Các mã bí mật (secret code) của cell phone ....

Các mã bí mật (secret code) của cell phone ....

Các nhà sản xuất cell phone, họ thường dùng các sequence của chữ số vô nghĩa để làm những mệnh lệnh bí mật của họ dùng để debug hay để program cái phone của họ . Họ hy vọng, người tiêu thụ, không biết đến các mệnh lệnh bí mật này .

Sau đây, Thuyền xin post một số các mệnh lệnh bí mật mà thiên hạ đã mầy mò ra khi xử dụng cell phone nha .

Cảnh Cáo : Nếu bạn fool around với mấy cái mệnh lệnh bí mật này, bạn có thể phá hư cell phone của bạn đó nha ! Thuyền không chịu trách nhiệm á !

-------------------

Ericsson 198

Erase Timers by typing 904060 <FUNCTION> <FUNCTION> SEND
Programming mode by typing 923885 <FUNCTION> <FUNCTION>.

-----------------------------------------------------------------------------------------------------------------------

Ericsson 218


To view Software Version enter -> * <- <- * <- * CLR (Use with Care)

To activate operator lock <- * * <- (This locks the phone to one carriers SIM card - Use with lots of care)
Press Yes to lock and No to notlock. You can also use the codes below to undo this function. USE AT OWN RISK

I have tested the function Lock to SP... At least on the 337 there''''s a submenu: Enter SPCK-code. There are 5 attempts, which is showed (05 attempts). At final attempt the phone beeps as a warning, ''''this is the final try'''', when entering the menu... Wrong code exits the menu, so you are not stuck in something... When you have tried to enter the code (wrong) all five times, the menu is deactivated, and you''''ll get: ''''Not allowed'''' when entering <-**<-

A "secret test mode" can be accessed on the GH337. There seems to be two methods:

> * < < * > * displays software version, such as 940810 1310

> * < < * < * displays software version, such as 951024 1054

After entering this mode, the < and > keys scroll through a menu. There seems to be different menus for different versions of software.

Software version number are apparently a date and time stamp.

940810 1310 version commands:

TEXT CHECK - shows 254 messages in current language

INIT EEPROM MMI - resents NVRAM settings (User Settings).

Other, probably more recent version:

FLASH - will restart the phone, to the point of entering PIN numbers.You can''''t kill a 337 when pressing YES while it says "FLASH?", you must connect it to 5/12 volts first to be able to erase the flash-memory.

1-ROW TEXTS - scroll through 174 single line text messages with < and >

n-ROW-TEXTS - scroll through full-screen messages with < and >

950626 1405 version commands:

CXC (number) - The Application software''''s "product number". The GH337/GF337 is always "CXC 125 005"

PRG - Indication for Programming


Programming

Set ComPort to 9600bps, 8 data, 1 stop, no parity.

Power on phone by pressing "NO/ENDpwr".
When performing its powerup sequence the phone will send two ">>"
(ASCII 62 decimal) characters. Within 1 second, reply to it by
sending the 4 character sequence "TP1<CR>".

(I used Procomm Plus with this script "eric.asp")
[proc main ]
[start: ]
[ ]
[ waitfor ">>" ]
[ pause 1 ]
[ transmit "TP1^M" ]
If everything went fine you should get the "OK" prompt back.

Test the TEST PROGRAM by sending the commands terminated by a <CR>:

PROG 0 (shows Test Program product number info)
PROG 1 (shows Test Program product date info)
PROG 3 (Shows Main Application product number info)
PROG D (Shows Main Application product date info)

Clearing Electronic Lock

To clear the electronic lock you have to clear the EEPROM address range 045B to 0466 by sending the commands:

EEWR 045B 00
EEWR 045C 00
EEWR 045D 00
EEWR 045E 00
EEWR 045F 00
EEWR 0460 00
EEWR 0461 00
EEWR 0462 00
EEWR 0463 00
EEWR 0464 00
EEWR 0465 00
EEWR 0466 00

Disabling the Service Provider Lock

To disable send the following command:

EEWR 1587 00

To enable send the following command:

EEWR 1587 01

Experimental Commands - Use at own Risk

To dump the application software send the following:

PREA <bank> <address> <bytestoread>

Bank range : 00..7F
Address : 0000..BFFF
Bytestoread : 0000..BFFF
The "ad***ional" value returned at the end are the checksum value for the
returned program memory bytes. Note, the byte-values are always returned in
format 0000 and NOT 00.

PREA FF

Returns the application checksum, takes a few seconds.

Cool Stuff to Do

Set ComPort to 115200bps, 8 data, 1 stop, no parity and watch all the phone commands on the screen and so on. Make a call and see what happens as well as shutting down.

Pinouts

1 In Voice
2 In +5V=External Power, 0V=Battery
3 Out Ext Speak control
4 Analog GND
5 Out Voice
6 Out +5V=POWER ON, 0V=POWER OFF
7 Out Charger control
8 Digital/DC GND
9 In 0V=normal,+5V=test, +12V=test+flash
10 In Hook
11 In TTL serial in
12 Out TTL serial out
13 In 0V for aprox 1 sec = POWER ON/OFF
14 In DC Power supply



Được thuyenxaxu sửa chữa / chuyển vào 05:22 ngày 29/06/2005

Ericsson 318

To view Software Version enter -> * <- <- * <- * CLR (Use with Care)
The Latest Software Version is under Phone Info.
To fine tune sound and clean up any echos, place the 388 into the car kit HF 2600.
Then close all windows, engine off and type * # * # 3. The E 388 will fine-tune itself in about a few seconds.
To activate operator lock <- * * <- (This locks the phone to one carriers SIM card - Use with lots of care)
Press Yes to lock and No to notlock. You can also use the codes below to undo this function. USE AT OWN RISK
I have tested the function Lock to SP... At least on the 337 there''s a submenu: Enter SPCK-code. There are 5 attempts, which is showed (05 attempts). At final attempt the phone beeps as a warning, ''this is the final try'', when entering the menu... Wrong code exits the menu, so you are not stuck in something... When you have tried to enter the code (wrong) all five times, the menu is deactivated, and you''ll get: ''Not allowed'' when entering <-**<-

