honeytech

• obilesoft
  stay in touch…………!!!

• join this 4 regular
  
• updates…!!

How To Hack A Motorola GSM Phone

Please note:
Information provided here may cause your phone to malfunction. Modifying the software of your GSM Phone is only a personal choice and shown for amateur purposes only. Commercial attempts based on these hardware and software may be illegal. We do not accept responsibility for any damage whatsoever that may result from reliance or otherwise of the information on this page.

It only needs simple adapter which connects the phone to the PC. The software acts as Test and Clone SIM Cards to enable the editing and transferring of the phone memory contents

Here is the hardware layout of the operation. Interface circuit consists of three transistors and six resistors and so simple to build. It prevents direct connection of the TTL interfaces of both computer and the phone. Computer’s serial COM1 port (usually where a serial mouse is connected to) is used to connect interface with a female connector. Phone’s SIM socket is where the other end of the interface is connected to. A small SIM adapter is used to ease this. It’s a PCB board cut as the size of a regular SIM module and contact points are etched on the copper side of it.

This is as it is on the Motorola V3690 and V2288 and placed in it’s credit card size SIM Card frame to be inserted in d460. Since the cables won’t fit in, I had to open the d460 and fix the card manually inside it. Lets start with the preparation of the SIM adapter. First you need to have a 300 DPI printout of the sim.tif to be copied onto a PCB. If you want a credit card size version to be used on a d460 like phone, may use this one. After the etching process, drill the holes on it and solder the four wires on it to be connected to the interface PCB. Using a thin ribbon wire makes it easy to install into the phone. Taking care while soldering wires to the adapter PCB is important, since a rough soldering may cause short circuits between the contacts of the SIM socket of the phone. Just take a look at the illustration below to get an idea. First, tin the copper layer with a thin coating of solder (do not overheat the copper, otherwise it may be detached from the PCB). Insert the pre soldered wire into the hole while it’s tip is aligned with the surface of the copper layer. Then repeat the soldering to fix the wire into the thin solder layer. If you do it right, there should be formed a smooth contact surface.

This is the SIM adapter PCB

Preventing a rough soldering

Interface PCB is more easy to create. Print out the pcb.tif at 300DPI. Etch the PCB and drill the holes, then solder the components on. Transistors are not critical, as long as their specifications are close to each other. Take attention to the lead order of them.

PBC design for ASIM interface

Here is the completed interface and SIM adapter

You’ll probably have to open d460 to insert the thick adapter with the card

Placing adapter in V3690 and connecting interface to COM1

With the basic skills of amateur electronic, upon completion of the parts (Adapter and Interface) now you may be able to connect your phone to your PC. Insert SIM adapter into the phone, connect Interface to the PC and run the SIM card emulator ASIM 3.1 written by the ANDROID.

Notice that there are wrong PCB designs in the ASIM package. So use the one I gave above. Apply +5V to the Interface (in fact it runs without this external +5V, I tested this on d460, V2288 and V3690 successfully) and load a SIM file into the emulator (preferably sim.dat) and start emulation.

Turn on your phone and enter the pin stated in the sim.dat file. By holding the # key for three seconds, your phone will be in the ‘Test Mode’. Note that if your phone is locked to a specific service provider, it will ask for a special code. In this case, you may try to remove it (only on older phones) or jump directly to the step: enabling permanent test mode. Now you can use test mode commands described on the Janus’s pages.

Here you can find a copy of the list. With clone.dat, you may enter into the Clone Mode and transfer frames from the phone memory into your computer. I’ve backed up all five frames this way before making any changes to my d460. But V3690 and V2288 only permits the transfer of first two frames and even they are incomplete, so making any changes on new phones have much risk. With the Medit software, you have the chance to translate the contents of the frames into the human readable text.

Here are some features added to my V3690, which were not on the original state.

It is also strange that V2288 has a Clock with Date, just like in V3690 and it is easily enabled by the keypad command ppp123p1p (letter p stands for the square character displayed by holding down the * key)

After Permanent Test Mode is enabled, it becomes easy to use pppXXXpXp type commands whenever wanted.

For example use ppp278p1p to enable EDIT MUSIC RINGTONE … Please remember that enabling a function that does not actually implemented on your phone may lock it.

Some of the enabled hidden features on the V3690, of course internet access is not possible

V2288 not only has FM Radio, it also has the clock with date …

If you carefully read through the user manual of the ASIM, you may try to transfer factflag.bin frame into your phone to enable ‘Permanent Test Mode’ which makes it possible to enter Test Mode by holding down the # key for about three seconds, whenever wanted, without the need of the special Test Card or the emulator. Also you can remove the SP-Lock from the phone (only worked on the d460, not on the V3690 and V2288 so do not try) with the spunlock.bin frame.

Once the Permanent Test Mode enabled, you can shut the phone off, remove the adapter and exit the emulator.

Turn the phone on (with your own SIM Card inside) then use it’s keypad to enter the codes essential to enable Engineering Field Options menu: ppp000p1p ppp001p1p ppp070p0p ppp113p1p . Now there should be a new menu item in your phone’s tree, ‘Eng Field Options’. There you can found many parameters belongs to the network, active and passive mode operating status of your phone. Parameters are explained in detail on the Janus’s web site so I do not include them here.

Only a few of them are interesting to mention here: While a call is active (it is determined by the timer displayed on the screen, set by the ‘Show time per call’ menu option) enter the engineering menu (you may call a toll free service to do this, but check if the timer is displayed, otherwise a ‘Busy, try later’ message appears). Find the item ‘TimeAdv’ and note the displayed value near it (for example: TimeAdv 08). Since the GSM system works on a very high frequency, it is needed to adjust the delay of the signals travel between the radio station’s antenna and your mobile unit.

Thus this parameter exists which is obtained by dividing a proposed maximum communication distance of 35 kilometers into 64 units. It results in 546.875 meters per unit (practically accepted as 550 meters). With the example above it corresponds to 8 x 550 = 4400 meters and this gives the minimum distance to the radio station’s antenna from the point you are at. Since the next step is 9 x 550 = 4950 meters, you can predict that you are at somewhere between 4400 and 4950 meters distance to the antenna.

Active cell parameters belongs to the current cell your phone is listening to. RxLevel indicates the received signal strength of the active channel in dB. Cell ID parameter can also be read from the System Parameters menu. This way you may have an idea on how many active cells are commonly listened by your phone where you are living.

Active channel and Cell ID numbers

You may trace the six most powerful adjacent cells, which are candidate for a cell switch, in case your current signal loses it’s strength. There may not be six cells in the list all the time, only detectable channels will be displayed. These may also not strong enough, for example a message ‘Not Synched’ tells that the channel is detectable but the digital signal cannot be decoded properly yet.

‘Not Synchronized’ and ‘Broadcast Control Channel Decoding’ conditions

Do not hesitate to e-mail me for questions that their answers cannot be found here or in mentioned source pages. If you have more data on the subject, or achieve improvements in modifications, I will be glad to receive information from you.

Free Tools

• Youtube Downloader

• Find Domain age,Pagerank,Valid Pagerank, Directory Listing,Indexed Pages in Search Engines,Web Archive, Alexa Traffic and Graph

• Free RapidShare and MegaUpload Search Engine

• Watch Live Tv

You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.