Changelog & Latest News

• 01-06-07 Tele-Servizi.com is no longer hosting my old pages. Therefore I have placed them at motpages.50webs.org in order for them to still be available as a reference for people that would like to play around with this old hardware. I'm probably way too nostalgic, but it seemed like a pity just to let them go completely off-line. Sorry about the ads, but hopefully it will just cover the hosting. Take care everyone! BR Janus

• 28-05-01 MeditX v1.8 is available. It's supposed to handle the latest phones as well, but due to the change of frames it is NOT able to modify phone-menus or the startup graphic.

• 10-05-01 Unbelieveable, but there is news! Mainly the FAQ has been updated (due to many questions on the discussion group), also the software/firmware list and the menu definitions file medit.mnu

• 04-09-00 Several testmode commands updated. Most new phones will accept setting of the testmode flag via. an FF frame - even though they only export crippled frames (T2288 - C4.02.31 SVN 09, late Timeports). After setting the testmode flag, you can enable any menu you'd like using the good old keypad codes - including clock, complete call diverting, internal phonebook(!), and EDITABLE MELODY RINGER !!! (thanks TST - I did not update the FAQ, but added your excellent forum-post to the menu modification page). Again, Motorola product crippling strategy at it's finest...

• 21-04-00 FIX for d160/d170 clock modification. Madis has worked out a 3 byte patch for 85.00.56 firmware to allow the correct display of the RTC after adding an XTAL to the phone as described on the 8700 clock page.

• 10-04-00 Stephan helped me straighten out the 3WIRE / DSC bus mixup on the hardware page. Now we are getting somewhere!

• 08-04-00 Hey, wait! Something is wrong here. An update after 6 months of silence ? Added a bit more detail on the emmibox section of the hardware page and few notes on the smartcellect cable. The latest firmware versions for the L (Timeport) series export reduced transfer frames which only contain user information (phonebook etc.). Since the menu bitmap is not exported, you can't enable Eng Field Options using MEDIT / MEDITX.

• 24-11-99 There is an procedure on the transfer card page that supposedly will let you enter clone mode on the V series (if the firmware version allows for it). I would appreciate if I could some test results, since I neither have a M or V series.

• 17-11-99 I nearly had a heartattack today. A "SmartCellect" cable is 1500 DKr here - that's more than 200 Euros. The Nokia cable costs excately 1/10 of that.... I really do not know if i should laugh or cry. Naturally, i did not buy it. I really would like to urge anyone with the cable to examine it and find out what that chip in cable is doing. Someone said it was an ASIC doing more than mere signal level conversion. The battery of my cd930 was at the end of it's lifetime after little over a year. I bought a Li-Ion cd9x0 battery from www.battery-direct.com and at half the price of the Motorola battery, it is a bargain. It has the Dallas chip in it and even more capacity (1050 mAh) than the Motorola battery, so I will reccomend it highly to anyone that are sick of Motorolas price policy. Finally added the ST130 BDM pinout.

• 12-10-99 The macros that Madis wrote for BD32 are now available from the BDM page. You will also find infromation on I/O mapping (keypad and display) of the d160 (which probably is analogous to most other units). I got a feedback on the survey, mentioning A0.07.02 firmware for the cd9x0 (last known was A0.06.28) - Can anyone tell what the changes are that justificate an increase in stepping and not just revision number ? Another feedback concerned the d520 firmware A8.07.02 which offers send SMS from phonebook and "delete all SMS" (Nice job Motorola!). BDM page fixed up and the CORRECT StarTAC 70/85 BDM connections now appear.

• 02-10-99 Added picture and text of how a small 2x5 pin header can be soldered onto the PCB of the cd9x0 for easier BDM access (bottom of BDM page).

• 01-10-99 The Clone / Transfer card is working again on the V3688 ! I had a confirmation on emulating clone mode on the new b1.06.34, but no attempt on activating Eng Field Options. Please give me feedback if you have a b1.06.34 unit and have the courage to try it ! (I have feedback on a single attempt that killed one of the early V3688's).

• 28-09-99 Updated the BDM page to include information on Madis and TST's BDM Flasher with support for 16 bit Intel Flash ROM's. Added StarTAC 70/85 BDM pinout and information on back-up and restoration of Flash ROM and EEPROM.

• 08-09-99 Stephans ASIM 4 deluxe has been released (emulator page).

• 03-09-99 Added information on EEPROM writing to the BDM page.

• 16-08-99 BUMMER! I had the wrong permanent testmode frame in /download/factflag.bin - it would *disable* the flag... Sorry, it has been corrected now. I would *really* like to hear from someone who could make a frontend for a BDM flasher in C. Nothing fancy, just something similar to ASIM. The flasher engine is already complete. Corrected a bunch of typos in test.html. Updated ideas.txt (02-07-99) PLEASE TAKE A LOOK AND SEE IF *YOU* CAN HELP.

• 09-08-99 The self disgnostics command in testmode will specify what type of checksum error (configuration, SP/IMEI or DS2401) resulted in 7100 = 07. There seem to be some incompatabilities between Ronny's new simpic and motorola phones. It is either a timing or missing file problem - I will investigate. I would really like to hear from someone that is fluent in C ;-) concerning a project of making a user friendly front end for an existing command line based motorola phone flasher (BDM). If you would like to do such a programming project, then please do contact me. The program will be available to everyone when finished. Please check out the new BDM page.

• 14-07-99 The 88# testmode command that displays the RTC on the d460 and up can also be used to set the clock, date and daylight saving status. The test mode command table has been updated to reflect this (Thanks Stanislav!). Ronny's simpic is now also hosted at tele-servizi.com (Nice people!). You should check out Ronny's latest version of simpic which supports COMP128 on a PIC+EEPROM wafer. Chaveiro has given ASIM several new features. The version number is 4 and is available for download on the emulator page (nice job!).

• 06-07-99 Added a more detailed description to the SVN number (testmode command 191#). Found new test mode command 54x# to test the LED of the StarTAC 85 / cd920 / v3688. The v3688 accepts the parameter 2 to the acoustic loopback command, indicating that it supports an additional CoDec (Half Rate ?).

• 02-07-99 I would like to ask all of you for a little help. Here is why: I have had a small "user" survey running the last couple of weeks and my conclusion is that I will remove the outdated FAQ and focus on adding more detail to the descriptions and try to bring some more complex modifications (e.g. custom music ringing tones, BDM how-to's). If you can / will help me perform these tasks I would like to hear from you. Updated software.txt & transfer.html.

• 24-06-99 Stephan has updated Kurgans description of how to take the startac apart and even included some new pictures. Thanks Stephan !

• 19-06-99 Added permanent testmode and provider update name update frames to the transfer card page (at last). Updated the emmifield table to include all the lengths of fields 01 - BD.

• 11-06-99 Seems like the Americans finally discovered what has been a well establsihed fact in Europe and Asia for a couple of years.

• 03-06-99 Ronny Stern, the authour of SIMPIC has developed a piece of code that emulates a test card. The code can be programmed onto a PIC 16F/C84 wafer card. This is a cheap and easy way to get a stand-alone test card. The Wafer card has the advantage that you can cut it into plug-in size. A big thank you goes out to Ronny for sharing his code with us ! The code can be downloaded from the card emulation page. I would be very interested in getting feedback from people that are going to try this on the v3688

• 16-05-99 Updated the description of the errorcodes returned by testmode 71nn#

• 12-05-99 The new version of Chefchens excellent Mottool is available. New features include the display of secraterial memory, scratchpad, locking status and the special code on older units (early 8700 and older). If you worry about your privacy, this should be food for thought. As always, you need an EEPROM dump from the phone to use mottool - frames will simply not do.

• 08-05-99 A little status on the v3688: A number of units with the factory test bit set have made it to the (mainly italian) market. However it seems like B1.06.06 (v3688 firmware) in contrary to the A0.xx.xx (cd930 firmware ) does not accept the old keypad codes when the factory test flag has been set. The problems with emulating the clone and test card on these units, seem to be mainly an interface problem. The clone mode is still there and the frames look much like the ones we currently know (however, the first attempt to enable the EngField Options with medit killed the phone!!!) I have heard of . The processor in the v series does not use MC68k opcodes. My guess would be that the processor was a Motorola MCore (RISC) - I sure could use a disassembler ! This little puppy also looks like a candidate. I just want to coment on the smartcellect cable: It contains an ASIC, so it's probably not possible to make your own. THIS IS SO BLOODY TYPICAL and a symptomatic of Motorola protectionism - just like with the dallas add only memories in the batteries, they are doing every stunt they can to deprive the end user of any acessory options and free market prices.

