELEPHONE PHREAKING PHILE VOL 2 by "The Mad Phone-man"
Some terms you should understand:
Control Channel- The channel the phone and cell base first communicate on.
Reverse Control Ch- The oposite frequency, 45 mhz lower than the control
channel.This is where the mobile unit is.
Voice channel- The channel you are assigned by the switch to commence the
call on after the exchange of suscriber data.
Reverse voice channel- Again 45mhz lower.
Cell Site- The base station that talks to the mobile.
Switch- The computer that places the calls, and takes and recieves data
from the suscriber or from PSTN. (public switched tel netwk)
OK that should get things started. A suscriber picks up his handset to
place a call.
The phone has already been locked onto the strongest control ch in the
area by a computerized scanner in the phone. As he drives thru the service a
the computer constantly picks out the strongest control ch and stays on it,
altho more than one cell site can actualy be heard. The suscriber enters the
number to call on the keypad, and presses the "send" button. At this time th
folowing data is transmitted to the cell sit by the mobile. The callers
electronic serial number (ESN) , his home system number (two digits) his
mobile's area code and phone number, and the number he wants.The cellular
switch now picks up an outgoing line, places the call for him and tells
the mobile to switch to a voice channel. The two ends are linked in the
central switch and violla! A complete phone call, in about 3 seconds.
I have purposely over-simplified the whole process to point out the
moment of truth. The mobile's ESN and phone number and the data in the
switch must match or no go. This is how the billing is figgured out.If
one had the ESN and the mobilephone number, you could call anytine
anyplace without fear of trace, let alone bill. The ideal setup would
let you listen to the reverse control channel, record and display heard
working numbers and ESN's and recall them at your discression to make calls.
This would be tits! Were not quite there yet. But some hard work has
allready been done for us. All the aforementioned codes are sent
in hex, in NRZ code (phancy term for phase shift keying) but the phone
allready has, for example a NRZ receiver and transmitter built right in.
All that has to be done is to have a receiver on the reverse control
channel, recover the other suscribers data and save it or at least print
it out. The mobile radio data books show some good technical stuff on
the systems used and chip part numbers for the NRZ stuff. I know there
is a mfgr using the lowley 8085 chip for the control head functions,
seems like theres room for xperementin here.
More to come!... "The Mad Phone-man"
Downloaded from The Land of Fa-II [716]/773-7526
----------------------------------------------------------------------------
Please don't send requests for reposts, missing parts, GIFs, FTP sites,
technical advice, codes, etc. If you find getting text files from this
newsgroup inconvenient, the archive is available on disk. Send a blank email
to hplist@f26.n340.z1.fidonet.org for more information. Authors wishing to
have files added to or removed from the THC Public archive should contact
me at: tommy@f26.n340.z1.fidonet.org.
Please help keep clutter to a minimum - refer comments to e-mail. Thank you.
-=( Tommy )=-
--
/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
-=- CandyMan -=-
http://www.mcs.net/~candyman/
candyman@mcs.com
"If in other lands the press and books and literature of all kinds are
censored, we must redouble our efforts here to keep them free."
-- Franklin Delano Roosevelt
/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
phreak/CELLULAR/cellphrk3.txt
+81
View File
@@ -0,0 +1,81 @@
The THC Hack/Phreak Archives: CELPHRK3.TXT (53 lines)
Note: I did not write any of these textfiles. They are being posted from
the archive as a public service only - any copyrights belong to the
authors. See the footer for important information.
==========================================================================
CELLULAR TELEPHONE PHREAKING PHILE VOL 3 by "The Mad Phone-man"
Now that you have become familiar with the technology of cellular phones
its time to discuss what you can do with a phone right now.
Not every system pays attention to a "Roamer" from outside the system as
closely as they do a local suscriber. In their mad rush to offer cellular as
"universal" service, meaning you can place a call in any cellular city any-
where in North America, they fucked up.
OK, heres the poop...I access say..Cleveland Ohio Cellular 1's Ericcson switch
and tell them by my "NAM" info that im a roamer from NYNEX in New York City.
Cleveland will let me make the call, cause it bills back to NYC my number
of minutes used. If the NYC number is bogus, the call goes thru, and the bill
doesn't go anywhere. They do know the exchange data for NYC, thats on a chart
so ya cant tell em yer...555-1212 or such..you must tell em yer a valid roamer
and the System number (two digits) must match NYC's. This is not too hard to
figgure out, (call some of their stupid sales idiots some time and see what
they will let out of the bag)...so now lets see what else you should know.
OK, the system number for the foreign exchange....Nynex in Buffalo is 56,
Chicago nonwireline is 01, Buffalo Nonwireline is 03, All wirelines are even
numbers all non-wirelines are odd.
OK, first three digits of the mobile number....Nynex Buffalo- 863 xxxx
Buffalo Non-wire 861 xxxx, 690 xxxx.
I am sure it wont take much to figgure out the local numbers for your area
like I said the sales people are fucks and will tell ya anything to
make a sale.
Until the companys get a cellular clearinghouse to validate roamers in real
time this will work out fine. The prospects of such a clearinghouse are
good after the companys get done with their bitching at each other.
But it may be a while before it becomes routine to look up a roamer. There's
simply too many to look up every time service is wanted.
So, steal a cellphone and his antenna, re-nam it as a roamer and when ya get
it setup, make copies of the info with different suscriber numbers (the
last 4 digits) and make free calls till whenever.
More to come...."The NOVATEL series phones "
Uncracking the Maintenance code
This is probibaly the best radio to use to shut down
a cell site completely, it has secret codes in the ctrl
head that allow you to bypass conventional switching
protocols.
Downloaded from The Land of Fa-II [716]/773-7526
----------------------------------------------------------------------------
Please don't send requests for reposts, missing parts, GIFs, FTP sites,
technical advice, codes, etc. If you find getting text files from this
newsgroup inconvenient, the archive is available on disk. Send a blank email
to hplist@f26.n340.z1.fidonet.org for more information. Authors wishing to
have files added to or removed from the THC Public archive should contact
me at: tommy@f26.n340.z1.fidonet.org.
Please help keep clutter to a minimum - refer comments to e-mail. Thank you.
-=( Tommy )=-
--
/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
-=- CandyMan -=-
http://www.mcs.net/~candyman/
candyman@mcs.com
"If in other lands the press and books and literature of all kinds are
censored, we must redouble our efforts here to keep them free."
-- Franklin Delano Roosevelt
/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
phreak/CELLULAR/cellprog.txt
+529
View File
@@ -0,0 +1,529 @@
The following file is a verbatim transcript of an article by the same name appearing in the
December, 1992 issue of NUTS & VOLTS Magazine. Copyright (c) 1992 Damien Thorn and
T & L Publications. Permission is granted to freely distribute this file in unmodified form.
Identifying board headers may be added as desired.
CELLULAR TELEPHONE PROGRAMMING
Focusing on Fundamentals
By Damien Thorn
The ever-increasing use of cellular telephones has created a market for people with the skills to
install and program them. Installation is no more difficult than installing a CB radio, and
programming is accomplished by entering data via the keypad on the phone. Whether you want
to completely reprogram a new or used phone, or simply change your unlock code, there is no
reason to pay a dealer to do it when you can do it yourself in a matter of minutes.
In the early days of cellular technology, an external device such as a "programming handset" or
ROM programmer was required to "burn" the mobile telephone number and service information
into the phone. Today's cellular phones incorporate resident software that allows you to key in
the required information on the phone itself. When you are finished and satisfied you've entered
the correct data, the phone burns it to non-volatile memory with the push of a button.
To understand why the simple process of programming a cellular phone seems to be an industry
secret, you need to understand that it is a lucrative service offered by cellular dealers. There is
no profit to be made selling the phone hardware. Most dealers sell at close to cost just to remain
competitive. The real profits are derived from commissions received from the cellular carriers
(service providers) for getting customers to sign up with them.
Due to the widespread use of surface mount technology within the phone, service centers almost
always return them to the manufacturer for repair. Fortunately for these dealers, most service
problems are external, involving the antenna, connectors, cables or a need for reprogramming.
These are all relatively simple matters that can quickly be diagnosed and repaired in the shop,
thus generating income. Aside from the Federal and State regulations governing the sales and
service of cellular equipment (because it is a transmitter), only basic electronics skills and
minimal equipment are required to begin such a business.
INTRODUCTION TO CELLULAR PROGRAMMING
The purpose of this article is to present the fundamentals of cellular programming. I've also
included brief reviews and sources of publications that are essential to anyone interested in
pursuing cellular programming as a hobby or profession. The basic principals of programming
are the same from phone to phone. Each manufacturer (or model), however, has a unique
sequence of key strokes to access the programming mode as well as a few other programming
quirks. If you plan to work with more than one brand of phone, a publication containing
programming tables (or "templates") is a must.
The phone used for this article is a common Motorola transportable "bag phone." One reason
for selecting this phone is because I own one. The other is because Motorola is the most prolific
manufacturer of cellular phones. Also, the "universal" nature of the Motorola programming
instruction set used as an example can be used on most of their phones as presented herein.
Not only do they make gear bearing the Motorola brand name, they custom manufacture phones
for a variety of other vendors. Some examples include the brand names Ambassador, America
Series, Dynasty, Modar, Nautilus, Pulsar, Tracer, Blaupunkt, Nissan Infiniti, Toyota LEXUS, and
models for AUDI and Ford.
PRELUDE TO PROGRAMMING
Before you even begin to program a phone, you need to obtain the required data. If you just
want to change your unlock code, then you need to make up a convenient three-digit number.
Activating service on a used phone requires you to obtain certain information from the cellular
carrier providing you with service. Here is a description of the data you will need:
01) System Identification Number (SID): A five digit number that has been assigned to
identify the particular cellular carrier from whom you are obtaining service. This number
identifies your "home" system.
02) Area Code of Mobile Identification Number (MIN): Simply the area code of your
cellular telephone number. MIN is the "official" term for the phone number assigned to you by
the cellular company.
03) Mobile Identification Number (MIN): The MIN is the actual seven digit cellular
telephone number assigned by the cellular carrier exclusively to your phone.
04) Station Class Mark (SCM): A two-digit number that identifies certain capabilities of your
phone. How the cellular network handles your call is based on these digits. The SCM tells the
system whether your phone transmits at standard power levels or low power levels, if it can
utilize the full 832 channels or only the original 666 frequencies. The last attribute identified is
whether your phone employs voice-activated transmission (VOX).
A phone without VOX is continuously transmitting a carrier back to the cell site the entire time
your call is in progress. The VOX operation used in smaller phones allows the phone to transmit
only while you are actually talking. This reduces battery drain and enables handheld phones to
operate longer on a smaller battery than would be possible without VOX.
To determine the proper SCM for your phone, examine Table 1 and use the code that matches
the presence (or absence) of each of the attributes described above.
05) Access Overload Class (AOLC or ACCOLC): A two-digit number used to arbitrate who
gets dropped from the system (or refused access) when there are more calls in a cell than can be
handled at one time. This feature is allegedly disabled in most systems and no preferential
treatment is shown to any particular ACCOLC.
06) Group Identification Mark (GIM): The Group ID Mark is a two-digit number used by
cellular sites other than your home system to determine if you should be allowed access to the
system on "roam" status. This feature is not yet fully implemented.
07) Security Code: This six-digit number is used to prevent unauthorized or accidental
alteration of the data programmed in the phone. The factory default is 000000.
08) Unlock Code: This is a three-digit number required to unlock the phone when you have
electronically locked it to prevent unauthorized use. The factory default is "123", however many
cellular programmers change it to match the last three digits of your MIN (phone number).
09) Initial Paging Channel (IPCH): This is the channel number used by the cellular provider
to "page" the phones in use on the system. The term "paging" refers to notifying a particular
phone that it has an incoming call. All idle phones on a system monitor the data stream on the
IPCH. Non-wireline cellular carriers use channel 0333 as the IPCH, while wireline providers
(operated by a telephone company) utilize channel 0334.
10) Options programming byte A
11) Options programming byte B
The options bytes are six and three-digit binary numbers used to enable or disable certain options
on the phone. Each digit is either a "1" or "0".
Options byte A consists of six bits. We'll label them "ABCDEF" for our purposes, where each
letter represents a bit set to "1" or "0". Here is what each bit controls:
Bit "A" - Handset internal speaker: A "1" in this position disables the internal speaker of your
handset to facilitate the use of an external speaker/microphone combination. This bit is set to
"0" in a normal installation to allow normal operation of the handset speaker.
Bit "B" - Local Use bit provided for certain cellular carrier system requirements. This is
normally enabled with a "1".
Bit "C" - MIN mark bit: Usually disabled with a "0" in this field.
Bit "D" - Auto recall: The auto recall function is always enabled with a "1" in this position.
Bit "E" - Second phone number: If the phone has a dual system registration capability, and you
are in fact registered with two different cellular carriers, the function is enabled with a "1" in this
field. A "0" in this position indicates the standard cellular configuration having just one
telephone number.
Bit "F" - Diversity: This bit is used to enable diversity if your telephone is equipped with two
antenna connections (ports). If your phone uses just one antenna (standard), this bit is set to "1"
to disable diversity.
If the phone was of a standard configuration, the description above indicates that this option byte
would be programmed as "110100" with each bit enabling or disabling the specific option as
appropriate.
Option byte B operates in the exact same fashion, except the byte consists of only three bits,
controlling three options. We'll label the bits "ABC" where each letter represents a specific bit.
Bit "A" - Long tone DTMF: A "1" in this position enables long tone DTMF for end-to-end
signalling. This means that the phone will transmit a DTMF tone for as long as you depress a
key on the key pad. A "0" will disable this feature, causing the phone to send a short burst of
DTMF when you dial, no matter how long you hold down the key.
Bit "B" - A "0" in this position enables the internal speaker of a transportable phone to act as
the "ringer" to signal an incoming call. This feature can be disabled by programming a "1" in
this position if you have some ancillary device connected to signal ringing.
Bit "C" - Eight hour timeout: This feature is normally enabled with a "0" in this position.
When enabled, the phone will timeout and turn off if it has been left on continuously for eight
hours. This helps prevent the phone from completely draining the battery of your car if it is
inadvertently left on for an extended period without being used.
ENTERING PROGRAMMING MODE
Once you have determined the proper values for the data fields described above, you can get
down to the actual programming of the phone. With the above data in front of you, it becomes
a simple matter of punching it all in on the keypad.
To begin programming the phone, you need to enter the programming mode. Almost all
Motorola phones use one of six possible key stroke sequences to gain access to the programming
mode. These are numbered one through six and listed in Table 2.
Indexing the exhaustive list of model numbers to the appropriate sequence number is beyond the
scope of this article. It is not difficult to figure out, and whether or not the phone has a "Fcn"
(function) or "Ctl" (control) key narrows it down to one or two possibilities.
The security code used to enter the programming mode consists of six digits. It is keyed in
twice, as though it were a twelve digit number, and in a couple of the sequences is prefaced with
a zero for a total of thirteen digits. All Motorola phones are shipped new with the factory default
security code set to 000000. Most cellular programmers do not change this, as it only makes
reprogramming more difficult in the future.
Roughly 80% of the phones I've encountered retain the factory default security code. The other
20% had been changed to 123456 by a local cellular dealer. While the security code could
conceivably be any six digit number, you should be aware that this code is only useful to prevent
idle tampering with the programming, not lock out the personnel at other service centers.
The security code is by no means akin to the vault door protecting the contents of Fort Knox.
In the next issue of Nuts & Volts I'll show you how to build manual test adapter from one
inexpensive part obtainable at any Radio Shack store. This device will immediately allow you
to enter the programming mode without the security code. You can then view and change the
security code or all of the programming if you wish.
Once in programming mode, the phone will display "01" which indicates the phone is at the first
programming step (or field). Table 3 is a template of the programming steps, and you'll notice
that the step numbers correspond with the numbers prefacing my descriptions of the required data
above. The phone always displays the two-digit field identifier before displaying the data in that
particular field. This lets you know where you are in the programming sequence.
COFFEE BREAK: TIME FOR AN ASIDE
It would not be unusual for you to feel a bit overwhelmed right now. I was confused the first
time I attempted to program a cellular phone. If this is your first exposure to cellular
programming, may I suggest you grab a cup of coffee and reread the article up to this point
before you actually attempt the programming process.
At first the idea of security codes and determining the proper sequence necessary to access the
programming mode was disconcerting and a bit frustrating. Once this step had been
accomplished, I was delighted to discover how easy the actual programming was.
If you have difficulty accessing the programming mode, here is a helpful tip: Let's say the
phone is quiescent until you've keyed in the entire sequence, including the 13 digits comprising
the security code, but fails to display "01" after the final keystroke. This indicates that you are
using the correct sequence from Table 2, but the security code is incorrect.
If you are using the wrong keystroke sequence to enter programming mode, the phone will abort
in the midst of keying in the security code, because it fails to recognize why you are punching
in all the digits. If you are using the correct sequence to access the programming mode, the
display on the phone will not echo (display) the security code unless you are keying it in too
slowly.
KEYING IN THE DATA
The process leading up to this point is actually the majority of the work involved in programming
a cellular phone. Keying in the data is so easy that it's almost disappointing.
If you've successfully accessed the programming mode, your phone will display "01" to identify
the current field. Pressing "*" advances the display to the data in that field. You can then key
in new data and press "*" to advance to step "02", or press "*" without entering data to retain
the information currently stored within the field.
I just want to change my unlock code, so I need to advance to the field where this data is stored.
A quick glance at Table 3 tells me that my current unlock code is stored in field 08. To get to
this field, I need only to repeatedly press the "*" key to sequence the phone through the fields
without altering any of the data. When "08" is displayed, I know I've arrived at the field
containing my unlock code.
First I access the programming mode on my transportable phone by turning on the power and
keying in sequence number 4 from Table 2. I depress the "control" key on the side of the
handset and quickly punch in "0" followed by my security code twice (123456+123456) and
finally press the "*" key. The display shows "01" to let me know I am at field 01, the SID.
I press "*" to advance to the data, and the display shows "00224" which is my SID. I press "*"
again and the software sequences to the next step. "02" is now on the display. Another "*" and
the phone displays "209" which is the data in field 02 - my cellular area code. Depressing the
star key advances us to step "03" which is my MIN. Pressing "*" displays the contents of field
03, and yes, it certainly is my cellular telephone number (MIN).
Each time I press the "*" key the phone continues to advance to the next field number and then
displays the data stored there. Since I want to change my unlock code, I repeatedly press the "*"
key until the phone displays "08." This is the field containing that code.
Another "*" and my display shows "602" which is my current unlock code. I want to change
it to "977." With the old code in the display (602), I simply punch in the numbers 9+7+7.
The display now reads "977" which will be my new unlock code.
If I continued pressing the "*" key, the phone would sequence through the remaining fields until
it returned to "01." I could then advance through the fields again. You might want to do this,
just scrolling through the data programmed into your phone. Use Table C to identify the fields
as you look at the data stored in each.
If you accidentally alter the data in any of the fields while you are looking around, press the "#"
key to exit programming mode without saving any of the changes to memory. The "#" key will
abort the programming mode, leaving the previously stored information intact.
Since I changed my unlock code, I need to burn the new information to the Numeric Assignment
Module (NAM) in the phone. NAM is the term used to describe the EEPROM chip where the
program data is stored. To save the new information, I press "Snd" (Send). This burns the
changes to the NAM and exits the programming mode.
These are the keys to remember while programming a phone, or just exploring the current
programming: The "*" key advances to the next field or step. The "#" key aborts programming
without saving any changes. The "Snd" key saves all changes to the NAM and exits
programming mode. The "clr" (clear) key will restore a field to the previously stored data if you
make a mistake while keying in digits. You can then reenter the data correctly.
SUMMARY
We've covered a lot of material, and I commend your tenacity. Cellular programming is actually
an easy process. You now have a decent understanding of the fundamentals, and I assure you
that a bit of practice will lead to a surprising proficiency.
The information in this article is specific to cellular equipment manufactured by Motorola. Other
manufacturers use somewhat different templates and methods to access the programming mode.
If you want a deeper understanding of cellular programming or need the exact programming
templates and instructions for a variety of phones, I suggest you buy one of the publications
reviewed here.
If you own just one model of phone and need a template or other basic assistance, I don't mind
helping you out. You can contact me directly via mail at 6333 Pacific Avenue, Suite 203,
Stockton, CA 95207-3713. If you need me to provide detailed information, I would appreciate
it if you'd enclose a few dollars to help offset my expense. I welcome all comments, and
encourage suggestions for future articles.
Building a test adapter for Motorola phones is the subject of my article next month in Nuts &
Volts. Placing a phone in test mode will allow you to bypass the keystroke sequence and
security code to access programming mode. This is a device every cellular service person should
have.
In addition to getting around a security code long forgotten by a customer, you'll learn how to
reset the cumulative call timer, reset the NAM programming to default values and a host of other
interesting test functions such as accessing the built-in relative signal strength indicator (RSSI)
and channel number display available only when the phone is in test mode.
# # #
Table 1
DETERMINING YOUR STATION CLASS MARK (SCM)
Proper SCM Value Attributes of Your Phone
00 Standard power output; 666 channel capability; no VOX operation.
04 Standard power output; 666 channel capability; uses VOX.
06 Low power output; 666 channel capability.
08 Standard power output; 832 channel capability; no VOX operation.
10 Low power output; 832 channel capability; no VOX operation.
12 Standard power output; 832 channel capability; uses VOX.
14 Low power output; 832 channel capability; uses VOX.
The SCM value appropriate to your cellular phone should be entered in programming field "04."
"Standard power" as used above refers to the RF output level of a transportable phone, or one
installed in a vehicle. "Low power" refers to the reduced RF output of handheld units.
Handheld phones utilize a lower power level not just because of their size and battery capacity.
Since the transmitter and antenna are a part of the handset, it was determined that radiating a full
three watts of RF just a few inches from your head might be unhealthy.
# # #
Table 2
PROGRAMMING MODE ACCESS SEQUENCES
#1 - Fcn + [six digit security code] + [six digit security code] + Rcl
#2 - Sto + # + [six digit security code] + [six digit security code] + Rcl
#3 - Ctl + 0 + [six digit security code] + [six digit security code] + Rcl
#4 - Control + 0 + [six digit security code] + [six digit security code] + *
#5 - Fcn + 0 + [six digit security code] + [six digit security code] + Mem
#6 - Fcn + 0 + [six digit security code] + [six digit security code] + Rcl
Note: In sequence #4 the "control" key refers to the audio and ringer volume control button on
the side of the handset if no "Ctl" key is present on the handset keypad.
Example: If the appropriate sequence for my phone is #3, and my security code is 123456, I
would key in the sequence as follows:
A) Turn power on. Display reads "ON."
B) Press: [Ctl], [0], [1], [2], [3], [4], [5], [6], [1], [2], [3], [4], [5], [6], [Rcl].
C) If entered correctly programming mode is active. Display reads "01."
# # #
Table 3
TEMPLATE: SEQUENCE OF PROGRAMMING STEPS
Field Description Digits Typical Example
01 System ID Number (SID) 5 000233
02 Area Code of Mobile ID Number (MIN) 3 209
03 Mobile Identification Number (MIN) 7 555-1212
04 Station Class Mark (SCM) 2 12
05 Access Overload Class (ACCOLC) 2 06
06 Group ID Mark (GIM) 2 10
07 Security Code 6 000000 or 123456
08 Unlock Code 3 123 or last 3 digits of MIN
09 Initial Paging Channel (IPCH) 4 0333 or 0334
10 Options programming byte "A" 6 011100 (binary)
Internal Speaker (1 = disable) X-----
Local Use bit (1 = enable) -X----
MIN Mark bit (usually disabled = 0) --0---
Auto-Recall bit (always set to 1) ---1--
Second Phone Number (0 = disable) ----X-
Diversity option bit (0 = disable) -----X
11 Options programming byte "B" 3 010 (binary)
Long tone DTMF (0 = disable) X--
Ringer/speaker (1 = handset / 2 = transducer) -X-
Timeout (8 hour) (0 = enabled) --X
If second phone number option is enabled and supported by the hardware, this programming
template will repeat for the second phone number. Each field identifier (step) number will be
displayed with a "2" to indicate data for the second number. (e.g. "01 2").
******************************************************************************
SOURCES: A Review of Available Publications
Every month I peruse the pages of Nuts & Volts with an eye for detail unmatched by the best
Revenue Agents employed by the IRS. Why? Because I have an insatiable appetite for
information - especially information surrounding technology that seems "inaccessible" to you and
me. As a result, I've purchased all four publications advertised herein that deal with cellular
communications. Each has unique features and all were worth the money. Here is my opinion
of each:
Cellular Programmer's Bible
The Cellular Programmer's Bible definitely lives up to it's name. Over 300 pages of nothing but
programming instructions for every conceivable cellular telephone manufactured. This tome
includes the factory preset security codes to greatly simplify access to the programming modes
of various phones. In addition to precisely detailing every programming sequence, each entry
includes invaluable technical information on channel capabilities, test modes, and other unique
tidbits applicable to the specific model of phone being described.
This volume is mandatory for anyone considering offering programming services to the public.
I discovered my Pac Tel Cellular customer service rep uses this same publication as his
programming reference, although he carries it in a nondescript binder.
Approximately 400 spiral bound 8.5 x 11" pages. $84.45.
Available from: TeleCode, P.O. Box 6426, Yuma, AZ, 85366-6426. (602) 782-2316.
Cellular Hacker's Bible
The Cellular Hacker's Bible is TeleCode's other cellular publication. About one third of this
book is devoted to programming templates for over thirty popular phones. The balance consists
of an elaborate technical dissertation describing the operation of the cellular network which reads
like a Bellcore technical document (coincidence?). From switching to timing and signalling
protocols - it's all here.
