- C E L L U L A R H A C K I N G -
BY
-----------=?> Doctor Who =-----------
Novatel 8325
------------
This article is copyright 1993 by the author. Reproduction is allowed, with the
following restrictions:
1) Any copy, or edited version, of this file must contain this copyright
notice, the author's name, and the information regarding Phrack.
2) No commercial use may be made of it without prior permission of the author.
This permission may be revolked at any time, in which case all reproduction
must cease, and any copies must be destroyed.
3) Use as evidence in a court of law, for the purposes of this agreement,
is considered a commercial use.
4) This agreement can not be changed, or added to in any way. Receipt of this
work through an authorized commercial distributor does not imply permission
given to the commercial consumer to re-distribute it in a commercial manner.
5) Any part of this agreement found invalid by a court of law does not render
the remainder of this agreement void: The rest of the terms of the agreement
must still be adhered to.
The Novatel 8325 is a bag-style portable cellular telephone. It is known as a
'ProClassic' in Novatel MarketSpeak. Two different handsets (control units) are
used with the 8325 transeiver: the 4130 and 5160. My phone has the 5160.
The handsets appear very similar: I doubt there is any functional difference
between them. Earlier transceivers, such as the 8320, contain many of the same
features as the 8325, though the hidden menus are accessed with different
codes. The only other code I know of is #746, which is the code for the 8320
CFG menu.
Terms: Throughout this article, I will refer to things without explaining them
each time. If you get lost, refer to the table below.
NORMAL = the phone is in this mode when it is not locked, or in either of the
hidden menus, or in the 'user' menus accessed by the MENU key. The screen will
display either READY or SCANNING when in normal mode. This is the mode the phone
is in when it is first turned on.
LOCKED = when the phone displays LOCKED, a code must be typed to enter normal
mode. The default code is 1234. The telephone can be locked using [FCN] 1 [SND]
from normal mode. The phone must be locked before entering in any of the codes
to access the hidden menus described below.
TBL = troubleshooting mode = the hidden menu accessed with 546*. This is a
menu supposedly know only to Novatel, not even their dealers are supposed to
know about it. According to Novatel, some of the features in this menu could
destroy the phone if improperly set. Scare tactics? you decide.
CFG = configuration mode = the hidden menu accessed with 510*. This is used by
dealers to set up a subscriber's service. As far as I know, there is nothing
particularly dangerous about this mode, but Novatel is touchy about it
nonetheless. I take no resposibility for any damages.
Troubleshooting Mode - TBL
First, lock phone with [FCN] 1 [SND]
Then, enter 546* on the keypad. The phone
will not make tones for each key pressed.
TBL 8325 /___ This is what shows up on my fone.
REV NA0C \ Yours may be different.
You are now in troubleshooting mode. You may page through the functions
by using the arrow keys, or access the functions by number, by hitting #
(The screen will display DIR PAGE ACCESS) and then the function number,
from the chart below. Note that on initially entering Troubleshooting mode,
you are on function 37. Toggle with the [SND] key, unless otherwise noted.
# Screen Default Toggle/Range Description
-----------------------------------------------------------------------------
11 TRANSMIT OFF ON Turn the transmitter on.
12 TX TEST OFF [CLR]=OFF, 0-7 test data stream,audio levels of
13 CHANNEL 0000 0000-1023 [H/F] = down, [RCL] = up.
14 TX AUDIO OFF ON
15 VOLUME GAIN 6 0-7
16 RX AUDIO OFF ON Turn the receiver on. Set this to ON
and use in conjunction with #13
(CHANNEL) to listen to calls.
17 POWER ATTN 3 0-7
18 SYNTH LOCKED synthesizer locked. if reads
unlocked, the phone has real problems.
19 SAT OFF ?? transmitted SAT
20 RF POWER OFF ON Not an option, but an indicator. When
TRANSMIT is set ON, this displays ON.
