Hacking the LS350 Pager?

Crazy Corrigan asks: "I just got a new pager, bought and paid for by my office. I'm looking and the thing and lo and behold, it has an IR port on the bottom. I got all excited and figured there must be someone out there who has a program for the Palm Pilot to interact with this thing. However, upon further research, Motorola says it's only for factory programming. Anyone want a challenge? This would probably be a great project for any Palm programmer! These things are really cheap and could be a great way to extend the usability of your Palm! Check out the LS350 User Guides on Motorola's site"

Comments

An infrared port for factory programming???

[Tiersten]

Isn't it a bit over the top to have an infrared port just to do factory programming? I would have thought it would be cheaper to just have some pins inside to do that sort of thing.

Could just be Motorola not wanting to have to support it?

*shrug*

LS550 has it as well

[chargen]

The Motorola LS550 pager has the IR port as well. It does seen very odd that they would use IR for programming when pin contacts would suffice at a fraction of this cost. Maybe they didn't want loose coins in your pocket accidentally re-programming your pager ;) -Pete

Government Conspiracy

[Greg Koenig]

The IR port is obviously there to allow the government to download a copy of your paging history as they fly past in their black helicopters.

A REAL hacker would modify their pager to encrypt all data sent/received over the IR port to prevent such a thing from happening!

Hmmm

[Chanc_Gorkon]

Could this be for reprogramming the id of the pager? It used to be done with crystals, but could they have used some other way so that when service changes (from one pager service, to another, say after you paid for the pager...), they can just program it via the IR port instead of taking it apart??

Re:Hmmm

[kju]

I wonder how this clueless post deserves the Score of 4 some moderators upped it to.

Never, never ever had the id of a page been programmed with crystals. A crystal is the part of the pager which sets the reception frequency, nothing else. Very often you need to change the crystal when changing pager service, because different services use different radio frequencies. In fact there is a huge market for services like changing the crystals.

The id of the pager is stored inside an eeprom in modern pagers (in very old pagers it was just inside an prom and thus not changeable). Probably the ir port can be used for reprogramming this id in the eeprom, but pager used to have some programming contacts, motorola usually hides them behind the battery slide. The service owns a device in which you can put the pager and which interfaces these contacts. This way you can reprogram the id, given that you have a.) the right software and know b.) the password (the firmware of the pager blocks reprogramming otherwise). If you are a virtue with your soldering iron you may unsolder the eeprom and change the id using a programmer but nowadays the eeprom might be integrated into the main controller and thus not be able to programmed seperately.

There is no reason why an ir port should be used for this programming. At least this cannot be the sole reason for the ir port. I guess that its just the same pager as another for a higher price which makes usage out of the ir port. its always the same, different models are of the same hardware (because its cheaper) but features are disabled in software/firmware.

Re:Hmmm

[__aahyzr9271]

A crystal is the part of the pager which sets the reception frequency, nothing else. Very often you need to change the crystal when changing pager service, because different services use different radio frequencies. In fact there is a huge market for services like changing the crystals.

That's true with older pagers, but the newer ones use a PLL (phase locked loop), the crystal only provides a refrence frequancy. It's cheaper to use a PLL since you don't have to replace a part to change the frequancy (just reprogram the pager), and you don't have to use a custom crystal in your design (you can get away with using a common refernce crystal, and use the PLL to tune the pager).

Very few pieces of modern radio equitpment are still tuned with crystals. If fact, when recrystaling services recrystal the newer pagers, they're actuily tuning the pager's PLL to the new frequancy.

Re:Hmmm

[Chanc_Gorkon]

Ok, I may not have KNOWN exactly this whole tech behind a pager ( I know about radio, but not as it pertains to pagers....I give to craps about pagers because i fond them very useless....why carry a pager when a cellphone (with and integrated pager possibly) will do). Just because I showed a little lack of knowlegde in that doesn't mean you have to bust on me about id's and pager crap. It also doesn't mean I (the poster) am clueless, it just means I have some familiarity with pagers and just because I am not a pager geek (and know every detail about every model of pager) doesn't mean what I said could not have been insiteful.

Maybe they rated it insiteful because it may have a grain of truth. One could very easily set something up to change the frequency of the pager by merely sending a ir sequence to it. It seems alot easier to me to do that instead of cracking open the case of the pager.

For the matter of having the same case in multple units, that show some merit, but I doubt they'd do that with an IR port. Why would a pager need an IR port except to do something as the above? Maybe if it had a way to send info to other pagers (say transfer pages to a computer too.). Who knows! It just may be what I said was true. Maybe not. Point is you won't be able to tell unless you work in said pager company. I doubt that Motorola will release specs to something such as this.

hmm..interesting

[rebelcool]

my pager has the same thing on the side of it. I wouldnt be surprised if its there to

a. diagnostic purposes..you can probably do an entire dump of the memory on the thing through that.

b. programming the id/frequency.

c. durability. an ir port is more durable (and aesthetically pleasing) than a pin-port

try asking someone in a pager shop, and see if you can procure whatever diagnostic tool motorola has for this. Undoubtedly you could call motorola and claim to be a pager shop needing an IR pager programmer...

Maybe one of these patents has some information

[HughsOnFirst]

From the manual
Patent Information

This pager is manufactured under one or more Motorola U.S. Patents. A
partial listing of these patents is provided on the inside surface of the
battery door. Other patents covering this product are pending.
Note: Patent numbers listed below with an asterisk (*) apply only to the
pager models which utilize the POCSAG protocol
4336524* 4385295* 4412217* 4518961* 4701759* 4755816* 4829466*
4839628* 4851829* 4893271* 4910510* 5073767* 5157391* 5381138*
5247519* 4860003 5051993 5117500 5128665 5168493 5311516
5325088 5371737 5414419 5450071

Re:IR port is for programming, but not much more

[nicck1101]

You should try taking it apart and seeing how it works, then search the Net for some info and programs to crack your pager.

IR port is for programming, but not much more

[BlueJay465]

I used to work at a shop that repaired and reprogrammed pagers. The software put out by Motorola enables you to change the capcode (ESN) and the carrier frequency in the 929.0 to 932.0 Mhz range. Most carriers when they send out these pagers to shops have a password on the pager itself to get to the programming. You have 8 attempts to enter the correct password before the pager will disable itself, and therefore must send back to Motorola or a licensed repair shop to have them reset the pager. (it involved some soldering on the older Lifestyle/Bravo/Advisor models as well as some specialized equipment to read the code pages off the IC) Unfortunately I didn't get the chance to play too much with the new LS350/LS550/LS850 models before I left that place...

tnn.comm.pager

[mellonhead]

Go to this newsgroup, post any questions you have and you'll learn more than you ever wanted to know about pagers...