• 11-04-99 New version of mottool available. Re-organized the pages, so please report broken links. Does anyone know what is new in A0.06.24 ?

• 10-04-99 Cleared up some misunderstandings about C1 & C2 that Dave actually brought to my attention months ago. Replaced the schematics that come with ASIM to the correct ones (bummer!). Added a few wakeup graphics. The 8700 clock page now has a link to an Italian description of the clock mod and there is an amusing picture of Stephans phone ;-)

• 07-04-99 My apologies to everyone for the lack of updates. Cleaned up and added a few things to the test mode command list. Mainly, the 191#, 192# & 21#. Did anyone have a look at 92# - 95# which can be found on A0.04.18 ? The V3688 does NOT have a motorola 683xx MCU - this is pretty darn interesting and very hard to believe ?!?!? It has no EEPROM - everything is stored in the 2 mb FLASH.

• 01-02-99 The good old menu keypad codes are back ! Phones with permanent testmode set will accept them. I have had a few problems with getting all of them to work, but it's good to be able to use this tool again. Updated the menu customization page (keypad codes section) and added information on the d520 to the hardware page. Enabling menu bit 123 and switching on the RTC with testmode 8801# will not do anything. The XTAL isn't present, and chances are pretty slim for ading one. The BGA package will make it impossible uless the pins can be found otherwhere on the PCB. If you find them I would like tohear about it.

• 07-01-99 Happy new year everyone ! I have added a small form that will help you to submit data to keep my lists up to date. I would be happy if you would take the time to use this to give me feedback on software and DSP versions as well as FAC & TAC's. Submit your data by clicking the "survey" link on the left. It's pretty depressing to see that NO-ONE has reported a single new field description to the list on the transfer card page !

• 17-12-98 Added a thorough description to the transfer card page about how the transfer frames are composed. I have also started to build and maintain a list of transfer frame fields - I really need some help for this enormous task. Before starting to try and map / explore these, you better be able to backup and restore your EEPROM. Lots of new software out that either ignore or freeze with special frames: 9A.02.12 (cd160), 74.06.16 (8700) and A8.02.21 (d520) - There are probably others as well. BTW: I got this crazy idea: Did anyone ever think of porting MEDITX or ASIM to the Palm Pilot ?

• 09-12-98 A month since the last update ?!!? I must really be getting lazy. Updated testmode commands (19N#, 23# & 89#). The Latest software versions (Nov '98) will not allow the use of special frames like IMEI, SP, TEST etc. An example is the cd920/930 A0.04.29 (please provide more info like this to the software list). Eng Field page updated with respect to Vocoder types and a few other things. We are currently beta-testing ASIM DeLuxe by Stephan.

• 09-11-98 New versions of Medit(x) are available. They both now handle the complete list of menus (Thanks Lui Ming !). The new menus can be found in the medit.mnu file. Medit(x) now has a better handling for the connection, it's no longer neccessary to press "ESC" inbetween transmissions (probably only the first time for each run).

• 08-10-98 TST has released MEDITX which is a hybrid between ASIM and MEDIT. Now you only need one program to upload/download frames to/from the phone and edit them. MEDITX can be found on the Card emulation page. Paolo has contributed with schematics of handsfree kits for the d460/8700/8900. These are now available in .pdf format at the hardware page.

• 18-09-98 After a shorter, unvoluntary interuption, my pages are enjoying hospitality in sunny Italy courtesy of TELESERVIZI! Another note: People looking for SP unlocking cards or cards that will permanently let the phone enter testmode even without a test card can contact the people at motorolacards@hotmail.com

• 02-07-98 I have set up a free web board for the users of these pages. I will try to join the discussion there and hopefully we can get a good and interesting discussion going there. Use the "Discussion" link in the index frame.

• 29-06-98 The Philips Diga has a nice testmode that can be entered with a test SIM (or ASIM). I am not sure what the baudrate is, but it will probably have to be adjusted from the one used with mot phones. The clock, menu editing is 100% the same with the 1900 MHZ units. I got confirmation on the clock addition on an 6000e. I would like to let you know that I am *really* having a hard time keeping up with my inbox. I have always tried to give a reply, but I simply can't do that anymore. I really enjoy the mail I am receiving - please keep the feedback and information coming, but I am afraid that I will not be able to reply to every single mail - sorry.

• 22-06-98 Arthur has pointed me to the patent on the DSC bus. I have added a link to it so you can read it from the DSC section of the hardware page. Emilio has sent me a nice construction for adding the coloured LED's to the 8700/8800 - this can be also be downloaded from the hardware page. Added a scan of the pin numbering on the 68338 that Alexander made for me to the clock page. The cd920 is the first non-StarTAC phone to have the clock. So ? Ericsson owners have had this for several years. Why is mot *always* lagging behind ? It was the same story with CLI, phonebook lookup, standby time etc. etc. etc.

• 16-06-98 Updated the 8700 clock with a scan of how a battery can be added. Added information about the new Lucent 1627 speechcoder (perhaps this will be used to support EFR in the future ?) to the hardware page. Units with this new DSP supports different modes of operations for the loopback test (36#). On most mot phones it is possible to close the flip without disconnecting the call if you press mute while closing the flip (useful with a HF kit). On the new 8900 software (9A.02.12) it just disconnects or even crashes! when this procedure is performed. I wonder if mot will admit that it is a bug or they will call it "a feature". I am looking for information and documentation on Manchester coding of serial data, if anyone can provide me with information, please contact me, thanks.

• 09-06-98 A diagram of a prototype dsc bus driver / receiver is now featured on the hardware page (Thanks AN). It is now possible to download a .zip file containing all the files in the wakeup graphics gallery. Several new Sw versions (19#) have been added to the list.

• 08-06-98 A picture showing how the crystal can be added beautifully on an 8900 is shown on the 8700 clock page. E-Plus traveller (8800) owners that miss the signal strength indicator in the display, can enable it by setting menu bit 168 with MEDIT (Thanks Dirk).

• 01-06-98 Added information about the DSC bus to the hardware page. Cleaned up a lot of typos etc. from the menu page.

• 29-05-98 Updated test mode command 03x# which turns out to be used for testing of the Digital Audio Interface.

• 27-05-98 Testmode command 48xxxx# is slightly different on the 8800/8900. After receiving information on this from Arne, I have updated the command list.

• 22-05-98 ASIM v 3.1 is available. ASIM now supports the COMP 128 version of the GSM authentication algorithms A3 & A8.

• 21-05-98 The "mystery" about the StarTAC's that were able to enter testmode without a card has been solved. The EEPROM contain a factory test flag that motorola for some reason did not reset before shipping the units. Unfortunately, this flag is not contained in the transfer frames. If you have the skills to manually edit the EEPROM, then you can enable the feature. The whole thing is explained in the EEPROM secton of the hardware page.

• 20-05-98 TST has enhanced MEDIT to allow downloading of the graphics from the phone. MEDIT 3.03 is now available on the emulator page. Updated the description of test mode command 11. It has been changed to provide support for GSM-1900 channels. After Ralph stopped by and demonstrated how he added the clock backup-battery to the 8700, I have added a description of this procedure.

• 19-05-98 Corrected a lot of typos and added a section about using the test card to recalculate the configuration block checksum in the EEPROM.

• 18-05-98 Klaas Goossensen of ssp electronics is having a real hard time, understanding that he can't just make word-by-word copies of my work for his own commercial purposes. Everybody that visit these pages regularily knows that I have compiled and put together these lists (with comments, speculations etc.) from scratch. None the less this guy is claiming that he can copy it, since he got it from another place on the net that he will not reveal. Klass, get your act together and stop stealing my work!

• 11-05-98 IMPORTANT NEWS !I AM CHANGING EMAIL ADDRESS. Please contact me at jckrarup@image.dk in the future, since post1 is stopping their free service.

• Old news