From rserling@dfw.dfw.netTue Jan 16 11:24:51 1996 Date: Tue, 16 Jan 1996 04:34:39 -0600 (CST) From: Rod Serling To: phax@exo.com Digital Oblivion Technologies Presents: -- The 4701V3.1 OKI 900 "Roam freely" Modification. -- "Pesky per-minute airtime prices gettin' you down?" ESN/NAM Programming Insructions: This modification stores five ESNs (corresponding to the five selectable NAMs within the phone). The ESNs are stored in the addresses as follows: ESN1: BE00-BE03 ESN2: BE04-BE07 ESN3: BE08-BE0B ESN4: BE0C-BE0F ESN5: BE10-BE13 Upon power up of the phone, the modification checks to see which NAM is set to be currently active (from the Administration Menu on the phone). The phone is then loaded with the respective ESN corresponding to the particular NAM that one wishes to use. Selecting the Auto NAM function will load ESN1. To program the ESNs into the phone, complete the following steps. A) Turn the phone on, and enter debug mode. Key in the following keys. Where there is a '+' press both keys at once. After pressing CLR, the message 'good timing!!' should be displayed. 7+9, MENU, SND, END, RCL, STO, CLR, 1+3 B) Suspend the operation of the phone by entering a '#01' and pressing SND. All debug commands are preceeded by a '#' symbol, which will display a C before the command number. C) Now, to program the ESNs, use the phone's write memory function, and store the appropriate bytes into the addresses listed above. The function number is 54, and the format is thus: #54 XXXX YY - where XXXX is the address and YY is the value. Thus, #54 BE00 82 would store an 82 in location BE00. You do not need to enter the spaces. To enter a hexadecimal letter on the command line, preceed the number by a *. Thus, you would actually type "#54 *2 *500 82". *1 is an A, *2 is a B, *3 is a C, *4 is a D, *5 is an E, and *6 is a F. Store the desired ESNs into the desired memory locations. When you are done, simply enter '#02' and the phone will reset, and load the appropriate ESN corresponding to whatever NAM you have selected. D) Next step, programming the NAM. This is a pretty straightforward step. To enter NAM programming mode, the following code must be entered within 30 seconds after powering the phone on. Enter: RCL+MENU,*,6,2,7,2,9,8,5,4,# E) The dealer NAM programming code will be displayed, and the phone may request that you change it. Ignore this if you wish. Use the phone's earpiece volume buttons to scroll through the NAM programming options. Among various features, you will be able to program all five NAMs on the spot. Program the appropriate NAMs to the corresponding ESNs, and hit 'STO' whenever you are done entering data. When finished completely, review the NAMs, and press CLR several times to exit NAM programming mode. Next, go to the administration menu of the phone, select the appropriate NAM you wish to use, and turn the phone off. When you turn the phone back on, the NAM you selected will be loaded, and the corresponding ESN to that NAM will have been loaded as well. You MUST turn the phone off and on whenever you select a new NAM, as the NAM Selection (1-5) is only checked on power on, and the ESN is only loaded on boot up. If you select a different NAM, and try to use it without cycling the power on the phone, the incorrect ESN will be transmitted. Remember to power off/on after you select a new NAM. Notes and thoughts: 1) Remove the antenna from the phone when programming the ESN/NAM pairs. This will give you the chance to check your errors without accidentally transmitting any info to the cellular system. 2) After entering debug mode (shown above) use #24 to the display the current ESN that was loaded on power up. 3) Also in debug mode, #25XXXX shows the location of XXXX. * and # scroll through memory locations. Use this function to view the contents of BE00-BE13, and make sure that you have entered data for all five ESNs correctly. Always check after programming an ESN to make sure the proper values were stored. Scroll through the locations, and confirm the data. 4) RCL+MENU, *, T,E,S,T,M,O,D,E,# - This is the test feature, accessible at any time from the keypad. As soon as you get the menu, hit the volume level a few times to scroll through the options. One displays the signal strength and some other information. One item shows the current ESN in decimal. Oki's ESN prefix is 129. Note the differences, when dicking around with various ESNs to make sure you've got them loaded in the right locations. If you don't have a handy HEX/Decimal converter, don't worry about it. Still, this feature is fun to play with. 5) Commonly, the default Administration menu access code is 000000, or 123456. The NAM programming code can only be used within thirty seconds of power-on. It is usually RCL+MENU, *,1,2,3,4,5,6,7,8,# I usually set it to RCL+MENU,1,2,3,4,5,6,7,8,9,0 - The backdoor NAM programming code is: RCL+MENU,*,6,2,7,2,9,8,5,4,# - Use this if you can't remember the code. The phone will then display the Dealer password (NAM programming code). Enter NAM 1 programming and scroll through it with the volume buttons. The 'Security' field (usually set to 123456) is the code you need to access the Administration menu. You can set it here if you wish. To wipe all five NAMs quickly, enter the Default Data Set item and hit STO. This will purge all five NAMs, and set the Admin Menu code to 123456. 6) If the phone comes up 'Locked' remember that the backdoor NAM programming code will always work. Use that in a pinch. You can always use 'Default Data Set' to reset all the data, including the Lock code if you need to. Good luck. Rod Serling - June 8, 1994 05:41 AM, PDT.