To Flash Program a 318
1. Connect the 318 to Cable with RS232/TTL converter.
2. Set Comport to 9600bps, 8 data, 1 stop, no parity.
3. Power ON, wait for "2" and send "OB" to the phone. DO NOT Press ENTER.
4. R should be on screen.
5. send pre_xxx.bin to the MS.
6. You should recieve a ">".
7. send "0B" again.
8. R should be on screen
9. send prodload.bin to the MS.
10. recieve ">".
Done, I don''t have the above files so please don''t ask for them.
Interesting Informating
The names on the files, sj.....X45 tells you a couple of things. "sj" stands for Sofia-Jane, thats the internal name for the model and x45 stands for "sub-model". The 388 is called model 4/5. The latest 337 phones is called "cr", like in Cost Reduction. They rebuilt the oscillator from a bought-in to one built up with discrete components and that was cheaper.
Clearing Electronic Lock
To clear the electronic lock you have to clear the EEPROM address range 03CF to 03DA by sending the commands:
EEWR 3CF 00
EEWR 3D0 00
EEWR 3D1 00
EEWR 3D2 00
EEWR 3D3 00
EEWR 3D4 00
EEWR 3D5 00
EEWR 3D6 00
EEWR 3D7 00
EEWR 3D8 00
EEWR 3D9 00
EEWR 3DA 00
Cool Stuff to do
Set ComPort to 115200bps, 8 data, 1 stop, no parity and watch all the phone commands on the screen and so on. Make a call and see what happens as well as shutting down.
Power Off
You should press the NO button a few times until Shut Down comes up on the screen, when it does press yes and this will shut down the phone properly.
Pinouts
1 In Voice
2 In +5V=External Power, 0V=Battery
3 Out Ext Speak control
4 Analog GND
5 Out Voice
6 Out +5V=POWER ON, 0V=POWER OFF
7 Out Charger control
8 Digital/DC GND
9 In 0V=normal,+5V=test, +12V=test+flash
10 In Hook
11 In TTL serial in
12 Out TTL serial out
13 In 0V for aprox 1 sec = POWER ON/OFF
14 In DC Power supply

Ericsson 337


To view Software Version enter -> * <- <- * <- * CLR (Use with Care)
To activate operator lock <- * * <- (This locks the phone to one carriers SIM card - Use with lots of care)
Press Yes to lock and No to notlock. You can also use the codes below to undo this function. USE AT OWN RISK
I have tested the function Lock to SP... At least on the 337 there''s a submenu: Enter SPCK-code. There are 5 attempts, which is showed (05 attempts). At final attempt the phone beeps as a warning, ''this is the final try'', when entering the menu... Wrong code exits the menu, so you are not stuck in something... When you have tried to enter the code (wrong) all five times, the menu is deactivated, and you''ll get: ''Not allowed'' when entering <-**<-
A "secret test mode" can be accessed on the GH337. There seems to be two methods:
> * < < * > * displays software version, such as 940810 1310
> * < < * < * displays software version, such as 951024 1054
After entering this mode, the < and > keys scroll through a menu. There seems to be different menus for different versions of software.
Software version number are apparently a date and time stamp.
940810 1310 version commands:
TEXT CHECK - shows 254 messages in current language
INIT EEPROM MMI - resents NVRAM settings (User Settings).
Other, probably more recent version:
FLASH - will restart the phone, to the point of entering PIN numbers.You can''t kill a 337 when pressing YES while it says "FLASH?", you must connect it to 5/12 volts first to be able to erase the flash-memory.
1-ROW TEXTS - scroll through 174 single line text messages with < and >
n-ROW-TEXTS - scroll through full-screen messages with < and >
950626 1405 version commands:
CXC (number) - The Application software''s "product number". The GH337/GF337 is always "CXC 125 005"
PRG - Indication for Programming

Programming 337
Set ComPort to 9600bps, 8 data, 1 stop, no parity.
Power on phone by pressing "NO/ENDpwr".
When performing its powerup sequence the phone will send two ">>"
(ASCII 62 decimal) characters. Within 1 second, reply to it by
sending the 4 character sequence "TP1<CR>".
(I used Procomm Plus with this script "eric.asp")
[proc main ]
[start: ]
[ ]
[ waitfor ">>" ]
[ pause 1 ]
[ transmit "TP1^M" ]
If everything went fine you should get the "OK" prompt back.
Test the TEST PROGRAM by sending the commands terminated by a <CR>:
PROG 0 (shows Test Program product number info)
PROG 1 (shows Test Program product date info)
PROG 3 (Shows Main Application product number info)
PROG D (Shows Main Application product date info)
Programming Calculator and Channel Indicator/RBS
To enable, send the following:
EEWR 047A 01
Wait for the OK prompt, power off* the phone and disconnect it from the interface cables. Powerup and browse through the menus.
To diasable, send the following:
EEWR 047A 00
Clearing Electronic Lock
To clear the electronic lock you have to clear the EEPROM address range 045B to 0466 by sending the commands:
EEWR 045B 00
EEWR 045C 00
EEWR 045D 00
EEWR 045E 00
EEWR 045F 00
EEWR 0460 00
EEWR 0461 00
EEWR 0462 00
EEWR 0463 00
EEWR 0464 00
EEWR 0465 00
EEWR 0466 00
Disabling the Service Provider Lock
To disable send the following command:
EEWR 1587 00
To enable send the following command:
EEWR 1587 01
Experimental Commands - Use at own Risk
To dump the application software send the following:
PREA <bank> <address> <bytestoread>
Bank range : 00..7F
Address : 0000..BFFF
Bytestoread : 0000..BFFF
The "ad***ional" value returned at the end are the checksum value for the
returned program memory bytes. Note, the byte-values are always returned in
format 0000 and NOT 00.
PREA FF
Returns the application checksum, takes a few seconds.
Notes on the PH337
1. Calculator mode is NOT available on all PH sw versions.
2. Invoking Calc/RBS mode not available for GH337 sw versions below R2A
3. SPCK attempts can be changed to 50 instead of the std 5 tries
4. The instruction LIME returns ERR but does not screw up phone
5. The instruction IMEI returns the IMEI no.
6. Pressing YES in response to FLASH? does screw up the unit.
Cool Stuff to Do
Set ComPort to 115200bps, 8 data, 1 stop, no parity and watch all the phone commands on the screen and so on. Make a call and see what happens as well as shutting down.
Pinouts
1 In Voice
2 In +5V=External Power, 0V=Battery
3 Out Ext Speak control
4 Analog GND
5 Out Voice
6 Out +5V=POWER ON, 0V=POWER OFF
7 Out Charger control
8 Digital/DC GND
9 In 0V=normal,+5V=test, +12V=test+flash
10 In Hook
11 In TTL serial in
12 Out TTL serial out
13 In 0V for aprox 1 sec = POWER ON/OFF
14 In DC Power supply

Ericsson 388
To view Software Version enter -> * <- <- * <- * CLR (Use with Care)
The Latest Software Version is under Phone Info.
To fine tune sound and clean up any echos, place the 388 into the car kit HF 2600.
Then close all windows, engine off and type * # * # 3. The E 388 will fine-tune itself in about a few seconds.
To activate operator lock <- * * <- (This locks the phone to one carriers SIM card - Use with lots of care)
Press Yes to lock and No to notlock. You can also use the codes below to undo this function. USE AT OWN RISK
I have tested the function Lock to SP... At least on the 337 there''s a submenu: Enter SPCK-code. There are 5 attempts, which is showed (05 attempts). At final attempt the phone beeps as a warning, ''this is the final try'', when entering the menu... Wrong code exits the menu, so you are not stuck in something... When you have tried to enter the code (wrong) all five times, the menu is deactivated, and you''ll get: ''Not allowed'' when entering <-**<-

Accessing the Service Program that is not provided with the 388
1. Connect the 388 to Cable with RS232/TTL converter.
2. Set Comport to 9600bps, 8 data, 1 stop, no parity.
3. Power ON, wait for "2" and send "0B" to the phone. DO NOT Press ENTER.
4. R should be on screen.
5. Send Command (Send as a binary file)
6. 388 should answer "SP,OK".
7. R should be on screen.
DO NOT write or read from the IMEI or SPCK area! If you try that you can send the phone to service at once, because you will automatically write FE or EF to EVERY cell in the EEPROM. In other words, all the calibration values for the radio is overwritten... (NOT good)
Some commands in the ServiceProg:
eere <startADR> <NoBytes> read from eeprom
eewe <adr> <value> write eeprom
lime xxxx xxxx xxxx xxx Learn imei no. Returns Error.
imei - Displays IMEI number
To Flash Program a 388
1. Connect the 388 to Cable with RS232/TTL converter.
2. Set Comport to 9600bps, 8 data, 1 stop, no parity.
3. Power ON, wait for "2" and send "OB" to the phone. DO NOT Press ENTER.
4. R should be on screen.
5. send pre_xxx.bin to the MS.
6. You should recieve a ">".
7. send "0B" again.
8. R should be on screen
9. send prodload.bin to the MS.
10. recieve ">".
Done, I don''t have the above files so please don''t ask for them.
Interesting Informating
The names on the files, sj.....X45 tells you a couple of things. "sj" stands for Sofia-Jane, thats the internal name for the model and x45 stands for "sub-model". The 388 is called model 4/5. The latest 337 phones is called "cr", like in Cost Reduction. They rebuilt the oscillator from a bought-in to one built up with discrete components and that was cheaper.
Programming Channel Indicator or RBS
To enable, send the following command:
EEWR 3EE 1
Wait for the OK prompt, power off* the phone and disconnect it from the interface cables. Powerup and browse through the menus.
To diasable, send the following command:
EEWR 3EE 0
Clearing Electronic Lock
To clear the electronic lock you have to clear the EEPROM address range 03CF to 03DA by sending the commands:
EEWR 3CF 00
EEWR 3D0 00
EEWR 3D1 00
EEWR 3D2 00
EEWR 3D3 00
EEWR 3D4 00
EEWR 3D5 00
EEWR 3D6 00
EEWR 3D7 00
EEWR 3D8 00
EEWR 3D9 00
EEWR 3DA 00
Cool Stuff to do
Set ComPort to 115200bps, 8 data, 1 stop, no parity and watch all the phone commands on the screen and so on. Make a call and see what happens as well as shutting down.
Power Off
You should press the NO button a few times until Shut Down comes up on the screen, when it does press yes and this will shut down the phone properly.

Reading the Channel Info now that''s it''s enabled
|-------|-------|-------| D
| | | | I
| 1 | 2 | 3 | S
|-------|-------|-------| P
| | | | L
| 4 | 5 | 6 | A
|-------|-------|-------| Y
1. This is three different channels things depending on the phone state.
a. When the phone is idle, this shows "Bxxx". "B" stands for "Broadcast channel" (a logic GSM channel)
b. When a phonecall is in progress, this shows "Sxxx". S stands for "Stand Alone Dedicated Control Channel" SDCCH for short.
c. When the phoncall in up, this shows "Txxx". "T" Stands for Traffic channel. The "xxx" thing is the channel number, 1-124.
2. This shows Rx Level. The values displayed is from 0 to 63. Rx Level is a indicator on how good your reception is for the moment. 0 is a signal strength of -110dBm. 63 is approx -45 to -50dBm.RXLEV is measured in dBm in such a way that incoming signal equals -110.5+RXLEV so that a RXLEV at 50 equals an incoming signal strenght at -50.5 dBm (plus or minus max deviation 0.5dBm)
3. This shows the output power in dBm.
4. This shows the timeslot used for the moment. You can see it when making a call.
5. This shows Rx Quality. Rx Quality is a measurement of how much error correction is required to the speech. 0 indicates none and as the figure rises you hear more pings and pongs on the speech as large parts of the frame are missing. If you have more RxQ then 5, you are on good way to loose your call. RxQuality reads 0-7.RXQUAL is measured by using a table wereas the biterrorrate or BER is interesting and measured in %
RXQUAL table
0 BER < 0,2
1 0,2 < BER < 0,4
2 0,4 < BER < 0,8
3 0,8 < BER < 1,6
4 1,6 < BER < 3,2
5 3,2 < BER < 6,4
6 6,4 < BER < 12,8 (here we have lost half a burst)
7 12,8 < BER
6. This shows the timing advance. The BS tells the MS to send before it should just make sure that the MS burst is comming to the BS on the right time. The TA is measured in halfbits so the distance to the BTS can be calculated as follows=1,11*TA/2. TimingAdvance reads 0-63. Co-incidentely this tells you how far you are from the base site in 550metre chunks, up to the theoretical max of 35.2km.
Pinouts
1 In Voice
2 In +5V=External Power, 0V=Battery
3 Out Ext Speak control
4 Analog GND
5 Out Voice
6 Out +5V=POWER ON, 0V=POWER OFF
7 Out Charger control
8 Digital/DC GND
9 In 0V=normal,+5V=test, +12V=test+flash
10 In Hook
11 In TTL serial in
12 Out TTL serial out
13 In 0V for aprox 1 sec = POWER ON/OFF
14 In DC Power supply

Ericsson 628


To view Software Version enter -> * <- <- * <- *
To read all programmed texts enter -> * <- <- * <- * ->
To view phone network lock status enter < * * < (wait 3 sec)
To fast dial press phone number pos nr and # (Example: 1 5 #)
To fast dial last number press 0 #
To reset main menu language to english enter * # 0 0 0 0 #
To see battery level while phone is turned off quickly press and release on/off(NO button).
To see Extended menus (on older versions) go to MISSED CALLS, empty directory, press and HOLD right arrow button, choose menu type
To see Extended menus (on newer versions) go to READ, empty directory, press and HOLD left arrow button, choose menu type
To e*** phone book Turn on extended menus and choose "E***Ph.Bk".
Command set
The following commands are recongnized by the phone.Use 9600 baud, 1 stopbit, 8 data bits, no parity.
ATA Pick up phone during ring
AT+GMI Manufacturer identification
AT+GMO Request model Identification
AT+GMR Request revision Identification
AT+GMM
ATDxxx; Dial number xxx
ATH Hangup phone
AT+CFUN=? Define levels of fuctionality in the order of power consumed
AT+CFUN=0 Switches off the phone
AT+CBC Query battery level
Each command has to be followed by a 0x0A, 0x0D sequence, that is carriage return - line feed. These commands will be ackowledged with an ''OK'' prompt. An
incoming call is signalled by the string ''RING'' sent by the phone at 9600b in normal mode.
Portable Handsfree Unit
1 Earphone: 16 Ohm
2 Microphone: <- 2 kOhm
5 Connected to 04 (GND)
Pinouts
Left to right, keyboard up.
1 Audio Out
2 Audio In
3 Accessory Sense. GND to enable External Mic and Speaker (Analog)
4 Audio Signal GND.
5 Portable handsfree In.
6 Music Mute Out, High when phone is used.
7 In Flash Memory Voltage and Service Voltage, In 0V=normal,+5V=test, +12V=test+flash
8 Logic Out, Status On. Sources over 100mA
9 Data Out from Mobile Station. Debug messages appear here at 112KBaud when in debug mode.
10 Digital Ground and DC return
11 Data in
12 DC in for battery charging, DC out for accessory power
------------------------------------------------------------------------------
Ericsson 768

