Newsgroup: it.tlc.cellulari
Titolo: FUNZIONI SEGRETE ERICCSON

Ciao sono un ragazzo che ha appena sentito parlare di funzioni segrete di
telefonini, vorrei sapere di cosa si tratta, cosa si può fare tramite queste
funzioni, chi le fornisce, e quale è il loro modo di attivazione.
Se vi è possibile potreste mandarmi una lista delle funzioni, con il loro
rispettivo utilizzo, attivazione e disattivazione????
Vi ringrazio anticipatamente e chiedo scusa per la mia grande esigenza.
P.S.= Vi prego di mandarmi i messaggi al mio indirizzo di posta elettronica
e non al newsgroup, grazie e buone feste.
salva...@memex.it


n-ROW-TEXTS - scroll through full-screen messages with < and >
950626 1405 version commands:
CXC (number) - The Application software's "product number". The
GH337/GF337
is always "CXC 125 005"
PRG - Indication for Programming
                              Programming 337
Set ComPort to 9600bps, 8 data, 1 stop, no parity.
Power on phone by pressing "NO/ENDpwr".
When performing its powerup sequence the phone will send two ">>"
(ASCII 62 decimal) characters. Within 1 second, reply to it by
sending the 4 character sequence "TP1<CR>".
(I used Procomm Plus with this script "eric.asp")
[proc main ]
[start: ]
[       ]
[ waitfor ">>" ]
[ pause 1 ]
[ transmit "TP1^M" ]
If everything went fine you should get the "OK" prompt back.
Test the TEST PROGRAM by sending the commands terminated by a <CR>:
PROG 0 (shows Test Program product number info)
PROG 1 (shows Test Program product date info)
PROG 3 (Shows Main Application product number info)
PROG D (Shows Main Application product date info)
              Programming Calculator and Channel Indicator/RBS
To enable, send the following:
EEWR 047A 01
Wait for the OK prompt, power off* the phone and disconnect it from
the
interface cables. Powerup and browse through the menus.
To diasable, send the following:
EEWR 047A 00
                          Clearing Electronic Lock
To clear the electronic lock you have to clear the EEPROM address
range
045B to 0466 by sending the commands:
EEWR 045B 00
EEWR 045C 00
EEWR 045D 00
EEWR 045E 00
EEWR 045F 00
EEWR 0460 00
EEWR 0461 00
EEWR 0462 00
EEWR 0463 00
EEWR 0464 00
EEWR 0465 00
EEWR 0466 00
Download the Procomm Plus Scipt to clear the electronic lock - Click
HERE
                    Disabling the Service Provider Lock
To disable send the following command:
EEWR 1587 00
To enable send the following command:
EEWR 1587 01
                  Experimental Commands - Use at own Risk
To dump the application software send the following:
PREA <bank> <address> <bytestoread>
Bank range :    00..7F
Address :       0000..BFFF
Bytestoread :   0000..BFFF
The "additional" value returned at the end are the checksum value for
the
returned program memory bytes. Note, the byte-values are always
returned in
format 0000 and NOT 00.
PREA FF
Returns the application checksum, takes a few seconds.
                            Notes on the PH 337
1. Calculator mode is NOT available on all PH sw versions.
2. Invoking Calc/RBS mode not available for GH337 sw versions below
R2A
3. SPCK attempts can be changed to 50 instead of the std 5 tries
4. The instruction LIME returns ERR but does not screw up phone
5. The instruction IMEI returns the IMEI no.
6. Pressing YES in response to FLASH? does screw up the unit.
                              COOL STUFF TO DO
Set ComPort to 115200bps, 8 data, 1 stop, no parity and watch all the
phone
commands on the screen and so on. Make a call and see what happens as
well
as shutting down.
---------------------------------------------------------------------------
                              ERICSSON 318/388
To view IMEI number *#06#
To view Software Version enter -> * <- <- * <- * CLR (Use with Care)
The Latest Software Version is under Phone Info.
To view Software Version enter -> * <- <- * <- * CLR (Use with Care)J
To fine tune sound and clean up any echos, place the 388 into the car
kit
HF 2600.
Then close all windows, engine off and type * # * # 3. The E 388 will
fine-tune itself in about a few seconds.
To activate operator lock <- * * <- (This locks the phone to one
carriers
SIM card - Use with lots of care)
Press Yes to lock and No to notlock. You can also use the codes below
to
undo this function. USE AT OWN RISK
I have tested the function Lock to SP... At least on the 337 there's a
submenu: Enter SPCK-code. There are 5 attempts, which is showed (05
attempts). At final attempt the phone beeps as a warning, 'this is the
final try', when entering the menu... Wrong code exits the menu, so
you are
not stuck in something... When you have tried to enter the code
(wrong) all
five times, the menu is deactivated, and you'll get: 'Not allowed'
when
entering <-**<-
      Accessing the Service Program that is not provided with the 388.
1. Connect the 388 to Cable with RS232/TTL converter.
2. Set Comport to 9600bps, 8 data, 1 stop, no parity.
3. Power ON, wait for "2" and send "0B" to the phone. DO NOT Press
ENTER.
4. R should be on screen.
5. Send TEST.BIN. (Send as a binary file)
6. 388 should answer "SP,OK".
7. R should be on screen.
DO NOT write or read from the IMEI or SPCK area! If you try that you
can
send the phone to service at once, because you will automatically
write FE
or EF to EVERY cell in the EEPROM. In other words, all the calibration
values for the radio is overwritten... (NOT good)
Some commands in the ServiceProg:
eere <startADR> <NoBytes> read from eeprom
eewe <adr> <value> write eeprom
lime xxxx xxxx xxxx xxx Learn imei no. Returns Error.
imei - Displays IMEI number
                           To FlashProgram a 388:
1. Connect the 388 to Cable with RS232/TTL converter.
2. Set Comport to 9600bps, 8 data, 1 stop, no parity.
3. Power ON, wait for "2" and send "OB" to the phone. DO NOT Press
ENTER.
4. R should be on screen.
5. send pre_xxx.bin to the MS.
6. You should recieve a ">".
7. send "0B" again.
8. R should be on screen
9. send prodload.bin to the MS.
10. recieve ">".
Done, I don't have the above files so please don't ask for them.
               Interesting Informating (well I thought so :)
The names on the files, sj.....X45 tells you a couple of things. "sj"
stands for Sofia-Jane, thats the internal name for the model and x45
stands
for "sub-model". The 388 is called model 4/5. The latest 337 phones is
called "cr", like in Cost Reduction. They rebuilt the oscillator from
a
bought-in to one built up with discrete components and that was
cheaper.
                    Programming Channel Indicator or RBS
To enable, send the following command:
EEWR 3EE 1
Wait for the OK prompt, power off* the phone and disconnect it from
the
interface cables. Powerup and browse through the menus.
To diasable, send the following command:
EEWR 3EE 0
                          Clearing Electronic Lock
To clear the electronic lock you have to clear the EEPROM address
range
03CF to 03DA by sending the commands:
EEWR 3CF 00
EEWR 3D0 00
EEWR 3D1 00
EEWR 3D2 00
EEWR 3D3 00
EEWR 3D4 00
EEWR 3D5 00
EEWR 3D6 00
EEWR 3D7 00
EEWR 3D8 00
EEWR 3D9 00
EEWR 3DA 00
                              COOL STUFF TO DO
Set ComPort to 115200bps, 8 data, 1 stop, no parity and watch all the
phone
commands on the screen and so on. Make a call and see what happens as
well
as shutting down.
---------------------------------------------------------------------------
                                 *POWER OFF
You should press the NO button a few times until Shut Down comes up on
the
screen, when it does press yes and this will shut down the phone
properly.
---------------------------------------------------------------------------
              Reading the Channel Info now that's it's enabled
|-------|-------|-------| D
|       |       |       | I
|   1  |   2  |   3   | S
|-------|-------|-------| P
|       |       |       | L
|   4  |   5  |   6   | A
|-------|-------|-------| Y
1. This is three different channels things depending on the phone
state.
   * a. When the phone is idle, this shows "Bxxx". "B" stands for
     "Broadcast channel" (a logic GSM channel)
   * b. When a phonecall is in progress, this shows "Sxxx". S stands
for
     "Stand Alone Dedicated Control Channel" SDCCH for short.
   * c. When the phoncall in up, this shows "Txxx". "T" Stands for
Traffic
     channel. The "xxx" thing is the channel number, 1-124.
2. This shows Rx Level. The values displayed is from 0 to 63. Rx Level
is a
indicator on how good your reception is for the moment. 0 is a signal
strength of -110dBm. 63 is approx -45 to -50dBm.RXLEV is measured in
dBm in
such a way that incoming signal equals -110.5+RXLEV so that a RXLEV at
50
equals an incoming signal strenght at -50.5 dBm (plus or minus max
deviation 0.5dBm)
3. This shows the output power in dBm.
4. This shows the timeslot used for the moment. You can see it when
making
a call.
5. This shows Rx Quality. Rx Quality is a measurement of how much
error
correction is required to the speech. 0 indicates none and as the
figure
rises you hear more pings and pongs on the speech as large parts of
the
frame are missing. If you have more RxQ then 5, you are on good way to
loose your call. RxQuality reads 0-7.RXQUAL is measured by using a
table
wereas the biterrorrate or BER is interesting and measured in %
RXQUAL table
0               BER < 0,2 (%)
1               0,2 < BER < 0,4
2               0,4 < BER < 0,8
3               0,8 < BER < 1,6
4               1,6 < BER < 3,2
5               3,2 < BER < 6,4
6               6,4 < BER < 12,8 (here we have lost half a burst)
7               12,8 < BER
6. This shows the timing advance. The BS tells the MS to send before
it
should just make sure that the MS burst is comming to the BS on the
right
time. The TA is measured in halfbits so the distance to the BTS can be
calculated as follows=1,11*TA/2. TimingAdvance reads 0-63.
Co-incidentely
this tells you how far you are from the base site in 550metre chunks,
up to
the theoretical max of 35.2km.
---------------------------------------------------------------------------
                     ERICSSON Pin-Outs 2xx & 3xx Series
1       In Voice
2       In +5V=External Power, 0V=Battery
3       Out Ext Speak control
4       Analog GND
5       Out Voice
6       Out +5V=POWER ON, 0V=POWER OFF
7       Out Charger control
8       Digital/DC GND
9       In 0V=normal,+5V=test, +12V=test+flash
10      In Hook
11      In TTL serial in
12      Out TTL serial out
13      In 0V for aprox 1 sec = POWER ON/OFF
14      In DC Power supply
---------------------------------------------------------------------------
Copyright © 1997
======================================================
Cordialità
--
r...@xsplit.it
Importante: per eventuale corrispondenza di ritorno rimuovere la "x" dall'indirizzo.

Fortuna che non ti ha chiesto il manuale..      ;-))))
Mope.