The attention to technical detail can be an engineer's dream or mind-numbing to the casual
reader. Although I occasionally became bogged down in things like "wink start signalling" and
multi-frequency (MF) call routing codes, I appreciated the excruciating detail when I came to the
18 pages listing each and every frequency in the radio spectrum allocated to the cellular network
by the FCC.
The reprogramming instructions are easy to follow, but not as comprehensive as the templates
in TeleCode's other publication (above).
Approximately 180 spiral bound 8.5 x 11" pages. $53.45.
Available from: TeleCode, P.O. Box 6426, Yuma, AZ, 85366-6426. (602) 782-2316.
Cellular Phone Phreaking
Technical documents published "for educational purposes only" by Consumertronics have a
unique format and tone not generally found in other books. John J. Williams, MSEE and
proprietor of the company, has a gift for presenting detailed technical information in an almost
conversational manner full of examples and anecdotes. Cellular Phone Phreaking is no exception.
The programming instructions are equivalent to those contained within TeleCode's Cellular
Hacker's Bible. The technical description of the cellular network is brief, and Williams includes
an abundance of information on how individuals have been known to perpetrate cellular fraud.
Included are relevant excerpts from various communications privacy laws, including the text of
the Electronic Communications Privacy Act (ECPA).
Of value to the technician or monitoring enthusiast are the mathematical algorithms necessary
to determine the cellular channel numbers based on the radio frequencies used.
While informative and entertaining, this book is a bit thin compared to the others, but Williams
crams in a lot of information by using small type and not wasting an inch of space.
Approximately 41 spiral bound 8.5 x 11" pages. $39.00.
Available from: Consumertronics, 2011 Crescent Drive, P.O. Box 88310, Alamogordo, NM
88310, (505) 434-0234.
Cellular Telephone Modification Handbook
The Cellular Telephone Modification Handbook is the one publication reviewed that is not really
a programming manual per se. It is a book explaining in detail how a hacker would change the
Electronic Serial Number (ESN) of a cellular phone. As a "security manual," the book holds
nothing back in precisely demonstrating how criminals can defraud the system by doing so. I
should note that a legitimate application for this information would be to "clone" a phone that
you already own.
By duplicating the ESN of your existing phone into another phone, you could use either unit at
any given time and avoid having to pay for an additional number and service for the second
phone. This seems analogous to adding an extension phone to your telephone service at home.
Why have a separate number for each "extension?" Cellular companies don't like it, but it
doesn't appear to be illegal. Emulating the phone of your local bank president in order to make
free calls is another story entirely.
In addition to basic "universal" programming guidelines, this book includes "screen dumps" of
PROM emulation software, lists of manufacturers' ESN prefixes and System Identification
Numbers (SIDs). Complete with sources for parts and equipment, as well as books and
magazines related to the field of cellular communications.
The representative I spoke with at Spy Supply provides programming support for their customers.
If you need assistance with a specific phone, he'll provide you with programming information
for that particular model at no charge. After purchasing the manual, I tested this service and
found that he could answer every question I threw at him without hesitation. The availability
of this invaluable resource elevates Spy Supply above the ranks of a typical publisher.
Approximately 52 spiral bound 8.5 x 11" pages. $79.95.
Available from: Spy Supply, 7 Colby Court, Suite 215, Bedford, NH 03110, (617) 327-7272.
******************************************************************************
AUTHOR BIOGRAPHY
(For publication)
Damien Thorn's interest in electronics has deep roots. A noted "hacker" and "phone phreak" by
age sixteen, he contributed regularly to the underground newsletter "TAP." Today Damien is
an on-air radio personality and FCC licensed engineer in California's San Joaquin Valley. His
interests include computers, communications, security and privacy issues. He welcomes questions
and comments. You can reach him at 6333 Pacific Ave. #203, Stockton, CA 95207-3713 or via
E-Mail at one of the following: DrDamien@Delphi.com via Internet mail, on CompuServe at
75720,2104, or on Delphi as DrDamien.

phreak/CELLULAR/cellqst1.txt
+53
View File
@@ -0,0 +1,53 @@
CELLQUEST
NOTES: This is a single NAM unit.
The ESN prefix is 174 decimal & AE hex.
Shintom: 213-328-7200
NAM PROGRAMING:
1. Turn power on.
2. If not locked press FUNC 5 to lock.
3. Enter FUNC # 6 2 6 # FUNC. (626 SPELLS NAM)
4. The SEND key stores and increments each step.
5. You can jump to any entry by pressing END STEP# SEND.
6. At any time press END FUNC END to complete and exit programing.
7. The first two (unnumbered) steps below are not strictly programing
data, and can not be altered, but are shown for clarity.
PROGRAMING DATA:
STEP# #OF DIGITS/RANGE DESCRIPTION
CAN NOT BE CHANGED MODEL NUMBER & SOFTWARE VERSION
CAN NOT BE CHANGED ESN IN HEX
01 3 DIGITS AREA CODE
02 7 DIGITS PHONE NUMBER
03 00000 - 32767 SYSTEM ID
04 2 DIGITS ACCESS OVERLOAD CLASS
05 2 DIGITS GROUP ID (10 IN USA)
06 0 OR 1 LOCAL USE MARK
07 0 OR 1 MIN MARK
08 3 DIGITS LOCK CODE
09 0 OR 1 AUTO LOCK
10 3 DIGITS CALL RESTRICTION CODE (DEFAULTS TO LOCK CODE)
11 2 DIGITS CALL COUNTER RESET CODE (DEFAULTS TO FIRST TWO
DIGITS OF LOCK CODE)
12 0 OR 1 HANDS FREE
13 0 OR 1 HORN ALERT
14 0 TO 3 HORN ALERT TURN OFF DELAY (0 = 2 hrs, 1 = 4 hrs,
2 = 8 hrs, 3 = no turn off)
15 2 DIGITS TOTAL AIRTIME RESET CODE (DEFAULTS TO FIRST TWO
DIGITS OF LOCK CODE)
LOCK: F5, UNLOCK: 3 DIGIT CODE
SYSTEM SELECT: F7 = A ONLY, F8 = B ONLY (F7 OR F8 AGAIN WILL TOGGLE BACK TO
PREF/NON PREF)
phreak/CELLULAR/cellsecr.txt
+3256
View File
File diff suppressed because it is too large Load Diff
phreak/CELLULAR/cellserl.txt
+270
View File
@@ -0,0 +1,270 @@
THE ELECTRONIC SERIAL NUMBER: A CELLULAR 'SIEVE'?
'SPOOFERS' CAN DEFRAUD USERS AND CARRIERS
by Geoffrey S. Goodfellow, Robert N. Jesse, and Andrew H. Lamothe, Jr.
What's the greatest security problem with cellular phones? Is it privacy of
communications? No.
Although privacy is a concern, it will pale beside an even greater problem:
spoofing.
'Spoofing' is the process through which an agent (the 'spoofer') pretends to
be somebody he isn't by proffering false identification, usually with intent
to defraud. This deception, which cannot be protected against using the
current U.S. cellular standards, has the potential to create a serious
problem--unless the industry takes steps to correct some loopholes in the
present cellular standards.
Compared to spoofing, the common security concern of privacy is not so severe.
Most cellular subscribers would, at worst, be irked by having their
conversational privacy violated. A smaller number of users might actually
suffer business or personal harm if their confidential exchanges were
compromised. For them, voice encryption equipment is becoming increasingly
available if they are willing to pay the price for it.
Thus, even though technology is available now to prevent an interloper from
overhearing sensitive conversations, cellular systems cannot--at any
cost--prevent pirates from charging calls to any account. This predicament is
not new to the industry. Even though cellular provides a modern,
sophisticated quality mobile communications service, it is not fundamentally
much safer than older forms of mobile telephony.
History of Spoofing Vulnerability
The earliest form of mobile telephony, unsquelched manual Mobile Telephone
Service (MTS), was vulnerable to interception and eavesdropping. To place a
call, the user listened for a free channel. When he found one, he would key
his microphone to ask for service: 'Operator, this is Mobile 1234; may I
please have 555-7890.' The operator knew to submit a billing ticket for
account number 1234 to pay for the call. So did anybody else listening to the
channel--hence the potential for spoofing and fraud.
Squelched channel MTS hid the problem only slightly because users ordinarily
didn't overhear channels being used by other parties. Fraud was still easy
for those who turned off the squelch long enough to overhear account numbers.
Direct-dial mobile telephone services such as Improved Mobile Telephone
Service (IMTS) obscured the problem a bit more because subscriber
identification was made automatically rather than by spoken exchange between
caller and operator. Each time a user originated a call, the mobile telephone
transmitted its identification number to the serving base station using some
form of Audio Frequency Shift Keying (AFSK), which was not so easy for
eavesdroppers to understand.
Committing fraud under IMTS required modification of the mobile--restrapping
of jumpers in the radio unit, or operating magic keyboard combinations in
later units--to reprogram the unit to transmit an unauthorized identification
number. Some mobile control heads even had convenient thumb wheel switches
installed on them to facilitate easy and frequent ANI (Automatic Number
Identification) changes.
Cellular Evolution
Cellular has evolved considerably from these previous systems. Signaling
between mobile and base stations uses high-speed digital techniques and
involves many different types of digital messages. As before, the cellular
phone contains its own Mobile Identification Number (MIN), which is programmed
by the seller or service shop and can be changed when, for example, the phones
sold to a new user. In addition, the U.S. cellular standard incorporates a
second number, the 'Electronic Serial Number' (ESN), which is intended to
uniquely and permanently identify the mobile unit.
According to the Electronic Industries Association (EIA) Interim Standard
IS-3-B, Cellular System Mobile Station--Land Station Compatibility
Specification (July 1984), 'The serial number is a 32-bit binary number that
uniquely identifies a mobile station to any cellular system. It must be
factory-set and not readily alterable in the field. The circuitry that
provides the serial number must be isolated from fraudulent contact and
tampering. Attempts to change the serial number circuitry should render the
mobile station inoperative.'
The ESN was intended to solve two problems the industry observed with its
older systems.
First, the number of subscribers that older systems could support fell far
short of the demand in some areas, leading groups of users to share a single
mobile number (fraudulently) by setting several phones to send the same
identification. Carriers lost individual user accountability and their means
of predicting and controlling traffic on their systems.
Second, systems had no way of automatically detecting use of stolen equipment
because thieves could easily change the transmitted identification.
In theory, the required properties of the ESN allow cellular systems to check
to ensure that only the correctly registered unit uses a particular MIN, and
the ESNs of stolen units can be permanently denied service ('hot-listed').
This measure is an improvement over the older systems, but vulnerabilities
remain.
Ease of ESN Tampering
Although the concept of the unalterable ESN is laudable in theory, weaknesses
are apparent in practice. Many cellular phones are not constructed so that
'attempts to change the serial number circuitry renders the mobile station
inoperative.' We have personally witnessed the trivial swapping of one ESN
chip for another in a unit that functioned flawlessly after the switch was
made.
Where can ESN chips be obtained to perform such a swap? We know of one recent
case in the Washington, D.C. area in which an ESN was 'bought' from a local
service shop employee in exchange for one-half gram of cocaine. Making the
matter simpler, most manufacturers are using industry standard Read-Only
Memory (ROM) chips for their ESNs, which are easily bought and programmed or
copied.
Similarly, in the spirit of research, a west coast cellular carrier copied the
ESN from one manufacturer's unit to another one of the same type and
model--thus creating two units with the exact same identity.
The ESN Bulletin Board
For many phones, ESN chips are easy to obtain, program, and install. How does
a potential bootlegger know which numbers to use? Remember that to obtain
service from a system, a cellular unit must transmit a valid MIN (telephone
number) and (usually) the corresponding serial number stored in the cellular
switch's database.
With the right equipment, the ESN/MIN pair can be read right off the air
because the mobile transmits it each time it originates a call. Service shops
can capture this information using test gear that automatically receives and
decodes the reverse, or mobile-to-base, channels.
Service shops keep ESN/MIN records on file for units they have sold or
serviced, and the carriers also have these data on all of their subscribers.
Unscrupulous employees could compromise the security of their customers'
telephones.
In many ways, we predict that 'trade' in compromised ESN/MIN pairs will
resemble what currently transpires in the long distance telephone business
with AT&T credit card numbers and alternate long-distance carrier (such as
MCI, Sprint and Alltel) account codes. Code numbers are swapped among
friends, published on computer 'bulletin boards' and trafficked by career
criminal enterprises.
Users whose accounts are being defrauded might--or might not--eventually
notice higher-than-expected bills and be reassigned new numbers when they
complain to the carrier. Just as in the long distance business, however, this
number 'turnover' (deactivation) won't happen quickly enough to make abuse
unprofitable. Catching pirates in the act will be even tougher than it is in
the wireline telephone industry because of the inherent mobility of mobile
radio.
Automating Fraud
Computer hobbyists and electronics enthusiasts are clever people. Why should
a cellular service thief 'burn ROMs' and muck with hardware just to install
new IDs in his radio? No Herculean technology is required to 'hack' a phone
to allow ESN/MIN programming from a keyboard, much like the IMTS phone thumb
wheel switches described above.
Those not so technically inclined may be able to turn to mail-order
entrepreneurs who will offer modification kits for cellular fraud, much as
some now sell telephone toll fraud equipment and pay-TV decoders.
At least one manufacturer is already offering units with keyboard-programmable
MINs. While intended only for the convenience of dealers and service shops,
and thus not described in customer documentation, knowledgeable and/or
determined end users will likely learn the incantations required to operate
the feature. Of course this does not permit ESN modification, but easy MIN
reprogrammability alone creates a tremendous liability in today's roaming
environment.
The Rolls Royce of this iniquitous pastime might be a 'Cellular Cache-Box.' It
would monitor reverse setup channels and snarf ESN/MIN pairs off the air,
keeping a list in memory. Its owner could place calls as on any other
cellphone. The Cache-Box would automatically select an ESN/MIN pair from its
catalog, use it once and then discard it, thus distributing its fraud over
many accounts. Neither customer nor service provider is likely to detect the
abuse, much less catch the perpetrator.
As the history of the computer industry shows, it is not far-fetched to
predict explosive growth in telecommunications and cellular that will bring
equipment prices within reach of many experimenters. Already we have seen the
appearance of first-generation cellular phones on the used market, and new
units can be purchased for well under $1000 in many markets.
How High The Loss?
Subscribers who incur fraudulent charges on their bills certainly can't be
expected to pay them. How much will fraud cost the carrier? If the charge is
for home-system airtime only, the marginal cost to the carrier of providing
that service is not as high as if toll charges are involved. In the case of
toll charges, the carrier suffers a direct cash loss. The situation is at its
worst when the spoofer pretends to be a roaming user. Most inter-carrier
roaming agreements to date make the user's home carrier (real or spoofed)
responsible for charges, who would then be out hard cash for toll and airtime
charges.
We have not attempted to predict the dollar losses this chicanery might
generate because there isn't enough factual information information for anyone
to guess responsibly. Examination of current estimates of long-distance-toll
fraud should convince the skeptic.
Solutions
The problems we have described are basically of two types. First, the ESN
circuitry in most current mobiles is not tamper-resistant, much less
tamper-proof. Second and more importantly, the determined perpetrator has
complete access to all information necessary for spoofing by listening to the
radio emissions from valid mobiles because the identification information
(ESN/MIN) is not encrypted and remains the same with each transmission.
Manufacturers can mitigate the first problem by constructing mobiles that more
realistically conform to the EIA requirements quoted above. The second
problem is not beyond solution with current technology, either. Well-known
encryption techniques would allow mobiles to identify themselves to the
serving cellular system without transmitting the same digital bit stream each
time. Under this arrangement, an interloper receiving one transmission could
not just retransmit the same pattern and have it work a second time.
An ancillary benefit of encryption is that it would reasonably protect
communications intelligence--the digital portion of each transaction that
identifies who is calling whom when.
The drawback to any such solution is that it requires some re-engineering in
the Mobile-Land Station Compatibility Specification, and thus new software or
hardware for both mobiles and base stations. The complex logistics of
establishing a new standard, implementing it, and retrofitting as much of the
current hardware as possible certainly presents a tough obstacle, complicated
by the need to continue supporting the non-encrypted protocol during a
transition period, possibly forever.
The necessity of solving the problem will, however, become apparent. While we
presently know of no documented cases of cellular fraud, the vulnerability of
the current standards and experience with similar technologies lead us to
conclude that it is inevitable. Failure to take decisive steps promptly will
expose the industry to a far more expensive dilemma. XXX
Geoffrey S. Goodfellow is a member of the senior research staff in the
Computer Science Laboratory at SRI International, 333 Ravenswood Ave., Menlo
Park, CA 94025, 415/859-3098. He is a specialist in computer security and
networking technology and is an active participant in cellular industry
standardization activities. He has provided Congressional testimony on
telecommunications security and privacy issues and has co-authored a book on
the computer 'hacking' culture.
Robert N. Jesse (2221 Saint Paul St., Baltimore, MD 21218, 301/243-8133) is an
independent consultant with expertise in security and privacy, computer
operating systems, telecommunications and technology management. He is an
active participant in cellular standardization efforts. He was previously a
member of the senior staff at The Johns Hopkins University, after he obtained
his BES/EE from Johns Hopkins.
Andrew H. Lamothe, Jr. is executive vice-president of engineering at Cellular
Radio Corporation, 8619 Westwood Center Dr., Vienna, VA 22180, 703/893-2680.
He has played a leading role internationally in cellular technology
development. He was with Motorola for 10 years prior to joining American
TeleServices, where he designed and engineered the Baltimore/Washington market
trial system now operated by Cellular One.
--------
A later note indicates that one carrier may be losing something like $180K
per month....
The Wanderjahr

phreak/CELLULAR/celltest.txt
+393
View File
@@ -0,0 +1,393 @@
The following file is a verbatim transcript of an article by the same name appearing in the
January, 1993 issue of NUTS & VOLTS Magazine. The six (6) accompanying photographs
detailing construction have been omitted. Copyright (c) 1992 Damien Thorn and T & L
Publications. Permission is granted to freely distribute this file in unmodified form. Identifying
board headers may be added as desired.
CELLULAR TELEPHONE MANUAL TEST MODE
How to Build and Use Programming Aids
By Damien Thorn
Over the last few months in Nuts & Volts we've taken a close look at cellular technology. From
an overview of the network to a "hands-on" tutorial covering cellular telephone reprogramming.
This article introduces the construction and use of a manual test adapter to assist in
reprogramming or diagnosing problems in various cellular phones.
You can build this device in about five minutes with one part from your local computer store or
Radio Shack. The simplicity is elegant, and belies the powerful control you can achieve over
your cellular hardware. Need to bypass the security code usually required for programming, or
display the relative signal strength indication (RSSI) on a specific cellular channel? With a
manual test adapter you're just a few keystrokes away from this and more.
INTRODUCTION
As I mentioned last month, there is little money to be made by cellular dealers in the sales of
equipment. Hardware prices are so competitive that most dealers sell new equipment at close
to cost. Dealers make their profit through commissions for signing up subscribers for cellular
service, and by installation and repair.
Installing cellular phones is comparable to installing a CB radio, and less difficult than wiring
a car stereo. Modern cellular phones are so reliable that the phone itself rarely needs to be
serviced. Ancillary equipment such as wiring and antennas are usually the cause of any
malfunction. Probably the most common service operation is programming.
Whether you are activating cellular service for the first time, or moving to another city, your
cellular phone must be reprogrammed with specific data supplied by the cellular service provider
(carrier). Even changing the unlock code on the phone requires reprogramming in many
instances, often associated with a fee ranging from $15-50.00.
The vast majority of contemporary cellular phones are programmed by punching in the data right
on the keypad without the aid of any external programming device. And this service is often
performed by shop personnel with little technical skill. With a programming manual in front of
her, I watched the receptionist at a local dealer program a phone that was being exchanged by
a customer.
I use this example to illustrate how easy it is to reprogram a phone. There is really no reason
you or I cannot perform this task ourselves and save money. Reprogramming can also become
a profitable additional service offered by independent technicians.
Motorola's Test Mode
Motorola is probably the largest manufacturer of cellular phones. In addition to their own
brands, they make phones for a plethora of other companies. I've always admired the quality
of Motorola communications equipment, and the test mode engineered into their cellular firmware
has scored them a few more points in my book.
The test mode is designed to be of assistance to cellular technicians in the field, and is entered
by grounding a specific pin on one of the phone's connectors. Once in test mode, the technician
has manual control over many of the functions normally automated by the firmware. The phone
display can now be used to indicate the status of various operational parameters.
The most useful functions to the hobbyist and professional programmer alike are those which
allow the data stored in the Numeric Assignment Module (NAM) to be reviewed and changed.
This is not much different from using the standard programming mode, except no special
keyboard sequences and security codes are required for access. The manual test mode effectively
bypasses the software "front door" commonly used to enter programming mode, and is invaluable
when the security code is unknown or has long since been forgotten.
The rest of this article details the construction of a test adapter and explains its use as applicable
to cellular programming. From this point on I'm assuming you've read my previous article or
otherwise have at least a basic knowledge of cellular programming.
The basic style of the Motorola-manufactured phone will determine how you go about placing
the unit in test mode. Palm-size folded phones and the one-piece hand held devices do not
require and adapter. A jumper between the contact designated as the "test line" and ground is
all that is required.
Activating Test Mode: Hand held Phones
If your phone is one of the hand held types, slide the battery pack off the unit. The battery pack
also serves as the rear of the phone's external case. On the top rear of the phone you should see
twelve contacts arranged in two horizonal rows as depicted in Photo #1.
Before you go any further, you should look at the model number of the phone located on the
back of the handset. A typical model number is "F09FSF9797." The fourth letter (underlined)
in this string is important. This indicates the phone is of the Motorola "F" series and contains
firmware that is programmed to allow us to use the manual test mode. The older "D" series
phones do not contain the appropriate firmware, and are not even programmable from the keypad.
Do not attempt this procedure on a "D" series phone.
Another way to make sure the phone is of the "F" or higher (G, H, I, etc.) series as opposed to
the older "D" series is to examine the plastic shroud which extends from the top of the phone
and partly covers the RF switch/antenna connector housing. The "F" (and newer) series phones
have various notches molded into the plastic shroud as can be seen in the photo.
To reiterate, if the model number contains the letter "D" as the fourth character, it does not have
a test mode, and cannot be reprogrammed from the keypad. Do not attempt to place it in test
mode or you may damage the phone. Once you are certain the phone is of the "F" or higher
series, you may proceed.
The contact which serves as the test line is #6. This is the contact to the far right in the upper
row, and should be the last (and sixth) of the contacts comprising the top row of contacts.
Making a connection between this contact and ground will cause the phone to enter the test mode
when powered up.
The most convenient way I've found to accomplish this in lieu of a special adapter or modified
battery pack is to use a small piece of wire as a jumper. The short lengths that come with the
Radio Shack RS-232 jumper box we'll be discussing later work perfectly, right out of the
package!
To jump contact #6 to ground, I use a very small jewelers screwdriver to carefully wedge one
of the solder-tinned ends of my jumper into the space between the contact and the plastic edge
to the right. The snug fit assures decent electrical contact and helps keep the jumper in place.
The other end of the jumper is gently inserted in the crevice on the RF switch housing. This
bare metal area is the most convenient ground and will even hold the end of the jumper.
Once you have the jumper connected, you need to flatten it against the phone so that you can
slide the battery back on without dislodging it. Photo #2 depicts the jumper in the proper
position to clear the battery pack.
Palm-size Folded Phones
The "Micro TAC" variety of miniature folded phones ("Flip-Fones") manufactured by Motorola
usually require a special battery to activate the test mode. You can simulate this battery with
your standard battery, however.
After removing the battery from the phone, you should see three contacts in a row located in the
lower right area of the phone. The two outer contacts are the battery connections. Positive "+"
is to the left, and negative "-" is to the right.
The center contact is somewhat recessed and does not make contact with the standard battery.
Your battery however, should have a mating third contact present. To place the phone in test
mode, you need to get the center contact to mate with the center contact on the battery. Strategic
use of a small piece of folded metal foil, solder wick or similar conductive material can be used
to extend the center contact on the phone so that it will make contact with the third terminal of
the battery.
If you attempt this procedure, immediately power up the phone to make sure you have not
shorted the battery terminals. If the phone does not come on at all or feels warm to the touch,
quickly remove the battery. A shorted NiCad battery can explode, causing serious injury.
MINI-TR or Silver MiniTac phones
Two specific phones - Motorola's MINI-TR or Silver MiniTac units can be placed in
programming mode by shorting the two contacts of the hands-free microphone connector.
Mobile Installations & Transportable Phones
These common phones are the type that consist of a handset connected to a separate transceiver
unit by a coiled cable resembling the receiver cord of a standard landline telephone. The handset
cable is terminated with a modular connector and plugged in to a jack. The control cable from
the jack carries the handset, power and options wiring. This control cable is connected to the
transceiver with a 25-pin DB25 connector as depicted in Photo #3.
These phones are also placed in manual test mode by grounding the test line. The easiest way
to accomplish this is by building a small test adapter (also known as a "programming aid"). This
device is placed between the control cable and transceiver DB25 connectors allowing all the
signals to pass through unaffected with the exception of jumping the test line to audio ground.
Building the Test Adapter
Construction of the test adapter is pretty straight forward. The same DB25 connectors used by
Motorola have been used for years as the standard RS-232-C connector on computer equipment.
You can easily pick up a serial RS-232 inline jumper box from your local computer, electronics
or Radio Shack store. The part number at Radio Shack is #276-1403 and lists for $9.95 in their
1993 catalog.
