ERICSSON SECRETS

WARNING - ALL THESE CODES ARE PROVIDED AS IS - SOME MAY DAMAGE YOUR PHONE - USE AT OWN RISK - I WILL NOT BE RESPONSIBLE FOR ANY DAMAGE . WARNING


ERICSSON 198

To view IMEI number *#06#

Erase Timers by typing 904060 <FUNCTION> <FUNCTION> SEND
Programming mode by typing 923885 <FUNCTION> <FUNCTION>.


ERICSSON 218

To view IMEI number *#06#

To view Software Version enter -> * <- <- * <- * CLR (Use with Care)
View Latest Software version under Phone Info

Press <- and -> will allow you to scroll through the menu, the only options are Flash (which kills the phone) and Texts (allows you to view all the text in the phone)

To activate operator lock <- * * <- (This locks the phone to one carriers SIM card - Use with lots of care)
Press Yes to lock and No to notlock. I haven't tried yes and I don't know how to unlock this, there may be a code or maybe just type it again to unlock. Use at own risk.


ERICSSON 318

To view IMEI number *#06#

To view Software Version enter -> * <- <- * <- * CLR (Use with Care)

Press <- and -> will allow you to scroll through the menu, the only options are Flash (which kills the phone) and Texts (allows you to view all the text in the phone)

To activate operator lock <- * * <- (This locks the phone to one carriers SIM card - Use with lots of care)
Press Yes to lock and No to notlock. I haven't tried yes and I don't know how to unlock this, there may be a code or maybe just type it again to unlock. Use at own risk.


ERICSSON 337

To view IMEI number *#06#

To view Software Version enter -> * <- <- * <- * CLR (Use with Care)

To activate operator lock <- * * <- (This locks the phone to one carriers SIM card - Use with lots of care)
Press Yes to lock and No to notlock. You can also use the codes below to undo this function. USE AT OWN RISK

I have tested the function Lock to SP... At least on the 337 there's a submenu: Enter SPCK-code. There are 5 attempts, which is showed (05 attempts). At final attempt the phone beeps as a warning, 'this is the final try', when entering the menu... Wrong code exits the menu, so you are not stuck in something... When you have tried to enter the code (wrong) all five times, the menu is deactivated, and you'll get: 'Not allowed' when entering <-**<-

 A "secret test mode" can be accessed on the GH337. There seems to be two methods:

> * < < * > * displays software version, such as 940810 1310

> * < < * < * displays software version, such as 951024 1054 (most recent?)

after entering this mode, the < and > keys scroll through a menu. There seems to be different menus for different versions of software.

Software version number are apparently a date and time stamp.

940810 1310 version commands:

TEXT CHECK - shows 254 messages in current language

INIT EEPROM MMI - resents NVRAM settings (User Settings).

Other, probably more recent version:

FLASH - will restart the phone, to the point of entering PIN numbers.You can't kill a 337 when pressing YES while it says "FLASH?", you must connect it to 5/12 volts first to be able to erase the flash-memory.

1-ROW TEXTS - scroll through 174 single line text messages with < and >

n-ROW-TEXTS - scroll through full-screen messages with < and >

950626 1405 version commands:

CXC (number) - The Application software's "product number". The GH337/GF337 is always "CXC 125 005"

PRG - Indication for Programming

Available on the 951024 1054 software but apparently not on the 940810 1310, the sequence < * * < Responds "Lock to SP?" - an anonymous correspondent reports:" You can lock the phone to a specific operator, which means that if You put in a SIMM-card from a different operator, the phone refuses to accept it. To activate/deactivate this lock, you need a special secret code that is not available for the user. I think only the operator can get it from the phone manufacturer.

 Instructions on how to enable the built-in calculator and rbs-info on a 337

Connect RS232 to phone via an TTL to RS232 converter (you can use the flasher lead) or make a RS-232 to TTL Converter Below.

NOTE! You can NOT connect the RS232 directly to the phone, you MUST use an TTL to RS232 converter!

Pin 8 DC GND -> ComPort GND
Pin 11 RXD (TTL serial data TO phone) -> ComPort TXD
Pin 12 TXD (TTL serial data FROM phone) -> ComPort RXD

Connect external 5 volts to Pin 9 (FLASH 5/12volts input)
(Pin 6 SWDC5 [5 volts out] to pin 9 may also work, but have not tried it)

Pin 1 is leftmost pin (near Mic), when looking at the front/bottom.

Set ComPort to 9600bps, 8 data, 1 stop, no parity.

Power on phone by pressing "NO/ENDpwr".
When performing its powerup sequence the phone will send two ">>"
(ASCII 62 decimal) characters. Within 1 second, reply to it by
sending the 4 character sequence "TP1<CR>".

(I used Procom Plus with this script "eric.asp")
[proc main ]
[start: ]
[ ]
[ waitfor ">>" ]
[ pause 1 ]
[ transmit "TP1^M" ]

If everything went fine you should get the "OK" prompt back.

Test the TEST PROGRAM by sending the commands terminated by a <CR>:

PROG 0 (shows Test Program product number info)
PROG 1 (shows Test Program product date info)
PROG 3 (Shows Main Application product number info)
PROG D (Shows Main Application product date info)

To enable the built-in calculator and rbs-info, send the command:

EEWR 047A 01

Wait for the OK prompt, power off the phone and disconnect it
from the interface cables. Powerup and browse through the menus, enjoy!

To disable the built-in calculator and rbs-info, send the command:

EEWR 047A 00

To clear the electronic lock you have to clear the EEPROM address range 045B to 0466 by writing the commands:

EEWR 045B 00
EEWR 045C 00
EEWR 045D 00
EEWR 045E 00
EEWR 045F 00
EEWR 0460 00
EEWR 0461 00
EEWR 0462 00
EEWR 0463 00
EEWR 0464 00
EEWR 0465 00
EEWR 0466 00

Download the Procomm Plus Scipt to clear the electronic lock - Click HERE

To disable the "Service Provider Lock" status you have to send the command:

EEWR 1587 00

To dump the application software you can use the command:

PREA <bank> <address> <bytestoread>

Bank range : 00..7F
Address : 0000..BFFF
Bytestoread : 0000..BFFF

The "additional" value returned at the end are the checksum value for the
returned program memory bytes. Note, the byte-values are always returned in
format 0000 and NOT 00.

PREA FF
returns the application checksum, takes a few seconds.


ERICSSON 388

To view IMEI number *#06#

To view Software Version enter -> * <- <- * <- * CLR (Use with Care)

The Latest Software Version is under Phone Info.

To view Software Version enter -> * <- <- * <- * CLR (Use with Care)

To activate operator lock <- * * <- (This locks the phone to one carriers SIM card - Use with lots of care)
Press Yes to lock and No to notlock. I haven't tried yes and I don't know how to unlock this, there may be a code or maybe just type it again to unlock. Use at own risk. 


Mat's HomePage Mat's GSM Page Mat's Piazza Page About Mat Mat's Cool Links

Comments and Suggestions? Click HERE.
Copyright © 1996 Matthew McDonald
Last modified: 23 September 1996