The Hacker's Encyclopedia 1998/hackers_encyclopedia.iso/zines/phrack2/p50_09.txt

Text File | 2003-06-11 | 25.4 KB | 458 lines

                                .oO Phrack 50 Oo.

                            Volume Seven, Issue Fifty

                                     9 of 16

                                SS7 based diverter

                      The MasterMiiND <[e-mail]>


Brief Description:
------------------

Hey everyone, well I've spent some time now designing a Diverter, and finally
came up with a foolproof design.  After building every diverter plan I could
find, and finding that they didn't work under the switching systems of our
day (not surprising, seeing how all the plans are like ten years old) I
decided something needed to be done.  Well, I thought I'd share this new
diverter with everyone, so we can all have phun again, until they change the
system again.

Also called a "Gold Box", a diverter allows somebody to call one predetermined
telephone number, and then get a dial tone from another predetermined phone
line.  It is like calling a direct in-dial (DID) line on a PBX and getting a
dial tone.  The main difference is, that YOU actually built the device, and
you don't have to enter authorization codes to get the dial tone.

Uses:
-----

You can setup a diverter so that you can call pseudo-anonymously.  That is,
you call the diverter, and then call out of the second line.  That way, if
anybody checks their caller ID unit, the number of the second line, and not
your own line will show up.  Also, if they decide to activate a trace, then
the telco and the police will get the wrong number.

Another reason for setting up a diverter of course, is to avoid paying for
telephone calls.  Any, and all calls you make on a diverter, are billed to
the owner of the second line.  This means, that if you call your Aunt Jemima
in the Outer Hebrides for 10 minutes, then the owner of the line you used will
get her number, and be able to call her up and ask who called her at the time
and date stated on their bill.  Now, if she is your average Aunt Jemima, then
she will most likely say, 'Oh, that was my nephew, Michael.  His number is
555-2357'.  But if she is cool, like MY Aunt Jemima, she would say something
like 'Hmm, let me see...oh yes, that was a telemarketer from the USA, trying
to sell me a used vacuum cleaner.'  Anyway, my point is, that every billable
call you make, will show up on their bill.  For that reason, it is best suited
to call stuff that you don't care too much about.  Setting up teleconferences,
calling long distance BBS's, phone sex, and maybe even long distance scanning
are all good uses for the diverter.

Technical Description:
----------------------

Ok, so you want to make a diverter?  Well, before you set out designing a
diverter, there are some basic properties of the Signaling System 7 (SS7)
telephone system that you should be aware of.  Previous plans for diverters
have been release in the past, but as those of you who tried to make one have
realized, they do not work under SS7.  Generally, these plans are around ten
years old, and were designed for older switching systems such as Step by Step
(SxS) and CrossBar (xbar).  The diverter that I have come up with, has been
tested under GTD-5 EAX, and DMS-100 switches.  Because the signaling used by
these switches, and the #5ESS are the same, it is safe to assume the diverter
would work under #5ESS, although I can't say for sure, as I haven't been able
to test it out.  If someone gets one working under an AT&T switch, please
drop me a line, because I would be really interested in how it worked, and
what, if any, changes had to be made.  Ok, enough nonsense from me!

When your telephone is in it's normal on-hook state, there is approximately
48VDC across the ring and tip.  When you pick up your phone, the voltage
drops down to about 6-10VDC.  This is because taking your phone off-hook
causes a closed circuit across the ring and tip, through your telephone.
Doing so, causes the CO's equipment to sense you have taken your telephone
off-hook, and send you a dial tone to tell you it is ready to receive dialing
instructions.  Ok, now, suppose your phone is on-hook.  Your Aunt Jemima calls
you up.  How does the CO alert you to this?  Well, they send a ring signal to
your line.  This is a 90-130VAC signal, that is approximately 20Hz in
frequency.  This is pulsed on for 2 seconds, then off for 4 seconds.  This is
then repeated for a predetermined amount of time, or until you pick up your
phone.  The amount of time a phone will ring, if you don't pick up your phone
depends on how your phriends at the CO programmed the switch.  The reason why
it has a time limit for a ring out, is for two main reasons.  First of all,
it takes a lot of equipment resources and power in the CO to ring a phone.
And secondly, to put an end to phreaker's "Black Boxes" that would depend on
the switches ability to ring a phone for ever, if it wasn't picked up...