Software Version enter * -> * <- <- * <- *
Service Provider Lock is * <- <- * but it is now called the ME lock.
There are two options after selecting yes on another menu. These are lock to Network or lock to NetSubet.
Command set
The following commands are recongnized by the phone.
Use 9600 baud, 1 stopbit, 8 data bits, no parity.
ATA Pick up phone during ring
AT+GMI Manufacturer identification
AT+GMO Request model Identification
AT+GMR Request revision Identification
AT+GMM
ATDxxx; Dial number xxx
ATH Hangup phone
AT+CFUN=? Define levels of fuctionality in the order of power consumed
AT+CFUN=0 Switches off the phone
AT+CBC Query battery level
Each command has to be followed by a 0x0A, 0x0D sequence, that is carriage return - line feed. These commands will be ackowledged with an ''OK'' prompt. An incoming call is signalled by the string ''RING'' sent by the phone at 9600b in normal mode.
Portable Handsfree Unit
1 Earphone: 16 Ohm
2 Microphone: <- 2 kOhm
5 Connected to 04 (GND)
Pinouts
Left to right, keyboard up.
1 Audio Out
2 Audio In
3 Accessory Sense. GND to enable External Mic and Speaker (Analog)
4 Audio Signal GND.
5 Portable handsfree In.
6 Music Mute Out, High when phone is used.
7 In Flash Memory Voltage and Service Voltage, In 0V=normal,+5V=test, +12V=test+flash
8 Logic Out, Status On. Sources over 100mA
9 Data Out from Mobile Station. Debug messages appear here at 112KBaud when in debug mode.
10 Digital Ground and DC return
11 Data in
12 DC in for battery charging, DC out for accessory power
Message
1. Go to the Keylock menu.
2. Set lock to Auto.
3. Press YES then hold the left arrow untill the Greeting menu appears.
GF788 Menu - 3 procedures for different software versions
Procedure 1
1. Go to the E*** MENU and press YES.
2. Type the number "2" and press YES.
3. In "NAME" HOLD DOWN the "2" key untill the number "2" apperars. Press YES.
4. Press YES again (to save any position) then QUICKLY press and hold left arrow (&lt untill "SIZE" appears in the display. 5.Press YES and choose "Full size". You now have the GF788 menu!
Confirmed working on version 970716 and 980318.
Procedure 2
1.Go to MissedCall
2. Empty the list
3. Press the -> key for a second or two
4. The option Menu size turns up
5. Choose ''yes'' and go from there
Confirmed working on version 990122.
Procedure 3
1. Go and set the ring volume and press yes.
2. When ''STORED'' is displayed - keep the right button -> pressed until ''Extended Menu'' is displayed.
3. Select "Activate" the menus and you now have lots of extra features
-----------------------------------------------------------------------------------------------------------------------
Ericsson 788
Software Version enter * -> * <- <- * <- *
Service Provider Lock is * <- <- * but it is now called the ME lock.
There are two options after selecting yes on another menu. These are lock to Network or lock to NetSubet.
Command set
The following commands are recongnized by the phone.
Use 9600 baud, 1 stopbit, 8 data bits, no parity.
ATA Pick up phone during ring
AT+GMI Manufacturer identification
AT+GMO Request model Identification
AT+GMR Request revision Identification
AT+GMM
ATDxxx; Dial number xxx
ATH Hangup phone
AT+CFUN=? Define levels of fuctionality in the order of power consumed
AT+CFUN=0 Switches off the phone
AT+CBC Query battery level
Each command has to be followed by a 0x0A, 0x0D sequence, that is carriage return - line feed. These commands will be ackowledged with an ''OK'' prompt. An incoming call is signalled by the string ''RING'' sent by the phone at 9600b in normal mode.
Portable Handsfree Unit
1 Earphone: 16 Ohm
2 Microphone: <- 2 kOhm
5 Connected to 04 (GND)
Pinouts
Left to right, keyboard up.
1 Audio Out
2 Audio In
3 Accessory Sense. GND to enable External Mic and Speaker (Analog)
4 Audio Signal GND.
5 Portable handsfree In.
6 Music Mute Out, High when phone is used.
7 In Flash Memory Voltage and Service Voltage, In 0V=normal,+5V=test, +12V=test+flash
8 Logic Out, Status On. Sources over 100mA
9 Data Out from Mobile Station. Debug messages appear here at 112KBaud when in debug mode.
10 Digital Ground and DC return
11 Data in
12 DC in for battery charging, DC out for accessory power

Ericsson 888

To view Software Version enter * -> * <- <- * <- *
(you also get version of InfraRed driver software and text labels)
Pinouts
1 = + external power supply. 7.2v @ 600mA.
2 = RS232 input (TTL)
3 = GND (digital)
4 = RS232 output (TTL)
5 = +5V output. Limited.
6 = Test. Switch phone off and provide +5V and switch back on. (set comms at 9600, n,8,1)
7 = Mute (0 - Normal, 1 - In Call)
8 = Internal/external (0 - External Mic/Speak, 1 - Internal Mic/Speak)
9 = GND (analog)
10 = Related to Mic/Speak
11 = BF in
12 = BF out
----------------------------------------------------------------------------------------------------------------------

Ericsson T10

*#06# IMEI
>*<<*<* for checking the firmware revision information (software release)
>*<<*<*>> n-row text strings. if pressing yes you can check the phones text programming in currently selected language.
Shortcut for Last Dialed call menu
If you for some reason don''t want to enter the ''Last Dialed calls menu'' by using the ''YES'' key you can use the following key stroke instead: First ''0'' then ''#''.
Access menu without Sim card
To access to the menu in your phone without having a card inside do the following: type **04*0000*0000*0000# When display say "Wrong Pin" press NO and you have access to the all menus: Info, Access, Settings, Calculator, Clock, Keylock On?, Mail, Phone book. NOTE if you try this on your phone may stop at Keylock On? menu and youÂll have to take your battery out to turn the phone on again. And this will not care about Phone lock!
A way to (un)lock your cell phone on to the network(subset):
1. Press <**<
2. Then on the display appear and give you two choices: Lock to Network ? and Lock to Network subset? (Use arrow keys to select)
3. Enter the NCK number (code is provided by the SP)
4. You have 5 attemps to do this
5. Then your cell phone will work ''only'' with the network
Warning: The Service Provider (SP) Lock menu is used to lock the cell phone to the SP''s SIM card. Once the cell phone is locked to a specific operator, if one inserts a SIM card from a different operator the phone will refuse to accept it! The cell phone will however accept another SIM card from the same operator. To activate/deactivate this lock one needs a special secret code that is not available to the end user. Your phone can be locked to a service provider FOREVER by doing this! If an invalid code is entered all five times, the menu will exit and be deactivated! Any further attempt to activate the NCK/NSCK lock Menu will result in the response "Not allowed"! However the NCK/NSCK lock can be recover through a direct clearing in the EEPROM.
Message Report
When writing a message, place at the start of it the code *0#.
----------------------------------------------------------------------------------------------------------------------
Ericsson T18

*#06# IMEI
SIM lock menu = <- * [CLR] <-
Message Report
When writing a message, place at the start of it the code *0# .

Mã số bí mật cho Nokia phone :

IMEI Number
*#06# Cells Identity Code (IMEI = International Mobile Equipment Identity)
XXXXXX XX XXXXXX X
TAC FAC SNR SP
TAC = Type Approval Code (first 2 digits = country code of the approval-country )
FAC = Final Assembly Code: (01,02 = AEG)
(10,20 Nokia)
(40,41,44 Siemens)
(30 Ericsson)
(50 Bosch)
(51 Sony,Siemens,Ericsson)
(60 Alcatel)
(65 AEG)
(70 Sagem)
(75 Dancall)
(80 Philips)
(85 Panasonic)
SNR = Serial Nr.
SP = Spare (always "0")


Software Version
*#0000# shows the software version

Signal Processing
*3370# - Enchanced full Rate Codec (EFR) activation. It will automatically restart.
#3370# - Enchanced full Rate Codec (EFR) deactivation
*4720# - Half Rate Codec activation. It will automatically restart.
#4720# - Half Rate Codec deactivation
Enchanced Full Rate will give you much better sound quality when you enable it. The new Enhanced Full Rate CODEC adopted by GSM uses the ASELP (AlgebraicCode Excitation Linear Prediction) compression technology. This technology allows for much great voice quality in the same number of bits as the older Full Rate CODEC. The older technology was called LPC-RPE (Linear Prediction Coding with Regular Pulse Excitation). Both operate at 13 kilobits.(but you take up more space on the network, so they can charge you more) - Talk-time is reduced with about 5%

Sim Clock Stopping
*#746025625#
[*#sim0clock#]
Checks if the sim clock can be stopped. Sim clock stop is a kind of stand-by mode which will save battery time. This code doesn''t work with software version 4.59.
It will tell you if it can be stopped or not.

Warrenty Menu
*#92702689# takes you to a secret menu with 6 choices:
[*#war0anty#]
1. Displays Serial Number.
2. Displays the Month and Year of Manufacture (0997).
3. Displays (if there) the date where the phone was purchased (MMYY).
4. Displays the date of the last repairment - if found (0000).
5. Makes you capable of transferring user data if you have the gear for it.
6. Shows how long the phone has been used to talk. This counter is not reset by when you "clear timers" like the counters in the call register.

Nokia Speed Trap Detector little joke on us from Nokia Engineers (urban legend)
The settings for radar speed traps detector. Your Nokia cell phone can be programmed to pick up radar speed traps, when programmed your cell phone picks up the radar and alerts you on the message alert tone. ( Doesn''t work with Nokia 7110! )
1. Enter your menu
2. Select settings
3. Select security settings
4. Select closed user group
5. Select on
6. Enter 00000
7. Press ok
8. Clear back to normal, within a few seconds your phone will display a radar sign with five zero''s next to it. It is now activated.
Unfortunately only Nokia phones have this function. The Cell Phone info display needs to be de-activated. Settings -> Phone Settings -> Cell Info display. Each time you turn off your phone, or even each time you loose contact with your carrier, you''ll have to activate it again... It is done using steps 1 through 5 above, but the number (00000) will be already on the field as a default.

The James Bond Trick
If you short-circuit the left middle and right pins on the bottom of the phone with all connections touching each other, the Nokia software hangs! The profile "Headset" will be activated. Before you do this just activate the "Automatic Answer" in the headset profile and set the ringing volume to "Mute". Now you can use your phone for checking out what people are talking about in a room. Just place it under a table in a room and call it. The phone receives the call without ringing and you can listen to what people are saying!

Game Hacking with Blizzard
Get the file called the ''BlizzardN-GAGE.SIS'' from IRC get in #mediaplace on Efnet (note: Downloading cracked/Hacked games is illegal unless you already own a copy of game)
The Blizzard Nokia N-Gage Installer.
1. Unpack Blizzard.sis file that you get from mIRC
2. Transfer the .sis file to your N-Gage
3. Get the .blz (N-gage ROM) from mIRC
4. copy the file to the root dir of your MMC (16MB MMC)Multimedia Card
5. Use the Blizzard application to unpack the .blz file
6. After unpacking the sonic icon should appeared in the MENU
7. Clicked sonic icon and it should work !
List of compatible games for the 3650,6600 and the N-gage that work:
[3650]
SonicN (v.2.5+)
Puyo Pop (v.2.5+)
[6600]
SonicN
Puyo Pop
Pandemonium
Tomb Raider
Super Monkey Ball
Tony Hawks Pro Skater
[N-Gage]
SonicN
Puyo Pop
Pandemonium
Tomb Raider
Super Monkey Ball
Tony Hawks Pro Skater

GSM Network Services Command Strings
When various network functions are selected via the cellphone''s menu using the keypad, the cellphone automatically generates the corresponding GSM network command string and transmits it to the network. These commands can however be manually entered via the keypad.
Each command is prefixed with either one or two * or # characters as follows:
** Register and Activate
* Activate
## De-Register (and Deactivate)
# Deactivate
*# Check Status
© Call button


