

                         P3 Test operations and more.

                         ============================



Orignal Text file name for Upload is P3TST001.TXT (P3 TeST Manual) compiled

and uploaded by Jono Bono (or soon to be just Jono) if you have any further

information to contribute please add it then re-upload this file as the next

avalible number. i.e. P3TST002.TXT etc.



To SYSOP, please ensure any future uploads and amendments of this file have

been done correctly. i.e. The file is still laid out in the same way with

all instructions including this top section. Thanks ....JoNo.



*** If you have examples of how to make use of some of the comands, please 

add them to the end of this file under the "Notes and Examples" section or 

put them in another file ***.



ALSO... Please keep this file as basic ASCII (i.e. keyboard ASCII text, only) 

and keep each line to a maximium 77 chars (i.e. last character in a long line

would be in column 77 on your text editor), so that users of all different 

systems can view it and edit it.



If you want to print this file then you may need to space it into 66 line

pages (dependant on Printer and/or System). Please "do not" include this

spacing in any altered files that you may re-upload.



**** leave the above intact and change the line below if you re-upload ****



Current File = P3TST001.TXT dated 24/09/94 uploaded by Jono Bono (Jono).

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^



Useful information that relates to the modified test chip avalible for the 

NEC P3 mobile phones (May not cover all avalible commands).



Please note: The contents of this entire document are for informational 

purposes only and must not be used to break any laws, if you use any of 

this information you are soley responceable for you own actions. OK!



Here are some of the new and most useful commands.

==================================================



To enter the phone's serial number and phone number.

----------------------------------------------------

Power On, Enter ESN (11 digits) on keypad then STO 69, the phone should 

now switch back to the display. (DO NOT enter eleven 0's sto 69, this will 

disable the phone completely and beyond normal reset, can be useful <grin>).

Note: If you ever need to use the eleven 0's then don't throw your phone

away as there still are ways to reset it.



Then press RCL *, RCL # 01 (test mode entered), RCL #71 and the phone 

number will appear. Just enter the new phone number.

i.e. providers code (4 digits) and then number (6 digits). 



The provider code translations are as follows; 

(please add to this list and re-upload this document, thanks).



(0374) = 2345 (VodaFone) System A.

(0378) = 2343 (VodaFone) System A.

(0831) = 2344 (VodaFone) System A.

(0836) = 2340 (VodaFone) System A.

-----------------------------------

(0585) = 2349 (Cellnet) System B.

(0850) = 2346 (Cellnet) System B.

(0860) = 2342 (Cellnet) System B.



Press # for the rest of the phone menu or just to ensure that the number has 

been stored. The only other item that needs to be changed is SYS=A or B. 

You can also change the real numbers prefix, but this is only for "real" 

number display purposes on the function command. i.e. FCN 33 will display 

0836-XXXXXX or whatever, but the phone's number according to the cell 

system is really 2340-XXXXXX. You may also wish to play with the other 

settings, but please note the originals before doing so. 



Once you have altered all of your settings, (note pressing # stores the

setting, and moves to the next) press and hold CLR once the display is

blank, press RCL # 02 to reboot the phone. Alternatively, you can just

press PWR to turn it off, and PWR to turn it back on.



Any further information on these extra options will be appreciated. 

(Please note them here and re-upload this document).



The lock code is obviously just the phone's lock code, however, it doesn't

serve much good with a modified P3 rom, since one can jump into test mode

from full lock! And then change the lock code....(You must enter test mode

by pulling out the battery, and quickly putting it back in.)



Home area has many possible values, however, for the purpose of the general

Cellphone Phreaker, only three are used. If you have a Vodafone ESN^MIN

pair, then enter 02051 here. This essentially means that you can receive

calls on the other person's number.....The other values for home area are

simply to tell the Cell where you live in the country. If you have a

Cellnet ESN^MIN pair, then enter 03600, and if you don't want to receive

calls, enter 00000. Note that if the other person has there phone turned on

at the time that you use yours for incoming calls, then the Cell will

automatically kill the ESN^MIN pair.



Roam is for future use, and will not be used....It is basically for phones

with Dual Nams, so they can use both Cellnet and Vodafone on the same

ESN^MIN pair.



Timer SW. This should always be on Voice CH. This is basically how the Cell

will charge you fo the calls.....Voice CH works on both Cellnet and

VodaFone, but Charge RT only works on Cellnet....This tells you how many

units you have spent (Using FCN 1 menu.)



