Moto T900 pager

clavo · Post by **clavo** » Wed May 05, 2004 9:30 pm

Anyone know anything about programming these things? Any info would be appreciated.

Drop me a PM.

Thx!

-c

cfdeng3 · Post by **cfdeng3** » Thu May 06, 2004 5:55 am

Here is a way to boost the in internal battery a bit which can help the transmitter:

from idle screen that shows date/time and send/recieve. type in this word: SLAYER, this will bring up a pager icon in the lower right part of screen.

then scroll down past power off, and you will see diagnostics. hit
enter.

then scroll down to SELF TEST MODE, hit enter.

it will say please wait when it brings up a bunch of numbers and
words jumbled together use right scroll and slowly right scroll unitl
u get to: 16:NICD and hit enter.

this will black out the screen and u will see a word- started in the
middle. this means that it is charging the internal battery off the
AA battery in the pager. let pager sit with flip open for about 25-30
minutes.
after 25-30 mins. close flip then reopen and hit the esc button.
this will restart your pager. then go to entry screen and type the
word SLAYER in again this should close the out the pager icon in the
lower right screen.
your internal battery is recharged. you will have to reset time date
after process.

Does anyone have any other things they can do with these??

Post by **alex** » Thu May 06, 2004 6:09 am

Anything else you can do with the self test mode?

I think for the most part they are probably OTA programmed by the provider since there's a 2way path.

-Alex

cfdeng3 · Post by **cfdeng3** » Thu May 06, 2004 6:12 am

Thats the only trick I know....anyone?

n3kvp · Post by **n3kvp** » Thu May 06, 2004 6:22 am

If you type in the word "dragon" that will put it into test mode for sensitivity adjustments and other things, 'DANGER" this will erase any and all saved messages and other user input data (addresses), saved data etc..

Butch

W4WTF · Post by **W4WTF** » Thu May 06, 2004 11:09 am

Cool! That nicad recharge seemed to help me, previously mine would only send from work if I set it down on soem metal to act as a "ground plane" now it send from my hip.

But, if you are in fringe areas setting down on metal (car hood, mobile radio, etc) works great to get it to send a little further.

I do see a pattern... dragon, slayer, I'll try some words that fit. Anyone knwo what the rest of that menu that slayer brinsg up is for?

clavo · Post by **clavo** » Thu May 06, 2004 4:47 pm

Wow. Those are some cool tips I didn't expect

Keep em coming

Still, anyone have any info on the programming side of things? Does software exist? Programmed by another hidden screen???

-c

clavo · Post by **clavo** » Fri May 14, 2004 2:28 pm

Any idea what the breakdown of the menu items in the diagnostic menu stand for? Some are obvious.... but anyone tried any others?

-c

clavo · Post by **clavo** » Fri May 14, 2004 2:43 pm

Also anyone know how reflex typically works? Does it use the same receive freq as a 1 way pager and then another for the TX?

I'm still looking for programming info for the T900 too.

clavo · Post by **clavo** » Fri May 14, 2004 8:08 pm

I'll just continue to talk to myself here

I don't know why this damn pager interests me so much...

It's interesting that it has a HOST and DSP just like astro gear.

I wonder if it's re-flashable.

-c

rasputin · Post by **rasputin** » Tue May 18, 2004 9:43 am

I can relay some info from the programming side and a little overview on how ReFlex works.

First, the "SLAYER" thing is not documented in the service manual that I have for the T-900. It's interesting to see.. I'll have to check it out later.

As for programming, software exists.. it's windows software. I happen to have it. If you want to purchase it yourself, Motorola will sell it to you. It is actually quite inexpensive at less than $50. I made a programming interface from the schematics listed on the paging section of the batlabs website, the Minitor 3 programmer. Works just fine.

Just as in the older 1-way pagers, there are passwords which may or may not be enabled. More likely than not, they are enabled. I happen to have a password list for most common carriers. If the pager can be read, I can hack out the remaining passwords with little effort. There are actually four passwords in the T-900. Download, Release, OTA, and HIX. Download is the basic password which allows you to modify non critical things in the pager. Release is the advanced password which allows you to change all other passwords, frequencies, capcodes, etc. OTA is the over-the-air programming password. HIX has something to do with roaming and picking up a roaming list from a foreign carrier, similar to the PRL in a cell phone.

As for the question on reflashing, yes it is possible. However, only the pager depot can do that. It looks like it is flashed through a JTAG port which appears to exist on the board. If someone knows a fair amount about JTAG and reading the FLASH from the pager with JTAG, I'd like to hear from that person. The HOST code runs the UI, and the DSP handles the encryption and decryption of the ReFlex packets.

