Ericsson 688
To view IMEI number *#06#
To view Software Version enter -> * <- <- * <- * CLR (Use with Care)
To reset phone language to English *#0000#
>*<<*<*> 1-row text strings. If pressing YES you can check the phones 1-row text programming in currently selected language.
>*<<*<*>> n-row text strings. If pressing YES you can check the phones n-row text programming in currently selected language.
Pinouts
1 = + external power supply. 7.2v @ 600mA.
2 = RS232 input (TTL)
3 = GND (digital)
4 = RS232 output (TTL)
5 = +5V output. Limited.
6 = Test. Switch phone off and provide +5V and switch back on. (set comms at 9600, n,8,1)
7 = Mute (0 - Normal, 1 - In Call)
8 = Internal/external (0 - External Mic/Speak, 1 - Internal Mic/Speak)
9 = GND (analog)
10 = Related to Mic/Speak
11 = BF in
12 = BF out
Ericsson 768/788To view IMEI number *#06#
To view Software Version enter * -> * <- <- * <- *
Service Provider Lock is * <- <- * but it is now called the ME lock. There are two options after selecting yes on another menu. These are lock to Network or lock to NetSubet.
Command set
The following commands are recongnized by the phone.Use 9600 baud, 1 stopbit, 8 data bits, no parity.
ATA Pick up phone during ring
AT+GMI Manufacturer identification
AT+GMO Request model Identification
AT+GMR Request revision Identification
AT+GMM
ATDxxx; Dial number xxx
ATH Hangup phone
AT+CFUN=? Define levels of fuctionality in the order of power consumed
AT+CFUN=0 Switches off the phone
AT+CBC Query battery level
Each command has to be followed by a 0x0A, 0x0D sequence, that is carriage return - line feed. These commands will be ackowledged with an 'OK' prompt. An
incoming call is signalled by the string 'RING' sent by the phone at 9600b in normal mode.
Portable Handsfree Unit
1 Earphone: 16 Ohm
2 Microphone: <- 2 kOhm
5 Connected to 04 (GND)
Pinouts
Left to right, keyboard up.
1 Audio Out
2 Audio In
3 Accessory Sense. GND to enable External Mic and Speaker (Analog)
4 Audio Signal GND.
5 Portable handsfree In.
6 Music Mute Out, High when phone is used.
7 In Flash Memory Voltage and Service Voltage, In 0V=normal,+5V=test, +12V=test+flash
8 Logic Out, Status On. Sources over 100mA
9 Data Out from Mobile Station. Debug messages appear here at 112KBaud when in debug mode.
10 Digital Ground and DC return
11 Data in
12 DC in for battery charging, DC out for accessory power
Ericsson 868/888
To view IMEI number *#06#
To view Software Version enter * -> * <- <- * <- *
(you also get version of InfraRed driver software and text labels)
Pinouts
1 = + external power supply. 7.2v @ 600mA.
2 = RS232 input (TTL)
3 = GND (digital)
4 = RS232 output (TTL)
5 = +5V output. Limited.
6 = Test. Switch phone off and provide +5V and switch back on. (set comms at 9600, n,8,1)
7 = Mute (0 - Normal, 1 - In Call)
8 = Internal/external (0 - External Mic/Speak, 1 - Internal Mic/Speak)
9 = GND (analog)
10 = Related to Mic/Speak
11 = BF in
12 = BF out
Ericsson AH 230/238 PROGRAMMINGPress and hold down FCN while entering the digits 9 8 7. You must enter the digits within ten seconds.
The text "SER NUMBER" is displayed along with the telephone's electronic serial number. The number contains 11 digits, so the most significant digit is shown for one second, followed by the other 10 digits.
ENTRY
DISPLAY TEXT
PERMISSABLE VALUE
Electronic Serial #
ESN
Not Changeable
Phone Number
MIN x
(where x is NAM choice)
10 digits
System ID
SID x
(where x is NAM choice)
00000 to 32767
Press # to review
MIN & SID, or END/PWR
to exit the short NAM-
programming mode.
