The Unsorted BBS Collection

home *** CD-ROM | disk | FTP | other *** search

/ The Unsorted BBS Collection / thegreatunsorted.tar / thegreatunsorted / hacking / phreak_utils_pc / box.doc < prev next >

Wrap

Text File | 1993-10-02 | 38.2 KB | 767 lines

BLASTERBOX/DACBOX Documentation by The Researcher June 26, 1993 INTRODUCTION The signaling tones produced by a Blue Box, Red Box, Silver Box and a standard Touch Tone pad are generated by these programs with laboratory precision. They are provided, together with this file, as historical documentation of the golden age of hardware phone phreaking. While it is still possible to utilize this material for illegal activity, the odds are the average fone phreak of today will not know what to do with it even after these detailed instructions. It would require knowledge and location of specific types of phone numbers and switching equipment. I claim no warranty of merchantability and hereby donate this material as public domain/freeware. This material is for informational and or educational use only. The act of using this material releases the author (Who shall remain anonymous other than by handle) from any damage caused or alleged to be caused by its use. If you feel that a donation of some sort to the author is in order, then might I suggest a subscription to the P-80 BBS for which this proram was written and named. Questions or comments to the author may be directed to the handle mentioned in the title of this file via P-80 Systems 304-744-2253. The two programs are identical except for the output device. BLASTERBOX uses the digital-to-analog converter on a Sound Blaster board. DACBOX uses a D to A convertor attached to a printer port. The D to A convertor for DACBOX can be a simple device built from 18 resistors and 1 capacitor soldered to a 25 pin DShell plug. I have provided a detailed drawing at the end of this file. Please note that file name differences are indicative of functional differences between the two STYLES of (output devices) what is essentialy the same box, But jointly are refered to as the P-80 Box (Not to be confused with some nonfunctioanl text file already circulating the computer underground called the blasterbox)! Information for the programs and this documentation came from many sources. These are the main ones in order of proven usefulness: 1. *The Whistler, most knowledgeable phone phreak of all time. 2. Bell Operating Company documents. (Notes on the BOC) 3. The computer underground *(via P-80 Systems BBS/Scan Man) 4. Articles published in *TAP, Esquire and 73 Magazine. 5. University libraries. * THE WHISTLER was/is a brilliant and blind Fone Phreak. He was originally featured in an 1971 Esquire article titled Secrets Of The Little Blue Box. He is the character depicted in the movie SNEAKERS who was also blind and called Whistler. He is also credited with inventing the Blue Box in its early form of Single Frequency Singnaling (SF), he used to lip whistle his calls all over the globe. (Real Name: Joe Engressia) * P-80 SYSTEMS/SCAN MAN is the operator of the oldest and one of the largest so-called underground BBS's in the world. He/his system or a member thereof have been featured in Newsweek, Phil Donahue, West 57th Street, Geraldo, 20/20, API, UPI, and a 1993 book entitled Hacker Crackdown. Scan Man over the years has provided technical and informational assistance on projects like this. (Real Name: Scott Higginbotham) * TAP was an underground newsletter that appeared in 1971 before the age of the personal computer. It specialized in general anarchy and serious phone phreaking. I have personally tested and proven everything discussed in this file by field research conducted in the mid 80's using less sophisticated technology than that provided by these programs. The single exception is the European break signal. This signal appeared in a number of Blue Box programs from European countries so I have provided support for it. I rely on the reports of European programmers for belief in its validity. RUNNING BLASTERBOX or DACBOX HARDWARE REQUIREMENTS: 1. An IBM or compatible personal computer of any type with this caution: The programs have not been tested on machines slower than a 12 Mhz 286. 2. Any type of monitor. Monochrome and VGA have been tested. Only ASCII graphics are used requiring no graphics modes. 