The Radio Shack jumper box is designed for maximum flexibility and as such does not have any
of the pins preconnected. Each trace on the circuit board connecting the pins has a small break
which you will need to bridge with solder to allow the signals to pass through. Examine the PC
board before beginning and follow a few of the traces. Note the difference between the break
in each trace and the small solder pads used for connecting jumpers. You only need to bridge
the traces.
Once you've applied a small dab of solder to restore the integrity of each trace, you are ready
to install the jumper. The test line on these Motorola phones is pin #21. Pin #20 is the audio
ground line. You want to jumper (short) these two pins.
Small numbers etched on the PC board indicate the jumper point for each pin. Locate the
numbers 20 and 21 next to the small solder pads. Using one of the short jumper wires provided
with the device, place the ends through these two holes and solder them down on the opposite
side of the board. Photo #4 depicts proper jumper installation, although I left one end of the
jumper unsoldered to illustrate it going through the board to be soldered on the other side.
That completes the construction of a handy programming aid for Motorola cellular phones, and
you have a small packet of left over jumpers that are perfect for jumpering the test line contact
on the hand held units. Be sure to save them.
To use the test adapter, place it between the control (handset) cable and the transceiver as shown
in Photo #5.
Test Mode Commands
Once you've jumpered the appropriate contact or applied the test adapter, it's time to turn on the
phone. When the phone powers up, a series of digits should appear in the display similar to
those shown in Photo #6. They should alternate with another series of digits. This indicates
your phone is in the manual test mode.
One display consists of two numbers, each three digits in length. The set to the right is the
channel number designator for the specific cellular frequency the phone is receiving from your
local cell site (tower). The right-most trio is the relative signal strength indication (RSSI) of the
received frequency.
The seven-digit number alternating with the channel/RSSI display provides the technician with
additional status information. Each individual digit in the field is actually an independent status
register. With a letter substituted for each of the seven digits, this is what they represent:
A B C D E F G
Position A - SAT Frequency. Indicates which of the three SAT lock frequencies is being used
by the phone. In this position a "0" = 5970Hz, "1" = 6000Hz, "2" = 6030Hz, "3" = No SAT
lock.
Position B - Carrier Status indication. "0" = carrier off, "1" = carrier on.
Position C - Signalling Tone. "0" = tone off, "1" = tone on.
Position D - RF Power Attenuation Level. "0" through "7" are valid values.
Position E - Channel designation. A "0" = voice channel, "1" = control data channel.
Position F - Audio Mute (receive). "1" = received audio is muted, "0" = unmuted.
Position G - Audio Mute (transmit). "1" = transmitted audio is muted. "0" = unmuted.
The meaning of all these status registers is fairly complex and has no bearing on cellular
reprogramming. This display, like the majority of the test commands, are only of value to an
engineer placing the phone under test with a cellular service monitor.
Table "A" lists the test commands that can be of assistance in reprogramming. I have omitted
the test commands designed for use with a service monitor, as issuing them without the phone
connected to a monitor may cause interference to the cellular network. You may own the phone,
but the cellular provider owns the FCC license that allows you to use it. Operating the
transmitter in the phone in a manner inconsistent with this license could subject you to loss of
service and possible legal trouble.
Issuing Commands
If your phone did not come up with the status display described above, you may need to
manually instruct the phone to do so. Pressing "#" enters the test command mode, and "02#" is
the command to display the status registers. If you enter a command improperly, the phone will
scroll the word "error" across the display.
If you need to review the current programming data stored in the NAM, enter "55#" which
instructs the phone to enter the programming mode. You can scroll through the contents of
NAM displaying the stored values by repeatedly pressing the "*" key. Actual reprogramming
through this mode is considerably more difficult than through the standard programming mode.
The test mode does not display a step number to let you know what programming step you are
at, and the information is stored and displayed in a different order.
Many programmers simply use this mode to obtain the security code, exit test mode and program
the phone in the normal fashion. As you step through the NAM contents with the "*" key, the
security code is the only six-digit number you'll see that isn't binary. Once you've written it
down, continue to step through NAM until you see the "tick mark" in the display (it looks like
an apostrophe) and exit test mode by turning off the phone.
Motorola designed their phones so that they could only be programmed three times. I don't
know the rationale for this, but a firmware counter increments each time the phone is
reprogrammed, and after the third time it will no longer enter programming mode. The
instruction booklet that accompanies the phone instructs you to take it to the dealer where you
bought it.
If you took the phone to a dealer, they would put the phone in test mode (just like we're doing)
and enter the command "32#" which resets the counter to zero, allowing the phone to be
reprogrammed three more times. Do it yourself and save!
Many phones also have a cumulative call timer that counts the total number of minutes the phone
has been used for calls (actively transmitting). This "autonomous timer" (that you were told was
not resetable) can be cleared and reset to zero by punching in "03#" while in test mode.
Another useful command is "38#" which causes the phone to display the Electronic Serial
Number (ESN) that is burned in ROM. The phone will display the ESN one hex byte at a time.
Press "*" to increment to the next byte. Note that the display shows four numbers. The two to
the left indicate which byte you are viewing (00, 01, 02 or 03), and the actual value of that byte
is at the right of the display.
You can punch in "19#" if you'd like to view the software version number resident in your
phone.
Conclusion
You should now have an understanding of the test mode inherent in cellular phones manufactured
by Motorola, and if you've followed this series of articles in recent issues of Nuts & Volts, the
operation of the cellular network and reprogramming procedures are no longer so mysterious.
Your questions and comments are always welcome, and you can write or send E-mail directly
to me as mentioned below. If plan to do much programming or would like detailed information
on the cellular network, you would benefit greatly by investing in one of the detailed technical
publications offered in these very pages. I've listed the publishers of several good volumes in
a sidebar, and you'll find their ads scattered throughout this magazine.
As a final note, you should be aware that the use of this information is undertaken at your own
risk. Although most of this information was triple-checked against available technical
documentation, none of it originated directly from Motorola. I doubt you'll have a problem, but
you never know when a manufacturer might change their specifications.
******************************************************************************
TEST MODE COMMAND SUMMARY
The following is a summary of some of the commands available from within the test mode on
most cellular phones manufactured by Motorola.
COMMAND DESCRIPTION
# Initial keystroke to enter test command mode.
01# Reboot phone (begin power-up routine).
02# Display status registers.
03# Reset "autonomous timer" to zero minutes.
04# Initialize transceiver.
07# Mute audio (received).
08# Unmute audio (received).
11XXX# Load frequency synthesizer with specific cellular channel (XXX = 3-digit
decimal channel designator).
13# Power down the phone (off).
19# Display software version number.
32# Initialize NAM. Erases all programmed data!
36XXX# Activate channel scanning. Pauses on each channel for XXX milliseconds.
Keying "#" aborts scanning.
38# Display Electronic Serial Number (ESN).
45# Display current relative signal strength (RSSI) of currently loaded channel.
53# Enables scrambler option if phone is equipped.
54# Disables scrambler option if phone is equipped.
55# Programming mode - display/change NAM contents.
******************************************************************************
Sources of Additional Information
The following companies distribute publications that offer detailed instructions and information
pertaining to cellular programming and various aspects of cellular hardware:
Spy Supply
7 Colby Court, Suite 215
Bedford, NH 03110
(617) 327-7272
TeleCode
P.O. Box 6426
Yuma, AZ 85366-6426
(602) 782-2316
Consumertronics
2011 Crescent Drive
P.O. Box 88310
Alamogordo, NM 88310
(505) 434-0234
******************************************************************************
AUTHOR BIOGRAPHY
(For publication)
Damien Thorn's interest in electronics has deep roots. A noted "hacker" and "phone phreak" by
age sixteen, he contributed regularly to the underground newsletter "TAP." Today Damien is
an on-air radio personality and FCC licensed engineer in California's San Joaquin Valley. His
interests include computers, communications, security and privacy issues. He welcomes questions
and comments. You can reach him at 6333 Pacific Ave. #203, Stockton, CA 95207-3713 or via
E-Mail at one of the following: DrDamien@Delphi.com via Internet mail, on CompuServe at
75720,2104, or on Delphi as DrDamien.

phreak/CELLULAR/cellu.txt
+397
View File
@@ -0,0 +1,397 @@
--->> LEECHED FROM - THE RaDiANCE US HEADQUARTERS - LEECHED FROM <<---
__/\______________________________ _________ _______________ _________/\__
\/ ___________ \ | Y | | _/ \ |/
_\____ \| | /\____| | |____ | | |___\____| |
| ø| \ _____/ / ø|ø \ / | | | / ø|
| :| / \ / | :|: \\ | / | :|
|___________/|______\ \__________|_______\\_________|_______\__________|
::: __/\_______ _______________ ___ ___/\__ :::
:: SySoP: \/ | _/ Y | |/ C0's: ::
: IlluVaTaR / |____| | |____ | | REMOTE :
. .:/ | | ø|ø \ \_____ |:. & HALFAST .
. . . ::::\ | | :|: \ | | |:::: . . .
[RiP!] . . :::::::\__________|_____|_______\|__________|:::::: . . [RiP!]
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:::: NODE 1: +1-707-451-2835 ::>-RINGDOWN->:: NODE 2: +1-707-453-0210 ::::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
!21.6k HST DUAL, 68030 POWER, 677 MeGZ <-> C0NSOLE / AMiGA / H-P-A ONLiNE!
::: 0-1 DaY WaReZ OnLy! SiGMA-X BeTa, PluS ThE CoOleST UsErS aNd UtiLs!:::
:::::::::::::::::: ALWaYZ FaST, DON'T CALL iF Ya AiN'T! ::::::::::::::::::
:NuP : SaFE:::::::::::::::::::::::::::::::::::::::::::::::::::NuP : SaFE :
--------------------------------------------------------------------------
@BEGIN_FILE_ID.DIZinformation about cellular phones + phreakin
@END_FILE_ID.DIZ
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Cellular Telephones
[Written By The High Evolutionary]
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
I assume that most of us know many of the technical aspects of Cellular
Phreaking therefore this file is intended for general information as to how
these unique devices operate.
--------------------------------------------------------------
Cellular is likely to be successful because it provides dramatic
improvements over the historic automobile phones. For years, mobile
radio-telephone service was an extremely limited proposition. There were only
forty-four radio channels available, and a maximum of about thirty were
assigned to any one area. That meant if all thirty channels were occupied-one
conversation per channel-and you were the thirty-first mobile phone user who
wished to make a call, you would have to wait thirty minutes or more, even in a
city the size of New York. As you can imagine, mobile radio-telephone service
like that could not become very popular. Even with the limited number of
channels, long delays in making calls during busy periods, and often poor
quality transmission, there were big waiting lists for mobile service. But
with a fully equipped cellular radio-telephone system, it is possible to make
5000 times as many calls simultaneously in the same metropolitan area, opening
up the service to anyone that can pay the hefty prices.
That is because cellular radio-telephones systems are technically quite
different from traditional mobile telephones. First, the FCC (Federal
Communications Commission) has allocated far more channels to cellular, 666 in
all. Second, those 666 channels are broadcast from many different locations.
In the old mobile telephone systems, there was one powerful radio station with
a large antenna that served an entire city. In the new system, a geographical
area is honeycombed with many cells, hence the name 'Cellular'. Each cell has
its own low-powered radio transmitter and receiver. As a car with a cellular
telephone or a person carrying a portable moves from one cell to the next, the
call is transferred automatically. You're unlikely to notice when this
transfer takes place, even though your phone is suddenly switched to a
different radio station and to another channel while you are talking.
Because the cellular signal is low-powered, it doesn't go very far. This
permits the same channel you are talking on to be used for calls in other parts
of the same metropolitan area without interference. This would mean cellular
radio-telephone systems can serve a very large number of customers in an area
because there are more channels than before-and the larger number of channels
are reused.
Unlike local telephone service, which is provided by a monopoly, there is
competition in cellular. Two classes of companies are allowed to offer
cellular telephone service in every market. One cellular system can be owned
by a telephone company, the other by someone else. The two-company rule was
adopted by the FCC so that AT&T, which developed cellular, could not monopolize
the whole thing.
Cellular Telephones come in two basic versions, as car phones and portable
phones, with a briefcase hybrid. Car phones are by far the most common,
because they are much cheaper. But most believe that, ultimately, portables
will be the most popular. Washington Post Company president Richard Simmons,
whose company is a partner in several cellular systems, even predicts that by
the early 1990's "There will be phones roughly the size of a calculators that
you carry around in your pocket. They will cost no more than five hundred
dollars. They will emancipate people from the necessity of locating a phone to
make calls. The bad news is, you will never be able to get away from the phone,
and we'll call it progress."
Car telephones include a small transmitter-receiver unit that is usually
mounted in the trunk, an antenna and a control head that includes the handset.
In most cellular systems, the telephone touchpad is located on the handset.
Many domestic and foreign manufacturers make cellular car phones, but so far
only Motorola makes portables, the DYNA T-A-C 8000X and 8000S. Motorola's
portables look like a slightly enlarged, somewhat chunky telephone handset,
with a stubby antenna at one end.
Portables are less powerful than car units, so they can't be used with some
cellular systems. The portable's other limitation is battery life. A portable
can listen for calls for about eight hours, but it can only transmit for only
thirty minutes. After that time it must be charged for a minimum of an hour.
The following American cities have cellular telephone service or soon will
get it:
New York Denver
Los Angeles Seattle
Chicago Milwaukee
Philadelphia Tampa
Detroit Cincinnati
Boston Kansas City
San Francisco Buffalo
Washington Phoenix
Dallas San Jose
Houston Indianapolis
St. Louis New Orleans
Miami Portland
Pittsburgh Cleveland
San Diego Atlanta
Baltimore Minneapolis
--------------------------------------------------------------
%
THE ELECTRONIC SERIAL NUMBER: A CELLULAR 'SIEVE'?
'SPOOFERS' CAN DEFRAUD USERS AND CARRIERS
by Geoffrey S. Goodfellow, Robert N. Jesse, and Andrew H. Lamothe, Jr.
What's the greatest security problem with cellular phones? Is it privacy of
communications? No.
Although privacy is a concern, it will pale beside an even greater problem:
spoofing.
'Spoofing' is the process through which an agent (the 'spoofer') pretends to
be somebody he isn't by proffering false identification, usually with intent
to defraud. This deception, which cannot be protected against using the
current U.S. cellular standards, has the potential to create a serious
problem--unless the industry takes steps to correct some loopholes in the
present cellular standards.
Compared to spoofing, the common security concern of privacy is not so severe.
Most cellular subscribers would, at worst, be irked by having their
conversational privacy violated. A smaller number of users might actually
suffer business or personal harm if their confidential exchanges were
compromised. For them, voice encryption equipment is becoming increasingly
available if they are willing to pay the price for it.
Thus, even though technology is available now to prevent an interloper from
overhearing sensitive conversations, cellular systems cannot--at any
cost--prevent pirates from charging calls to any account. This predicament is
not new to the industry. Even though cellular provides a modern,
sophisticated quality mobile communications service, it is not fundamentally
much safer than older forms of mobile telephony.
History of Spoofing Vulnerability
The earliest form of mobile telephony, unsquelched manual Mobile Telephone
Service (MTS), was vulnerable to interception and eavesdropping. To place a
call, the user listened for a free channel. When he found one, he would key
his microphone to ask for service: 'Operator, this is Mobile 1234; may I
please have 555-7890.' The operator knew to submit a billing ticket for
account number 1234 to pay for the call. So did anybody else listening to the
channel--hence the potential for spoofing and fraud.
Squelched channel MTS hid the problem only slightly because users ordinarily
didn't overhear channels being used by other parties. Fraud was still easy
for those who turned off the squelch long enough to overhear account numbers.
Direct-dial mobile telephone services such as Improved Mobile Telephone
Service (IMTS) obscured the problem a bit more because subscriber
identification was made automatically rather than by spoken exchange between
caller and operator. Each time a user originated a call, the mobile telephone
transmitted its identification number to the serving base station using some
form of Audio Frequency Shift Keying (AFSK), which was not so easy for
eavesdroppers to understand.
Committing fraud under IMTS required modification of the mobile--restrapping
of jumpers in the radio unit, or operating magic keyboard combinations in
later units--to reprogram the unit to transmit an unauthorized identification
number. Some mobile control heads even had convenient thumb wheel switches
installed on them to facilitate easy and frequent ANI (Automatic Number
Identification) changes.
Cellular Evolution
Cellular has evolved considerably from these previous systems. Signaling
between mobile and base stations uses high-speed digital techniques and
involves many different types of digital messages. As before, the cellular
phone contains its own Mobile Identification Number (MIN), which is programmed
by the seller or service shop and can be changed when, for example, the phones
sold to a new user. In addition, the U.S. cellular standard incorporates a
second number, the 'Electronic Serial Number' (ESN), which is intended to
uniquely and permanently identify the mobile unit.
According to the Electronic Industries Association (EIA) Interim Standard
IS-3-B, Cellular System Mobile Station--Land Station Compatibility
Specification (July 1984), 'The serial number is a 32-bit binary number that
uniquely identifies a mobile station to any cellular system. It must be
factory-set and not readily alterable in the field. The circuitry that
provides the serial number must be isolated from fraudulent contact and
tampering. Attempts to change the serial number circuitry should render the
mobile station inoperative.'
The ESN was intended to solve two problems the industry observed with its
older systems.
First, the number of subscribers that older systems could support fell far
short of the demand in some areas, leading groups of users to share a single
mobile number (fraudulently) by setting several phones to send the same
identification. Carriers lost individual user accountability and their means
of predicting and controlling traffic on their systems.
Second, systems had no way of automatically detecting use of stolen equipment
because thieves could easily change the transmitted identification.
In theory, the required properties of the ESN allow cellular systems to check
to ensure that only the correctly registered unit uses a particular MIN, and
the ESNs of stolen units can be permanently denied service ('hot-listed').
This measure is an improvement over the older systems, but vulnerabilities
remain.
Ease of ESN Tampering
Although the concept of the unalterable ESN is laudable in theory, weaknesses
are apparent in practice. Many cellular phones are not constructed so that
'attempts to change the serial number circuitry renders the mobile station
inoperative.' We have personally witnessed the trivial swapping of one ESN
chip for another in a unit that functioned flawlessly after the switch was
made.
Where can ESN chips be obtained to perform such a swap? We know of one recent
case in the Washington, D.C. area in which an ESN was 'bought' from a local
service shop employee in exchange for one-half gram of cocaine. Making the
matter simpler, most manufacturers are using industry standard Read-Only
Memory (ROM) chips for their ESNs, which are easily bought and programmed or
copied.
Similarly, in the spirit of research, a west coast cellular carrier copied the
ESN from one manufacturer's unit to another one of the same type and
model--thus creating two units with the exact same identity.
The ESN Bulletin Board
For many phones, ESN chips are easy to obtain, program, and install. How does
a potential bootlegger know which numbers to use? Remember that to obtain
service from a system, a cellular unit must transmit a valid MIN (telephone
number) and (usually) the corresponding serial number stored in the cellular
switch's database.
With the right equipment, the ESN/MIN pair can be read right off the air
because the mobile transmits it each time it originates a call. Service shops
can capture this information using test gear that automatically receives and
decodes the reverse, or mobile-to-base, channels.
Service shops keep ESN/MIN records on file for units they have sold or
serviced, and the carriers also have these data on all of their subscribers.
Unscrupulous employees could compromise the security of their customers'
telephones.
In many ways, we predict that 'trade' in compromised ESN/MIN pairs will
resemble what currently transpires in the long distance telephone business
with AT&T credit card numbers and alternate long-distance carrier (such as
MCI, Sprint and Alltel) account codes. Code numbers are swapped among
friends, published on computer 'bulletin boards' and trafficked by career
criminal enterprises.
Users whose accounts are being defrauded might--or might not--eventually
notice higher-than-expected bills and be reassigned new numbers when they
complain to the carrier. Just as in the long distance business, however, this
number 'turnover' (deactivation) won't happen quickly enough to make abuse
unprofitable. Catching pirates in the act will be even tougher than it is in
the wireline telephone industry because of the inherent mobility of mobile
radio.
Automating Fraud
Computer hobbyists and electronics enthusiasts are clever people. Why should
a cellular service thief 'burn ROMs' and muck with hardware just to install
new IDs in his radio? No Herculean technology is required to 'hack' a phone
to allow ESN/MIN programming from a keyboard, much like the IMTS phone thumb
wheel switches described above.
Those not so technically inclined may be able to turn to mail-order
entrepreneurs who will offer modification kits for cellular fraud, much as
some now sell telephone toll fraud equipment and pay-TV decoders.
At least one manufacturer is already offering units with keyboard-programmable
MINs. While intended only for the convenience of dealers and service shops,
and thus not described in customer documentation, knowledgeable and/or
determined end users will likely learn the incantations required to operate
the feature. Of course this does not permit ESN modification, but easy MIN
reprogrammability alone creates a tremendous liability in today's roaming
environment.
The Rolls Royce of this iniquitous pastime might be a 'Cellular Cache-Box.' It
would monitor reverse setup channels and snarf ESN/MIN pairs off the air,
keeping a list in memory. Its owner could place calls as on any other
cellphone. The Cache-Box would automatically select an ESN/MIN pair from its
catalog, use it once and then discard it, thus distributing its fraud over
many accounts. Neither customer nor service provider is likely to detect the
abuse, much less catch the perpetrator.
As the history of the computer industry shows, it is not far-fetched to
predict explosive growth in telecommunications and cellular that will bring
equipment prices within reach of many experimenters. Already we have seen the
appearance of first-generation cellular phones on the used market, and new
units can be purchased for well under $1000 in many markets.
How High The Loss?
Subscribers who incur fraudulent charges on their bills certainly can't b
expected to pay them. How much will fraud cost the carrier? If the charge is
for home-system airtime only, the marginal cost to the carrier of providing
that service is not as high as if toll charges are involved. In the case of
toll charges, the carrier suffers a direct cash loss. The situation is at its
worst when the spoofer pretends to be a roaming user. Most inter-carrier
roaming agreements to date make the user's home carrier (real or spoofed)
responsible for charges, who would then be out hard cash for toll and airtime
charges.
We have not attempted to predict the dollar losses this chicanery might
generate because there isn't enough factual information information for anyone
to guess responsibly. Examination of current estimates of long-distance-toll
fraud should convince the skeptic.
Solutions
The problems we have described are basically of two types. First, the ESN
circuitry in most current mobiles is not tamper-resistant, much less
tamper-proof. Second and more importantly, the determined perpetrator has
complete access to all information necessary for spoofing by listening to the
radio emissions from valid mobiles because the identification information
(ESN/MIN) is not encrypted and remains the same with each transmission.
Manufacturers can mitigate the first problem by constructing mobiles that more
realistically conform to the EIA requirements quoted above. The second
problem is not beyond solution with current technology, either. Well-known
encryption techniques would allow mobiles to identify themselves to the
serving cellular system without transmitting the same digital bit stream each
time. Under this arrangement, an interloper receiving one transmission could
not just retransmit the same pattern and have it work a second time.
An ancillary benefit of encryption is that it would reasonably protect
communications intelligence--the digital portion of each transaction that
identifies who is calling whom when.
The drawback to any such solution is that it requires some re-engineering in
the Mobile-Land Station Compatibility Specification, and thus new software or
hardware for both mobiles and base stations. The complex logistics of
establishing a new standard, implementing it, and retrofitting as much of the
current hardware as possible certainly presents a tough obstacle, complicated
by the need to continue supporting the non-encrypted protocol during a
transition period, possibly forever.
The necessity of solving the problem will, however, become apparent. While we
presently know of no documented cases of cellular fraud, the vulnerability of
the current standards and experience with similar technologies lead us to
conclude that it is inevitable. Failure to take decisive steps promptly will
expose the industry to a far more expensive dilemma. XXX
Geoffrey S. Goodfellow is a member of the senior research staff in the
Computer Science Laboratory at SRI International, 333 Ravenswood Ave., Menlo
Park, CA 94025, 415/859-3098. He is a specialist in computer security and
networking technology and is an active participant in cellular industry
standardization activities. He has provided Congressional testimony on
telecommunications security and privacy issues and has co-authored a book on
the computer 'hacking' culture.
Robert N. Jesse (2221 Saint Paul St., Baltimore, MD 21218, 301/243-8133) is an
independent consultant with expertise in security and privacy, computer
operating systems, telecommunications and technology management. He is an
active participant in cellular standardization efforts. He was previously a
member of the senior staff at The Johns Hopkins University, after he obtained
his BES/EE from Johns Hopkins.
Andrew H. Lamothe, Jr. is executive vice-president of engineering at Cellular
Radio Corporation, 8619 Westwood Center Dr., Vienna, VA 22180, 703/893-2680.
He has played a leading role internationally in cellular technology
development. He was with Motorola for 10 years prior to joining American
TeleServices, where he designed and engineered the Baltimore/Washington market
trial system now operated by Cellular One.
--------
A later note indicates that one carrier may be losing something like $180K per
month....