NB:
The Number Assignment Module (NAM) is programmed through the telephone keypad. There are two NAM-programming modes available; the short and the long. The short programming mode is all that is required in most cases. The long programming mode is required if a value set by the short mode is not desired.
Either mode may be used stand-alone, or the short mode can be used to set up most of the values and then the long mode can be used to make any changes desired. To enter either of the two NAM programming modes, press and hold down the FCN key while entering a specific series of digits. You must enter the digits within ten seconds.
In each programming step, you can either keep the displayed setting or value, or you can change it.
a. To go to the next step, without changing anything, press #. b. In some steps, you can "toggle" a setting from ON or OFF, or vice versa. To change the setting, press any numeric key.
In other steps, you can replace a displayed value. To replace a value, enter the digits on the numeric keys. If you enter a wrong digit, you can erase it by pressing FCN CLR.
Pressing * key restores the original value in the display.
Press # to store new setting/value and go to next step.
Press END/PWR in any step to leave the NAM-Programming mode. If you have changed anything in a step, you must store the setting by pressing # before pressing END/PWR.
Ericsson DH368, GF768, A1018s
Ericsson DH368
Try these Codes on your DH-368 phone:
1. Power on.
2. Press 904059 + 'MENU'
3. 'TEST SET' display ...
4. Press 'YES' will display @ then press 1 'RCL' will turn light off and you will see 'DONE'
5. Press 'YES' will display @ then press 86 'RCL' display 'DONE' also you will hear static... You can just enter the channel number (up to 1023) by pressing 'Yes' 3 'CLR' XXXX - channel number to enter a channel directly. You can also see the signal level on channel by pressing 3 'MENU'. You can see the ESN number by pressing 'YES' 1 'RCL' 96 in HEX format.
6. Press 3 to exit, now you phone will power down and power up again. You can install the phone number into the phone by pressing 923885 + 'MENU'
Ericsson GF768
Edit Greetings Tip
1. Go to the Keylock menu.
2. Set lock to Auto.
3. Press YES then hold the left arrow untill the Greetings menu appears.
GF788 menu in your GF768 phone! (1)
1. Go to the EDIT MENU and press YES.
2. Type the number "2" and press YES.
3. In "NAME" HOLD DOWN the "2" key untill the number "2" apperars. Press YES.
4. Press YES again (to save any position) then QUICKLY press and hold left arrow (<) untill "SIZE" appears in the display.
5.Press YES and choose "Full size". You now have the GF788 menu!
NB. Confirmed working on version 970716 and 980318.
GF788 menu in your GF768 phone! (2)
1.Go to MissedCall
2. Empty the list
3. Press the -> key for a second or two
4. The option Menu size turns up
5. Choose 'yes' and go from there
NB. Confirmed working on version 990122.
GF788 menu in your GF768 phone! (3)
1. Go and set the ring volume and press yes.
2. When 'STORED' is displayed - keep the right button -> pressed until 'Extended Menu' is displayed.
3. Select "Activate" the menus and you now have lots of extra features
NB. Confirmed working on version 980910
Ericsson A1018s
(UN)LOCKING YOUR ERICSSON A1018s TO SPECIFIC NETWORK :
A way to (un)lock your cell phone on to the network:
1. Press : <**<
2. Then on the display appear and give you two choices: Lock to Network ? and Lock to Network subset?
3. Enter the NCK number (code is provided by the SP)
4. You have 5 attemps to do this
5. Then your cell phone will work 'only' with the network
Erricson WAP Mobile Phone Bug Allows Wiretapping
May, 23 2001 - 09:51
Summary
Erricson's WAP, Wireless Application Protocol, suffers from a security flaw that allows attackers to listen into other WAP sessions traveling on the cellular carrier wave.
Details
Erricson Mobile Phone allows attackers to wiretap other lines. This attack is limited, since you cannot choose which number to wiretap on, and you cannot talk at the same time that you are wiretapping a line. This vulnerability shows the lack of security of WAP as it is offered in today's cellular networks.