Once each command has been entered, if it is a network command (as opposed to a local handset command) it must be transmitted to the network by pressing the YES (receiver) key which acts as an enter key - this is represented here with the © character. Always enter numbers in full international format +CountryAreaNumber (e.g. +447712345678).
Command Description Command String
Security
Change call barring code **03*OldCode*NewCode*NewCode#©
Change call barring code **03*330*OldCode*NewCode*NewCode#©
Change PIN code **04*OldPIN*NewPIN*NewPIN#©
Change PIN2 code **042*OldPIN2*NewPIN2*NewPIN2#©
Unlock PIN code (when PIN is entered wrong 3 times) **05*PUK*NewPIN*NewPIN#©
Unlock PIN2 code (when PIN2 is entered wrong 3 times) **052*PUK2*NewPIN2*NewPIN2#©
Display IMEI *#06#
Call Forwarding (Diversions)
De-register all call diversions ##002#©
Set all configured call diversions to number and activate **004*number#©
De-register all configured call diversions (no answer, not reachable, busy) ##004#©
Uncon***ionally divert all calls to number and activate **21*number#©
Activate uncon***ionally divert all calls *21#©
De-register uncon***ionally divert all calls ##21#©
Deactivate uncon***ionally divert all calls #21#©
Check status of uncon***ionally divert all calls *#21#©
Divert on no answer to number and activate **61*number#©
Activate divert on no answer *61#©
De-register divert on no answer ##61#©
Deactivate divert on no answer #61#©
Check status of divert on no answer *#61#©
Divert on not reachable to number and activate **62*number#©
Activate divert on not reachable *62#©
De-register divert on not reachable ##62#©
Deactivate divert on not reachable #62#©
Check status of divert on not reachable *#62#©
Divert on busy to number and activate /td> **67*number#©<
Activate divert on busy *67#©
De-register divert on busy ##67#©
Deactivate divert on busy #67#©
Check status of divert on busy *#67#©
Change number of seconds of ringing for the given service before diverting a call (such as on no answer). Seconds must be a value from 5 to 30. De-registering the same divert will also delete this change! **service*number**seconds#© (Service numbers, see below)
Call barring
Activate barr all outgoing calls (see Security to set code) **33*code#©
Deactivate barr all outgoing calls #33*code#©
Check status of barr all outgoing calls *#33#©
Activate barr all calls **330*code#©
Deactivate barr all calls #330*code#©
Check status of barr all calls /td> *#330*code#©<
Activate barr all outgoing international calls **331*code#©
Deactivate barr all outgoing international calls #331*code#©
Check status of barr all outgoing international calls *#331#©
Activate barr all outgoing international calls except to home country **332*code#©
Deactivate barr all outgoing international calls except to home country #332*code#©
Check status of barr all outgoing international calls except to home country *#332#©
Activate barr all outgoing calls **333*code#©
Deactivate barr all outgoing calls #333*code#©
Check status of barr all outgoing calls *#333#©
Activate barr all incoming calls **35*code#©
Deactivate barr all incoming calls #35*code#©
Check status of barr all incoming calls *#35#©
Activate barr all incoming calls when roaming **351*code#©
Deactivate barr all incoming calls when roaming #351*code#©
Check status of barr all incoming calls when roaming *#351#©
Activate barr all incoming calls **353*code#©
Deactivate barr all incoming calls #353*code#©
Check status of barr all incoming calls *#353#©
Call waiting
Activate call waiting *43*#©
Deactivate call waiting #43##©
Check status of call waiting *#43#©
Calling Line Identification
The following only works if CLIP and CLIR are enabled (ask your service provider)
CLIP: Presentation of the number of the incoming call
Activate CLIP **30#©
Deactivate CLIP ##30#©
Check status of CLIP *#30#©
CLIR: Presentation of one''s own number to the to the called party
Activate CLIR **31#©
Activate CLIR for the actual call *31#number©
Deactivate CLIR ##31#©
Deactivate CLIR for the actual call #31#number©
Check status of CLIR *#31#©
COLP: Presentation of the actual number reached (if number called was diverted to another number
Activate COLP *76#©
Deactivate COLP #76#©
Check status of COLP *#76#©
COLR: Presentation of the original number called by the calling party (if the call was diverted to this cellphone)
Activate COLR *77#©
Deactivate COLR #77#©
Check status of COLR *#77#©


Cellphone Services
10 All types of cellphone services
11 Speech service
12 Data service
13 Fax
14 Datex-J
15 Teletex
16 Short message service (SMS)
18 All data services without SMS
19 All cellphone services without SMS


Carrier Services
20 All services
21 All asynchronous services
22 All synchronous services
23 3.1kHz services
24 Synchronous point-to-point connections including PAD''s (all synchronous data services)
25 Asynchronous point-to-point connections including PAD''s (all asynchronous data services)
26 Data packet sending including PAD''s (all synchronous data packet services)
27 Services with PAD-share
29 Digital connection with 12kbps


GSM Network Service Codes

Note that at present only the following service codes are in use:
11 Speech
13 fax
25 data

Cell Broadcast
While Short Message Service (SMS) can be configured as a personal service, Cell Broadcast is a general service which is designed for subscribers of a specific cell or topic. For example, a subscriber to cell 050 in England will receive information on the GSM tower currently being used by their phone. This new concept brings a whole new meaning to the term mobile communications as the phone is now able to receive information such as share prices or weather updates without the need of data cards and computers. At present the following message types exist (note: this may vary from carrier to carrier and some carriers may charge for this service):

Code Title
000 Index
010 Flashes
020 Hospitals
022 Doctors
024 Pharmacy
030 Long Distant Road Reports
032 Local Road Reports
034 Taxis
040 Weather
050 District
052 Network Information
054 Operator Services
056 Directory Inquiries (national)
057 Directory Inquiries (international)
058 Customer Care (national)
059 Customer Care (international)


In the future one will be able to control each individual call by use of the following service codes. To do this the user has to insert the service code in front of the last # in the MMI command above.
For example the sequence *21*number*16# would divert all SMS calls (and only these) to the given number.