phreak/CELLULAR/cellufon.phk
+132
View File
@@ -0,0 +1,132 @@
CELLULAR RADIO / PHONES
<S><C><A><N><*><M><A><N>
MOST SCANNER ENTUSIASTES ARE FAMILIAR WITH THE STANDARD MOBILE TELEPHONE
SYSTEM; THIS SYSTEM HAS GONE THROUGH VERY LITTLE EVOLUTION IN THE PAST DECADE,
AND IN THE US. IT HAS REMAINED A CONSIDERABLY LIMITED SERVICE. A LARGE METRO
ARE MAY ONLY HAVE SEVERAL HUNDRED USERS, (NEW YORK HAS APPROX. 700 MOBILE
TELEPHONE SUBSCRIBERS), DUE LARGELY TO LIMITAIONS IMPOSED BY SPECTRAL
OVERCROWDING. SO-CALLED CELLULAR TECHNOLOGY PROMISES TO CHANGE ALL THAT,
OFFERING SERVICE TO LITERALLY HUNDREDS OF THOUSANDS OF USERS. LAND MOBILE
COMMUNICATIONS HAS SEEN A 10-12% ANNUAL GROWTH RATE FOR THE PAST TWO DECADES
THE RESULT IS THAT THE 40,150,450 MHZ BANDS ARE OVER CROWDED. EVEN THE
UTILIZATION OF THE NEW 900MHZ BAND WITH 30-40 TIMES MORE CHANNELS AVAIL. THAN
ON OTHER BANDS IS A SHORT LIVED SOLUTION TO THE PROBLEM. CELLULAR TECHNOLOGY IS
A RESONABLE ALTERNATIVE. CELLULAR TECHNOLOGY STANDARDS SUCH AS RECOMMENDED
TRANSMISSION MODES (SSB, FM, DIGITAL, OR SPREAD SPECTRUM) HAVE YET TO BE AGREED
UPON BUT WE CAN OUTLINE THE GENERAL PRINCIPLES BEHIND ITS IMPLIMENTATION AND
USE.
THE CELL AND THE MOBILE CALL
THE ONLY FUNDIMENTAL POINT OF CELLULAR TECHNOLOGY IMPLIMENTATION ACTUALLY
AGREED UPON TO DATE IS THAT A GIVEN SERVICE AREA WILL BE DIVIDED INTO IDENTICLE
ADJACENT CELLS WITH NO OVERLAPS AND NO GAPS,HEXAGONS ARE POPULAR FOR DIAGRAMING
INDIVIDUAL CELLS. AT THE CENTER OF AN INDIVIDUAL CELL IS A BASE STATION WHICH
IS CONNECTED VIA LAND LINE TO A LOCAL MOBILE TELEPHONE SWITCHING OFFICE.
CERTAIN FREQUENCY BANDS ARE ASSIGNED TO CERTAIN CELLS, BUT NOT SHARED WITH
ADJACENT CELLS TO AVOID MUTUAL INTERFERENCE. A MOBILE UNIT WISHING TO MAKE A
CALL WILL GO OFF-HOOK AND TRANS MITT DIGITAL SOURCE AND DESTINATION CODES.
THESE TRANS MISSIONS TAKE PLACE ON SPECIAL SETUP CHANNELS AND ARE JSUT STRONG
ENOUGH TO REACH THE BASE STATION IN THE LOCAL CELL.
THE BASE STATION THEN RECIEVES THE CODES AND FORWARDS A MESSAGE TO THE CENTRAL
SWITCHING OFFICE WHICH IN TURN SENDS OUT A PAGING SIGNAL TO ALL CELLS IN SEARCH
OF THE SECOND MOBILE UNIT WHOSE NUMBER HAS BEEN DIALED. WHEN THE DESTIANTION
UNIT IS FINALLY FOUND, IT RESPONDES TO THE PAGING SIGNAL BY TRANSMITTING AN
ACKNOWLEDGEMENT CODE TO ITS LOCAL BASE STATION ON A SETUP CHANNEL.
THE SWITCHING CENTER THEN ASSIGNES A PAIR OF FREQ'S (CHANNEL PAIR) TO EACH OF
THE UNITS FOR ACTUAL VOICE COMMUNICATIONS TO TAKE PLACE. THESE CHANNEL PAIRS
ARE NOT NECCESARILY THE SAME FOR THE RESPECTIVE CELLS THAT EACH MOBILE UNIT IS
IN. THESE FREQ'S ARE ALSO RELAYED THROUGH THE BASE STATIONS AND THE CENTRAL
SWITCHING OFFICE.
WHEN ONE UNIT MOVES INTO ANOTHER CELL, THINGS GET REALLY INTERESTING. UPON
ENTRY INTO ANOTHER CELL THE MOBILE UNITS MUST TRANSMITT THROUGH A NEW BASE
STATION. AN AUTOMATIC HANDOFF TO THE NEW BASE STATION IS CARRIED OUT BY ANOTHER
EXCHANGE OF DATA THROUGH THE SETUP CHANNEL.
TERMINATION OF THE CALL IS A SIMPLE MATTER. WHEN THE CALL ENDS ON HOOK SIGNALS
ARE EXCHANGED VIA THE SETUP CHANNELS BETWEEN THE MOBILE UNIT AND THE BASE
STATION. THE MAIN VOICE CHANNELS ARE THEN CLEARED.
ADVANCED MOBILE TELEPHONE SYSTEM
IN 1979 AT&T BEGAN TEST MARKETING ITS VERSION OF A CELLULAR TELEPHONE SYSTEM IN
CHICAGO,ILL. THIS SYSTEM IS CALLED ADVANCED MOBILE TELEPHONE SYSTEM (AMPS)
SOME 2100 SQ MILES OF THE METRO CHICAGO AREA ARE DIVIDED INTO 10 CELLS TO SERVE
APPROX. 2000 CUSTOMERS. FULL DUPLEX IS POSSIBLE BY USING A PAIR OF ONE WAY
CHANNELS SEPERATED BY 45MHZ TO CONNECT THE MOBILE UNITS WITH THE BASE STATIONS.
THE RF RANGE IS 825-890 MHZ AND NORMAL NARROW BAND FM IS USED TO TRANSMITT
VOICE. HAND OFF TO ADJACENT CELLS IS ACCOMPLISHED BY MONITORING SIGNAL
STRENGTHS. WHEN THE CENTRAL SWITCHING OFFICE DETERMINES THAT A NEW BASE STATION
RECIEVES THE MOBILE UNITS SIGNAL BETTER THAN THE PREVIOUS ONE THE SWITCHING
OFFICE SIGNALS THROUGH THE VOICE CHANNEL FOR THE MOBILE PHONE TO SWITCH TO A
NEW CHANNEL. COMMUNICATIONS DISRUPTION THROUGH THE SWITCHING PROCESS IS ONLY 50
MILLISECONDS.
AS WITH IMPS (DISCUSSED IN THE FEATURE ARTICLE ON THIS BBS (PIRATE-80)) THERE
IS THE POSSIBILITY OF PHREAKING CALLS WITH IMPS OR AMPS SIMPLY BY MONITERING
THE SETUP CHANNELS WITH A SCANNER AND RECORDING THE ID NUMBERS AND THE DIALED
NUMBERS SINCE THEY ARE IN DIAL PULSE FORM AND AFTER U HAVE A NICE SET OF
NUMBERS U WILL NEED A TRANSMITTER OF SUFFICIENT STRENGTH TO REACH THE BASE
STATION (UNLICIENCED TRANSMITTER OF COURSE).
FINAL COMMENTS
MANY REGULATORY AND IMPLIMENTATION ISSUES REMAIN UNSOLVED. MODULATION ISSUES
ARE THE BIGGEST PROBLEM TO BE SOLVED. SINGLE SIDEBAND AM, NARROW BAND FM,
DIGITAL, AND SPREAD SPECTRUM TECHNIQUE'S ARE ALL BEING CONSIDERED.
BIBLIOGRAPHY
1. CELLULAR MOBILE TECHNOLOGY: THE GREAT MULTIPLIER BY GEORGE COOPER AND RAY
NETTELTON. IEEE SPECTRUM, VOL 20 #6 JUNE 83 PP 30-37
2. MOBILE COMMUNICATIONS ENGINEERING BY WILLIAM C.Y. LEE
3.*** SPECIAL ISSUE ON AMPS. BELL SYSTEM TECHNICAL JOURNAL JAN. 79.
THIS FILE IS PRESENTED BY MT. <S><C><A><N><*><M><A><N> AND PIRATE-80
SYSTEMS....
phreak/CELLULAR/cellular.2fr
BIN
View File
Binary file not shown.
phreak/CELLULAR/cellular.rdt
+750
View File
@@ -0,0 +1,750 @@
C e l l u l a r T e l e p h o n y
by
B r i a n O b l i v i o n
A -=Restricted -=Data -=Transmission
The benefit of a mobile transceiver has been the wish of experimentors
since the late 1800's. To have the ablility to be reached by another
man despite location, altitude, or depth has had high priority in
communication technology throughout its history. Only until the late
1970's has this been available to the general public. That is when
Bell Telephone (the late MaBell) introduced the Advanced Mobile
Phone Service, AMPS for short.
Cellular phones today are used for a multitude of different jobs.
They are used in just plain jibber-jabber, data transfer(I will
go into this mode of cellular telephony indepth later), corporate
deals, surveillance, emergencies, and countless other applications.
The advantages of cellular telephony to the user/phreaker are
obvious:
1. Difficulty of tracking the location of a transciever
(especially if the transciever is on the move) makes
it very difficult to locate
2. Range of the unit within settled areas
3. Scrambling techniques are feasible and can be made to
provide moderate security for most transmissions.
4. The unit, with modification can be used as a bug, being
called upon by the controlling party from anywhere on
the globe.
5. It with the right knowledge one can modify the cellular
in both hardware and software to create a rather diverse-
iffied machine that will scan, store and randomly change
ESN's per call there by making detection almost impossible.
I feel it will be of great importance for readers to understand the
background of the Cellular phone system, mainly due to the fact that
much of the pioneering systems are still in use today. The first
use of a moblie radio came about in 1921 (remember prohibition?)
by the Detroit police department. This system operated at 2Mhz. In
1940, frequencies between 30 and 40Mhz were made available to and
soon became overcrowded. The trend of overcrowding continues today.
In 1946, the FCC declared a 'public corresponence system' called,
or rather classified as "Domestic Public Land Mobile Radio Service"
(DPLMRS) at 35 - 44 Mhz band that ran along the highway between
New York and Boston. Now the 35-44MHz band is used mainly by Amateur
radio hobbiest's due to the bands susceptibility to skip-propogation.
These early mobile radio systems were all PTT(push-to-talk) systems
that did not enjoy todays duplex conversations. The first real
mobile 'phone' system was the 'Improved Mobile Telephone Service'
or the IMTS for short, in 1969. This system covered the spectrum
from 150 - 450MhHz, sported automatic channel selection for each
call, eliminated PTT, and allowed the customer to do thier own
dialing. From 1969 to 1979 this was the mobile telephone service
that served the public and business community, and it is still
used today.
IMTS frequencies used(MHz):
Channel Base Frequency Mobile Frequency
VHF Low Band
ZO 35.26 43.26
ZF 35.30 43.30
ZH 35.34 43.34
ZA 35.42 43.32
ZY 34.46 43.46
ZC 35.50 43.50
ZB 35.54 43.54
ZW 35.62 43.62
ZL 35.66 43.66
VHF High Band
JL 152.51 157.77
YL 152.54 157.80
JP 152.57 157.83
YP 152.60 157.86
YJ 152.63 157.89
YK 152.66 157.92
JS 152.69 157.95
YS 152.72 157.98
YA 152.75 158.01
JK 152.78 158.04
JA 152.81 158.07
UHF Band
QC 454.375 459.375
QJ 454.40 459.40
QO 454.425 459.425
QA 454.45 459.45
QE 454.475 459.475
QP 454.50 459.50
QK 454.525 459.525
QB 454.55 459.55
QO 454.575 459.575
QA 454.60 459.60
QY 454.625 459.625
QF 454.650 459.650
VHF High frequencies are the most popular frequencies of all
the IMTS band. VHF low bands are used primarily in rural areas
and those with hilly terrain. UHF bands is primarily used in cities
where the VHF bands are overcrowded. Most large cities will find
at least one station being used in their area.
ADVANCED MOBILE PHONE SYSTEM
The next step for Mobile telephone was made in 1979 by Bell
Telephone, again (gee.. where was the competition?), introducing
the Advanced Mobile Phone Service. This service is the focus
of this document, which has now taken over the mobile telephone
industry as the standard. What brought this system to life
were the new digital technologies of the 1970's. This being
large scale integrated custom circuits and microprocessors.
Without these technologies, the system would not have been
economically possible.
The basic elements of the cellular concept have to do with
frequency reuse and cell splitting.
Frequency reuse refers to the use of radio channels on the same
carrier frequency to cover different areas which are seperated by
a signifigant distance. Cell splitting is the ability to split
any cell into smaller cells if the traffic of that cell requires
attitional frequencies to handle all the area's calls. These two
elements provide the network an opportunity to handle more simul-
taneous calls, decrease the transmitters/receivers output/input
wattage/gain and a more universal signal quality.
When the system was first introduced, it was allocated 40mHz in
the frequency spectrum, divided into 666 duplex radio channels
providing about 96 channels per cell for the seven cluster
frequency reuse pattern. Cell sites (base stations) are located
in the cells which make up the cellular network. These cells
are usually represented by hexagons on maps or when developing
new systems and layouts. The cell sites contain radio, control,
voice frequency processing and maintnence equipment, as well as
transmitting and receiving antennas. The cell sites are inter-
connected by landline with the Mobie Telecommunications Switching
Office (MTSO).
In recent years, the FCC has added 156 frequencies to the Cellular
bandwidth. This provides 832 possible frequencies available to
each subscriber per cell. All new cellular telephones are built
to accomodate these new frequencies, but old cellular telephones
still work on the system. How does a cell site know if the unit
is old or new? Let me explain.
The problem of identifying a cellular phones age is done by the
STATION CLASS MARK (SCM). This Numer is 4 bits long and broken
down like this:
Bit 1: 0 for 666 channel usage (old)
1 for 832 channel usage (new)
Bit 2: 0 for a mobile unit(in vehical)
1 for voice-activated transmit (for protables)
Bit 3-4: Indentify the power class of the unit
Class I 00 = 3.0 watts Continuous Tx's 00XX...DTX <> 1
Class II 01 = 1.2 watts Discont. Tx's 01XX...DTX = 1
Class III 10 = 0.6 watts reserved 10XX, 11XX
Reserved 11 = --------- Letters DTX set to 1 permits
use of discontinuous trans-
missions
Cell Sites: How Cellular telephones get their name
Cell sites, as mentioned above are layed out in a hexagonal type
grid. Each cell is part of a larger cell which is made up of
seven cells in the following fashion:
|---| ||===|| |---| |---| |---| |---
/ \ // \\ / \ / \ / \ /
| |===|| 2 ||===|| ||===|| |---| |---|
\ // \ / \\ // \\ / \ / \
|---|| 7 |---| 3 ||==|| 2 ||==|| |---| |---|
/ \\ / \ // \ / \\ Due to the \
| ||---| 1 |---|| 7 |---| 3 ||--| difficulty of |
\ // \ / \\ / \ // \ representing /
|--|| 6 |---| 4 ||--| 1 |---|| |graphics with |
/ \\ / \ // \ / \\ / ascii characters\
| ||==|| 5 ||==|| 6 |---| 4 ||--| I will only show |
\ / \\ // \\ / \ // \ two of the cell /
|---| ||===|| ||===|| 5 ||==|| |types I am trying-
/ \ / \ / \\ // \ / to convey. \
| |---| |---| ||==|| |---| |---| |
\ / \ / \ / \ / \ / \ /
|---| |---| |---| |---| |---| |---|
As you can see, each cell is a 1/7th of a larger cell. Where one(1)
is the center cell and two(2) is the cell directly above the center.
The other cells are number around the center cell in a clockwise
fashion, ending with seven(7). The cell sites are equiped with
three directional antennas with an RF beamwidth of 120 degrees
providing 360 degree coverage for that cell. Note that all cells
never share a common border. Cells which are next to each other
are obviously never assigned the same frequencies. They will
almost always differ by at least 60 Khz. This also demonstrates
the idea behind cell splitting. One could imagine that the parimeter
of one of the large cells was once one cell. Due to a traffic
increase, the cell had to be sub-divided to provide more channels
for the subscribers. Note that subdivisions must be made in factors
of seven.
There are also Moblie Cell sites, which are usually used in the
transisitional period during the upscaling of a cell site due to
increased traffic. Of course, this is just one of the many uses of
this component. Imagine you are building a new complex in a very
remote location. You could feasibly install a few mobile cellular
cell sites to provide a telephone-like network for workers and
executives. The most unique component would be the controller/
transceiver which provides the communications line between the
cell site and the MTSO. In a remote location such a link could
very easily be provided via satellite up/down link facilities.
Lets get into how the phones actually talk with eachother. There
are several ways and competitors have still not set an agreed upon
standard.
Frequency Division Multiple Access (FDMA)
This is the traditional method of traffic handling. FDMA is a
single channel per carrier analog method of transmitting signals.
There has never been a definate set on the type of modulation to
be used. There are no regulations requiring a party to use a single
method of modulation. Narrow band FM, single sidband AM, digital, and
spread-spectrum techniques have all been considered as a possible
standard. But none hae yet to be chosen.
FDMA works like this: Cell sites are constantly searching out
free channels to start out the next call. As soon as a call finishes
the channel is freed up and put on the list of free channels. Or, as
a subscriber moves from one cell to another the new cell they are in
will hopefully have an open channel to recieve the current call in
progress and carry it through its location. This process is called
handoff, and will be discussed more indepth further along.
Other proposed traffic handling schemes include Time-Division
Multiple Acces (TDMA), Code-Division Multiple Access(CDMA), and
Time-Division/Frequency Division Multiple Access.
Time Division Multiple Access
With TDMA calls are simultaneously held on the same channels, but
are mutiplexed between pauses in the conversation. These pauses
occur in the way people talk and think, and the telephone company
also injects small delays on top of the conversation to accommodate
other traffic on that channel. This increase in the length of the
usual pause results in a longer amount of time spent on the call.
Longer calls result in higher cost of the call.
Code Division Multiple Access
This system has been used in mobile military communications for the
past 35 years. This system is digital and breaks up the digitized
conversation into bundles, compressed, sent, then decompressed and
converted back into analog. There are said increases of throughput
of 20 : 1 but CDMA is susceptible to interference which will result
in packet retransmission and delays. Of course error correction can
can help in data integrity, but will also result in a small delay in
throughput.
Time-Dvision/Frequency Division Multiple Access
TD/FDMA is a relatively new system which is an obvious hybrid of
FDMA and TDMA. This system is mainly geared towards the increase
of digital transmission over the cellular network. TD/FDMA make
it possible to transmit signals from base to moblie without
disturbing the conversation. With FDMA there are signifigant
disturbances during handoff with prevent continual data transmission
from site to site. TD/FDMA make it possible to transmit control
signals by the same carrier as the data/voice thereby ridding
extra channel usage for control.
Cellular Frequency Usage and channel allocation
There are 832 cellular phone channels which are split into two
seperate bands. Band A consists of 416 channels for non-wireline
services. Band B consists equally of 416 channels for wireline
services. Each of these channels are split into two frequencies
to provide duplex operation. The lower frequency is for the mobile
unite while the other is for the cell site. 21 channels of each
Band are dedicated to 'control' channels and the other 395 are
voice channels. You will find that the channels are numbered from
1 to 1023, skipping channels 800 to 990.
I found these handy-dandy equations that can be used for calculating
frequencies from channels and channels from frequencies.
N = Cellular Channel # F = Cellular Frequency
B = 0 (mobile) or B = 1 (cell site)
CELLULAR FREQUENCIES from CHANNEL NUMBER:
F = 825.030 + B * 45 + ( N + 1 ) * .03
where: N = 1 to 799
F = 824.040 + B * 45 + ( N + 1 ) * .03
where: N = 991 to 1023
CHANNEL NUMBER from CELLULAR FREQUENCIES
N = 1 + (F - 825.030 - B * 45) / .03
where: F >= 825.000 (mobile)
or F >= 870.030 (cell site)
N = 991 + (F - 824.040 - B * 45) / .03
where: F <= 825.000 (moblie)
or F <= 870.000 (base)
Now that you have those frequencies, what to do with them. Well,
for starters, one can very easily monitor the cellular frequencies
with most hand/base scanners. Almost all scanners pre-1988 have
some coverage of the 800 - 900 MHz band. All scanners can
monitor the IMTS frequencies.
Remember that cellular phones operate on a full duplex channel.
That means that one frequency is used for transmission and the
other is used for receiving, each spaced exactly 30 Khz apart.
Remember also that the base frequencies are 45MHz higher than
the cellular phone frequencies. This can obviously make
listening rather difficult. One way to listen to both parts of
the conversation would be having two scanners programmed 45 Mhz
apart to capture the entrire conversation.
The upper UHF frequency specrum was 'appropriated' by the Cellular
systems in the late 1970's. Televisions are still made to
recieve up to channel 83. This means that you can recieve much
of the cellular system on you UHF receiver. One television channel
occupies 6Mhz of bandwidth. This was for video, sync, and audio
transmission of the channel. A cellular channel only takes up
24 KHz plus 3KHz set up as a guard band for each audio signal.
This means that 200 cellular channels can fit into one UHF
television channel. If you have an old black and white television
drop a variable cap in there to increase the sensistivity of the
tuning. Some of the older sets have coarse and fine tuning knobs.
Some of the newer, smaller, portable television sets are tuned by
a variable resistor. This make modifications MUCH easier, for now
all you have to do is drop in there a smaller value pot and
tweak away. I have sucessfully done this on two televisions.
Most users will find that those who don't live in a city will
have a much better listening rate per call. In the city, the cells
are so damn small that handoff is usually every other minute.
Resulting in chopped conversations.
If you wanted to really get into it, I would suggest to obtain an
old Television set with decent tuning controls and remove the RF
section out of the set. You don't want all that hi-voltage circuitry
lying around(flyback and those caps). UHF recievers in televisions
downconvert UHF frequencies to IF (intermediate frequencies) between
41 and 47 MHz. These output IF frequencies can then be run into a
scanner set to pick-up between 41 - 47 MHz. Anyone who works with
RF knows that it is MUCH easier to work with 40MHz signals than working
with 800MHz signals (not to far away from Ghz.. mmmmmmm.. Waveguides
are just sooo much fun). JUST REMEMBER ONE THING!!!! Isolate the
UHF reciever from your scanner by using a coupling capacitor(.01 -
.1 microfarad(50V min.) will do nicely)!!!! You don't want any of
those biasing voltages creeping into your scanners recieving
AMPLIFIERS!!! Horrors. Also, don't forget to gound both the scanner
and reciever.
Some systems transmit and recieve the same cellular transmission
on the base frequencies. There you can simply hang out on the
base frequency and capture both sides of the conversation. The
handoff rate is much higher in high traffic areas leading the listener
to hear short or choppy conversations. At times you can listen in
for 5 to 10 minutes per call, depending on how fast the caller is
moving through the cell site.
TV Cell & Channel Scanner TV Oscillator Band
Channel Freq.& Number Frequency Frequency Limit
===================================================================
73 (first) 0001 - 825.03 45.97 871 824 - 830
73 (last) 0166 - 829.98 41.02 871 824 - 830
74 (first) 0167 - 830.01 46.99 877 830 - 836
74 (last) 0366 - 835.98 41.02 877 830 - 836
75 (first) 0367 - 836.01 46.99 883 836 - 842
75 (last) 0566 - 841.98 41.02 883 836 - 842
76 (first) 0567 - 842.01 46.99 889 842 - 848
76 (last) 0766 - 847.98 41.02 889 842 - 848
77 (first) 0767 - 848.01 46.99 895 848 - 854
77 (last) 0799 - 848.97 46.03 895 848 - 854
All frequencies are in MHz
You can spend hours just listening to cellular telephone conversations
but I would like to mention that it is illegal to do so. Yes, it is
illegal to monitor cellular telephone conversations. It just another
one of those laws like removing tags off of furniture and pillows.
It's illegal, but what the hell for? Its also illegal to spit on
the sidewalks here in Massachusetts, yet you can carry a shotgun
on sundays with you to mass(thats still in the books. Obviously
it was for the original settlers). At any rate, I just want you
to understand that doing the following is in violation of the law.
Now back to the good stuff.
Conversation is not only what an avid listener will find on the
cellular bands. One will also hear call/channel setup control
data streams, dialing, and other control messages. At times,
a cell site will send out a full request for all units in its
cell to indentify itself. The phone will then respond with the
appropriate identification on the corresponding control channel.
Whenever a moblie unit is turned on, even when not placing a call,
whenever there is power to the unit, it transmits its phone
number and its 8-digit ID number. The same process is done when
an idling phone passes from one cell to the other. This process
is repeated for as long as there is power to the unit. This allows
the MTSO to 'track' a mobile through the network. That is why it is
not a good reason to use a mobile phone from one site. They do have
ways of finding you. And it really is not that hard. Just a bit
of RF Triangulation theory and you're found. However, when the
power to the unit is shut off, as far as the MTSO cares, you never
existed in that cell, of course unless your unit was flagged for some
reason. MTSO's are basically just ESS sytems designed for mobile
applications. This will be explained later within this document.
It isn't feasible for the telephone companies to keep track of each
customer on the network. Therefore the MTSO really doesn't know
if you are authorized to use the network or not. When you purchase
a cellular phone, the dealer gives the units phone ID number to the
local BOC, as well as the number the BOC assigned to the customer.
When the unit is fired up in a cell site its ID number and phone
number is transmitted and checked. If the two numbers are registered
under the same subscriber, then the cell site will allow the mobile
to send and recieve calls. If they don't match, then the cell will
not allow the unit to send or recieve calls. Hence, the most
successful way of reactivating a cellular phone is to obtain an
ID that is presently in use and modifying your rom/prom/eprom for
your specific phone.
RF and AF Specifications:
Everything that you will see from here on out is specifically
Industry/FCC standard. A certian level of compatibility has
to be maintained for national intercommunications, therefore
a common set of standards that apply to all Cellular telephones
can be compiled and analyzed.
Transmitter Mobiles: audio transmission
- 3 kHz to 15 kHz and 6.1 kHz to 15 kHz
- 5.9 kHz to 6.1 kHz 35 dB attenuation
- Above 15 kHz, the attenuation becomes 28 dB
- All this is required after the modulation limiter and before
the modulation stage
Transmitters Base Stations: audio transmission
- 3 kHz to 15 kHz
- Above 15 kHz, attenuation required 28 dB
- Atennuation after modulation limiter - no notch filter required
RF attenuation below carrier Transmitter: audio transmission
- 20 kHz to 40 kHz, use 26 dB.
