How To Hack A Motorola GSM Phone -

Home Page  > Main Cellphones & Security Page

Please note:Motorola d460
Information provided here may cause your phone to malfunction. Modifying the software of your GSM Phone is only a personal choice and shown for amateur purposes only. Commercial attempts based on these hardware and software may be illegal. We do not accept responsibility for any damage whatsoever that may result from reliance or otherwise of the information on this page.

It only needs simple adapter which  connects the phone to the PC. The software acts as Test and Clone SIM Cards to enable the editing and transferring of the phone memory contents

Logical layout of the connections 
Here is the hardware layout of the operation. Interface circuit consists of three transistors and six resistors and so simple to build. It prevents direct connection of the TTL interfaces of both computer and the phone. Computer's serial COM1 port (usually where a serial mouse is connected to) is used to connect interface with a female connector. Phone's SIM socket is where the other end of the interface is connected to. A small SIM adapter is used to ease this. It's a PCB board cut as the size of a regular SIM module and contact points are etched on the copper side of it.

This is as it is on the Motorola V3690 and V2288 and placed in it's credit card size SIM Card frame to be inserted in d460. Since the cables won't fit in, I had to open the d460 and fix the card manually inside it. Lets start with the preparation of the SIM adapter. First you need to have a 300 DPI printout of the sim.tif to be copied onto a PCB. If you want a credit card size version to be used on a d460 like phone, may use this one. After the etching process, drill the holes on it and solder the four wires on it to be connected to the interface PCB. Using a thin ribbon wire makes it easy to install into the phone. Taking care while soldering wires to the adapter PCB is important, since a rough soldering may cause short circuits between the contacts of the SIM socket of the phone. Just take a look at the illustration below to get an idea. First, tin the copper layer with a thin coating of solder (do not overheat the copper, otherwise it may be detached from the PCB). Insert the pre soldered wire into the hole while it's tip is aligned with the surface of the copper layer. Then repeat the soldering to fix the wire into the thin solder layer. If you do it right, there should be formed a smooth contact surface.

SIM adapter
This is the SIM adapter PCB

Smooth soldering of the wires
Preventing a rough soldering

  Interface PCB is more easy to create. Print out the  pcb.tif  at 300DPI. Etch the PCB and drill the holes, then solder the components on. Transistors are not critical, as long as their specifications are close to each other. Take attention to the lead order of them.

PCB design for ASIM interface
PBC design for ASIM interface

Completed interface  SIM adapter, interface, and a real SIM
Here is the completed interface and SIM adapter

Using SIM adapter in credit card size  Have to open d460 to insert adapter
You'll probably have to open d460 to insert the thick adapter with the card

Adapter placed in  Connecting interface to serial COM1
Placing adapter in V3690 and connecting interface to COM1

V3690 in Test Mode  With the basic skills of amateur electronic, upon completion of the parts (Adapter and Interface) now you may be able to connect your phone to your PC. Insert SIM adapter into the phone, connect Interface to the PC and run the SIM card emulator  ASIM 3.1  written by the ANDROID.

Notice that there are wrong PCB designs in the ASIM package. So use the one I gave above. Apply +5V to the Interface (in fact it runs without this external +5V, I tested this on d460, V2288 and V3690 successfully) and load a SIM file into the emulator (preferably sim.dat) and start emulation.

Turn on your phone and enter the pin stated in the sim.dat file. By holding the # key for three seconds, your phone will be in the 'Test Mode'. Note that if your phone is locked to a specific service provider, it will ask for a special code. In this case, you may try to remove it (only on older phones) or jump directly to the step: enabling permanent test mode. Now you can use test mode commands described on the Janus's pages.

Here you can find a copy of  the list.  With clone.dat, you may enter into the Clone Mode and transfer frames from the phone memory into your computer. I've backed up all five frames this way before making any changes to my d460. But V3690 and V2288 only permits the transfer of first two frames and even they are incomplete, so making any changes on new phones have much risk. With the  Medit  software, you have the chance to translate the contents of the frames into the human readable text.

V3690 in Clone ModeHere are some features added to my V3690, which were not on the original state.

It is also strange that V2288 has a Clock with Date, just like in V3690 and it is easily enabled by the keypad command   ppp123p1p  (letter  p  stands for the square character displayed by holding down the  *  key)

 After Permanent Test Mode is enabled, it becomes easy to use pppXXXpXp type commands  whenever wanted.

For example use ppp278p1p to enable EDIT MUSIC RINGTONE ... Please remember that enabling a function that does not actually implemented on your phone may lock it.


V3690 with dual line mode enabled   GSM900/1800/Auto selection is enabled
Editing of the music ringtone is enabled  Copying of the phonebook data is enabled
You may turn off the bootup tone  Now you have more choices ...
Is this for dual line mode?     Unfortunately it doesn't work :(
Some of the enabled hidden features on the V3690, of course internet access is not possible

Date and time on V22288   Now it's got the clock!
V2288 not only has FM Radio, it also has the clock with date ...

  If you carefully read through the user manual of the ASIM, you may try to transfer  factflag.bin frame into your phone to enable 'Permanent Test Mode' which makes it possible to enter Test Mode by holding down the  #  key for about three seconds, whenever wanted, without the need of the special Test Card or the emulator. Also you can remove the SP-Lock from the phone (only worked on the d460, not on the V3690 and V2288 so do not try) with the  spunlock.bin  frame.

Engineering Field Options menu enabled  Once the Permanent Test Mode enabled, you can shut the phone off, remove the adapter and exit the emulator.

Turn the phone on (with your own SIM Card inside) then use it's keypad to enter the codes essential to enable Engineering Field Options menu:   ppp000p1p   ppp001p1p   ppp070p0p   ppp113p1p .   Now there should be a new menu item in your phone's tree, 'Eng Field Options'. There you can found many parameters belongs to the network, active and passive mode operating status of your phone. Parameters are explained in detail on the Janus's web site so I do not include them here.

Only a few of them are interesting to mention here:  While a call is active (it is determined by the timer displayed on the screen, set by the 'Show time per call' menu option) enter the engineering menu (you may call a toll free service to do this, but check if the timer is displayed, otherwise a 'Busy, try later' message appears). Find the item 'TimeAdv' and note the displayed value near it (for example: TimeAdv 08). Since the GSM system works on a very high frequency, it is needed to adjust the delay of the signals travel between the radio station's antenna and your mobile unit.

Thus this parameter exists which is obtained by dividing a proposed maximum communication distance of 35 kilometers into 64 units. It results in 546.875 meters per unit (practically accepted as 550 meters). With the example above it corresponds to 8 x 550 = 4400 meters and this gives the minimum distance to the radio station's antenna from the point you are at. Since the next step is 9 x 550 = 4950 meters, you can predict that you are at somewhere between 4400 and 4950 meters distance to the antenna.

  Active cell parameters belongs to the current cell your phone is listening to. RxLevel indicates the received signal strength of the active channel in dB. Cell ID parameter can also be read from the System Parameters menu. This way you may have an idea on how many active cells are commonly listened by your phone where you are living.

Active Channel and reception level displayed    Active Cell ID Number displayed
Active channel and Cell ID numbers

  You may trace the six most powerful adjacent cells, which are candidate for a cell switch, in case your current signal loses it's strength. There may not be six cells in the list all the time, only detectable channels will be displayed. These may also not strong enough, for example a message 'Not Synched' tells that the channel is detectable but the digital signal cannot be decoded properly yet.

Phone is out of synch   Phone is synched to the network
'Not Synchronized' and 'Broadcast Control Channel Decoding' conditions

  Do not hesitate to e-mail me for questions that their answers cannot be found here or in mentioned source pages. If you have more data on the subject, or achieve improvements in modifications, I will be glad to receive information from you.



Get FREE updates on the latest ringtones,
logos, alerts, mobile news, & free downloads.
Join our newsletter now