I'll document the others when i get time to lock up one of these phones again (it's a clients so dont have long with it)ġ. There are multiple ways to do this bypass - here are just a few i came across freestyling.
If I get free time I will clean these steps up some so they are more clear and also get ahold of the handset and post additional methods/steps.)
(Sorry for the poor write up, it's basically notes from when I did this model quickly.