Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Phreaking Cellular - Other Manufacturers :: oki900fq.txt

OKI 900 FAQ - on a phone popular with cell hackers.





                      &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&
                     &                                &
                     &     Oki 900:  The Real Deal    &
                     &                                &
                     &        by: Oki Dokie           &
                     &                                &
                      &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&

     Well this is the first real file on cellular worth keeping.  There
have been several LAME attempts made in 2600.  All the files in 2600 were by
people who DID not know enough about the topic to carry on a technical
paper.  The only file that was worth reading was written by Brian O. The
file was in Phrack.
      Most of the people out there think they are cool because they can
link up SIMPLE cables and use software they did not write to clone cell
phones.  All this kids who think they know cell, you do not know anything!
You are all lame!
      This file is not for the people on the private cell lists on the
Internet.  Not for the people who are looking for handouts not wanting to
understand the technology.  One such person is a little kid named Alpha BITS.
Alpha Bits is in jail now, and we all wish him to die there!
This file was written for information warfare!  We can all thank the FBI,
This is just the start!

        Here is the outline of this file:

        - Hardware one will Need
        - Memory Break Down
        - Debug command
        - The Oki Mod
        - The Network Wizards Interface cable
        - Character set in the Oki 900


Hardware one will Need
~~~~~~~~~~~~~~~~~~~~~~

      In this section, this will cover the hardware one will need
to buy, along with the terms, and prices of the hardware.


Package Terms

  In electronics there are many terms that are used for the same thing.
One area that electronics manufacturers, distributors and product
representatives have different names for the same thing is in the
packages of the IC (integrated Circuit). The package is the shape,
size of the chip, the number of pins, and the way the pins connect to
the circuit board.  Here are some of the common packages:

DIP          Dual In-Line Package
PDSO         Plastic Dual Small Outline (Same as SOIC)
PLCC         Plastic Leaded Chip Carrier
PSIP         Plastic Single In-Line Package
SOP          Small Outline Package (Same as SOIC)
SOL          Small Outline package (Same as SOIC)
SOI          Small Outline In-Line Package (Same as SOIC)
SOIC         Small Outline In-Line Package

As one can see, the SOP, SOI, SOP, PDSO and SOIC are all the same package.
The best way to find out about the package types is to look in the
back of manufacturer's data books.
   The package type of the Oki PROM is a SOIC, this is why it was necessary to
cover this.



EPROM Programmer

The best deal around is the <A HREF="http://www.intronics.com">Intronics</A>
EPROM Programmer.

The Pocket Programmer   -  $130.00

Intronics, Inc.
Box 13723
Edwardsville, KS 66113
(913) 422-2094

A good programmer is The Pocket Programmer that uses the printer port. The
software has 24 functions and programs (E)EPROM, Flash & RAM 27/28(C)XXXX from
16K - 8Meg with a 32 pin socket.

SOIC to DIP Socket

With most EPROM programmers have a ZIF DIP socket.  This means that you
will need to have a SOIC to DIP converter.  There are several way that
one can go about this, one can buy a converter or one can make one.


You can order a SOIC Test Clip that can be wired into a 28 pin  PC board
socket.  This will take about an hour of your time to soldering 28 wires
from the clip to 28 pin PCB socket.  The cost would be the big plus for
going with the SOIC Test Clip.  You can order the clip from:

Contact East
335 Willow Street
North Andover, MA 01845-5995
800-225-5334

Part Number:  923665-28      $12.55


If making a converter seems like it would be too much work, a low price
converter can be found (after looking for weeks).  The best price
around for a SOIC to DIP converter is from:

 M^2L Electronics
 3526 Jasmine, Suite #4
 Los Angeles, CA 90034
 (310) 837-7818

Part Number:   EP-SOIC28     $50.00



Oki Phones Domestic Distributors - Where to get an Oki 900

        The last shipment of Oki 900 telephones was in December of 94.  There
were 10,000 phones shipped.  There should not be too many  problems in
finding the phones (maybe not after this is printed).


Allied Communications
1705 Winchester Road
Bensalem, PA 19020
(215) 244-1262

Connecticut, Delaware, Maine, Maryland, Massachusetts, Vermont, New Hampshire,
New Jersey, New York, Pennsylvania, Virginia, West Virginia, Virginia, Washington,
D.C., Kentucky, North Carolina, South Carolina, Tennessee, Louisiana,
Mississippi, Alabama, Georgia, Florida

Cellular Wholesalers, Inc.
5151 Church Street
Skokie, IL 60077
(708) 965-2300

Illinois, Wisconsin, Ohio, Arizona, North Dakota, South Dakota, Minnesota, Iowa,
Michigan, Indiana

Pacific Unplugged Communications, Inc.
20526 Gramercy Place
Torrance, CA 90501
(310) 787-9400

California, Nevada, Arizona, Washington, Wyoming, Alaska, Hawaii, New Mexico,
Colorado, Utah, Idaho, Oregon, Montana,

Southern Electronic Distributors, Inc.
4916 North Royal Atanta Drive
Tucker, GA 30084
(800) 444-8962

North  Carolina, South Carolina, Kentucky, Tennessee, Louisiana, Mississippi,
Alabama, Georgia, Florida


Wholesale Cellular USA, Inc.
5720 West 71st Street
Indianapolis, IN, 46278
(800) 243-1227

Kentucky, Indiana, Michigan, Kansas, Ohio, Arizona, Missouri, North Dakota,
Wyoming, South Dakota, Nebraska, Oklahoma, Colorado, Arkansas, Montana, Iowa,
Minnesota, Utah, Wisconsin


The PROM you will Need

  The PROM the Oki 900 uses is the TC54512AF-20, this is really a 27C512 SOIC
PROM.  This can be ordered from




Memory Break Down
~~~~~~~~~~~~~~~~~
  Here is the break down of the Oki 900 phone.

        $0000-$FFFF (64K) - Software PROM
        $0000-$00FF (256) - Micro Internal Memory
        $7000-$70FF (256) - Glue Logic
        $A000-$BFFF (8K)  - EEPROM
        $C000-$C0FF (256) - Extended RAM
        $D000-$D0FF (256) - Screen Memory


$0000-$FFFF (64K)  - Software PROM

     This is the software of the phone.  The software controls the
phone.  This is where one will need to change the code to allow for
the ESN to be changed.  The ROM version covered here is the 4701.
The 4003 is not covered.

Common LCALLS in the Oki 900

   Here is a small list of some of the more common lcalls that are
used in the Oki 900.  This may or may not help, but here they are:

lcall $04c2   - Sets $D0-$D1 and $A0-$A1 to $78 (there is a good reason)
lcall $0542   - Fixes NAMs if needed, check sum
lcall $055a   - Sets up security code via ESN, hex to dec conversion
lcall $0723   - Clr A Set Of Locations to X00, X=R2, DPTR point to first
lcall $072d   - Clears custom power on message BEAF to BEB6
lcall $073d   - ESN chksumm
lcall $07e6   - Will reset the NAM if something happens to it
lcall $13d4   - ACC.6 to C and lcall $2fe1   Write to screen direct....
lcall $152c   - Display on screen (calls $2fe1 along the way)
lcall $1549   - $7A to A and ACC.6 to C
lcall $1638   - Gets key from keyboard and wonders if it is clear
lcall $2722   - Mov DPTR, #$bec2 ESN working storage location mov R7, #04h
lcall $274f   - Reads from BED1 BED2
lcall $2e59   - Puts DPTR to R5 and R6 (DPH to R5,  DPL to R6)
lcall $2e5e   - Puts R5 and R6 to DPTR (R5 to DPH, R6 to DPL)
lcall $2f17   - 22-&gt;A, 8-&gt;R7, JMP to write to screen ($2fe1)
lcall $2f4e   - lcall 3016, A-&gt;R7, 10-&gt;A, Screen Write, etc...
lcall $2fb3   - A-&gt;R0, 39-&gt;A, Alcall N2fb3F0, CJNE A on F0 to B2fbc
                (R0-&gt;A, F0-&gt;A, scr write) $2fe1
lcall $2fc3   - A-&gt;R7, 10-&gt;A, jmp to Screen Write ($2fe1)
lcall $2fd2   - A-&gt;R7, A-&gt;@C087, CLR A, JMP to Screen write ($2fe1)
lcall $2fe3   - The REAL screen write!!
lcall $2ffb   - Write A to @DPTR, for EEPROM (ATMEL 28C64)
lcall $3042   - Adjusts on over load!
lcall $305e   - Change channel
lcall $3110   - adds 40h (64d) to name address used for NAM pulls
lcall $31f5   - Point to the correct location of the NAM selected
lcall $3265   - Goto current NAM location and Read it out
lcall $347a   - Clr #$7f, Lets just save one byte
lcall $347d   - Resets the autonomous timer
lcall $34a7   - Enable Hands-free
lcall $34b0   - Disable Hands-free (enable Skkr)
lcall $3546   - Mutes the receive audio
lcall $354a   - UN-mutes the receive audio
lcall $3552   - UN-mutes the transmit audio
lcall $3797   - Setup for call
lcall $3834   - Checks if key is pressed
lcall $3887   - Gets and Decodes a Control Channel Message
lcall $38e6   - Get FCC message
lcall $3939   - Decode FCC Message
lcall $5b5e   - Inc DPTR, with DPL inc to only thru $00-$29 and $2b-$3e
lcall $5b5e   - Inc DPTR, with DPL inc to only thru $00-$29 and $2b-$3e
lcall $5d84   - NAM Checksum byte correction
lcall $34b6   - Turns on Loudspeaker near mic (Used in Debug #77)
lcall $37cf   - Enable the compressor and expander (Used in Debug #65)
lcall $37d6   - Disable the compressor and expander (Used in Debug #66)
lcall $34c6   - Turns the carrier off (Used in Debug #08)
lcall $3741   - Transmits a continuous signaling tone (Used in Debug #16)
lcall $354e   - Mutes the transmit audio (Used in Debug #13)

Misc. Locations in the Oki 900 Software.


$0000    Starting entry
$00b1    Read in all data, if not zero, die error number 2
$00c8    RAM Check Sum, if not zero after being deced, error number 3
$00cb    RAM Check Sum loop label
$00dd    Makes the call to the ESN check sum ($073d) better return a zero
         Error number 4
$00e7    Call setup
$0102    Reset phone
$012e    Reads out what NAM that the phone is set on
$0136    Check Sum for External RAM, fail error number 3
$0144    Read NAM out abd write into memory
$0501    Setup for Security code (hex to dec conversion)
$055a    HEX to decimal converter
$055b    HEX to Dec conversion looper var ent point
$0573    Turn off write protect (lcall)
$057a    Turn on write protect (lcall)
$0581    Default NAM info, done on reset of phone  ($0102) Data
$05c4    Write default NAMs Start from data at $0581
$0723    Clr A Set Of Locations to X00, X=R2, DPTR point to first location
$072d    Clears  customized power on message
$0732    Clear power on message loop var (Places spaces in the phone)
$073d    Loads Encrypted ESN Locations  (ESN Check Sum)
$0766    Decodes Encrypted ESN          (ESN Check Sum)
$077a    ESN Check Sum                 (ESN Check Sum)
$07dc    The Check Sum part of the NAM check sum
$07e6    Will Reset the NAM if something happens to it *** START
$07ed    Write loop for NAM write (called from $0581)
$09b1    This is the START of debug!!!!
$0b51    Debug indirect jump
$140e    Data for key test  (DATA)
$1638    This function is used to read a key from the keypad
         more over the CLR key
$16d5    Address table for debug  (DATA)
$2722    Loads ESN working storage location with ESN
$2f55    Call from debug command #74
$34a7    Enable Hands free
$34b0    Disable Hands-free (enable Speaker)
$354a    UN-mutes the receive audio
$3741    Transmits a continuous signaling tone
$385f    From C3834: this is the debug command number #20
$4a74    Setup for customized power on message
$5bb8    200 memory location control
$5bd6    200 memory location address for indirect moves (DATA)



$0000-$00FF (256) - Micro Internal Memory

     The internal memory contains the function registers.  When one wants
to use the use a register, TASM does not have the labels for one to use.
One can access the register direct.  Here is the addresses one will need
to use.

        IOCON           $FF-$F8
        B               $F7-$F0
        ACC             $E7-$E0
        PSW             $D7-$D0
        TH2             $CD
        TL2             $CC
        RCAP2H          $CB
        RCAP2L          $CA
        T2CON           $CF-$C8
        IP              $BF-$B8
        P3              $B7-$B0
        IE              $AF-$A8
        P2              $A7-$A0
        SBUF            $99
        SCON            $9F-$98
        P1              $97-$90
        TH1             $8D
        TH0             $8C
        TL1             $8B
        TL0             $8A
        TMOD            $89
        TCON            $8F-$88
        PCON            $87
        DP              $83
        DPL             $82
        SP              $81
        P0              $87-$80


  The Stack is specified by stack pointer ($81).

                        Stack Storage Layout

  Stack Processing    Stack Pointer     7    6    5    4    3    2    1    0

   Before Execution         $7F         D7   D6   D5   D4   D3   D2   D1   D0
   Interrupt Process        $80         PC7  PC6  PC5  PC4  PC3  PC2  PC1  PC0
                            $81         PC15 PC14 PC13 PC12 PC11 PC10 PC9  PC8
   PUSH process (ACC)       $82         A7   A6   A5   A4   A3   A2   A1   A0
   POP process (ACC)        $82         A7   A6   A5   A4   A3   A2   A1   A0
   RETI process (pop PC)    $81         PC15 PC14 PC13 PC12 PC11 PC10 PC9  PC8
                            $80         PC7  PC6  PC5  PC4  PC3  PC2  PC1  PC0
   After Execution          $7F         D7   D6   D5   D4   D3   D2   D1   D0




$7000-$70FF (256) - Glue Logic

   Glue Logic is the decoder which controls various functions of the
Oki 900.  The NAM locations are under a write protect.  The write protect is
controlled via the $7005 location.  Here is some sample code  showing how
one uses the $7005 write protect.

Turn Off EEPROM Write Protect  -  $01 into $7005

        mov a, #$01               ; Load a $01 into A
        mov dptr, #$7005          ; Load the value $7005 into DPTR
        movx @dptr, a             ; Move A ($01) into the location at DPTR
                                  ; which is $7001

Turn On EEPROM Write Protect   -  $00 into $7005

        mov a, #$00               ; Load a $00 into A
        mov dptr, #$7005          ; Load the value $7005 into DPTR
        movx @dptr, a             ; Move A ($01) into the location at DPTR
                                  ; which is $7001


$C000-$C0FF (256) - Extended RAM

        C0F4-C0FE   Current NAM Information (Sid, MIN1/2, ICMP, OCL, GIM)
        C0FF        Current NAM Selected (0=Auto-NAM)

$D000-$D0FF (256) - Screen Memory

         This is the LCD memory locations.


$A000-$BFFF (8K)  - EEPROM Memory locations

    The EEPROM contains the ESN, NAM, passwords and other data that
may need to be changed.
    The ESN contains two locations.  The main location is the encrypted
and CAN NO BE CHANGED unless one jumpers the 28C64 EEPROM write protect.
(Order the databook by calling Atmel at 408-441-0311) To jumper the
EEPROM one can place a low on NOT WE (Write enable, Pin 27), NOT CE
(Chip Enable, 20) and a high on OE (Output Enable, pin 22).  While
writing each byte, the NOT WE and CE should cycle, the OE NEEDS to be
high.
    The other ESN location is the working storage location, the is written
over each time the phone is turned on.   One can make a two byte crack
on the binary to change the ESN on the phone. Looking at $0788 in the
Oki PROM, you will see #$90 #$BE #$C2 (#$78 #$60 #$79, extra opcodes are
added to help find the location in question). #$90 #$BE #$CE could be
changed to #$90 #$FF #$F0, and you be able to change the ESN by
using debug command #54 to poke the ESN to $BEC2 thru $BEC5

200 Memory location Table Starts at $9F4E in the PROM.  The addresses
are of the names, NOT the numbers please note that the the numbers
come before the names in the locations this starting at B000.

