Motorola Bag Phone Handset Control

Overview

An experimental control circuit to simulate the handset key presses on an old Motorola "bag"-style cellular phone.  Refer to GBPPR 'Zine, Issue #4 for an application on using two old cellular phones to jam tape recorders.

A standard Microchip PIC16F84 is used to control two 4066 quad bilateral switches, which in turn, simulate pressing the keys on the keypad.  Wires are run from the 4066s to each row and column on the handset's keypad.  When a connection is made from the row to the column, the phone registers a key press.  The source code for the PIC16F84 is written in PICBasic, so it's very easy to understand.  The code, as written, takes about ten seconds to execute.

For this design, you'll only need to control the keys: 1, 2, 3, 7, 8, 0, and #

The key sequence will be like this:

  1.   [#]  - Enter the test mode's servicing level.
  2.   [1] [1] [0] [0] [0] [1] [#]  - Enter channel '0001' for a transmit frequency of 825.03 MHz.
  3.   [2] [8] [#]  - Enable the high tone of 1,150 Hz.
  4.   [3] [0] [#]  - Enable the low tone of 770 Hz.
  5.   [1] [2] [0] [#]  - Set the maximum transmit RF power of 3 Watts.
  6.   [2] [7] [#]  - Continuously transmit control channel data.

This makes a nice "warbly" jamming noise signal, useful for jamming tape recorders.

Keypad Connections

            Column

            C1   C2   C3
         +---------------+
Row   R1 |  1    2    3  |
         |               |
      R2 |  4    5    6  | (R2 is not used in this design)
         |               |
      R3 |  7    8    9  |
         |               |
      R4 |  *    0    #  |
         +---------------+















Pictures

Handset overview.  An example keypad circuit board is shown on the left.

Taking the handset apart.  There are usually three screws, two T6 Torx and a T8 Torx.

Close up picture of the microphone (right), speaker, and handset cable connector.

The pinout and wire color for the RJ-45 connector is as follows:

  1. BLUE  - Handset Logic Ground
  2. RED  - +9.5 VDC
  3. PURPLE  - T-DATA, 3-Wire Databus "True"
  4. ORANGE  - C-DATA, 3-Wire Databus "Complimentary"
  5. YELLOW  - R-DATA, 3-Wire Databus "Return"
  6. BROWN  - Handset Audio Ground
  7. GREEN  - No Connection
  8. WHITE  - Receive Audio to Handset

Internal view.  Clear out all the nonsense.

Close up of the keypad and its connections.  We'll only be interested in the twelve top pads.  Note the three columns (going up and down) and the four rows (going across).  We'll number the columns C1, C2, and C3 and the rows R1, R2, R3, and R4.

To remove the solder mask on the circuit board (to make testing with a continuity meter easier), use a Dremel tool with a wire brush attachment.

Close up picture of the keypads with the solder mask removed.

Control circuit board.  PIC16F84 is on the top left, the two 4066s are on the bottom.

You may want to remove the little conductive pads behind the rubber keys.  This will help prevent any accidental key pressing during operation.

Installation of the three row wires and the three column wires.  You'll have to pin them out to double check them.  Yes, it's a pain.  Have fun!

Installation is complete.  This was an experimental version, so it's a little messy.

Power the circuit from the +9.5 VDC line on the handset connection.  































Schematic

PICBasic Source Code

' Motorola Bag Phone Handset Control 
' Phone must be hardwired into test mode (ground pin 21 on the DB-25)
' PICBasic and PIC16F84-04I/P  (4 MHz clock)
'
' See GBPPR 'Zine, Issue  #4 - Use Old Cellular Phones to Jam Tape Recorders


       ' Bring all pins low                         
Low 0  ' 1 
Low 1  ' 2
Low 2  ' 3
Low 3  ' 7
Low 4  ' 8
Low 5  ' 0
Low 6  ' #

Pause 4000    ' Wait 4 seconds for things to settle

Gosub Pound   ' [#]  Enter Servicing Level
Pause 200

Gosub One     ' [110001#]  Set TX Frequency (825.03 MHz)
Gosub One
Gosub Zero
Gosub Zero
Gosub Zero
Gosub One
Gosub Pound

Gosub Two     ' [28#]  High Tone Enable (1150 Hz)
Gosub Eight
Gosub Pound

Gosub Three   ' [30#]  Low Tone Enable (770 Hz)
Gosub Zero
Gosub Pound

Gosub One     ' [120#]  Maximum TX Power (3 Watts)
Gosub Two
Gosub Zero
Gosub Pound

Gosub Two     ' [27#]  TX Continuous Control Channel Data
Gosub Seven
Gosub Pound

End

Pound:
       High 6
       Pause 200
       Low 6
       Pause 200
       Return

One:
       High 0
       Pause 200
       Low 0
       Pause 200
       Return

Two:
       High 1
       Pause 200
       Low 1
       Pause 200
       Return

Three:
       High 2
       Pause 200
       Low 2
       Pause 200
       Return

Seven:
       High 3
       Pause 200
       Low 3
       Pause 200
       Return

Eight:
       High 4
       Pause 200
       Low 4
       Pause 200
       Return

Zero: 
       High 5
       Pause 200
       Low 5
       Pause 200
       Return

PIC16F84 Hex Code

:1000000028288F018E00FF308E07031C8F07031CEA
:10001000232803308D00DF300F2003288D01E83EB8
:100020008C008D09FC30031C18288C070318152838
:100030008C0764008D0F15280C181E288C1C222894
:1000400000002228080083130313831264000800B1
:1000500006108316061083128610831686108312EC
:1000600006118316061183128611831686118312D8
:1000700006128316061283128612831686128312C4
:1000800006138316061383120F308F00A030022050
:100090006120C83001206E206E20AF20AF20AF203D
:1000A0006E2061207B20A22061208820AF2061206B
:1000B0006E207B20AF2061207B2095206120630093
:1000C0005F28061783160613C83083120120061313
:1000D00083160613C8308312012008000614831605
:1000E0000610C83083120120061083160610C8308F
:1000F000831201200800861483168610C8308312EC
:100100000120861083168610C83083120120080053
:10011000061583160611C8308312012006118316B6
:100120000611C83083120120080086158316861137
:10013000C83083120120861183168611C8308312BD
:1001400001200800061683160612C830831201200B
:10015000061283160612C830831201200800861684
:1001600083168612C83083120120861283168612E7
:08017000C830831201200800D1
:02400E00F53F7C
:00000001FF