Ok, now you pick up your ringing phone.  This causes voltage to flow from the
tip through your phone to the ring.  This causes the CO's switching equipment
to stop sending the ringing signal, and then drops the voltage down to around
6-10VDC.  An audio path is then opened between your Aunt Jemima and you.  Now,
after about 10 minutes of speaking with her, your Aunt Jemima shouts:
'Oh no...my pancakes are burning...gota go...' and hangs up on you.  But you,
being the phreak that you are, stay on the line.  You listen carefully, but
hear nothing but the silence of linenoise.  Then, after about 10 seconds,
the CO sends a disconnect signal to your line.  This disconnect signal is
simply a reversal of polarity between the ring and tip for about 1 second.
When the polarity is first reversed, you hear a click in the earpiece of the
phone.  Then, when the polarity is reversed again, you hear another click.
The voltage is back at 6-10VDC, and the polarity is just as if you had just
picked up your phone.  Now, if you stay on the line for about 30 seconds
longer, the CO will send an off-hook signal, which is a very special signal.
It is a MF signal that consists of 1400Hz & 2060Hz & 2450Hz & 2600Hz tone
pulsed on 0.1 second on, and 0.1 second off.  That is the very loud and
annoying sound you hear if you leave your phone off-hook.

Ok, those are the basic properties of the SS7 telephone system you need to
know, to understand how the diverter works.  I've spent a little of my time
drawing a schematic in GIF format, and you will find it uuencoded at the end
of this file, so please decode it first, and load it up in your favorite
image viewer, while you read the next part.  It really helps to follow the
schematic, while reading the white paper.  After all, anybody can follow
simple instructions on how to make a diverter, but I would prefer you all
understand how it works.  I wouldn't want to think I wasted my time on this
little project ;-)

Parts List:
-----------

(1) DPDT relay (5VDC Coil Rating)
(1) 600 Ohm:600 Ohm transformer (Telecom Isolation Type)
(1) 2N3904 transistor (NPN, Small Signal type)
(1) Opto-Isolator pair (IR LED/Phototransistor Type)
(1) 22K Ohm resistor (1/4W, 5%)
(1) 470 Ohm resistor (1/4W, 5%)
(4) 1N4003 diodes (200 PIV)
(1) 7805 IC (5VDC, Positive Voltage Regulator)
(1) 0.33uF capacitor (Mylar Type, microfarad)

Parts Notes:
------------

The transformer is the type you would find in an answering machine, but can be
picked up for around $7.00.  The opto-isolator is a slotted pair.  That is,
they are housed in a plastic assembly, that has an IR LED facing onto a photo-
transistor, with a slot in between them.  The slot is designed for a rotating
wheel or something similar, but doesn't affect the design at all.  A true
opto-isolator could be used instead, I guess, but the only ones I could find
where photodarlington types, and I couldn't really be bothered with them.
Besides, I happen to think the slotted pair look cooler! ;-)

Anyhow, in my diverter, I replaced the 4 diodes with a full wave bridge
rectifier in a 4 pin DIP.  It was smaller, and again, it looked cooler.
The 7805 is a voltage regulator IC.  It has 3 pins, and can be found almost
anywhere.  Lastly, the capacitor is just a regular mylar device.  If the value
is higher than 0.4uF, then the diverter will activate with line noise on line
#1, or if someone picks up line #1, or if the pulse dial!  If it is less than
0.2uF, then line #1 will ring a couple of times before the diverter picks up.
Best advice is to simply use a 0.33uF capacitor.  Other stuff you will need is
hook up wire, plugs and connectors, some sort of protoboard, and a box.  This
part is up to you, and is where you get to show your phriends at the next 2600
meeting your creativity.  Using a Rubbermaid (tm) tub is pretty creative.  I
just went with a plain project box from Hammond (tm).  Ah well...