- 45 kHz to 2nd harmonic, the specification is 60 dB or 43 + 10 log
of mean output power
- 12 kHz to 20 kHz, attenuation 117 log f/12
- 20 kHz to 2nd harmonic, there is a choice: 100 log F/100 or 60 dB
or 43 log + 10 log of mean output power, whichever is less.
Wideband Data
- 20 kHz to 45 kHz, use 26 dB
- 45 kHz to 90 kHz, use 45 dB
- 90 kHz to 2nd harmonic, either 60 dB or 43 + 10 log mean output
power
- all data streams are encoded so that NRZ (non-return-to-zero)
binary ones and zeroes are now zero-to-one and one-to-zero
transitions respectively. Wideband data can then modulate
the transmitter carrier by binary frequency shift keying(BFSK)
and ones and zeroes into the modulator must now be equivalent
to nominal peak frequency deviations of 8 kHz above and below
the carrier frequency.
Supervisory Audio Tones
- Save as RF attenuation measurements
Signaling Tone
- Same as Wideband Data but must be 10 kHz +/- 1 Hz and produce a
nominal frequency deviation of +/- 8 kHz.
The previous information will assist any technophile to modify or
even troubleshoot his/her cellular phone. Those are the working
guidelines, as I stated previously.
UNIT IDENTIFICATION
Each mobile unit is identified by the following sets of numbers.
The first number is the Moblie Identification Number (MIN). This
34 bit binary number is derived from the units telephone number,
MIN1 is the last seven digits of the telephone number and MIN2 is
the area code.
For demonstrative purposes, we'll encode 617-637-8687.
Here's how to derive the MIN2 from a standard area code. In this
example, 617 is the area code. All you have to do is first convert
to modulo 10 using the following function. A zero digit would be
considered to have a value of 10.
100(first number) + 10(second) +1(third) - 111 = x
100(6) + 10(1) + 1(7) - 111 = 506
(or you could just - 111 from the area code.)
Then convert it to a 10-bit binary number: 0111111010
To derive MIN1 from the phone number is equally as simple. First
encode the next three digits, 637.
100(6) + 10(3) + 1(7) - 111 = 526
Converted to binary: 1000001110
The remainder of the number 8687, is processed further by taking
the first digit, eight(8) and converting it directly to binary.
8 = 1000 (binary)
The last three digits are processed as the other two sets of
three numbers were processed.
100(6) + 10(8) + 1(7) - 111 = 576
Converted to binary: 1001000000
So the completed MIN number would look like this:
|--637---||8-||---687--||---617--|
1000001110100010010000000111111010
\________/\__/\________/\________/
A unit is also identifiable by its Electronic Serial Number or
ESN. This number is Factory Preset and is usually stored in a
ROM chip, which is soldered to the board. It may also be found
in a 'computer on a chip', which are the new microcontrollers
which have rom/ram/microprocessor all in the same package. This
type of setup usually has the ESN and the software to drive the
unit all in the same chip. This makes is significantly harder
to dump, modify and replace. But it is far from impossible.
The ESN is a 4 byte hex or 11-digit octal number. I have encountered
mostly 11-digit octal numbers on the casing of most celluar phones.
the first three digits represent the manufacturer and the remaining
eight digits are the units ESN. I'll go more into the ESN later in
the document.
The Station Class Mark (SCM) is also used for station identification
by providing the station type and power output rating. This was
already discussed in a previous section.
The System IDentification (SID number is a number wich represents
the mobile's home system. This number is 15-bits long and a list
of current nationwide SID's should either be a part of this file
or it will be distrubted along with it.
In the next issue we'll discuss the Control channels, signalling
formats, and dissecting the NAM in detail. Social.technological
impacts (re: cellular interception designed into the units)
-------------- cut me here ---------------------------------------------------
PUTTING IT ALL TOGETHER - Signaling on the Control Channels
There are two types of continuous wideband data stream transmissions.
One is the Forward Control Channel which is sent from the land station
to the mobile. The other is the Reverse Control Channel, which is
sent from the mobile to the land station. Each data stream runs at a
rate of 10 kilobit/sec, +/- 1 bit/sec rate. The formats for each of
the channels follow.
Forward Control Channel
The forward control channel consists of three discrete information
streams. They are called stream A, stream B and the busy-idle
stream. All three streams are multiplexed together. Messages to
mobile stations with the least significant bit of thier MIN number
equal to "0" are sent on stream A, and those with a "1" are sent
on stream B.
The busy-idle stream contains busy-idle bits, whic are used to
indicate the status of the reverse control channel. If the busy-idle
bit = "0" the reverse control channel is busy, if it equals "1"
it is idle. The busy-idle bit is located at the beginning of each
dotting sequence, word sync sequence, at the beginning of the first
repeat of word A and after every 10 message bits thereafter.
Mobile stations achieve synchronization with the incoming data via
a 10 bit dotting sequence (1010101010) and an 11 bit word sync
sequence (11100010010). Each word contains 40 bits, including parity
and is repeated 5 times after which it is then refered to as a
"block". For a multiword message, the second word block and subsequent
word blocks are formed the same as the first word blok including the
dotting and sync sequences. A "word" is formed when the 28 content
bits are encoded into a (40, 28; 5) BCH (Bose-Chaudhuri-Hocquenghem)
code. The left-most bit shall be designated the most-signifigant bit.
The Generator polynominal for the (40, 28;5) BCH code is:
12 10 8 5 4 3 0
G (X) = X + X + X + X + X + X + X
B
Each FOCC message con consist of one or more words. Messaging trans-
mitted over the forward control channel are:
- Mobile station control message
- Overhead message
- control-filler mesage
Controller-filler messages may be inserted between messages and
between word blocks of a multiword message.
Message Formats: Found on either stream A or B
MOBILE STATION CONTROL MESSAGE
The mobile station control message can consist of one, two, or four
words.
Word 1 (abbreviated address word)
+--------+-------+---------------------------------------+-----------+
| T t | | | |
| 1 2 | DCC | Moblie Identification Number 1 | P |
| | | 23-0 | |
+--------+-------+---------------------------------------+-----------+
bits: 2 2 24 12
Word 2 (extended address word)
+------+-----+-----------+------+--------+-------+----------+-----+
| T T |SCC =| | RSVD | LOCAL | CRDQ | ORDER | |
| 1 2| 11 | MIN2 | = 0 | | | | |
| = +-----+ 3-24 +------+-----+--+-------+----------| P |
| 10 |SCC =| | VMAC | CHAN | |
| | 11 | | | | |
+------+-----+-----------+------------+---------------------+=----+
The Reverse Control Channel (RECC) is a wideband data stream sent
from the moblie station to the land station. This data stream runs
at a rate of 10 kilobit/sec, +/- 1 bit/sec rate. The format of the
RECC data stream follows:
+---------+------+-------+------------+-------------+-----------+-----
| Dotting | Word | Coded | first word | Second word | Third word|
| | sync | DCC | repeated | repeated | repeated | ...
| | | | 5 times | 5 times | 5 times |
+---------+------+-------+------------+-------------+-----------+-----
DCC = Digital Color Code Dotting = 01010101...010101
Received DCC 7-bit Codec DCC Word sync = 11100010010
00 0000000
01 0011111
10 1100011
11 1111100
All messages begin with the RECC seizure precursor with is composed
of a 30 bit dotting sequence (1010...101), and 11 bit word sync
sequence (11100010010), and the coded digital color code.
Each word contains 48 bits, including parity, and is repeated five
times after which it is refered to as a word block. A word is
formed by encoding 36 content bits into a (48, 36) BCH code that has
a distance of 5, (48 36; 5). The left most bit shall be designated
the most-significant bit. The 36 most-significant bits of the 48 bit
field shall be the content bits.
The generator polynomial for the code is the same for the (40,28;5)
code used on the forward channel.
CONTROL CHANNELS (SETUP CHANNELS)
Each wireline and non-wireline service have 21 channels. These
channels are used by the MTSO and the cell sites to directly
communicate with the mobile unit. The first signal sent to initiate
a call is the Supervisory Audio Tone (SAT). This can be thought of
as the voltage used to close the loop on a land telephone.
SAT Tones with corresponding binary codes:
5970 Hz (00)
6000 Hz (01)
6030 HZ (10)
The mobile unit recieves the SAT from the cell site and transponds
it back (closing the loop). Tone recognition must take place
within 250 milliseconds or the site interprets it as the mobile
is out of range. If the SAT is returned, then a Signaling Tone
is issued. This Tone is 10kHz and is present when the user is
either being alerted(call initialization), being handed off,
or disconnecting The Signaling tone is used only in mobile to
land direction
phreak/CELLULAR/cellular.the
+83
View File
@@ -0,0 +1,83 @@
Cellular Phreaking Theory
The cellular/mobile phone system is one that is perfectly set up to be
exploited by phreaks with the proper knowledge and equipment. Thanks to
deregulation, the regional BOC's (Bell Operating Companies) are scattered and
do not communicate much with each other. Phreaks can take advantage of this
by pretending to be mobile phone customers whose "home base" is a city served
by a different BOC, known as a "roamer". Since it is impractical for each BOC
to keep track of the customers of all the other BOC's, they will usually allow
the customer to make the calls he wishes, often with a surcharge of some sort.
The bill is then forwarded to the roamer's home BOC for collection. However,
it is fairly simple (with the correct tools) to create a bogus ID number for
your mobile phone, and pretend to be a roamer from some other city and state,
that's "just visiting". When your BOC tries to collect for the calls from
your alleged "home BOC", they will discover you are not a real customer; but
by then, you can create an entirely new electronic identity, and use that
instead.
How does the cellular system know who is calling, and where they are?
When a mobile phone enters a cell's area of transmission, it transmits its
phone number and its 8 digit ID number to that cell, who will keep track of it
until it gets far enough away that the sound quality is sufficiently
diminished, and then the phone is "handed off" to the cell that the customer
has walked or driven into. This process continues as long as the phone has
power and is turned on. If the phone is turned off (or the car is), someone
attempting to call the mobile phone will receive a recording along the lines
of "The mobile phone customer you have dialed has left the vehicle or driven
out of the service area." When a call is made to a mobile phone, the
switching equipment will check to see if the mobile phone being called is
"logged in", so to speak, or present in one of the cells. If it is, the call
will then act (to the speaking parties) just like a normal call - the caller
may hear a busy tone, the phone may just ring, or the call may be answered.
How does the switching equipment know whether or not a particular
phone is authorized to use the network? Many times, it doesn't. When a
dealer installs a mobile phone, he gives the phone's ID number (an 8 digit
hexadecimal number) to the local BOC, as well as the phone number the BOC
assigned to the customer. Thereafter, whenever a phone is present in one of
the cells, the two numbers are checked - they should be registered to the same
person. If they don't match, the telco knows that an attempted fraud is
taking place (or at best, some transmission error) and will not allow calls to
be placed or received at that phone. However, it is impractical (especially
given the present state of deregulation) for the telco to have records of
every cellular customer of every BOC. Therefore, if you're going to create a
fake ID/phone number combination, it will need to be "based" in an area that
has a cellular system (obviously), has a different BOC than your local area
does, and has some sort of a "roamer" agreement with your local BOC.
How can one "phreak" a cellular phone? There are three general areas
when phreaking cellular phones; using one you found in an unlocked car (or an
unattended walk-about model), modifying your own chip set to look like a
different phone, or recording the phone number/ID number combinations sent by
other local cellular phones, and using those as your own. Most cellular
phones include a crude "password" system to keep unauthorized users from using
the phone - however, dealers often set the password (usually a 3 to 5 digit
code) to the last four digits of the customer's mobile phone number. If you
can find that somewhere on the phone, you're in luck. If not, it shouldn't be
TOO hard to hack, since most people aren't smart enough to use something
besides "1111", "1234", or whatever. If you want to modify the chip set in a
cellular phone you bought (or stole), there are two chips (of course, this
depends on the model and manufacturer, yours may be different) that will need
to be changed - one installed at the manufacturer (often epoxied in) with the
phone's ID number, and one installed by the dealer with the phone number, and
possible the security code. To do this, you'll obviously need an EPROM burner
as well as the same sort of chips used in the phone (or a friendly and
unscrupulous dealer!). As to recording the numbers of other mobile phone
customers and using them; as far as I know, this is just theory... but it
seems quite possible, if you've got the equipment to record and decode it.
The cellular system would probably freak out if two phones (with valid
ID/phone number combinations) were both present in the network at once, but it
remains to be seen what will happen.
Note/Disclaimer: Ok, I don't pretend to know everything about
cellular phones; I've screwed around with them a little, but I figured I'd
make a file with the things I've learned about them, to at least share what I
know and possible bring about further discussion.
phreak/CELLULAR/cellular.txt
+126
View File
@@ -0,0 +1,126 @@
________________________________
// \
||| Cellular Phreaking |
||| Written by: |
||| The Bootlegger |
||| |
||| Distributed by: |
||| Thirteenth Floor Enterprises |
||| |
\\\________________________________
6885
\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\
o Though not written specifically for
13th Floor Enterprises, the members of
the 13th Floor believed the information
to be very interesting and, thus, should
be distributed.
\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\
O.K. WE ALL KNOW THAT WITH BELL BUSTING
PEOPLE ROUND THE COUNTRY,QUITE NATURALLY
THER'RE GONNA START PROTECTING AGAIN
THE TECHNIQUES WE HAVE ALL GROWN TO
KNOW SO WELL AND LOVE.
SO-O-O YOU ASK WHATS NEXT???
AH-HA SAYS YE OLE BOOTLEGGER-
LET ME INTRODUCE YOU TO CHAPTER 1 OF
CELLULAR PHREAKING!
QUOTING THE CAMPS 2001 CELLULAL SYSTEM:
" THE NORMAL ATTENDENT STATION IS SIMPLY
A PUSH BUTTON TELEPHONE! CALLS REQUIRING
ATTENDENT ASSISTANCE ARE ROUTED TO THAT
PHONE! THE CELLULAR OFFICE MAY HAVE A
REMOTE ATTENDANT EITHER BY USING A
DEDICATED 2-WIRE VOICE FREQUENCY LINE
OR BY CONFIGURING THE CELLULAR SWITCH
TO AUTOMATICALLY DIAL UP A TELEPHONE #
THROUGH AN EXISTING DIAL-OUT LINE."
THE DATABASE MAINTENANCE FUNCTION,
BILLING FUNCTION, MAY BE REMOTED BY
SIMPLY INSTALLING AUTOANSWER 300 BAUD
DATA MODEMS AT THE CELL & CENTRAL
LOCATION.(AND IN YOUR HOME COMPUTER)
SINCE NONE OF THESE FUNCTIONS REQUIRE
FULL TIME ATTENTION,A NORMAL DIAL-UP
LINE IS ENTIRELY ADEQUATE.(BOY-O-BOY)
THUS, SOMEONE AT THE CENTRAL LOCATION
(OR ANYWHERE ELSE) CAN DIAL UP THE
SYSTEM IN SAY BEAUMONT AND ADD A CUST-
OMER TO THE SUBSCRIBER DATA BASE, OR
DELETE ONE! (I LOVE IT)
PERIODICALLY,SHE CAN DIAL UP THE SYSTEM
AND INSTRUCT IT TO DUMP ITS BILLING
INFO INTO HER COMPUTER (OR YOURS) FOR
BILL PROCESSING. A MAINTENANCE MAN CAN
USE THE SAME MODEMS TO CHECK FOR ERROR
LOGS,SYSTEM OPS, AND MANUALLY EXERCISE
CERTAIN FUNCTIONS!
THIS SYSTEM DUE IN SMALL TOWNS IN ABOUT
6 MO. - ANOTHER FIRST FROM BOOTLEG
NUFF SAID FOR PART 1
CELLULAR PHREAKING #2
SEEMS LIKE THE WESTERN UNION MOBILE
PHONES(JOHNSON MOD 1154) HAVE A COUPLE
OF FEATURES THE MFG NEVER INTENDED!
CHIP U1 IS THE SERIAL NUMBER ROM,WHILE
CHIP U706 IS THE PROM THAT CONTAINS
THE ID NUMBER,TELEPHONE NUMBER OF THE
MOBILE,PAGE CHANNEL,HOME CELL,LOCK
CODE,AND OTHER OPTIONS.
NOW,AFTER EXTENSIVELY READING THE
MANUALS ON THIS UNIT,I DONT SEE ANY
REASON THOSE 2 CHIPS CANT BE REPLACED
WITH EPROMS PROGRAMED WITH ANY PHONE
NUMBER YOU WANT!!!!
THIS SHOULD ENABLE THIS UNIT TO CALL
AND RECEIVE CALLS FROM ANY PHONE #
YOU WANT!!!! (WILL ALSO CHARGE CALLS
TO ANY PHONE # )
THIS MAY TURN OUT BETTER THAN OWNING
A WHOLE CENTRAL OFFICE (HEE-HEE)
NUFF SAID-
BOOTLEG
P.S. I HAVE THE CODING SEQUENCES FOR
THE ABOVE CHIPS.ALSO-ILL BUY A
USED WESTERN UNION MOBILE OR ANY
OTHER MOBILE PHONE FOR THE RIGHT
PRICE! CALL ME VIA VOICE
\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\
o Thirteenth Floor Enterprises and its
members neither condone or suggest
the use of cellular phreaking, yet
merely distribute this article for
the information of its readers.
\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\
x A 13th Floor Enterprises Distribution x
phreak/CELLULAR/cellularfrq.phk
+851
View File
@@ -0,0 +1,851 @@
Complete List of Cellular Channel Numbers and Frequencies 03/30/93
The Researcher
Band A
Chan Mobile Cell Site
-------------------------
1 -- 825.03 -- 870.03
2 -- 825.06 -- 870.06
3 -- 825.09 -- 870.09
4 -- 825.12 -- 870.12
5 -- 825.15 -- 870.15
6 -- 825.18 -- 870.18
7 -- 825.21 -- 870.21
8 -- 825.24 -- 870.24
9 -- 825.27 -- 870.27
10 -- 825.30 -- 870.30
11 -- 825.33 -- 870.33
12 -- 825.36 -- 870.36
13 -- 825.39 -- 870.39
14 -- 825.42 -- 870.42
15 -- 825.45 -- 870.45
16 -- 825.48 -- 870.48
17 -- 825.51 -- 870.51
18 -- 825.54 -- 870.54
19 -- 825.57 -- 870.57
20 -- 825.60 -- 870.60
21 -- 825.63 -- 870.63
22 -- 825.66 -- 870.66
23 -- 825.69 -- 870.69
24 -- 825.72 -- 870.72
25 -- 825.75 -- 870.75
26 -- 825.78 -- 870.78
27 -- 825.81 -- 870.81
28 -- 825.84 -- 870.84
29 -- 825.87 -- 870.87
30 -- 825.90 -- 870.90
31 -- 825.93 -- 870.93
32 -- 825.96 -- 870.96
33 -- 825.99 -- 870.99
34 -- 826.02 -- 871.02
35 -- 826.05 -- 871.05
36 -- 826.08 -- 871.08
37 -- 826.11 -- 871.11
38 -- 826.14 -- 871.14
39 -- 826.17 -- 871.17
40 -- 826.20 -- 871.20
41 -- 826.23 -- 871.23
42 -- 826.26 -- 871.26
43 -- 826.29 -- 871.29
44 -- 826.32 -- 871.32
45 -- 826.35 -- 871.35
46 -- 826.38 -- 871.38
47 -- 826.41 -- 871.41
48 -- 826.44 -- 871.44
49 -- 826.47 -- 871.47
50 -- 826.50 -- 871.50
51 -- 826.53 -- 871.53
52 -- 826.56 -- 871.56
53 -- 826.59 -- 871.59
54 -- 826.62 -- 871.62
55 -- 826.65 -- 871.65
56 -- 826.68 -- 871.68
57 -- 826.71 -- 871.71
58 -- 826.74 -- 871.74
59 -- 826.77 -- 871.77
60 -- 826.80 -- 871.80
61 -- 826.83 -- 871.83
62 -- 826.86 -- 871.86
63 -- 826.89 -- 871.89
64 -- 826.92 -- 871.92
65 -- 826.95 -- 871.95
66 -- 826.98 -- 871.98
67 -- 827.01 -- 872.01
68 -- 827.04 -- 872.04
69 -- 827.07 -- 872.07
70 -- 827.10 -- 872.10
71 -- 827.13 -- 872.13
72 -- 827.16 -- 872.16
73 -- 827.19 -- 872.19
74 -- 827.22 -- 872.22
75 -- 827.25 -- 872.25
76 -- 827.28 -- 872.28
77 -- 827.31 -- 872.31
78 -- 827.34 -- 872.34
79 -- 827.37 -- 872.37
80 -- 827.40 -- 872.40
81 -- 827.43 -- 872.43
82 -- 827.46 -- 872.46
83 -- 827.49 -- 872.49
84 -- 827.52 -- 872.52
85 -- 827.55 -- 872.55
86 -- 827.58 -- 872.58
87 -- 827.61 -- 872.61
88 -- 827.64 -- 872.64
89 -- 827.67 -- 872.67
90 -- 827.70 -- 872.70
91 -- 827.73 -- 872.73
92 -- 827.76 -- 872.76
93 -- 827.79 -- 872.79
94 -- 827.82 -- 872.82
95 -- 827.85 -- 872.85
96 -- 827.88 -- 872.88
97 -- 827.91 -- 872.91
98 -- 827.94 -- 872.94
99 -- 827.97 -- 872.97
100 -- 828.00 -- 873.00
101 -- 828.03 -- 873.03
102 -- 828.06 -- 873.06
103 -- 828.09 -- 873.09
104 -- 828.12 -- 873.12
105 -- 828.15 -- 873.15
106 -- 828.18 -- 873.18
107 -- 828.21 -- 873.21
108 -- 828.24 -- 873.24
109 -- 828.27 -- 873.27
110 -- 828.30 -- 873.30
111 -- 828.33 -- 873.33
112 -- 828.36 -- 873.36
113 -- 828.39 -- 873.39
114 -- 828.42 -- 873.42
115 -- 828.45 -- 873.45
116 -- 828.48 -- 873.48
117 -- 828.51 -- 873.51
118 -- 828.54 -- 873.54
119 -- 828.57 -- 873.57
120 -- 828.60 -- 873.60
121 -- 828.63 -- 873.63
122 -- 828.66 -- 873.66
123 -- 828.69 -- 873.69
124 -- 828.72 -- 873.72
125 -- 828.75 -- 873.75
126 -- 828.78 -- 873.78
127 -- 828.81 -- 873.81
128 -- 828.84 -- 873.84
129 -- 828.87 -- 873.87
130 -- 828.90 -- 873.90
131 -- 828.93 -- 873.93
132 -- 828.96 -- 873.96
133 -- 828.99 -- 873.99
134 -- 829.02 -- 874.02
135 -- 829.05 -- 874.05
136 -- 829.08 -- 874.08
137 -- 829.11 -- 874.11
138 -- 829.14 -- 874.14
139 -- 829.17 -- 874.17
140 -- 829.20 -- 874.20
141 -- 829.23 -- 874.23
142 -- 829.26 -- 874.26
143 -- 829.29 -- 874.29
144 -- 829.32 -- 874.32
145 -- 829.35 -- 874.35
146 -- 829.38 -- 874.38
147 -- 829.41 -- 874.41
148 -- 829.44 -- 874.44
149 -- 829.47 -- 874.47
150 -- 829.50 -- 874.50
151 -- 829.53 -- 874.53
152 -- 829.56 -- 874.56
153 -- 829.59 -- 874.59
154 -- 829.62 -- 874.62
155 -- 829.65 -- 874.65
156 -- 829.68 -- 874.68
157 -- 829.71 -- 874.71
158 -- 829.74 -- 874.74
159 -- 829.77 -- 874.77
160 -- 829.80 -- 874.80
161 -- 829.83 -- 874.83
162 -- 829.86 -- 874.86
163 -- 829.89 -- 874.89
164 -- 829.92 -- 874.92
165 -- 829.95 -- 874.95
166 -- 829.98 -- 874.98
167 -- 830.01 -- 875.01
168 -- 830.04 -- 875.04
169 -- 830.07 -- 875.07
170 -- 830.10 -- 875.10
171 -- 830.13 -- 875.13
172 -- 830.16 -- 875.16
173 -- 830.19 -- 875.19
174 -- 830.22 -- 875.22
175 -- 830.25 -- 875.25
176 -- 830.28 -- 875.28
177 -- 830.31 -- 875.31
178 -- 830.34 -- 875.34
179 -- 830.37 -- 875.37
180 -- 830.40 -- 875.40
181 -- 830.43 -- 875.43
182 -- 830.46 -- 875.46
183 -- 830.49 -- 875.49
184 -- 830.52 -- 875.52
185 -- 830.55 -- 875.55
186 -- 830.58 -- 875.58
187 -- 830.61 -- 875.61
188 -- 830.64 -- 875.64
189 -- 830.67 -- 875.67
190 -- 830.70 -- 875.70
191 -- 830.73 -- 875.73
192 -- 830.76 -- 875.76
193 -- 830.79 -- 875.79
194 -- 830.82 -- 875.82
195 -- 830.85 -- 875.85
196 -- 830.88 -- 875.88
197 -- 830.91 -- 875.91
198 -- 830.94 -- 875.94
199 -- 830.97 -- 875.97
200 -- 831.00 -- 876.00
201 -- 831.03 -- 876.03
202 -- 831.06 -- 876.06
203 -- 831.09 -- 876.09
204 -- 831.12 -- 876.12
205 -- 831.15 -- 876.15
206 -- 831.18 -- 876.18
207 -- 831.21 -- 876.21
208 -- 831.24 -- 876.24
209 -- 831.27 -- 876.27
210 -- 831.30 -- 876.30
211 -- 831.33 -- 876.33
212 -- 831.36 -- 876.36
213 -- 831.39 -- 876.39
214 -- 831.42 -- 876.42
215 -- 831.45 -- 876.45
216 -- 831.48 -- 876.48
217 -- 831.51 -- 876.51
218 -- 831.54 -- 876.54
219 -- 831.57 -- 876.57
220 -- 831.60 -- 876.60
221 -- 831.63 -- 876.63
222 -- 831.66 -- 876.66
223 -- 831.69 -- 876.69
224 -- 831.72 -- 876.72
225 -- 831.75 -- 876.75
226 -- 831.78 -- 876.78
227 -- 831.81 -- 876.81
228 -- 831.84 -- 876.84
229 -- 831.87 -- 876.87
230 -- 831.90 -- 876.90
231 -- 831.93 -- 876.93
232 -- 831.96 -- 876.96
233 -- 831.99 -- 876.99
234 -- 832.02 -- 877.02
235 -- 832.05 -- 877.05
236 -- 832.08 -- 877.08
237 -- 832.11 -- 877.11
238 -- 832.14 -- 877.14
239 -- 832.17 -- 877.17
240 -- 832.20 -- 877.20
241 -- 832.23 -- 877.23
242 -- 832.26 -- 877.26
243 -- 832.29 -- 877.29
244 -- 832.32 -- 877.32
245 -- 832.35 -- 877.35
246 -- 832.38 -- 877.38
247 -- 832.41 -- 877.41
248 -- 832.44 -- 877.44
249 -- 832.47 -- 877.47
250 -- 832.50 -- 877.50
251 -- 832.53 -- 877.53
252 -- 832.56 -- 877.56
253 -- 832.59 -- 877.59
254 -- 832.62 -- 877.62
255 -- 832.65 -- 877.65
256 -- 832.68 -- 877.68
257 -- 832.71 -- 877.71
258 -- 832.74 -- 877.74
259 -- 832.77 -- 877.77
260 -- 832.80 -- 877.80
261 -- 832.83 -- 877.83
262 -- 832.86 -- 877.86
263 -- 832.89 -- 877.89
264 -- 832.92 -- 877.92
265 -- 832.95 -- 877.95
266 -- 832.98 -- 877.98
267 -- 833.01 -- 878.01
268 -- 833.04 -- 878.04
269 -- 833.07 -- 878.07
270 -- 833.10 -- 878.10
271 -- 833.13 -- 878.13
272 -- 833.16 -- 878.16
273 -- 833.19 -- 878.19
274 -- 833.22 -- 878.22
275 -- 833.25 -- 878.25
276 -- 833.28 -- 878.28
277 -- 833.31 -- 878.31
278 -- 833.34 -- 878.34
279 -- 833.37 -- 878.37
280 -- 833.40 -- 878.40
281 -- 833.43 -- 878.43
282 -- 833.46 -- 878.46
283 -- 833.49 -- 878.49
284 -- 833.52 -- 878.52
285 -- 833.55 -- 878.55
286 -- 833.58 -- 878.58
287 -- 833.61 -- 878.61
288 -- 833.64 -- 878.64
289 -- 833.67 -- 878.67
290 -- 833.70 -- 878.70
291 -- 833.73 -- 878.73
292 -- 833.76 -- 878.76
293 -- 833.79 -- 878.79
294 -- 833.82 -- 878.82
295 -- 833.85 -- 878.85
296 -- 833.88 -- 878.88
297 -- 833.91 -- 878.91
298 -- 833.94 -- 878.94
299 -- 833.97 -- 878.97
300 -- 834.00 -- 879.00
301 -- 834.03 -- 879.03
302 -- 834.06 -- 879.06
303 -- 834.09 -- 879.09
304 -- 834.12 -- 879.12
305 -- 834.15 -- 879.15
306 -- 834.18 -- 879.18
307 -- 834.21 -- 879.21
308 -- 834.24 -- 879.24
309 -- 834.27 -- 879.27
310 -- 834.30 -- 879.30
311 -- 834.33 -- 879.33
312 -- 834.36 -- 879.36
313 -- 834.39 -- 879.39
314 -- 834.42 -- 879.42
315 -- 834.45 -- 879.45
316 -- 834.48 -- 879.48
317 -- 834.51 -- 879.51
318 -- 834.54 -- 879.54
319 -- 834.57 -- 879.57
320 -- 834.60 -- 879.60
321 -- 834.63 -- 879.63
322 -- 834.66 -- 879.66
323 -- 834.69 -- 879.69
324 -- 834.72 -- 879.72
325 -- 834.75 -- 879.75
326 -- 834.78 -- 879.78
327 -- 834.81 -- 879.81
328 -- 834.84 -- 879.84
329 -- 834.87 -- 879.87
330 -- 834.90 -- 879.90
331 -- 834.93 -- 879.93
332 -- 834.96 -- 879.96
333 -- 834.99 -- 879.99
334 -- 835.02 -- 880.02
335 -- 835.05 -- 880.05
336 -- 835.08 -- 880.08
337 -- 835.11 -- 880.11
338 -- 835.14 -- 880.14
339 -- 835.17 -- 880.17
340 -- 835.20 -- 880.20
341 -- 835.23 -- 880.23
342 -- 835.26 -- 880.26
343 -- 835.29 -- 880.29
344 -- 835.32 -- 880.32
345 -- 835.35 -- 880.35
346 -- 835.38 -- 880.38
347 -- 835.41 -- 880.41
348 -- 835.44 -- 880.44
349 -- 835.47 -- 880.47
350 -- 835.50 -- 880.50
351 -- 835.53 -- 880.53
352 -- 835.56 -- 880.56
353 -- 835.59 -- 880.59
354 -- 835.62 -- 880.62
355 -- 835.65 -- 880.65
356 -- 835.68 -- 880.68
357 -- 835.71 -- 880.71
358 -- 835.74 -- 880.74
359 -- 835.77 -- 880.77
360 -- 835.80 -- 880.80
361 -- 835.83 -- 880.83
362 -- 835.86 -- 880.86
363 -- 835.89 -- 880.89
364 -- 835.92 -- 880.92
365 -- 835.95 -- 880.95
366 -- 835.98 -- 880.98
367 -- 836.01 -- 881.01
368 -- 836.04 -- 881.04
369 -- 836.07 -- 881.07
370 -- 836.10 -- 881.10
371 -- 836.13 -- 881.13
372 -- 836.16 -- 881.16
373 -- 836.19 -- 881.19
374 -- 836.22 -- 881.22
375 -- 836.25 -- 881.25
376 -- 836.28 -- 881.28
377 -- 836.31 -- 881.31
378 -- 836.34 -- 881.34
379 -- 836.37 -- 881.37
380 -- 836.40 -- 881.40
381 -- 836.43 -- 881.43
382 -- 836.46 -- 881.46
383 -- 836.49 -- 881.49
384 -- 836.52 -- 881.52
385 -- 836.55 -- 881.55
386 -- 836.58 -- 881.58
387 -- 836.61 -- 881.61
388 -- 836.64 -- 881.64
389 -- 836.67 -- 881.67
390 -- 836.70 -- 881.70
391 -- 836.73 -- 881.73
392 -- 836.76 -- 881.76
393 -- 836.79 -- 881.79
394 -- 836.82 -- 881.82
395 -- 836.85 -- 881.85
396 -- 836.88 -- 881.88
397 -- 836.91 -- 881.91
398 -- 836.94 -- 881.94
399 -- 836.97 -- 881.97
400 -- 837.00 -- 882.00
401 -- 837.03 -- 882.03
402 -- 837.06 -- 882.06
403 -- 837.09 -- 882.09
404 -- 837.12 -- 882.12
405 -- 837.15 -- 882.15
406 -- 837.18 -- 882.18
407 -- 837.21 -- 882.21
408 -- 837.24 -- 882.24
409 -- 837.27 -- 882.27
410 -- 837.30 -- 882.30
411 -- 837.33 -- 882.33
412 -- 837.36 -- 882.36
413 -- 837.39 -- 882.39
414 -- 837.42 -- 882.42
415 -- 837.45 -- 882.45
416 -- 837.48 -- 882.48
417 -- 837.51 -- 882.51
418 -- 837.54 -- 882.54
419 -- 837.57 -- 882.57
420 -- 837.60 -- 882.60
421 -- 837.63 -- 882.63
422 -- 837.66 -- 882.66
423 -- 837.69 -- 882.69
424 -- 837.72 -- 882.72
425 -- 837.75 -- 882.75
426 -- 837.78 -- 882.78
427 -- 837.81 -- 882.81
428 -- 837.84 -- 882.84
429 -- 837.87 -- 882.87
430 -- 837.90 -- 882.90
431 -- 837.93 -- 882.93
432 -- 837.96 -- 882.96
433 -- 837.99 -- 882.99
434 -- 838.02 -- 883.02
435 -- 838.05 -- 883.05
436 -- 838.08 -- 883.08
437 -- 838.11 -- 883.11
438 -- 838.14 -- 883.14
439 -- 838.17 -- 883.17
440 -- 838.20 -- 883.20
441 -- 838.23 -- 883.23
442 -- 838.26 -- 883.26
443 -- 838.29 -- 883.29
444 -- 838.32 -- 883.32
445 -- 838.35 -- 883.35
446 -- 838.38 -- 883.38
447 -- 838.41 -- 883.41
448 -- 838.44 -- 883.44
449 -- 838.47 -- 883.47
450 -- 838.50 -- 883.50
451 -- 838.53 -- 883.53
452 -- 838.56 -- 883.56
453 -- 838.59 -- 883.59
454 -- 838.62 -- 883.62
455 -- 838.65 -- 883.65
456 -- 838.68 -- 883.68
457 -- 838.71 -- 883.71
458 -- 838.74 -- 883.74
459 -- 838.77 -- 883.77
460 -- 838.80 -- 883.80
461 -- 838.83 -- 883.83
462 -- 838.86 -- 883.86
463 -- 838.89 -- 883.89
464 -- 838.92 -- 883.92
465 -- 838.95 -- 883.95
466 -- 838.98 -- 883.98
467 -- 839.01 -- 884.01
468 -- 839.04 -- 884.04
469 -- 839.07 -- 884.07
470 -- 839.10 -- 884.10
471 -- 839.13 -- 884.13
472 -- 839.16 -- 884.16
473 -- 839.19 -- 884.19
474 -- 839.22 -- 884.22
475 -- 839.25 -- 884.25
476 -- 839.28 -- 884.28
477 -- 839.31 -- 884.31
478 -- 839.34 -- 884.34
479 -- 839.37 -- 884.37
480 -- 839.40 -- 884.40
481 -- 839.43 -- 884.43
482 -- 839.46 -- 884.46
483 -- 839.49 -- 884.49
484 -- 839.52 -- 884.52
485 -- 839.55 -- 884.55
486 -- 839.58 -- 884.58
487 -- 839.61 -- 884.61
488 -- 839.64 -- 884.64
489 -- 839.67 -- 884.67
490 -- 839.70 -- 884.70
491 -- 839.73 -- 884.73
492 -- 839.76 -- 884.76
493 -- 839.79 -- 884.79
494 -- 839.82 -- 884.82
495 -- 839.85 -- 884.85
496 -- 839.88 -- 884.88
497 -- 839.91 -- 884.91
498 -- 839.94 -- 884.94
499 -- 839.97 -- 884.97
500 -- 840.00 -- 885.00
501 -- 840.03 -- 885.03
502 -- 840.06 -- 885.06
503 -- 840.09 -- 885.09
504 -- 840.12 -- 885.12
505 -- 840.15 -- 885.15
506 -- 840.18 -- 885.18
507 -- 840.21 -- 885.21
508 -- 840.24 -- 885.24
509 -- 840.27 -- 885.27
510 -- 840.30 -- 885.30
511 -- 840.33 -- 885.33
512 -- 840.36 -- 885.36
513 -- 840.39 -- 885.39
514 -- 840.42 -- 885.42
515 -- 840.45 -- 885.45
516 -- 840.48 -- 885.48
517 -- 840.51 -- 885.51
518 -- 840.54 -- 885.54
519 -- 840.57 -- 885.57
520 -- 840.60 -- 885.60
521 -- 840.63 -- 885.63
522 -- 840.66 -- 885.66
523 -- 840.69 -- 885.69
524 -- 840.72 -- 885.72
525 -- 840.75 -- 885.75
526 -- 840.78 -- 885.78
527 -- 840.81 -- 885.81
528 -- 840.84 -- 885.84
529 -- 840.87 -- 885.87
530 -- 840.90 -- 885.90
531 -- 840.93 -- 885.93
532 -- 840.96 -- 885.96
533 -- 840.99 -- 885.99
534 -- 841.02 -- 886.02
535 -- 841.05 -- 886.05
536 -- 841.08 -- 886.08
537 -- 841.11 -- 886.11
538 -- 841.14 -- 886.14
539 -- 841.17 -- 886.17
540 -- 841.20 -- 886.20
541 -- 841.23 -- 886.23
542 -- 841.26 -- 886.26
543 -- 841.29 -- 886.29
544 -- 841.32 -- 886.32
545 -- 841.35 -- 886.35
546 -- 841.38 -- 886.38
547 -- 841.41 -- 886.41
548 -- 841.44 -- 886.44
549 -- 841.47 -- 886.47
550 -- 841.50 -- 886.50
551 -- 841.53 -- 886.53
552 -- 841.56 -- 886.56
553 -- 841.59 -- 886.59
554 -- 841.62 -- 886.62
555 -- 841.65 -- 886.65
556 -- 841.68 -- 886.68
557 -- 841.71 -- 886.71
558 -- 841.74 -- 886.74
559 -- 841.77 -- 886.77
560 -- 841.80 -- 886.80
561 -- 841.83 -- 886.83
562 -- 841.86 -- 886.86
563 -- 841.89 -- 886.89
564 -- 841.92 -- 886.92
565 -- 841.95 -- 886.95
566 -- 841.98 -- 886.98
567 -- 842.01 -- 887.01
568 -- 842.04 -- 887.04
569 -- 842.07 -- 887.07
570 -- 842.10 -- 887.10
571 -- 842.13 -- 887.13
572 -- 842.16 -- 887.16
573 -- 842.19 -- 887.19
574 -- 842.22 -- 887.22
575 -- 842.25 -- 887.25
576 -- 842.28 -- 887.28
577 -- 842.31 -- 887.31
578 -- 842.34 -- 887.34
579 -- 842.37 -- 887.37
580 -- 842.40 -- 887.40
581 -- 842.43 -- 887.43
582 -- 842.46 -- 887.46
583 -- 842.49 -- 887.49
584 -- 842.52 -- 887.52
585 -- 842.55 -- 887.55
586 -- 842.58 -- 887.58
587 -- 842.61 -- 887.61
588 -- 842.64 -- 887.64
589 -- 842.67 -- 887.67
590 -- 842.70 -- 887.70
591 -- 842.73 -- 887.73
592 -- 842.76 -- 887.76
593 -- 842.79 -- 887.79
594 -- 842.82 -- 887.82
595 -- 842.85 -- 887.85
596 -- 842.88 -- 887.88
597 -- 842.91 -- 887.91
598 -- 842.94 -- 887.94
599 -- 842.97 -- 887.97
600 -- 843.00 -- 888.00
601 -- 843.03 -- 888.03
602 -- 843.06 -- 888.06
603 -- 843.09 -- 888.09
604 -- 843.12 -- 888.12
605 -- 843.15 -- 888.15
606 -- 843.18 -- 888.18
607 -- 843.21 -- 888.21
608 -- 843.24 -- 888.24
609 -- 843.27 -- 888.27
610 -- 843.30 -- 888.30
611 -- 843.33 -- 888.33
612 -- 843.36 -- 888.36
613 -- 843.39 -- 888.39
614 -- 843.42 -- 888.42
615 -- 843.45 -- 888.45
616 -- 843.48 -- 888.48
617 -- 843.51 -- 888.51
618 -- 843.54 -- 888.54
619 -- 843.57 -- 888.57
620 -- 843.60 -- 888.60
621 -- 843.63 -- 888.63
622 -- 843.66 -- 888.66
623 -- 843.69 -- 888.69
624 -- 843.72 -- 888.72
625 -- 843.75 -- 888.75
626 -- 843.78 -- 888.78
627 -- 843.81 -- 888.81
628 -- 843.84 -- 888.84
629 -- 843.87 -- 888.87
630 -- 843.90 -- 888.90
631 -- 843.93 -- 888.93
632 -- 843.96 -- 888.96
633 -- 843.99 -- 888.99
634 -- 844.02 -- 889.02
635 -- 844.05 -- 889.05
636 -- 844.08 -- 889.08
637 -- 844.11 -- 889.11
638 -- 844.14 -- 889.14
639 -- 844.17 -- 889.17
640 -- 844.20 -- 889.20
641 -- 844.23 -- 889.23
642 -- 844.26 -- 889.26
643 -- 844.29 -- 889.29
644 -- 844.32 -- 889.32
645 -- 844.35 -- 889.35
646 -- 844.38 -- 889.38
647 -- 844.41 -- 889.41
648 -- 844.44 -- 889.44
649 -- 844.47 -- 889.47
650 -- 844.50 -- 889.50
651 -- 844.53 -- 889.53
652 -- 844.56 -- 889.56
653 -- 844.59 -- 889.59
654 -- 844.62 -- 889.62
655 -- 844.65 -- 889.65
656 -- 844.68 -- 889.68
657 -- 844.71 -- 889.71
658 -- 844.74 -- 889.74
659 -- 844.77 -- 889.77
660 -- 844.80 -- 889.80
661 -- 844.83 -- 889.83
662 -- 844.86 -- 889.86
663 -- 844.89 -- 889.89
664 -- 844.92 -- 889.92
665 -- 844.95 -- 889.95
666 -- 844.98 -- 889.98
667 -- 845.01 -- 890.01
668 -- 845.04 -- 890.04
669 -- 845.07 -- 890.07
670 -- 845.10 -- 890.10
671 -- 845.13 -- 890.13
672 -- 845.16 -- 890.16
673 -- 845.19 -- 890.19
674 -- 845.22 -- 890.22
675 -- 845.25 -- 890.25
676 -- 845.28 -- 890.28
677 -- 845.31 -- 890.31
678 -- 845.34 -- 890.34
679 -- 845.37 -- 890.37
680 -- 845.40 -- 890.40
681 -- 845.43 -- 890.43
682 -- 845.46 -- 890.46
683 -- 845.49 -- 890.49
684 -- 845.52 -- 890.52
685 -- 845.55 -- 890.55
686 -- 845.58 -- 890.58
687 -- 845.61 -- 890.61
688 -- 845.64 -- 890.64
689 -- 845.67 -- 890.67
690 -- 845.70 -- 890.70
691 -- 845.73 -- 890.73
692 -- 845.76 -- 890.76
693 -- 845.79 -- 890.79
694 -- 845.82 -- 890.82
695 -- 845.85 -- 890.85
696 -- 845.88 -- 890.88
697 -- 845.91 -- 890.91
698 -- 845.94 -- 890.94
699 -- 845.97 -- 890.97
700 -- 846.00 -- 891.00
701 -- 846.03 -- 891.03
702 -- 846.06 -- 891.06
703 -- 846.09 -- 891.09
704 -- 846.12 -- 891.12
705 -- 846.15 -- 891.15
706 -- 846.18 -- 891.18
707 -- 846.21 -- 891.21
708 -- 846.24 -- 891.24
709 -- 846.27 -- 891.27
710 -- 846.30 -- 891.30
711 -- 846.33 -- 891.33
712 -- 846.36 -- 891.36
713 -- 846.39 -- 891.39
714 -- 846.42 -- 891.42
715 -- 846.45 -- 891.45
716 -- 846.48 -- 891.48
717 -- 846.51 -- 891.51
718 -- 846.54 -- 891.54
719 -- 846.57 -- 891.57
720 -- 846.60 -- 891.60
721 -- 846.63 -- 891.63
722 -- 846.66 -- 891.66
723 -- 846.69 -- 891.69
724 -- 846.72 -- 891.72
725 -- 846.75 -- 891.75
726 -- 846.78 -- 891.78
727 -- 846.81 -- 891.81
728 -- 846.84 -- 891.84
729 -- 846.87 -- 891.87
730 -- 846.90 -- 891.90
731 -- 846.93 -- 891.93
732 -- 846.96 -- 891.96
733 -- 846.99 -- 891.99
734 -- 847.02 -- 892.02
735 -- 847.05 -- 892.05
736 -- 847.08 -- 892.08
737 -- 847.11 -- 892.11
738 -- 847.14 -- 892.14
739 -- 847.17 -- 892.17
740 -- 847.20 -- 892.20
741 -- 847.23 -- 892.23
742 -- 847.26 -- 892.26
743 -- 847.29 -- 892.29
744 -- 847.32 -- 892.32
745 -- 847.35 -- 892.35
746 -- 847.38 -- 892.38
747 -- 847.41 -- 892.41
748 -- 847.44 -- 892.44
749 -- 847.47 -- 892.47
750 -- 847.50 -- 892.50
751 -- 847.53 -- 892.53
752 -- 847.56 -- 892.56
753 -- 847.59 -- 892.59
754 -- 847.62 -- 892.62
755 -- 847.65 -- 892.65
756 -- 847.68 -- 892.68
757 -- 847.71 -- 892.71
758 -- 847.74 -- 892.74
759 -- 847.77 -- 892.77
760 -- 847.80 -- 892.80
761 -- 847.83 -- 892.83
762 -- 847.86 -- 892.86
763 -- 847.89 -- 892.89
764 -- 847.92 -- 892.92
765 -- 847.95 -- 892.95
766 -- 847.98 -- 892.98
767 -- 848.01 -- 893.01
768 -- 848.04 -- 893.04
769 -- 848.07 -- 893.07
770 -- 848.10 -- 893.10
771 -- 848.13 -- 893.13
772 -- 848.16 -- 893.16
773 -- 848.19 -- 893.19
774 -- 848.22 -- 893.22
775 -- 848.25 -- 893.25
776 -- 848.28 -- 893.28
777 -- 848.31 -- 893.31
778 -- 848.34 -- 893.34
779 -- 848.37 -- 893.37
780 -- 848.40 -- 893.40
781 -- 848.43 -- 893.43
782 -- 848.46 -- 893.46
783 -- 848.49 -- 893.49
784 -- 848.52 -- 893.52
785 -- 848.55 -- 893.55
786 -- 848.58 -- 893.58
787 -- 848.61 -- 893.61
788 -- 848.64 -- 893.64
789 -- 848.67 -- 893.67
790 -- 848.70 -- 893.70
791 -- 848.73 -- 893.73
792 -- 848.76 -- 893.76
793 -- 848.79 -- 893.79
794 -- 848.82 -- 893.82
795 -- 848.85 -- 893.85
796 -- 848.88 -- 893.88
797 -- 848.91 -- 893.91
798 -- 848.94 -- 893.94
799 -- 848.97 -- 893.97
There are no existing channel
numbers in the range 800-990.
Band B
Chan Mobile Cell Site
-------------------------
991 -- 824.04 -- 869.04
992 -- 824.07 -- 869.07
993 -- 824.10 -- 869.10
994 -- 824.13 -- 869.13
995 -- 824.16 -- 869.16
996 -- 824.19 -- 869.19
997 -- 824.22 -- 869.22
998 -- 824.25 -- 869.25
999 -- 824.28 -- 869.28
1000 -- 824.31 -- 869.31
1001 -- 824.34 -- 869.34
1002 -- 824.37 -- 869.37
1003 -- 824.40 -- 869.40
1004 -- 824.43 -- 869.43
1005 -- 824.46 -- 869.46
1006 -- 824.49 -- 869.49
1007 -- 824.52 -- 869.52
1008 -- 824.55 -- 869.55
1009 -- 824.58 -- 869.58
1010 -- 824.61 -- 869.61
1011 -- 824.64 -- 869.64
1012 -- 824.67 -- 869.67
1013 -- 824.70 -- 869.70
1014 -- 824.73 -- 869.73
1015 -- 824.76 -- 869.76
1016 -- 824.79 -- 869.79
1017 -- 824.82 -- 869.82
1018 -- 824.85 -- 869.85
1019 -- 824.88 -- 869.88
1020 -- 824.91 -- 869.91
1021 -- 824.94 -- 869.94
1022 -- 824.97 -- 869.97
1023 -- 825.00 -- 870.00
Downloaded From P-80 International Information Systems 304-744-2253
phreak/CELLULAR/celphrk1.txt
+50
View File
@@ -0,0 +1,50 @@
CELLULAR TELEPHONE PHREAKING PHILE SERIES VOL 1 by The Mad Phone-man
How would ya like to have a phone that no body could locate? How bout free
phone service on it too? Well Cellular telephones have the potential to do
all this and more. First lets discuss some basics of the service.
QUESTIONS & ANSWERS:
--------------------
Q:What is cellular; a cellular phone?
A: A 800 mhz radiotelephone, running 3 watts, with the ability to change
channel on computer command from the central switch. This happens when you
travel thru the service area and your signal becomes stronger at a neighboring
cell base station.
Q: They are marketed as a high security device with no possibility of anyone
making a phoney call and charging it to someone else, how can it be phreaked?
A: An understanding of the phone reveals that every time a call is made, the
phone number,an electronic serial number, and other data is sent to the switch.
If you were to listen to the oposite side of the control channel as the call
is being "set-up" you would hear this data being transmitted to the switch in
NRZ code (non-return to zero). All one has to do, is record this info and
program the bogus phone to these params and a free call is possible thru the
switch.
Q: Has anyone done this yet?
