P3 Test operations and more.
                         ============================

Orignal Text file name for Upload is P3TST001.TXT (P3 TeST Manual) compiled
and uploaded by Jono Bono (or soon to be just Jono) if you have any further
information to contribute please add it then re-upload this file as the next
avalible number. i.e. P3TST002.TXT etc.

To SYSOP, please ensure any future uploads and amendments of this file have
been done correctly. i.e. The file is still laid out in the same way with
all instructions including this top section. Thanks ....JoNo.

*** If you have examples of how to make use of some of the comands, please 
add them to the end of this file under the "Notes and Examples" section or 
put them in another file ***.

ALSO... Please keep this file as basic ASCII (i.e. keyboard ASCII text, only) 
and keep each line to a maximium 77 chars (i.e. last character in a long line
would be in column 77 on your text editor), so that users of all different 
systems can view it and edit it.

If you want to print this file then you may need to space it into 66 line
pages (dependant on Printer and/or System). Please "do not" include this
spacing in any altered files that you may re-upload.

**** leave the above intact and change the line below if you re-upload ****

Current File = P3TST001.TXT dated 24/09/94 uploaded by Jono Bono (Jono).
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Useful information that relates to the modified test chip avalible for the 
NEC P3 mobile phones (May not cover all avalible commands).

Please note: The contents of this entire document are for informational 
purposes only and must not be used to break any laws, if you use any of 
this information you are soley responceable for you own actions. OK!

Here are some of the new and most useful commands.
==================================================

To enter the phone's serial number and phone number.
----------------------------------------------------
Power On, Enter ESN (11 digits) on keypad then STO 69, the phone should 
now switch back to the display. (DO NOT enter eleven 0's sto 69, this will 
disable the phone completely and beyond normal reset, can be useful <grin>).
Note: If you ever need to use the eleven 0's then don't throw your phone
away as there still are ways to reset it.

Then press RCL *, RCL # 01 (test mode entered), RCL #71 and the phone 
number will appear. Just enter the new phone number.
i.e. providers code (4 digits) and then number (6 digits). 

The provider code translations are as follows; 
(please add to this list and re-upload this document, thanks).

(0374) = 2345 (VodaFone) System A.
(0378) = 2343 (VodaFone) System A.
(0831) = 2344 (VodaFone) System A.
(0836) = 2340 (VodaFone) System A.
-----------------------------------
(0585) = 2349 (Cellnet) System B.
(0850) = 2346 (Cellnet) System B.
(0860) = 2342 (Cellnet) System B.

Press # for the rest of the phone menu or just to ensure that the number has 
been stored. The only other item that needs to be changed is SYS=A or B. 
You can also change the real numbers prefix, but this is only for "real" 
number display purposes on the function command. i.e. FCN 33 will display 
0836-XXXXXX or whatever, but the phone's number according to the cell 
system is really 2340-XXXXXX. You may also wish to play with the other 
settings, but please note the originals before doing so. 

Once you have altered all of your settings, (note pressing # stores the
setting, and moves to the next) press and hold CLR once the display is
blank, press RCL # 02 to reboot the phone. Alternatively, you can just
press PWR to turn it off, and PWR to turn it back on.

Any further information on these extra options will be appreciated. 
(Please note them here and re-upload this document).

The lock code is obviously just the phone's lock code, however, it doesn't
serve much good with a modified P3 rom, since one can jump into test mode
from full lock! And then change the lock code....(You must enter test mode
by pulling out the battery, and quickly putting it back in.)

Home area has many possible values, however, for the purpose of the general
Cellphone Phreaker, only three are used. If you have a Vodafone ESN^MIN
pair, then enter 02051 here. This essentially means that you can receive
calls on the other person's number.....The other values for home area are
simply to tell the Cell where you live in the country. If you have a
Cellnet ESN^MIN pair, then enter 03600, and if you don't want to receive
calls, enter 00000. Note that if the other person has there phone turned on
at the time that you use yours for incoming calls, then the Cell will
automatically kill the ESN^MIN pair.

Roam is for future use, and will not be used....It is basically for phones
with Dual Nams, so they can use both Cellnet and Vodafone on the same
ESN^MIN pair.

Timer SW. This should always be on Voice CH. This is basically how the Cell
will charge you fo the calls.....Voice CH works on both Cellnet and
VodaFone, but Charge RT only works on Cellnet....This tells you how many
units you have spent (Using FCN 1 menu.)

Priority should basically be set rather high. If your local Cell is busy,
and there are no free cells, and you have a priority of 15, then someone
else will be disconnected, and your call will be allowed!

Call Timer. This serves little for the Cellular Phreaker. It is best to
leave this on Call Out. The function only is significant to those who
actually pay the phone bill!

To make the phone scan all avalible channels (Voice only).
==========================================================
Later in this document will be some test commands, to enter test mode on 
the modified chip you will always need to enter the ESN again, then RCL * 
and RCL #01 for test mode. (NOTE: There is a faster way of entering the test 
mode by simply removing the battery and quicly putting it back, the phone 
will go into test mode.)

To Scan (Once in test mode) press RCL # 12 (Speaker on), RCL # 69 then 4 
digits (channel to start), then # (see this option in test manual text later 
in this document for more details). Use * to pause.

i.e. If you enter 0001 as the channel, the phone will start scanning each 
channel from 1 to 600 and then 1329 to 2047. As soon as you hear voice you
can press * to stay on that channel and * again to move on.

Start of Test Commands.
=======================
These are listed as they are in the test manual, but please note that some
commands may be different or act differently due to the modification on the
chip.
---------------------------------------------------------------------------
Taken from DCU: 0708A
Top of page reads: 147-102650X322A  TR5E1320-22A  APPENDIX A Test commands -
                   - through keypad.

NOTE: Enter each command by pressing RCL key, # key, and the proper command
number. Some commands require additional numbers after a hyphen followed by
the # key.

    RCL, #, Number
    RCL, #, Number, Additional Number, #

When you enter the commands through the keypad, always give SUSPEND command
(RCL, #, 01) before you press other commands except STATUS (RCL, #, 03) and
STATUS REPEAT (RCL. #, 61, 1, #).

0---------------17--------------33-----------------------------------------77
^               ^               ^                                           ^
Above is the coloumn ruler where each of the next sections starts and ends.
Most remark paragraphs start at col 33 unless the Function name is long, then
it will start at 1 or 2 spaces after the Function name. Notice that no chara-
-cter is placed after col 77 (max).

Key Entry       Function Name   Remarks
=========       =============   =======
RCL, #, 01      SUSPEND         All dots come on (not on Modified test chip)
                                It terminates the normal mode, performs 
                                initialization and awaits further test 
                                commands.

RCL, #, 02      RESTART         It teminates the test mode, enters the normal
                                mode and restarts the call processing tasks.
                                You hear a wake-up tone and momentarily the
                                phone number appears on the display. You are
                                now at receiving standby mode (normal mode).

RCL, #, 03      STATUS          It shows the status information of the unit 
                                by 16 digits on the display.
                ----------      ----------
Example:            119110          AAABCD
                0003100363      EFGHIJKKKK
                ----------      ----------
Where:          AAA: Shows RSSI (Receiver Signal Strength) Value ranging from
                     000 through to 255 (3 digits).
                B:   Shows RXM (Receiver Audio Mute) or Receiver audio gate
                     on/off. 1 = muted or gate off.
                C:   Shows TXM (Transmitter Audio Mute) or Transmitter audio   
                     gate on/off. 1 = muted or gate off.   
                D:   Shows WS (Word Synchronization) in FOCC. 1 =WS acquired.        
                E:   Shows B/I (Current state of the busy idle bit of FOCC).
                     1 = idle  0 = busy.
                F:   Shows CARR (carrier) on/off. 1 = off.   
                G:   Shows ST (Signalling Tone) on/off. 1 = ST on.   
                H:   Shows SAT (Supervisory Audio Tone) on/off. 0 = 5970Hz,  
                     1 = 6000Hz,  2 = 6030Hz  and  3 = No SAT.
                I:   Shows MODE. 1 = Control channel,  0 = Voice channel.   
                J:   Shows Transmission Power Reduction Level.   
                           0 = No reduction.
                           1 = No reduction.
                           2 = No reduction.
                           3 = -4dB.
                           4 = -8dB.
                           5 = -12dB.
                           6 = -16dB.
                           7 = -20dB.
                KKKK: Shows Channel Number, ranging from 0000 through 0600 &
                      1329 through 2047 (4 digit).

RCL, #, 04      RESET           Reset the autonomous timer to zero.

RCL, #, 06      INIT            Initialize the transceiver unit to the 
                                following state; 
                                Carrier off.
                                Attenuation 0dB.
                                Receiver-Audio muted.
                                Transmit-Audio muted.
                                Signaling Tone (ST) off.
                                Autonomous timer reset and it's periodic.
                                SAT off.
                                DTMF and Audio tones off.
                                Received-voice Volume Max.
                                Compandor off.

RCL, #, 07      CARRIER-ON      Turn the TX carrier on.

RCL, #, 08      CARRIER-OFF     Turn the TX carrier off.

RCL, #, 09      LOAD-SYNTH      Set the synthesizer to the channel specified
                                by up to 4 digits followed by # key (up to 4 
                                digits = 0 through 600, 1329 through 2047).
                ---------       ---------
Example:        TEST MODE       TEST MODE      Pressing 333 and #
                      09-          09-333
                ---------       ---------

RCL, #, 10      SET-ATTN        Set the RF power attenuation to the value
                                specified by 1 digit followed by the # key
                                (1 digit = 0 through 7).
                ----------
Example:        TEST  MODE      Pressing 4 for 8dB reduction
                     10-4
                ----------      0 to 2 = No reduction.
                                3 = -4dB,  4 = -8dB,  5 = -12dB,
                                6 = -16db,  7 = -20dB.

RCL, #, 11      RXMUTE          Mute the receive-audio signal. No audio
                                signal comes from the speaker.

RCL, #, 12      RXUNMUTE        Unmute the receive-audio signal. Noise or
                                Voice comes from the speaker.

RCL, #, 13      TXMUTE          Mute the Transmit-audio signal.

RCL, #, 14      TXUNMUTE        Unmute the Transmit-audio signal.

RCL, #, 15      RESET OFF       Discontinue periodic resetting of the
                                autonomous timer (allow timer to time out).

RCL, #, 16      STON            Transmit a continuious Signalling Tone (ST).

RCL, #, 17      STOFF           Stop transmission of Signalling Tone (ST).

RCL, #, 23      VERSION         Show the software version-information on the
                                display.
                                ----------
                                  V-2.0
                                 (V-9011)
                                ----------

RCL, #, 24      READ SN         Show the production serial number of the
                                phone. i.e. ----------
                                            Serial No.
                                            22A-000001
                                            ----------

RCL, #, 32      SATON           Enable the transmit of SAT. One digit follow-
                                -ing the command code shall contain the color
                                code of the SAT frequency that the transceiv-
                                -er unit may expect to receive. SAT shall be
                                transmitted if the carrier is currently on.
                                COLOR CODE DIGIT.       SAT FREQUENCY.
                                =================       ==============
                                        0                   5970Hz
                                        1                   6000Hz
                                        2                   6030Hz

RCL, #, 33      SATOFF          Disable the transmission of SAT.

RCL, #, 34      CDATA           Transmits 6 bytes NAM data as 240 bits data.
                                DEFAULT = 01, 02, 03, 04, 05, 06 (No TX ON).

RCL, #, 35      HIGH TONE ON    Activate the high audio tone (1150 Hz) and
                                apply it to the receive-audio line. You hear
                                the high tone from the speaker.

RCL, #, 36      HIGH TONE OFF   Deactivate the high audio tone. Tone stops.

RCL, #, 37      LOW TONE ON     Activate the low audio tone (770Hz) and apply
                                it to the receive-audio line. You hear the 
                                low tone from the speaker.

RCL, #, 38      LOW TONE OFF    Deactivate the low audio tone. Tone stops.

RCL, #, 39      INVM            Initialize non-volatile memory. Set registra-
                                -tion memory and clear all the speed-dial
                                memories. Set the Lock State to activate
                                (Fully Locked).

RCL, #, 42      DTMF ON         It sounds DTMF tones, a responce from each
                                pressed key. It sends the signal to RX AUDIO
                                and TX AUDIO lines.

RCL, #, 43      DTMFOFF         Deactivates DTMF generator. DTMF tones stop.

RCL, #, 48      TONE-OFF        Deactivate alert tone and external call 
                                alert. The alert tones stop.

RCL, #, 49      TX-DISE         Deactivate TX ENABLE line. Disable the 
                                transmitter.

RCL, #, 50      STATUS REPEAT   Status Repeat at Test Mode.
                (TEST MODE)

RCL, #, 51      MON             Monitors the port status.
                                "      ABCD" (Mid line of LCD display).
                                A: HOOK         1 = ON HOOK
                                B: EXT PS       1 = BATTERY MOUNTED
                                C: ADP MON      1 = ADAPTER CONNECTED
                                D: HF MON       1 = HANDS FREE

RCL, #, 57      TX-ENABLE       Activate TX ENABLE line. Enable transmitter.

RCL, #, 60      AUDIO PATH      Set the Audio Path.
                                "      60-X" (Mid line of LCD display).
                                X: 0 = HF
                                   1 = SPK
                                   2 = ALT
                                   3 = HS

RCL, #, 61      STATUS-REPEAT   Without suspend. It shows the status
                                information of the unit by 16 digits every
                                second.
                ----------      ----------
Example:        TEST  MODE      TEST  MODE    Press 1 and # for display on.
                       61-            61-1    Press 0 and # for display off.
                ----------      ----------
                After the setting, press RCL, #, 02. The wake-up tone and
                display come on. The 16 digit status information appears.
                ----------      ----------
Example:            119110          AAABCD
                0003100363      EFGHIJKKKK
                ----------      ----------
Where:          AAA: Shows RSSI (Receiver Signal Strength) Value ranging from
                     000 through to 255 (3 digits).
                B:   Shows RXM (Receiver Audio Mute) or Receiver audio gate
                     on/off. 1 = muted or gate off.
                C:   Shows TXM (Transmitter Audio Mute) or Transmitter audio   
                     gate on/off. 1 = muted or gate off.   
                D:   Shows WS (Word Synchronization) in FOCC. 1 =WS acquired.        
                E:   Shows B/I (Current state of the busy idle bit of FOCC).
                     1 = idle  0 = busy.
                F:   Shows CARR (carrier) on/off. 1 = off.   
                G:   Shows ST (Signalling Tone) on/off. 1 = ST on.   
                H:   Shows SAT (Supervisory Audio Tone) on/off. 0 = 5970Hz,  
                     1 = 6000Hz,  2 = 6030Hz  and  3 = No SAT.
                I:   Shows MODE. 1 = Control channel,  0 = Voice channel.   
                J:   Shows Transmission Power Reduction Level.   
                           0 to 2 = No reduction.
                           3 = -4dB.
                           4 = -8dB.
                           5 = -12dB.
                           6 = -16dB.
                           7 = -20dB.
                KKKK: Shows Channel Number, ranging from 0000 through 0600 &
                      1329 through 2047 (4 digit).

RCL, #, 69      SCAN SLOW       Measure the Received Signal Stength Indicati-
                                -on (RSSI) signal at each channel.
                                Shows each channel number and it's RSSI level
                                on the display.
Example:        ----------      ----------
                TEST  MODE      TEST  MODE     Simply press # key or
                       69-            69-1     press channel number and #.
                ----------      ----------  
                To activate the SCAN SLOW command, press RCL. # 69, XXXX, #.
                Where XXXX = starting channel number (1 through 6000, 1329
                through 2047). If you don't enter the channel number and
                press # key, then the channel will begin from 0001. The unit
                measures the RSSI at each channel, scanning from the channel
                number you set. The scanning speed is 0.5secs per channel.
                The unit shows each channel number and it's RSSI level on
                the display "XXXX-sss" (On Mid line).
                ----------
                TEST  MODE       Where: XXXX = Channel number
                  XXXX-sss               sss = RSSI
                ----------
                Pressing * key while scanning causes the unit to pause.

                Pressing * key again resumes scanning. To end scanning press
                the # key. The radio channel will be fixed at the first 
                channel number and is ready to accept other commands. If you
                press other keys other than the * or # the unit ignores them
                and gives back a short alarm tone.

RCL, #, 70      KEYPAD PROGRAM2 Allow you to do NAM programming via the 
                                keypad. See appendix C.       
                                
RCL, #, 71      KEYPAD PROGRAM1 Allow you to do NAM programming via the
                                Keypad. See appendix C.

NOTE: This file contains the reference from Appendix A only. If you have or
can get information from appendix C, please add it to the end of this file.

RCL, #, 72      I/O DATA OUT    Writes data (0-255) or I/O (0-127).
                                Address is 00FF00H-0FF7FH
                                        XXX   YYY  (Mid Line)
                                           XXX = Address
                                           YYY = Write Data

RCL, #, 73      AEC ON          Turns AEC (Automatic Efficiency Control) on.

RCL, #, 74      AEC OFF         Turns AEC (Automatic Efficiency Control) off.

RCL, #, 75      CDATA OFF       Stops CDATA transmission.

RCL, #, 77      LOAD SYNTH 2    CH assignation to TX/RX synth.
                                "TXXXXRYYYY" (Mid Line).
                                   XXXX = TX channel
                                   YYYY = RX channel

RCL, #, 78      SET DEFAULT DATA It writes default data into AF IC & EEPROM.

RCL, #, 79      WRITE ADJUST DATA It writes to AF IC and EEPROM the adjust-
                (MAX DEV.)        -ment data that specifies the MAX 
                                  deviation for each unit.

RCL, #, 80      WRITE ADJUST DATA It writes to AF IC and EEPROM the adjust-
                (EXT IN)          -ment data that specifies the EXT IN data
                                  for each unit.

RCL, #, 81      WRITE ADJUST DATA It writes to AF IC and EEPROM the adjust-
                (DTMF)            -ment data that specifies the DTMF data
                                  for each unit.

RCL, #, 82      WRITE ADJUST DATA It writes to AF IC and EEPROM the adjust-
                (MIC)             -ment data that specifies the MIC data
                                  for each unit.

RCL, #, 83      WRITE ADJUST DATA It writes to AF IC and EEPROM the adjust-
                (TX DATA)         -ment data that specifies the TX data
                                  for each unit.

RCL, #, 84      WRITE ADJUST DATA It writes to AF IC and EEPROM the adjust-
                (SAT)             -ment data that specifies the SAT data
                                  for each unit.

RCL, #, 85      WRITE ADJUST DATA It writes to AF IC and EEPROM the adjust-
                (RX DATA)         -ment data that specifies the RX data
                                  for each unit.

RCL, #, 86      WRITE ADJUST DATA Sets power level and specific data of each
                (POW LEVEL)       unit in EEPROM with 7 byte.(P0-P7, Spec, 
                                  Data). Specific Data: Fine adjustment of 
                                  output power level.
                                  Example. RCL, #, 86, ___ #, ___ #.

RCL, #, 87      WRITE DATA(RSSI)  Writes A/D transformed data of +10dBuV to
                                  EEPROM to set at the position between block
                                  two and three of the RSSI indication.
                                  (between **--- and ***--).

RCL, #, 88      MOD TRACKING ADJ  VCO Modulation Senstivity.

RCL, #, 90      BATT            Shows the A/D converted value of the
                                battery Voltage. "       XXX" (Mid Line).
                                XXX = 0 to 255. (0 = fucked!).

RCL, #, 91      TEMP            Shows the A/D converted value of the 
                                Temperature inside the unit.
                                XXX = 0 to 255. (000 = fried!).

RCL, #, 94      COMPANDOR ON    Set the compandor circuit on.      

RCL, #, 95      COMPANDOR OFF   Set the compandor circuit off.

RCL, #, 99      KEYPADPROGC++   Write applications to run with the Intel
                                80386, 486 family of processors via the
                                units keypad.
                                Example: Write DOS and Windows applications
                                in C++, write a Bluebox prog etc.
                                Refer to the P3 C++ prog ref for further info
                                also refer to DOS and Windows references.
                                Note: This function only works with the P3 
                                I/O card for connection to the CPU of a PC.

Note: All information given in this file is from Appendix A of the P3 Test
ROM manual, it is documented as per appendix A apart from the last couple
of remarks under BATT and TEMP (i.e. Fucked! and Fried!) also the last test
code 99 is a load of rubbish, well after writing all this long boring tech
file about a phone that can do everything! I could resist added it! <g>.

Notes and Examples.
===================
This section has been put here for you to add further notes about funtions
you have found. Then please re-upload as next revision.
----------------------------------------------------------------------------
i.e.
1) Using the Phone capture other ID's. (I wish). by DREAMER.
In test mode use RCL, #, 98 and take down all the information that pops up
every second. *** Example only, put yours like this below ***.
----------------------------------------------------------------------------