home *** CD-ROM | disk | FTP | other *** search
- THE HIGH TECH HOODS
- & A-CORP PRESENTS...
-
- *%*%*%*%*%*%*%*%*%*%*%*%*%*%*
- *% THE ULTIMATE %*
- *% CELLULAR PHONE PHREAKS %*
- *% MANUAL PART 2 %*
- *% %*
- *% WRITTEN BY THE RAVEN %*
- *% AND INTROSPECT %*
- *%*%*%*%*%*%*%*%*%*%*%*%*%*%*
-
-
-
-
- THE RAVEN
- +=======+
- THANKS TO THE FOLLOWING: PEBBLES, BIT STREAM & THOMAS ICOM
- /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\//\/\/\/\/\/\/\/\/\/\/\/\
-
- INDEX:
-
- I. WHAT'S IN A NAM
- II. NAM/ESN REPROGRAMMING
- III. ADVANCED REPROGRAMMING
- IV. OBTAINING SYS. REGISTRATION DATA
- V. REPROGRAMMING YOUR PHONE
- VI. ------------------------
-
- \/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
-
- I. What's In A NAM
-
- First thing were going to start with is the NAM. The NAM is a PROM, A blank
- NAM costs about $5. Sometimes its more expensive depending on the operating
- temperature and packaging specifications.
- Two flavors of NAM's are most commonly used for cellular phones. NEC Corp.
- uses the open collector (SIGNETICS p/n 82S23 or equivalent). All others use
- the tri-state (SIGNETICS 82S123 or equivalent). Blank NAMs are manufactured by
- Signetics, National Semiconductor, Monolithic Memorys, Fujitsu, Texas Instrum
- ents, and Advanced Microdevices. Blank NAMs can be purchased at your local
- electronic distributor's, thru the various parts sources advertised in
- electronic magazines, and some radios come with a blank included.
- The NAM contains the subscriber number and lock code, the home system ID and
- other system-required data. You may wonder how this info is arranged. The NAM
- is organized into 32 rows and 8 colums. It is 32 words of 8 bits each.
- (256 bits total). Starting from top of the NAM (address 00), you will find
- the abreviation SIDH. This means "System Identifaction Number Home", a number
- starting at 0001 assigned by the FCC. Each market allows two systems. These
- two digits are even for the wire-line and odd for the non-wireline.
- At address 03, we find LU (Local Use) on the left and MIN on the right, and
- they are usually set to 1. Locations with zeros are reserved. Going down the
- map, there's MIN1 and MIN2-the subscriber number and the area code respectively
- Dont try to read them from a raw printout of the NAM data, as they are
- scrambled beyond recognition. The reason? THe way they are arranged is the way
- they must be transmitted to the cellular systems receivers. The programmer
- does this to make the radio's job easier.
- Next is the station class mark, which identifies the class and power
- capability of the phone. The system will treat a handheld (low power)
- differently than a standard 3-watt mobile.
-
- IPCH is the Inital Paging Channel. The radio listens for a page on this
- channel. Wirelines use 334 and non-wirelines use 333.
-
- ACCOLC (ACCess Overload Class) is designed for throwing off customers in the
- event of an overload. Thru neglect, this standard has been largly unused.
- (A Class 15 stationis supposed to be police, fire or military). Usually, It's
- a set to 0 plus the last digit of the phone number to provide random loading.
-
- PS (Preferred System). This is always 1 in a non-wireline and 0 in wireline.
-
- The Lock Code is about the only thing you can read directly by studying NAM
- data. The "spare" bit must be a 0 if the radio contains a 3-digit code.
- Because the number of clicks when you dial 0 on a (dial) phone equals 10,
- zeros in the lock code are represented by an "A"(the hexadecimal equiv of 10).
-
- EE, REP, HA and HF correspond to end-to-end signaling (DTMF tones, possibly
- as you talk), and REPeratory dialing (provision for 10 or more numbers in
- memory).
-
- Horn Alert and Hands Free. Like all options, they are 1 if turned on and 0 if
- turned off (all these numbers are in hex). They are supposed to be used by
- radio makers to store option switches. Usually 13 is used, 14 sometimes and
- the rest less often.
-
- Last, you will find Cheksum Adjustment and Checksum. These numbers are
- calculated automatically after the data has been edited for the NAM. The sum
- of all words in the NAM plus these last two must equal a number with 0's in
- the last two digits. The radio checks this sum and if it isn't correct the
- radio assumes the NAM is bad or tampered with. In the case radio refuses to
- operate until a legal NAM is installed.
-
- THE ANATOMY OF A NAM
- --------------------
-
- MARK Defin. most <-- BIT Significance --> least Hex
- ------------------------------------------------------
- 0 SIDH (14-8) 00
- SIDH (7-0) 01
- LU=Local use LU 000000 MIN 02
- 00 MIN2 (33-28) 03
- MIN2 (27-24) 0000 04
- 0000 MIN1 (23-20) 05
- MIN1 (19-12) 06
- MIN1 (11-4) 07
- MIN1 (3-0) 0000 08
- 0000 SCM (3-0) 09
- 00000 IPCH (10-8) 0A
- IPCH (7-0) 0B
- 0000 ACCOLC (3-0) 0C
- PS=Perf Syst 0000000 PS 0D
- 0000 GIM (3-0) 0E
- LOCK DIGIT 1 LOCK DIGIT 2 0F
- LOCK DIGIT 3 LOCK SPARE BITS 10
- EE=End/End EE 000000 REP 11
- REP=Reprity HA 000000 HF 12
- HF=Handsfree Spare Locations (13-1D) 13
- HA=Horn Alt contain all 0's 1D
-
- NAM CHECKSUM ADJUST. 1E
- NAM CHECKSUM 1F
-
- II. NAM/ESN REPROGRAMMING
-
- The first step to using cellular phones is to obtain one. They can be
- purchased new or used. Ham fests are one good source. Many people dump their
- cellular phones once they see just how expensive they are to operate. And of
- course the perception of being jerked promotes phreaking.
- First generation E.F. Johnson units are good choice as they are easy to
- modify, use uniquely effective diveristy (dual antenna) receivers, and use the
- AMPS control bus, which means that several maker's control heads will work
- with it. Another good choice is Novatel's Aurora/150. It uses a proprietary
- parallel bus and control head, but costs less, is rugged, and is also easy to
- work on. Also, all Novatel CMTs have built-in diagnostics. This allows you to
- manually scan all 666 repeater output freqs-great for scanning!
- All cellular phones have a unique ESN. This is a 4-byte hex or 11 digit
- octal number stored in the ROM soldered on the logic board. Ideally, it's
- supposed to be never changed. Some newer cellulars embed the ESN in a
- VLSI IC (Very Large Scale Integration Integrated Circuit) along with the units
- program code. This makes ESN mods very difficult at best. The ESN is also
- imprinted on the reciever boiler plate, usually mounted on the outside of the
- housing. When converted to octal (11 digits), the first 3 digits represents
- the maker while the other 8 identify the unit.
- The other important ROM is the NAM. It contains the MIN (i.e. phone #,
- including area code), the lock code, and various model ID and carrier ID
- codes.
- The lock code keeps unauthorized parties from using the phone. Some newer
- cellulars have no built in NAM and instead use an EEPROM, which allows a
- technician who knows the maintenance code to quickly change the NAM data thru
- the control head keypad.
- WHen one attempts to make a cellular call, the transceiver first automatically
- transmits the ESN and NAM data to the nearest cellsite reapeter by means of
- the Overhead Data Stream (ODS). The ODS is a 10 kilobaud data channel that
- links the cellular's computer to the MTSO, which then controls the phone's
- entire operation down to the selected channel and output power. If the MTSO
- doesn't recognize the received ESN/MIN pair as valid (sometimes due to RF
- noise), it issues a repeat order and will not process the call unit until a
- valid pair is received.
