CELLULAR TELEPHONE PHREAKING PHILE        VOL 2 by "The Mad Phone-man"

Some terms you should understand:

Control Channel- The channel the phone and cell base first communicate on.
Reverse Control Ch- The oposite frequency, 45 mhz lower than the control
                    channel.This is where the mobile unit is.
Voice channel- The channel you are assigned by the switch to commence the
                    call on after the exchange of suscriber data.
Reverse voice channel- Again 45mhz lower.
Cell Site- The base station that talks to the mobile.
Switch- The computer that places the calls, and takes and recieves data
        from the suscriber or from PSTN. (public switched tel netwk)
OK that should get things started. A suscriber picks up his handset to
place a call.

 The phone has already been locked onto the strongest control ch in the
area by a computerized scanner in the phone. As he drives thru the service area
the computer constantly picks out the strongest control ch and stays on it,
altho more than one cell site can actualy be heard. The suscriber enters the
number to call on the keypad, and presses the "send" button. At this time the
folowing data is transmitted to the cell sit by the mobile. The callers
electronic serial number (ESN) , his home system number (two digits) his
mobile's area code and phone number, and the number he wants.The cellular
switch now picks up an outgoing line, places the call for him and tells
the mobile to switch to a voice channel. The two ends are linked in the
central switch and violla! A complete phone call, in about 3 seconds.

I have purposely over-simplified the whole process to point out the
moment of truth. The mobile's ESN and phone number and the data in the
switch must match or no go. This is how the billing is figgured out.If
one had the ESN and the mobilephone number, you could call anytine
anyplace without fear of trace, let alone bill. The ideal setup would
let you listen to the reverse control channel, record and display heard
working numbers and ESN's and recall them at your discression to make calls.
This would be tits!  Were not quite there yet. But some hard work has
allready been done for us. All the aforementioned codes are sent
in hex, in NRZ code (phancy term for phase shift keying) but the phone
allready has, for example a NRZ receiver and transmitter built rite in.
All that has to be done is to have a receiver on the reverse control
channel, recover the other suscribers data and save it or at least print
it out. The mobile radio data books show some good technical stuff on
the systems used and chip part numbers for the NRZ stuff. I know there
is a mfgr using the lowley 8085 chip for the control head functions,
seems like theres room for xperementin here.

               More to come!...     "The Mad Phone-man"