A: YES, about 6 months after the first cellular phone system was "turned-up"
a technician programmed a panasonic telephone with a NEC E.S.N. (Electronic
serial number) this was reportedly done for a gram of coke. With the popular
ROM programmers available today, almost any NAM (Numeric Assignment Module)
can be duplicated or copied with changes. (The NAM is the heart of the billing
information and contains the phone number but not the ESN) The most popular
integrated circut for NAMs is the 74LS123.
Q: This sounds like a lot of trouble, is there easier ways to get service?
A: SURE, the cellphone companies have been their own downfall. In an effort
market their wares as a universal service (Your phone will work in any system)
they have let the cart get before the horse. Nobody can tell if a phone from
another city (that has a roaming agreement) is valid till its too late. The
only thing they could do after finding out is block any call with the bad
ESN because as we know, the phone number is easy to change, but the ESN is
not. So heres a likely plot...a roamer identifying itself as a number from
Chicago non-wireline accesses a Cellular system in Dallas. Sometimes an
operator intervienes but you can bullshit them as long as you know the
information you have programmed into your phone. Then you make calls just
like you are a local user. If you're found out, you remove the number,
change it to another, and see if that works. Usualy it will require the
radio's ESN chip to be changed, but thats a lot easier if you have a ZIF
(zero insertion force) socket installed, thats what I use.
Upcomming soon, more good info on particular mfgrs ESN codes.
Cracking the Motorola switch, Shortcommings of the Ericcson AXE-10 switch.
>>> The Mad Phone-man <<<
phreak/CELLULAR/celphrk2.txt
+47
View File
@@ -0,0 +1,47 @@
CELLULAR TELEPHONE PHREAKING PHILE VOL 2 by "The Mad Phone-man"
Some terms you should understand:
Control Channel- The channel the phone and cell base first communicate on.
Reverse Control Ch- The oposite frequency, 45 mhz lower than the control
channel.This is where the mobile unit is.
Voice channel- The channel you are assigned by the switch to commence the
call on after the exchange of suscriber data.
Reverse voice channel- Again 45mhz lower.
Cell Site- The base station that talks to the mobile.
Switch- The computer that places the calls, and takes and recieves data
from the suscriber or from PSTN. (public switched tel netwk)
OK that should get things started. A suscriber picks up his handset to
place a call.
The phone has already been locked onto the strongest control ch in the
area by a computerized scanner in the phone. As he drives thru the service a
the computer constantly picks out the strongest control ch and stays on it,
altho more than one cell site can actualy be heard. The suscriber enters the
number to call on the keypad, and presses the "send" button. At this time th
folowing data is transmitted to the cell sit by the mobile. The callers
electronic serial number (ESN) , his home system number (two digits) his
mobile's area code and phone number, and the number he wants.The cellular
switch now picks up an outgoing line, places the call for him and tells
the mobile to switch to a voice channel. The two ends are linked in the
central switch and violla! A complete phone call, in about 3 seconds.
I have purposely over-simplified the whole process to point out the
moment of truth. The mobile's ESN and phone number and the data in the
switch must match or no go. This is how the billing is figgured out.If
one had the ESN and the mobilephone number, you could call anytine
anyplace without fear of trace, let alone bill. The ideal setup would
let you listen to the reverse control channel, record and display heard
working numbers and ESN's and recall them at your discression to make calls.
This would be tits! Were not quite there yet. But some hard work has
allready been done for us. All the aforementioned codes are sent
in hex, in NRZ code (phancy term for phase shift keying) but the phone
allready has, for example a NRZ receiver and transmitter built right in.
All that has to be done is to have a receiver on the reverse control
channel, recover the other suscribers data and save it or at least print
it out. The mobile radio data books show some good technical stuff on
the systems used and chip part numbers for the NRZ stuff. I know there
is a mfgr using the lowley 8085 chip for the control head functions,
seems like theres room for xperementin here.
More to come!... "The Mad Phone-man"
phreak/CELLULAR/celphrk3.txt
+49
View File
@@ -0,0 +1,49 @@
CELLULAR TELEPHONE PHREAKING PHILE VOL 3 by "The Mad Phone-man"
Now that you have become familiar with the technology of cellular phones
its time to discuss what you can do with a phone right now.
Not every system pays attention to a "Roamer" from outside the system as
closely as they do a local suscriber. In their mad rush to offer cellular as
"universal" service, meaning you can place a call in any cellular city any-
where in North America, they fucked up.
OK, heres the poop...I access say..Cleveland Ohio Cellular 1's Ericcson switch
and tell them by my "NAM" info that im a roamer from NYNEX in New York City.
Cleveland will let me make the call, cause it bills back to NYC my number
of minutes used. If the NYC number is bogus, the call goes thru, and the bill
doesn't go anywhere. They do know the exchange data for NYC, thats on a chart
so ya cant tell em yer...555-1212 or such..you must tell em yer a valid roamer
and the System number (two digits) must match NYC's. This is not too hard to
figgure out, (call some of their stupid sales idiots some time and see what
they will let out of the bag)...so now lets see what else you should know.
OK, the system number for the foreign exchange....Nynex in Buffalo is 56,
Chicago nonwireline is 01, Buffalo Nonwireline is 03, All wirelines are even
numbers all non-wirelines are odd.
OK, first three digits of the mobile number....Nynex Buffalo- 863 xxxx
Buffalo Non-wire 861 xxxx, 690 xxxx.
I am sure it wont take much to figgure out the local numbers for your area
like I said the sales people are fucks and will tell ya anything to
make a sale.
Until the companys get a cellular clearinghouse to validate roamers in real
time this will work out fine. The prospects of such a clearinghouse are
good after the companys get done with their bitching at each other.
But it may be a while before it becomes routine to look up a roamer. There's
simply too many to look up every time service is wanted.
So, steal a cellphone and his antenna, re-nam it as a roamer and when ya get
it setup, make copies of the info with different suscriber numbers (the
last 4 digits) and make free calls till whenever.
More to come...."The NOVATEL series phones "
Uncracking the Maintenance code
This is probibaly the best radio to use to shut down
a cell site completely, it has secret codes in the ctrl
head that allow you to bypass conventional switching
protocols.
phreak/CELLULAR/celprog.phk
+1964
View File
File diff suppressed because it is too large Load Diff
phreak/CELLULAR/celular1.txt
+50
View File
@@ -0,0 +1,50 @@
CELLULAR TELEPHONE PHREAKING PHILE SERIES VOL 1 by The Mad Phone-man
How would ya like to have a phone that no body could locate? How bout free
phone service on it too? Well Cellular telephones have the potential to do
all this and more. First lets discuss some basics of the service.
Q:What is cellular a cellular phone?
A: A 800 mhz radiotelephone, running 3 watts, with the ability to change
channel on computer command from the central switch. This happens when you
travel thru the service area and your signal becomes stronger at a neighboring
cell base station.
Q: They are marketed as a high security device with no possibility of anyone
making a phoney call and charging it to someone else, how can it be phreaked?
A: An understanding of the phone reveals that every time a call is made, the
phone number,an electronic serial number, and other data is sent to the switch.
If you were to listen to the oposite side of the control channel as the call
is being "set-up" you would hear this data being transmitted to the switch in
NRZ code (non-return to zero). All one has to do, is record this info and
program the bogus phone to these params and a free call is possible thru the
switch.
Q: Has anyone done this yet?
A: YES, about 6 months after the first cellular phone system was "turned-up"
a technician programmed a panasonic telephone with a NEC E.S.N. (Electronic
serial number) this was reportedly done for a gram of coke. With the popular
ROM programmers available today, almost any NAM (Numeric Assignment Module)
can be duplicated or copied with changes. (The NAM is the heart of the billing
information and contains the phone number but not the ESN) The most popular
integrated circut for NAMs is the 74LS123.
Q: This sounds like a lot of trouble, is there easier ways to get service?
A: SURE, the cellphone companies have been their own downfall. In an effort
market their wares as universal service (Your phone will work in any system)
they have let the cart get before the horse. Nobody can tell if a phone from
another city (that has a roaming agreement) is valid till its too late. The
only thing they could do after finding out is block any call with the bad
ESN because as we know, the phone number is easy to change, but the ESN is
not. So heres a likely plot...a roamer identifying itself as a number from
Chicago non-wireline accesses a Cellular system in Dallas. Sometimes an
operator intervienes but you can bullshit them as long as you know the
information you have programmed into your phone. Then you make calls just
like you are a local user. If you're found out, you remove the number,
change it to another, and see if that works. Usualy it will require the
radio's ESN chip to be changed, but thats a lot easier if you have a ZIF
(zero insertion force) socket installed, thats what I use.
Upcomming soon, more good info on particular mfgrs ESN codes.
Cracking the Motorola switch, Shortcommings of the Ericcson AXE-10 switch.
>>> The Mad Phone-man <<<
phreak/CELLULAR/celular2.txt
+50
View File
@@ -0,0 +1,50 @@
CELLULAR TELEPHONE PHREAKING PHILE VOL 2 by "The Mad Phone-man"
Some terms you should understand:
Control Channel- The channel the phone and cell base first communicate on.
Reverse Control Ch- The oposite frequency, 45 mhz lower than the control
channel.This is where the mobile unit is.
Voice channel- The channel you are assigned by the switch to commence the
call on after the exchange of suscriber data.
Reverse voice channel- Again 45mhz lower.
Cell Site- The base station that talks to the mobile.
Switch- The computer that places the calls, and takes and recieves data
from the suscriber or from PSTN. (public switched tel netwk)
OK that should get things started. A suscriber picks up his handset to
place a call.
The phone has already been locked onto the strongest control ch in the
area by a computerized scanner in the phone. As he drives thru the service area
the computer constantly picks out the strongest control ch and stays on it,
altho more than one cell site can actualy be heard. The suscriber enters the
number to call on the keypad, and presses the "send" button. At this time the
folowing data is transmitted to the cell sit by the mobile. The callers
electronic serial number (ESN) , his home system number (two digits) his
mobile's area code and phone number, and the number he wants.The cellular
switch now picks up an outgoing line, places the call for him and tells
the mobile to switch to a voice channel. The two ends are linked in the
central switch and violla! A complete phone call, in about 3 seconds.
I have purposely over-simplified the whole process to point out the
moment of truth. The mobile's ESN and phone number and the data in the
switch must match or no go. This is how the billing is figgured out.If
one had the ESN and the mobilephone number, you could call anytine
anyplace without fear of trace, let alone bill. The ideal setup would
let you listen to the reverse control channel, record and display heard
working numbers and ESN's and recall them at your discression to make calls.
This would be tits! Were not quite there yet. But some hard work has
allready been done for us. All the aforementioned codes are sent
in hex, in NRZ code (phancy term for phase shift keying) but the phone
allready has, for example a NRZ receiver and transmitter built rite in.
All that has to be done is to have a receiver on the reverse control
channel, recover the other suscribers data and save it or at least print
it out. The mobile radio data books show some good technical stuff on
the systems used and chip part numbers for the NRZ stuff. I know there
is a mfgr using the lowley 8085 chip for the control head functions,
seems like theres room for xperementin here.
More to come!... "The Mad Phone-man"
phreak/CELLULAR/celular3.txt
+50
View File
@@ -0,0 +1,50 @@
CELLULAR TELEPHONE PHREAKING PHILE VOL 3 by "The Mad Phone-man"
Now that you have become familiar with the technology of cellular phones
its time to discuss what you can do with a phone right now.
Not every system pays attention to a "Roamer" from outside the system as
closely as they do a local suscriber. In their mad rush to offer cellular as
"universal" service, meaning you can place a call in any cellular city any-
where in North America, they fucked up.
OK, heres the poop...I access say..Cleveland Ohio Cellular 1's Ericcson switch
and tell them by my "NAM" info that im a roamer from NYNEX in New York City.
Cleveland will let me make the call, cause it bills back to NYC my number
of minutes used. If the NYC number is bogus, the call goes thru, and the bill
doesn't go anywhere. They do know the exchange data for NYC, thats on a chart
so ya cant tell em yer...555-1212 or such..you must tell em yer a valid roamer
and the System number (two digits) must match NYC's. This is not too hard to
figgure out, (call some of their stupid sales idiots some time and see what
they will let out of the bag)...so now lets see what else you should know.
OK, the system number for the foreign exchange....Nynex in Buffalo is 56,
Chicago nonwireline is 01, Buffalo Nonwireline is 03, All wirelines are even
numbers all non-wirelines are odd.
OK, first three digits of the mobile number....Nynex Buffalo- 863 xxxx
Buffalo Non-wire 861 xxxx, 690 xxxx.
I am sure it wont take much to figgure out the local numbers for your area
like I said the sales people are fucks and will tell ya anything to
make a sale.
Until the companys get a cellular clearinghouse to validate roamers in real
t{w{e this will work out fine. The prospects of such a clearinghouse are
good after the companys get done with their bitching at each other.
But it may be a while before it becomes routine to look up a roamer. There's
simply too many to look up every time service is wanted.
So, steal a cellphone and his antenna, re-nam it as a roamer and when ya get
it setup, make copies of the info with different suscriber numbers (the
last 4 digits) and make free calls till whenever.
More to come...."The NOVATEL series phones "
Uncracking the Maintenance code
This is probibaly the best radio to use to shut down
a cell site completely, it has secret codes in the ctrl
head that allow you to bypass conventional switching
protocols.
phreak/CELLULAR/celular4.txt
+113
View File
@@ -0,0 +1,113 @@
WHATS IN A NAM by The Mad Phone-man
---------------------------------------------------------
Nam stands for "Number Assignment Module" or to the Teckies a PROM
(Programable Read-Only Memory) A blank Nam usualy costs between $1. to
$2.75. Sometimes its more expensive depending on the operating temperature
and packaging specifications.
Two flavors of NAM's are used for cellular. NEC uses the open colector
(Signetics p/n 82S32 or equivalent). All others use the tri-state (Signetics
82S123 or equivalent). Blank Nams are manufactured by Signetics,National
Semiconductor, Monolithic Memorys, Fujitsu, Texas Instruments, and Advanced
Microdevices. Blank Nams can be purchased at your electronic distribuitor's
and many radios come with a blank included.
The NAM contains the subscriber number and lock code, the home system
identification and other system required information. You may wonder how this
info is arranged.
The NAM is organized into 32 rows and 8 columns. It is 32 words of 8 bits
each. (256 bits total) Starting from the top of the NAM (address 00)
you will find the abreviation SIDH, This means "system identification number
home" , a number starting at 0001 assigned by the FCC.
Each market allows two systems. Even for the wire-line and odd for
the non-wireline.
At address 03 we find LU (Local use) on the left and MIN on the right these
areusualy set to 1. Locations with zeros are reserved. Going down the map,
there's MIN1 and MIN2 the subscriber number and the area code respectivly
Dont try to read them from a raw printout of the NAM data, they are scrambled
beond recognition. The reason? The way they are arranged is the way they must
be transmitted to the cellular systems receivers. The programmer does this to
make the radio's job easier.
Next is the station class mark, which identifys the class and power capability
of the phone. The system will treat a handheld (low power) differently than
a standard 3 watt mobile.
IPCH is the inital paging channel. The radio listens for a page on this
channel. Wirelines use 334 and non-wirelines use 333.
ACCOLC (ACCess Overload Class) is designed in throwing off customers in
the event of an overload. Thru neglect this standard has been largely unused.
(A class 15 station is supposed to be police, fire, or military)
Usualy its set to 0 plus the last digit of the phone number to provide random
loading.
PS- Prefered system. This is always 1 in non-wireline and 0 in wireline.
The lock code is about the only thing you can read directly by studying
the NAM data. The "spare" bit must be a 0 if the radio contains a 3 digit code.
Because the number of clicks when you dial 0 on a (dial) phone equals 10
zeros in the lock code are represented by an "A" the hexadecimal equiv of 10.
EE,REP,HA, and HF correspond to end-to-end signaling (DTMF tones possible
you talk) REPeratory dialing (provision for 10 or more numbers in memory)
Horn Alert and hands free. Like all options, they are 1, if turned on and
0 if turned off.
Addresses 13 thru 1D (all these numbers are in hex) are supposed to be used
by radio mfgrs to store option switches. Usualy 13 is used, 14 sometimes and
the rest less often.
Last you will find checksum adjustment and checksum. These numbers are
calculated automaticly after the data has been edited for the NAM. The sum
of all words in the nam plus these last two must equal a number with 0's
in the last two digits. The radio checks this sum and if it isnt correct
the radio assumes the NAM is bad or tampered with. In the case the radio
refuses to operate until a legal NAM is installed.
MARK most BIT SIGNIFICANCE least Hex
DEFINITION address
----------------------------------------------------------------------------
| 0 SIDH (14-8) | 00
----------------------------------------------------------------------------
| SIDH (7-0) | 01
----------------------------------------------------------------------------
LU=Local use | LU | 0 0 0 0 0 0 | MIN | 02
----------------------------------------------------------------------------
| 0 0 MIN2 (33-28) | 03
----------------------------------------------------------------------------
| MIN2 (27-24) | 0 0 0 0 | 04
----------------------------------------------------------------------------
| 0 0 0 0 | MIN1 (23-20) | 05
----------------------------------------------------------------------------
| MIN1 (19-12) | 06
----------------------------------------------------------------------------
| MIN1 (11-4) | 07
----------------------------------------------------------------------------
| MIN1 (3-0) | 0 0 0 0 | 08
----------------------------------------------------------------------------
| 0 0 0 0 | SCM (3-0) | 09
----------------------------------------------------------------------------
| 0 0 0 0 0 | IPCH (10-8) | 0A
----------------------------------------------------------------------------
| ICPH (7-0) | 0B
----------------------------------------------------------------------------
| 0 0 0 0 | ACCOLC (3-0) | 0C
----------------------------------------------------------------------------
PS=Perf Syst | 0 0 0 0 0 0 0 | PS | 0D
----------------------------------------------------------------------------
| 0 0 0 0 | GIM (3-0) | 0E
----------------------------------------------------------------------------
| LOCK DIGIT 1 | LOCK DIGIT 2 | 0F
----------------------------------------------------------------------------
| LOCK DIGIT 3 | LOCK SPARE BITS | 10
----------------------------------------------------------------------------
EE=End/End | EE | 0 0 0 0 0 0 | REP | 11
----------------------------------------------------------------------------
REP=Reprity | HA | 0 0 0 0 0 0 | HF | 12
----------------------------------------------------------------------------
HF=Handsfree | |
HA=Horn Alt | Spare Locations (13-1D) |
| contain all 0's | 13
| | to
| | 1D
----------------------------------------------------------------------------
| NAM CHECKSUM ADJUSTMENT | 1E
----------------------------------------------------------------------------
| NAM CHECKSUM | 1F
----------------------------------------------------------------------------
phreak/CELLULAR/cf.phk
BIN
View File
Binary file not shown.
phreak/CELLULAR/clarion1.txt
+42
View File
@@ -0,0 +1,42 @@
CLARION CAL-1000CT/3000CT/5100CT/5200CT.
NOTES: This unit has three NAMS.
The ESN prefix is 140 decimal & 8C hex.
Clarion: 213-327-9100
NAM programing:
1. Turn on power, new phones will display "Err 3", this is normal.
2. Within 10 seconds press CLR followed by * * 1 2 3 1 2 3 # #.
3. The phone will display a "0" if you have completed the above steps
correctly.
4. Select the NAM you want to program by entering 1, 2 or 3.
5. Each of the nine programing steps below is accessed by pressing
RCL N, where N is the step number.
6. Enter the new data for each location followed by the STO key.
7. Turn the power off to complete programing.
PROGRAMING DATA:
STEP# #OF DIGITS/RANGE DESCRIPTION
0 3 OR 4 DIGITS LOCK CODE
1 00000 - 99999 SYSTEM ID
2 1 OR 2 LOCAL USE MARK
3 0 OR 1 MIN MARK
4 10 DIGITS MIN (AREA CODE & PHONE NUMBER)
5 2 DIGITS STATION CLASS MARK
6 333 OR 334 INITIAL PAGING CHANNEL
7 2 DIGITS ACCESS OVERLOAD CLASS
8 0 OR 1 PREFERRED SYSTEM (1=A, 0=B)
9 2 DIGITS GROUP ID (10 FOR USA)
LOCK: F 0. UNLOCK: Three or Four digit code.
SYSTEM SELECT: F 4 then 4 to scroll, STO to store.
phreak/CELLULAR/cm.txt
+244
View File
@@ -0,0 +1,244 @@
~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^
02/23/93 1.00 RELEASE
~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^
/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
/\/\%%%%%%%\/\%%%%%%/\%%%\/\/\%%%\/\/\%%%\/%%%/\%%%\/\/\/%%%%%%\/\%%%%%%%\/\/\
/\/%%% %%%/\/ \%%% /\/\%%% /\/\%%% /%%% \%%% /\/\%%% %%%/\%%% %%%/\/\
/\/%%% \/\ \%%%%%\/\%%% /\/\%%% /\/\%%% /%%% \%%% /\/\%%%%%%%% \%%%%%%% \/\
\/\%%% /\/\/\/%%% \/%%% \/\/%%% \/\/%%% \%%% /%%% \/\/%%% %%% /%%% %%%\/\/
/\/%%% \/%%%/\%%% /\/\%%% /\/\%%% /\/\%%% /%%% \%%% /\/\%%% /%%% \%%% /%%% \/\
/\/\%%%%%%% \%%%%%%/\%%%%%%/\%%%%%%/\/%%%%%% \%%%%%%/\%%% /%%% \%%% /%%% \/\
/\/\/ /\/ \/ \/ \/\ /\/ \/ /\ \/ /\ \/\
/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
/\/%%%/\/\/\%%%\/\%%%%%%/\/%%%/\%%%\/\%%%%%%/\/\%%%%%%%\/\%%%%%%/\%%%%%%%\/\/\
/\/%%%%\/\/%%%% /%%% %%%\/%%% \%%% /%%% %%%\/%%% %%%/\/ \%%% %%%/\/\
/\/%%%%%/\%%%%% /%%%%%%%% /%%%%\%%% /%%%%%%%% /%%% \/\ \%%%%%\/\%%%%%%% \/\
\/\%%% %%%% %%% \%%% %%% \%%%%%%%% \%%% /%%% \%%% /%%%%\/%%% \/%%% \%%%\/\/
/\/%%% \%% %%% /%%% \%%% /%%% %%%% /%%% \%%% /%%% \/%%% \%%% /\/\%%% /%%% \/\
/\/%%% \/ \%%% /%%% \%%% /%%% \%%% /%%% \%%% /\%%%%%%% \%%%%%%/\%%% /%%% \/\
/\/\ \/\/\/ /\ \/ /\ \/ /\ \/ /\/ /\/ \/ /\ \/\
/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^
PROGRAM HISTORY
~~~~~~~~~~~~~~~
DATE VER DESC
-------- ---- ------------------------------------------------------
12/15/92 0.10 Started initial work based off of VTools concept
" " 0.12 All ESN decimal identifications in database
12/16/92 0.19 Added seach by [N]ame of Manufacturer
12/20/92 0.23 Started work on Binary conversion routines
" " 0.24 Binary routines done, started on MIN creation routines
12/23/92 0.37 Fixed problems with [N]ame search, MIN completed
" " 0.38 Added binary conversion option
" " 0.40 Started work on Cellular Freq/Chan tables
12/27/92 0.43 Added control channel table
01/01/93 0.47 Completed all Freq/Chan routines
01/05/93 0.52 Added some command line options (same as main menu)
" " 0.55 Added toggle to clean up command line options
01/09/93 0.60 Fixed case-sensativity problems
01/10/93 0.70 Completed programming specs area
01/12/93 0.71 Optimized some of the screen routines
01/13/93 0.80 Added Directory of Wirelines for Major US Cities
01/15/93 0.90 Added Cell Cross-reference features
01/19/93 0.92 Fixed a couple of minor problems within the X-Ref
02/04/93 0.94 Added the strongest cell search function
02/23/93 1.00 Added new exploding menus and finished release
-------- ---- ------------------------------------------------------
WHAT IS CELLULAR MANAGE
~~~~~~~~~~~~~~~~~~~~~~~
Well, Cellular Manager (CM), would best be described as a kind of reference
program, much like Professor Falkins Phreakers Tools, except for Cellular phones
and the like. CM has some of the most common tools in a easy, fast, menu driven
environment, to give us just one more edge over our opponents.
I am not, however, going to go into any great detail about what each of the
options is for, and what can be done with the information gathered, since there
are many other nice files already out there that do just that (I would recommend
Bootlegger's freecell file from HohoCon, since in includes virtually all of the
information that is available at the moment).
The most benifical part about this program is the fact that you can track down
the strongest control cell in your area. This is especially useful when trying
to recieve the reverse control channel, which is very weak (due to power limit-
ations from the mobile to the base).
AVAILABLE OPTIONS
~~~~~~~~~~~~~~~~~
All of the options listed below are available from the main menu of the CM,
which the program defaults into. Some options are also available from the
command line, which is discussed later.
Create MIN1 and MIN2
^^^^^^^^^^^^^^^^^^^^
Generates the MIN1 and MIN2 for the phones NAM. Prompts for the areacode
and phone number, then outputs the MIN's in binary format.
Cellular Channel to Frequency
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Fairly self-explanitory, converts a given cellular frequency into it's
channel number. Will display either forward, or reverse frequencies.
Cellular Frequency to Channel
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Like above option, except reversed.
Table of control Channels
^^^^^^^^^^^^^^^^^^^^^^^^^
A complete listing of all the controls numbers, their channel number, and
forward and reverse frequencies.
Convert HEX to Binary
^^^^^^^^^^^^^^^^^^^^^
Convienient routine to convert a HEX number (up to 10 digits) into Binary
Search list of Manufactures ESN by Name
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Searches through a list of Cellular phone manufactures name fields, then
shows the most likely match and their decimal ESN identification
Search list of Manufactures ESN by Identification
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Like above option, except reversed.
