TUCoPS :: Phreaking Cellular - Misc. :: cell_13.txt

Telecom Bandit's files on Cellular Fraud


PART XIII.             EQUATIONS FOR PROGRAMMING THE CHIPS

        In most instances, you will not be able to tell the code on a PROM
because the manufacturer will have blown the security fuse in order to 
prevent people from obtaining the codes to reprogram their own chips.
Therefore, it might be necessary to produce a set of equations that are
programmed into the cip to produce a bogus ESN.  The bogus chips must contain
the first three digits of the manufacturer's code listing, which is 
consequently the first marker of the actual ESN.  Experimentation might be
necessary, but hey, isn't that half the fun? 

        With the aid of an EPROM emulator, the whole process should be able
to be completed in under an hour - this includes pulling the chip, creating
a new ESN, programming the chip, and replacing it.

        So know you're saying "Holy Cow this project is getting expensive!".
Well it can get that way, but the long run payoff is worth it.  I have seen
both emulators and burners for under $200 (I'm not talking about those spiffy
models that program RAM, just the basic EPROMs...in fact I can buy them for
under $150. Same with the emulator. Just look around.)

        I wouldn't be surprised if actual ESN data started appearing on 
boards in the near future.  I know when I finsish my phone (Hopefully soon)
I plan on U/L the ESN info somewhere.

****************************************************************************


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH