Cellular Phone File - #1 written, created and tested by Count Zero {CHiNA} This simple (?) mod has been tested on the: UNIDEN CS-1000/1200 Series Cellular MPPS Red 12/13 (Pretty much same as above model) and has proven effective for over four months running. However, (yes, here comes the big disclaimer...) ---------------------------------------------------------------------------- D I S C L A I M E R CHiNA and its members claim no responsibility for irresponsible use of the information and designs contained herein. This file is being presented on a "for knowledge's sake" basis to the members of the modemming community at large. Any use of this file except for educational and operational efficiency purposes is hereby forbidden. So there! The Conflict * Maxwell Smart * Count Zero * Monalisa Overdrive * The Viper & Rubiks the Cube ---------------------------------------------------------------------------- What this mod does is prevent a correct unit identification code (called UIC from here on) from being transmitted. The messages sent to and from the local transmittal stations should be surpisingly familiar to any one of our readers. But here's the mod and a bit of theory that I used to discover it. (1) Your individual UID is "burned into" a simple 8x8 EPROM that may be erased and "re-written" to accomodate a new code. This may be difficult, and in fact IS difficult because you will have a lot of trouble finding where it begins and ends. (2) The contact sequence when you first power up the unit (which usually goes on while the handset's "NO SERVC" or "SVC UNAVAIL" is lit) goes like this: YOU A0 A0 A0 A0 A0 A0 A0 A0 IT ACK or NAK (up to a max of 4 times) YOU 12 3A + UID IT 12 3A + UID YOU ACK or NAK IT 00 00 00 or FF FF FF (Available / Not Available) The best route to handle this is to FORCE your system to ACK when asked if a false code is its code. The following should outline the procedure: You will need: * A Temperature-Controlled Soldering Iron * Rosin-Core Solder * Solder wick (for you slobs) * Pair of Diag-Cutters (or wire-cutters) * About 15 minutes of time. Step 1 - Unplug the unit and allow to sit for at least a half hour to allow all capacitors to become completely discharged. Also, as a precaution, "discharge" yourself on a common ground (no woolly socks, ok?) Remove cover from "handset" portion (yes, the one with the keypad) Step 2 - Locate the indicated EPROM should have a serial number that begins with an "IA" prefix and will be noted on the circuit board as "IC4" or "IC5". Given this knowledge and the following picture: +5v -!-------!- GND -! IA... !- RST -! !- +1.5v -! !- IC4 D1 -! !- D5 D2 -! !- D6 D3 -! !- D7 D4 -!-------!- D8 ...you should be able to find it. Step 3 - Cut the D1 pin and pull completely back from the motherboard at a 90 deg angle. This will not interfere with your system messages but will disable any "odd number" from being sent! Thus your code alone will come out false. Step 4 - Locate the following components: R14 - Resistor #14 1.5 ohm Cut and jumper with solder and small gauge wire R15 - Resistor #15 3.5 ohm Cut and replace with 1.5 ohm from previous step C22 - Capacitor #22 Cut and leave out! Now make sure you have no "cold" joints and all soldered points are secure! If you are going to screw up at any point in the procedure, this will be it. Make sure to double-check your work! I don't want anyone weeping to me because their handset if now fused to their right ear! Step 5 - (explanation of Step 4) This step "forces" the system to send an ACK (by routing the NAK trigger through ACK output) and thus verifying the bogus code. Step 6 - Reassemble handset. Just a hint, do NOT go overboard on your calls as these calls are not free, they are just being billed to another person's code (if it is a legit code) Again, re-read the disclaimer. Step 7 - Operate the unit normally. TROUBLESHOOTING: Problem Solution * NO POWER Be sure all power leads were reconnected correctly when you put the handset back together. * STILL GETTING CHARGED FOR Cut the correct pin from the IC! CALLS If still getting charged, cut D2 as well though this may be risky. * CALLS "CAN'T BE COMPLETED" Recheck mods made in Step #4. AS DIALED or SYSTEM UNAVAILABLE Well, this should get you started. A few notes before I go: Thanks to The Conflict (for the inspiration), Maxwell Smart (for that "Smart" report on Operation Wolf), Monalisa Overdrive (for letting me call him repeatedly while testing this mod out!), Lord Blix (for the cracking help when I needed it), The Viper (because he wants to be thanked) Call on of our CHiNA nodes today for the latest in "knowledgable" text files unlike other groups... OVER AND OUT ---------> COUNT ZER0 ! +- Shamelessly Leeched from The Mudd Club -+ Press a key...