Motorola As A Cell Scanner

[Vishal Gupta 4]

Hi guys

i dont know for which model this method is?

i found it on a website.

so i posting here.

hope techies can find something interesting in it.

You can make your Motorola into a cell scanner. The hardest part is grounding

the right pin. Grounding this pin will put your phone in test mode. On most

flip phones there are 3 pins visible when you remove the battery. The center

pin is visible but will not make contact with the center pin on the battery.

You must have a rechargeable Motorola battery or a battery that has an

metallic contact on the center pin of the battery. To put the phone in test

mode, take a piece of aluminum foil and role it into a strip big enough to

fit into the gap in the center pin on the phone. Make it large enough that

it protrudes above the plastic of the phone so that is makes contact with

the center pin of the battery. Make sure that it is not too small and falls

into the phone! Once you have placed the foil, turn on the phone (unlock it

if needed). Numbers are displayed 1 screen full then it quickly flashes to

the next.

CHAN \/ PWR LVL

x x x x x x <--Rx Sig Strength, 00-99

SAT -->x x x x x x x <--1=TX Audio OFF

^ ^ ^ ^

1=TX on <-- : : : : 1=RX AUdio OFf

1=SigTone ON : : 1=Control Channel

Press the # key. The phone should display US, or something like that. Now

to scan cell phone channels you enter the following:

When you enter 11xxx# the xxx = the channel number not the frequency.

I will provide a list of frequency to channel number at the end.

353#-Select Handset audio path

08#-RX Audio ON

11xxx#-Three digit number,

e.g. 11362#

11xxx#-Change to another channel

Be very careful with the rest of the codes because some could mess up the

cell system and some could erase your phone! The codes will work with all

Motorola phones because grounding procedures differ.

01#-Restart (Turns unit off and back on)

02#-Display current radio status (non-scrolling version

of above display)

04#-Initials Unit to Standard Default Settings:

-Carrier OFF

-RF Attenuator to max power

-Receiver Audio Muted

-Transmit Audio Muted

-Signaling Tone Off

-Resetting of Watchdog Timer Enabled

-DTMF and Audio Tones off

-Audio path set to speaker

05#-TX Carrier ON

06#-TX Carrier OFF

07#-RX OFF (Mute RX audio)

08#-RX Audio ON (Unmuted)

09#-TX Audio OFF

10#-TX Audio ON

11(CH No)#-Sets to desired channel

12#-Set power to x; 0=max 7 = min

14#-10 Khz sig tone on

15#-10 Khz Sig tone off

19#-Display software version number (4 digits)

25x#-SAT Tone on when

x=0, SAT = 5970 Hz

x=1, SAT = 6000 Hz

x=2, SAT = 6030 Hz

26#-SAT Tone off

27#-Transmit Data

28#-1150 Hz Tone on

29#-1150 Hz Tone off

30#-770 Hz Tone on

31#-770 Hz Tone off

32#-Clears all timers and resets User's programmable features to standard,

also clears user stored memory.

33x#-Turn on DTMF Tone for X, X = 0-9, * or #

34#-DTMF Tone(s) off

35#-Display RSSI ("D" Series portable only)

35x#-Set Audio path to xx = 0, VSP mike (mobile only)

x = 1, speaker

x = 2, Alert

x = 3, Handset

38#-Display ESN in Hex, 2 char at a time, use * to step

(Compandor OFF (D series portable only))

39#-Compandor on (D series portable only)

41#-Enables Diversity (on f19cta series only)

42#-Disables Diversity

43#-Disable Diversity

44#-Disable Diversity

45#-Display current rssi

46#-Display cumulative call timer

47x#-Set Rx audio level, 0-7

i.e. 474# is mid level

48#-Set side tone on

49#-Side Tone off

53#-Enable Scrambler option when equipped

54#- Disable scrambler

55#-Programming customer/system information

Enter 55#, display shows U5 '

Enter 55# again, proceed as if you've followed the sheet included with the

phone. This allows one to change the phone params an infinite number of

times. However, some of the info is not in sequence with the sheet provided

with the phone.

58#-Compandor on

59#-Compandor off)

61#- Serial number transfer (for dmt/minitac only) (See Esn transfer procedure elsewhere)

62#-Turn on ringer audio path

63#-Turn off ringer audio path

70#-Abbreviated field transmitter audio deviation command

71#-Abbreviated field power adjustment command

72#-Field audio phasing commands

73#-Field power adjustment command (dmt/minitac only)

[Mahidhar 3]

hey code and static, only the two of u can make sense out of this try figuring it out !!

[StaticElectricity 8]

well, basically, what we are doing here is called packet scanning.

since all phones (GSM & CDMA) use a packet based communication system instead of a live line,

by saying a live line, i mean like radio, which has a specific frequency for each station, whereas in GSM & CDMA, the provider (eg Reliance) has got a specific frequency of operation like 400MHZ for example.

next, each phone gets a sideband(sort of) like 385.35Mhz and the next 385.36 MHz. but mostly a few phones use the same sideband (* a few)

and then they send packets, with headers which identify the phone to the service providers tower.

so basically what is written above, enables us to scan for other packets in a specific sideband thereby enabling us to scan other phones using the same frequency.

though from the above post, i cant figure out wheather it's for motorola GSM or motorola CDMA.

moreover, shorting different pins may DAMAGE THE PHONE BEYOND REPAIR!! so be careful before trying out such stuff.