How to get free Cellular phone calls to a phreind (without using pairs) ======================================================================= DATE : 08/04/96 (With the NEC P3 - A truly great piece of phreaking kit) Well folks, its that time again, yep, i've ran out of beer and coca-cola(tm) and have decided that i should really write a file of some sort, just to bide the time. The contents of this file have not been fully experimented with, so don't blame *me* if you think it doesnt work. The TestMode commands are all absolutely correct (for the P3), and if you know the equivalent commands for another phone, i'd expect it to work for that also. In order to do this you will need a test rommed P3 (STORE 69 chip) or a cable to place the phone into test mode (both of these things are beyond the scope of this document, so if you dont know what the fucks going on stop right now). There are files to remedy this situation, so go hunt. ======================================================================= Don't you just hate it when that happens. Ran out of pairs, the last ones just died in the middle of something important ? Have no fear, so long as you and the person you want to call have access to a P3 each (and a regular fone) then those days are over. All you effectivly have to do is use your P3's as a pair of CB's (sort of). This is relativly easy to do and can be done with the same knowledge it takes to break into calls with the P3 (covered in the test rom manual (currently p3tst004.txt i believe)). Okay, down to the business. Firstly, you and your friend should pre- arrange one channel on which you will both be broadcasting and recieving on. You could do this with the regular telephone line. Then, once thats done, both of you should follow the sequence of test mode commands that follow (i.e.put the fone in test mode first) RCL, * Prime test mode RCL, #, 01 Initialise test mode and wait for more commands RCL, #, 60, 3, # Select audio path, to handset RCL, #, 57 Tx enable RCL, #, 14 Tx-Unmute RCL, #, 07 Enable Tx Carrier RCL, #, 12 Rx-Unmute RCL, #, 32, X, # SAT tone setup, where X is 0,1,2 0 = 5970 Hz 1 = 6000 Hz 2 = 6030 Hz RCL, #, 69, , # once youve pressed #, immediately press * (this stops the scanning on the channel you chose). Allowing for signal strength this method will work, althuogh probably not for data. For the best results you should be in the same cell as each other, the size of which will vary depending upon the density of cell towers (usually ok at about a mile or two). (although the density of cell towers doesnt DIRECTLY effect this use of the P3, it serves as a marker for cell fone ranges - theres a reason they put the cell towers specific distances apart, and its partly to do with the predicted range a cell phone will have in an area). This is it for now then. Group greetings go to ENERGiZER, cold fire, slam-tilt, chase, cyber and any other other agents i forgot to mention whilst writing this file. Knocked up by, ^ ***********================= * * | * Greytor *================= - Agent of a Hostile Power, * * | ***********================= | | ============================ "Flying the flag for foreign hostiles" | | ============================ | | ============================ || || || || If you want to contact me you can email me at greytor@spuddy.mew.co.uk, or one of the boards i call. PGP encrypted email preffered, ask for my key. Alternativly, i do accept psychic transmissions, visions, messenger pigeons, rocks with paper wrapped around, semaphor, morse code, secret transmissions from foreign embassys and telex's from the president. --------------------------------------------------------------------------- EOF.