Priority should basically be set rather high. If your local Cell is busy,

and there are no free cells, and you have a priority of 15, then someone

else will be disconnected, and your call will be allowed!



Call Timer. This serves little for the Cellular Phreaker. It is best to

leave this on Call Out. The function only is significant to those who

actually pay the phone bill!



To make the phone scan all avalible channels (Voice only).

==========================================================

Later in this document will be some test commands, to enter test mode on 

the modified chip you will always need to enter the ESN again, then RCL * 

and RCL #01 for test mode. (NOTE: There is a faster way of entering the test 

mode by simply removing the battery and quicly putting it back, the phone 

will go into test mode.)



To Scan (Once in test mode) press RCL # 12 (Speaker on), RCL # 69 then 4 

digits (channel to start), then # (see this option in test manual text later 

in this document for more details). Use * to pause.



i.e. If you enter 0001 as the channel, the phone will start scanning each 

channel from 1 to 600 and then 1329 to 2047. As soon as you hear voice you

can press * to stay on that channel and * again to move on.



Start of Test Commands.

=======================

These are listed as they are in the test manual, but please note that some

commands may be different or act differently due to the modification on the

chip.

---------------------------------------------------------------------------

Taken from DCU: 0708A

Top of page reads: 147-102650X322A  TR5E1320-22A  APPENDIX A Test commands -

                   - through keypad.



NOTE: Enter each command by pressing RCL key, # key, and the proper command

number. Some commands require additional numbers after a hyphen followed by

the # key.



    RCL, #, Number

    RCL, #, Number, Additional Number, #



When you enter the commands through the keypad, always give SUSPEND command

(RCL, #, 01) before you press other commands except STATUS (RCL, #, 03) and

STATUS REPEAT (RCL. #, 61, 1, #).



0---------------17--------------33-----------------------------------------77

^               ^               ^                                           ^

Above is the coloumn ruler where each of the next sections starts and ends.

Most remark paragraphs start at col 33 unless the Function name is long, then

it will start at 1 or 2 spaces after the Function name. Notice that no chara-

-cter is placed after col 77 (max).



Key Entry       Function Name   Remarks

=========       =============   =======

RCL, #, 01      SUSPEND         All dots come on (not on Modified test chip)

                                It terminates the normal mode, performs 

                                initialization and awaits further test 

                                commands.



RCL, #, 02      RESTART         It teminates the test mode, enters the normal

                                mode and restarts the call processing tasks.

                                You hear a wake-up tone and momentarily the

                                phone number appears on the display. You are

                                now at receiving standby mode (normal mode).



RCL, #, 03      STATUS          It shows the status information of the unit 

                                by 16 digits on the display.

                ----------      ----------

Example:            119110          AAABCD

                0003100363      EFGHIJKKKK

                ----------      ----------

Where:          AAA: Shows RSSI (Receiver Signal Strength) Value ranging from

                     000 through to 255 (3 digits).

                B:   Shows RXM (Receiver Audio Mute) or Receiver audio gate

                     on/off. 1 = muted or gate off.

                C:   Shows TXM (Transmitter Audio Mute) or Transmitter audio   

                     gate on/off. 1 = muted or gate off.   

                D:   Shows WS (Word Synchronization) in FOCC. 1 =WS acquired.        

                E:   Shows B/I (Current state of the busy idle bit of FOCC).

                     1 = idle  0 = busy.

                F:   Shows CARR (carrier) on/off. 1 = off.   

                G:   Shows ST (Signalling Tone) on/off. 1 = ST on.   

                H:   Shows SAT (Supervisory Audio Tone) on/off. 0 = 5970Hz,  

                     1 = 6000Hz,  2 = 6030Hz  and  3 = No SAT.

                I:   Shows MODE. 1 = Control channel,  0 = Voice channel.   

                J:   Shows Transmission Power Reduction Level.   

                           0 = No reduction.

                           1 = No reduction.

                           2 = No reduction.

                           3 = -4dB.

                           4 = -8dB.

                           5 = -12dB.

                           6 = -16dB.

                           7 = -20dB.

                KKKK: Shows Channel Number, ranging from 0000 through 0600 &

                      1329 through 2047 (4 digit).



