Motorola GSM Transfer/ Clone Card.
The Clone Card (also reffered to as transfer card) is used by motorola to transfer user (personality) information (phonebook, options etc.) from one phone to another. The transfer card is not a plain SIM, because the ISO CLASS is not $A0 as in a standard GSM SIM, but some sort of SAM (Security Access Module). The card is a password protected 24 kbit serial memory (EEPROM). This means that a password has to be sent to the card before the memory can be accesed. The transfer card password is " TESTCODE" (This is sent in plaintext from the MS to the SIM after the MS detects that a transfer card is inserted. The transfer card is identified by the phone from its ATR which is "3F 6C 00 00 25 A0 31 00 FF 00 00 01 80 04 90 00" 

There are two primary uses of the transfer card: 

1) Transfer of personality. If your phone fails ("Phone Fail See Supplier") and is to be exchanged, then there is a possibility to have the user data transferred from the defective phone to another one (This does require that the phone actually can be powered up). This will make the exchange phone appear like the old one, with the same menu setup, phonebook and settings. This is acomplished by transferring the areas of the EEPROM that contain the user data. The user data is far more than the 3 kb that will fit on the card and therefore the 8k phone EEPROM is divided into "transfer frames". Only one transfer frame will fit on the transfer card at a time. A transfer of the frames 1, 2 and 3 will do a total personality transfer. 

2) Initialization of the EEPROM. If the phones EEPROM data become corrupted, then the configuration checksum can fail and generate a "Phone Failed See Supplier" the will result in the phone not booting up. With the transfer card *some* of the corrupted data can be replaced and the configuration block checksum can be recalculated. A transfer of frame 4 (the "Master Frame") will in many cases cure a phone that fails with a self diagnostics code "07" (interrogate with 7100# in test mode). 

Data CAN go bad on the transfer card. The phone will detect the error and go "Bad Data On Card" when trying to transfer the frame to the phone. It is not an actual checksum that makes the phone capable of spotting bad data. The first and last thing that is written to the clone card, is at address $40 - This address contain a register that flags the status of the frame and the frame number. The phone will initiate the transfer to the card by writing "bad data" and when everything has been transferred, it will write "good data". This way, a transfer that was stopped prematurely can be rejected. EEPROM read/write operations that go wrong (if not soldered correctly or bad) can be detected and the phone will prompt "EEPROM Rd Fail" or "EEPROM Wr Fail" . 

List of Clone Card (51-04025D03) Commands: 
02N# Read data frame N (0...5) into clone card 
03# Write transfer card dataframe into phone 
06# Locks the data on a transfer card 
07# Unlocks the data on a transfer card
Frame (02N#) contents, description and size 
Frame 1 : Phone setup (greeting,keypad,features,settings,counter) - 2880 bytes 
Frame 2 : Phonebook entries 1-75 - 3008 bytes 
Frame 3 : Phonebook entries 76-100, timers,rates & user features - 1728 bytes 
Frame 4 : Master SIM data (OEM settings,wakeup text,keypad,features) - 1248 bytes 
Frame 5 : Last 10 calls (among other things) - 896 bytes (not supported by all phones)
Contents of the different transfer frames and lengths were determined on a 7500 
There are some differences between phone types. The StarTAC (and Slimlite) frame 3 also contains life time meter, last 10 calls & keypress-beep setting