pitter patter on the keyboard

I wasn’t going to write about the Meridian I adopted way back again because I planned on cleaning it up and selling the system. It turns out I have had better things to do. One night recently I decided to reward myself for being productive by dicking around with it for a bit and managed to get it working on a VoIP line by way of an ATA. I was so impressed with the quality of the audio I decided to keep the system for personal use. There is a subtle irony to having a three metre analogue bridge between two perfectly digital systems and all this fire-retardant 1990s-beige/grey plastic is getting to my head.

The POTS interface is generally terminated with a 25-pair BIX (Building Industry Cross-connect) block. These require a punch-down tool. My only punch-down tool at the moment has automatic snippers on one end which is useless as the position of the terminal teeth alternates from top to bottom.

I jammed the pairs in with the attached blade tool which is strongly discouraged as you invariably weaken the teeth and risk cracking the (especially ancient) plastic.

I, however, am a rebel.

The KSU had been unplugged some time and defaulted. Interestingly, the dialing mode defaults to pulse which, intuitively enough, doesn’t work with my ATA. It turns out you have to go in and set each line to tone dialing individually.

m7324: I rode this phone into Germany during WWII and rescued some POWs.

It took me forever to find out how to do this so pay close attention, I’m only going to remember this once:

• Punch FEATURE **CONFIG
  • **CONFIG is **266344
• The password should be CONFIG,  if lost will have to be reset.
• Press the top-rightmost indicated meta key, the display will read:
  • 1. Trk/Line Data
• Press the top-rightmost indicated meta key again. The display will read:
  • Show line: _
• This prompt expects three digits. To configure line one, press 001. The display will read:
  • Trunk data
• Press the top-rightmost indicated meta key once then the bottom-rightmost twice. The display will read:
  • Dial Mode: Pulse
• The rightmost display key will read
  • CHANGE
• Press the CHANGE display key and it will toggle between Pulse and Tone.
• Press Rls to exit the menu

Above you can see the data and software cartridges for the M8x24; one fits into the other which fits into the cabinet. If your KSU loses all of its settings when the power goes out you need to replace the backup capacitors mounted on the data board. They are 1 farad and 5.5 volts each.

These appear to be a very common capacitor configuration for data backup and shouldn’t be hard to find at a reasonable price.

Something neat I learned in my travels is that when these 24V phones are subjected to the ring voltage on a POTS line (90V in NA?) they tend to blow. What they may lack in ruggedness they more than make up for in ease of installation however, as their all-digital signalling makes their ports polarity agnostic.

I just bought my first cellphone in years. I know that sounds strange coming from an IT guy but my logic is sound: if you don’t have one your boss can’t call it. One of my colleagues is a big VoIP genius and he pointed out that by using a dial-out gateway and Telus’ one-number-unlimited feature it’s possible to have the equivalent of unlimited calling for $7 per month on a prepaid phone – plus the one-time cost of provisioning a phone number that forwards incoming calls back through the gateway (about $25). I’ve been horny for the newer android-based phones that are in circulation in the states but most of the ones I want don’t operate on the Canadian bands yet and/or it will take a long time before they are rolled out up here, thus I decided for unlimited calling at $7 a month I may as well settle for a cheap phone in the mean time. I decided to tack on $10/month unlimited web browsing because it makes the e-mail and instant messaging packages moot.

The Keybo 2 is the closest thing to a smart phone in Telus’ prepaid lineup, and at the time of writing the most expensive – clocking in at a modest $99. It sports a 160x96px external screen and flips open to reveal a large QWERTY keyboard and 320x240px internal screen. There are stereo speakers mounted on either side of the internal screen and to be perfectly frank they are better sounding than my laptop’s. The Keybo 2 has a 3.2MP flash camera that takes decent pictures but crappy closeups.

In the United States (and possibly elsewhere) the Keybo 2 is marketed as the enV3. The Canadian model number is CX9200 and the US model is VX9200; as far as I can tell the difference is cosmetic. Verizon seems to be the main carrier for enVs in the states and Koodo is popular in Canada as well. Interestingly the Koodo and Verizon firmwares of the phone do not include Java support. It would seem that the popular thing to do with your Keybo is flash it to Telus’ firmware if you’re on a different provider. Unfortunately Telus’ firmware is so locked down that one wonders just how bad Verizon’s could be.

I’ve had a hell of a time over the past few days trying to find information on hacking the Keybo 2, most of the results I have found thus far only apply to the original Keybo (aka enV2 or VX9100), for example it no longer seems possible to simply overwrite application slots with other java apps to install them on the phone. Telus’ proxy prevents users from downloading apps from the web that don’t come from their store. I have tried altering the proxy settings to use a personal proxy on ports 8118, 80 and 110 but the browser fails to connect. I even tried popping the opera mini .jad and .jar files onto an SSL site and altering the .jad to pull from the new URL to no avail – the download begins, posts, then returns this error:

Issue has been reported.
Please try again later.

950 Server Error (-1289)

then the browser bounces back to the Telus apps store. I tried renaming the .jar to .jax (and updating the .jad accordingly) also to no avail.  I am beginning to suspect that the firmware has been modified to enforce some sort of DRM for applications. Custom ringtones are a pain in the ass as they definitely require DRM, fortunately they can be dropped into the phone’s filesystem at /brew/shared/ringtone/ with BitPim (1.0.7+ supports the CX9200) and given DRM with the Sony-Ericsson DRM Packager.

I couldn’t find the right SPC code for my particular phone anywhere (unlike the old Keybo/enV2 it does not have nvm_XXXX files) so I had to grab it with CDMA Workshop (it’s 105495 by the way). With the correct SPC you can access the programming menus for your phone by dialing:

##DEBUG
##TELUS
##BROWSER
##TEST
##DATA

Note that you can get into ##DEBUG on any LG phone with the unlock code 183729.

Overall, this phone pisses me off because it could do so much more but Telus makes it extremely difficult to modify. While there is some community support for the Keybo/enV2 those of us with the new Keybo 2s and enV3s are practically on our own at present time. The fact that the Telus firmware is considered “the good firmware” is extremely discouraging, flashing your old Verizon enV2 to Telus’ old Keybo firmware may let you load on some java apps but how to do this successfully on the newer Keybo 2′s firmware is as yet a mystery.