RCL, #, 04      RESET           Reset the autonomous timer to zero.



RCL, #, 06      INIT            Initialize the transceiver unit to the 

                                following state; 

                                Carrier off.

                                Attenuation 0dB.

                                Receiver-Audio muted.

                                Transmit-Audio muted.

                                Signaling Tone (ST) off.

                                Autonomous timer reset and it's periodic.

                                SAT off.

                                DTMF and Audio tones off.

                                Received-voice Volume Max.

                                Compandor off.



RCL, #, 07      CARRIER-ON      Turn the TX carrier on.



RCL, #, 08      CARRIER-OFF     Turn the TX carrier off.



RCL, #, 09      LOAD-SYNTH      Set the synthesizer to the channel specified

                                by up to 4 digits followed by # key (up to 4 

                                digits = 0 through 600, 1329 through 2047).

                ---------       ---------

Example:        TEST MODE       TEST MODE      Pressing 333 and #

                      09-          09-333

                ---------       ---------



RCL, #, 10      SET-ATTN        Set the RF power attenuation to the value

                                specified by 1 digit followed by the # key

                                (1 digit = 0 through 7).

                ----------

Example:        TEST  MODE      Pressing 4 for 8dB reduction

                     10-4

                ----------      0 to 2 = No reduction.

                                3 = -4dB,  4 = -8dB,  5 = -12dB,

                                6 = -16db,  7 = -20dB.



RCL, #, 11      RXMUTE          Mute the receive-audio signal. No audio

                                signal comes from the speaker.



RCL, #, 12      RXUNMUTE        Unmute the receive-audio signal. Noise or

                                Voice comes from the speaker.



RCL, #, 13      TXMUTE          Mute the Transmit-audio signal.



RCL, #, 14      TXUNMUTE        Unmute the Transmit-audio signal.



RCL, #, 15      RESET OFF       Discontinue periodic resetting of the

                                autonomous timer (allow timer to time out).



RCL, #, 16      STON            Transmit a continuious Signalling Tone (ST).



RCL, #, 17      STOFF           Stop transmission of Signalling Tone (ST).



RCL, #, 23      VERSION         Show the software version-information on the

                                display.

                                ----------

                                  V-2.0

                                 (V-9011)

                                ----------



RCL, #, 24      READ SN         Show the production serial number of the

                                phone. i.e. ----------

                                            Serial No.

                                            22A-000001

                                            ----------



RCL, #, 32      SATON           Enable the transmit of SAT. One digit follow-

                                -ing the command code shall contain the color

                                code of the SAT frequency that the transceiv-

                                -er unit may expect to receive. SAT shall be

                                transmitted if the carrier is currently on.

                                COLOR CODE DIGIT.       SAT FREQUENCY.

                                =================       ==============

                                        0                   5970Hz

                                        1                   6000Hz

                                        2                   6030Hz



RCL, #, 33      SATOFF          Disable the transmission of SAT.



RCL, #, 34      CDATA           Transmits 6 bytes NAM data as 240 bits data.

                                DEFAULT = 01, 02, 03, 04, 05, 06 (No TX ON).



RCL, #, 35      HIGH TONE ON    Activate the high audio tone (1150 Hz) and

                                apply it to the receive-audio line. You hear

                                the high tone from the speaker.



RCL, #, 36      HIGH TONE OFF   Deactivate the high audio tone. Tone stops.



RCL, #, 37      LOW TONE ON     Activate the low audio tone (770Hz) and apply

                                it to the receive-audio line. You hear the 

                                low tone from the speaker.



RCL, #, 38      LOW TONE OFF    Deactivate the low audio tone. Tone stops.



RCL, #, 39      INVM            Initialize non-volatile memory. Set registra-

                                -tion memory and clear all the speed-dial

                                memories. Set the Lock State to activate

                                (Fully Locked).



RCL, #, 42      DTMF ON         It sounds DTMF tones, a responce from each

                                pressed key. It sends the signal to RX AUDIO

                                and TX AUDIO lines.



RCL, #, 43      DTMFOFF         Deactivates DTMF generator. DTMF tones stop.



RCL, #, 48      TONE-OFF        Deactivate alert tone and external call 

                                alert. The alert tones stop.



RCL, #, 49      TX-DISE         Deactivate TX ENABLE line. Disable the 

                                transmitter.



