STATION ID - 7047/3.12                                             3/4/98

9x Datakit Network
FOR OFFICIAL USE ONLY

This is a 9x system, restricted to authorized persons and for
official 9x business only. Anyone using this system, network or data
is subject to being monitored at any time for system administration and
for identifying unauthorized users or system misuse. Anyone using this
system expressly consents to such monitoring and is advised that any
evidence of criminal activity revealed through such monitoring may be
provided to law enforcement for prosecution.


        Why the qualcom PCS Phone, and other PCS phones, Can Not Be Cloned.

       With the new digital phones that are coming out onto the market, more
       and more questions come up about them and there protocol.Further more
       questions arise, that if these new phones can be cloned.   A qualcomm
       phone can not be cloned, and futher, that "sprints PCS"  phone  could
       never be lit up on another CDMA net without sprint's coop (giving the
       other  carrier the unique  "PN"  code of that phone.  But, also, that
       sprint will coop with CDMA carriers in the few areas they dont  serve
       ( example where primeco has a net and sprint has no license or resell
       agreement.   The only way to clone a PCS phone is from the network if
       one should get into the MSCmaster PN assignment files.  Which is very
       hard. Also, all CDMA phones have a unique "PN" code,  that has a very
       high security factor,  the pilot of a CDMABSC can be nabbed over air,
       but, until sufficient processing power can be applied to the breaking
       of the "PN" code, cloning of CDMA phones will be impossible.     That
       processing power will evolve, but for now,  it does not exist (unless
       one is a qualcomm engineer.     As for modifying the phone itself the
       phone has a unchangeable  "PN"  code,  if that does not match the MSC
       logs, the phone does not work, it is resident in the micros and  dsps
       in the phone, to whip the roms and rewrite, well, u cannot. They  are
       roms.  If you would just flash these roms that would not work  either
       because it's in true rom resident in the mocro, and the dsp, both are
       required for the 'rake" reciever  processing  gain  function  and the
       supervisory micro Function. The PN codes are not in flash.Qualcom and
       other phones chose to put it in rom for more secure(and they can keep
       it completely "proprietary" and charge royalties).    I would like to
       mention that the "PN" random code is not a "PIN' it is in addition to
       the pin. It is the whole basis of that phone's air-interface;     the
       correct "PN"code is required to even make a connection to the BSC/MSC
       before any "authentication" is performed on the  "NAM" or the  "ESN".
       The CDMA, is after all "CODE division multiple access" a "PN" (psysdo
       random) code is required for the phone and the BSC to agree on a"code
       channel". Remember, all possible channels in a CDMA system are reused
       at every BSC, and all phones hear all channels from all in range BSCs
       at once, there is no time or freq segmentation in CDMA,the only thing
       the system and the phones recognize for "channelization" is the  "PN"
       code.

       If  any  of you find any info on PCS cloning please contact me on IRC
       as daem0n. As for this ariticle, if it sounds like a tech manual then
       good I meant it to be.I didn't write this article for someone who has
       no clue on cellular phones. I hope this info will be useful to all of
       9x and anyone who reads this.

       Peace

       daem0n