Ericsson phones
{ MC16, 198,218,337, 318, 368, 388, 688/628, 768/788/788e, A1018s }

MC16

Wiring of the Synchronization cable and a null modem cable.

The "pins" of the synch contact on the back of the MC16, are numbered 1 to 10 from left to right, when you look at the backside of the MC16, holding it with the keys up and the bottom down.

MC16 Synchronization cable Zero modem cable
RS 232 Signals MC16 port MC16 contact DB9F DB9M DB25M
DSR, DCD 1 1 4 4 6,8
RD 2 2 3 3 3
TD 3 3 2 2 2
DTR 4 4 1,6 1,6 20
GND 5 5 5 5 7
  6 6      
RTS 7 7 8 8 4
CTS 8 8 7 7 5
  9 9      
  10 10      

198

To view IMEI number *#06#

218/337

To view IMEI number *#06#

After entering this mode, the < and > keys scroll through a menu. There seems to be different menus for different versions of software.

Software version number are apparently a date and time stamp.

940810 1310 version commands:

TEXT CHECK - shows 254 messages in current language

INIT EEPROM MMI - resents NVRAM settings (User Settings).

Other, probably more recent version:

FLASH - will restart the phone, to the point of entering PIN numbers.You can't kill a 337 when pressing YES while it says "FLASH?", you must connect it to 5/12 volts first to be able to erase the flash-memory.

1-ROW TEXTS - scroll through 174 single line text messages with < and >

n-ROW-TEXTS - scroll through full-screen messages with < and >

950626 1405 version commands:

CXC (number) - The Application software's "product number". The GH337/GF337 is always "CXC 125 005"

PRG - Indication for Programming

318/388

To view IMEI number *#06#

The Latest Software Version is under Phone Info.

To view Software Version enter -> * <- <- * <- * CLR (Use with Care)

368

Try these Codes on your DH-368 phone:

1) Power on.
2) Press 904059 + 'MENU'
3) 'TEST SET' display ...
4) Press 'YES' will display @ then press 1 'RCL' will turn light off
and you will see 'DONE'
5) Press 'YES' will display @ then press 86 'RCL' display 'DONE'
also you will hear static...
You can just enter the channel number (up to 1023) by pressing
'Yes' 3 'CLR' XXXX - channel number to enter a channel directly.
You can also see the signal level on channel by pressing 3 'MENU'.
You can see the ESN number by pressing 'YES' 1 'RCL' 96 in HEX format.
6) Press 3  to exit, now you phone will power down and power up again.
You can install the phone number into the phone by pressing 923885 + 'MENU'

688/628

To quickly reset menu language to English, simply type:

*#0000#

To see the Full Network Name:

Go to the Network menu when the phone displays the networks available press * and it will show the full name.

Pin-Outs: Bottom view, keyboard up,
counting from the right

1 = + external power supply (7.2Volt - 600mA)
2 = RS232 input (TTL)
3 = GND (digital)
4 = RS232 output (TTL)
5 = +5V output
6 = Test (0=Normal - 1=test mode)
7 = Mute
8 = Internal/external mic and ear (0=External - open=Internal)
9 = GND (analogic)
10 = ?
11 = BF in
12 = BF out

To check the phone's software (firmware revision information) type:

>*<<*<*

Information Provided:
CXC125065 - 1st line: Cell phone's internal product code.
PRG
970715 1515 - 3rd line: Firmware revision (date & time stamp).

Note:
Latest known software version is: 
980114


For shortcut for Last Dialed call menu type: 0#

To check the battery level when the phone is off and not charging, press very quickly
NO and wait for 2 secs.

To see the Full Network Name: Go to the Network menu, when the phone displays the networks available press * and it will show the full name.

To view the full operator list: Go to the 'Edit list' menu under 'networks'. The phone says 'please wait'. When finished, Press the < key once, then YES twice. Now the full list show be displayed. Browse through the list using the < > keys.

 

Pinout of the GA628. Bottom view, keyboard up, counting from the right:

1: Charger plus.
2: Serial input.
3: GND
4: Serial output. Debug messages appear here at 112KBaud when in debug mode.
5: +5V out ? Sources over 100mA.
6: Digital Input. Phone enters debugmode when tied to +5V at power-up.
7: Digital output. High when calling. Could be off-hook signal.
8: Enable external mike and speaker, connect to GND to do so.
9: GND
10: Enable external mike and speaker, connect to GND to do so.
11: External microphone.
12: External speaker, very small signal (10 mV)

All signals seem to be at 5V logic. Most debug messages are text. Like "CB ok!" etc. Debug messages are trailed by 0x0A, 0x0D. Power-up means removal of battery, reconnection of battery, depressure of "NO".

