THE HIGH TECH HOODS
& A-CORP PRESENTS... 

                        *%*%*%*%*%*%*%*%*%*%*%*%*%*%*
                        *%       THE ULTIMATE      %*
                        *% CELLULAR PHONE PHREAKS  %*
                        *%     MANUAL PART 2       %*
                        *%                         %*
                        *%   WRITTEN BY THE RAVEN  %*
                        *%     AND INTROSPECT      %*
                        *%*%*%*%*%*%*%*%*%*%*%*%*%*%*

 
 

                                                      THE RAVEN
                                                      +=======+
       THANKS TO THE FOLLOWING:  PEBBLES, BIT STREAM & THOMAS ICOM
/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\//\/\/\/\/\/\/\/\/\/\/\/\

     INDEX:

              I. WHAT'S IN A NAM
             II. NAM/ESN REPROGRAMMING
            III. ADVANCED REPROGRAMMING
             IV. OBTAINING SYS. REGISTRATION DATA
              V. REPROGRAMMING YOUR PHONE
             VI. ------------------------

\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\

 I. What's In A NAM

 First thing were going to start with is the NAM. The NAM is a PROM, A blank
NAM costs about $5. Sometimes its more expensive depending on the operating
temperature and packaging specifications.
 Two flavors of NAM's are most commonly used for cellular phones. NEC Corp.
uses the open collector (SIGNETICS p/n 82S23 or equivalent). All others use
the tri-state (SIGNETICS 82S123 or equivalent). Blank NAMs are manufactured by
Signetics, National Semiconductor, Monolithic Memorys, Fujitsu, Texas Instrum
ents, and Advanced Microdevices. Blank NAMs can be purchased at your local
electronic distributor's, thru the various parts sources advertised in 
electronic magazines, and some radios come with a blank included.
 The NAM contains the subscriber number and lock code, the home system ID and
other system-required data. You may wonder how this info is arranged. The NAM
is organized into 32 rows and 8 colums. It is 32 words of 8 bits each.
(256 bits total). Starting  from top of the NAM (address 00), you will find
the abreviation SIDH. This means "System Identifaction Number Home", a number
starting at 0001 assigned by the FCC. Each market allows two systems. These
two digits are even for the wire-line and odd for the non-wireline.
 At address 03, we find LU (Local Use) on the left and MIN on the right, and
they are usually set to 1. Locations with zeros are reserved. Going down the
map, there's MIN1 and MIN2-the subscriber number and the area code respectively
Dont try to read them from a raw printout of the NAM data, as they are 
scrambled beyond recognition. The reason? THe way they are arranged is the way
they must be transmitted to the cellular systems receivers. The programmer
does this to make the radio's job easier.
 Next is the station class mark, which identifies the class and power
capability of the phone. The system will treat a handheld (low power) 
differently than a standard 3-watt mobile.

 IPCH is the Inital Paging Channel. The radio listens for a page on this
channel. Wirelines use 334 and non-wirelines use 333.

 ACCOLC (ACCess Overload Class) is designed for throwing off customers in the
event of an overload. Thru neglect, this standard has been largly unused.
(A Class 15 stationis supposed to be police, fire or military). Usually, It's
a set to 0 plus the last digit of the phone number to provide random loading.

 PS (Preferred System). This is always 1 in a non-wireline and 0 in wireline.

 The Lock Code is about the only thing you can read directly by studying NAM
data. The "spare" bit must be a 0 if the radio contains a 3-digit code.
Because the number of clicks when you dial 0 on a (dial) phone equals 10,
zeros in the lock code are represented by an "A"(the hexadecimal equiv of 10).

 EE, REP, HA and HF correspond to end-to-end signaling (DTMF tones, possibly
as you talk), and REPeratory dialing (provision for 10 or more numbers in
memory).

 Horn Alert and Hands Free. Like all options, they are 1 if turned on and 0 if
turned off (all these numbers are in hex). They are supposed to be used by
radio makers to store option switches. Usually 13 is used, 14 sometimes and 
the rest less often.

