                          ==Phrack Magazine==

             Volume Five, Issue Forty-Five, File 26 of 28

                      Cellular Debug Mode Commands

Motorola test mode programing codes for most motorola phones

01# Restart (re-enter DC power start-up routine)

02# Display Current Telephone Status

04# Initializes Telephone to Std. Default Conditions

05# TX Carrier On (key transmitter)

06# TX Carrier Off

07# RX Off (mute receiver audio)

08# RX Audio On (unmute receiver audio)

09# TX Audio Off

10# TX Audio On

11(ch.no.)# Set Transceiver to channel (RX & TX)

12# Set power level

13# Power Off

14# 10 khz Signalling Tone On

15# 10 khz Signalling Tone Off

16# Setup (Transmits a five word RECC message)

17# Voice (Transmits a two word REVC message)

18# C-SCAN

19# Display Software Version Number (year & week)

25# SAT On

26# SAT Off

27# Transmit Data (TX continuous control channel data)

32# Clear (clears non-volatile memory)

33# Turn DTMF on

34# Turn DTMF off

35# Display RSSI ("D" series portable only)

35# Set Audio path

38# Display ESN (displays ESN in four steps, hit * till back at start)

39# Compander On

41# Enables Diversity

42#,43#,44# Disable Diversity (different models use different codez)

45# Display Current RSSI

46# Display Cumulative Call Timer

47# Set Audio level

48# Side Tone On

49# Side Tone Off

55# Display and or program NAM (test mode programing)

58# Compander On

59# Compander Off

61# ESN Transfer (for series I and Mini T.A.C's)

62# Turn On Ringer

63# Turn Off Ringer

66# Identity Transfer (series II and some current portables)

68# Display FLEX and Model info

69# Used with Identity Transfer

Entering test mode on 25 pin transceivers is as follows:

for F19ATA or F19CTA ground pin 11 and power-up phone, for DMT/Mini T.A.C series I, II, III ground pin 21 and power-up phone.
Entering test mode on OEM 32 pin transceivers is as follows:

ground pin 9 and power-up phone.
Entering test mode on portable phones is as follows:

ground pin 6 and power-up phone.
Entering test mode on Micro T.A.C's phones is as follows:

ground pin 2 and power-up phone.

Oki Debug Commands - Good Timing From Nuts & Volts Dec. 1993

To Enter Debug Mode:

Press 7 & 9 Together then press MENU, SEND, END, RCL, STO and CLR then press 1 & 3 together

Commands:

01 Suspend Performs Initialization

02 Restart Terminates the test mode

03 Status Shows the current status of TRU

04 Reset Resets the timer

07 Carrier On Turns the carrier on

08 Carrier Off Turns off the carrier

09XXXX Load Synth Sets the synthesizer to channel XXXX

10X Set Attn Sets the RF power attenuation to X

11 RX Mute Mutes the receive audio

12 RX Unmute Unmute the receive audio

13 TX Mute Mutes the transmit audio

14 TX Unmute Unmutes the transmit audio

16 ST On Transmits a signalling tone

17 ST Off Turns off the signalling tone

18 Setup Transmits a 5 word RCC message

19 Voice Transmits a 2 word RVC message

20 Rcv SU Receives a 2 word FCC message

21 Rcv VC Receives a 1 word FVC message

22 Send NAM Returns the information contained in the NAM

23 Version Displays the TRU software version

24 Send SN Displays the ESN

25XXXX Mem Displays the resident memory data at XXXX

28 WSTS Receive 1 word messages on CC until #56/CLR

29 WSTV Receive 1 word messages on VC until #56/CLR

32X SAT On Enables the transmission of SAT X

33 SAT Off Disables the transmission of SAT

35 Hi TN On Activates the 1150 Hz tone to receive audio line

36 Hi TN Off Deactivates the 1150 Hz tone

37 Lo TN On Activates the 770 Hz tone to receive audio line

38 Lo TN Off Deactivates the 770 Hz tone

42XX DTMF On Enables the transmission of DTMF frequency XX

43 DTMF Off Disables the transmission of DTMF

Novatel 8325

1) Any copy, or edited version, of this file must contain this copyright notice, the author's name, and the information regarding Phrack. 2) No commercial use may be made of it without prior permission of the author. This permission may be revoked at any time, in which case all reproduction must cease, and any copies must be destroyed. 3) Use as evidence in a court of law, for the purposes of this agreement, is considered a commercial use. 4) This agreement can not be changed, or added to in any way. Receipt of this work through an authorized commercial distributor does not imply permission given to the commercial consumer to re-distribute it in a commercial manner. 5) Any part of this agreement found invalid by a court of law does not render the remainder of this agreement void: The rest of the terms of the agreement must still be adhered to.

The Novatel 8325 is a bag-style portable cellular telephone. It is known as a 'ProClassic' in Novatel MarketSpeak. Two different handsets (control units) are used with the 8325 transceiver: the 4130 and 5160. My phone has the 5160. The handsets appear very similar: I doubt there is any functional difference between them. Earlier transceivers, such as the 8320, contain many of the same features as the 8325, though the hidden menus are accessed with different codes. The only other code I know of is #746, which is the code for the 8320 CFG menu.

Terms: Throughout this article, I will refer to things without explaining them each time. If you get lost, refer to the table below.

NORMAL = the phone is in this mode when it is not locked, or in either of the hidden menus, or in the 'user' menus accessed by the MENU key. The screen will display either READY or SCANNING when in normal mode. This is the mode the phone is in when it is first turned on.

LOCKED = when the phone displays LOCKED, a code must be typed to enter normal mode. The default code is 1234. The telephone can be locked using [FCN] 1 [SND] from normal mode. The phone must be locked before entering in any of the codes to access the hidden menus described below.

TBL = troubleshooting mode = the hidden menu accessed with 546*. This is a menu supposedly know only to Novatel, not even their dealers are supposed to know about it. According to Novatel, some of the features in this menu could destroy the phone if improperly set. Scare tactics? You decide.

CFG = configuration mode = the hidden menu accessed with 510*. This is used by dealers to set up a subscriber's service. As far as I know, there is nothing particularly dangerous about this mode, but Novatel is touchy about it nonetheless. I take no responsibility for any damages.

Troubleshooting Mode - TBL

First, lock phone with [FCN] 1 [SND] Then, enter 546* on the keypad. The phone will not make tones for each key pressed.

TBL 8325 /_ This is what shows up on my phone. REV NA0C \ Yours may be different.

You are now in troubleshooting mode. You may page through the functions by using the arrow keys, or access the functions by number, by hitting # (The screen will display DIR PAGE ACCESS) and then the function number, from the chart below. Note that on initially entering Troubleshooting mode, you are on function 37. Toggle with the [SND] key, unless otherwise noted.

Screen Default Toggle/Range Description

11 TRANSMIT OFF ON Turn the transmitter on. 12 TX TEST OFF [CLR]=OFF, 0-7 test data stream, audio levels of 13 CHANNEL 0000 0000-1023 [H/F] = down, [RCL] = up. 14 TX AUDIO OFF ON 15 VOLUME GAIN 6 0-7 16 RX AUDIO OFF ON Turn the receiver on. Set this to ON and use in conjunction with #13 (CHANNEL) to listen to calls. 17 POWER ATTN 3 0-7 18 SYNTH LOCKED synthesizer locked. if reads unlocked, the phone has real problems. 19 SAT OFF ?? transmitted SAT 20 RF POWER OFF ON Not an option, but an indicator. When TRANSMIT is set ON, this displays ON. 21 SPEAKER ON OFF 22 SIDE TONE ON OFF 23 TX DTMF OFF Tone test. [CLR] then 00-25. DTMF means touch-tone 00 = DTMF 1 01 = DTMF 2 02 = DTMF 3 03 = DTMF A? 04 = DTMF 4 05 = DTMF 5 06 = DTMF 6 07 = DTMF B? 08 = DTMF 7 09 = DTMF 8 10 = DTMF 9 11 = DTMF C? 12 = DTMF * 13 = DTMF 0 14 = DTMF # 15 = DTMF D? 16 = 1+2+3 17 = 4+5+6 18 = 7+8+9 19 = *+0+# 20 = 1+4+7+# 21 = 2+5+8+0 22 = 3+6+9+# 23 = A+B+C+D? 24 = ? 25 = Wake-up-tone. The + signs are use to signify keys simultaneously held on a regular (desk-style) touch-tone phone. These tones are each half of the dual tones the comprise touch tones. 24 RX MODE BURST CONT 25 RX TEST OFF ON 26 FRME CNT 000000 Frame count. (of counter)

27 BIT ERR 0000000 Bit Error. every so often is no big deal. Hit any key to clear. 28 WATCHDOG ON OFF watch-dog periodically checks the timing of the different clocks in the system. Hit any key to turn this off and the Phone re-starts 29 HOOK SW OFF Hook Switch - since a bag phone has no switch hook, always off. 30 HORN MODE ON OFF Toggles indicator light 31 BELL MODE 0 0-9, [SND] 32 RSST 20x Received Signal Strength Indicator 33 MICROPHN ENABLED DISABLED 34 NVM TEST RM=0 E=1 Non-Volatile Memory Test 35 COMPANDR ON OFF A Compander compresses speech to confine energy to the given bandwidth. 36 NVM CLR USE SND Non-Volatile Memory [SND]="ACCESS DENIED" 37 TBL 8325 REV NA0C MENU,MODEL,REVISION (INITAL SCREEN) ------Modulation------- Don't mess with this stuff - it can screw up your phone N0 means channel bank 0. Banks are 0-4. Tune to a mid-band channel using the keypad, and tune with [H/F] down and [RCL] for up. 38 MODG CLR Any Key, 0 = YES resets options #39,#40,#41 to default. 39 CHN 0991 N0 AMG16 AMG = SAD Deviation. 40 CHN 0991 N0 DMG16 DMG = Signalling tone. 41 CHN 0991 N0 SMG12 SMG = Transmit audio level. ------Digital Potentiometers-- DANGER! Play with this, and you may have to send your phone out for repair. 42 DPOT CLR Any Key, 0 = YES resets options #43,#44,#45,#46 to default 43 MICROPHN 14190 OHM 44 EXPANDER 14936 OHM 45 TX LIMIT 12180 OHM 46 SPEAKER 15420 OHM ------Analog Switches-------- Enables/Disables on-board potentiometers. 47 ANALOG SW1 ON High end of transmit audio 48 ANALOG SW2 OFF Low end of transmit audio

49 PWR LVL3 DAC0777 power level, reading from digital-analog converter 50 PL3@0000 14 power level @ channel, received signal strength