TUCoPS :: Phreaking Cellular - Misc. :: sprintpc.htm

Sprint PCS Cloning
Sprint PCS Cloning SPRINT PCS CLONING by oki900/okiwan/kehoki etc. (whatever the hell he wants to be known as these days)

Introduction
    Here's a sweet exploit I came up with while waiting in line at the Sprint PCS store.  First a little back story,  Sprint PCS is a digital CDMA network making it virtually impossible to clone...or so we thought.  The weakness  of Sprint's network is that there digital coverage is pathetic.  To fill up  the HUGE holes in their network, Sprint has roaming agreements throughout the US.  The roaming agreement is that whenever there isn't a digital signal (1900) the phones will drop to analog (800) which is what Sprint calls "roaming".

THE EXPLOIT
    Every Sprint PCS store has a sales floor where they have activated phones that you can pick up and use.  Sprint stores do that so you can try out their phones to hear the sound quality of each different phone before  you buy one or to call home(or anyone) as a courtesy call.  In fact, every time I go to a Sprint store I always make at least 15-20 prank calls all over the US.

    Basically all you need to do is:

1)Go through the menu and look for the phone's telephone number which is your MIN (mobile id number)

2)Look at the back of the phone and find an 8 character number/letter sequence and this is your ESN.

3)Program the ESN and MIN  into your analog OKI-900 phone.

    Guess what you just cloned  the Sprint PCS's courtesy phone.  So when you use your cloned  OKI-900 phone, Sprint PCS will think your roaming since your  using an analog only phone.

    These phones are activated using unlimited calling minutes and I doubt that the  Sprint PCS store looks though the hundreds off phones calls that are made from these phones each month so there's little to no chance of getting caught.  There's like 7-8 different models out right now so you should get all 7-8 accounts and use'em like crazy.

SPRINT PCS CLONING by oki900/okiwan/kehoki etc. (whatever the hell he wants to be known as these days)

Introduction
    Here's a sweet exploit I came up with while waiting in line at the Sprint PCS store.  First a little back story,  Sprint PCS is a digital CDMA network making it virtually impossible to clone...or so we thought.  The weakness  of Sprint's network is that there digital coverage is pathetic.  To fill up  the HUGE holes in their network, Sprint has roaming agreements throughout the US.  The roaming agreement is that whenever there isn't a digital signal (1900) the phones will drop to analog (800) which is what Sprint calls "roaming".

THE EXPLOIT
    Every Sprint PCS store has a sales floor where they have activated phones that you can pick up and use.  Sprint stores do that so you can try out their phones to hear the sound quality of each different phone before  you buy one or to call home(or anyone) as a courtesy call.  In fact, every time I go to a Sprint store I always make at least 15-20 prank calls all over the US.

    Basically all you need to do is:

1)Go through the menu and look for the phone's telephone number which is your MIN (mobile id number)

2)Look at the back of the phone and find an 8 character number/letter sequence and this is your ESN.

3)Program the ESN and MIN  into your analog OKI-900 phone.

    Guess what you just cloned  the Sprint PCS's courtesy phone.  So when you use your cloned  OKI-900 phone, Sprint PCS will think your roaming since your  using an analog only phone.

    These phones are activated using unlimited calling minutes and I doubt that the  Sprint PCS store looks though the hundreds off phones calls that are made from these phones each month so there's little to no chance of getting caught.  There's like 7-8 different models out right now so you should get all 7-8 accounts and use'em like crazy.

Here is the list of  * Codes / Asterisk codes etc.
*2 TALK          Access Provider's Customer Service Dept.
*4 TALK          Access Automated Account and Usage Data
*72 TALK        Call forwarding to another phone
*720 TALK      Turn Call Forwarding feature off
*73 TALK        Call Forward - No answer to another phone
*730 TALK      Call Forward - No answer off
*74 TALK        Call Forward - Busy to another phone
*740 TALK      Call forward - Busy off
*70 TALK        Cancel Call Waiting on a per call basis
*67 TALK        Caller ID Block on a per call basis
*82 TALK        Override Call ID Block on a per call basis
*98 TALK        Do Not Disturb on
*980 TALK      Do Not Disturb off
*0 TALK          Sprint PCS Operator
*18 TALK        Turns "Call Delivery OUTSIDE home service area account" ON
*180 TALK      Turns the "Call Delivery OUTSIDE home service area" OFF
*211 TALK      SmarTraveller - only in certain areas

With that in mind it's a good idea to type in *98 from the phone that you copy the ESN/MIN from so it won't ring when incoming calls come.

Also considering this would be an exploit, you can get your phone's Master Lock code by calling the customer service department and changing your cell phone number over the phone. They will assign you a new phone number and walk you through the steps of reprogramming your new number including giving your the Master Lock code. Note: when you first buy a Sprint PCS phone and activate it, the phone is programmed using a Subsidiary code that you can only use once.

SORRY OKI, PLEASE FORGIVE US FOR THIS OVERSIGHT. :(

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH