Cellular Phone Based Surveillance Bug

One of the easiest homebrew surveillance bugs you can use is an old, AMPS Motorola handheld cellular phone. They will need to be the slightly newer phones with software version numbers starting with 95xx. Examples: Motorola TeleTAC 200/250 and Pipers.

Press [PWR] to turn the phone on.
Immediately enter: [FCN] [0] [0] [*] [*] [8] [3] [7] [8] [6] [6] [3] [3] [STO]
The screen will start flashing numbers. Example: 314 059
In case you have trouble remembering the number sequence, it spells out "TESTMODE". Your phone is now in test mode, which is where we'll begin to turn it into an excellent, stable, high-power surveillance bug.
Press [#] to get to the U5 ' prompt. This is the test mode prompt where all the commands will be entered from. (Note, the U5 stands for US - as in USA)
Enter the frequency you want to transmit at. This can be anything from 824.04 MHz to 848.97 MHz in 30 kHz steps. You'll need to enter the frequency in "Motorola Test Mode" channel format. Example: to transmit at 837.00 MHz, cellular channel 0400, you'd enter
[1] [1] [0] [4] [0] [0] [#]
To turn the transmitter carrier on enter: [0] [5] [#]
Verify with a frequency counter or communications receiver that it is indeed transmitting at 837.00 MHz.
Next is the most important step, you need to turn the microphone (transmit audio) on!!
Do this by entering: [1] [0] [#]
Verify by listening for a feedback squeal on your communications receiver or by talking into the phone's microphone.
You are now in possession of a very powerful surveillance device. For a complete listing of the Motorola channel numbers and more test mode commands, read the The Motorola Bible by Mike Larsen.

Notes

• Transmitter carrier off is: [0] [6] [#]
• Microphone (transmit audio) off is: [0] [9] [#]
• RF output power is controlled by [1] [2] [x] [#], where [x] is 0, 1-7. 0 = maximum power (3 Watts) 7 = minimum power out.
• Cut the traces on the phone's LED display so they don't light up. Your phone will look as if it's not turned on.
• You can replace the standard microphone in the cellular phone with a high-gain preamplifier microphone for better sensitivity.
• You can replace the standard "plastic straw" antenna with an external high-gain omni-directional antenna or even a directional Yagi.
• You can send DTMF tones also. See test mode command [3] [3] [x] [#]. This is great for remote control applications. You can also send high, low and SAT tones.
• Battery level test: [FUNC] [4]
• Reset the phone by just turning it off.