CELLULAR TELEPHONE PHREAKING PHILE VOL 2 by "The Mad Phone-man" Some terms you should understand: Control Channel- The channel the phone and cell base first communicate on. Reverse Control Ch- The oposite frequency, 45 mhz lower than the control channel.This is where the mobile unit is. Voice channel- The channel you are assigned by the switch to commence the call on after the exchange of suscriber data. Reverse voice channel- Again 45mhz lower. Cell Site- The base station that talks to the mobile. Switch- The computer that places the calls, and takes and recieves data from the suscriber or from PSTN. (public switched tel netwk) OK that should get things started. A suscriber picks up his handset to place a call. The phone has already been locked onto the strongest control ch in the area by a computerized scanner in the phone. As he drives thru the service area the computer constantly picks out the strongest control ch and stays on it, altho more than one cell site can actualy be heard. The suscriber enters the number to call on the keypad, and presses the "send" button. At this time the folowing data is transmitted to the cell sit by the mobile. The callers electronic serial number (ESN) , his home system number (two digits) his mobile's area code and phone number, and the number he wants.The cellular switch now picks up an outgoing line, places the call for him and tells the mobile to switch to a voice channel. The two ends are linked in the central switch and violla! A complete phone call, in about 3 seconds. I have purposely over-simplified the whole process to point out the moment of truth. The mobile's ESN and phone number and the data in the switch must match or no go. This is how the billing is figgured out.If one had the ESN and the mobilephone number, you could call anytine anyplace without fear of trace, let alone bill. The ideal setup would let you listen to the reverse control channel, record and display heard working numbers and ESN's and recall them at your discression to make calls. This would be tits! Were not quite there yet. But some hard work has allready been done for us. All the aforementioned codes are sent in hex, in NRZ code (phancy term for phase shift keying) but the phone allready has, for example a NRZ receiver and transmitter built rite in. All that has to be done is to have a receiver on the reverse control channel, recover the other suscribers data and save it or at least print it out. The mobile radio data books show some good technical stuff on the systems used and chip part numbers for the NRZ stuff. I know there is a mfgr using the lowley 8085 chip for the control head functions, seems like theres room for xperementin here. More to come!... "The Mad Phone-man"