I have been gathering information on the GA628 for over a year now. It once started as a project in which mortar supply bunkers were to be equipped with smart level indicators. These would send a warning message to the distribution centre when the mortar runs out. The idea was to use a GA628, a weight sensor and some electronics to this end. Unfortunately costs were too high, as phone companies didn't give enough rebate on volume contracts. But the idea was neat. Follows the information I collected, partly by investigating the phone myself, but also thanks to many contributions from the net. Thanks !
Bottom view, keyboard up, counting from the left:
All signals seem to be at 5V logic. Most debug messages are text. Like "CB ok!" etc. Debug messages are trailed by 0x0A, 0x0D. Power-up means removal of battery, reconnection of battery, depressure of "NO".
A portable hands free kit is connected as follows:
Portable Handsfree (directly connected to pins 01, 02, 04):
01 Earphone: 16 Ohm
02 Microphone: <= 2 kOhm
05 to be connected to 04 (GND)
The following commands are recognised by the phone. This list is not complete. If you know the full commandset or if you have any comments, please mail me. Use 9600 baud, 1 stopbit, 8 data bits, no parity.
ATA Pick up phone during ring AT+GMI Manufacturer identification AT+GMO Request model Identification AT+GMR Request revision Identification AT+GMM ATDxxx; Dial number xxx (note the semicolon (;)) ATH Hang up phone AT+CFUN=? Define levels of fuctionality in the order of power consumed AT+CFUN=0 Switches off the phone AT+CBC Query battery level
Each command has to be followed by a 0x0A, 0x0D sequence, that is carriage return - line feed. These commands will be acknowledged with an 'OK' prompt. An incoming call is signalled by the string 'RING' sent by the phone at 9600b in normal mode.
TTL signal levels are use on the data pins of the GA628. Probably the easiest way to generate TTL signals out of a serial port is by removing the RS232 level shifters (1488 1489 or alike) from the serial board inside your computer !
The following is applicable to at least the Ericsson GH377. Written by Anthony, aberkow@syfrets.co.za Well here's the skimpy info I have on sending SMS messages via the phone's serial port: SMS Commands ============ When sending/receiving SMS messages the text cannot exceed 160 characters though larger messages can be sent in blocks of 160 and joined again by the receiving PC. The character set used is not quite regular ASCII and is as follows (note characters are only 7-bit): SMS Character Set ================= b7 0 0 0 0 1 1 1 1 b6 0 0 1 1 0 0 1 1 b5 0 1 0 1 0 1 0 1 b4 b3 b2 b1 0 1 2 3 4 5 6 7 0 0 0 0 0 SP D SP 0 @ P ¿ p 0 0 0 1 1 £ SP ! 1 A Q a q 0 0 1 0 2 $ F " 2 B R b r 0 0 1 1 3 ¥ G # 3 C S c s 0 1 0 0 4 è L $ 4 D T d t 0 1 0 1 5 é W % 5 E U e u 0 1 1 0 6 ù P & 6 F V f v 0 1 1 1 7 ì Y ' 7 G W g w 1 0 0 0 8 ò S ( 8 H X h x 1 0 0 1 9 Ç Q ) 9 I Y i y 1 0 1 0 10 LF X * : J Z j z 1 0 1 1 11 Ø SP + ; K Ä k ä 1 1 0 0 12 ø Æ , < L Ö l ö 1 1 0 1 13 CR æ - = M Ñ m ñ 1 1 1 0 14 Å ß . > N Ü n ü 1 1 1 1 15 å É / ? O § o à Notes: SP Space LF Line feed (in GSM this implies a carriage return/line feed combination) CR Carriage return is forbidden by the TAP protocol and cannot be included in the message text. The ONLY SMS command I have been able to work out is the one to send an SMS MO message from the PC to the cellphone (BS) but NOT actually transmit it. Once in the phone's memory, this message can then be optionally edited and subsequently sent at a later time (assuming one has the GH388 or other model that supports SMS MO). However I suspect the same command with different parameters may actually transmit the message. The command must be sent using the correct protocol as per my earlier posting. The command (with parameters) is: 0x41 0x07 0x03 0x01 0x00 0x01 0x00 0x00 0x81 0x00 0x00The first 2 bytes are the command itself as usual, the next 9 bytes are parameters that I expect can be somehow modified to give different results. is a byte containing the number of ASCII characters in the TEXT of . The number of actual bytes in in NOT necessarily the same as - since the message is compressed! Each character of the message is only 7-bits and the 8th bit is stripped out to save bandwidth such that the lsb of the 2nd character will be sent as the msb (8th bit) of the first byte, etc. As an example consider the message "test" with is 4 characters long so above = 4 (and bytes = 3.5 with compression). The characters "test" in hex are: 0x74 0x65 0x73 0x74 So in binary this is: 01110100 01100101 01110011 01110100 (note 8th bit is zero for each character) ---t---- ---e---- ---s---- ---t---- 87654321 87654321 87654321 87654321 So strip out the 8th bit: 1110100 1100101 1110011 1110100 ---t--- ---e--- ---s--- ---t--- 7654321 7654321 7654321 7654321 and stuff it: 1 1110100 11 110010 100 11100 0000 1110 e ---t--- s- --e--- -t- --s-- ---- -t-- 1 7654321 21 765432 321 76543 ---- 7654 To give: 11110100 11110010 10011100 00001110 (4 bits wasted in msb of 4th byte) or in hex: 0xF4 0xF2 0x9C 0x0E So the full command string is: 0x02 0x10 0x41 0x07 0x03 0x01 0x00 0x01 0x00 0x00 0x81 0x00 0x00 0x04 0xF4 0xF2 0x9C 0x0E Perhaps you can get further than I did? It's really difficult to get any info on this. Anthony
Go to MissedCall Empty the list Press the -> key for a second or two The option Menu size turns up Choose 'yes' and go from there. An alarm clock turned up too but it never rang. I think this was because there is no clock in the phone. By Michael SextonAnd another: Try to type this in your Ericsson: >*<<*<* where < is the left arrow and > is the right one This should enter the hidden menu. By Gemini@4u.net And the IMEI (Serial Number) *#06# Reset language to English *#0000# Switch off the phone, but continue call: Press 40# 'NO' while the phone is diverting, press 'NO' again to switch off the phone. Disconnect battery to hang up. Mute the microphone: Hold the CLR button (by danield@w3.org) Add SIM lock: <**< Note: I really don't know how to unlock your phone. I am in no way responsible for any damage to your equipment, or whatever misfortune that might arise from using any of this information on this page. I sympathize, though.
Note the peculiar position of the eeprom. One would expect it near the uC, at the back of the PCB. And what about these extra button contacts ?