                              ==Phrack Magazine==

                 Volume Five, Issue Forty-Five, File 26 of 28

******************************************************************************

                          Cellular Debug Mode Commands


**************************************

 Motorola test mode programing codes
        for most motorola phones

**************************************

01# Restart (re-enter DC power start-up
    routine)

02# Display Current Telephone Status

04# Initializes Telephone to Std.
    Default Conditions

05# TX Carrier On (key transmitter)

06# TX Carrier Off

07# RX Off (mute receiver audio)

08# RX Audio On (unmute receiver audio)

09# TX Audio Off

10# TX Audio On

11(ch.no.)# Set Transceiver to channel
    (RX & TX)

12# Set power level

13# Power Off

14# 10 khz Signalling Tone On

15# 10 khz Signalling Tone Off

16# Setup (Transmits a five word RECC
    message)

17# Voice (Transmits a two word REVC
    message)

18# C-SCAN

19# Display Software Version Number
    (year & week)

25# SAT On

26# SAT Off

27# Transmit Data (TX continuous
    control channel data)

32# Clear (clears non-volatile memory)

33# Turn DTMF on

34# Turn DTMF off

35# Display RSSI ("D" series portable
    only)

35# Set Audio path

38# Display ESN (displays ESN in four
    steps, hit * till back at start)

39# Compander On

41# Enables Diversity

42#,43#,44# Disable Diversity
     (different models use different
      codez)

45# Display Current RSSI

46# Display Cumulative Call Timer

47# Set Audio level

48# Side Tone On

49# Side Tone Off

55# Display and or program NAM (test
    mode programing)

58# Compander On

59# Compander Off

61# ESN Transfer (for series I and Mini
    T.A.C's)

62# Turn On Ringer

63# Turn Off Ringer

66# Identity Transfer (series II and
    some current portables)

68# Display FLEX and Model info

69# Used with Identity Transfer

***************************************
***************************************

1. Entering test mode on 25 pin
   transceivers is as follows:

   for F19ATA or F19CTA ground pin 11
       and power-up phone,
   for DMT/Mini T.A.C series I, II,
       III ground pin 21 and power-up
       phone.

2. Entering test mode on OEM 32 pin
   transceivers is as follows:

     ground pin 9 and power-up phone.

3. Entering test mode on portable
   phones is as follows:

     ground pin 6 and power-up phone.

4. Entering test mode on Micro T.A.C's
   phones is as follows:

     ground pin 2 and power-up phone.

------------------------------------------------------------------------------

Oki Debug Commands - Good Timing
From Nuts & Volts Dec. 1993

To Enter Debug Mode:

Press 7 & 9 Together
then press MENU, SEND, END, RCL, STO and CLR
then press 1 & 3 together

Commands:

#01     Suspend         Performs Initialization
#02     Restart         Terminates the test mode
#03     Status          Shows the current status of TRU
#04     Reset           Resets the timer
#07     Carrier On      Turns the carrier on
#08     Carrier Off     Turns off the carrier
#09XXXX Load Synth      Sets the synthesizer to channel XXXX
#10X    Set Attn        Sets the RF power attenuation to X
#11     RX Mute         Mutes the receive audio
#12     RX Unmute       Unmute the receive audio
#13     TX Mute         Mutes the transmit audio
#14     TX Unmute       Unmutes the transmit audio
#16     ST On           Transmits a signalling tone
#17     ST Off          Turns off the signalling tone
#18     Setup           Transmits a 5 word RCC message
#19     Voice           Transmits a 2 word RVC message
#20     Rcv SU          Receives a 2 word FCC message
#21     Rcv VC          Receives a 1 word FVC message
#22     Send NAM        Returns the information contained in the NAM
#23     Version         Displays the TRU software version
#24     Send SN         Displays the ESN
#25XXXX Mem             Displays the resident memory data at XXXX
#28     WSTS            Receive 1 word messages on CC until #56/CLR
#29     WSTV            Receive 1 word messages on VC until #56/CLR
#32X    SAT On          Enables the transmission of SAT X
#33     SAT Off         Disables the transmission of SAT
#35     Hi TN On        Activates the 1150 Hz tone to receive audio line
#36     Hi TN Off       Deactivates the 1150 Hz tone
#37     Lo TN On        Activates the 770 Hz tone to receive audio line
#38     Lo TN Off       Deactivates the 770 Hz tone
#42XX   DTMF On         Enables the transmission of DTMF frequency XX
#43     DTMF Off        Disables the transmission of DTMF