  ---------------------------------------------------------------
  | Addr  Memory Location Number  | Addr  Memory Location Number|
  |-------------------------------+-----------------------------|
  | B010  Memory location #1      | B029  Memory location #2    |
  | B044  Memory location #3      | B05D  Memory location #4    |
  | B078  Memory location #5      | B091  Memory location #6    |
  | B0AC  Memory location #7      | B0C5  Memory location #8    |
  | B0DE  Memory location #9      | B0F9  Memory location #10   |
  | B112  Memory location #11     | B12D  Memory location #12   |
  | B146  Memory location #13     | B15F  Memory location #14   |
  | B17A  Memory location #15     | B193  Memory location #16   |
  | B1AE  Memory location #17     | B1C7  Memory location #18   |
  | B1E0  Memory location #19     | B1FB  Memory location #20   |
  | B214  Memory location #21     | B22F  Memory location #22   |
  | B248  Memory location #23     | B261  Memory location #24   |
  | B27C  Memory location #25     | B295  Memory location #26   |
  | B2B0  Memory location #27     | B2C9  Memory location #28   |
  | B2E2  Memory location #29     | B2FD  Memory location #30   |
  | B316  Memory location #31     | B331  Memory location #32   |
  | B34A  Memory location #33     | B363  Memory location #34   |
  | B37E  Memory location #35     | B397  Memory location #36   |
  | B3B2  Memory location #37     | B3CB  Memory location #38   |
  | B3E4  Memory location #39     | B3FF  Memory location #40   |
  | B418  Memory location #41     | B433  Memory location #42   |
  | B44C  Memory location #43     | B465  Memory location #44   |
  | B480  Memory location #45     | B499  Memory location #46   |
  | B4B4  Memory location #47     | B4CD  Memory location #48   |
  | B4E6  Memory location #49     | B501  Memory location #50   |
  | B51A  Memory location #51     | B535  Memory location #52   |
  | B54E  Memory location #53     | B567  Memory location #54   |
  | B582  Memory location #55     | B59B  Memory location #56   |
  | B5B6  Memory location #57     | B5CF  Memory location #58   |
  | B5E8  Memory location #59     | B603  Memory location #60   |
  | B61C  Memory location #61     | B637  Memory location #62   |
  | B650  Memory location #63     | B669  Memory location #64   |
  | B684  Memory location #65     | B69D  Memory location #66   |
  | B6B8  Memory location #67     | B6D1  Memory location #68   |
  | B6EC  Memory location #69     | B705  Memory location #70   |
  | B71E  Memory location #71     | B739  Memory location #72   |
  | B752  Memory location #73     | B76D  Memory location #74   |
  | B786  Memory location #75     | B79F  Memory location #76   |
  | B7BA  Memory location #77     | B7D3  Memory location #78   |
  | B7EE  Memory location #79     | B807  Memory location #80   |
  | B820  Memory location #81     | B83B  Memory location #82   |
  | B854  Memory location #83     | B86F  Memory location #84   |
  | B888  Memory location #85     | B8A1  Memory location #86   |
  | B8BC  Memory location #87     | B8D5  Memory location #88   |
  | B8F0  Memory location #89     | B909  Memory location #90   |
  | B922  Memory location #91     | B93D  Memory location #92   |
  | B956  Memory location #93     | B971  Memory location #94   |
  | B98A  Memory location #95     | B9A3  Memory location #96   |
  | B9BE  Memory location #97     | B9D7  Memory location #98   |
  | B9F2  Memory location #99     | BA0B  Memory location #100  |
  | A010  Memory location #101    | A029  Memory location #102  |
  | A044  Memory location #103    | A05D  Memory location #104  |
  | A078  Memory location #105    | A091  Memory location #106  |
  | A0AC  Memory location #107    | A0C5  Memory location #108  |
  | A0DE  Memory location #109    | A0F9  Memory location #110  |
  | A112  Memory location #111    | A12D  Memory location #112  |
  | A146  Memory location #113    | A15F  Memory location #114  |
  | A17A  Memory location #115    | A193  Memory location #116  |
  | A1AE  Memory location #117    | A1C7  Memory location #118  |
  | A1E0  Memory location #119    | A1FB  Memory location #120  |
  | A214  Memory location #121    | A22F  Memory location #122  |
  | A248  Memory location #123    | A261  Memory location #124  |
  | A27C  Memory location #125    | A295  Memory location #126  |
  | A2B0  Memory location #127    | A2C9  Memory location #128  |
  | A2E2  Memory location #129    | A2FD  Memory location #130  |
  | A316  Memory location #131    | A331  Memory location #132  |
  | A34A  Memory location #133    | A363  Memory location #134  |
  | A37E  Memory location #135    | A397  Memory location #136  |
  | A3B2  Memory location #137    | A3CB  Memory location #138  |
  | A3E4  Memory location #139    | A3FF  Memory location #140  |
  | A418  Memory location #141    | A433  Memory location #142  |
  | A44C  Memory location #143    | A465  Memory location #144  |
  | A480  Memory location #145    | A499  Memory location #146  |
  | A4B4  Memory location #147    | A4CD  Memory location #148  |
  | A4E6  Memory location #149    | A501  Memory location #150  |
  | A51A  Memory location #151    | A535  Memory location #152  |
  | A54E  Memory location #153    | A567  Memory location #154  |
  | A582  Memory location #155    | A59B  Memory location #156  |
  | A5B6  Memory location #157    | A5CF  Memory location #158  |
  | A5E8  Memory location #159    | A603  Memory location #160  |
  | A61C  Memory location #161    | A637  Memory location #162  |
  | A650  Memory location #163    | A669  Memory location #164  |
  | A684  Memory location #165    | A69D  Memory location #166  |
  | A6B8  Memory location #167    | A6D1  Memory location #168  |
  | A6EC  Memory location #169    | A705  Memory location #170  |
  | A71E  Memory location #171    | A739  Memory location #172  |
  | A752  Memory location #173    | A76D  Memory location #174  |
  | A786  Memory location #175    | A79F  Memory location #176  |
  | A7BA  Memory location #177    | A7D3  Memory location #178  |
  | A7EE  Memory location #179    | A807  Memory location #180  |
  | A820  Memory location #181    | A83B  Memory location #182  |
  | A854  Memory location #183    | A86F  Memory location #184  |
  | A888  Memory location #185    | A8A1  Memory location #186  |
  | A8BC  Memory location #187    | A8D5  Memory location #188  |
  | A8F0  Memory location #189    | A909  Memory location #190  |
  | A922  Memory location #191    | A93D  Memory location #192  |
  | A956  Memory location #193    | A971  Memory location #194  |
  | A98A  Memory location #195    | A9A3  Memory location #196  |
  | A9BE  Memory location #197    | A9D7  Memory location #198  |
  | A9F2  Memory location #199    | AA0B  Memory location #200  |
  ---------------------------------------------------------------

NAM Storage in the EEPROM:
       SID-------  min1/min2-------------------  IPCH------  OLC-  GIM-
NAM1 - A02B  A06B  A0AB  A0EB  A12B  A16B  A1AB  A1EB  A22B  A26B  A2AB
NAM2 - A2EB  A32B  A36B  A3AB  A3EB  A42B  A46B  A4AB  A4EB  A52B  A56B
NAM3 - A5AB  A5EB  A62B  A66B  A6AB  A6EB  A72B  A76B  A7AB  A7EB  A82B
NAM4 - A86B  A8AB  A8EB  A92B  A96B  A9AB  A9EB  AA2B  AA6B  AAAB  AAEB
NAM5 - AB2B  AB6B  ABAB  ABEB  AC2B  AC6B  ACAB  ACEB  AD2B  AD6B  ADAB


A6AA        Used with Encrypted ESN
A72A        Used with Encrypted ESN
A3EA        Used with Encrypted ESN
A16A        Used with Encrypted ESN
A2AA        Used with Encrypted ESN
A22A        Used with Encrypted ESN
BBAC-BE73   30 roamer access memories
BE03        Index of NAM in use
BEAF-BEB6   Customized power on message (8 bytes)
BEBE-BEC1   &quot;AEIO&quot; signature sent to cell
BEC2-BEC5   ESN  working storage location
BF2C        Index of NAM in use
BF2D        Even/odd SID (0 or 1)
BF60-BF63   Keyboard unlock code digits
BF71        Version number of display cpu rom
BF74        Lighting mode control byte (0=7sec, 1=off, 2=on)




Debug command
~~~~~~~~~~~~~

   Here is a list of some of the debug commands for the Oki 900.  Along with
the list of debug commands are the address in the 4701 binary.
The table for the indirect jump starts at $16D5.  The indirect jump for
the debug mode is at $0b51.
   Note, if the address is $14e3, the debug command does not exist.


 Addr   Number       Use
 ----   ------       ---

 $14e3   #00
 $0b81   #01         Performs Initialization
 $0000   #02         Terminates the test mode
 $0b97   #03         Shows current status of TRU
 $0bd0   #04         Resets the autonomous timer
 $0b70   #05         Returns Data Bytes following command
                     to the Test Set.
 $0b81   #06         Initialize the TRU to following states:
                     Carrier Off, Attenuation - 0db,
                     Receive Audio Muted Transmit Audio Muted,
                     Signaling tone off,
                     Autonomous timer reset,
                     SAT off, and DTMF off
 $0bdf   #07         Turns the carrier on
 $0bf8   #08         Turns the carrier off
 $0bfe   #09XXXX     Sets the synthesizer to channel XXXX
 $0c34   #10X        Set the RF power attenuation to X
                     0=0db, 7=-28 db
                     (in steps of -4db thru 7)
 $0c46   #11         Mutes the receive audio
 $0c4c   #12         UN-mutes the receive audio
 $0c52   #13         Mutes the transmit audio
 $0c58   #14         UN-mutes the transmit audio
 $0bda   #15         Discontinues resetting of autonomous timer
 $0c5e   #16         Transmits a continuous signaling tone
 $0c64   #17         Stops transmission of signaling tone
 $0fbb   #18         Transmits a 5 word RCC message
                     (fixed text pattern)
 $0fe8   #19         Transmits a 2 word (RCC) RVC message
                     (fixed test pattern)
 $1009   #20         Receives a 2 word FCC message (cancel with 0x38)
 $1086   #21         Receives a 1 word (FCC) FVC message
                     (cancel with 0x38)
 $0e3d   #22         Returns the information contained in the NAM
 $0f03   #23
 $0edd   #24
 $0dad   #25XXXX     Displays the resident memory data at XX
                     00XX=in micro, XXXX=EEPROM
 $14e3   #26
 $14e3   #27
 $0f2c   #28         Count 1 word messages on CC, until TERMINATE
 $0f61   #29         Count 1 word messages on VC, until TERMINATE
 $14e3   #30
 $14e3   #31
 $0c73   #32X        Enable the transmission of SAT X
                     0 = 5970 Hz,
                     1 = 6000 Hz,
                     2 = 6030 Hz
 $0c9d   #33         Disables the transmission of SAT
 $10a8   #34&lt;60&gt;     Transmits 5 word RCC message (30 bytes)
 $0cdc   #35         Activates the 1150Hz tone to receive audio line
 $0cd4   #36         Deactivates the 1150Hz tone
 $0ce0   #37         Activates the 770Hz tone to receive audio line
 $0cd4   #38         Deactivates the 770Hz tone
 $14e3   #39
 $14e3   #40
 $14e3   $41
 $0ca7   #42XX       Enable the transmission of DTMF
                     frequency XX[2]
 $0cd4   #43         Disable the transmission of DTMF
 $1286   #44
 $0cf0   #45
 $0d00   #46
 $0d06   #47
 $0eac   #48
 $14e3   #49
 $14e3   #50
 $0d7c   #51
 $0d55   #52<xx>
 $0da2   #53
 $0e27   #54XXXXZZ   Write HEX (ZZ) into ADDRESS $XXXX
 $14e3   #55
 $0e22   #56         Return Value stored in $BEBB
 $14e3   #57
 $14e3   #58
 $14e3   #59
 $10c2   #60
 $14e3   #61
 $0f91   #62
 $0fdc   #63
 $1009   #64         Receives a 2 word FCC message
                     (Please see debug command #20)
 $0ce4   #65         Enable the compressor and expander
                     Compander is a SA 5750
                     This is a Phillips Chip (800) 234-7381

 $0cea   #66         Disable the compressor and expander
 $0d31   #67         X-Set volume (0-7) 0=max
 $0d4a   #683XX      Mutes/UN-mute Tx/Rx Audio Signal
                     Enable Disable the Compressor/Expander,
                     XX=commanded states.
                     CMD Compress Tx Mute Rx Mute
                     --- -------- ------- -------
                     40  on       UN-muted UN-muted
                     41  off      UN-muted UN-muted
                     42  on       muted   UN-muted
                     43  off      muted   UN-muted
                     44  on       UN-muted muted
                     45  off      UN-muted muted
                     46  on       muted   muted
                     47  off      muted   muted
 $14e3   #69
 $14e3   #70
 $14e3   #71
 $1142   #72         Pulls, outputs 1 word
 $11ff   #73XXXXYYYYZZ  Scans Channels
                     XXXX = Starting
                     YYYY = Ending
                     zz   = Delay
 $1305   #74         keypad test
 $0ef1   #75         Enable Hands-free (disable spkr)
 $0ef7   #76         Disable Hands-free (enable spkr)
 $0efd   #77         Turns on Loudspeaker near mic
 $14e3   #78
 $14dd   #79
 $1a42   #80
 $1962   #81
 $19c8   #82
 $182c   #83
 $1789   #84
 $18fe   #85
 $14e3   #86
 $14e3   #87
 $14e3   #88
 $14e3   #89


The Oki Mod
~~~~~~~~~~~

  Here is the Oki 900 mod, some changes will need to be made to the
4701 binary before this will work.  THIS DOES WORK, and IS THE REAL
THING, this is the same one that lame people are selling for cash!