Schematic:
----------

NO ASCII SCHEMATICS FOR YOU!   DECODE THE GIF AT THE END OF THIS FILE INSTEAD!

Theory of Operation:
--------------------

Ok, looking at the schematic, we see RED #1, GREEN #1, RED #2 and GREEN #2.
Obviously, these are the two lines.  Now, line #1 is going to be the line
that we initially call into to get the dial tone, and line #2 is going to be
the line of the dial tone that we actually get.

We see that in the normal state, the DPDT relay is not activated.  This
presents an open circuit to line #2.  Current cannot flow from GREEN #2 to
RED #2, because of the open relay.  Thus, line #2 is in the on-hook state.
The same is the case for line #1.  Current cannot flow from GREEN #1 to RED #1
because of the open relay contacts.  Also, because the voltage across the two
wires is 48VDC, the direct current is blocked by the capacitor, C1.  Thus,
current from line #1 cannot enter the rectifier either.  In the normal state,
both lines #1 and #2 are on-hook.

Now, you dial up the number for line #1.  The 48VDC, becomes a ringing signal
of 90-130VAC @ 20Hz.  This causes an alternating current to pass the capacitor
C1, and into the full wave bridge rectifier.  This causes a DC voltage to
appear on the output of the rectifier, which flows through the IR LED in the
opto-isolator, lighting it up.  As the IR light hits the phototransistor,
the phototransistor's collector current starts to flow.  This causes the
second transistor's base current to flow.  This causes the transistor's
collector current to flow, which turns on the DPDT relay.  Now, as the relay
turns on, current can now flow from GREEN #1 through D1 in the full wave
bridge rectifier, through the IR LED in the opto-isolator and it's current
limiting resistor, through one half of the DPDT relay's contacts, through one
winding of the transformer, and to the RED #1.  Also, at the same time, we now
have current flowing from GREEN #2 through the second half of the DPDT relay's
contacts, through the other winding of the transformer, and to RED #2.

In effect, the diverter is picking up both lines.  Now, you would think that
if the diverter picked up both lines, then the ringing signal would stop on
line #1, and the IR LED would turn off, thus turning off the whole circuit.
Well, this is partially correct.  However, notice that line #1 is now flowing
THROUGH the IR LED, which keeps it on!  So, the ring signal initially turns on
the IR LED, and the off-hook current of about 6-10VDC keeps it on!

So, now, you are connected to line #1.  Line #2 is off-hook as well, and both
line #1 and line #2 are being bridged via the transformer.  Thus, any and all
audio is passed between both lines.  What this means is that you get the dial
tone from line #2, and you can send your DTMF's from line #1.

Ok, now you make your call.  Now, you hang up on line #1.  Now, for about 10
seconds, the diverter stays active.  But then, the CO sends a disconnect
signal to line #1.  If you remember back, this is just a reversal of polarity
between the ring and tip, that is the GREEN #1 and RED #1.  Doing so, the
IR LED, being a polarity sensitive device, turns off.  This causes the
phototransistor's collector current to goto zero. This causes the transistor's
base current to goto zero as well, and as a result, the transistor's collector
current goes to zero as well, thus turning off the relay, and putting both
line #1 and line #2 on-hook again.  The diverter is now ready for another
call.  There...simple huh?

Special Notes:
--------------

The diverter can be installed anywhere you have access to 2 lines.  Obviously,
green base's, can's, telephone pole's, network interface's etc... are all prime
locations for the diverter.  Now, you need a lineman's handset or a "Beige Box"
and access to an ANI read back circuit, in order to determine the numbers of
the line's you are using.

Once the device is installed, anyone and everyone calling line #1 will receive
a dial tone.  This means that you cannot simply leave the device installed for
a whole month.  That is, unless you manage to find a line that is unpublished
and used for outgoing calls or something.  An example is a corporate data line
used by a local (unnamed) fast food restaurant that sends payroll data at
night, once a week.  You get your diverter on this line, and you could leave
it there for a while.

