Ericsson 218/337 Code Secret

Ericsson 218/337 Code Secret


To view IMEI number *#06#To view Software Version enter -> * <- <- * <- * CLR (Use with Care)
To activate operator lock <- * * <- (This locks the phone to one carriers SIM card - Use with lots of care)
Press Yes to lock and No to notlock. You can also use the codes below to undo this function. USE AT OWN RISK
I have tested the function Lock to SP... At least on the 337 there's a submenu: Enter SPCK-code. There are 5 attempts, which is showed (05 attempts). At final attempt the phone beeps as a warning, 'this is the final try', when entering the menu... Wrong code exits the menu, so you are not stuck in something... When you have tried to enter the code (wrong) all five times, the menu is deactivated, and you'll get: 'Not allowed' when entering <-**<-
A "secret test mode" can be accessed on the GH337. There seems to be two methods:> * < < * > * displays software version, such as 940810 1310
> * < < * < * displays software version, such as 951024 1054
After entering this mode, the < and > keys scroll through a menu. There seems to be different menus for different versions of software.

Software version number are apparently a date and time stamp.

940810 1310 version commands:

TEXT CHECK - shows 254 messages in current language

INIT EEPROM MMI - resents NVRAM settings (User Settings).

Other, probably more recent version:

FLASH - will restart the phone, to the point of entering PIN numbers.You can't kill a 337 when pressing YES while it says "FLASH?", you must connect it to 5/12 volts first to be able to erase the flash-memory.

1-ROW TEXTS - scroll through 174 single line text messages with < and >

n-ROW-TEXTS - scroll through full-screen messages with < and >

950626 1405 version commands:

CXC (number) - The Application software's "product number". The GH337/GF337 is always "CXC 125 005"

PRG - Indication for Programming

Programming 337
Set ComPort to 9600bps, 8 data, 1 stop, no parity.
Power on phone by pressing "NO/ENDpwr".
When performing its powerup sequence the phone will send two ">>"
(ASCII 62 decimal) characters. Within 1 second, reply to it by
sending the 4 character sequence "TP1".
(I used Procomm Plus with this script "eric.asp")

[proc main ]

[start: ]

[ ]

[ waitfor ">>" ]

[ pause 1 ]

[ transmit "TP1^M" ]
If everything went fine you should get the "OK" prompt back.

Test the TEST PROGRAM by sending the commands terminated by a :

PROG 0 (shows Test Program product number info)
PROG 1 (shows Test Program product date info)
PROG 3 (Shows Main Application product number info)
PROG D (Shows Main Application product date info)
Programming Calculator and Channel Indicator/RBS
To enable, send the following:
EEWR 047A 01
Wait for the OK prompt, power off* the phone and disconnect it from the interface cables. Powerup and browse through the menus.
To diasable, send the following:
EEWR 047A 00
Clearing Electronic Lock
To clear the electronic lock you have to clear the EEPROM address range 045B to 0466 by sending the commands:
EEWR 045B 00
EEWR 045C 00
EEWR 045D 00
EEWR 045E 00
EEWR 045F 00
EEWR 0460 00
EEWR 0461 00
EEWR 0462 00
EEWR 0463 00
EEWR 0464 00
EEWR 0465 00
EEWR 0466 00
Disabling the Service Provider Lock
To disable send the following command:
EEWR 1587 00
To enable send the following command:
EEWR 1587 01
Experimental Commands - Use at own Risk
To dump the application software send the following:
PREA

Bank range : 00..7F

Address : 0000..BFFF

Bytestoread : 0000..BFFF
The "additional" value returned at the end are the checksum value
for the returned program memory bytes. Note, the byte-values are
always returned in format 0000 and NOT 00.
PREA FF
Returns the application checksum, takes a few seconds.
Notes on the PH 337
1. Calculator mode is NOT available on all PH sw versions.
2. Invoking Calc/RBS mode not available for GH337 sw versions below
R2A
3. SPCK attempts can be changed to 50 instead of the std 5 tries
4. The instruction LIME returns ERR but does not screw up phone
5. The instruction IMEI returns the IMEI no.
6. Pressing YES in response to FLASH? does screw up the unit.
COOL STUFF TO DO
Set ComPort to 115200bps, 8 data, 1 stop, no parity and watch all t
he phone commands on the screen and so on. Make a call and see what
happens as well as shutting down.
Pinouts
1 In Voice

2 In +5V=External Power, 0V=Battery

3 Out Ext Speak control

4 Analog GND

5 Out Voice

6 Out +5V=POWER ON, 0V=POWER OFF

7 Out Charger control

8 Digital/DC GND

9 In 0V=normal,+5V=test, +12V=test+flash

10 In Hook

11 In TTL serial in

12 Out TTL serial out

13 In 0V for aprox 1 sec = POWER ON/OFF

14 In DC Power supply