Command set

The following commands are recognised:

AT+GMI  Manufacturer identification
AT+GMO  Request model Identification
AT+GMR  Request revision Identification
AT+GMM
ATDxxx; Dial number xxx (note the semicolon (;))
ATH     Hangup phone
AT+CFUN=? Define levels of fuctionality in the order of power consumed
AT+CBC  Query battery level

Interfacing circuitry

TTL signal levels are use on the data pins of the GA628. Probably the easiest way to generate TTL signals outof a serial port is by removing the RS232 levelshifters (1488 1489 or alike) from the serial board inside your computer !


SMS Character Set
				b7 	0 	0 	0 	0 	1 	1 	1 	1 
				b6 	0 	0 	1 	1 	0 	0 	1 	1 
				b5 	0 	1 	0 	1 	0 	1 	0 	1 
b4 	b3 	b2 	b1 	   	0 	1 	2 	3 	4 	5 	6 	7 
0 	0 	0 	0 	0 	SP 	D   	SP	0 	@ 	P 	¿ 	p 
0 	0 	0 	1 	1 	£ 	SP	! 	1 	A 	Q 	a 	q 
0 	0 	1 	0 	2 	$ 	F   	" 	2 	B 	R 	b 	r 
0 	0 	1 	1 	3 	¥ 	G   	# 	3 	C 	S 	c 	s 
0 	1 	0 	0 	4 	è 	L  	$   	4 	D 	T 	d 	t 
0 	1 	0 	1 	5 	é 	W	% 	5 	E 	U 	e 	u 
0 	1 	1 	0 	6 	ù 	P  	& 	6 	F 	V 	f 	v 
0 	1 	1 	1 	7 	ì 	Y   	' 	7 	G 	W 	g 	w 
1 	0 	0 	0 	8 	ò 	S 	( 	8 	H 	X 	h 	x 
1 	0 	0 	1 	9 	Ç 	Q   	) 	9 	I 	Y 	i 	y 
1 	0 	1 	0 	10	LF	X   	* 	: 	J 	Z 	j 	z 
1 	0 	1 	1 	11	Ø  	SP	+ 	; 	K 	Ä 	k 	ä 
1 	1 	0 	0 	12	ø 	Æ 	, 	< 	L 	Ö 	l 	ö 
1 	1 	0 	1 	13	CR	æ 	- 	= 	M 	Ñ 	m 	ñ 
1 	1 	1 	0 	14	Å 	ß 	. 	> 	N 	Ü 	n 	ü 
1 	1 	1 	1 	15	å 	É 	/ 	? 	O 	§	o 	à 

Notes:
SP Space
LF Line feed (in GSM this implies a carriage return/line feed
combination)
CR Carriage return is forbidden by the TAP protocol and cannot be
included in the message text.

Hidden menus
        Go to MissedCall
        Empty the list
        Press the -> key for a second or two
        The option Menu size turns up
        Choose 'yes' and go from there.
        
        An alarm clock turned up too but it never rang. I think this was
        because there is no clock in the phone.

        Try to type this in your Ericsson:
        >*<<*<*
        where < is the left arrow and > is the right one

768

Tips & Tricks

Edit Greetings Tip.

1. Go to the Keylock menu.
2. Set lock to Auto.
3. Press YES then hold the left arrow untill the Greetings menu appears.

GF788 menu in your GF768 phone!

1. Go to the EDIT MENU and press YES.
2. Type the number "2" and press YES.
3. In "NAME" HOLD DOWN the "2" key untill the number "2" apperars. Press YES.
4. Press YES again (to save any position) then QUICKLY press
and hold left arrow (<) untill "SIZE" appears in the display.
5.Press YES and choose "Full size". You now have the GF788 menu!

NB. Confirmed working on version 970716 and 980318.

GF788 menu in your GF768 phone!

1.Go to MissedCall
2. Empty the list
3. Press the -> key for a second or two
4. The option Menu size turns up
5. Choose 'yes' and go from there

NB. Confirmed working on version 990122.

GF788 menu in your GF768 phone!

1. Go and set the ring volume and press yes.
2. When 'STORED' is displayed - keep the right button -> pressed until 'Extended Menu' is displayed.
3. Select "Activate" the menus and you now have lots of extra features

NB. Confirmed working on version 980910

The tricks hasn't been confirmed yet (works?)

Lastest Firmaware
Lastest Firmaware version: 990317

To quickly reset menu language to English, simply type:

*#0000#

To see the Full Network Name:

Go to the Network menu

when the phone displays the networks available press

* {and it will show the full name}

Pin-Outs: Bottom view, keyboard up, counting from the right

1 = + external power supply (7.2Volt - 600mA)
2 = RS232 input (TTL)
3 = GND (digital)
4 = RS232 output (TTL)
5 = +5V output
6 = Test (0=Normal - 1=test mode)
7 = Mute
8 = Internal/external mic and ear (0=External - open=Internal)
9 = GND (analogic)
10 = ?
11 = BF in
12 = BF out

To check the phone's software (firmware revision information) type:

>*<<*<*

A1018s

(UN)LOCKING YOUR ERICSSON A1018s TO SPECIFIC NETWORK :

A way to (un)lock your cell phone on to the network:
1. Press : <**<
2. Then on the display appear and give you two choices:
Lock to Network ? and Lock to Network subset?
3. Enter the NCK number (code is provided by the SP)
4. You have 5 attemps to do this
5. Then your cell phone will work 'only' with the network

New Ringtone Software

Gh688.exe [~38kb]
Want to test the melodies for your ericsson gh688 phone before typing it into the cellular? This DOS program will do the trick!

Musicbox.zip [~139kb]
MUSICBOX 1.0b3 from Cosmos Software
Great little Windows program for testing you ericsson melodies before typing them into your phone!

SP unlock Software

Erclear.zip [~1,6 Mb]
Program for unlocking SP lock on Ericsson phones (6xx and 7xx series)
Your phone needs computer<->phone cable to work. [ Reported working on 628 and 788 for sure ]

Eric.zip [~1,6 Mb]
Program for activating/deactivating RBS, Calc, SP lock on Ericsson 337, 388, 318. How to build Cable instructions included.

Erserv32.zip (v1.8) [~250 kb] New Version
Program for activating/deactivating RBS, SP unlock, IMEI change on Ericsson 388, 318, 628, 688, 788
How to build Cable (6xx/7xx) instructions included.

Showlock.exe (v0.2)  [~250 kb]
Program for getting the NCK, NSCK, CCK and User Lock
from Ericsson phones. Just download the entire EEprom from the phone and save it as .bin file (8192 bytes). Run Showlock.exe and Select the file.

EEprom [~10 kb]
BIN files (Eeprom dumps) for use with eeprom upload programs like Erserv32.

688788.zip [~80 kb]
Activate Test mode on Ericsson 6xx and 7xx phones.
The program only needs a ericsson cable.

A1018s.zip [~80 kb]
Activate Test mode on Ericsson 6xx and 7xx phones.
The program only needs a ericsson cable.

T18.exe [~80 kb]
A Unlock Code viewer for 6xx, 7xx, 8xx, T18, A1018s phones. (Cracked version)

PLEASE NOTE that's this program is a Dummy ! 

T18 tried with two phones newer than 99w23. Software recognize them, then it writes "Wait, working..." and something really funny messages pops up. Something like: "check if your cable is short enough", "check the color of your phone (don't use the cable of same color as your phone)", etc.

Ericsson DH-3xx/vi

-codes-

923885[Menu] NAM programming
904060[Menu] Reset phone
904080[Menu] Title blink
904090[Menu] TestMode on/off
904059[Menu] Test Set

Ericsson Test Set

Test Set Codes

Known commands:
(dunno what the data's say)

1F Mode Set
2F Mode Set

27 Some Data (2*param=00..99)
28 Some Data (4*param=00..FF)
38 Many Data
3A Some Data
3C Set Channel Number
(in mode 1F) (4*param=0001..1023)
3D Show RX Level
3F Reboot
4F Exit
5F Some Data (XXXXXXXXXXh)
63 Some Data (XXXX)
73 Copyright
83 Set Channel Number
(in mode 1F) (4*param=?001..?31F)
85 Speaker Off (in mode 1F)
86 Speaker On (in mode 1F)
8B Show TX Level
94 Many Data
95 Some Data (XXXXh)
96 ESN num in hex (XXh-XXXXXXh)
AA Tone (in mode 2F) (2*param=00..FF)
E2 Reset Phone
E3 Reset Phone
E4 Some Data (2*param=00..03,..,90..93)
E5 Check Screen (2*param)
E6 Some Data (2*param=00..99)

UnKnown commands:
(dunno what they do but this is what they say...)

22 Param (2*param)
29 Done (6*param)
2B Error (8*param)
2C Done (4*param)
2D Param (6*param)
2E Param
30 Error (16*param)
31 Error
32 Error
34 Error
35 Error (7*param)
37 Param (>100*param)
39 Done (4*param)
3B Done
60 Error (42*param)
62 Done (6*param)
64 Done (2*param)
65 Done (2*param)
66 Done (2*param)
69 Done (6*param)
72 Param (6*param)
74 Error (6*param)
77 Error (6*param)
78 Done (2*param)
80 Done
81 Done
82 Done
84 Done (2*param)
87 Done
88 Done
8C Done (2*param)
8D Done (4*param)
8F Done
90 Done
92 Error halts (2*param)
98 Error
9A Error
9B Error
9E Error
A0 Done (2*param)
A1 Done
A2 Done (12*param)
AB Done
AC Done
AD Done
E0 Done (4*param)
E1 Done (6*param)
E7 Error
E9 Param
EB Done (2*param)
EC Done (12*param)
ED Done
EE Done (8*param)
EF Error (2*param)
................................................................................................[ pokraèování ]