F.A.Q. for Janus pages on Motorola GSM phones

I am hoping this FAQ will let other people benefit from the answers to questions I get in my mail. It should also help me personally by reducing the time I spend on answering the same questions over and over again.

Table of contents:

1) The pppXXXpYp(OK) codes don't work with my Motorola .......... (fill out the dotted line).

2) Which pppXXXpYp(OK) codes are available ?

3) Why can't I enable menu XXX? / Why does my phone not have the Calculator/Games/... ?

4) What is "permanent testmode" and how do I enable it ?

5) Can you send me some codes for my Motorola .......... GSM phone (fill out the dotted line) ?

6) Can you send me some codes for my Nokia / Ericsson / Panasonic etc. ?

7) I lost my LOCK or SECURITY code - What do I do ?

8) Can I unblock my SIM/SP locked phone / How do I get the "Special Code" ?

9) How do Flash upgrade the ROM / copy the software from a one phone to another (eg. 8400 onto a 8200) ?

10) I do not like the operator name shown in the display, can I rename it ?

11) What are the BDM connections of the M and V series (M3x66, V3688 etc.) ?

12) Can I change the Melody ringing tone of my motorola phone ?

13) Where can I find really detailed information on the SIM card and SIM / ME interface ?

--

Q1 : The pppXXXpYp(OK) codes doesn't work with my Motorola _ _ _ _ _ _ _ (write on the dotted line).

There are different answers to this, depending on your phone and firmware version:

A1a : Only a few mot phones will accept the codes per default. These were mainly the 7500's, some 6200's / 8200's.

A1b : If the codes do not work on your phone, you will have to use the transfer card emulator and MEDIT to change the menu configuration bitmap in order to add menus. The procedures for doing this are thoroughly described on the Menu Customization page. However the latest firmware versions do not export the necessary data for modifying the configuration bitmap. So forget about this.

A1c : Some of the more recent firmware revisions will accept the codes if the factory test flag in the EEPROM is enabled. Look otherwhere in this FAQ for information on how to enable it.

--

Q2 : Which pppXXXpYp(OK) codes are available ?

A3 : See the Menu Customization page. There is a link to the latest medit.mnu file.

--

Q3 : Why can't I enable menu XXX? / Why does my phone not have the Calculator/Games/... ?

A3 : If you are absolutely sure that your method of changing the menu configuration bitmap is working and you still cannot enable some menus, then the answer is simple: Your phone and/or your firmware revision does not have this feature built in. See the software versions file on Mot GSM Hardware and look for your model/version - there may be some annotations of working/non-working menus. And don't forget to report new versions!

--

Q4 : What is "permanent testmode" and how do I enable it ?

A4 : Checking wether your phone has "permanent testmode" (PTM) enabled is simple: Turn it on, then press and hold the #-key until your phone displays an unusual frame with "Test" written on the lower-left corner. Then you are in testmode. On many phones (unfortunately not on all - see Q&A 3) PTM can be enabled by storing a special factory flag into EEPROM: Import the factflag.bin provided on the Transfer Card page. It may be necessary to change the number of the frame in factflag.bin (at offset $0040) beforehand. $04, $05, $99 and $FF have been reported to work on different phones, actually anything between $01 and $FF might be a good guess.

--

Q5 : Can you send me some codes for my xxxxx Motorola phone ?

A5 : What you see is what you get! The information on my pages is all I have been able to come up with. If I had any more codes then you can be sure that they would on the pages. Why would I not list some codes on the www, but mail them to people on their request ? That doesn't make sense. You can still try to ask your question on the Mot GSM Discussion forum - maybe someone already has more information and wants to share it.

--

Q6 : Can you send me some codes for my Nokia / Ericsson / Panasonic etc. ?

A6 : I have limited this hobby project to Motorola phones - I believe web pages of this kind should be specialized in order of be of any real use. (no offence meant). Try an Altavista search.

--

Q7 : I lost my LOCK or SECURITY code - What do I do ?

A7 : First try the factory defaults which are 1234 for the LOCK code and 000000 for the SECURITY code. If this doesn't work, then you need a test card. You can etiher go to a Motorola service place and pay then to insert a test card and read out the codes or you can do it yourself with an emulated test card. You will need to build the emulator interface featured on the card emulation page at Janus pages. The interface is very simple and cheap to build. Next you need to use ASIM with the sim.dat module loaded in order to emulate a test card. As an alternative to the ASIM / season interface, you can use a PIC wafer card programmed with the appropriate code (also available from the card emualtion page.) After entering test mode by holding down the "#" key you need to enter 58# to view the LOCK code and 59# to view the SECURITY code.

--

Q8 : Can I unblock my SIM/SP locked mot phone / How do I get the "Special Code" ?

A8 : The special code is the code that will remove the provider lock that was put on the phone when it was manufactured for some mobile phone company. S/L will appear on the label of the phone. SP locked phones are normally sold cheap or with prepay cards. Phones with old firmware (pre october 1998) can easily be unlocked by exploiting a bug in the clone card interface by using an FF frame. Some newer phones can be firmware "downgraded" using BDM to allow the FF frame to be used. So in short: forget about unlocking M, V, L, T series.

--

Q9 : How do Flash upgrade the ROM / copy the software from a one phone to another (eg. 8400 onto a 8200) ?

A9 : This is not possible with the transfer card interface. The transfer card will only let you transfer EEPROM content - NOT Flash ROM content. Flashing of the phone is normally done with an EMMIbox - DIY people have done it by desoldering the Flash ROM(s) and programming them manually. You have to be sure that the EEPROM map versions for the respective software versions are compatible - The upgrade of 8200 to 8400 must be from 37.62.57 to 62.63.15 (or above). It will not work from 37.62.39 because of incompatibe EEPROM map versions.

--

Q10 : I do not like the operator name shown in the display, can I rename it ?

A10 : There is a small field in the EEPROM for updates to the network number list. Normally, it's in the firmware, but minor updates are kept in the EEPROM field (there is room for 3 entries). On the clone card page, a special frame that will update these fields can be found. Edit it to your own needs. Unfortunately the SIM may override the operator name if there's a name programmed on it.

--

Q11 : What are the BDM connections of the M, V, L, T series (M3x66, V3688, T2288, Timeports etc.) ?

A11 : The cd930 and d520 were the last models that used the Motorola 683xx MCU and hence had BDM. This means that you can not use BDM with the M3x88, V3688, Timeport etc.

--

Q12 : Can I change the Melody ringing tone of my motorola phone ?

A12 : On the latest phones/firmwares this feature is already built in (see Q&A 3). If you believe your phone should have this feature, see the Menu Customization page for how to enable it. You'll still need a transfer card emulator (-> hardware). On earlier phones - Perhaps ! On some (8900 and later) it is possible to put a melody in an EEPROM field numbered 239. I have not gotten around to writing a tutorial for it, but you might be able to find the information needed in some of Madis documents. The EEPROM field can not be reached with the clone card interface so it is needed to edit the EEPROM directly via. BDM or an EEPROM programmer. There is a bit that controld the speed of the melody (slow or fast) and a bit that signals that the EEPROM melody should be used instead of the default one in ROM. The music is rather poor sounding because of the slow speed and the gaps between the notes.

--

Q13 : Where can I find information on the SIM card and SIM / ME interface ?

A13 : The GSM SIM is ISO7816 1-3 compliant and the commands and file structure is described thoroughly in the ETSI GSM Technical Specification 11.11. GSM TS 09.91 contains the additions used in phase two SIM's. TS 02.17 contains a functional overview. ETSI specs are availabe for download from www.etsi.fr. Some information can be found in the documentation that comes with ASIM by the Android (on the card emulation page).

--