3. A Sound Blaster board or a parallel printer port with a digital-to-analog convertor attached. If you have a Sound Blaster board with jumpers set to factory defaults (port address 220 Hex, interrupt request # 7) BLASTERBOX will come up ready to go. If your board is jumpered differently you will be prompted for the correct port address and interrupt request number. When the information is entered, the program will try again to detect a working Sound Blaster. This cycle will repeat until successful or you press <ESC>ape. (Written and tested on SB 1.5) If you do not have a Sound Blaster, but have a parallel printer port, connect a digital-to-analog convertor to printer port 1, 2, or 3. The default is LPT1. The D to A convertor can be a simple device consisting of 18 resistors and 1 capacitor soldered to a 25 pin DShell plug. A drawing of this is provided at the end of this file. I have tested this and found that it works well. With the D/A convertor in place, run DACBOX. This program is identical in operation to BLASTERBOX. DACBOX will come up whether you have a working D/A or not and should not lock up your computer. If you don't have a Sound Blaster or a D/A convertor, you can still run DACBOX and look over the program. You just won't hear anything. Unless otherwise noted, the following information applies to both BLASTERBOX and DACBOX. The program will come up in Blue Box/Red Box mode. DTMF tones (Touch Tones) are also produced from this screen by enclosing the digits in square brackets "[]". The frequencies and tolerances for all the tones used are given in the section on TECHNICAL SPECIFICATIONS. BLUE BOX KEYS: 1, 2, 3, 4, 5, 6, 7, 8, 9, 0 E = Code 11 T = Code 12 K = KP (Key Pulses) P = KP2 S = ST D = 2600 Hz Disconnect B = European Break - Appears to be used like our 2600 Hz disconnect. RED BOX KEYS: Q = Quarter I = dIme N = Nickel DTMF KEYS: 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, *, #, A, B, C, D SILVER BOX: These are the DTMF A-D keys as follows: A = Flash B = Flash Override Priority C = Priority Communication D = Priority Override DELAYS: ,Comma = 1 Second delay ~Tilde = 10 Second delay Mxxxxx = Delay xxxxx milliseconds. Milliseconds can be 1 to 65535. Always leave a space after the last digit in milliseconds so the program can tell where the delay ends and the next digit to be dialed begins. W = Wait for keypress. Suspend dialing until a key is pressed, then continue. PLAYING DTMF TONES: Enclose the digits to play as standard Touch Tones in square brackets. For example, to dial 555-1234, type [555-1234] and hit <ENTER>. When the program encounters a left square bracket '[' DTMF interpretation is turned on. It stays on for as long as the program runs until a right square bracket ']' is encountered. This feature is handy if you are doing an experiment that only requires DTMF tones. You can start the first dial string with a left square bracket leaving off the right bracket or just type a left bracket by itself and hit <ENTER>. All subsequent dial strings will be interpreted as DTMF digits without the need for brackets. You can switch back to Blue Box/Red Box mode at any time by entering a right square bracket anywhere in a dial string or by itself and hitting <ENTER>. A message will appear on the main screen when the program has been left in DTMF mode. All you have to remember about square brackets and DTMF tones is: [ = Turn on DTMF interpretation (Touch Tones) ] = Turn off DTMF interpretation THE FUNCTION KEYS Pressing F1 displays the following help screen: FUNCTION KEYS: SENDING DTMF TOUCH TONES: ─────────────────────────────────────────┬───────────────────────────────────── F1 - Display this help screen. │ Enclose the digits you wish to send F2 - Set tone duration and interval │ as standard Touch Tones in square for MF digits (includes ST). │ brackets '[]'. The left bracket '[' F3 - Set duration of 2600 Hz disconnect. │ turns on DTMF interpretation. It F4 - Set duration/interval of DTMF tones │ stays on for the current and all F5 - Ear training. Learn the difference │ subsequent dial strings until a between busy signal & reorder, etc. │ right bracket ']' is encountered. F6 - Switch to Rotary Blue Box. Uses │ Single Frequency (SF) signaling. │ Entering a left bracket without a F7 - Load dial string from disk. │ right bracket will transform the │ Blue Box/Red Box dialer into a COMMAND CHARACTERS USED IN DIAL STRING: │ standard Touch Tone dialer. The DTMF ─────────────────────────────────────────┤ digits are (0 - 9, *, #, A - D). , Comma = 1 second delay │ ~ Tilde = 10 second delay │ The A, B, C, and D digits are the Mxxxxx = Delay xxxxx milliseconds. │ infamous 'Silver Box' keys. Milliseconds = 1 to 65535. │ A = Flash Leave a space after the last │ B = Flash Override Priority digit in milliseconds. │ C = Priority Communication W = Wait for keypress. │ D = Priority Override ? = .5 second of 480 Hz. Used as a │ marker when recording to tape. │ This is the help screen for BLASTERBOX. The help screen for DACBOX is the same except that F5 is used to let you change the printer port used for output to the DAC and the function keys from F5 - F7 are incremented by 1. F2 - Set tone duration and interval for MF (Blue Box) digits (includes ST). This lets you change the duration and interdigit interval of the MF (Blue Box) digits. ST is included as an MF digit. KP is set separately. You are given the option of making the new settings permanent defaults for the program. F3 - Set duration of 2600 Hz disconnect. The duration of the 2600 Hz tone can be set within the limits of 1 to 2000 milliseconds (2 seconds). The new setting can be made a permanent program default. F4 - Set duration/interval of DTMF tones (Touch Tones) Lets you change the duration and interdigit interval of the DTMF tones (Touch Tones). The new setting can be made a permanent default. F5 (F6 in DACBOX) - Ear training. Learn the difference between busy signal, reorder, ROH, and many others. This gives you a menu of call progress tones as shown below. Pressing the key corresponding to a selection will produce the sound of that signal. Call Progress Tones Signal Frequencies (Hz) Cadence 1> Dial Tone 350 + 440 Continuous 2> Audible Ringing Tone 440 + 480 2 seconds on 4 seconds off 3> Busy Tone 480 + 620 .5 second on .5 second off 4> Reorder Tone(local or toll) 480 + 620 .25 second on .25 sec off 5> Reorder Tone (toll) 480 + 620 .2 second on .3 second off 6> Reorder Tone (local) 480 + 620 .3 second on .2 second off (The reorder tone you get depends on the type of switching equipment.) 7> Special Information Tones 950,1400,1800 On in order 330 ms, off 20 ms 8> Receiver Off-Hook 1400+2060+2450+2600 .1 second on .1 second off 9> Call-Waiting Tone 440 Single 500 ms pulse 0> Low Tone 480 + 620 Varies according to use A> High Tone 480 Varies according to use B> Confirmation Tone (480+620) On 200ms/off100ms/on 400ms/off 500ms/dial tone C> Calling Card Prompt 941+1477(60ms) 440+350(940ms decayed exponentially) D> Operator Emerg. Interrupt 440 2 secs on then 1/2 sec on every 10 secs E> Recorder Warning Tone 1400 .5 second every 15 seconds F6 (F7 in DACBOX) - Switch to Rotary Blue Box. Uses Single Frequency (SF) signaling. This is really a piece of history. Phone phreaking did not start with the Blue Box as it has come to be known. It was started by a group of blind kids whistling off on ancient switches that used SF (Single Frequency) signaling. This works on a principle similar to pulse dialing with an old rotary dial phone. The on hook breaks (1 break for 1, 2 breaks for 2, etc.) produced by the rotary dial are replaced with short bursts of 2600 Hz. The way the kids used this was to whistle off with 2600 Hz just as was done later with the Blue Box. They literally did this by whistling with their mouths. When they heard the "chirp-kerchunk" indicating seizure of a trunk, they whistled the digits of the number they wanted to call. Early Blue Boxes were sometimes equipped with a rotary dial and a 2600 Hz oscillator to do this kind of phreaking. I have always been impressed by the talent of those earliest phone phreaks. I could never get my own "whistler" up to 2600 Hz. To get the flavor of how it all really started, check out the Rotary Blue Box. F7 (F8 in DACBOX) - Load dial string from disk. You can set up dial strings in advance, as simple or complex as you like, and load them into the program with this command. DIAL STRING FORMATS FOR BLASTERBOX AND DACBOX Spaces have been injected into dial strings to aid clarity. They have no effect on their interpretation by the program. All non-dialable characters except delay commands are ignored. See the section titled HOW BLUE BOXING WAS DONE for more detailed instructions on making Blue Box calls. BLUE BOX CALL IN THE CONTINENTAL US: FORMAT: (2600 Hz for approx. 1 sec), (Delay approx. 1 second), then send KP + Area Code + 7 digit phone number + ST BLASTERBOX/DACBOX DIAL STRING: Assuming the number to be called is (515) 555-1234 D,K 515 555 1234 S With everything set to program defaults, this is how the above dial string will be interpreted by the program. D = Send 2600 Hz for 1 second , = Delay 1 second K = Send KP signal for 100 milliseconds 515 555 1234 = Send MF (Multifrequency) digits 70 milliseconds on with 70 ms silent period between digits. S = Send STart signal for 70 ms If the number you are calling is in the local dialing area for the switching office you are controlling you would leave out the area code. BLUE BOX CALL TO AN OVERSEAS NUMBER: FORMAT: (2600 Hz for approx. 