Also, it is a good idea, once you get the dial tone, to use calling cards, or
third party calling to complete your call.  That way, your calls don't show up
on line #2's bill right away.  Usually, it will show up on the next bill of
the person you third party'd, and it will take another month or two to reach
the bill of line #2.  However, line #2 will also get service charges for the
third party, so their bill will be even higher than if you just used their
line directly.

Ok, as for the circuit...I've gotten into a habit of designing all my circuits
to operate at 5VDC.  Although this isn't too necessary in this circuit, it
makes it totally TTL and CMOS compatible, should you want add digital gating
and other fancy stuff to the basic diverter.  Well, that's enough rambling from
me for now...go and get yourself some parts!

Shout Out's:
------------

Shout's to the Vancouver, BC hack community...you know who you are...
Shout's to all the guys at Phrack...keep the legend going....
Shout's to the Niagara Falls, ON hack community...(IS there one?)
Hell, shout's to the whole damn community...we're still alive and kicking
right!

Oh yeah, I can't miss out our beloved BC Tel!  Keep those rates increasing,
and keep installing those ultra fancy NorTel Millenium's in the high vandalism
and high crime areas!

That's all folks...

=[MasterMiiND]=

==============================BEGIN UUENCODED GIF=============================

begin 644 diverter.gif
M1TE&.#EAL`*S`8```````/___RP`````L`*S`0`"_HR/J<OM#Z.<M-J+L]Z\
M^P^&XDB6YHFFZLJV[@O'\DS7]HWG^L[W_@\,"H?$HO&(3"J7S*;S"8U*I]2J
M]8K-:K>`KO<+#HO'Y++YC$ZKU^RV^PV/O[?TNCT(N.OI^;W_#XC2%TCH-%B(
MF*CH<+CH"-3X*#FI%TEY26.)N<GYI-D)*A@Z2GKT68K:<9K*VNJRZAH;`2M;
M:ZMZFRM!J]OKV\#[&QLL7-Q+;(R*G,SLNMP,^@P]'2I-?6E]K3V9O>W8[1U>
M^.F54(YP?I`NC@7._EX)'-"81S]O?@]_Y:[?GZ4Y**"Z@08$%O1'A1_"A5(`
M$LP'T6!$AE$44KRXQ)*]_HWX[&%D8O&C2"(:.YI$!_&@`CDL6[I\"3-FR%TC
M:_)9P!%ESH<H;4Z8.<NG4"LE=9X<Z!'?4`A`F2Y]"J4HTJ,'D_:$RJ#I`ZU8