GSM Operator Codes
202-01 COSMOTE - Greece
202-05 Greece Panafon S A Panafon
202-10 Greece STET Hellas STET Hellas
204-04 KPN Telecom (GSM 900)
204-08 Libertel (GSM 900)
204-12 Telfort (GSM 1800)
204-16 Ben (GSM 1800)
204-20 Dutchtone (GSM 1800)
206-01 Belgium Belgacom BEL PROXI
206-10 Belgium Mobistar BEL mobistar
206-20 KPN Orange Belgium SA
208-01 France France Telecom F Itineris
208-01 Monaco France Telecom F Itineris
208-10 France SFR F SFR
208-10 Monaco SFR F SFR
208- France Bouygues Telecom Bouygues
213-03 Andorra STA Andorra AND M-AND
214-01 Spain Airtel Airtel
214-03 Spain AMENA
214-07 Spain Telefonica Moviles MSTAR
216-01 Hungary Pannon GSM Pannon
216-30 Hungary Westel H-Westel 900
216-70 Hungary Vodafone (GSM 900/1800)
218-01 Bosnia Cronet Cronet
218-90 Bosnia PTT Bosnia BIH PTT-GSM
219-01 Croatia HPT Croatian PTT HR-CRONET
219-10 Croatia VIPNET
220-01 Serbia Mobile Telecomm. MOBTEL
220-03 YU PTT
220-02 Montenegro PROMONTE GSM
220-04 Montenegro MoNet GSM
220-07 Serbia Promonte PROMONTE GSM
222-01 Italy Telecom Italia Mobile TIM
222-01 San Marino Telecom Italia Mobile TIM
222-01 The Vatican Telecom Italia Mobile TIM
222-10 Italy Omnitel Pronto Italia Omni
222-10 San Marino Omnitel Pronto Italia Omni
222-10 The Vatican Omnitel Pronto Italia Omni
222-88 Wind Telecomunicazioni S.P.A, Vatican and San Marino, Italy
222-98 Blu s.p.a. Telefonia mobile Italy
226-01 Romania MobiFon
226-03 Romania Cosmorom
226-10 Romania MobilRom
228-01 Switzerland Swiss PTT CH NAT D
228-01 Liechtenstein Swiss PTT CH NAT D
228-03 Orange Switzerland
230-01 Czech republic Radio Mobil CZ Paegas
230-02 Czech republic Eurotel Praha EUROTEL-CZ
230-03 Czech republic OSKAR
231-01 Slovakia Globtel
231-02 Slovakia Eurotel Bratislava Eurotel Bratislava
232-01 Austria Mobilkom A1
232- Austria O Call TS
232-03 Austria Max Mobil Telekoms A max.
232-05 Connect Austria Gesellschaft für Telekommunikation GmbH - ONE
232-07 tele.ring Telekom Service GmbH - Telering
234-10 UK Cellnet Cellnet
234-15 UK Vodafone Vodafone
234-30 UK One2One/Virgine
234-33 UK Orange
234-50 Jersey Jersey Telecoms Jer 1
234-55 Guersney Guersney Telecom GSY-TEL
234-58 Isle of Man Manx Telecom Manx
235- UK
238-01 Denmark Tele Danmark Mobil DK TDK-MOBIL
238-02 Denmark SONOFON
238- Denmark Telia Denmark Telia DK
238- Denmark Mobilix Mobilix
240-01 Sweden Telia Mobitel S TELIA MOBITEL
240-07 Sweden Comviq S COMVIQ
240-08 Sweden Europolitan Europolitan
240- Sweden Telenordia
242-01 Norway Telenor Mobil N Tele-mobil
242-02 Norway NetCom GSM A/S N NetCom GSM
244-05 Finland Telecom Finland Telecom Finland
244-91 Finland OY Radiolinja Radiolinja
244- Finland Telivo
244- .land Alands Mobil
246-01 Lithuania Omnitel LT OMNITEL
246-02 Lithuania Mobilios Telekomunikacijos LT BITE
246-03 Lithuania LT TELE2
246-04 ir Lithuanian X-GSM Tele2
247-01 Latvia Latvias Mobilais Telefons LV LMT GSM
247-02 Latvia Baltcom LV BALTCOM
248-01 Estonia Eesti Mobiiltelefon EE EMT GSM
248-02 Estonia Radiolinja Eesti AS RLE-GSM
248-03 Estonia Ritabell Q-GSM
250-01 Russia Mobil Telesystems MTS-RUS
250-02 Russia NW GSM St Petersburg RUS NWGSM
250- Russia DonTelecom
250- Russia United Tele Moscow UTM
250-38 Russia Wireless Technology
250- Russia Extel Mobile Comms Systems
250-99 Russia KB Impuls
255-01 UKR FLASH
257-01 VELCOM Belarus
260-01 Poland Polkomtel SA PL-PLUS
260-02 Poland Polska TelefoniaCyfrowa PL-ERA GSM
260-03 Poland Polska TelefoniaKomorkowa Idea Centertel
262-01 Germany DeTeMobil D1 D1-Telekom
262-02 Germany Mannesmann Mobilfunk D2 D2-Privat
262- Germany E-plus E-plus
262- Germany VIAG E2
265-01 Ukraine UA UMC UA UMC
265- Ukraine Ukrainian Radio System
265- Ukraine Bancomsvyaz
266-01 Gibraltar Gibtel Gibtel GSM
268-01 Portugal Telecel Telecel
268-06 Portugal Telemovel P TMN
268-03 Optimus
270-01 Luxembourg P&T Luxembourg LUXGSM
270-77 Luxemburg (900/1800) Millicom.SA L TANGO
272-01 EIR Eircell IRL EIR-GSM
272-02 EIR Esat Digifone IRL DIGIFONE
274-01 Iceland Postur og simi IS SIMINN
276-01 Albania AMC AMC
278- Malta Advanced
278-01 Malta Telecell Telecell
280-01 Cyprus Cyprus Telecom Auth CY CYTAGSM
283-01 RA-ARMGSM
284-01 Bulgaria MobiTel CITRON BG
286-01 Turkey TurkCell TURKCELL
286-02 Turkey Türk Telekom TR TELSIM
293-41 Slovenia Mobitel DD SI-GSM
293- Slovenia Digitel Digitel
294-01 Macedonia PTT Makedonija MKD-MOBIMAK
302-37 Canada (PCS) Microcell FIDO
310-02 USA (PCS) Sprint Spectrum Sprint
310-15 USA (PCS) BellSouth Mobility PCS
310- USA (PCS) Pacific Bell Mobile Srvs
310- USA (PCS) Western Wireless Corp
310-20 USA (PCS) American Portable Telecoms Sprint
310-16 USA (PCS) Omnipoint Corporation
310-17 USA (PCS)
310-27 USA (PCS) Powertel PCS Partners
310-66 USA (PCS) DigiPH DigiPH
400-01 Azerbadjan Azercell ACELL
401-01 Kazakhstan K-Mobile
401-02 Kazakhstan K-Cell
404-07 India TATA INA-TATA
404-10 India Airtel AIRTEL
404-11 India Essar ESSAR
404-12 India Escotel INA-ESCOTEL
404-19 India Escotel INA-ESCOTEL
404-20 India Max Touch MAXTOUCH
404-21 India BPL Mobile BPL MOBILE
404-27 India BPL Mobile BPL MOBILE
404-30 India Command COMMAND
404-31 India Mobilenet MOBILENET
404-40 India Skycell SKYCELL
404-41 India RPG MAA RPG MAA
404- India Usha Martin
404- India Modi Telstra
404- India Sterling Cellular SCL
404- India Mobile Telecom
404- India Airtouch
404-43 India BPL Mobile BPL MOBILE
404-46 India BPL USWest BPL MOBILE
404- India Koshiki
404- India Bharti Telenet
404- India Birla Comm
404- India Cellular Comms
404-56 India Escotel INA-ESCOTEL
404- India JT Mobiles
404- India Evergrowth
404- India Modicom
404- India Fascel
410-01 Pakistan Mobilink MOBILINK
413-02 Sri Lanka MTN Networks Pvt Ltd SRI DALOG
415-01 Lebanon Cellis (FTML) RL Cellis
415-03 Lebanon Libancell RL LibCL
416-01 Jordan FastLink JOR FSTLNK
417-09 Syria Mobile Syria SYR MOB
418- Iraq Iraq Telecoms + Posts
419-02 Kuwait Mobile Telecom KT MTCNet
420-01 Saudi Arabia MoPTT, DMTS-1 KSA ALJAWWAL
420-07 Saudi Arabia EAE KSA EAE
422-02 Oman General Telecoms GTO
424-01 Un Arab Emirat Etisalat UAE ETSLT
424-02 Un Arab Emirat Etisalat UAE EG2
425- Israel Cellcom Israel Ltd Cellcom
426-01 Bahrein Batelco BHR MPLUS
427-01 Qatar QTel QAT Q-NET
432-11 Iran T.C.I.
432- Iran Celcom
432- Iran Kish Free Zone
438-01 Turkmenistan BCTI
452-01 Vietnam MTCS VMS-GSM
452-02 Vietnam Vinaphone (GSM 900)
454-00 Hong Kong Hong Kong Telecom HK TCSL GSM
454-04 Hong Kong Hutchinson HutchinsonGSM
454-06 Hong Kong Smartone Mobile Comm SmarTone
454- Hong Kong Peoples Telephone Co Ltd
455-01 Macao C.T.M. CTM GSM
457-01 Laos Lao Shinawatra Telecom
460-00 China Guangdong MCC CHNTELGSM
460-01 China China United Telecom CHN-CUGSM
460- China Guangxi PTB
460- China Liaoning PPTA
460- China Beijing Wireless
460- China Zhuhai Comms
460- China Jiaxing PTT
460- China Tjianjin Toll Telecom
460- China DGT MPT
466-92 Taiwan Shungwa Telecom LDM ROCLDGSM
502-01 Malaysia My Digi MY DIGI
502-02 Malaysia My BSB MY BSB
502-12 Malaysia Binariang Maxis Mobile MY maxis
502-13 Malaysia Telecom Malaysia Touch MY MRTEL
502-16 Malaysia Mutiara Telekom DIGI 1800
502-17 Malaysia Sapura Digital Adam PHS MY ADAM
502-19 Malaysia Celcom GSM Celcom
505-01 Australia Telstra Corporation Limited Telstra
505-02 Australia Cable & Wireless Optus Limited YES OPTUS
505-03 Australia Vodafone Network Pty Limited VODAFONE
505-08 Australia One-Tel (GSM 1800)
510- Indonesia PT Kartika Ekamas
510-01 Indonesia PT Satelindo IND SAT-C
510-10 Indonesia Telekomsel TELKOMSELGSM
510-11 Indonesia Excelcom IND-EXCELCOM
510-15 Indonesia Telekomindo Telekomindo
515-01 The Philipines IslaCom ISLA
515-02 The Philipines Globe Telecom GLOBE
515-03 SMART telecommunications, Phlippines
520-01 Thailand Advanced Info Serv Pcl TH AIS GSM
520-18 Thailand Tacs WP1800
525-01 Singapore Singapore Telecom ST-GSM-SGP
525-03 Singapore Mobile One M1-GSM-SGP
528-01 Brunei Jabatan Telekom
528-11 Brunei DSTCom
530-01 New Zealand Bell South BELLSOUTH021
542-01 Fiji Vodafone Fiji VODAFONE
546-01 New Caledonia Mobilis Mobilis
547-20 Fr Polynesia Tikiphone F VINI Fr Pacific Isls Guinea International Wireless
604-01 Morocco ONPT Marocko MOR ONPT
605-02 Tunesia
608-01 Senegal Sonatel
612-01 Ivory Coast Comstar
612-03 Ivory Coast Ivoiris
612-05 Telecel
617-01 Mauritius Cellplus Mobile Comms MRU-CELLPLUS
624-01 Cameroon PTT Cameroon Cellnet CAM CELLNET
633-01 The Seychelles SEZ SEYCEL SEZ SEYCEL
634-01 Sudan MobiTel SDN MobiTel
636-01 Ethiopia ETA ETH-MTN
640-01 Tanzania TriTel TZ-Tritel
641-01 Uganda Celtel Cellular CELTEL
641-10 Uganda Mobile Telephone Networks MTN Uganda.
646-01 Madacom (Madagascar)
646-02 Antaris SMM (Madagascar)
646-03 SACEL (Madagascar)
647-10 Reunion SRR F SFR RU
648-01 Zimbabwe PTC Zimbabwe NET ONE
649-01 Namibia MTC Network NAM MTC
650-01 Malawi Telekom Network MW CP 900
651-01 Lesotho Vodacom *** COMMS
652-01 Botswana, Mascom Wireless
652-02 Botswana, Vista Cellular
655-01 South Africa Vodacom VodaCom-SA
655-10 South Africa Mobile Telephone Networks MTN-SA

Nokia Secret Code (to see the transmit and receive levels in -dbm):
Dial *3001#12345#
Menu up to Field Test. Choose Enable (or Disable), and press OK.
This will put a new menu item called Field Test on the phone.
Note that if you choose "Enable with Lights" the screen will stay lit,
drastically reducing your battery life while you have the field
strength enabled.
Turn the phone off and turn back on. Field Test will then be in the
main menu (will probably be on, if not turn it on by entering this
menu item and dialing 01).
You''ll see the db receive level, something like -70 to -90 (-70 is
better than -90) on the screen of the phone all the time.
To turn Field Test off press 00, to turn it back on press 01.
To remove it from the main menu, reverse the above procedure by
entering the "secret code."
---------------------------------------------------------------
Nextel Secret Code (to see the transmit and receive levels in -dbm):
# * MENU "RIGHT ARROW" (you must perform this sequence quickly).
You''ll see an item called Phone Model, and you can hit the RIGHT ARROW
key to see ad***ional items.
Hit RIGHT ARROW six times, and you''ll see a screen full of numbers. The
first number is some kind of quality indicator (22.11 is better than
12.11), and the second number is the cell site you''re on. Transmit and
receive strength will change as soon as the phone chooses a new cell
site.
The next number is the transmit power, usually at -00db (full power).
If you are very close to a cell site, the number will be bigger, like
-05db, indicating that the phone has reduced the transmit power output.
The next number is the receive signal strength. -80 is better than -99
(which is pretty bad). I don''t know what the bottom row of numbers
are for.
IMPORTANT: These screens DO NOT update - you have to go past them, and
then back again to update them.
You can automate the process by pushing TRACE. The phone will go back
to the regular screen, but the field strength information will
alternate with the regular information. Each time the screen
alternates, it will have the current field strength.
To turn this mode off, reverse the above procedure or turn the phone
off for a moment.
---------------------------------------------------------------
Motorola Startac 7797 (AT&T) Secret Code (to see the transmit and
receive levels in -dbm)
TESTMODE:
NOTE: This is not for the beginner. You can really mess up your phone
here.
To enter TESTMODE:
[FCN] 0 0 [*] [*] TESTMODE [STO]
(or [FCN] 0 0 [*] [*] 83786633 [STO])
In TESTMODE you can use your phone as normal, but it will display test
data on the screen (signal strength, etc.). You can navigate through a
few different screens of test data using [FCN] [#] and [FCN] [*]. You
can always return to the test data display using [CLR] (if something
else comes on the screen).
Once in testmode, you also have access to one more very important
feature, service mode. If you press AND HOLD the [#] for a few seconds
you will get a "US" prompt. Here you can enter various commands. All
of the commands here consist of a number followed by a [#].
Some of the more popular service mode commands are:
01 [#] Restart (you should do this after making programming changes)
19 [#] Show software version
32 [#] Reset phone to factory defaults
-------------------------
PROGRAMMING MODE:
-------------------------
To enter programming mode:
[#] PROGRAM [#] [SND]
(or [#] 7764726 [#] [SND])
You should get a "Which NAM" prompt. You probably want to enter 1 for
the first NAM.
You should now see "NAM 1 E*** *=yes #=No". Press [*] unless you
decide you really don''t want to be here.
Now you get a Security Code prompt. Enter your security code, which is
probably 000000.
Now you''ll see your ESN. You can use the volume keys to navigate
through other options. When you get to the "To Level (whatever)"
options, you can press the "smart button" to get to other menu levels.
Almost every option has text that explains what it is, so you can mess
around with things.
The PPMsg option on level 4 is worth noting: you can change the
power-on message to your name or whatever. Just type in your new
message using the numeric keypad ([#] moves forward 1 character and [*]
backspaces) and hit [STO] when you are done. Then navigate back to the
"To Level 1" option and press the "smart button".
To exit, navigate to the "Exit" option (level 1) and hit the "smart
button". To save, just hit [*] to save or [#] to cancel. You can also
abort programming mode at any time using the [END] button.
NOTE: The [CLR] button will always revert values to their previous
state. [#] aborts at any time.
-------------------------------------------------------
SprintPCS Samsung 3500 Phone Secret Codes
***** Debug Menu:
Hit the Menu Button
Press 9 (Setup)
Press 0 (this option is NOT listed)
Enter the Service Code (maybe 040793)
You get to the Debug Menu.
You have 4 options
1. Screen Displays information about the PCS network
2. TestCalls 4 different numbers that test the phone''s reception of
the signal
3. Errors Displays the last 20 errors that the phone has recorded
4. EraseError Clears the above list