Locate and list adjacent Cells
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Prompts for entry of the most powerful control or voice channel in your
area, then displays a small hex table showing the closest cells and their
identification. This function also displays the cell's group status as well
as it's designator.
Search through Phone programming specs
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Searches through a list of Cellular phones available, and displays what
information is available about reprogramming. Well display all possible
matches.
Search through Directory of Wirelines
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Searches through a list of major cities in the US and then displays the
Wire/Non-Wire (Band A&B) channels for each city. States can also be
specified.
Cross-Reference Cell Groups
^^^^^^^^^^^^^^^^^^^^^^^^^^^
Uses the cellulars group identification and wireline specs to list all of
the voice channels and their corresponding frequencies. Also displays the
control channel for the group, and it's forward frequency.
Find Strongest Control Cell
^^^^^^^^^^^^^^^^^^^^^^^^^^^
This option requires you to have established 5 (no more, no less) control
channels that can be received at your location. After inputing their
channel numbers, the program will respond with the group that is most likely
to be the strongest.
THE BEST WAY TO SCAN REVERSE
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The way I would recommend that will yield the best results when scanning the
reverse channels is this:
(1) Locate and write down the forward control frequencies that you can hear
with the antenni removed from your scanner. Get at least five, and if
possible stay either wireline or non-wireline. Use the table in option
[4] if necessary.
(2) Convert the frequencies to their appropriate channel using option [3].
(3) Enter the channels into option [C] and then write down the group.
(4) Use option [B] to find the channel/frequencies, as well as the strongest
voice channels in your region.
(5) Enter the channel into option [2] and specify [R]everse information.
Simple enough, eh? Now you have the best possible chance of capturing reverse
channel information (such as the ESN). Also try to place your scanners antenni
in the most open location possible, although this is not necessary. I have used
a Radio Shack Pro-37 (portable) with a DDI, and a laptop with very good success.
A COUPLE OF BRIEF NOTES
~~~~~~~~~~~~~~~~~~~~~~~
In the Locate & List Adj Cells function, on the hex chart that is displayed,
only cells that actually TOUCH the highlighed cell are adjacent to it. The cells
on the left and right do not touch the primary cell, although they may appear to.
This is because there are redundant cells exactly opposite it in the field, and
I chose not to display those.
When trying to establish what is most likely your strongest control channel,
it does not matter if you list Wireline and Non-Wireline channels. This is due
to the fact that most cellular companies share a zone, and split it up on the
A/B settings appropriately. Also, do not list the same cell channel twice, since
this will effect what it suggests.
COMMAND LINE OPTIONS
~~~~~~~~~~~~~~~~~~~~
Several of the main menu options are also available from the command line.
For a current listing of supported commands, at dos enter either 'CM /?' or
'CM /H'. Operation through the command line is exactly the same as if the
option was selected from the menu.
KNOWN BUGS
~~~~~~~~~~
None.
UPDATES
~~~~~~~
I plan to keep CM as updated as possible, but this can only be done with your
help! When you find any information that it does not contain, please leave it
to me on any of the systems listed below. An open exchange of information helps
everyone, and this is the next frontier of phreaking...
PROGRAMS FOR THE FUTURE
~~~~~~~~~~~~~~~~~~~~~~~
Here's some of the programs to be watching for, from me, in the future:
ACTCHK Checks CBI accounts against their algorhythm and verifies
format validity and extra information.
[AVAILABLE EARLY 1993]
CBIDBS A database that sorts and displays all of your credit
reports. Implements the VC routines real time for
maximum security. Allows searching for any field, comment
fields, and ARDT directory.
[AVAILABLE SUMMER 1993]
VINHP A new operating system for the HP 95/LX
[AVAILABLE FALL 1993]
CONCLUSION
~~~~~~~~~~
If you have any questions, comments, or problems, please report them to me
on any of the boards listed below or in the program. The greets go out to:
DIGITAL HITLER BOOTLEGGER THE WHITE RIDER
MAXIMUM OVERDRIVE MR. DRUNKFUX GRANDMASTER RATTE'
Erekose: Where the fuck are you? Get in touch with me..
And extra special thanks to Capt. Zap for the TV plug...
"...Send money now, this is a limited time offer, operators are standing by..."
A couple of notes on the systems listed below... There finally is a transfer
area on Demon Roach for my files (Log 38), so you can EASILY find them for a
change. Unphamiliar Territory is now another cDc board, helping to spreading
the word of the holy bovine to the world.
Here's a couple of things to keep in mind; Clinton's daughter is what happens
when you marry a relative (Jesus, what the fuck IS she?). And, of course,
always remember...
Fuck Clinton, Fuck Gore, Fuck Law & Order, and FUCK THE WORLD!
=============================================================================
Demon Roach [PW: THRASH - NUP: FEAR - cDc - Nuff said ] 24 806-794-4362
Unphan. Terr. [The best H/P system left - Phalcon/Skism ] 96 602-894-1757
Phunline [Extensive Satellite/Virii sections ] 96 916-481-2306
The Stash [My European Connection... Lots of files ] 96 46-498-222113
=============================================================================
This concludes another wonderful file by Video Vindicator (C)opyright 1993
=============================================================================
phreak/CELLULAR/cmt.phk
+271
View File
@@ -0,0 +1,271 @@
A GUIDE TO CELLULAR PHREAKING
--by Bernie S.
The recent FBI/Secret Service cellular sting operation that culminated in the
arrests of over 25 people in New York City confirms what many of us have
suspected for quite some time: that cellular telephone fraud is widespread.
The FBI estimates that cellular phone fraud costs system operators $3 million
anually; with the average subscriber's airtime bill about $50 per month for 100
minutes of usage, there could be over 2500 cellular pirates on the air if a
pirate uses twice the normal amount of airtime. The term "pirate" rather than
"phreak" is used here because the vast majority of illegitimate CMT users
(Cellular Mobile Telephone) are only interested in stealing airtime, while
phone phreaks are mainly interested in learning more about the telephone
network through its manipulation.
The six-month FBI investigation used "cooperative sources" who named
fraudulent installers; then FBI agents posing as customers and installers used
standard entrapment techniques to gather evidence against those allegedly
involved. The FBI's press release statement that "Recent technological
advances in computerized telephone switching equipment and billing systems were
instrumental in...(their investigation)" is deliberately misleading. New York
cellular carrier NYNEX merely supplied the FBI with its billing data to
document the use of bogus and stolen ESN's & MIN's (Electronic Serial Numbers
and Mobile Identification Numbers) discovered in the investigation. The Secret
Service later became involved because the laws relating to the credit fraud
being allegated are under their jurisdition.
SAFE PHREAKING: In practice, cellular phreaking is very safe if one does
their own tranceiver modifications, changes ESN's & MIN's regularly, and uses
standard phone-phreak precautions. Indeed, FBI agent Greg Meecham has stated
that fraudulently programmed CMT's are "anattributable, unbillable,
untraceable and untappable." A cellular carrier will become aware of any bogus
or stolen ESN's and MIN's used on its system within a month or so after their
initial use once the subscriber or carrier who is assi gned those codes is
billed and notifies them of the error. The home carrier will then change the
legitimate subscriber's MIN in the MTSO (Mobile Telephone Switching Office) and
arrange for a new NAM (Number Assignment Module, or ROM) to be installed in t
hat subsciber's CMT transceiver. The MTSO maintains a database of all its
valid ESN/MIN pairs, as well as a "negative verify" file on all known invalid
numbers for the deadbeats and pirates in its area. The carrier may choose to
leave certain fraudulent codes active to have any activity monitored, but as
long as all parties at the receiving end of any phreaked calls become amnesiac
to any inquiries, the phreak's identity will remain secret. If a phreak uses a
different ESN & MIN every month, it'll be extremely difficult for the carrier
to react in time to gather any information.
As with any landline, inband signalling (i.e. 2600 Hz, MF tones, etc.) will
work but can be easily detected by the ESS controlling that line. Since all
cellular systems are in metropolitan areas, it's logical to assume that most
cellular lines are on ESS . Although telco security may be aware of any
blue-boxing, the links in their security chain stop at the MTSO. Moreover,
since the MTSO selects outgoing landlines from a trunk group, a pen register at
the CO would be useless for establishing any toll fr aud patterns.
Because of cellular's inherent frequency-hopping nature, it is very difficult
to track down a CMT using conventional radio direction-finding (DF) techniques,
even if it's stationary. A small directional antenna aimed randomly at
surrounding cell-site rep eaters with a TV antenna rotor will thoroughly
confuse any DF attempts, although keeping calls as short as possible is always
a good precaution. Locating a mobile CMT is virtually impossible. I was
recently given a tour of an FCC monitoring van in Washi ngton DC, and was
suprised to see how lacking in sophistication their onboard DF gear was. The
only equipment available to readily locate a CMT transmitter is primarily used
by the military and intelligence agencies, which couldn't care less about CMT
fr aud unless it involved national security.
EQUIPMENT: Most CMT's are actually two main pieces of equipment: the
transceiver and control head. The transceiver (transmitter/receiver) is
usually a nondescript metal box with three external connectors and contains
sophisticated circuitry. There are usually two main circuit boards inside: an
RF board with all the radio transmitting/receiving circuits, and a logic board
with a microprocessor, A/D & D/A circuits, and control logic. The control head
is a Touch-Tone telephone handset with an extended ke ypad, numeric or
alphanumeric display, and volume and mic mute controls. It often has a
seperate speaker mounted in the cradle for on-hook dialling and call-progress
monitoring. Some CMT's have a speakerphone option that allows you to drive
with both ha nds on the wheel by talking into a small microphone mounted near
the vehicle's sun-visor, and listening to the cradle loudspeaker. This may
seem to be the ultimate in laziness, but remember you could be maneuvering your
five-speed through heavy traffic o n the exressway when the phone rings! The
control head/cradle is usually bolted to the transmission hump by the drivers
seat, and the transceiver is usually mounted in the trunk with a power cable
connecting it to the car battery and ignition switch. A shielded control cable
links this equipment together and allows data and audio to pass between them.
Most first-generation CMT's used the AMPS bus, developed by AT&T, which
specified a system of 36 parallel wires in a bulky control cable. Some
manufactu rers later developed their own busses--Novatel's serial bus specifies
a thin cable of just a few wires which is much easier to install in vehicles.
For fixed use, a CMT may be powered by any 12-volt regulated DC power supply
that can deliver at least 5 A mperes.
Any would-be cellular phreak must first obtain a CMT. Used bargains abound
in some cities, where many subscribers found they couldn't afford to pay their
airtime bills after they bought their phone! First-generation E.F. Johnson
transceivers are a good choice because they're easy to work on, use a uniquely
effective diversity (dual-antenna) receiver, and use the AMPS control bus,
which means that several manufacturers' control heads will work with it.
Another good choice is Novatel's Aurora/150 model. It uses a proprietary
parallel bus and control head, but costs less, is very rugged, and is also easy
to work on. In addition, all Novatel CMT's have built-in diagnostics which
allow (among other things) manual scanning of all 666 repeater output freque
ncies--great entertainment when you're bored!
ANTENNAS: A mobile cellular antenna is usually a short (less than a foot
long) piece of stiff wire with a half-dozen or so turns in the middle, like a
spring. The "spring" acts as a phasing coil in a 5/8-wave configuration. The
antenna is mounted verti cally either through a hole in the vehicle's roof or
at the top of the rear windshield using silicone adhesive with conductive
plates on either side to pass RF energy right through the glass. It's not
quite as efficient as a roof mount, but most folks pr efer not to drill a hole
in their Mercedes. A 50-Ohm coaxial cable such as RG-58/U links the antenna to
the transceiver with a male TNC-type UHF connector. A ceramic duplexer allows
the transmitter and receiver to share the same antenna simultaneously. Mobile
roof-mount antennas are designed to work with the ground plane provided by the
vehicle's body, but for fixed use an "extended-feed" or voltage-fed coaxial
antenna (which requires no ground plane) can be used if there's no tin roof on
your house. A capped PVC pipe makes an ideal rooftop housing for this type of
antenna, concealing it and making it weatherproof at the same time. As with
any kind of antenna, the higher the better--but unless you're surrounded by
tall steel buildings any height will probably do (provided you're within range
of a cell-site repeater.) It should even work indoors if near a
window--remember that cellular systems are designed to work primarily with
inefficient antennas at ground-level. Yagi and corner-reflector antenna s are
available for fixed use that provide very high gain and directivity. Antenna
specialists Co. (216/791-7878) manufactures a broad line of cellular antennas.
INTERFACING: Interfacing audio devices such as MF tone-generators to a CMT
can be accomplished by coupling the device's output through an audio coupling
transformer and capacitor across the control head's microphone wires. If it's
available, a schematic diagram will show which CMT bus lines carry the transmit
audio; coupling the signal there would be preferable. Acoustic modems can be
interfaced acoustically, or by coupling the mic and speaker wires to those on
the control head or to the appropriate bu s lines. Direct-connect modems,
answering machines, regular and cordless telephones and other devices can be
interfaced to a CMT through the AB1X cellular interface manufactured by
Morrison & Dempsey Communications (818/993-0195). This compact $300 devi ce is
a one-line PBX that connects between the tranceiver and control head and
provides an RJ-11C jack that accepts ANY direct-connect telephone accessory.
It recognizes Touch-Tone and pulse dialling, provides 1.0B equivalent ringing
voltage, and generat es dial and busy tones when appropriate.
ACCESS CODES: Every CMT manufactured has a unique ESN, which is an four-byte
hexadecimal or 11-digit octal number in a ROM soldered directly to the logic
board. It's supposed to be there for life and never removed. Some newer CMT's
embed the ESN in a V LSI chip along with the unit's program code, which makes
ESN modifications virtually impossible. The ESN is also imprinted on the
receiver ID plate mounted on the outside housing. When converted to octal (11
digits), the first three digits specify the C MT manufacturer, and the other 8
identify the unit. Typical ESN's might be 13500014732 (octal) for a NEC brand
CMT, and 8E01A7F6 (hexadecimal) for a Novatel. The other important chip is the
NAM, which contains the MIN (NPA-XXX-XXXX), lock code (keeps th e kids from
using it) and various model-specific and carrier-specific codes. Some newer
CMT's have no NAM at all and use an EEPROM which allows a technician who knows
the maintenance code to change NAM data through the control head keypad.
Basically, when one attempts to make a CMT call the transceiver first
automatically transmits its ESN & NAM data to the nearest cell-site repeater by
means of the overhead data stream, or ODS. The ODS is a 10 kilobaud data
channel that links the CMT's co mputer to the MTSO computer, which controls the
phone's entire operation right down to its channel and RF output power. If the
MTSO doesn't recognize the received ESN/MIN pair as valid, it returns a reorder
signal and will not process the call. In most cities with cellular systems
there are two carriers: the wireline operator (usually Bell or the local
telco) and the non-wireline operator, an independant company. Both maintain
their own MTSO and network of cell-site repeaters, and occupy seperate halve s
of the cellular radio band. Non-wirelines operate on system A (channels 001 to
333), and wirelines on system B (channels 334 to 666.)
Custom-Calling features such as call-forwarding, call-waiting, and three-way
calling are all standard with most cellular carriers, but the procedures for
using them differ so it's best to call the carrier for more information.
OBTAINING CODES: The most difficult task for cellular phreaks and pirates is
obtaining usable ESN's and MIN's. One method involves having an accomplice who
is employed at a CMT installation center. They will have a file on every CMT
installed at that l ocation, including the ESN's & MIN's assigned to those
subscribers. Using several codes from one source could focus attention there,
however. Another method involves the help of an inside person at the cellular
carrier's customer service or billing depa rtment, where many low-paid
employees have access to thousands of valid ESN's & MIN's. The most
sophisticated method requires interfacing a CMT's A/D circuitry to a personal
computer, enabling one to literally pick valid codes out of thin air.
PROGRAMMING THE CMT: Once a valid ESN/MIN pair is obtained, it must be
programmed into the CMT's ROM'S. Some CMT manufacturers use different devices
and memory maps, but most adhere to the AMPS 16-pin, 32 x 8 bit format. The
most common ROM's are Signe tics 82S23 (open collector) and 82S123 (tri-state)
or equivalents, but it's best to check the part numbers used in your unit. The
existing ESN ROM should be carefully removed from the logic board using
grounded desoldering tools and read using a NAM prog rammer' bit-editor mode.
Any PROM programmer that is device-compatible can be used, but dedicated NAM
programmers have built-in software which greatly simplifies the process. The
ESN printed on the ID plate (if in decimal, convert to hex) should be foun d in
memory and will be immediately followed by an 8-bit checksum determined by the
8 least significant bits of the hex sum of the ESN's four bytes. The old ESN
data (now copied into the NAM programmer's RAM) should be replaced with the new
ESN and check sum. A new blank ROM of the same type should be inserted into
the programmer and "burned." It would be advisable to solder a ZIF (Zero
Insertion Force) DIP socket onto the logic board to accomodate the new ESN chip
and any future versions.
The NAM chip is usually already ZIF socketed on the logic board for easy
replacement. It, too should be copied into the NAM burner's RAM and the old
MIN replaced with the new one. The NAM checksum should also be updated to
reflect the new data. Althoug h the carrier's system parameters must also be
programmed into the NAM, they can be left the same if the NAM being changed had
previously been on the carrier now to be used. All that needs to be changed in
this case is the last four MIN digits and checks um (and maybe the exchange if
they're using more than one.) An excellent write-up on NAM programming is
available free of charge from Curtis Electro Devices (415/964-3846). Ask for
the May '87 reprint from Cellular Business magazine. Bytek Corporation
(305/994-3520) sells a good budget NAM programmer for about $500, and the
operations manual (available seperately) explains in detail the memory maps,
part numbers, and programming techniques for most CMT's on the market. This
same unit is also capable o f programming many ESN chips using the bit-editor
mode. Some carriers and their installation agents will provide NAM system
parameters on request, and some CMT service facilities will provide NAM & ESN
memory maps and schematics of specific CMT's for a p rice.
One could eliminate the need for a NAM programmer altogether by programming
and interfacing a personal computer to the CMT's ESN and NAM sockets. Another
approach is to interface 2 banks of 8 hexadecimal thumbwheel switches to the
sockets, although a com puter program would still be needed to determine the
proper switch settings. Either of these two approaches will permit quick
emulation of any CMT with an ESN & MIN of your choosing.
ROAMING: Whenever a CMT is used in a cellular system other than the one
indicated by the SID (System ID) code in its NAM, it is in the ROAM mode and
the ROAM indicator on the control head will turn on. A CMT can roam in any
system its home carrier has a roaming agreement with, and most carriers now
have roaming agreements with each other. If there is no roaming agreement, the
MTSO will transmit a recorded voice message to the CMT user with instructions
to call the carrier (the only call the CMT will be able to make) and give his
name, MIN, ESN, and American Express Card number. All roamed calls will then
be completed by the MTSO and billed to the credit card account. Fortunately,
this procedure is becoming less common as more roaming agreements are m ade.
Usually, a carrier can only determine if a roamer came from a system with
which it has a roaming agreement, not the creditworthiness of that roamer.
Consequently, many carriers have been abused by roamers who've been denied
service on their home system d ue to non-payment. Once the home carrier is
billed for roaming services provided by the roamed carrier, it will notify same
to add that ESN & MIN to their MTSO's "negative verify" file to prevent further
abuses. Several independent companies are establi shing system software and
data networks to allow Positive Roamer Verification (PRV) which will allow near
real-time roamer validation by sharing data between carriers. Because of the
many technical, financial, and political details that still need to be
resolved, PRV systems will probably not be in place for at least two more
years. In the meantime, even fictitious ESN's & MIN's can roam if they follow
the standard format, although some carriers are sharing roamer data on a
limited basis to curtail this .
To call a roaming CMT, the caller must know which system that unit is in, and
call that carrier's roaming number. Roaming numbers vary, but are usually in
the format: (NPA)XXX-ROAM, where NPA is the carrier's area code and XXX is the
MTSO exchange. Cal ling that number will return a dial or ready tone, after
which the roamed CMT's full MIN should be entered in Touch-Tones. After a few
seconds, the mobile unit will ring or the caller will hear a recording stating
that the mobile unit is out of range. T elocator Publications (202/467-4770)
publishes a nationwide roaming directory for travellers with cellular phones.
Cellular Telephone technology offers phone phreaks complete safety by
allowing miles of physical seperation from the wire pair, and by offering
thousands of lines to choose from. In addition, all this is possible from just
about any location, even from a car, boat, train, or aircraft. It is these
characteristics that are attracting a sophisticated new breed of phone phreaks
who will enjoy unprecedented convenience and security.

phreak/CELLULAR/cmtelco1.txt
+60
View File
@@ -0,0 +1,60 @@
CM TELECOM AR3800
NOTES: This is a dual NAM unit.
The ESN prefix is 153 decimal and 99 hex.
This unit was only imported for a short time and is no longer
supported in the USA.
Several different software versions have been available and not
every phone will follow these steps... Good Luck!
Leave NAM 2 data at factory default If NAM 2 is not used.
1. Turn on power.
2. Lock phone by pressing FUNC 1, then 1 repeatedly until the phone
displays F-LOCK, press SND.
3. Enter * 5 9 6 5, display will show "CONF 3800", if not try entering
* 4 0 1 8 which is the master reset code.
4. Volume up and down keys step through the programing data. You may
also directly access any step by pressing RCL NN, where NN is the
step number. Some single digit options toggle by pressing STO (?).
5. Press SND to store each step.
6. Press END to complete programing and exit at any time.
PROGRAMING DATA:
STEP# #OF DIGITS/RANGE DISPLAY DESCRIPTION
01 10 DIGITS MINA NAM 1 AREA CODE & PHONE NUMBER
02 00000 - 99999 SIDA NAM 1 SYSTEM ID
03 0333 OR 0334 IPCHA NAM 1 INITIAL PAGING CHANNEL
04 2 DIGITS ACOLCA NAM 1 ACCESS OVERLOAD CLASS
05 2 DIGITS GIMA NAM 1 GROUP ID (10 IN USA)
06 0 OR 1 L CTLA NAM 1 LOCAL USE MARK
07 0 - 4 MINA NAM 1 PREFERRED SYSTEM
0 = Prefer A
1 = Prefer B
2 = A only
3 = B only
4 = Home only
08 UNKNOWN (LOCK CODE?)
09 UNKNOWN
10 10 DIGITS MINB NAM 2 AREA CODE & PHONE NUMBER
11 00000 - 99999 SIDAB NAM 2 SYSTEM ID
12 0333 OR 0334 IPCHB NAM 2 INITIAL PAGING CHANNEL
13 2 DIGITS AOLCB NAM 2 ACCESS OVERLOAD CLASS
14 2 DIGITS GIMB NAM 2 GROUP ID (10 IN USA)
15 0 OR 1 L CTLB NAM 2 LOCAL USE MARK
16 0 - 4 MINB NAM 2 PREFERRED SYSTEM
0 = Prefer A
1 = Prefer B
2 = A only
3 = B only
4 = Home only
17 0 ONLY E ADDR LEAVE AT 0
18 0 OR 1 PWR SAVE AUTO POWER OFF OPTION
19 00000 - 99999 ISID INHIBIT SYSTEM ID
20 4 DIGITS PCAC PROGRAMING PASSWORD
phreak/CELLULAR/colt01.txt
+53
View File
@@ -0,0 +1,53 @@
COLT TP 832
NOTES: This is a single NAM unit.
The ESN prefix is 174 decimal & AE hex.
Shintom: 213-328-7200
NAM PROGRAMING:
1. Turn power on.
2. If not locked press FUNC 5 to lock.
3. Enter FUNC # 6 2 6 # FUNC. (626 SPELLS NAM)
4. The SEND key stores and increments each step.
5. You can jump to any entry by pressing END STEP# SEND.
6. At any time press END FUNC END to complete and exit programing.
7. The first two (unnumbered) steps below are not strictly programing
data, and can not be altered, but are shown for clarity.
PROGRAMING DATA:
STEP# #OF DIGITS/RANGE DESCRIPTION
CAN NOT BE CHANGED MODEL NUMBER & SOFTWARE VERSION
CAN NOT BE CHANGED ESN IN HEX
01 3 DIGITS AREA CODE
02 7 DIGITS PHONE NUMBER
03 00000 - 32767 SYSTEM ID
04 2 DIGITS ACCESS OVERLOAD CLASS
05 2 DIGITS GROUP ID (10 IN USA)
06 0 OR 1 LOCAL USE MARK
07 0 OR 1 MIN MARK
08 3 DIGITS LOCK CODE
09 0 OR 1 AUTO LOCK
10 3 DIGITS CALL RESTRICTION CODE (DEFAULTS TO LOCK CODE)
11 2 DIGITS CALL COUNTER RESET CODE (DEFAULTS TO FIRST TWO
DIGITS OF LOCK CODE)
12 0 OR 1 HANDS FREE
13 0 OR 1 HORN ALERT
14 0 TO 3 HORN ALERT TURN OFF DELAY (0 = 2 hrs, 1 = 4 hrs,
2 = 8 hrs, 3 = no turn off)
15 2 DIGITS TOTAL AIRTIME RESET CODE (DEFAULTS TO FIRST TWO
DIGITS OF LOCK CODE)
LOCK: F5, UNLOCK: 3 DIGIT CODE
SYSTEM SELECT: F7 = A ONLY, F8 = B ONLY (F7 OR F8 AGAIN WILL TOGGLE BACK TO
PREF/NON PREF)
phreak/CELLULAR/cpp.phk
+1373
View File
File diff suppressed because it is too large Load Diff

Some files were not shown because too many files have changed in this diff Show More