----------------------4715e.asm - Cut Here - Start ----------------------

; **********************************************************************
; *                                                                    *
; *                This is 4715 mod for the Oki 900 Phone              *
; *                                                                    *
; *                      by:  Oki Dokie                                *
; *                                                                    *
; *      There are a few changes you will have to make to your binary  *
; *  in order for this code to work for you.  A you need to get        *
; *  around the check sums, if you can not do that, you should not    *
; *  have this.                                                        *
; *                                                                    *
; *     Look at $00dd in the 4701 binary, you will see 12073D, Change *
; *     this to 12A290, do this to get the code to run.                *
; *                                                                    *
; **********************************************************************
;
; **********************************************************************
; *
; * BFE1 = 1 Selector  ( With a #$20 there, we have a clone), Normal
; * BFE2 = 2 Selector  ( with a #$20 there, we have a clone), other Tumble
; * BFE3 = 5 Selector  #$20 = clone, $40 = Rotate, other = auto
; * BFE4 = Number of times can be ESN used
; * BEF5 = Number of times it has been
; * ESN Location #1  $be8e-$be91
; * ESN Location #2  $be93-$be96
; * ESN Location #3  $be98-$be9b
; * ESN Location #4  $be9d-$bea0
; * ESN location #5  $bea2-$bea5
; *
; **********************************************************************
;
;     Patch this in at $a0de (in the 4701 binary).  This should be
;   patched in as is!   This is the address for the indirect jump for
;   the auto mode.  Auto mode is the 230 ESN mode where the 230 ESN are
;   used and deleted after they are used x number of time.  x is from
;   0 to 255, this value is poked in $BFE4.  Three strikes and you're out!
;
;   The NAM has to be entered in as it is stored in the phone, you
;   will have to look that one up yourself, and write your own
;   program. :)
;
;   You will also need to rework the checksums on the ROM.
;      Fast turn on:
;                 ROM Address $00AB contains  $90 $FF $00
;                                 change  to  $02 $00 $C8
;                          After the $00 starting at address
;                          $00AE you can have the words
;                          &quot;Think There was code Here?&quot;
;                          and that will being you up to $00C8
;                          (that is with out the double quote)
;
;      Slow turn on:
;                ROM Address $00C5 contains  $02 $03 $C5
;                                change  to  $00 $00 $00
;
;
; **********************************************************************
; Org A016
;
; b010b029b044b05db078b091b0acb0c5b0deb0f9b112b12db146
; b15fb17ab193b1aeb1c7b1e0b1fbb214b22fb248b261b27cb295
; b2b0b2c9b2e2b2fdb316b331b34ab363b37eb397b3b2b3cbb3e4
; b3ffb418b433b44cb465b480b499b4b4b4cdb4e6b501b51ab535
; b54eb567b582b59bb5b6b5cfb5e8b603b61cb637b650b669b684
; b69db6b8b6d1b6ecb705b71eb739b752b76db786b79fb7bab7d3
; b7eeb807b820b83bb854b86fb888b8a1b8bcb8d5b8f0b909b922
; b93db956b971b98ab9a3b9beb9d7b9f2ba0ba000a019a034a04d
; a06da081a09aa0b5a0cfa0eda102a11ba136a14fa16ca183a19c
; a1b7a1d0a1eca204a21da238a251a26ca285a29ea2b9a2d2a2ed
; a306a31fa33aa353a36ea387a3aca3bda3d5a3efa408a42da43c
; a455a470a489a4bea4d6a4f1a50aa52da53fa557a572a58ba5ac
; a5bfa5d8a5f3a60ca62ca640a659a674a68da6aca6c1a6daa6f5
; a70ea72ca743a75ca776a78fa7aca7c3a7dca7f7a810a82ca844
; a85da878a891a8aca8c5a8f9a912a92da946a97aa993a9aea9c7
; a9fbaa14aa2caa3baa4aaa5aaa6caa7caa8daa9caaadaabcaacd
; aaecaafcab0cab2cab3cab4cab5cab6cab7cab8cabacabccabec
; abfcac0cac2cac3cac4cac5cac6cac7cac8cac9cacacacbcaccc
; acecacfcad0cad2cad3cad5cad6cad7cad8cadacadccadecae0c
; ae1cae2cae3cae4cae5cae6cae8cae9caeacaebcaeccaedcaeec
; aefcaf0caf1caf2caf3caf4caf5caf6caf7caf8caf9cafacafbc
; afccafdcaffcba15ba20ba2cba38ba43ba4fba5bba66ba71ba7d
; ba9ababdbac9bad5bae1baedbaf9bb05bb11bb1dbb29bb35bb41
; bb4dbb59bb65bb71bb7dbb89bb95bba1bbadbbb9bbc5bbd1bbdd
; bbe9bbf5bc01bc0dbc19bc25bc31bc3dbc49bc55bc61bc6dbc79
; bc85bc91bc9dbca9bcb5
;
;  org.  $a290
;
;
;***********************

begin:  .org $a290
eleetesn:mov dptr, #$bf2c         ; NAM Select
        movx a, @dptr             ; Load that data up
        cjne a, #$01, try2
        mov dptr, #$bfe1          ; Load Selector, for Autodial/Clone Mod
        movx a, @dptr             ; Load that data up
        cjne a, #$20, wehnp       ; Do We Have Normal Phone?
        mov dptr, #$be8e          ; ESN Location #1  $be8e-$be91
        ljmp letsgo
wehnp:  ljmp nothing
try2:   cjne a, #$02, try3        ;
        mov dptr, #$bfe2          ; Load Selector, for Autodial/Clone Mod
        movx a, @dptr             ; Load that data up
        cjne a, #$20, wehtum      ; Do We Have Tumble?
        mov dptr, #$be93          ; ESN Location #2  $be93-$be96
        ljmp letsgo               ;
wehtum: mov dptr, #$bfe3          ; Load Selector, for Tumble/Clone Mod
        movx a, @dptr             ; Load that data up
        ljmp tumbl
try3:   cjne a, #$03, try4        ;
        mov dptr, #$be98          ; ESN Location #3  $be98-$be9b
        ljmp letsgo               ;
try4:   cjne a, #$04, its5        ;
        mov dptr, #$be9d          ; ESN Location #4  $be9d-$bea0
        ljmp letsgo               ;
its5:   cjne a, #$05, nothing     ; Better be 5, or you get NOTHING!!
        mov dptr, #$bfe3          ; Load Selector, for Autodial/Clone Mod
        movx a, @dptr             ; Load that data up
        cjne a, #$20, wehad       ; Do We Have Auto Dial?
        mov dptr, #$bea2          ; ESN Location #5  $bea2-$bea5
        ljmp letsgo               ;
wehad:  cjne a, #$40, ihad2       ; Do We Have Auto Dial?
        ljmp rotate               ; Maybe We have Rotate
ihad2:  ljmp autodia              ;
tumbl:  mov a, #$01               ;\
        mov dptr, #$7005          ; |Turn off EEPROM write protect.
        movx @dptr, a             ;/
        mov dptr, #$bec2          ; ==========
        mov r0, #$60              ;
        mov r1, #$04              ;
loop:   movx a, @dptr             ;   Put current Serial # into $60-$63
        mov @r0, a                ;
        inc dptr                  ;
        inc r0                    ;
        djnz r1,loop              ; ==========
        mov a, $63                ;     Store last byte of ESN
        mov $66, a                ;     for random MIN routine.
        mov a, $62                ;     and third byte for random
        anl a, #$9f               ;     first byte.
        orl a, #$80               ;
        mov $60, a                ;
        inc $60                   ; ==========
        xrl $61, a                ;
        dec $61                   ;   Randomize the second
        mov a, $61                ;   byte by using the
        anl a, #$0f               ;   first byte as a seed.
        mov $61, a                ;
        mov dptr, #$be00          ; ==========
        movx a, @dptr             ;
        mov @r0, a                ;  Put position pointer for
        inc dptr                  ;        XOR code.
        inc r0                    ;  Put DPTR in $64-$65
        movx a, @dptr             ;
        mov @r0, a                ; ==========
        mov a, $64                ;
        xch a, $83                ; $83 = DPH
                                  ; Take pointer for XOR, put

        mov a, $65                ;  it in DPTR. Then pull
        xch a, $82                ; $82 = DPL
                                  ;  the information in those
        clr a                     ;
        movc a, @a+dptr           ;  two bytes in the *ROM*
        xrl $66, a                ; (store for later use)
        xrl $62, a                ;  and XOR it with the
        inc dptr                  ;  last two ESN bytes.
        clr a                     ;
        movc a, @a+dptr           ;
        xrl $63, a                ; ==========
        inc $65                   ;
        mov a, $65                ; Increase the position
        jnz nocarry               ; of the pointer
        mov a, $64                ; for doing an XOR.
        inc a                     ; with the carry
        cjne a, #$97, noflip      ; function.
        clr a                     ;
noflip: mov $64, a                ; ==========
nocarry:mov dptr, #$be00          ;
        mov a, $64                ; Store the new pointer
        lcall $2ffb               ; into the EEPROM
        inc dptr                  ; at $BE00
        mov a, $65                ;
        lcall $2ffb               ; ==========
        mov dptr, #$bf3b          ;
        movx a, @dptr             ; Take the time
        add a, $62                ; used in minutes
        mov $62, a                ; on the phone
        inc dptr                  ; and add it to
        movx a, @dptr             ; the ESN.
        add a, $63                ;
        mov $63, a                ; ==========
        mov dptr, #$bec2          ;
        mov r0, #$60              ; Store the
        mov r1, #$04              ;
esnloop:mov a, @r0                ; new ESN into
        lcall $2ffb               ;
        inc dptr                  ; the EEPROM.
        inc r0                    ;
        djnz r1,esnloop           ; ==========

        mov dptr, #$bea1          ; If $BEA1 is set to
        movx a, @dptr             ; #$01, then don't
        cjne a, #$01, fixmin      ; randomize the
        ljmp done                 ; phone number.

fixmin: mov a, $63                ; ==========  [Begin MIN Randomizer]
        anl a, #$03               ;
        cjne a, #$03, notbad      ;  Randomize The Two high bits
        anl a, #$01               ;  of x where last four = xYYY

;       SID-------  min1/min2-------------------  IPCH------  OLC-  GIM-
; NAM1  A02B  A06B  A0AB  A0EB  A12B  A16B  A1AB  A1EB  A22B  A26B  A2AB
; NAM2  A2EB  A32B  A36B  A3AB  A3EB  A42B  A46B  A4AB  A4EB  A52B  A56B
; NAM3  A5AB  A5EB  A62B  A66B  A6AB  A6EB  A72B  A76B  A7AB  A7EB  A82B
; NAM4  A86B  A8AB  A8EB  A92B  A96B  A9AB  A9EB  AA2B  AA6B  AAAB  AAEB
; NAM5  AB2B  AB6B  ABAB  ABEB  AC2B  AC6B  ACAB  ACEB  AD2B  AD6B  ADAB
;        A     B     C     D     E     F     G     H     I     J     K
notbad: mov $67, a                ;
        mov dptr, #$a3eb          ; Row = E
        movx a, @dptr             ;  =======
        anl a, #$fc               ;  Randomize The Two low bits
        orl a, $67                ;  of x where last four = xYYY
        lcall $2ffb               ;  =======
        mov dptr, #$a42b          ; Row = F
        movx a, @dptr             ;
        xrl $66, a                ;
        mov a, $67                ;
        cjne a, #$02, alltwo      ;
        mov a, $66                ;  Randomize the upper
        anl a, #$7f               ;  6 bits of the 10bit last 3
        mov $66, a                ;  digits of the MIN.
alltwo: mov a, $66                ;
        anl a, #$3f               ;[   MIN setup:                            ]
        cjne a, #$3f, notbig      ;[areacode--- 10 binary spaces (0=9&HEXCOV)]
        mov a, $66                ;[exchange--- 10 binary spaces (0=9&HEXCOV)]
        anl a, #$fe               ;[7th digit-- 4 binary space (DIRECT DEC)  ]
        mov $66, a                ;[8-10 dig--- 10 binary spaces (0=9&HEXCOV)]
notbig: mov a, $66                ;
        lcall $2ffb               ;  Randomize the lower
        mov dptr, #$a46b          ; Row = G
                                  ;  4 bits of the 10bit last 3
        cjne a, #$3e, keepem      ;  digits of the MIN.
        mov a, $62                ;
        anl a, #$70               ;
        mov $62, a                ;
keepem: mov a, $62                ;
        anl a, #$f0               ;
        lcall $2ffb               ; ========================================
        lcall $5d84               ; NAM Checksum byte correction
        mov dptr, #$7005          ;\
        mov a, #$00               ;| Write protect EEPROM again!
        movx @dptr, a             ;/
done:   mov r0, #$64              ;
        mov r1, #$04              ;  \
        clr a                     ;   |     Clear
clwork: mov @r0, a                ;   |     ESN/MIN
        inc r0                    ;   |     workspace
        djnz r1, clwork           ;  /
        clr a                     ;
        ret                       ;  Bye, bye NAM.
; ============= Subroutine for copying in a fake ESN ========================

letsgo: mov r0, #$60              ;
        mov r1, #$04              ;
cploop: movx a, @dptr             ;
        mov @r0, a                ;      THIS WILL COPY A OBTAINED
        inc dptr                  ;
        inc r0                    ;      ESN TO THE LOCATION FOR
        djnz r1, cploop           ;
        mov dptr, #$bec2          ;      REAL ESN USE. FOR USE
        mov r0, #$60              ;
        mov r1, #$04              ;      WITH ESN/MIN PAIRS.
wrloop: mov a, @r0                ;
        lcall $2ffb               ;
        inc dptr                  ;
        inc r0                    ;
        djnz r1, wrloop           ;
        ljmp done
autodia:mov a, #$01               ;\
        mov dptr, #$7005          ; |Turn off EEPROM write protect.
        movx @dptr, a             ;/
        clr $60                   ; Make sure $60 is clean
                                  ; ******* Loop for 1 to 256
                                  ; \
        mov $62, #$a0             ;  | #$a0de Load First Address
        mov $63, #$de             ;  | in Data Table
                                  ; /
                                  ; DPH   DPL
                                  ; $83   $82
pulldat:mov $83, $62              ; \
        mov $82, $63              ;  |  82 = DPL
        clr a                     ;  |  83 = DPH
        movc a, @a+dptr           ;  |  83 82
        mov $60, a                ;  |
        inc $63                   ;  | Read from Data Table starting
        mov $82, $63              ;  | at ROM address #$9f4e, we pull
        clr a                     ;  |
        movc a, @a+dptr           ;  |
        mov $61, a                ;  | the data (the data being a address)
        mov $83, $60              ;  | and test to see if there is
        mov $82, $61              ;  | data (an ESN) at that location.
        movx a, @dptr             ;  |
        jnz found1                ; /
        inc $63                   ; \
        mov a, $63                ;  |
        cjne a, #$00, overtst     ;  |  If we get nothing, we will add
        inc $62                   ;  | one more (MUST be an even number
overtst:mov a, $62                ;  | for this to work), while making
        cjne a, #$a2, pulldat     ;  | sure we do not pass address
        mov a, $63                ;  | #$a140, which is the end of the ESN,
        cjne a, #$90, pulldat     ;  |
        ljmp nothing              ; /
                                  ; ESN
                                  ;  $62 - 1st byte ESN
                                  ;  $63 - 2nd byte ESN
                                  ;  $64 - 3rd byte ESN
                                  ;  $65 - 4th byte ESN
                                  ;  $66 - 1st byte NAM for SID
                                  ;  $67 - 2st byte NAM for SID
                                  ;  $68 - NAM
                                  ;  $69 - NAM
                                  ;  $6A - NAM
                                  ;  $6B - NAM
                                  ;  $6C - NAM
found1: mov r0, #$62              ;  | Setup for copy loop
        mov r1, #$0B              ; /
ncplop: movx a, @dptr             ; \
        mov @r0, a                ;  |
        inc dptr                  ;  |  Copy Data to RAM
        inc r0                    ;  |
        djnz r1, ncplop           ; /