1 sec), (Delay approx. 1 second) 1st stage outpulsing: KP + 011 + Paired Country Code + ST wait about 5 seconds for the overseas dialtone 2nd stage outpulsing: KP + Country Code + City Code + Phone Number + ST BLASTERBOX/DACBOX DIAL STRING: To call 246-8091 in London, England D,K 011044 S,,,,,,K 044 1 2468091 S This will be executed by the program as the following sequence: D = Send 2600 Hz for 1 second , = Delay 1 second K = Send KP for 100 ms 011044 = Send 011 and paired country code as MF digits (70ms on/70ms off) S = Send ST ,,,,,, = Delay 6 seconds allowing time for international dial tone K = Send KP 044 1 2468091 = Send MF digits S = Send ST MAKING A RED BOX CALL FORMAT: The required amount of money in nickels, dimes and quarters is inserted into a coin slot. BLASTERBOX/DACBOX DIAL STRING: To simulate $1.15 QQQQIN The program will generate tones for 4 quarters, 1 dime, 1 nickel. MAKING A STANDARD DTMF CALL FORMAT: 1+(A/C)+7 digit number or just 7 digit number for local call. BLASTERBOX/DACBOX DIAL STRING: To call 555-1234 [5551234] The digits enclosed in square brackets will be sent as standard DTMF tones. TECHNICAL SPECIFICATIONS BLASTERBOX and DACBOX produce high quality dual sine wave signaling tones with a very tight frequency tolerance. This is achieved by using mathematically calculated "sound sample" data for the tones and a high enough sampling rate to give good wave form resolution. Since no actual sound sampling was done no noise or distortion has been introduced into the "sound sample" data. The tones will be as good as the DAC can reproduce them. Frequency tolerances far tighter than those required by the Bell or other phone companies was also assured by careful selection of the sampling rate. The data for the tones is calculated for a selected sampling rate. To reproduce it at that rate, and thus at the correct frequency, a clock signal has to be divided by a number which will result in a frequency which matches the desired sampling rate. The smaller the remainder of this division the more accurate the sampling rate for playing the tones will be. The clock used by the Sound Blaster is 1 Mhz. The clock used by DACBOX for timing output to a DAC at a printer port is the PC's timer chip clock which is 1.193182 MHz. If I had used the same sampling rate for printer port output as for Sound Blaster output, a tiny error would have been introduced into printer port output. This error would not be enough to put the tones out of phone company specs (it amounts to about 4-6 Hz depending on frequency) but I didn't like it. For this reason I made two separate programs instead of one program with support for both outputs. For the precision I wanted, I needed to use a slightly different sampling rate for data output to a printer port. A different sampling rate required recalculating all the data used. If I had put two sets of data in one program, the program size would have been enormous. I was splitting hairs. I chose to do it. This paragraph explains why. Sampling rate used by BLASTERBOX = 19607 Hz Sampling rate used by DACBOX = 19560 Hz Frequency tolerance for all dual tones (both programs) = ±1 Hz Frequency tolerance for 2600 Hz (BLASTERBOX) = ± %0.15 Frequency tolerance for 2600 Hz (DACBOX) = ± %0.24 These are the standard DTMF (Touch Tone) frequencies in two useful formats. The Bell Operating Company frequency tolerance is ± %1.5. The Silver Box consists of the A, B, C and D keys. The legitimate use of those keys is on a military telephone network called Autovon, in amateur radio, and for internal telephone company testing. Digit Frequencies LOW ----- ------------ TONE HIGH TONE GROUP (HZ) 1 697 + 1209 GROUP 2 697 + 1336 (HZ) 1209 1336 1477 1633 3 697 + 1477 4 770 + 1209 697 1 2 3 A - Flash 5 770 + 1336 770 4 5 6 B - Flash override priority 6 770 + 1477 852 7 8 9 C - Priority communication 7 852 + 1209 941 * 0 # D - Priority override 8 852 + 1336 9 852 + 1477 0 941 + 1336 * 941 + 1209 # 941 + 1477 A 697 + 1633 B 770 + 1633 C 852 + 1633 D 941 + 1633 Multifrequency signaling tones used for control of telephone switching (Blue Box). Bell Operating Company frequency tolerance = ± %1.5. Digit Frequencies (Hz) ----- ---------------- 1 700 + 900 2 700 + 1100 3 900 + 1100 4 700 + 1300 5 900 + 1300 6 1100 + 1300 7 700 + 1500 8 900 + 1500 9 1100 + 1500 0 1300 + 1500 ------------------------------- CODE 11 700 + 1700 Inward operator (European) CODE 12 900 + 1700 Delayed-ticketing or suspended- call operator (European) KP (Key Pulses) 1100 + 1700 Start of digit transmission for a national call. KP2 1300 + 1700 Start of digit transmission for an international call from an intermediate (transit) exchange. ST (Start) 1500 + 1700 End-of-digit transmission. Disconnect 2600 ± 30 Hz The Red Box frequencies are 2200 Hz + 1700 Hz. The Bell Operating Company frequency tolerance for these is ± %1.5. Red boxing consists of simulating the tones produced when coins are deposited in a pay phone. 