USRobotics Courier V.34: Undocumented Features
----------------------------------------------

AT Commands
-----------

^BE^GHmX^I^H    (where ^ indicates a control character)
                enter flash rom programming mode

                h = hex digit, n = decimal digit, [] = optional

Cx=n            (see Y14)
                x=8, 23, 39, 56, 74, 10 to change the respective bytes
                Cx=n can be disabled for each byte individually,
                by default Cx=n is disabled for all bytes

G=[hhhh:]hhhh   display a byte dump of the modem memory
GR[hhhh:]hhhh   display a word dump of the modem memory
GIhhhh          read value from I/O port
GOhhhh,hh       write value to I/O port
GBhhhh          dump 256 sequential I/O ports
GN              set flag: NVRAM contents valid
GXhhhh          (unknown)
GYhhhh          (unknown)

I8             Germany: display blacklist

RS99?           display copyright notice
USR             display copyright notice and credits

Yn
      n =  5:   self test
      n =  6:   (unknown, gives OK)
      n =  7:   while online: signal quality screen
      n =  8:   dumps V.42bis dictionary (?)
      n =  9:   dumps V.42bis dictionary (?)
      n = 11:   while online: display frequency level
      n = 12:   while online: display recv / xmit level (?)
      n = 14:   displays six bytes encoding specific model
      n = 15:   display dipswitch settings
      n = 55:   (unknown)

      Y14 display (byte #, meaning):
      1, 2      unused
      3, 4,     product type (as shown by I7)
      5         add: 1=HST, 2=Fax, 4=V.32terbo, 8=V.FC/V.34
      6         country code

&Jn             (unknown; probably jack type selection)
      n = 0
      n = 1


%R              nop (parameter is saved but ignored)

~S?             display the 16-place serial number of the modem

~S-mmddyy-nnnnnnccnnnnnnnn
                save a new serial number to NVRAM
                mmddyy  supervisor date
                  n       a digit
                  c       any character

S registers
-----------

Saved to NVRAM:

S31             (unknown)
S35             (unknown)
S36             (unknown)
S37             (unknown)

S39             Germany: set TX level (as measured with ZyXEL 1496E+)
          0..5        -4.5 dB
            6         -6.5 dB
            7         -6.5 dB
            8         -8.0 dB
            9         -8.6 dB
           10         -9.4 dB
           11        -10.6 dB
           12        -11.6 dB
           13        -13.3 dB
           14        -14.1 dB
         15..255     -14.8 dB

S40             Germany: disable various BZT restrictions
        .0      disable calling tone
        .1      disable blacklisting
        .2      enable ATA, ATH1
        .3-.7   reserved

S57             (unknown)
        .0      Germany: select blacklisting
                =0  no delays between calls, 12-call limit
                =1  30s delays between calls, no call limit

Volatile:

S17             (unknown, only written to)
S20             (unknown)
S30             (unknown)
S50             (unknown, only written to)


General AT Parser Idiosyncracies
--------------------------------

- If not between Sn and = or ?, .n will be ignored.


Country Codes:
--------------

        0 = USA/Canada          10 = New Zealand
        1 = Japan               11 = Czechoslovakia
        2 = Finland             12 = Belgium
        3 = Sweden              13 = Denmark
        4 = UK                  14 = Australia
        5 = Norway              15 = France
        6 = Switzerland         16 = Germany
        7 = Netherlands         17 = International
        8 = South Africa        18 = Austria
        9 = Italy               19 = Ireland

The country code, as all the Y14 bytes, is saved to NVRAM. There is a
Cx=n command to modify those bytes, unfortunately this command is
disabled.