MNZJ0*C'L0ZE>E;;@6C;M"+!CVZI,R5,MW*]RZT+"";<>U7MDZZ+-:C=PCR[F
M"*,SK`YQ0<7S_HISO%*PY!U@$J>KO/CRE\EO64#F##KTC,]719L.M+DPX\:K
M#Z]C^IIUI-19:2<A'?>T[MJ'6AL)XWH=<)QB9F'.+/RX:N6_7^#>3;$X:Y"&
M$5L/B)UX;UCGKB?^OEC[827/YT(_/]<WR>SAP2M>S3AV8?"-Q]>GCW\ZDO+E
M_M$OG`V@3#"I1MQ\\=&C$8"9%3C>@?.MU!\NK_A'87H!"NC2<IH9B."#'KHW
MW'W?.6C?AT7P5Z%_LU$WG(,DYM>>4F/$&-Z+-,(X!(HIGK=B1MO5TZ&-(I;(
MX((N=D@DCD+HN.-N/6J(H1PF$G;D@U0F:-Z0]55IWY4%1J@!DTV>]F1P44J9
MI)<@EG@EDJUQV=Y[V;U6'9@8B#FF:&7>AET?WL7XIV9^;@=HG?3]>9^@-^+A
M7)ZZ[;E?B"'*)N=QTL4IJ7*37GIICHTZ"JHI=,9FFV77D?HC@O#)9VFIGDX8
M:JRR9H#GK+;>"ABLN(;:JJ"G_FIG,[7NFN*!JA+H_IJ)?GU*;),E[5357ITM
MJVNS%;+UEEC9XA78L-9"A^U$VXYK%K5G?7LMMU,9Q6YN67;E+;JF]:57N]&6
MYJY7\<H;&KUY_6M5OO`R6\69!A^,<,(*+\PPANK>NV[$TR+7<,46JT=7M0GQ
M6PJT?.T5[!YV[FL(QQV[)6[*(8L\&L$;FSR*MBJC+&S+&D]!C*O!08CQSCW#
M?*[']4I<LPPD-Q',I&:F^C.E30/]E;'(6G;-R"[CO`M[$!ZJ-3!^0FVRU3<W
ME'6212J[-=@PBWWN/L:A#?>I::O-,=N>M?.VV5,GNV"B2M.-J]TKK&P"+4*:
MJJJ<(#('^*V"9TQ4WDIN_MKJFHW+^W@*A)=@.)*,O&DHII=C;G/;D<.F]]E=
MLO?TZ(YF+HK;DB/JII6L;^ZZ3;"?@/M:6=M69XN<"I^[M;L7CO?OGE.J(8&M
M%_]ZZ7?+#GWUO$L_>/+6;^^[T5>3S7WX(!S/N?;BGQ\F]I`7W'VYZ(>MON;F
M?]#7^_R23T+O(@!5O_WHXM\^]NWO8?XCG??&5I$`"JR`NP+@`*DW/@(RT'CQ
MB]WI0M"_"3:P@M>#(/TDJ,$-'M!T`L0@"$/H.`XBSX,>R"`*9^5`$[)00NY[
M80I'.+T+1C`R-B16#'=8L.?1A(<]#)P*RT>4*&GG8DP48A$3\<,/)G$F+OS'
M_A-)$<46QNR$6M#?%1F%P^Q5@XM6_&(TCIB_+1+Q#EXTHP^R2,-.5'%^;J0$
M'#DP,L:A+E=OHA49Z5A'2=QQ`WG\V^?DH27Y#+&&-PDD)@:9/J/-J&P,JI0U
MYCA#1RX"DGZ4)-Q49SGD=)*17-`D-M"HP%=XKE2,(\,GG;)&.[31E#?@Y)U&
MTR?$(6Y5G=(2!3"I0UIN$I4/C$&G#%49WPP*E#_Y8R:%20A;7J"04BO'AJ"T
MJE'BJPZSA"8QD4A"YP"):6I:U"13IT9O*D*:%LACWYA'(]`MRI<G4^<ZOPE$
M&,A-1,'3V:"PY`Q[WC.,ZQ,GWS(%)&XILYLG$B@4_O$I16.>0F?T7"8SL>A0
M1+"S`@R]2$<S6E`$=C`:V60C2*,)42V>L3.*!.1)99G2.#X27TXLV4O_L-%?
MKK0V\;BI'W+:3$ZLHJ9(\^E/8XI'.6Z%94;MJ3&_)\BE.K6IW$0J(97*"*92
MM:H$E9]0W??15&[5I6(,YREO%-9BCK6+5HVD'$FEU;66\:DBM55:Y7K5KEJ0
M@GB=JSZA>D-`--$,!J2K644H6![<U1]`721?$TN9POZUKC!$:63_UU9M^O!=
MC=3!8OO1V*`\]K,R]*QD`;O"S6Z3JZ;%K%Y':L18LC8'I(5':&$96V>6D+:G