RCL, #, 50      STATUS REPEAT   Status Repeat at Test Mode.

                (TEST MODE)



RCL, #, 51      MON             Monitors the port status.

                                "      ABCD" (Mid line of LCD display).

                                A: HOOK         1 = ON HOOK

                                B: EXT PS       1 = BATTERY MOUNTED

                                C: ADP MON      1 = ADAPTER CONNECTED

                                D: HF MON       1 = HANDS FREE



RCL, #, 57      TX-ENABLE       Activate TX ENABLE line. Enable transmitter.



RCL, #, 60      AUDIO PATH      Set the Audio Path.

                                "      60-X" (Mid line of LCD display).

                                X: 0 = HF

                                   1 = SPK

                                   2 = ALT

                                   3 = HS



RCL, #, 61      STATUS-REPEAT   Without suspend. It shows the status

                                information of the unit by 16 digits every

                                second.

                ----------      ----------

Example:        TEST  MODE      TEST  MODE    Press 1 and # for display on.

                       61-            61-1    Press 0 and # for display off.

                ----------      ----------

                After the setting, press RCL, #, 02. The wake-up tone and

                display come on. The 16 digit status information appears.

                ----------      ----------

Example:            119110          AAABCD

                0003100363      EFGHIJKKKK

                ----------      ----------

Where:          AAA: Shows RSSI (Receiver Signal Strength) Value ranging from

                     000 through to 255 (3 digits).

                B:   Shows RXM (Receiver Audio Mute) or Receiver audio gate

                     on/off. 1 = muted or gate off.

                C:   Shows TXM (Transmitter Audio Mute) or Transmitter audio   

                     gate on/off. 1 = muted or gate off.   

                D:   Shows WS (Word Synchronization) in FOCC. 1 =WS acquired.        

                E:   Shows B/I (Current state of the busy idle bit of FOCC).

                     1 = idle  0 = busy.

                F:   Shows CARR (carrier) on/off. 1 = off.   

                G:   Shows ST (Signalling Tone) on/off. 1 = ST on.   

                H:   Shows SAT (Supervisory Audio Tone) on/off. 0 = 5970Hz,  

                     1 = 6000Hz,  2 = 6030Hz  and  3 = No SAT.

                I:   Shows MODE. 1 = Control channel,  0 = Voice channel.   

                J:   Shows Transmission Power Reduction Level.   

                           0 to 2 = No reduction.

                           3 = -4dB.

                           4 = -8dB.

                           5 = -12dB.

                           6 = -16dB.

                           7 = -20dB.

                KKKK: Shows Channel Number, ranging from 0000 through 0600 &

                      1329 through 2047 (4 digit).



RCL, #, 69      SCAN SLOW       Measure the Received Signal Stength Indicati-

                                -on (RSSI) signal at each channel.

                                Shows each channel number and it's RSSI level

                                on the display.

Example:        ----------      ----------

                TEST  MODE      TEST  MODE     Simply press # key or

                       69-            69-1     press channel number and #.

                ----------      ----------  

                To activate the SCAN SLOW command, press RCL. # 69, XXXX, #.

                Where XXXX = starting channel number (1 through 6000, 1329

                through 2047). If you don't enter the channel number and

                press # key, then the channel will begin from 0001. The unit

                measures the RSSI at each channel, scanning from the channel

                number you set. The scanning speed is 0.5secs per channel.

                The unit shows each channel number and it's RSSI level on

                the display "XXXX-sss" (On Mid line).

                ----------

                TEST  MODE       Where: XXXX = Channel number

                  XXXX-sss               sss = RSSI

                ----------

                Pressing * key while scanning causes the unit to pause.



                Pressing * key again resumes scanning. To end scanning press

                the # key. The radio channel will be fixed at the first 

                channel number and is ready to accept other commands. If you

                press other keys other than the * or # the unit ignores them

                and gives back a short alarm tone.



RCL, #, 70      KEYPAD PROGRAM2 Allow you to do NAM programming via the 

                                keypad. See appendix C.       

                                

RCL, #, 71      KEYPAD PROGRAM1 Allow you to do NAM programming via the

                                Keypad. See appendix C.



NOTE: This file contains the reference from Appendix A only. If you have or

can get information from appendix C, please add it to the end of this file.



RCL, #, 72      I/O DATA OUT    Writes data (0-255) or I/O (0-127).