5 cents - 1 beep, 66 milliseconds duration. 10 cents - 2 beeps, each 66 milliseconds duration with 66 millisecond pause between beeps. 25 cents - 5 beeps, each 33 milliseconds duration with a 33 millisecond pause between beeps. These are the frequencies for the European Break signal which seems to be used by European phone phreaks to start a calling sequence the way 2600 Hz is used in the U.S. All I know about it other than the frequencies is that it appears in European Blue Box programs and that European phones phreaks are Blue Boxing into underground bulletin boards in the U.S. to this day. 2390 + 2600 150 milliseconds delay 165 ms 2410 + 2390 225 ms delay at least 600 ms HOW BLUE BOXING WAS DONE "Whistling off", "beeping off", and "blowing 2600 Hz" all mean the same thing - sending a 2600 Hz tone down a phone line for approximately 1 second. A "blowable number" means a toll free number like an 800 number or Canadian directory assistance which when called and fed 2600 Hz results in the seizure of a trunk in a switching office. All Blue Box calls begin with seizure of a trunk in this way, although there are few blowable numbers left except in obscure locations with old switching equipment. BLUE BOXING WITHIN THE CONTINENTAL U.S. Boxing a call to anywhere in the Continental United States was so simple I don't seem to have made any personal notes on the subject. When reviewing my notes in preparation for this doc file, all I found were a few examples I had hard coded into a computer program. In any case, this is how it was done. Though these instructions are given in the present tense, they are spoken from a viewpoint in the mid 80's. 1. Go to a pay phone. Never do this from home. This is the most important step in this procedure. 2. Call a "blowable number". It is not necessary to wait for the called number to ring. Just listen for the click or series of clicks indicating call completion. If it rings, fine, but Blue Boxing is a class act and beeping off before the called number rings is classier and more fabian than waiting until after. 3. Send 2600 Hz for approximately 1 second. 4. Listen for the "chirp-kerchunk" indicating a trunk seizure. If you have set up an automated procedure by means of a portable computer or a tape recording of tones produced by a computer, provide a 1 second delay after the 2600 Hz tone. 5. Send the MF digits in this format: KP+(Area Code)+(7 digit number)+ST. The timing of the MF digits is not super critical but if you can control it precisely, send KP for 100 ms; delay 70 ms; send the rest of the digits including ST at 70 ms with 70 ms interdigit silence. BLUE BOXING TO OVERSEAS DESTINATIONS Boxing a call to an overseas number requires more knowledge than that required for calls within the Continental U.S. To give you this knowledge, I am including the original notes on my research and field experiments on this subject. I could call toll free to anywhere in the world that had a telephone. This is the information I used to do it. ===============Start of Notes on Blue Boxing to Overseas Numbers=============== Notes on Overseas Dialing Overseas dialing is done in two stages of outpulsing. The first stage routes to an overseas sender and uses 011, which is the international access code for International Direct Distance Dialing (IDDD) plus the paired country code. If the country code is two digits, the paired country code can be derived by adding a "0" to the left of the country code. Example: The country code for England is 44. The paired country code would be 044. First stage outpulsing for England would then be: KP-011044-ST. If the country code contains three digits, the paired country code cannot be derived in this way and must be looked up. Example: The country code for Guam is 671. The paired country code is 067. First stage outpulsing for Guam would be KP-011067-ST. Second example: The country code for Cyprus is 357. The paired country code is 087. It is a rule that a paired country code must never be the same as