21 SPEAKER ON OFF
22 SIDE TONE ON OFF
23 TX DTMF OFF Tone test. [CLR] then 00-25. DTMF means touch-tone
00 = DTMF 1 01 = DTMF 2 02 = DTMF 3 03 = DTMF A?
04 = DTMF 4 05 = DTMF 5 06 = DTMF 6 07 = DTMF B?
08 = DTMF 7 09 = DTMF 8 10 = DTMF 9 11 = DTMF C?
12 = DTMF * 13 = DTMF 0 14 = DTMF # 15 = DTMF D?
16 = 1+2+3 17 = 4+5+6 18 = 7+8+9 19 = *+0+#
20 = 1+4+7+# 21 = 2+5+8+0 22 = 3+6+9+# 23 = A+B+C+D?
24 = ? 25 = Wake-up-tone. The + signs are use to
signify keys simultaneously held on a regular (desk-style)
touch-tone phone. These tones are each hald of the dual tones
the comprise touch tones.
24 RX MODE BURST CONT
25 RX TEST OFF ON
26 FRME CNT 000000 Frame count. of counter. Had the last digit become
27 BIT ERR 0000000 Bit Error. 1 every so often is no big
deal. Hit any key to clear.
28 WATCHDOG ON OFF watch-dog periodicaly checks the timing
of the different clocks in the system.
Hit any key to turn this off and the
Phone re-starts
29 HOOK SW OFF Hook Switch - since a bag phone has
no switch hook, always off.
30 HORN MODE ON OFF Toggles indicator light
31 BELL MODE 0 0-9, [SND]
32 RSST 20x Received Signal Strength Indicator
33 MICROPHN ENABLED DISABLED
34 NVM TEST RM=0 E=1 Non-Volatile Memory Test
35 COMPANDR ON OFF A Compander compresses speech to
confine energy to the given bandwidth.
36 NVM CLR USE SND Non-Volatile Memory [SND]="ACCESS DENIED"
37 TBL 8325 REV NA0C MENU,MODEL,REVISION (INITAL SCREEN)
------Modulation------- Don't mess with this stuff - it can screw up your phone
N0 means channel bank 0. Banks are 0-4. Tune to a mid-band channel using the
keypad, and tune with [H/F] down and [RCL] for up.
38 MODG CLR Any Key, 0 = YES resets options #39,#40,#41 to default.
39 CHN 0991 N0 AMG16 AMG = SAD Deviation.
40 CHN 0991 N0 DMG16 Signalling tone.
41 CHN 0991 N0 SMG12 Transmit audio level.
------Digital Potentiometers-- DANGER! Play with this, and you may have to
send your phone out for repair.
42 DPOT CLR Any Key, 0 = YES resets options #43,#44,#45,#46 to default
43 MICROPHN 14190 OHM
44 EXPANDER 14936 OHM
45 TX LIMIT 12180 OHM
46 SPEAKER 15420 OHM
------Analog Switches-------- Enables/Disables on-board potentiometers.
47 ANALOG SW1 ON High end of transmit audio
48 ANALOG SW2 OFF Low end of transmit audio
-----
49 PWR LVL3 DAC0777 power level, reading from digital-analog converter
50 PL3@0000 14 power level @ channel, received signal strength
Configuration Mode - CFG
Lock the phone with [FCN] 1 [SND].
Enter 510*
CNF 8325 /_____ Menu, model, softare revision.
REV NA02 \ May be different on your phone.
[UP] <----- Use the up arrow key switch each option. [DN] goes back.
SERIAL /_____ ESN - No way to change it from
8Exxxxxx \ the handset, as far as I know.
NAM1 SEL /_____ Select which NAM you want to program, or 0 for common
0-4 END \ configuration. The digit following the letters NAM
is the last NAM examined, or 1 when entering this menu
the first time.
I will be dispensing with the arrows from this point on. First we start with
the common configuration. Hit the 0 key.
COMMON
CONFIG
INIT NAM Initalize NAM memory - ALL of them! This is dangerous.
USE SND Values in the NAMs are replaced by factory defaults.
INIT ICM Initial Configuration Mode - Resets everything back to
USE SND factory defaults. You need a special PCB boardwith a 'key'
on it for this to work, according to Novatel.
INIT REP Initialize Reperatory - This means clearing out ALL of the
USE SND memory for storing phone numbers!
LOCKCODE The code used to unlock the phone. Not too useful if you know
1234 about 510* and 546*.
CHANGE To change the lock code, enter the OLD lockcode, displayed
LOCKCODE in the previous option. the NEW CODE FFFF menu will appear,
enter the new 4 digit code, then [SND].
BIL CODE The code to get into the BIL menu. C means # and A means *.
C185 So from the LOCKED mode I would enter #185 for the BIL menu.
QRC SET Quick Recall - very convenient. 10 memories, 0-9. To use, in
normal mode just hit which memory you want and [SND].
QST SET Quick Store - store numbers in above memories. In normal mode
type in a phone number, [FCN] [FCN] and the memory localtion.
WUT SET Wake Up Tone - The sound the phone makes when first turned on.
MLH CLR Mobile to Land Hold - Accumulated air time counts all mobile-
to-land time when SET, ignores calls less than 30 seconds
when CLR.
LMH CLR Land to Mobile Hold. See above to figure it out.
CRU CLR Call Round Up - round times up to nearest minute.
EE SET Extended DTMF Enable, during call.
NLM CLR No Land to Mobile. Do not count land originated calls in call
timer.
HAL CLR Horn Alert
ONL SET Online Diagnostics. Activate by [FCN] 9 from normal mode.
displays channel number, power level, received signal
strength, and digital color code. I think it's neat, and leave
it on all the time. Note that it overrides everything, and
stays on even when the phone is locked. To get rid of it,
either turn the phone off and on again, or toggle it with
[FCN] 9 from normal mode.
PLACBITH Placement Bits - a reading from the data stream -- ??
** *
Pressing the [UP] key at this point just goes around to the start of the
common config again. Use [END] to return to the NAM selection menu.
Select a NAM 1 through 4. I start with NAM 1 here.
NAM 1 [SND] toggles ENABLED / DISABLED except on NAM 1, which
ENABLED cannot be disabled. Enabled means you can use it from normal mode.
MIN 312 Mobile Identification Number - the phone number - enter the new
555-0990 number, then [SND].
SIDH System ID - a number designating the serving area (city) an
0010 cellular carrier (company) of the subscriber. Even numbers
designate wire-line (System A) carriers, Odd numbers
Non-wire-line (System B) carriers. Enter 5 digit number, [SND}
TO EXIT When installing a new NAM, most times you can just finish here
NOW--END and leave the rest of the settings at their default values. To
do so, hit [END].
IPCH Initial Paging Channel. 0333 for System A carriers, 0334 for
0334 System B carriers. Enter 4 digit channel number, [SND].
EX SET Extended address - to dial more than 7 digits. always set.
IDCCA IPCH scan start for A systems. Should be 0333.
0333 Enter 4 digit channel number, [SND].
IDCCB IPCH scan start for B systems. Should be 0334.
0334 Enter 4 digit channel number, [SND].
ACCOLC Access Overload Class. A sort of 'Priority' designation. It
08 doesn't seem to really do anything. Enter 00 through 15, [SND].
GROUP ID Cell carrier sub division. This setting is not known to have
MARK 10 any effect on service.
REG TBL Registration Table Size. Novatel says it should always be 1.
SIZE 1 Enter 0-4, [SND].
LU CLR Local Use - SET prohibits calls outside the local area.
INVLD ID Invalid ID - a list of System IDs to never use. Useful when
1 NONE you want to avoid inadvertantly wandering into an area
2 NONE with a cellular carrier that scalps you for roaming fees.
3 NONE Hit #, the 5 digit System Id number, then [SND]
4 NONE
FD SET Touch-Tone dialing. Always have set.
MFD SET Extended DTMF. SET for continuous tones,
CLR for fixed-time tones
32D SET 32 Digit Dialing - always have set.
PS CLR Default system. CLR = B, SET = A.
IRI CLR CLR allows user to prefer system A or B from normal mode, by
using [FCN] [SND] to display preference, and [SND] again to
toggle. System preference function not available when the HOM
option is set because the HOME function uses the same keys.
(Note: confused? the HOM option is that which we set here
in the CFG menu, enabling the HOME function to be used from
normal mode.)
HOM CLR When HOM is SET, [FCN] [SND] in normal mode shows the HOME
status. [SND] a second time toggles it. When HOME is ON, all
calls are restricted to your home system.
SSD SET Signal Strength Indicator. When SET, in normal mode the bottom
line of the display shows the received signal strength. When
SSD is CLR, the bottom line in normal mode displays the System
Preference, or ONLY if IRI (see above) is SET. When SSD is set
and you want to see which operating condition is active, HOME,
PREF, or ONLY, in normal mode type [FCN] [SND] [UP].
Billing Mode - BIL
1) lock the phone with [FCN] 1 [SND].
2) enter #185.
3) If the screen reads BIL 8325 REV NA0C (or something similar) then go to 4.
Else,the phone still says LOCKED, enter 510*. Use the [UP] key to get to the
screen that reads NAM1 SEL 0-4 END. Hit 0. Hit the [UP] key 7 times to get
to the BIL CODE screen. The number on the bottom line is the code used to
enter the Billing Mode. A "C" stands for the # sign, and "A" means the *
sign. Write this code down. Hit [END] [END] to exit the CFG mode, and
restart at step one, using this code instead of #185.
4) The BIL mode has 10 screens, most of them fairly boring compared to the CFG
and TBL modes. Like the TBL mode, BIL mode allows use of the # key to
directly access a given screen rather than stepping through each one with
[UP] and [DN] keys. Note direct access is not available from the NEW CODE
screen, as this is interpreted literally. Use [UP] or [DN] to leave that
screen. Below is a table of the screens available. the number on the left
is the screen number, for use with the # sign.
00 TOT TIME
00-00-00
01 MIN 312
555-0990
02 LOCKCODE
1234
03 INVLD ID [SND] moves 1-4
1 NONE
04 STACK
ALARM
05 SCRATCH [SND] to disable.
PAD ENAB
06 PWR DOWN
CODE 0
07 SERIAL
8Exxxxxx
08 FIRMWARE
10000001
09 NEW CODE Reset the code to enter the BIL mode. Enter 4 digits,
FFFF C will be displayed for # and A for *. Hit [SND].
5) [END] to exit.
-----DrWho, 10/12/93
|
|
Disclaimer: The file contained in the
box above or displayed in a separate window from a link in the
box above is NOT owned nor implied to
be owned by BeYoND THe iLLuSioN. Most files at BeYoND THe
iLLuSioN are originally from public Bulletin Board Systems
(BBS) which were popular in the days before the Internet or
from gopher, web, and FTP sites from the early days of the
Internet which no longer exist today. Essentially, all files
were acquired from the public domain in one for or another.
However, there have been occasions when copyright protected
material has appeared on BeYoND THe iLLuSIoN without permission
of the copyright holder. In these instances, we have and will
continue to remove the copyright protected file as soon as it
is brought to our attention. This can now be done using our Report Copyright Material form. Fill
out the form, and the webmaster will be notified of the
situation.
There are also times when files found on BeYoND THe iLLuSioN
have a real home somewhere else on the Internet. In these
instances, we will gladly replace the file with a link to its
true home whenever it is brought to our attention. If you know
of the true home of any of these files, you can use our Report Original URL form to bring it yo our
attention.
|