There are two different versions of ReFlex. ReFlex 25 and ReFlex 50. The number indicates the channel size of their forward channels. 25 KHz or 50 KHz. ReFlex 50 was designed for SkyTel and is not licensed to any other carrier to my knowledge. You can't even get the carrier version of R50 software from Motorola, without SkyTel's permission.
ReFlex 50 actually runs four seperate 6400 baud data streams on the same frequency for an aggregate data rate of 25.6 Kbps. SkyTel transmits on 940.225 MHz and receives on 901.20625 MHz (no.. it's not a typo. It's really 901.20625). The return channels for both ReFlex 25 and ReFlex 50 are 12.5 KHz, up to 9600 baud.

ReFlex 25 runs a single 6400 baud forward data stream. It appears that carriers had the ability to run ReFlex in the 929-932 paging band but none do that I'm aware of. It is possible that the option was given to carriers to run both Flex and ReFlex forward channels on the same frequency. All the carriers are running ReFlex in the 940/901 MHz band around where I live, and are licensed as Narrowband PCS instead of Paging.

I'm not sure of the deviation of ReFlex but it is definately less than Flex. Flex is optimized for 4.8 KHz deviation. I'm going to say that ReFlex is approximately half, at about 2.4 KHz deviation. While I've been able to decode 4-level Flex fairly reliably with a 2-level data slicer, I've not been able to decode ReFlex, which only runs 4-level, with any reliability at all.

That pretty much sums it up for now. I've probably forgotten to mention a few details. PM me if you have questions.

Rasputin

cfdeng3 · Post by **cfdeng3** » Tue May 18, 2004 10:39 am

Does anyone know how to get rid of the newsgroups or change them???

Post by **alex** » Tue May 18, 2004 11:13 am

cfdeng3 wrote:Does anyone know how to get rid of the newsgroups or change them???

Pull the capcodes from the pager.

That's about it.

Other than that, turn the info alert off, the pager still gets them, but you won't know.

-Alex

RESCUE161 · Post by **RESCUE161** » Mon Feb 26, 2007 4:59 pm

I have everything set up and can read the pager, but I need to get into the frequency/capcode portion of the codeplug. You must enter a "release" password and I have no idea what it is. I've been searching for it with a hex editor and have found a few possibles, but nothing has worked yet.

It keeps telling me that I only have 5 tries left and it counts down, but if I get it wrong and then cancel, it resets the counter back to 5. I guess that's a good thing. There are umpteen million instances of "Password" using WinHex. I tried the \CurrentVersion\ thing too, but no luck.

Anyone have any clues? Common passwords? I've tried the standards and they do not work. I did see a text string while searching and it read, "Release password must be exactly 10 characters".

Post by **alex** » Mon Feb 26, 2007 6:05 pm

Try the pager serial number?

123ABC1234 is 10 characters, and I believe they use the same setup as the radios, except you see 0-9 and A-Z sometimes in the last quad.

-Alex

RESCUE161 · Post by **RESCUE161** » Mon Feb 26, 2007 6:10 pm

Yep, tried all of that and nothing is working. Does anyone have an address to look under in a hex editor?

RESCUE161 · Post by **RESCUE161** » Tue Feb 27, 2007 6:31 pm

Got the guy I got the cradle from to figure it out for me. I would have NEVER guessed what it was. I gave him the serial number and bam, he sent the OTA and the Release passwords to me. I guess they are based off of the serial number somehow, but I don't see a connection other than all are 10 digits long.

Post by **Code3Response** » Wed Apr 18, 2007 12:18 pm

So you still have a T900 in service and operating? Whos the service provider? I had one several years ago and would love to have one again for email stuff!

otter9309 · Post by **otter9309** » Thu Apr 19, 2007 7:40 am

Ok, so I could not help but to play around with mine. (Smoke) will reset the pager, and (fire) will bring up a set of icons at the bottom of the screen. I am not sure what this does, but did not seem to enter any other functions or test.

P.S. Mine is in service with US Mobility aka: Metrocall

Steve

RESCUE161 · Post by **RESCUE161** » Thu Apr 19, 2007 1:15 pm

The T900 service was from Arch, but I think they are US Mobility now.

Moto T900 pager

Moto T900 pager

.

.

.

.

Talkabout Pager Release Password

Re: Talkabout Pager Release Password