t28s pinout description

[eric s0n]

I need a correct pinout description of the T28... it's the same as for a R320 and R380...

Oh yes, and for all that do not know: the T28 different pinouts than the T18 and T10!!!

Thanks for your help!

[-Neb]

I experimented with T28 and this is what I found out:

keyboard
1---------------11 (counting pins on phone)

4 Rx
5 Tx
8,10 Gnd

but... I don't know which pins connect together to achive entering in test mode..
Any ideas ?

Regards,
-Neb

[ALieN_CHeMiST]

try that legendary chinese site?? http://xf-bbs.hb.cninfo.net/~chinagsm/

Jim

[eric s0n]

Hmm...
I tried that Chinese site, it has a file named T28repair-flow.zip for download of which I think might contain interesting information... unfortunately I can neither read nor understand the Chinese language...

Oh, yes, I also played a little with the T28's pinouts:

pin 11 ( counted from left to right ) is +??V DC for loading the battery

if you shortcut pin 7 and 8 ( left to right ), the phone enters the profile "Portable Hands Free"....

but I still don't know how to enter test mode...

any furthr help appreciated!

[cIVIc]

_______________________________________
| 1 2 | 3 4 5 6 7 8 9 10 11 | 12 |
---------------------------------------

1 - AFMS, Out, Audio from mobile station (external speaker, very small signal 10 mV).
2 - ATMS, In, Audio to mobile station (external microphone).
3 - EXTAUD, In, External Analog Audio Accessory Sense (enable external mic and speaker,
connect to GND to do so).
4 - GND, Audio Signal Ground, 0V reference
5 - PORTHF, In, Portable Handsfree (Enable external mic and speaker, connect to GND to do so).
6 - MUTE, Out, Music Mute (Digital output. High when calling. Could be off-hook signal).
7 - VPPFLASH, In, Flash Memory Voltage and Service Voltage (Digital Input.
Phone enters debug mode when tied to +5V at power-up).
8 - VDD, Out, Logic Reference, Status ON (+5V out ? Sources over 100mA).
9 - TFMS/DFMS, Out, Terminal Adaptor Equipment From Mobile Station/Data From Mobile Station
(Serial output. Debug messages appear here at 112KBaud when in debug mode).
10 - GND, Digital Ground and DC Return
11 - TTMS/DTMS, In, Terminal Adaptor Equipment To Mobile Station/Data To Mobile Station (Serial input).
12 - DCIO, In/Out, DC positive pole for phone battery charging and external accessory powering (Charger plus).

[eric s0n]

hmm...
I have seen similar pinout descriptions like the one civic posted here for the T28 but they do not seem to be correct...
first, you describe 12 pins here, but there are only 11 pins on the phone...
second, pin 10 and 11 are 100% sure used for charging the phone because the charger plug goes in there...
third, pin 9 is not used on the R320/R380 data cable which is sold by ericsson for use with those phones which are pin-compatible with the T28. For this reason, it can't be important for serial communication...
fourth, shortcutting the pins civic describes does not put the phone into test mode!

For these reasons I assume that the above pinout description is for the T10/T18 or whatever but definitely not for the T28...


Also, the fact that pin 9 is the only one of the pins I do not know of what they do that is not used in the ericsson r320/380 serial cable I assume that it *might* be somehow important for putting the phone into test mode...

anyways, even if I thing that civic's pinout is not the one of the T28 I appreciate his help!

Plz everyone keep on the work, I am sure we will soon know how to put the phone in test mode and then we can use the r320/380 serial cable ( sells for about 40$ I guess ) to flash/unlock the phone!

laterz...

[-Neb]

Since pins 8 and 10 are connected together in the phone and they are Gnd, I carefully opened connector moved pin number 8 to possition of not existant pin 9. This pin is connected in the phone... somewhere. When I mesure electric resistance between pin 9 and ground, the measure is about 66 Kohms. It could be digital input (?). I also tryed to connect pin 9 to other pins, but no test mode... For instance i connected it to pin no.3 (which measures about 1.6 V to the ground) and later to pin 11 (3,7 V (Vcc) to the Gnd). But nothing happend...

Continue to investigate

[-Neb]

By the way... the pinout for Rx, Tx and Gnd I posted before is 100% correct. Try to load telix, telemate or any other terminal prog, and connect pin 4 as Rx, pin 5 as Tx, and pin 10 or 8 as a Gnd.. Set 9600 8N1 in term prog, and try to comunicate with phone. It says OK for AT command.

[eric s0n]

I tried to communicate with my T28, using the serial cable for Ericsson R320/380 which is pin-compatible with the T28, and the minicom terminal emulation program for linux...

I have sent AT^J^M which is AT trailed by linefeed, carriage return to the phone as initialization string but it did not reply with "OK"...

I have put the settings to 9600 baud 8N1... however, I don't know if I should use Hardware or software handshaking ( XON/XOFF )... also, I do not know if I need to enable some specific setting in the phone's menu to access it with my terminal program etc.. I don't know what to do and it doesn't work...

also, I am interested in why the T28 should respond to Hayes/AT commands, it does not have a built-in modem....

anyways, I am no cellular expert so I'd appreciate if you would go into detail of how you communicated with the T28 and share some of your obviously very sophisticated knowledge with me/us...

Thanks in advance, eric s0n

[-Neb]

Hi !

No.. I'm not cell expert either. The post above was just demonstration how to check if rx tx and ground pins are ok. If you type AT (AT folowed with return) and during that you see apearing of letters A & T on screen and after pressing return you see OK in the next line (response from T28) that means that you comunicate with cellphone. This is first step in connecting phone to Er2000. I don't know anything about set of AT commands and hayes compatibility for T28 (sorry). For this demonstration you don't have to enter any special menu in phone, it just have to be turned on and connected. I don't know anything about ericsson serial cable, I used scheme from misiek for T28 and instead of using pins mentioned there, I used 4 as Rx, 5 as Tx and 10 as Gnd.... This conversation should lead us to discovering how to enter test mode (second step) and conect it to Er2K. I hope that some other people who know that will enter this conversation and help us achieve our goal.

best regards,
Neb

[eric s0n]

ok, neb, I also managed to talk to my T28, this time I used HyperTerminal under WinNT, baud base 9600, 1 stopbit, no parity, XON/XOFF software handshaking...

Ok, the usual "AT" command to initialize a Hayes compatible modem returns an OK from the T28... I also found out some more things...

ATDxxxx; dials number xxx, don't forget the
trailing ;

ATH hangs up the phone

AT+CFUN=0 switches off the phone

AT+CBC shows current battery status, 1 means that the battery is perfectly full whereas 0.00 means it's empty...
ATA picks up an incoming call...

If a call is incoming, the T28 will send the string "RING", trailed by a sequence of linefeef, carriage return to over the serial cable, "ATA" will then pick up the phone...

Oh yes, one more thing: it didn't manage to talk to the T28 from minicom in linux at first because of the fact that UNIX uses just the linefeed character ( ASCII 0x0a ) for the newline sign whereas Windows uses a sequence of linefeed ( 0x0a ) and carriage return ( ASCII 0x0d ) for newline... the T28 also requires this sequence...

Ok, I'll play a little more with the AT commands and with shortcutting some pins... btw in one gsm "hacking" file I read that the phone should send ">>" when it's powered up and enters testmode and you have to reply with "TP1" within one second... that's how entering testmode on a GH337 works but I think once we shortcut the correct pins, actually entering testmode is cake!

I am sure that we will soon discover how to enter testmode, neb! Unfortunately, the day after tomorrow I have to spend 10 days in France with my class and I probably won't be allowed to use a computer during this period of time ( I won't go into detail why I will not be allowed here.... ) Still, I'll spend the whole tomorrow playing with the T28!

Laterz...

[dito]

Keep on trying! Keep on posting!
This is very funny!

[eric s0n]

ok, I played a little more with AT commands on the T28... I compiled a list of all working Hayes/AT commands on the T28 and how to use them just in case you don't know...

CALLCONTROL:

AT Initialize T28 ( not really needed ), returns OK
ATA Accept incoming call ( phone sends "RING" when called )
ATDxxxx; Dial number xxxx, don't forget the trailing semicolon
ATH Hang up phone
ATL=x set volume to x (?), ATL? displayes possible values, ATL=? shows current
AT+CRC=x Cellular result codes (?), AT+CRC=? shows possible, AT+CRC? shows current

DATACONTROL:

ATZ Reset phone ( does this anything except showing OK?? )
AT&F restore factory settings (?)

