Pay Phone: Alcatel TRMA VIA

[Bicurico]

Hello,

Apart from being a TEA with a special focus on TV/CATV/SAT field meter and spectrum analyzer, I got into antiques and restoring them. Within antiques, my interest goes to stuff from the 60ies, 70ies and 80ies, not the reallly old stuff.

My latest purchase (20 Euro) was a table top pay phone, which was usually found in the 80ies and 90ies in coffee shops, restaurants and bars. My model is the OEM for PT Comunicações, a company that belonged to the Portuguese Telecom (PT) - now exitinct and replaced by Altice, thanks to unbelievable missmangagement and corruption.



I got the device, like most of the stuff, at a local flee market.

After cleaning it, it looks pretty good - not like new, but nevertheless in a perfect display state.

However, my collection pieces have to be in full working order, so I tried to see if it works. First obstacle: it came with an RJ45 plug instead of an RJ11 one. Luckily I had recently bought a crimp tool at local ALDI in sales, which came with a collection of RJ11 and RJ45 plugs. At the second attempt I got the wires right and the phone switched on! Hurray...

But the joy did not last very long... A weird message saying (in Portuguese language) "only free calls" and a weird icon with an X on it. It took me two days to figure out that icon was the phone in a side view.

Also, I had no keys: I could not open the side lock, that gives access to the coin deposit and which allows to open the phone to see its inner workings. The key for a front door was missing, too.

Using my chinese lock picking kit, I attempted to open the front lock - a regular lock. I used the raking method and shortly after, I got it open. The front cover door reveals two sliding switches for pulse or tone dial and ring volume. It has a button for the configuration menu, but pressing it asks for a PIN code, which I did not have, either.

I tried the more common codes (0000, 1234, 8888, 9999, 1397, etc.) with no luck. The security of this was granted by a 5 second waiting between every failed and new attempt. Quick mental calculation: 5 seconds x 10.000 possible codes = 50.000 seconds = about 14 hours uninterrupted brute force... There had to be a better way!

This meant, I needed to open the phone. But the lateral lock is a disc detainer lock, which requires a pick that "Bosnian Bill and the Lockpicking Lawyer" developed... I don't have such a pick and even if I had one, you really need to train the technique. I got not time for this, so I took out my fairly new Lidl battery powered screw driver, but a metal drilling tool and literally bruteforced my way in. The lock can be easily replaced with a new one (I think) and after 5 minutes the phone was open.

The coin mechanism is pretty interesting, it uses optical sensors to determine the coin value (I think based on the acceleration?).

Anyway, the phone uses a NEC uPD78053 processor, a ST M27W101 EPROM and a ST 24C64 EEPROM.

Both EPROM/EEPROM's are socketed, so I extract their contents (shared below).

It took me some time to find the PIN - I had no idea where in the 4096 bytes they were located. So I came up with the idea to list all consecutive bytes that form a decimal number between "0000-9999". To make use of my ChatGPT subscription, I typed:

Code: [Select]

write a vb.net routine to read a binary file an list ina listbox all byte pairs that represent a 4-digit decimal number. example: "11 AC 23 45 65 AF" would list 2345, 4565

Surprisingly, it took one edit and a second request to get the code I needed - literally in 5 minutes. I could not have written this faster on my own.

So I run it and got a list with 304 candidates. While I was in a Teams meeting (one has to work, too), I worked down the list - after about 200 numbers (took me 30 minutes), I found the code ("7003").

Out of curiosity I looked at the dump with the hex editor (again, spent the whole night yesterday, looking for the pin). And guess what - the stupid pin is at address 00000011 and repeated at address 00000013! Literally in the second line of the hex editor.



Meanwhile I determined that this phone is an Alcatel TRMA VIA, known in Spain as a Teletupi. Teletupi were so kind to release a manual! Found it, downloaded it and found out, that I am stuck (again).

My phone has a different revision and some settings can not be done on the phone but... ...need to be set remotely!

For this the phone has a picky back modem PCB (I know it is a modem, because the phone complained about the missing modem, when I run it without it).

Because of this, I cannot set the time (which is possible on the Teletupi). Without time, the phone enters the free mode, which does not allow any call, because it has not been activated.

And, I cannot activate the phone for two reasons: the number found in the EEPROM is no longer active by PT, because they no longer exist!

Also, I am using VOIP through my router, which does not produce the required impulses for call duration and charge.

Last hope was to flash the FW of the Teletupi. And yes, I found one, because the MAME team has included the Teletupi and you can download the "ROM's". It is flagged as non-working, though.

I had my programming laptop and my G540 all setup, when I rememebered that the M27W101 is a EPROM - it can only be written once! And of course, I don't have virgin ones...

Was hoping that the Teletupi FW would give me the missing setup options, so that I could unlock the phone, at least into a free phone.

As is, it can only receive calls and is a really gorgeous 80ies/90ies vintage display item.

For 20 Euro I had my fun: from lock picking, EEPROM content extraction to access code extraction I had everything covered...

Questions:

- Anyone into pay phones? Do you have further insight?
- What would be a modern compatible equivalent to the M27W101 and where to get one cheap?

Kind regards,
Vitor