; **************************************************

                                  ; ******* Use Number
                                  ; * BFE4 = Number of times can be ESN used
                                  ; * BEF5 = number of times it has been
                                  ; *******
usenum: mov dptr, #$bfe4          ; Times address
        movx a, @dptr             ; Lets see what's there
        mov $56, a                ; store for a sec
        inc dptr                  ; bfe5
        movx a, @dptr             ; Lets see what's there
        inc a                     ; We used it again, need to add that so
        cjne a, $56, morlif       ; Three Strikes and your out!
        mov $83, $60              ; \
        mov $82, $61              ;  | Load DPTR
                                  ; /
        clr a                     ;    A = 00
        mov r0, #$0b              ;    Loop X number
delesn: lcall $2ffb               ; \
        inc dptr                  ;  | Wipe out ESN
        djnz r0, delesn           ; /
morlif: mov dptr, #$bfe5          ;    Load address
        lcall $2ffb               ;
;**************************************************
comonp: mov dptr, #$bec2          ; \
        mov r0, #$62              ;  | Set up for ESN Write
        mov r1, #$04              ; /
nwrlop: mov a, @r0                ; \
        lcall $2ffb               ;  |
        inc dptr                  ;  |  **Write ESN loop
        inc r0                    ;  |
        djnz r1, nwrlop           ; /
        mov dptr, #$ab2b          ; &lt;----  SID address
        mov r0, #$66              ; &lt;----  Start RAM at SID
        mov r1, #$07              ; &lt;----  #7 Times
                                  ;
                                  ; SID-------  MIN1/MIN2-------------------
                                  ; AB2B  AB6B  ABAB  ABEB  AC2B  AC6B  ACAB
                                  ;
donam:  mov a, @r0                ; \
        lcall $2ffb               ;  |
        lcall $3110               ;  |  Write SID, MIN1 and MIN2
        inc r0                    ;  |
        djnz r1, donam            ; /
        mov r0, #$60              ; \
        mov r1, #$0D              ;  |
        clr a                     ;  |      Clear
clwrk2: mov @r0, a                ;  | ESN/SID/MIN1/MIN2
        inc r0                    ;  |     workspace
        djnz r1, clwrk2           ; /
        clr a                     ; Clear A
        lcall $5d84               ; NAM Checksum byte correction
        mov dptr, #$7005          ; \
        mov a, #$00               ;  | Write protect EEPROM again!
        movx @dptr, a             ; /
        ljmp done                 ; New ESN/MIN
rotate: mov a, #$01               ; \
        mov dptr, #$7005          ;  | Turn off EEPROM write protect.
        movx @dptr, a             ; /
        clr $60                   ; Make sure $60 is clean
        clr $61                   ; Make sure $61 is clean
; 01
        mov dptr, #$bef6          ;
        movx a, @dptr             ; load up offset
        mov $61, a                ; load up offset
;************************************************
        mov dptr, #$bfe4          ; Times address
        movx a, @dptr             ; Lets see what's there
        mov $56, a                ; store for a sec
        inc dptr                  ; bfe5
        movx a, @dptr             ; Lets see what's there
        inc a                     ; We used it again, need to add that so
        cjne a, $56, morlif       ; Three Strikes and your out!

;************************************************
allovr: inc $61                   ; $61 is needed because A is used
                                  ; for other things
        mov a, $61                ; And if $61 is different
        cjne a, #$e8, donew       ; We only have 230 ESNs to spin thru
        mov $61, #$01             ; back to z old FF
donew:  mov a, $61                ; We have to copy it again if it is different
        movx @dptr, a             ; write the new value back
                                  ;
                                  ;   The reason I copy A to $61 and back
                                  ;   is because A is used else where
                                  ;
        mov $60, #$e7             ; the total value
        mov dptr, #$a28e          ; Load the END of the data
rrssee: mov a, $60
        cjne a, $61, decrota      ; do we have a match?
        sjmp gtaaddr              ; gotta address
decrota:dec $82                   ;              \
        dec $82                   ; DPH    DPL    |  dec on DPTR
        mov a, $82                ;               |
        cjne a, #$fe, nofdech     ; $83    $82    |  With carry
        dec $83                   ;              /
nofdech:djnz $60, rrssee          ; loopit!
        ljmp nothing              ; there is nothing there,..
gtaaddr:movx a, @dptr             ; Load of the ESN for a test
        jz allovr                 ; Is there data there?
        mov r0, #$62              ;  | Setup for copy loop
        mov r1, #$0B              ; /
rcpllop:movx a, @dptr             ; \
        mov @r0, a                ;  |
        inc dptr                  ;  |  Copy Data to RAM
        inc r0                    ;  |
        djnz r1, rcpllop          ; /
        ljmp comonp
.END

--------------------- 4715e.asm End - Cut Here - End  --------------------


The Network Wizards Interface cable
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    With the interface cable, one can program the NAM and ESN on the phone
with this mod.  Clone a phone fast, easy and fun!


---------------------- prog.c - Start - Cut Here  ------------------------


/*
ESN Location #1  $be8e-$be91
ESN Location #2  $be93-$be96
ESN Location #3  $be98-$be9b
ESN Location #4  $be9d-$bea0
ESN location #5  $BEA2-$BEA5
*/

#include <stdio.h>
#include <dos.h>
#include <conio.h>
#include <bios.h>
#include <ctype.h>
#include <math.h>
#include <string.h>

#define FALSE           0
#define TRUE            1
#define SWAP(a,b) (a^=b,b^=a,a^=b)
typedef unsigned char bool;
typedef unsigned char byte;
typedef unsigned int  word;
#include &quot;ctlib.h&quot;

/*    Defines that CTLIB does not have   */
#define CT_KEY_1AND3      0x30
#define CT_KEY_4AND6      0x31
#define CT_KEY_7AND9      0x32
#define CT_KEY_STAR_POUND 0x33
#define CT_KEY_RCL_MENU   0x28
#define CT_KEY_SND_END    0x35
/*   You may want to use these too!#@ */

#define BUFLEN          128
#define ESC             0x1B

char buf[BUFLEN];

char ps_system;
byte nambyte = 0x00;
byte namonebyte =0x01;
int  ps_cc;                             /* control channel */
int  ps_cc_rss;                         /* control channel last rss */

char ournum[32];                        /* our telephone number */
unsigned long ouresn;                   /* our esn */


main(argc,argv)
  int argc;
  char *argv[];
{
  int i;


  /* initialize ct library using the specified COM port */
  if (argc &gt; 1)
  {
    if (*argv[1] == '1')
      ct_lib_init(900,0x3f8,4);
    else if (*argv[1] == '2')
      ct_lib_init(900,0x2f8,3);
    else if (*argv[1] == '3')
      ct_lib_init(900,0x3e8,5);
    else
    {
      puts(&quot;Type 'TMPRO 2' to use COM2&quot;);
      exit(0);
    }
  }
  else
    ct_lib_init(900,0x3f8,4);           /* com1 by default */

  /* power up oki and tell it what mode to use */
  if (!ct_on(MODE_TEST))
  {
    fprintf(stderr,&quot;?No response from OKI\n&quot;);
    cleanup();
    exit(1);
  }


   if (!ct_on(MODE_TEST))
   {
    fprintf(stderr,&quot;?No response from OKI\n&quot;);
    cleanup();
    exit(1);
   }

  strcpy(ournum,nam_info[ct_state.namindex].number);    /* use current nam */
  printf(&quot;Current NAM index #: %d\n&quot;,ct_state.namindex);
  printf(&quot;Current NAM number : %d\n&quot;,nam_info[ct_state.namindex].number);
  printf(&quot;Tel# is %s, &quot;,ournum);

  if (!ct_get_esn(&ouresn))
  {
    fprintf(stderr,&quot;?Can't get ESN\n&quot;);
    cleanup();
    exit(1);
  }
  printf(&quot;ESN is %08lx\n\n&quot;,ouresn);

  cmd_elite_stuff();

  cleanup();
  exit(0);
}

cleanup()
{
  ct_off();                             /* turn off phone */
  ct_lib_done();                        /* cleanup library stuff */
}

cmd_power_messages()
{
   byte c,x,pointer;
   char powerstring[8];
   char ch;

   for (c=1;c&lt;32;c++)
    {
    for (x=0;x&lt;8;x++)
     {
      powerstring[x] = (c*8) + x;
      printf(&quot;%x &quot;,powerstring[x]);
      pointer = 0xBEAF + x;
      ct_set_block(&powerstring[x],pointer,1);
     }
    printf(&quot;\n&quot;);
    ct_off();
    ct_on(MODE_NORMAL);
    ch = getche();
    ct_off();
    if (ch == 'x')
     {
      cleanup();
      exit(1);
     }
    delay(1000);
    ct_on(MODE_TEST);
    ct_get_nams();
    }
}


cmd_elite_stuff()
{
 char ch;
 unsigned long esn;
 byte counter;
 char sysid[6];

   fetch_esn(&esn,1);
   printf(&quot;our NAM#1 ESN : %08lx\n&quot;,esn);
   fetch_esn(&esn,2);
   printf(&quot;our NAM#2 ESN : %08lx\n&quot;,esn);
   fetch_esn(&esn,3);
   printf(&quot;our NAM#3 ESN : %08lx\n&quot;,esn);
   fetch_esn(&esn,4);
   printf(&quot;our NAM#4 ESN : %08lx\n&quot;,esn);
   fetch_esn(&esn,5);
   printf(&quot;our NAM#5 ESN : %08lx\n&quot;,esn);

   printf(&quot;Enter number of NAM to configure (1-5) : &quot;);
   ch = getche();
   printf(&quot;\nEnter new ESN : &quot;);
   scanf(&quot;%8lx&quot;, &esn);
   printf(&quot;Enter new MIN : &quot;);
   scanf(&quot;%10s&quot;, &ournum);
   printf(&quot;Enter system ID : &quot;);
   scanf(&quot;%5s&quot;, &sysid);

   store_esn(esn, ch-48);

   nambyte = ch-48;
   ct_set_block(&nambyte,0xBF2C,1);
   ct_set_block(&nambyte,0xC0FF,1);

   store_min((ch-48),ournum,sysid);

}

int fetch_esn(esn,nam)
unsigned long *esn;
int nam;
{
 word addr;
 union esn_un {
    unsigned long l;
    byte b[4];
   } myesn;

switch (nam) {
  case 1:  addr = 0xBE8E; break;
  case 2:  addr = 0xBE93; break;
  case 3:  addr = 0xBE98; break;
  case 4:  addr = 0xBE9D; break;
  case 5:  addr = 0xBEA2; break;
  default: return(1); break;
 }

 ct_read_block(esn,addr,4);
 myesn.l = *esn;
 SWAP(myesn.b[0],myesn.b[3]);
 SWAP(myesn.b[1],myesn.b[2]);
 *esn = myesn.l;
 return(0);
}


int store_esn(unsigned long stored_esn, int nam)
{
  word addr;
  union esn_un {
    unsigned long l;
    byte b[4];
   } myesn;

switch (nam) {
  case 1:  addr = 0xBE8E; break;
  case 2:  addr = 0xBE93; break;
  case 3:  addr = 0xBE98; break;
  case 4:  addr = 0xBE9D; break;
  case 5:  addr = 0xBEA2; break;
  default: return(1);     break;
 }

  myesn.l = stored_esn;
  SWAP(myesn.b[0],myesn.b[3]);
  SWAP(myesn.b[1],myesn.b[2]);
  stored_esn = myesn.l;
  ct_set_block(&stored_esn,addr,4);
  return(0);
}


store_min(int nam, char *num, char *sysid)
 {
   int x;

   ct_off();
   ct_on(MODE_NORMAL);
   delay(1000);
   send(CT_KEY_RCL_MENU);
   send(CT_KEY_STAR);
   send(CT_KEY_6);
   send(CT_KEY_2);
   send(CT_KEY_7);
   send(CT_KEY_2);
   send(CT_KEY_9);
   send(CT_KEY_8);
   send(CT_KEY_5);
   send(CT_KEY_4);
   send(CT_KEY_POUND);
   printf(&quot;Waiting for messages to settle\n&quot;);
   delay(4000);
   for (x=0;x&lt;4+nam;x++)
     send(CT_KEY_DOWN);
   printf(&quot;Waiting for NAM %d to fall through\n&quot;,nam);
   delay(3000);
   sendnum(num);
   send(CT_KEY_STO);
   send(CT_KEY_DOWN);
   sendnum(sysid);
   send(CT_KEY_STO);
   send(CT_KEY_CLR);
   send(CT_KEY_CLR);
   ct_off();
}


sendnum(char *number)
{
  int x;

   for (x=0;x&lt;strlen(number);x++)
     {
       switch (number[x])
       {
         case '0' :     send(CT_KEY_0); break;
         case '1' :     send(CT_KEY_1); break;
         case '2' :     send(CT_KEY_2); break;
         case '3' :     send(CT_KEY_3); break;
         case '4' :     send(CT_KEY_4); break;
         case '5' :     send(CT_KEY_5); break;
         case '6' :     send(CT_KEY_6); break;
         case '7' :     send(CT_KEY_7); break;
         case '8' :     send(CT_KEY_8); break;
         case '9' :     send(CT_KEY_9); break;
         default  :     printf(&quot;Fuckup in sendnum string!&quot;); exit(1); break;
       }       // switch
     }       // for
}
/* &quot;push&quot; key for 100 milliseconds */
send(key)
  int key;
{
  ct_keypress(key);
  delay(100);
  ct_keypress(CT_KEY_RELEASE);
}

----------------------- prog.c End - Cut Here  ------------------------



Charter set in the Oki 900
~~~~~~~~~~~~~~~~~~~~~~~~~~

   The Oki 900 has a full charter set built in.  The charter set can
be used in the power on message.  The power on message can be programmed
by the debug command #54.  The addresses of the power on message are $BEAF
thru $BEB8.  Here is a list of the charter set, please note that all these
were guessed at, and some may be wrong.  ALL NUMBERS ARE IN HEX!

Small Katakana

A6 = a     A7 = i     A8 = u     A9 = e     AA = o     AB = ka    AC = ki
AD = ku    AE = ke    AF = ko


B0 = -

Katakana

B1 = a     B2 = i     B3 = u     B4 = e     B5 = o     B6 = ka    B7 = ki
B8 = ku    B9 = ke    BA = ko    BB = sa    BC = shi   BD = su    BE = se
BF = so    C0 = fa    C1 = chi   C2 = tsu   C3 = te    C4 = to    C5 = na
C6 = ni    C7 = nu    C8 = ne    C9 = no    CA = ha    CB = hi    CC = fa
CD = he    CE = ho    CF = ma    D0 = mi    D1 = mu    D2 = me    D3 = mo
D4 = ya    D5 = yu    D6 = yo    D7 = ra    D8 = ri    D9 = ru    DA = re
DB = ro    DC = wa    A6 = o     DD = n'

DE = dakutan
DF = Small circle the no one knows the name to
FC = Yen
FA = Thousand (Japanese)
FB = Adds zero

English

21 = &quot;     22 = !     23 = #     24 = $     25 = %     26 = &     27 = '
28 = (     29 = )     2A = *     2B = +     2C = ,     2D = -     2E = .
2F = /     30 = 0     31 = 1     32 = 2     33 = 3     34 = 4     35 = 5
36 = 6     37 = 7     38 = 8     39 = 9     3A = :     3B = ;     3C = &lt;
3D = =     3E = &gt;     3F = ?     40 = @     41 = A     42 = B     43 = C
44 = D     45 = E     46 = F     47 = G     48 = H     49 = I     4A = J
4B = K     4C = L     4D = M     4E = N     4F = O     50 = P     51 = Q
52 = R     53 = S     54 = T     55 = U     56 = V     57 = W     58 = X
59 = Y     5A = Z     5B = [     5D = ]     5E = ^     61 = a     62 = b
63 = c     64 = d     65 = e     66 = f     67 = g     68 = h     69 = i
6A = j     6B = k     6C = l     6D = m     6E = n     6F = o     70 = p
71 = q     72 = r     73 = s     74 = t     75 = u     76 = v     77 = w
78 = x     79 = y     7A = z     7B = {     7D = }     5F = _     60 = `
7C = |

SPACE = 0C, 0D, 10-20, 7E-A0


Misc. chars

01 - Right Triangle (Up)
02 - Right Triangle (Down)
05 thru 0F are random
E0 - Alpha
E1 - lower case a with two dots over it
E2 - Beta
E3 - Epsilon
E4 - Mu
E5 - Sigma
E6 - Circle with two flat sides on top
E7 - Circle with two flat sides on right hand side
E8 - Square root
E9 - To the power of -1 (1/x)
EA - i (Complex Number)
EB - To the power of x
EC - Cent
ED - Pound
EE - Lower case n with line over it
EF - o with two dot over it
F0 - L with circle
F1 - inverted image of F0
F2 - Theta
F3 - Infinity
F4 - Upper Omega
F5 - U with two dots over it
F6 - Upper Signa
F7 - Pie
F8 - X with a line over it
F9 - Upper Mu
FE - Division

********************************** EoF *********************************


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH