ERICSSON 318/388
To view IMEI number *#06#
To view Software Version enter -> * <- <- * <- * CLR (Use with Care)
The Latest Software Version is under Phone Info.
To fine tune sound and clean up any echos, place the 388 into the car kit HF 2600.
Then close all windows, engine off and type * # * # 3. The E 388 will fine-tune itself in
about a few seconds.
To activate operator lock <- * * <- (This locks the phone to one carriers SIM card -
Use with lots of care)
Press Yes to lock and No to notlock. You can also use the codes below to undo this
function. USE AT OWN RISK
I have tested the function Lock to SP... At least on the 337 there's a submenu: Enter
SPCK-code. There are 5 attempts, which is showed
(05 attempts). At final attempt the phone beeps as a warning, 'this is the final try',
when entering the menu... Wrong code exits the menu,
so you are not stuck in something... When you have tried to enter the code (wrong) all
five times, the menu is deactivated, and you'll get:
'Not allowed' when entering <-**<-
Accessing the Service Program that is not provided with the 388.
1. Connect the 388 to Cable with RS232/TTL converter.
2. Set Comport to 9600bps, 8 data, 1 stop, no parity.
3. Power ON, wait for "2" and send "0B" to the phone. DO NOT Press
ENTER.
4. R should be on screen.
5. Send TEST.BIN. (Send as a binary file)
6. 388 should answer "SP,OK".
7. R should be on screen.
DO NOT write or read from the IMEI or SPCK area! If you try that you can send the phone to
service at once, because you will
automatically write FE or EF to EVERY cell in the EEPROM. In other words, all the
calibration values for the radio is overwritten... (NOT
good)
Some commands in the ServiceProg:
eere <startADR> <NoBytes> read from eeprom
eewe <adr> <value> write eeprom
lime xxxx xxxx xxxx xxx Learn imei no. Returns Error.
imei - Displays IMEI number
To FlashProgram a 388:
1. Connect the 388 to Cable with RS232/TTL converter.
2. Set Comport to 9600bps, 8 data, 1 stop, no parity.
3. Power ON, wait for "2" and send "OB" to the phone. DO NOT Press
ENTER.
4. R should be on screen.
5. send pre_xxx.bin to the MS.
6. You should recieve a ">".
7. send "0B" again.
8. R should be on screen
9. send prodload.bin to the MS.
10. recieve ">".
Done, I don't have the above files so please don't ask for them.
Interesting Informating (well I thought so :)
The names on the files, sj.....X45 tells you a couple of things. "sj" stands for
Sofia-Jane, thats the internal name for the model and x45
stands for "sub-model". The 388 is called model 4/5. The latest 337 phones is
called "cr", like in Cost Reduction. They rebuilt the oscillator
from a bought-in to one built up with discrete components and that was cheaper.
Programming Channel Indicator or RBS
To enable, send the following command:
EEWR 3EE 1
Wait for the OK prompt, power off* the phone and disconnect it from the interface cables.
Powerup and browse through the menus.
To diasable, send the following command:
EEWR 3EE 0
Clearing Electronic Lock
To clear the electronic lock you have to clear the EEPROM address range 03CF to 03DA by
sending the commands:
EEWR 3CF 00
EEWR 3D0 00
EEWR 3D1 00
EEWR 3D2 00
EEWR 3D3 00
EEWR 3D4 00
EEWR 3D5 00
EEWR 3D6 00
EEWR 3D7 00
EEWR 3D8 00
EEWR 3D9 00
EEWR 3DA 00
COOL STUFF TO DO
Set ComPort to 115200bps, 8 data, 1 stop, no parity and watch all the phone commands on
the screen and so on. Make a call and see
what happens as well as shutting down.
*POWER OFF
You should press the NO button a few times until Shut Down comes up on the screen, when it
does press yes and this will shut down the
phone properly.
Reading the Channel Info now that's it's enabled
|-------|-------|-------| D
| | | | I
| 1 | 2 | 3 | S
|-------|-------|-------| P
| | | | L
| 4 | 5 | 6 | A
|-------|-------|-------| Y
1. This is three different channels things depending on the phone state.
a. When the phone is idle, this shows "Bxxx". "B" stands for
"Broadcast channel" (a logic GSM channel)
b. When a phonecall is in progress, this shows "Sxxx". S stands for "Stand
Alone Dedicated Control Channel" SDCCH for short.
c. When the phoncall in up, this shows "Txxx". "T" Stands for Traffic
channel. The "xxx" thing is the channel number, 1-124.
2. This shows Rx Level. The values displayed is from 0 to 63. Rx Level is a indicator on
how good your reception is for the moment. 0 is a
signal strength of -110dBm. 63 is approx -45 to -50dBm.RXLEV is measured in dBm in such a
way that incoming signal equals
-110.5+RXLEV so that a RXLEV at 50 equals an incoming signal strenght at -50.5 dBm (plus
or minus max deviation 0.5dBm)
3. This shows the output power in dBm.
4. This shows the timeslot used for the moment. You can see it when making a call.
5. This shows Rx Quality. Rx Quality is a measurement of how much error correction is
required to the speech. 0 indicates none and as
the figure rises you hear more pings and pongs on the speech as large parts of the frame
are missing. If you have more RxQ then 5, you
are on good way to loose your call. RxQuality reads 0-7.RXQUAL is measured by using a
table wereas the biterrorrate or BER is
interesting and measured in %
RXQUAL table
0 BER < 0,2 (%)
1 0,2 < BER < 0,4
2 0,4 < BER < 0,8
3 0,8 < BER < 1,6
4 1,6 < BER < 3,2
5 3,2 < BER < 6,4
6 6,4 < BER < 12,8 (here we have lost half a burst)
7 12,8 < BER
6. This shows the timing advance. The BS tells the MS to send before it should just make
sure that the MS burst is comming to the BS on
the right time. The TA is measured in halfbits so the distance to the BTS can be
calculated as follows=1,11*TA/2. TimingAdvance reads
0-63. Co-incidentely this tells you how far you are from the base site in 550metre chunks,
up to the theoretical max of 35.2km.
Free calls for Ericsson PH388.............
1) On putting down the phone press "YES" ,you should see "1 on hold"
(it apply for both incoming and outgoing calls)
2) Press "CLR" until you see a "mute" appear
3) Press "<" (left arrow) then "*"
4) Press "CLR" again and
5) Press "YES" follow by "NO", now you are disconnected with no phone
charges as you have hacked the system.
Pinouts
1 In Voice
2 In +5V=External Power, 0V=Battery
3 Out Ext Speak control
4 Analog GND
5 Out Voice
6 Out +5V=POWER ON, 0V=POWER OFF
7 Out Charger control
8 Digital/DC GND
9 In 0V=normal,+5V=test, +12V=test+flash
10 In Hook
11 In TTL serial in
12 Out TTL serial out
13 In 0V for aprox 1 sec = POWER ON/OFF
14 In DC Power supply