 Last, you will find Cheksum Adjustment and Checksum. These numbers are 
calculated automatically after the data has been edited for the NAM. The sum
of all words in the NAM plus these last two must equal a number with 0's in
the last two digits. The radio checks this sum and if it isn't correct the
radio assumes the NAM is bad or tampered with. In the case radio refuses to
operate until a legal NAM is installed.

                        THE ANATOMY OF A NAM
                        --------------------

       MARK Defin.    most <-- BIT Significance --> least Hex
       ------------------------------------------------------
                             0     SIDH (14-8)            00
                                   SIDH (7-0)             01
       LU=Local use LU       000000        MIN            02
                             00    MIN2 (33-28)           03
                                   MIN2 (27-24)  0000     04
                             0000  MIN1 (23-20)           05
                                   MIN1 (19-12)           06
                                   MIN1 (11-4)            07
                                   MIN1 (3-0)    0000     08
                             0000  SCM (3-0)              09
                             00000 IPCH (10-8)            0A
                                   IPCH (7-0)             0B
                             0000  ACCOLC (3-0)           0C
       PS=Perf Syst    0000000     PS                     0D
                       0000    GIM (3-0)                  0E
                       LOCK DIGIT 1    LOCK DIGIT 2       0F
                       LOCK DIGIT 3    LOCK SPARE BITS    10
       EE=End/End            EE    000000 REP             11
       REP=Reprity     HA    000000              HF       12
       HF=Handsfree          Spare Locations (13-1D)      13
       HA=Horn Alt               contain all 0's          1D
                
                             NAM CHECKSUM ADJUST.         1E
                             NAM CHECKSUM                 1F

 II. NAM/ESN REPROGRAMMING

 The first step to using cellular phones is to obtain one. They can be 
purchased new or used. Ham fests are one good source. Many people dump their
cellular phones once they see just how expensive they are to operate. And of
course the perception of being jerked promotes phreaking. 
 First generation E.F. Johnson units are good choice as they are easy to 
modify, use uniquely effective diveristy (dual antenna) receivers, and use the
AMPS control bus, which means that several maker's control heads will work 
with it. Another good choice is Novatel's Aurora/150. It uses a proprietary
parallel bus and control head, but costs less, is rugged, and is also easy to
work on. Also, all Novatel CMTs have built-in diagnostics. This allows you to
manually scan all 666 repeater output freqs-great for scanning!
 All cellular phones have a unique ESN. This is a 4-byte hex or 11 digit 
octal number stored in the ROM soldered on the logic board. Ideally, it's 
supposed to be never changed. Some newer cellulars embed the ESN in a 
VLSI IC (Very Large Scale Integration Integrated Circuit) along with the units
program code. This makes ESN mods very difficult at best. The ESN is also
imprinted on the reciever boiler plate, usually mounted on the outside of the
housing. When converted to octal (11 digits), the first 3 digits represents
the maker while the other 8 identify the unit.
 The other important ROM is the NAM. It contains the MIN (i.e. phone #,
including area code), the lock code, and various model ID and carrier ID
codes.
 The lock code keeps unauthorized parties from using the phone. Some newer
cellulars have no built in NAM and instead use an EEPROM, which allows a
technician who knows the maintenance code to quickly change the NAM data thru
the control head keypad.
 WHen one attempts to make a cellular call, the transceiver first automatically
transmits the ESN and NAM data to the nearest cellsite reapeter by means of
the Overhead Data Stream (ODS). The ODS is a 10 kilobaud data channel that 
links the cellular's computer to the MTSO, which then controls the phone's
entire operation down to the selected channel and output power. If the MTSO
doesn't recognize the received ESN/MIN pair as valid (sometimes due to RF
noise), it issues a repeat order and will not process the call unit until a
valid pair is received.
 In most cities, there are two CPCs or "carries". One is the wireline CPC and
the other is the non-wireline CPC. Both maintain their own MTSO and network
(i.e: cell-site repeaters), and occupy separate halves of the cellular radio
band. Non-wirelines use System A, and wirelines use System B. (the amenities
that are avaible with most landline phone service - call waiting, caller ID,
call-forwarding, 3-way calling,etc., are standard fair for most CPCs. However,
they are usually applied for differently.)
 For the cellular phreaker, the most diffuclt task is obtaining usable ESN/MIN
pairs. Over the years,standard phreaker techniques have been employed for all
types of phreaking to obtain the required info.  These includes trashing,
using inside help,joining the staff,hacking them from known good ESNs and
MINs (i.e: spoofing), con strategis, strong-arming, Bribing, blackmail, etc.
(This is how The High Tech Hoods get them!).
 The hacker knows that most CPCs do not turn off or keep track of unused MIN
numbers. In fact, their general pattern is to start at the low numbers and 
work their way up. WHen a number is cancelled, it is reassigned instead of 
using a larger number.
 The first places to look is the authorized cellular installers and service 
centers in your area (see your Yellow Pages). They have on file a record of
every cellular phone installed or serviced by them, including the ESN/MIN 
pairs. Another place to focus on is the cellular CPC's customer service or
billing department. These offices contain the ESN/MIN pairs often for
thousands of cellular phones,  and hire low-paid people. Some cellular CPCs,
installers and service centers will provide NAM system parameters upon
request, and some will sell you NAM and ESN memory maps and schematics of a
specific cellular phone model. And some will sell you service manuals
(i.e: Motorola) that will describe the often easy method to program their 
cellular phones.
 The good phreak/hacker could interface the cellular phone's ADC circuit to
his PC and hack out all of the valid ESN/MIN pairs he could possibly need.
Since the ESN/MIN pair are transmitted from cellular phones (usually in an
unencrypted form), these pairs can be obtained simply by scanning the cellular
phone channels. Even if they are encrypted, the phreaker only will need to 
reproduce the encrypted pair. In some areas, you can buy the ROMs right off
the street - often by the same dealers who sell drugs and stolen property,
etc. All it takes is a few discreet inquires. However, many get caught
doing this because of police stings.
 Once a valid ESN/MIN is obtained, it must be programed into the cellular 
phone's ROM. Some cellular makers use different devices and memory maps, but
the standard is the AMPS 16-pin 32x8 bit format and some ROMs have proprietary
markings.
 If the part number are different than those given and you can't find them in
your data book, look for the IC maker's logo and call or write them for data
sheets. If the IC's have proprietary markings, by looking at the external
parts that are directly wired to them, one can often determine not only
whether the IC is open-collector or tri-state, but also what the pin assingn-
ments are, and sometimes the type of replacement IC to use.
 The ESN ROM is then carefully desoldered from the logic board (first ground
the soldering tip thru a 1 Meg-ohm resistor). Once, removed the IC can then be
placed on a ROM reader/programmer or NAM programmer (bit editing mode). Any
ROM reader/programmer that will burn a compatible ROM is usable, but a 
dedicated NAM programmer has built-in software that takes out much of the
aggravation. Using a non-NAM ROM reader/programmer, one searches for the memory
locations that has the same number as ESN printed on the boiler plate. This 
number will be immediatly followed by an 8-bit checksum determined by the 8
least significant bits of the hex sum of the ESNs four bytes.
 The old ESN data (now copied into the NAM programmer's RAM) is replaced by the
new ESN and the updated checksum. A new blank and compatible ROM is inserted 
into the ROM burner and burned with the new ESN data. Most cellular phreakers
at this point install a Zero Insertion Force (ZIF) DIP socket into the logic
board for this and any future ROM changes.
 The NAM IC is usually already installed in a ZIF socket on the logic board.
Similarly, its MIN is read by the ROM reader/programmer and a new ROM is
burned with the new MIN and updated MIN checksum.  Altho one may wish to also
update the CPC's system parameters, they can left the same if the same CPC
is desired. To change the CPC'c designation, the last four MIN digits, the
checksum and the exchange (if they use more than one exchange) are changed.
 The more astute cellular phreaker of course can design and build his own NAM
programmer/reader, ideally one interfaced to a PC. A more primitive approach
is to interface two banks of hex thumbwheel switches to the sockets, altho
a computer program would be very helpful to determine the proper switch
settings. Thumbwheel switches allow you to make changes on the fly and they
can be plugged in as needed, so if one is caught red-handed, it is difficult
to prove intent and origin of phone call.

   III. ADVANCED REPROGRAMMING
 
 Your cellular phone contains a special memory which retains data about the 
phone's individual characteristics, such as its assigned phone number, system
identification number, (ID#) and other data that is necessary for cellular
operation. This special memory is known as the NAM. You can program the phone
yourself, if the phone has not already been programmed where you got it. You
can also reprogram the phone yourself should you wish to change some of the 
features already selected for the NAM.
  The reprogramming of the NAM is performed after you have contacted your
cellular system operator for the nessary data as described below. Enter the
data received from your cellular system operator in the NAM Reprogramming
Data Table before reprogramming  the NAM of your cellular phone. Incorrect
NAM entries can cause your cellular phone to operate improperaly or not at
all. Your cellular phone can be reprogrammed up to three times. After that,
it must be reset at a Motorola-authorized service facility.
 Be sure you read this complete text before attempting to reprogram your 
phone!

 1. RE-PROGRAMMING FEATURES

  You must get seven pieces of data from the cellular system operator to 
allow you to reprogram the cellular phone. You provide the remaining data.
Write all of this  programming data on the NAM Reprogramming Data Table
provided in this text before implementing this procedure. Incorrect NAM
entries can cause your cellular phone to operate improperly or not at all.
The required data is:
  * System Identification (SID) Code (S-digits): Indicates youe home system
    Enter 0's into the left-most unsued positions. Provided by the system
    operator.
  
  * Cellular Phone Number (10 digits): Used in the same manner as a standard
    land-line phone. The mobile phone number and the Electric Serial Number
    are checked against each other by the cellular system each time a call
    is placed or recieved. Provided to you by the system operator.

  * Station Class Code (2 digits): This number is 06 or 14 for most personal
    or portable phones. Even though your phone has extended bandwith
    capability (832 channel capacity), the cellular system operator may
    require your station class code to remain 06. The code should be 14 if
    832 channel operation is allowed.
  
  * Access Overload Class (2 digits): Provided to you by the system operator.

  * Group ID Mark (2 digits): Provided to you by the system operator.

  * Security Code (6 digits): The six-digit security code allows the user to
    restrict his calls in certain ways and permits other advanced security
    measures. Refer to your phones operator manual for further details. 
    Select any 6-digit code that you will remember, but one that will not be
    easily guessed.

  * Unlock Code (3-digits): The 3-digit unlock code unlocks the phone after
    it has been locked. LOcking the phone allows you to prevent unauthorized
    usage. With many models, this number can be resued as often as desired.
    Check the users manual. Select any convenient 3-digit number.

  * Initial Paging Channel (4 digits): Use a leading 0 if required.
    (example: Channel 334 is entered as 0334.) Provided to you by the 
    system operator.

  * Option Bits (6 digits): This reprogramming step allows you to program
    six seperate features in one step. Each feature is either selected or
    cancelled by assigning a value of 1 or 0. The six individual single-
    digit features combine to form a six-digit code which is entered as one 
    step. If any of the features is to be changed , the entire six-bit word
    must be re-entered.

      DIGIT #1: Internal Speaker: This feature is normally selected by
                entering 0. However, if you purchased the convertible
                Accessory and it contains a seperate external/VSP unit,
                cancel the internal speaker feature by reprogramming 1.

      DIGIT #2: Local Use: This feature is normally selected by entering 1.
                Your system operator can tell you if you need to cancel
                this feature by reprogramming 0.

      DIGIT #3: MIN Mark: This feature is normally not used and is assigned
                a value of 0. To select use 1.

      DIGIT #4: Auto Recall: This feature is always 1.

      DIGIT #5: 2nd Phone Number: This feature is usually not used and 
                assigned a value of 0.

      DIGIT #6: Diversity: This feature is always set at 0 for the portable/
                personal phone used alone. If you have a convertible
                accessory, and it has two external antennas, select this
                feature by reprogramming 1.

 * Option Bits (3 digits): This step allows you to reprogram an additional
   three separate features in one step. Each feature is either selected or
   cancelled with the digit 1 or 0. The three individual single-digit
   features combine  to form a three-digit code which is entered as one
   step. If any of the features is to be changed the entire three-bit word
   must be reentered.

      DIGIT #1: Long Tone DTMF: Certian electronic devices such as answering
                machines, are are not able to decode the normal DTMF tones
                because the phone standard duration is too short. The Long
                Tone DTMF allows access to answer machines and other similar
                devices by transmitting the DTMF tone for as long as the key
                is depressed. This feature  is normally not used and is 
                assigned a value of 0. However you can select long tone DTMF
                by reprogramminng 1.

      NOTE: Personal or portable models with a MENU key can more flexibly
            select and cancel this feature thru the menu. To allow Menu
            control of the function it must be cancelled in the NAM by 
            setting this bit to 0. If Long Tone DTMF is selected in the 
            NAM  with a 1 in this bit, it cannot be reversed thru the menu.

      DIGIT #2: Future use: This feature  is always set at 0.

      DIGIT #3: Eight-Hour Timeout (Convertible only): Personal or portable 
                phones with the convertible accessory can normally be left
                active in the vehicle for eight hours with the ignation cut
                off. If the time out feature is selected the phone will turn
                itself off after eight hours to preserve the vehicle's 
                battery. This feature is normally selected by entering 0.
                However, you can cancel this eight-hour time limit by 
                entering 1.
  
   IV.  OBTAINING SYS. REGISTRATION DATA

 A cellular phone owner purchases services from a cellular system operator,
just as he would purchase land-line service (for standard phones) from the
local phone company. In cities with cellular coverage, the customer may have
the option of picking one or two possible cellular system operators.
 Before you can obtain a phone number you will have to supply your cellular 
system operator with your electronic serial number. All cellular phones 
contain a special Electronic Serial Number (ESN). The ESN uniquely identifies
your phone and provides a measure of protection against theft and fraud. The
ESN is an eight-charcter (numeric/hexadecimal) number printed on the box
your phone came in. Once you supply your electronic serial number to the 
system operator he or she will issue your phone number and supply the other
data required to reprogram the NAM. You should immediately enter this data 
on the NAM Programming Data Table found in this text.

V.   REPROGRAMMING YOUR PHONE
     ************************

 Determinig the initial Reprogramming Sequence:

The initial reprogramming steps include a sequence of keypresses which vary
depending on the type of cellular phone you have. The phone NAM can be 
reprogrammed from the personal or portable keypad. Determine from the 
Six-Keystroke table below which of the six keystroke sequence numbers to 
use on your phone, based on the type of keys present on the keypad.

  SIX-KEYSTROKE TABLE

Determining the sequence Number with Personal/Portable Keypad

PERSONAL/PORTABLE KEYPAD KEYS SEQUENCE
======================================

            MENU AND FCN keys              6
            FCN key but no MENU key        1
            No FCN key                     2

If you have the convertible accessory, the phone NAM must reprogrammed from
the convertible handset. (MAke sure that the personal phone is disconnected
from the convertible accessory before reprogramming the convertible.) The 
handset type can be read from the label on the back of the handset. The 
keystroke sequence number is determinded from the KEYSTROKE SEQUENCE TABLE.
If you have the convertible accessory, and wish to use it seperately as a
atandalone mobile, you may obtain an additional phone number and reprogram
this into the convertible accessory at this time.

KEYSTROKE SEQUENCE TABLE
########################
Determining the sequence Number with Convertible Handset

                MODEL        HANDSET TYPE      SEQ.
                -----        ------------      ----
                3000         SCN2007A           6
                6000         SCN2023A           2
                6000X        SLN2020A           1
                6000XL       TLN2659A           1
                6800XL       TLN2733A           6

 Choose one of the six initial reprogramming sequences from the Initial
Sequence Table depending on the sequence number which you determined from
previous tables in this file.

 Initial Reprogram Sequence Table
 ++++++++++++++++++++++++++++++++

Seq. #  Sequence
1  FCN, Security Code entered twice, RCL
2  STO, #, Security Code entered twice, RCL
3  Ctl, 0 + Security Code entered twice, RCL
4  Ctl, 0 + Security Code entered twice, *
5  FCN, 0 + Security Code entered twice, MEM
6  FCN, 0 + Security Code entered twice, RCL

Security code is factory-programmed 000000.

 Initial Steps: Before you proceed with the reprogramming procedure, be sure
you have filled out the NAM Reprogramming Data Table herin:
        Step a: Turn on your cellular phone by pressing the Pwr or On/Off
                button. The power indicator in the display will flash.
        Step b: Enter the proper keystroke sequence determined from the
                Initial Sequence Table.
        Step c: The message, "01", will appear in the display to confirm the
                activaction of the NAM reprogramming feature. It also 
                indicates that you are at the first step in the NAM 
                reprogramming sequence. If this message does not appear, it
                may be due to one of these reasons:

  (1) The initial sequence may not have been entered quickly enough. The 
apperence of zeros in the display will indicate this. Press Clr and Try again.
  (2) The six digit Security Code may have previously been reprogrammed into
your cellular phone. If this happens to be the case, you must re-enter the
activation sequence using the assigned security code.
  (3) The maximum number of times that your cellular phone can be reprogrammed
from the keypad may have been reached.
  (4) The ability for your cellular phone to be reprogrammed from the keypad
may have been disabled or cancelled.

 REPROGRAMMING PROCEDURE: Reprogramming for a single phone number can be as
quick as a four-step process or may take up to 11 steps, depending on how
many programable features you wish to review or change. The phone always has
some data programed for each of the features, whether that data is standard
programming performed at the factory or data provided by someone who
programmed the unit previously. If, while you are reprogramming, you are 
satisfied with the value already programmed for a particular feature, simply
press * to move to the next feature. To perform the following steps, it is 
nessary for you to refer to the completed NAM Reprogramming Data Table. If 
you enter a digit incorrectly, press the Clr button to start again.

 REVIEWING of NAM REPROGRAMMING: Once you have completed the reprogramming
steps, review the data by repeatedly pressing *. Check to make sure that the
data reprogrammed matches what you wrote in the NAM Reprogramming Data Table.
Make any required changes.

 STORING the DATA: If you are reprogramming a single phone number, press SND
to store the programming data when you are satisfied that it is all correct.
A two-digit step number (01-11) must appear in the display in order for you 
to store the data. Press * until one appears and then press SND. Your
personal or portable cellular phone is now ready for normal use, if you are
reprogramming a single phone number.

 REPROGRAMMING the Second Phone #: If "012" appears in the display after you
have pressed SND to store the programming data for the first phone number, 
you are ready to repeat some or all of the ten steps, this time for a second
phone  number. The 01 indicates that you are ready to enter the System ID 
data (step 1) and the 2 indicates that you are reprogramming data for the
second phone number. The phone assigns the same security and lock codes 
(steps 7 and 8) for the second phone number and as so skips from step 6 to
step 9. There is no step 11 when reprogramming a second number.
 If "01 2" did not appear after reprogramming the first  phone number, and
you wish to reprogram a second number, either the second phone option has not
been selected (step 10) or your phone is not equipped for dual system 
operation. Once you have completed the reprogramming steps, review the data
by repeatly pressing *. Check to make sure that the data programmed matches
what you wrote in the NAM reprogramming Data Table. Make any required changes
Press SND to store the programming data when you are happy that it's all
correct. (A two-digit step number (01-10) must appear in the dispaly.)

Your personal or portable cellular phone is now ready for normal use.

 NAM REPROGRAMMING DATA TABLE
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

 STEP        DESCRIPTION               # OF DIGITS             SOURCE
---------------------------------------------------------------------------
  01        System ID #                    5 Digits           Sys Op
  02        Cellular Area Code             3 Digits           Sys Op
  03        Cellular Phone #               7 Digits           Sys Op
  04        Station Class Mark             2 Digits           Sys Op
      (Usually 14 for 832 chan., 12 for standalone mobile)
  05        Access Overld Class            2 Digits           Sys Op
  06        Group ID Mark                  2 Digits           Sys Op
  07        6-Digit Secur. Code            6 Digits           Phone Owner
  08        3-Digit Unlock Code            3 Digits           Phone Owner
  09        Initial Paging Chan.           4 Digits           Sys Op
           (Usually 0333 or 0334)

10 Option Programming 6 Digits

 /--------------------Handset Internal 1 Dgit                Phone Owner
                      Speaker disable
                      If your install, has a seperate
                      External Spkr/VSP unit
                      The handset internal speaker
                      must be disabled.
                      1 = disabled, 0 = enabled.
                      This bit normally enabled.
 /--------------------Local Use 1 Digit   Sys Op
                      (Normally enabled
                       1=enabled & 0=disabled)
 /--------------------MIN Mark 1 Digit    Sys Op
                       normally disabled
                      1=Enabled, 0=disabled
 /--------------------Auto Recall  1 Digit   Always 1
 /--------------------2nd Phone #  1 Digit     Phone Owner
                      normally disabled
                      1=Enabled & 0=Disabled
 /-------------------Diversity    1 Digit
                      (based on the # of antenna ports
                      on your cellular phone
                      0 = standard 1 Ant. & 1 = Optional 2 ant.

 =====================Optional programming data entry

 11 Option Programming 3 Digits (Cont'd)

 /--------------------Long Tone DTMF  1 Digit   Phone Owner
                       (normally disabled)
                      1 = Enabled & 0 = Disabled
 /--------------------For future use    1 Digit   Always 0
 /--------------------Eight-Hr. Timeout  1 Digit   Phone Owner
                      (normally enabled)
                      1 = Disabled & 0 = Enabled

======================Optional Programming Data Entry

 Step number - This number is the message that appears in the display during
reprogramming.


                        NAM REPROGRAMMING STEPS
                        -----------------------

 step     Keypad Entry       Display             Comments
------   --------------    -------------     -----------------------------
 01                                            Ready for step 1
 1a           *          Current System ID     Factory Setting 000000
 1b     New Sy. ID         XXXXXXX              New system ID
 1c            *           02                    Ready for step 2
 2a            *           Curr. Area Code      Factory set at 111
 2b      New Area Code     XXX                   New Area Code
 2c            *           03                   Ready for step 3
 3a            *           Cur. Phone #          Factory Setting 1110111
 3b      New Phone #       XXXXXXX              New Phone #
 3c            *           04                    Ready for step 4
 4a            *           Cur. Station         Factory Setting 0/14 for
                           Class Mark           portable/personal or 12
                                                for standalone Mobile.
 4b      New Station       XX                       New Station
          Class Mark                                 Class Mark
 4c            *           05                       Ready for step 5
 5a            *           Cur. Access               Cur. Access
                           Overload Class           Overload Class
 5b      New Access        XX                        New Access
         Overload Class                             Overload Class
 5c            *           06                       Ready for step 6
 6a            *           Curr. Group ID Factory set at 00
 6b      New Group ID      XX                        New Group ID
 6c            *           07                       Ready for step 7
 7a            *           Current Sec. Code Factory set at 000000
 7b     New Security Code  XXXXXX     
 7c            *           08                        Ready for step 8
 8a            *                      Current Unlock Code setting at 123
 8b       New Unlock Code   XXX                     New Unlock Code
 8c            *           09                        Ready for step 9
 9a            *                      Current Initial Factory Setting 123
 0334                                               PAGING CHANNEL
 9b       New Initial      XXXXXX                     New Initial
          Paging Channel                            Paging Channel
 9c            *           10                        Ready for step 10
10a            *           Cur. Options             Factory Setting 010100
10b       New Options      XXXXXX                    New Options
10c            *           11                         Ready for step 11
11a            *           Cur. Options              Factory Set. 000
11b       New Option        XXX                       New Options
11c             *          01 or 01 2                Ready for Review
                                                      to program.
 or
Second                      Phone Number

============================================================================
 Now That conclude Part 2, Part 3 will the instructions for NAM reprogramming
for all the phones I listed in part 1. If you have any questions or comments
you can leave me mail on one of the following bbs's that I have listed below.

                                                           THE RAVEN
                                                           +=======+

 The following is a list of BBS's that recieve my files 1st run in order:

                  Installition Five (???) PRI-VATE NUP>KNOWLEDGE
                 BlitzKreig BBS (502) 499-8933 NUP>COLUMBIAN COKE
                       The Ripco  BBS (312) 528-5026
                       The Hawks Nest (201) 347-6969


                        