The IMEI is the International Mobile station Equipment Identity

It is composed of the following:


IMEI = International Mobile station Equipment Identity
TAC  = Type Approval Code
FAC  = Final Assembly Code
SNR  = Serial Number
CD   = Check Digit

The composition of the IMEI is such that each individual mobile station equipment 
can be separately identified. Information is contained in the IMEI by which a 
GSM PLMN, after requesting it, can immediately decide whether or not to accept 
calls made thru this equipment. Therefore the manufacturer is responsible for 
ascertaining that each IMEI is unique and keeping records of produced and 
delivered mobile stations.

The IMEI contains all information which is necessary for a network operator to make 
relations thru its administrative system to trace the equipment to its origin of production.

The IMEI (14 digits) is complemented by a check digit. The check digit is not 
part of the digits transmitted at IMEI check occasions. The Check Digit shall 
avoid manual transmission errors, e.g. when customers register stolen mobiles 
at the operator's customer care desk.

A network operator can make administrative use of the IMEI in the following manner:
Three registers are defined, known as "white lists", "grey lists" and "black lists". 
The use of such lists is at the operators' discretion.
The white list is composed of all number series of equipment identities that are 
permitted for use.
The black list contains all equipment identities that belong to equipment that need 
to be barred.
Besides the black and white list, administrations have the possibility to use a grey 
list. Equipments on the grey list are not barred (unless on the black list or not on 
the white list), but are tracked by the network (for evaluation or other purposes).

Later, the IMEISV (International Mobile station Equipment Identity and Software Version Number) 
was introduced. It adds a 2 digit Software Version Number (SVN) to the end of the IMEI.


IMEI = International Mobile station Equipment Identity
TAC  = Type Approval Code
FAC  = Final Assembly Code
SNR  = Serial Number
CD   = Check Digit
SVN  = Software Version Number

The SVN allows the manufacturer to identify different software versions of a given type 
approved mobile. The SVN is a separate field from the IMEI, although it is associated 
with the IMEI, and when the network requests the IMEI from the mobile, the SVN 
(if present) is also sent towards the network. It comprises 2 decimal digits. 
The white list shall use the IMEI, The Black and Grey Lists may also use the SVN.

NOTE: The Check Digit is not applied to the Software Version Number.

Some Motorola mobiles display the SVN after the IMEI with check digit.

******  M A P P I N G  T H E  T Y P E   A P P R O V A L  C O D E  ******

An IMEI consists of 15 numbers from 0 to 9 ( 111111-22-333333-4 )

-Numbers 1 to 6 are the Type Approval Code (TAC) 
	This is the data that enables your provider to tell precisely what
	type of phone you are using !

All IMEI start with numbers 33,44,45,49 (Explanation ?)

I am making a list of TAC's and FAC's 

The TAC is issued by a central body, the FAC is issued by the manufacturer.


1000			450053		(D1-326)
2500			445000    	 
3300			444556		
5200			442742
5080			442716		.8 W 5200		  	
6200 Flare GSM		445051  	
6200 Surf DCS		443441  	
6300			446723		Telefonica 
6700 / d460 (MG1-4A11)	446790 		known in Italy as "Handly"/Graphite
d470	    (MG1-4D11)	447090		Movistar		
7200			442883		
7500 / 1-888		445254  	
8200			444788
8200C			446205  	
8400			446072	       
8500			446158		Asian language 8200 with 8700 display
8700 / GC87		446620	   	
87C 			446954		Simplified Chinese display, with Chinese SMS (does not support Chinese Cellular Broadcast SMS)
8800 / MR601		447266
8900			447373
B310 (Surf DCS)		444042				
GC-87CE			447265		Simplified Chinese display, with Chinese SMS (support Chinese Cellular Broadcast SMS), 
					graphic Quick Access Key interface (like 8700), and an indicator light on phone top (like StarTAC).
StarTAC 70		447264		Grey
StarTAC 80		446203    	Black
StarTAC 70 (Royale)	447371		GSM-1800 
StarTAC 80 		444049		GSM-1800
StarTAC 130		448548
d160			447263 &
d160			447262
d170/d170		447370
Slimlite		447070

d520			448114
d520			448118
d560			448114		Chinese market name for d520
d520 (MG2 B12)		448543
cd920			447768
cd928			447768		Chinese market name for db920 The cd928 is a 900/1800 Dual Band phone. It supports Simplified Chinese, 
 					Complex Chinese, Thai, Indonesia and Vietnam language. Support SMS by these languages.

cd160			447766
cd930			447769

v3688			448835
v66			449276

m3688			448955
cd520 flip		448836
m3288			448951
m3788			449652
m3588			449174

7389			458962
TimePort 260		350029
Timeport 189		446790
Timeport 192		449279

Select 2000e		010014
Select 6000e		010016
StarTac 8600		010015
StarTAC ??		010017
StarTAC 7000g		010025

M301			443050		one2one OEM - kind of between a 5200 and a 7500
Bosch M-Com 206		446402
Bosch M-Com 506 	446840		OEM model of d460
Bosch Cartel		443023		OEM model of 5200


-Numbers 7 to 8 are the Final Assembly Code (FAC) 

I am quite certain that:

 06 = made in Flensburg, Germany (flare)
 07 = made in Flensburg, Germany
 08 = made in Flensburg, Germany
 31 = ?
 40 = made in Easterinch, Scotland (UK)
 41 = made in Easterinch, Scotland (UK)
 47 = Also a very popular fake IMEI. There are thousands of phones out there with IMEI=00000047000000 !
 49 = Was found on a 8700 from China with Fake IMEI
 67 = made in Illinois, USA (most prototypes)
 80 = made in Tianjin, China
 81 = made in Tianjin, China  
 92 = made in China by EASTCOM in Hangzhou
 93 = made in China by EASTCOM in Hangzhou

PLEASE CHECK THIS AGAINST YOUR OWN FAC !!!!!! (and let me know if I am wrong)

-Numbers 9 to 14 are the Serial Number (SN)

-Number 15 is the Check Digit (CD)
	0 on all older phones I have seen, on newer phones the checksum of the 14-digit IMEI

Sometimes the check digit is left out, giving an IMEI of only 14 numbers

The IMEI number is kept in the 8 K EEPROM of the Motorola International phones

The information here has been confirmed for 6200,7500,8200,d460:

The 8 bytes that holds the IMEI can be found at offset 52H (82 dec) - 59H (89 dec)

Let's say we are dealing with a flare, which has the IMEI 445051-07-123456-0

To make that into EEPROM data you have to align the numbers in pairs, starting
with number 2 and then take each pair and switch the numbers. The first number which 
is not paired with another number must be paired with the nibble (4 bits) A.

   4 4 5 0 5 1 0 7 1 2 3 4 5 6 0		IMEI

   4  45  05  10  71  23  45  60		Paired

  4   54  50  01  17  32  54  06		Switched

  4A  54  50  01  17  32  54  06		EEPROM data

However there is a crc style checksum that has to be calculated !

SIM emulator software & hardware by the android

The Android has written a *wonderful* SIM emulator in turbo pascal. It emulates the file serving part of a SIM card AND the GSM authentication routines (COMP128). With the software and a very simple computer (RS-232) to phone interface (top left in the picture), it will allow you to make your own virtual SIM card where there are no restrictions to what SIM files can be updated. Normally only someone with the SIM administrative code are allowed to update certain files such as the administrative file - When the SIM is emulated, then *YOU* are in charge and there are no restrictions as to which fields can be changed - AD, ATR, etc.. The circuit board in the middle is a smart card adaptor that was used to log trafic between phone and SIM during (the ongoing) development of the program. The program does not require much computing power - a 16 MHz 286 will do just fine.
Giulio Cesare (designer of the interface boards) has a
page describing them (only in Italian for now). There are many places that sell complete season interfaces(eg. Multisat, that are easy to modify into a ASIM interface(G7HID demonstrates just how). An even simpler interface circuit that only needs a single 7400 has been designed by George Terziysky (please note that this version almost exclusively works with 5v phones such as the international 3200 - 8200). Maybe the simplest interface is this one - it works fine with most of the phones and is only a lightly modified version of the interface described in simhard.gif (included in ASIM31.ZIP below).

From ver. 3.1 ASIM supports the A3 & A8 authentication algorithms (COMP128) !

Download ASIM VERSION 3.1 source, .exe and documentation (75k)

Chaveiro has added even more functions to ASIM in the version below. The additions are: Save sim file capability, added suport for SMS and Abreviated phone numbers. (read and record), added Verify of sent data - On error user will be notified, added INS=2F (status), to work with recent phones, added detailed runtime information and description of what's going on, added suport for PIN2 and PUK, sdded schematic hardware to the program exe, added autoload and autostart funcionality from command prompt, change serial port usage from DSR to DCD for compability with other hardware!!!, redisigned 6fxx File view with detailed description, added pc speaker beep on reset.

Download ASIM VERSION 4 source, .exe and documentation (86k)

Stephan Made a bunch of additions to ASIM 3.1 as well.
Neither of the two above authours are continueing devellopment on these programs,
The things-to-do list includes: merging additions of the two above versions. Improving internal editor or simply spawning another editor from ASIM.

Download ASIM VERSION 4 Deluxe source, .exe and documentation (106k)

Emulating the test and clone card

Files for emulating a Motorola test and clone card are inluded with ASIM (sim.dat and clone.dat). Look at the pages describing the test and clone card for more information. The clone card frames can be saved in motorola S19 or binary format and can be edited within ASIM. The framebuffer has a size of 4K. COM port and language is defined in the *.dat file.

Here are a few hints:

  • BE VERY CAREFUL WITH THE CLONE FEATURE AND DON'T USE IT AT ALL IF YOU ARE NOT 100% SURE WHAT YOU ARE DOING! It SHOULD be needless to say that by transferring and especially editing transfer frames, you are performing brain surgery on your phone - Many of the registers WILL crash your phone if they are changed so use these tools with extreme caution ! REMEMBER: Frames are as the rule *not* compatible across "platforms"
  • Use these tools at your own risk. You have been warned !
  • If a transfer for some reason does not complete, then DO NOT POWER OFF THE PHONE. Load back the original frame before you do !
  • Specify the first 5 numbers in the IMSI as 00101 (reserved for test use) to avoid the phone registering (and getting rejected)
  • Change the phone language selection away from "automatic"
  • If you use an external powersupply for the interface, be sure to isolate it from the SIM Vpp line !
  • Check the COM post setting in the .dat file - the default setting is COM 3
  • If you encounter problems, try using it under DOS (not a DOS window)
  • FIX ! - Some people are experiencing trouble using ASIM with the newer phones, here is a fix: You must first power on the phone without the interface card present, then load clone.dat, execute the clone emulation option, and then insert the interface into the phone (while phone is powered).
  • Turbo Pascal 7.0 has a bug in regards to really fast machines and the CRT unit. When the program starts up, it immediately crashes with a divide by zero error. Use this fix if you experience problems with these programs.

PIC 16x84 based test card

Ronny has written PIC code for emulating the file serving routines of a SIM card and modified it to contain the specific entries for the Motorola GSM test card. This will allow you to program your own, ISO or plug-in size test card without having to haul a PC / laptop and season interface along with you. You will need a blank wafer card (around 10 USD when sold one at a time) and a programmer. PIC card programmers are very popular among satelite dish owners, so you can often find someone to program it for you if you do not want to build one yourself. If your EPROM / device programmer supports the 16F84/16C84 you can simply make an adaptor from DIL to ISO7816 card and program the card that way. The fuses should be set as follows: OSC: XT, WDOG: Off, PUT: Disabled, CP: Don't care. If you want to build your own programmer, then check out the Electronic Projects Page by Jacob Blichfeldt where you can find both a *very* simple (cheap!) programmer or a versatile one.

Download SIM-PIC testcard .hex file for Motorola Test card emulation (3k)

Editing of transfer frames

TST has made a really, really neat program that will let you edit the menu configuration easily as well as editing the phonebook with ease and uploading your own wakeup graphic screen to the phone ! Have fun with it, take care and remember to send me copies of your frames and customized graphics ! Do not use with 7200 and older phones. Read the excellent documentation before you try to use MEDIT. MEDITX is a hybrid between ASIM and MEDIT - MEDITX will let you do everything from one program with command line parameters.

  • If you manage to enable the Chinese, Thai or Korean language option on a unit that normally does not support this, do not select it ! It has shown to crash 8400 & 8700's - Only the 8500 (with 8700 display) should have these (at least complex chinese character) options.
  • The same warning applies to menus that depend on special hardware inside the phone, e.g. voice-recording, voice-activation, voice-dialling etc. Do not enable those menus if your phone lacks the necessary hardware!

Download MEDIT VERSION 3.04 source, .exe and documentation (21k)

Download MEDITX VERSION 1.8 executable and documentation (30k)

Collection of useful files

  • Wakeup graphics gallery

I wish to thank The Android & TST for putting all this time, effort and energy into the ASIM project !

Engineering Field Options Menu

The "Eng Field Options" menu is supported in the 8200/6200 ver. 1.7 (37.62.39), 7500 ver. 2.1 (58.62.15) and all later revisions - The software on the 3200 / 5200 / 7200 does not include the menu but it is present in all the newer models like d460, 8700, 8900, StarTAC (70, 85, 130), SlimLite, cd160/920/930 & d520 (The models mentioned here are the European / Asian GSM-900/1800 digital units). Unfortunately the menu is never enabled from the factory but with some special tools, it is possible to activate it. What follows here is the description of the menu, look at the menu customization page for instructions on how to enable it.

The Engineering menu will provide you with detailed information about the connection between the MS and the network. This is all information that the MS can meassure by itself or decode from the BCCH which is transmitted from the BTS. The menu only gives readout of parameters, you are not able to change a thing with it, and consequently you can't do any harm to your phone - it's perfectly safe to use the menu. On the latest software revisions, the menu is available in several languages. In german it will show as "Eng Felder Optionen", "Aktive Zelle", "Nachbar-zellen" and "System-Parameter"

It is easier to understand these terms if you have an idea about what the BCCH actually is: When powering on your GSM phone, it doesn't know what frequency to tune into in order to communicate with the cell, therefore it will start scanning all 125 GSM frequencies (GSM-900), looking for a Frequency Correction Burst. Once this is found and the frequency has been adjusted, it will "stay tuned" and listen for a Synchronization burst and decode it in order to synchronize (timewise) to the network. After sucessfully synchronizing frequency and time, the BCCH channel can be received and decoded, providing network identification and information about how the mobile should "behave" on the net. The BCCH is on timeslot 0 - the remaining 7 timeslots are used for traffic. The BCCH never frequency-hops - it stays put all the time, like a beacon, transmitting information to the mobiles. The mobile will continue to search for BCCH's and keep a list of the 6 strongest BCCH in the area.

The "Eng Field Options" menu appears in the top level of the menus and consists of three sub-menus:

Active Cell:

Displays what Channel the BCCH (Broadcast Control CHannel) is received on (If available).

During idle you can view the parameters : RxLev, RxLevAM, NCC, BCC, MSTxPwr, C1. Dualbanders will also provide: CRO, TO, C2, 2ter, 2bis & ECSC

During dedicated mode you can view the parameters : RxLev, RxLevFull, RxLevSub, RxQualFul, RxQualSub, Timeslot, TimeAdv and PwrLev. Dualbanders will also provide:Vocoder, 5bis, BSIC, MBReport, MeasValid.

The ActCh (Active Channel) may read "Hopping" during a call. The GSM system can use slow frequency hopping where the mobile station and the base station transmit each TDMA (Time Division Multiple Access) frame on a different carrier frequency (The hopping rate is 217 hops/second which corresponds to one hop per. TDMAframe). The frequency hopping algorithm is decoded from the Broadcast Control Channel which the mobile station continuously decodes. Since multipath fading is dependent on carrier frequency, slow frequency hopping help mitigate the problem. Frequency hopping is operator optional down to the individual cell.

When communicating with the BTS (for the reasons below) you can see how the SDCCH (Standalone Dedicated Control CHannel) is mapped. The DCCH (Dedicated ControlCHannels) are used for registration, location updating, authentication and call set-up. This channel can be mapped in two different ways: SDCCH8 ( 1/8 rate channel) if combined is off and SDCCH4 ( 1/4 rate channel) if combined is on. See also Combined, below.

Adjacent Cells:

Lets you scroll through the 6 nearby cells with the highest C1 criterion and view the information transmitted on their corresponding BCCH carriers (If they can be decoded). Pressing (OK) Will let you view the data transmitted on the selected BCCH (some of thse are only available on dualband units): RxLev, <BCCH decode status, RxLevAM, CRO, TO, NCC, BCC, MSTxPwr, C1, C2, CBA & CBQ.

System Parameters:

During idle you can view the parameters :Combined, AcsClas, MCC, MNC, LAC, CellID, T3212, BS-PA-MFRM and XZQTY.

During dedicated mode you can view the parameters :Combined, DTX, MCC, MNC, LAC, CellID

Pressing (OK) while in the Eng Field Opt menu, will toggle refresh on and off. When refresh is enabled, the phone will continuously measure and display the strength of the signal and try to decode the BCCH. If you disable the refresh the phone will remember and show the last set of values until the refresh is enabled again. If you are driving around and the info changes real fast, you can "freeze" the values so you can examine them before they change again.


  • ActCh: Displays the Active Channel on which the BCCH is received. GSM-900 has 124 (001-124) channels and GSM-1800 has 374 (512-885). The channels are split between the operators - HERE is how it is done in Denmark (GSM-900)
  • Combined: Describes the channel organization in the 51-frame multiframe : off uses SDCCH/8 and on uses SDCCH/4. The logical channels can be mapped differently : Off: BCCH+CCCH and SDCCH are on different channels. On: BCCH, CCCH and SDCCH are combined on the same channel - confused about all the channels ? Take a look at the GSM channel structure section below
  • AcsClas: Access Control Class . The Access Control class is a parameter to control the RACH (Random Access CHannel) utilization. 15 classes are split into 10 classes randomly allocated to normal subscribers and 5 classes allocated to specific high priority users. This way, the operator can cut out users when the net is getting clogged-up. Denied classes can by cycled so that in extreme loading you may be denied for 10 minutes or so, but then you'll have service. Other classes are reserved for the emergency services/operators so they can be excluded and have priority calling. What networks does use this RACH regulation ???
  • RxLev:(7bits) The strength of the received BCCH signal (000 to 127 dBm), normally between -55 to -90 - the MS will look for another BCCH carrier when the signal drops to RxLevAm* ( RxLev and RxQual are sent regularly to the BSC during a call - )
  • RxLevAm: Rx Level Access minimum - Minimum Rx signal strength threshold (usually around -100 dBm to -110 dBm). This is related to the minimum signal that the operator wants the network to receive when being initially accessed by an MS.
  • CRO:(6 bits) Cell Reselect Offset. Applies an offset to the C2 reselection criterion. 0 - 126 dB in 2 dB steps, i.e. 0=0dB, 1=2 dB, etc.
  • TO:(3 bits) Temporary Offset. Applies a negative offset to C2 for the duration of PENALTY_TIME. 0 - 60 dB, 10 dB steps i.e. 0=0dB, 1=10 dB, etc. and 7 = infinity
  • BCC:(3 bits) Base-station Color Code (0-7)- This is used to distinguish neighboring cells of the same operator broadcasting BCCH on the same FDMA (FrequencyDivision Multiple Access) channel from each other (Different channel "sets" are used by GSM operators in the same country, so their BCCH will always be on different FDMA channels). A set of cells that covers all the channels available for a specific operator is called a "cluster". BCC has the same value in all the cells of a cluster, because of each cell, in the cluster, transmits on different channels. NCC+BCC is called BSID (Base Station Identity)
  • NCC:(3 bits) Network Color Code (0-7) - this is used to distinguish neighboring cells between operators of different countries broadcasting BCCH on the same FDMA channel from each other. The NCC is equal within a PLMN (Public Land Mobile Network). It's a 3 bit value.
  • MSTxPwr: The maximum power level that the MS (Mobile Station) is allowed to access the RACH - this means that even though you have a 8W unit, you are not always allowed to blast away at full power. Generally MSTxPwr is low in urban areas (small cells) and high in rural areas (large cells) - See notes on power control below
  • C1: The path loss criterion parameter C1 (defined as C1=(RxLev-RxLevAm-MAX((MSTxPwr-MSMaxTxPwr),0)) ) used for cell selection and reselection. This is calculated by the MS and used for deciding which cell to camp to (selection and reselection). C1 is more useful than just RxLev, since it takes the MSTxPwr& MSMaxTxPwr into account. MSMaxTxPwr is the phones maximum output in dBm (for GSM normally 33 but 39 with carkit). The reason Tx power is factored into C1 is so that an MS only camps to a cell where it has a reasonable chance to be heard by the base station if it transmitted.
  • C2: Cell reselection criterion. Identical to C1 when camped in 900 band. You will notice that the dual band units do have a preference for the 1800 band. The C1 can be much higher than C2 but it doesn't result in the phone switching back to the 900 band. The reason C2 is included is to handle small cells, where an MS may select and camp to a cell but not have long enough to do anything before loosing it completely. C2 is time varying so it can get bigger after a certain period. If the MS can still see it then it will camp to it.
  • CBA:(1 bit)Control parameter Cell Bar Access. If enabled and CBQ=0 then cell selection and reselection will be barred.
  • CBQ:(1 bit)Control parameter Cell Bar Qualify. If enabled, then cell selection priority will be low, but cell reselection status (barred/normal)will be normal.
  • 2ter: This message is sent optionally on the BCCH by the network to all mobile stations within the cell giving information on the extension of the BCCH allocation in the neighbour cells.. Based on this information the mobile station is able to decide whether and how it may gain access to the system via the current cell. The 2ter message shall be sent if and only if this is indicated in TYPE 3 message. Can be ignored by units only capable of GSM900.
  • 2bis: This message is sent optionally on the BCCH by the network to all mobile stations within the cell giving information on control of the RACH and of the extension of the BCCH allocation in the neighbour cells. Based on this information the mobile station is able to decide whether and how it may gain access to the system via the current cell. The 2bis message shall be sent if and only if the EXT-IND bit in the Neighbour Cells Description IE in both the TYPE 2 and TYPE 2bis messages indicates that each IE only carries part of the BA. Can be ignored by units only capable of GSM900.
  • ECSC:(1 bit) Early Classmark Sending Control. This bit controls the early sending of the classmark by the Mobile Stations implementing the Controlled Early Classmark Sending option: 1= Early Sending is explicitly accepted 0= Early Sending is explicitly forbidden.
  • RxLevFull:(6 bits) C1 value with continuous transmission from tower (calculated from all the timeslots of one 51-multiframe)#
  • RxLevSub:(6 bits) C1 value with discontinuous transmission from tower (subset of the timeslots in the 51-multiframe - usually from the SACCH timeslot)#
  • RxQualFull:(3 bits) Received signal quality is derived from the BER (Bit Error Rate) with continuous transmission from tower (calculated from all the timeslots of one 51-multiframe) - see notes on BER
  • RxQualSub:(3 bits) Received signal quality is derived from the BER (Bit Error Rate) with discontinuous transmission from tower (subset of the timeslots in the 51-multiframe - usually from the SACCH timeslot) - see notes on BER
  • Timeslot:(4 bits) The current Ts (Timeslot) (0 through 7 - TDMA allows eight channels to be accommodated on a single RF (Radio Frequency) carrier)
  • TimeAdv:(7 bits) TA (Timing Advance) (0 through 63 ) - see notes on timing advance below
  • PwrLev: Reports which power step/level the phone is transmitting at - (See section below on power control)
  • Vocoder: EFR (Enhanced FullRate) / FR (FullRate) / HR (HalfRate) / NA (NotApplicable) - (How many of these are actually implemented ?)
  • 5bis: This system information message is sent optionally on the SACCH just after handover by the network to mobile stations within the cell giving information on the extension of the BCCH allocation in the neighbour cells. When received (and not ignored) this information must be used as the list of neighbouring cells to be reported on. Any change in the neighbour cells description must overwrite any old data held by the mobile station. The mobile station must, with the exception stated above, analyse all correctly received system information type 5 messages. Can be ignored by units only capable of GSM900.
  • BSIC:(6 bits) Control parameter Base Station Identity Code = |NCC (3 bits) BCC (3 bits)|
  • MBReport:(2 bits) MultiBand report. The number of neighbour cells (with known and allowed NCC part of the BSID) for each frequency band supported is included in this parameter. Possible values are: 6-0, 5-1, 4-2 & 3-3
  • MeasValid:(1bit) This bit indicates if the measurement results for the dedicated channel are valid or not: 0=The measurement results are valid, 1=the measurement results are not valid.
  • DTX:(1 bit) Discontinuous transmission, a feature used to save battery and reduce network traffic by powering down the mobile station transmitter when there isn't any speech to transmit.
  • MCC: Mobile Country Code - This is the X.121 code for the country ( 238 = Denmark etc.)
  • MNC: Mobile Network Code 1 = Tele Denmark, 2 = Sonofon, 10 = TDM GSM-1800 (These are the ones for MCC 238 )
  • LAC: Local Area Code, Several cells are contained in a LA(Local Area). The size is operator definable and may vary. A LU (Location Update) must take place if the MS leaves the LA. The LAC is 2 bytes long and hence the value between 0 and 65535. Together with MCC & MNC this gives the LAI (Local AreaInformation)
  • CellID: A number that identifies the active cell. The CID (CellID) is unique to the LA. For a truly unique description of a cell, the CGI (Cell GlobalIdentity) should be used. The CGI consists of the CID, MCC, MNC & LAC
  • T3212: Time between periodic LU's (0-255). The value of the T3212 timer has to be multiplied with 6 minutes to get the LU-period : 010=1 Hour, 050=5 hours the theoretical maximum is 25.5 hours - It can be configured independently for each cell. The Location Update Timer is much more a HLR (Home LocatonRegister) time-out. If a phone leaves the coverage area and has no chance to send a "IMSI Detach" (to log off - please note that not all cells allow IMSIdetach/attach), then the phone would be paged in the last known LA, which may force a lot of traffic a) on the radio channels and b) between the BTS, theBSC (Base Station Controller) and the HLR. The LU timer is reset if a call or SMS is sent / received.
  • BS-PA-MFRM: Number (2...9) of MFRMs (MultiFRaMe) between two transmissions of the same PAging message to MSs of the same paging group. I assume, that when we are talking about paging, the channel at issue here is the paging channel, which is a CCH (Control CHannel)- here the length of a multiframe is 234 ms - see note on TDMA frame structure & duration. The value for my operator 238-01 is 9 which corresponds to 234 ms x 9 = 2.1 seconds between paging messages. The BS-PA-MFRM shows the Discontinuous Receive (DRX) parameter of the network. DRX allows the mobile to synchronize its listening period to a known paging cycle of the network. This can typically reduce the standby power requirements by 90%. The paging procedure has been designed to facilitate significant battery-saving potential in the hand portable - the larger the period between listening periods the lower battery consumption. Unless a hand portable is used excessively the biggest drain on its battery comes not from the time spent using it, but from the standby cycle as it monitors the paging channel, in case it is being called. In the GSM system the DRX allows the mobile, once it has located the paging signal, to synchronize a clock knowing that it will not get another signal until a specified time has elapsed. It can thus power down its circuits for most of the time during standby. On a 8700 with a 600 mAh battery motorola specifies 60 hours of standby with DRX=2 and 75 hours with DRX=9
  • XZQTY : From disassembling the firmware, it appears as if XZQTY is not variable at all, but simply fixed at 14.3 all the time.

* When comparing RxLev's, remember the logarithmic nature of the dB scale and that the signal intensity decays by a factor 4 when the distance from the BST is doubled ; Assuming line of sight to the BST, the signal will drop 6 dB when the distance is doubled.

Continue here to read my description of the technical basis for the codes, BCCH decoding status, powerlevels, bit error rate. timing advance, and TDMA channel structure.

I would like to thank Marcello Scata, Norbert Hüttisch, Patrick Zandl and Thomas Kochanek for their help in the making of this page.

Welcome to my pages on Motorola GSM phones

I am in no way affiliated with Motorola Inc. These are NOT official Motorola pages

In order to make these pages evolve and grow, I need more information. If you have information or documentation of any kind, please share it. I will treat any information I receive as confidential (you might consider using pgp) – anonymity is guaranteed. There are still many gaps and holes that need to be filled – please help me in trying to do that. The things that I am especially interested in is the DSC bus and the emmibox (any details, comm protocols, firmware dumps etc.). I need information on the BIC & MODEM IC. Of course all this is for academic purposes only and my lips will remain sealed (or as a prominent writer of cryptography software once said: “They will have to pry the pgp passphrase from my cold, dead neurons…”).

Everyone can help. I need feedback for the software version, test mode command, IMEI (TAC+FAC) and battery lists. If you have information that is missing in those lists, please help me keep them up to date. These pages should not be viewed in a resolution less than 800×600. Please read the copyright and disclaimer.

Thank you to Antonio and TELESERVIZI for kindly providing webspace.