any country code. About five seconds after the STart pulse, an international dial tone will be heard. This will time out to a reorder in about ten seconds. When the dial tone is heard, the system is ready to accept the second stage of pulsing in the format: KP-country code-city code-digits-ST. At this stage it is the country code not the paired country code which is used. Use the paired country codes when calling inward operators. Some toll offices are screened against 011 coming in on a long distance trunk. In that case precede the 011 with the area code which would apply for that toll office. Example: for a toll office in Gainsville, FL use KP-904+011+paired CC-ST. Another way to reach the overseas senders is to call them directly with KP-sender number-ST. If this doesn't work add the area code of the sender. Example: KP-904185-ST. This is a list of international centers with their area codes.: A/C Sender Location --- ------ -------- 914 182 White Plains, NY 212 183 New York, NY 412 184 Pittsburgh, PA 904 185 Jacksonville, FL 415 186 Sacramento, CA 303 187 Denver, CO 212 188 New York (same sender as 183) The routing for a particular country can be found by dialing normally (pulse or touch-tone) 011+CC+000+enough digits to add up to a total of seven including the country code. Example: 011+44+00011. You will get a recording. At the end of the recording, the area code of the international center will be given. The sender used to call a particular country can vary depending on the area of the country from which the call is originated. An international call can sometimes be completed through the wrong sender, but this causes a print out that will later be investigated to find out which CO it came from. To find the correct routing when pulsing through any particular toll office use KP+paired CC+000+ST. For example, KP-011044000-ST would give the same result as dialing normally 011-44-00011 if you were dialing it in the area where the toll office is located. The first digit of a country code is the world region in which that country is located. The world regions are: 1--North America, 2--Africa, 3 and 4--Europe, 5--South and Central America, 6--South Pacific, 7--Union of Soviet Socialist Republics (U.S.S.R.), 8--Far East, 9--Middle East and South-East Asia. Note 1. KP2 is not used in first or second stage outpulsing when calling any country in the IDDD network. Note 2. Public telephones are interfaced to TSPS (Traffic Service Position System). If you call an 800 number and whistle off using 2600 Hz, the distant toll office sends a wink back signal (a short on-hook) indicating it is ready to receive pulsing. TSPS responds to this wink back by printing out the original number called, the number called from, and the number MFed after the wink back. This print out goes to the billing and security departments. General Notes on Overseas Senders and Routing Codes From Canadian Directory Assistance (514) call Montreal sender with KP 188 ST. Using this sender these countries can be called: England (Satellite) Australia (Satellite) Egypt (Cable only) Philippines (Satellite) Could not reach Thailand or Japan from this sender. Canadians cannot direct dial these countries. They have to go through an overseas operator in Vancouver at last check. Guam can be reached by satellite by beeping off 514 directory assistance and calling the sender in Jacksonville with KP 904185 ST. The following senders could be reached through a PBX extender in Orlando, Florida. After getting an outside line through the extender any number can be called. After a series of clicks, blow 2600 Hz. This will give control of a tandem in the Orlando area. A/C Sender Location --- ------ -------- 914 182 White Plains 212 183 New York 412 184 Pittsburgh 904 185 Jacksonville 303 187 Denver These senders could not be reached by this method: 415 186 Oakland 514 188 Montreal European countries can be reached by beeping off an 800 number and keying KP 011 Derived CC ST. This will automatically connect you to the right sender for that country code and will give you an overseas dial-tone for ten seconds. For example to call the weather recording in England, the routing would be KP 011044 ST then KP 044 1 246 8091 ST. PAIRED COUNTRY CODES This is a list of paired country codes for use in first stage outpulsing on overseas calls. For two digit country codes simply add a zero. Example: The country code for England is 44. The paired country code is 044. Paired country codes that cannot be derived by this simple method are listed below. Country Country Code