Here is an Ericsson GH388 from the year 1996. This is a companion video to the GH337 from 1994.
Link in the description below. I'll be comparing the internals and the service mode of this phone
and at times referring back to that other video.
The GH388 was very popular when it came out. It was very similar to the GH337. Though
and they both continue to sell very well alongside each other. I want to have a look at some of the
technological differences. So first I'm going to take this one apart. Let's take the battery off
and if we have a look at the back label we can see this one was manufactured 1997 week 15. OK
so first we'll get the slotted screwdriver, see if we can get some of these things out, yep.
Not so bad.
I want to take out the bottom two. So that's a torx. The front should come off, yep,
and here we have the first look at the insides. Initially looks very similar to the 337.
So we do have some more slotted screws to remove these two here.
But underneath comes out as well and there's one at the top right here.
And this one is a slightly different shape. So it's a little bit harder to get out.
My screwdriver almost doesn't quite fit. Take out the board. One of the
first things we notice is that it's a lot thinner compared to the GH337.
So in this case they've managed to squeeze all the components
onto just one side of the main board. Leaving the other side still as the user interface.
Pretty much the same except the display is not attached. The display simply has a connector
to connect up to the front. But let's look at this back side of the board. They've somehow
managed to consolidate both sides of the GH337 mainboard into just one side on the GH388.
So there's the top with the radio section and the main transmitter. We have this section here
which has a lot of the oscillations. There's the Phillips chip which I remember from the GH337.
Now we have these ceramic capacitors. Which I don't remember seeing those on the GH337.
I'll have to look back. There's some sort of crystal here. Let's see 32C73. Here's this
chip which looks like it has some bus lines going to it. I'll just turn this around for a moment.
There's that main Ericsson chip. Much smaller in this model.
Turning it back around we'll just quickly have a look here. We've got
what looks like it's going to be the flash memory and I guess that would make that the RAM
and there's that Texas Instruments chip as well from the GH337.
So that could well be user interface again.
Maybe something to do with the bottom port and of course the large 90's style sim card holder.
That's really impressive work. In only two years they managed to really shrink everything down
into this much smaller package. Which means the phone is actually a little bit thinner as well
than the GH337. Really quite a nice effort. So again the back of the phone, which is metal, is
again shielding the components, and I wonder how they shielded the front. I guess they put a thick
ground plane in there separating the front of the board from the back.
I'm going to get this together and we'll have a poke around in the software. Now,
so first we'll get all the screws back in.
OK internal screws are in. Just a simple matter of front back on
and reassembly will be complete. OK we're all back together and I've just realized that the
sim card holder is not complete. so i'll just clip that bit in there.
There we go OK. Let's power up and have a look. Have a look at that, the phone is locked,
all right four zeroes.
All right one two three four. So I don't have the lock code to get into this phone and see the menu.
Instead we'll just switch to service mode and find a way to get rid of that lock as well.
I'll be again using the Android tablet to talk to the phone. I'll just get that set up now,
get the cable ready. So I've got the Micro USB adapter and the serial TTL converter and the
bottom connector for the phone and I have to connect up the wires. So red goes to 5 volts.
Oops red goes to 5 volts, blue is ground.
Green is transmit from the phone. So receive on the adapter here, and yellow is received from the
phone. So transmit from here. OK that should work. Plug it into the bottom of the phone.
All right let's get this plugged in and see what happens.
There's our serial terminal. So when I power up the phone I should see the number two come up on
the screen, and then I first send '0B' and then the phone will send 'R' and then I have to send
this sequence here. So it's this long sequence of hex and this is actually Z80 machine code
instructing the phone how to set up and boot into service mode. Now I found a disassembly of this
online because this is standard Z80 code that we're seeing here. And it shows each instruction
and most likely what each instruction is doing to access service mode in the phone.
So let's give this a go. I haven't actually tried this yet so I'm not sure what's going to happen.
I think the first thing I'll do is check the settings and I will do the debug mode which is
1115 200. And that should give us debug on the screen when I power up. Even though it's locked
and we're getting nothing now. First I have to connect
to the device. OK good. Now we'll power up and see, yep, there we go. We've got a phone connected
even though the phone is locked. It's still going to give us debug mode on the screen here.
OK let's switch to settings we go to 9600, looks good.
OK let's let's do the sequence. I'm going to power up and we'll see how it goes
'2', '0B'. No I missed it. It hasn't worked. I'm not certain I'd missed it. It just hasn't worked.
That's just debug mode in the wrong Baud. Right OK let's try again.
'2'
Exact same sequence. So something's happening.
OK I've been messing about with this for a bit and I found a solution to getting into service mode.
For the initial sequence we have to have absolutely no other characters except for,
the sequence that it needs. So power up 'R' comes up and then we can send the full sequence,
and sure enough service program OK.
So this will initially not allow any commands because we're not sending any
carriage returns or line feeds. So we do have to then switch back to say carriage return.
And now we should be able to enter commands.
OK though the IMEI command doesn't appear to exist in this model. So this version of the service
program appears to have some different commands. Let's try 'prog 1' so that doesn't exist.
Analogue Read, it exists but I didn't enter the correct format, and this does give us a version
of 96.0528. But I don't know if that's the service program or the main flash.
'LSPC' for checking the locks. So service provider lock. So I can now use service mode to remove the
user code lock, and have a look online and there's a document that shows that
the user code is stored in electronic EPROM, right address 03 cf and it's 12 bytes long.
There we go. First bit written, first bite Written. OK electronic
write. So I have to go through and set 12 of these bytes to zero. 03 D0, oops zero. OK that's
the 12th bit written. So we should now have an unlocked phone. Let's power it up and have a look.
Looks pretty good so far.
There we go. We're in and we're in the phone. OK
I must say that screen looks a lot clearer than the GH337.
To finish up I want to compare the screen of this Ericsson 388
to yet another Ericsson. This time the Ericsson 398, which is yet another variation.
The Ericsson 398 uses a full dot matrix display. Rather than a character matrix display.
The 388 just has a text welcome and the 398 has a full graphic of the Ericsson logo.
And the reason for this is the languages. So if we go to settings, Asian characters hence the need
for a full graphic display. OK that's it that's the Ericsson GH388 and a little bit of the GH398.