------------------------------------------------------------------------------

Novatel 8325
------------

This article is copyright 1993 by the author. Reproduction is allowed, with the
following restrictions:

1) Any copy, or edited version, of this file must contain this copyright
   notice, the author's name, and the information regarding Phrack.
2) No commercial use may be made of it without prior permission of the author.
   This permission may be revoked at any time, in which case all reproduction
   must cease, and any copies must be destroyed.
3) Use as evidence in a court of law, for the purposes of this agreement,
   is considered a commercial use.
4) This agreement can not be changed, or added to in any way. Receipt of this
   work through an authorized commercial distributor does not imply permission
   given to the commercial consumer to re-distribute it in a commercial manner.
5) Any part of this agreement found invalid by a court of law does not render
   the remainder of this agreement void: The rest of the terms of the agreement
   must still be adhered to.


The Novatel 8325 is a bag-style portable cellular telephone. It is known as a
'ProClassic' in Novatel MarketSpeak. Two different handsets (control units) are
used with the 8325 transceiver: the 4130 and 5160. My phone has the 5160.
The handsets appear very similar: I doubt there is any functional difference
between them. Earlier transceivers, such as the 8320, contain many of the same
features as the 8325, though the hidden menus are accessed with different
codes. The only other code I know of is #746, which is the code for the 8320
CFG menu.

Terms: Throughout this article, I will refer to things without explaining them
each time. If you get lost, refer to the table below.

NORMAL = the phone is in this mode when it is not locked, or in either of the
hidden menus, or in the 'user' menus accessed by the MENU key. The screen will
display either READY or SCANNING when in normal mode. This is the mode the phone
is in when it is first turned on.

LOCKED = when the phone displays LOCKED, a code must be typed to enter normal
mode. The default code is 1234. The telephone can be locked using [FCN] 1 [SND]
from normal mode. The phone must be locked before entering in any of the codes
to access the hidden menus described below.

TBL = troubleshooting mode = the hidden menu accessed with 546*. This is a
menu supposedly know only to Novatel, not even their dealers are supposed to
know about it. According to Novatel, some of the features in this menu could
destroy the phone if improperly set. Scare tactics? You decide.

CFG = configuration mode = the hidden menu accessed with 510*. This is used by
dealers to set up a subscriber's service. As far as I know, there is nothing
particularly dangerous about this mode, but Novatel is touchy about it
nonetheless. I take no responsibility for any damages.


Troubleshooting Mode - TBL

First, lock phone with [FCN] 1 [SND]
Then, enter 546* on the keypad. The phone
will not make tones for each key pressed.

TBL 8325    /___ This is what shows up on my phone.
REV NA0C    \    Yours may be different.

You are now in troubleshooting mode. You may page through the functions
by using the arrow keys, or access the functions by number, by hitting #
(The screen will display DIR PAGE ACCESS) and then the function number,
from the chart below. Note that on initially entering Troubleshooting mode,
you are on function 37. Toggle with the [SND] key, unless otherwise noted.

#    Screen       Default   Toggle/Range       Description
-----------------------------------------------------------------------------
11   TRANSMIT     OFF       ON   Turn the transmitter on.
12   TX TEST      OFF       [CLR]=OFF, 0-7 test data stream, audio levels of
13   CHANNEL      0000      0000-1023    [H/F] = down, [RCL] = up.
14   TX AUDIO     OFF       ON
15   VOLUME GAIN  6         0-7
16   RX AUDIO     OFF       ON   Turn the receiver on. Set this to ON
                                 and use in conjunction with #13
                                 (CHANNEL) to listen to calls.
17   POWER ATTN   3         0-7
18   SYNTH LOCKED                       synthesizer locked. if reads
                                        unlocked,  the phone has real problems.
19   SAT OFF      ??                    transmitted SAT
20   RF POWER     OFF       ON          Not an option, but an indicator. When
                                        TRANSMIT is set ON, this displays ON.
21   SPEAKER      ON        OFF
22   SIDE TONE    ON        OFF
23   TX DTMF      OFF        Tone test. [CLR] then 00-25. DTMF means touch-tone
                 00 = DTMF 1     01 = DTMF 2      02 = DTMF 3     03 = DTMF A?
                 04 = DTMF 4     05 = DTMF 5      06 = DTMF 6     07 = DTMF B?
                 08 = DTMF 7     09 = DTMF 8      10 = DTMF 9     11 = DTMF C?
                 12 = DTMF *     13 = DTMF 0      14 = DTMF #     15 = DTMF D?
                 16 = 1+2+3      17 = 4+5+6       18 = 7+8+9      19 = *+0+#
                 20 = 1+4+7+#    21 = 2+5+8+0     22 = 3+6+9+#    23 = A+B+C+D?
                 24 = ?          25 = Wake-up-tone. The + signs are use to
                 signify keys simultaneously held on a regular (desk-style)
                 touch-tone phone. These tones are each half of the dual tones
                 the comprise touch tones.
24   RX MODE      BURST     CONT
25   RX TEST      OFF       ON
26   FRME CNT     000000   Frame count.  (of counter)

27   BIT ERR      0000000   Bit Error.   every so often is no big
                                         deal. Hit any key to clear.
28   WATCHDOG     ON        OFF          watch-dog periodically checks the
                                         timing of the different clocks
                                         in the system.  Hit any key to turn
                                         this off and the Phone re-starts
29   HOOK SW      OFF                    Hook Switch - since a bag phone has
                                         no switch hook, always off.
30   HORN MODE    ON        OFF          Toggles indicator light
31   BELL MODE    0         0-9, [SND]
32   RSST         20x                    Received Signal Strength Indicator
33   MICROPHN     ENABLED   DISABLED
34   NVM TEST     RM=0 E=1               Non-Volatile Memory Test
35   COMPANDR     ON        OFF          A Compander compresses speech to
                                         confine energy to the given bandwidth.
36   NVM CLR      USE SND                Non-Volatile Memory [SND]="ACCESS
                                         DENIED"
37   TBL 8325     REV NA0C               MENU,MODEL,REVISION (INITAL SCREEN)
------Modulation------- Don't mess with this stuff - it can screw up your phone
 N0 means channel bank 0. Banks are 0-4. Tune to a mid-band channel using the
 keypad, and tune with [H/F] down and [RCL] for up.
38   MODG CLR     Any Key, 0 = YES        resets options #39,#40,#41 to default.
39   CHN 0991     N0 AMG16  AMG = SAD Deviation.
40   CHN 0991     N0 DMG16  DMG = Signalling tone.
41   CHN 0991     N0 SMG12  SMG = Transmit audio level.
------Digital Potentiometers-- DANGER! Play with this, and you may have to
                               send your phone out for repair.
42   DPOT CLR     Any Key, 0 = YES   resets options #43,#44,#45,#46 to default
43   MICROPHN     14190 OHM
44   EXPANDER     14936 OHM
45   TX LIMIT     12180 OHM
46   SPEAKER      15420 OHM
------Analog Switches-------- Enables/Disables on-board potentiometers.
47   ANALOG SW1   ON         High end of transmit audio
48   ANALOG SW2   OFF        Low end of transmit audio
-----
49   PWR LVL3     DAC0777     power level, reading from digital-analog converter
50   PL3@0000     14          power level @ channel, received signal strength