Pay Phone: Alcatel TRMA VIA - Page 1
Forum section: electronics / general

author: Bicurico
author_rank: Super Contributor
timestamp: July 22, 2024, 01:43:32 pm
content: Hello,Apart from being a TEA with a special focus on TV/CATV/SAT field meter and spectrum analyzer, I got into antiques and restoring them. Within antiques, my interest goes to stuff from the 60ies, 70ies and 80ies, not the reallly old stuff.My latest purchase (20 Euro) was a table top pay phone, which was usually found in the 80ies and 90ies in coffee shops, restaurants and bars. My model is the OEM for PT Comunicações, a company that belonged to the Portuguese Telecom (PT) - now exitinct and replaced by Altice, thanks to unbelievable missmangagement and corruption.I got the device, like most of the stuff, at a local flee market.After cleaning it, it looks pretty good - not like new, but nevertheless in a perfect display state.However, my collection pieces have to be in full working order, so I tried to see if it works. First obstacle: it came with an RJ45 plug instead of an RJ11 one. Luckily I had recently bought a crimp tool at local ALDI in sales, which came with a collection of RJ11 and RJ45 plugs. At the second attempt I got the wires right and the phone switched on! Hurray...But the joy did not last very long... A weird message saying (in Portuguese language) "only free calls" and a weird icon with an X on it. It took me two days to figure out that icon was the phone in a side view.Also, I had no keys: I could not open the side lock, that gives access to the coin deposit and which allows to open the phone to see its inner workings. The key for a front door was missing, too.Using my chinese lock picking kit, I attempted to open the front lock - a regular lock. I used the raking method and shortly after, I got it open. The front cover door reveals two sliding switches for pulse or tone dial and ring volume. It has a button for the configuration menu, but pressing it asks for a PIN code, which I did not have, either.I tried the more common codes (0000, 1234, 8888, 9999, 1397, etc.) with no luck. The security of this was granted by a 5 second waiting between every failed and new attempt. Quick mental calculation: 5 seconds x 10.000 possible codes = 50.000 seconds = about 14 hours uninterrupted brute force... There had to be a better way!This meant, I needed to open the phone. But the lateral lock is a disc detainer lock, which requires a pick that "Bosnian Bill and the Lockpicking Lawyer" developed... I don't have such a pick and even if I had one, you really need to train the technique. I got not time for this, so I took out my fairly new Lidl battery powered screw driver, but a metal drilling tool and literally bruteforced my way in. The lock can be easily replaced with a new one (I think) and after 5 minutes the phone was open.The coin mechanism is pretty interesting, it uses optical sensors to determine the coin value (I think based on the acceleration?).Anyway, the phone uses a NEC uPD78053 processor, a ST M27W101 EPROM and a ST 24C64 EEPROM.Both EPROM/EEPROM's are socketed, so I extract their contents (shared below).It took me some time to find the PIN - I had no idea where in the 4096 bytes they were located. So I came up with the idea to list all consecutive bytes that form a decimal number between "0000-9999". To make use of my ChatGPT subscription, I typed:Code:write a vb.net routine to read a binary file an list ina listbox all byte pairs that represent a 4-digit decimal number. example: "11 AC 23 45 65 AF" would list 2345, 4565Surprisingly, it took one edit and a second request to get the code I needed - literally in 5 minutes. I could not have written this faster on my own.So I run it and got a list with 304 candidates. While I was in a Teams meeting (one has to work, too), I worked down the list - after about 200 numbers (took me 30 minutes), I found the code ("7003").Out of curiosity I looked at the dump with the hex editor (again, spent the whole night yesterday, looking for the pin). And guess what - the stupid pin is at address 00000011 and repeated at address 00000013! Literally in the second line of the hex editor.Meanwhile I determined that this phone is an Alcatel TRMA VIA, known in Spain as a Teletupi. Teletupi were so kind to release a manual! Found it, downloaded it and found out, that I am stuck (again).My phone has a different revision and some settings can not be done on the phone but... ...need to be set remotely!For this the phone has a picky back modem PCB (I know it is a modem, because the phone complained about the missing modem, when I run it without it).Because of this, I cannot set the time (which is possible on the Teletupi). Without time, the phone enters the free mode, which does not allow any call, because it has not been activated.And, I cannot activate the phone for two reasons: the number found in the EEPROM is no longer active by PT, because they no longer exist!Also, I am using VOIP through my router, which does not produce the required impulses for call duration and charge.Last hope was to flash the FW of the Teletupi. And yes, I found one, because the MAME team has included the Teletupi and you can download the "ROM's". It is flagged as non-working, though.I had my programming laptop and my G540 all setup, when I rememebered that the M27W101 is a EPROM - it can only be written once! And of course, I don't have virgin ones...Was hoping that the Teletupi FW would give me the missing setup options, so that I could unlock the phone, at least into a free phone.As is, it can only receive calls and is a really gorgeous 80ies/90ies vintage display item.For 20 Euro I had my fun: from lock picking, EEPROM content extraction to access code extraction I had everything covered...Questions:- Anyone into pay phones? Do you have further insight?- What would be a modern compatible equivalent to the M27W101 and where to get one cheap?Kind regards,Vitor