- In most cities, there are two CPCs or "carries". One is the wireline CPC and
- the other is the non-wireline CPC. Both maintain their own MTSO and network
- (i.e: cell-site repeaters), and occupy separate halves of the cellular radio
- band. Non-wirelines use System A, and wirelines use System B. (the amenities
- that are avaible with most landline phone service - call waiting, caller ID,
- call-forwarding, 3-way calling,etc., are standard fair for most CPCs. However,
- they are usually applied for differently.)
- For the cellular phreaker, the most diffuclt task is obtaining usable ESN/MIN
- pairs. Over the years,standard phreaker techniques have been employed for all
- types of phreaking to obtain the required info. These includes trashing,
- using inside help,joining the staff,hacking them from known good ESNs and
- MINs (i.e: spoofing), con strategis, strong-arming, Bribing, blackmail, etc.
- (This is how The High Tech Hoods get them!).
- The hacker knows that most CPCs do not turn off or keep track of unused MIN
- numbers. In fact, their general pattern is to start at the low numbers and
- work their way up. WHen a number is cancelled, it is reassigned instead of
- using a larger number.
- The first places to look is the authorized cellular installers and service
- centers in your area (see your Yellow Pages). They have on file a record of
- every cellular phone installed or serviced by them, including the ESN/MIN
- pairs. Another place to focus on is the cellular CPC's customer service or
- billing department. These offices contain the ESN/MIN pairs often for
- thousands of cellular phones, and hire low-paid people. Some cellular CPCs,
- installers and service centers will provide NAM system parameters upon
- request, and some will sell you NAM and ESN memory maps and schematics of a
- specific cellular phone model. And some will sell you service manuals
- (i.e: Motorola) that will describe the often easy method to program their
- cellular phones.
- The good phreak/hacker could interface the cellular phone's ADC circuit to
- his PC and hack out all of the valid ESN/MIN pairs he could possibly need.
- Since the ESN/MIN pair are transmitted from cellular phones (usually in an
- unencrypted form), these pairs can be obtained simply by scanning the cellular
- phone channels. Even if they are encrypted, the phreaker only will need to
- reproduce the encrypted pair. In some areas, you can buy the ROMs right off
- the street - often by the same dealers who sell drugs and stolen property,
- etc. All it takes is a few discreet inquires. However, many get caught
- doing this because of police stings.
- Once a valid ESN/MIN is obtained, it must be programed into the cellular
- phone's ROM. Some cellular makers use different devices and memory maps, but
- the standard is the AMPS 16-pin 32x8 bit format and some ROMs have proprietary
- markings.
- If the part number are different than those given and you can't find them in
- your data book, look for the IC maker's logo and call or write them for data
- sheets. If the IC's have proprietary markings, by looking at the external
- parts that are directly wired to them, one can often determine not only
- whether the IC is open-collector or tri-state, but also what the pin assingn-
- ments are, and sometimes the type of replacement IC to use.
- The ESN ROM is then carefully desoldered from the logic board (first ground
- the soldering tip thru a 1 Meg-ohm resistor). Once, removed the IC can then be
- placed on a ROM reader/programmer or NAM programmer (bit editing mode). Any
- ROM reader/programmer that will burn a compatible ROM is usable, but a
- dedicated NAM programmer has built-in software that takes out much of the
- aggravation. Using a non-NAM ROM reader/programmer, one searches for the memory
- locations that has the same number as ESN printed on the boiler plate. This
- number will be immediatly followed by an 8-bit checksum determined by the 8
- least significant bits of the hex sum of the ESNs four bytes.
- The old ESN data (now copied into the NAM programmer's RAM) is replaced by the
- new ESN and the updated checksum. A new blank and compatible ROM is inserted
- into the ROM burner and burned with the new ESN data. Most cellular phreakers
- at this point install a Zero Insertion Force (ZIF) DIP socket into the logic
- board for this and any future ROM changes.
- The NAM IC is usually already installed in a ZIF socket on the logic board.
- Similarly, its MIN is read by the ROM reader/programmer and a new ROM is
- burned with the new MIN and updated MIN checksum. Altho one may wish to also
- update the CPC's system parameters, they can left the same if the same CPC
- is desired. To change the CPC'c designation, the last four MIN digits, the
- checksum and the exchange (if they use more than one exchange) are changed.
- The more astute cellular phreaker of course can design and build his own NAM
- programmer/reader, ideally one interfaced to a PC. A more primitive approach
- is to interface two banks of hex thumbwheel switches to the sockets, altho
- a computer program would be very helpful to determine the proper switch
- settings. Thumbwheel switches allow you to make changes on the fly and they
- can be plugged in as needed, so if one is caught red-handed, it is difficult
- to prove intent and origin of phone call.
-
- III. ADVANCED REPROGRAMMING
-
- Your cellular phone contains a special memory which retains data about the
- phone's individual characteristics, such as its assigned phone number, system
- identification number, (ID#) and other data that is necessary for cellular
- operation. This special memory is known as the NAM. You can program the phone
- yourself, if the phone has not already been programmed where you got it. You
- can also reprogram the phone yourself should you wish to change some of the
- features already selected for the NAM.
- The reprogramming of the NAM is performed after you have contacted your
- cellular system operator for the nessary data as described below. Enter the
- data received from your cellular system operator in the NAM Reprogramming
- Data Table before reprogramming the NAM of your cellular phone. Incorrect
- NAM entries can cause your cellular phone to operate improperaly or not at
- all. Your cellular phone can be reprogrammed up to three times. After that,
- it must be reset at a Motorola-authorized service facility.
- Be sure you read this complete text before attempting to reprogram your
- phone!
-
- 1. RE-PROGRAMMING FEATURES
-
- You must get seven pieces of data from the cellular system operator to
- allow you to reprogram the cellular phone. You provide the remaining data.
- Write all of this programming data on the NAM Reprogramming Data Table
- provided in this text before implementing this procedure. Incorrect NAM
- entries can cause your cellular phone to operate improperly or not at all.
- The required data is:
- * System Identification (SID) Code (S-digits): Indicates youe home system
- Enter 0's into the left-most unsued positions. Provided by the system
- operator.
-
- * Cellular Phone Number (10 digits): Used in the same manner as a standard
- land-line phone. The mobile phone number and the Electric Serial Number
- are checked against each other by the cellular system each time a call
- is placed or recieved. Provided to you by the system operator.
-
- * Station Class Code (2 digits): This number is 06 or 14 for most personal
- or portable phones. Even though your phone has extended bandwith
- capabi Overload Class
- 5c * 06 Ready for step 6
- 6a * Curr. Group ID Factory set at 00
- 6b New Group ID XX New Group ID
- 6c * 07 Ready for step 7
- 7a * Current Sec. Code Factory set at 000000
- 7b New Security Code XXXXXX
- 7c * 08 Ready for step 8
- 8a * Current Unlock Code setting at 123
- 8b New Unlock Code XXX New Unlock Code
- 8c * 09 Ready for step 9
- 9a * Current Initial Factory Setting 123
- 0334 PAGING CHANNEL
- 9b New Initial XXXXXX New Initial
- Paging Channel Paging Channel
- 9c * 10 Ready for step 10
- 10a * Cur. Options Factory Setting 010100
- 10b New Options XXXXXX New Options
- 10c * 11 Ready for step 11
- 11a * Cur. Options Factory Set. 000
- 11b New Option XXX New Options
- 11c * 01 or 01 2 Ready for Review
- to program.
- or
- Second Phone Number
-
- ============================================================================
- Now That conclude Part 2, Part 3 will the instructions for NAM reprogramming
- for all the phones I listed in part 1. If you have any questions or comments
- you can leave me mail on one of the following bbs's that I have listed below.
-
- THE RAVEN
- +=======+
-
-
- Downloaded From P-80 International Information Systems 304-744-2253
- d walk away.
-
-
- Remember after every trick to put the phone back together for another day.
-
- Downloaded From P-80 Systems 304-744-2253
-
- e me E-mail.
-
- |!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|!|
-