                                Address is 00FF00H-0FF7FH

                                        XXX   YYY  (Mid Line)

                                           XXX = Address

                                           YYY = Write Data



RCL, #, 73      AEC ON          Turns AEC (Automatic Efficiency Control) on.



RCL, #, 74      AEC OFF         Turns AEC (Automatic Efficiency Control) off.



RCL, #, 75      CDATA OFF       Stops CDATA transmission.



RCL, #, 77      LOAD SYNTH 2    CH assignation to TX/RX synth.

                                "TXXXXRYYYY" (Mid Line).

                                   XXXX = TX channel

                                   YYYY = RX channel



RCL, #, 78      SET DEFAULT DATA It writes default data into AF IC & EEPROM.



RCL, #, 79      WRITE ADJUST DATA It writes to AF IC and EEPROM the adjust-

                (MAX DEV.)        -ment data that specifies the MAX 

                                  deviation for each unit.



RCL, #, 80      WRITE ADJUST DATA It writes to AF IC and EEPROM the adjust-

                (EXT IN)          -ment data that specifies the EXT IN data

                                  for each unit.



RCL, #, 81      WRITE ADJUST DATA It writes to AF IC and EEPROM the adjust-

                (DTMF)            -ment data that specifies the DTMF data

                                  for each unit.



RCL, #, 82      WRITE ADJUST DATA It writes to AF IC and EEPROM the adjust-

                (MIC)             -ment data that specifies the MIC data

                                  for each unit.



RCL, #, 83      WRITE ADJUST DATA It writes to AF IC and EEPROM the adjust-

                (TX DATA)         -ment data that specifies the TX data

                                  for each unit.



RCL, #, 84      WRITE ADJUST DATA It writes to AF IC and EEPROM the adjust-

                (SAT)             -ment data that specifies the SAT data

                                  for each unit.



RCL, #, 85      WRITE ADJUST DATA It writes to AF IC and EEPROM the adjust-

                (RX DATA)         -ment data that specifies the RX data

                                  for each unit.



RCL, #, 86      WRITE ADJUST DATA Sets power level and specific data of each

                (POW LEVEL)       unit in EEPROM with 7 byte.(P0-P7, Spec, 

                                  Data). Specific Data: Fine adjustment of 

                                  output power level.

                                  Example. RCL, #, 86, ___ #, ___ #.



RCL, #, 87      WRITE DATA(RSSI)  Writes A/D transformed data of +10dBuV to

                                  EEPROM to set at the position between block

                                  two and three of the RSSI indication.

                                  (between **--- and ***--).



RCL, #, 88      MOD TRACKING ADJ  VCO Modulation Senstivity.



RCL, #, 90      BATT            Shows the A/D converted value of the

                                battery Voltage. "       XXX" (Mid Line).

                                XXX = 0 to 255. (0 = fucked!).



RCL, #, 91      TEMP            Shows the A/D converted value of the 

                                Temperature inside the unit.

                                XXX = 0 to 255. (000 = fried!).



RCL, #, 94      COMPANDOR ON    Set the compandor circuit on.      



RCL, #, 95      COMPANDOR OFF   Set the compandor circuit off.



RCL, #, 99      KEYPADPROGC++   Write applications to run with the Intel

                                80386, 486 family of processors via the

                                units keypad.

                                Example: Write DOS and Windows applications

                                in C++, write a Bluebox prog etc.

                                Refer to the P3 C++ prog ref for further info

                                also refer to DOS and Windows references.

                                Note: This function only works with the P3 

                                I/O card for connection to the CPU of a PC.



Note: All information given in this file is from Appendix A of the P3 Test

ROM manual, it is documented as per appendix A apart from the last couple

of remarks under BATT and TEMP (i.e. Fucked! and Fried!) also the last test

code 99 is a load of rubbish, well after writing all this long boring tech

file about a phone that can do everything! I could resist added it! <g>.



Notes and Examples.

===================

This section has been put here for you to add further notes about funtions

you have found. Then please re-upload as next revision.

----------------------------------------------------------------------------

i.e.

1) Using the Phone capture other ID's. (I wish). by DREAMER.

In test mode use RCL, #, 98 and take down all the information that pops up

every second. *** Example only, put yours like this below ***.

----------------------------------------------------------------------------