CELLPHONE CONTROL:

AT+CBC Show Battery Charge, AT+CBC=? shows possible values
AT+CGMI Request Manufacturer ID, should return "ERICSSON"
AT+CGMM Request Model ID, returns "1101101-BVT28s" on my phone
AT+CGMR Request Revision ID, returns date, timestamp and version of software
AT+CGSN Request Product Serial Number ID i.e. display IMEI
AT+CMEE? Report Cellphone Error, AT+CMEE=? shows all possible values
AT+CPAS shows phone activity code, AT+CPAS=? shows possible values
AT+CPBF Find phone book entry (?), AT+CPBF=? shows possible values (?)
AT+CPBR=x Read phone book entry at position x, AT+CPBR=? shows possible values
AT+CPBS=x Select phone book memory storage, AT+CPBS=? shows possible values
AT+CPBW=x Write pbook entry, AT+CBPW shows possible values, how does this work???
AT+CSCS=x select character set that phone should use, AT+CSCS=? shows all sets
AT+CSQ show current signal quality, AT+CSQ=? shows possible values

DATA CARD INTERFACE COMMANDS
ATE=1 or 0 enable or disable command echoing, ATE? shows current setting
ATQ=1 or 0 enable/disable result code supression, ATQ? shows current setting
ATV=1 or 0 define response format, ATV? shows current ( changing this doesn't work? )

REPORTING OPTION COMMANDS

AT+CLIP=x enable/disable CLIP, AT+CLIP=? shows possible, AT+CLIP? shows current

SMS COMMANDS

AT+CSMS enable/disable SMS, AT+CSMS=? shows possible, AT+CSMS? shows current value
AT+CPMS select storage for SMS, AT+CPMS=? shows possible, AT+CPMS? shows current
AT+CMGF select msg format, AT+CMGF=? shows possible, AT+CMGF shows current
AT+CSCA? display SMS service center's phone #, AT+CSCA=? shows possible store areas
AT+CSCB=x select Cell Broadcast msg types, AT+CSCB=? shows possible, AT+CSCB? curr.
AT+CSAS=x store settings, AT+CSAS=? shows possible values
AT+CRES=x restore settings previously saved, AT+CRES=? shows possible values
AT+CNMI=x new msg indications to TE, AT+CNMI=? shows possible, AT+CNMI? current
AT+CMGL=x list msgs, AT+CMGL=? shows possible values
AT+CMGR=x Read sms at place x, AT+CMGR shows possible values
AT+CMGS=x send previously edited message x, AT+CMGS=? shows possible values
AT+CMSS=x send previously saved message x, AT+CMSS=? shows possible values
AT+CMGW=x write message x to memory, AT+CMGW shows possible values
AT+CMGD=x delete message x, AT+CMGD=? shows possible values


Also, since we are still looking for an exact pinout of the T28, I put all information we got so far together in one pseudo pinout description, now, we need YOUR help to complete the description... here is what we have so far:

T28 pinout so far...

Keyboard
-------------------------------
| || 12345678 | | 9 | | 10 | 11 | |
-------------------------------

Pin 1: ????
Pin 2: ????
Pin 3: ???? +1, 6V output
Pin 4: Rx, Serial Input, TTMS/DTMSTerminal Adaptor Equipment
To Mobile Station/Data To Mobile Station
Pin 5: Tx, Serial Output, TFMS/DFMSTerminal Adaptor Equipment
From Mobile Station/Data From Mobile Station
Pin 6: ????
Pin 7: Probably Portable Handsfree (??), connect to GND to have
T28 enter profile "Port. Handsfree", enable external mic
and speaker
Pin 8: GND
Pin 9: ????, probably Digital Input
Pin 10: GND
Pin 11: +3,7 V output, DC IN for charging battery...


OK! Neb, I am very interested in your progress as well... as I have already said I will be out for 10 days, starting tomorrow so I won't make more than probably one post to this thread again... plz mail me at [email protected] with your progress, I'll reply as soon as I can!

Laterz.. and have a lot of fun!

[dito]

Yeah... See yaa... Have fun!

[hadak1]

What's so funny about it, Dito !