IMPORTANT NOTE: Wiretapping is illegal. The following information is just a proof of concept that shows a potential vulnerability in Erricson's WAP implementation.
How to wiretap from an Erricson Cell Phone:
1) Type 904059
2) Menu
3) Yes
4) 1
5) RCL
6) Yes
7) 8300**
8) Yes
9) 86
(Instead of the ** you can write any number you wish, except for the number 00)
To stop the wiretapping:
1) Type RCL
2) 3
3) Yes
Additional information
The information has been provided by Pirsing, ::: m0sad team :::.
Ericsson GA628
*#06# for checking the IMEI (International Mobile Equipment Identity)
*#0000# to reset the phones menu-language to English.
*#103# then YES Time and date will be shown.
>*<<*<* for checking the firmware revision information (software release)
>*<<*<*> 1-row text strings. if pressing yes you can check the phones text programming in currently selected language. (298 entries)
>*<<*<*>> n-row text strings. if pressing yes you can check the phones text programming in currently selected language. (160 entries?)
The Service Provider (SP) Lock
The Service Provider (SP) Lock menu is used to lock the cell phone to the SP's SIM card. Once the cell phone is locked to a specific operator, if one inserts a SIM card from a different operator the phone will refuse to accept it! The cell phone will however accept another SIM card from the same operator.
To activate/deactivate this lock one needs a special secret code that is not available to the end user.
Here is how to activate the menu:
<**< Lock to Network? if pressing yes you have 5 attempts to enter NCK.
<**<< Lock to Network subset? if pressing yes you have 5 attempts to enter NSCK.
Warning: Your phone can be locked to a service provider FOREVER by doing this! If an invalid code is entered all five times, the menu will exit and be deactivated! Any further attempt to activate the NCK/NSCK lock Menu will result in the response "Not allowed"! However the NCK/NSCK lock can be recover through a direct clearing in the EEPROM.
Shortcut for Last Dialed call menu
If you for some reason don't want to enter the 'Last Dialed calls menu' by using the 'YES' key you can use the following key stroke instead: First '0' then '#'.
Bat. level indicator when turned OFF
When the phone is turned off and the phone is not changing - the bat. level can be seen for a short period of time by pressing the 'NO' key quick once (it has to be quick!) and then wait for about 2 sec. The bat. level will now be shown in the display at its normal position.
Access menu without Sim card
To access to the menu in your phone without having a card inside do the following: type **04*0000*0000*0000# When display say "Wrong Pin" press NO and you have access to the all menus: Info, Access, Settings, Calculator, Clock, Keylock On?, Mail, Phone book. NOTE if you try this on your phone may stop at Keylock On? menu and you´ll have to take your battery out to turn the phone on again.
Alarm Clock Menu
Go to MissedCall Empty the list Press the -> key for a second or two The option Menu size turns up Choose 'yes' and go from there.
An alarm clock turned up too but it never rang. I think this was because there is no clock in the phone.
Free phone calls using the GA628
This trick has only been reported working on PREPAID GSM CARDS and in some countries and with some sw versions.
The prepaid GSM SIM CARD is a kind of "SIM card" which only has a sertant amount of credit on it (like a normal phonebox telecard)... if it can be traced? - we don't know...
Well..here's the trick you dial the no. normally and press YES. While "connecting" is shown on the screen, the following procedure should be carried out: Press CLR then 0 then # and then NO (twice) so as to switch OFF the phone. You can then still speak on the phone while it is switched off but the SIM card does not record your calls which will lead to FREE phone calls in some countries.. we hope!!
Another variant of the code
Make a Call, while the phone says Connecting type 083# (the position 83 must be empty! ), when phone says Pos Emtpy, press the NO key and turn off the phone.
If you can make the call with the phone turned off you will face a problem when you need to hang up the phone...the only way for you to do that is remove the battery...???
-------------------------------------
- Author: Rizwan Siddiqui -
- email: mobilobby@gmail.com -
- MsN ID: mobilobby@hotmail.com -
- Website: http://www.mobilobby.com -
-------------------------------------