Paired Code ------- ------------ ----------- Algeria 213 013 American Samoa 684 284 Bahrain 973 073 Belize 501 111 Bolivia 591 991 Brune 773 180 Cameroon 237 077 Costa Rica 506 806 Cyprus 357 087 Ecuador 593 293 El Salvador 503 003 Ethiopia 251 059 Fiji 679 879 Finland 358 088 French Antilles 596 896 French Polynesia (Tahiti) 689 289 Gabon 241 025 Gibraltar 350 050 Guam 671 067 Guatemala 502 022 Guyana 592 892 Haiti 509 887 Honduras 504 884 Hong Kong 852 692 Iceland 354 854 Iraq 964 294 Ireland 353 083 Israel 972 072 Ivory Coast 225 285 Jordan 962 282 Kenya 254 074 Kuwait 965 015 Lesotho 266 186 Liberia 231 851 Libya 218 018 Luxembourg 352 292 Malawi 265 096 Marisat Atlantic 871 101 Marisat Pacific 872 102 Marisat Indian Ocean 873 103 Morocco 212 012 Namibia 264 194 Netherlands Antilles 599 099 New Caledonia 687 287 Nicaragua 505 975 Nigeria 234 014 Oman 968 068 Panama 507 247 Papua New Quinea 675 875 Paraguay 595 295 Portugal 351 281 Qatar 974 174 Saipan 670 071 Saudi Arabia 966 990 Senegal 221 021 St. Pierre/Miguelon 508 104 Suriname 597 097 Swaziland 268 168 Taiwan 886 006 Tanzania 255 075 Tunisia 216 016 Uganda 256 876 United Arab Emirates 971 291 Uruguay 598 288 USSR 7 007 Yemen Arab Republic 967 297 Zambia 260 008 Zimbabwe (Rhodesia) 263 283 Notes: The Marisat codes are used when calling ships directly. Single stage outpulsing is used for calls to Mexico in this format: KP-180-City Code-digits-ST. To call an inward operator in Mexico use KP-190-City Code-09-ST. For directory assistance use KP-190-City Code-01-ST. ================End of Notes on Blue Boxing to Overseas Numbers================ SILVER BOXING (a.k.a. WHITE BOXING) I didn't experiment much with this and took no notes on it. I checked it out once or twice with a young phreak who lived in the midwest. The way it worked was two phone phreaks in different parts of the country would call directory assistance in an area that was still on the old 4A switch. Immediately after dialing the last digit you would hold down the 'D' key on the silver box. Instead of getting a directory assistance operator you would hear a pulsing dial tone. Then one caller would send a Touch Tone 6 and the other would send a Touch Tone 7. The two would then be connected to each other through a test loop where they could talk indefinitely toll free. RED BOXING Red Boxing is a method of making free calls by simulating the tones produced by dropping coins into a payphone. The specs for these tones are given above under TECHNICAL SPECIFICATIONS. I experimented intensively with this for about three weeks. My main method for producing the tones was to make a cassette recording of an endless string of quarter tones and then play them into a payphone receiver as needed. I have the uncertain honor of having invented Red Boxing with whistles. The whistles were made from aluminum tubing available in hobby shops. They were 1/4 inch in diameter by 4 inches long and were tuned by means of a wooden dowel rod which fit snugly inside. I tuned one to 2200 Hz and another to 1700 Hz by adjusting the dowel rod in and out while listening for a zero beat against a known signal source (a computer). I taped the two whistles together snugly with masking tape. After very little practice, I found that I could whistle nickels, dimes and quarters that were accepted by a payphone. I made a set of these whistles for my Silver Boxing friend, mentioned above, and mailed them to him. He used them every day for a week to call me up and demonstrate this new technique for "blowing" money. HOW TO MAKE A DAC FOR USE WITH DACBOX This circuit requires 9 20K resistors, 9 10K resistors and 1 100 MFD capacitor. The resistors are 1/4 watt and should have %1 tolerance. You will need a 25 pin DShell plug to connect it to your printer port. You might also want to add a female RCA plug to have a convenient way to connect it to an amplifier. The entire circuit can be built on the back of the 25 pin plug. Be sure to connect the two points labeled 0v. No power supply is required. This circuit was included in an Amiga mod file player package by Mark J. Cox. He acknowledges Harry Stox for the circuit. I have tested it and found it to be pure gold. Printer Port: signal pin 20k 20k D0 2 >───░░░─┬─░░░──0v 20k ░ 10k D1 3 >───░░░─┤ 20k ░ 10k D2 4 >───░░░─┤ 20k ░ 10k D3 5 >───░░░─┤ 20k ░ 10k D4 6 >───░░░─┤ 20k ░ 10k D5 7 >───░░░─┤ 20k ░ 10k D6 8 >───░░░─┤ 20k ░ 10k D7 9 >───░░░─┤ 20k ░ 10k 100 MFD ├──────┤█────> TO AMPLIFIER ░ 10k GND 20 >───────┼────────────> 0v Written For P-80 International Information Systems 304-744-2253