MI6P:<YLKF%XVH%-%+3@K_HO;SO)6%:XBZ@\@5<K7IE9621-N:Y.JGW=&)6#*
M->YOJ<O1V>*`'U9Q[G-7&UW#YC!_+5UA'[$:WO0N%[L\,>\;2Y.<VDI5O67=
M7R]C)[6OWI*MP\UK(O6;5;<8!,&(Y&](6[C/J,6SO0/5[&['"V&X"K`ZL@6?
M@[WJ7U)RSJ*BG"E]@UE++;[W91)9H$T_O%?Z84Q-P-L0J\XYSV&J%,4V(*\Y
M3]?BB7EXLH?%XU`WTRM@\5)I]B5P1%]6X%'&9Q_6(4B0/9'9`6.P3[\2G=\P
MY9"*,CC&.\;:8$Z<DC$?<F<E'K)WQ6ID7?;-FFW23_!XUDHU'[>T;KZNEG4[
M_I3;[G=\"BI4,HF7W5V6]!NPC<I=5`OC1D-X:L"2,Y@K"5"3)EC2(KZOIR%-
MY/42VE1<&]'M</3/BSJYP]_E67/._-A0]Y?0E%L:Q4C\WH7B%-!/)G5#%>O:
M2$_7OTVKL1!)_,I5<W;/>CQOE&6A9]$*>\_]<G%J#>GL^=J"PHZ6+K6K;34<
M@Q'#OS36A3[';9)\S*]O5BN9:E`&=9/[)]UA<K/%O1^51+O!LGZP9)",2U>^
MJL?MK'>F4*VXC-`,RENA:+*%3.:*-!EGJ8G0&>2=8GJCBE`P"G!1Y9M@"J?[
M:#[:=YC.R9^+#SSCL$DHI9<G9BR#G-_++G:[^63R_CL)'.(C1L/*6;[F11\8
M;1,G^,R#R_,<=_K;"?RIRM&[EC4L"=AK/C#'\R//%[.[P95Z^+);S7!9/GWI
M&5;#U*F^1+3"_'#TS/?1E]B;^CIVUF;F@]0E:?9Q/_O6BDK3,N4YYIS37![O
MP>_<_=UM+K"AEF.'>K^UK6A$X<<[HU+ZSY\I(RYS%^ET[W,[[M[CQG_=MYG8
M8Z)+?>DY,UCPG.?ZUUH/^X@WG9MI&,S.1T]Z;Q>*-_FES7]?K6R:#RW-AP?Q
MA15/V#>B'.U[/QLY;NPK-;,>T`"A4_%EGWBQQWM)%8=U\UDQ?59W'OLRK\3V
MN4^E3T,>VMW-/9_#KOW?_NO]^[I71ON+S.G9FQ3?4Y]E[\(/;_<G:HA7?M:%
M;>7V,T5W94`7@+X`@(YG?..7?=W5;`C84NF67+CG?A'((H/E@;4'9Q(X;'5W
M?PX75$K79,"T@1Q('@+F;BM89O!'5ABX:=/2-=,T>*6W?K?A@GRF1S]8<?YT
M<SPH@-8F;1&1<'_&:P0X;9<750'42](Q25$XA&X7?.R5'&2'9ED&=E9X5FJ%
M8S,R/)M2A:;P=E#X>A`8@_57AO1783[(99-W=1.FAB%8@#S&;!,#&2OC18'7
M@_D48$DX=)/7AK^&>0J4AD:XAH5(?D[X"$TQAUZ6:"\B'(SHB!-H?%=&&L'2
M_H<?9V)@6&A1F#C6!X/`)X."`#SBUX7XQX4Z^(EPF#9_8V[P88EG=XJ[UH2/
M9XIVU&HE=8''$GOYAXEWJ%&Y6(M&]XJ`N$H3!7-:^(*>YXF,=HRKN(O<T(L_
MHB1J5X,BJ'7$J&.LR(;9]H5P6&M>\THDIW#Z9XW@:(SBR(MHV%S,>([3Z(X@
M`5],V([J]X[/.(`LJ([I&'7EU'!P-XIHL8E%ET]$F(R]5HI;"(UFV'-(MCR@
M@U`5*%/^F(_>-XX)V9`&=GQ>&'79(HA9IWKRMXC"2(^M>(47R8YVV(T@&9)S
MTW=3@FQMQY"-V(_5&'\?R).@%U]XB'&%DVE!R%-4_C.((XB2+?EH1W5]#IF3
M33EHMS@X:(**F$%G]<9[OI=+FM.3#!.-Q;6--_F41ZA3AXB14"EC5NDE=4:0
M2K:'2GF6EWB&JNA6NHB6.?B/':F()\=3;=)/<OA/")F!<3F6<KF22UB6&>F,
M=/F5TVB0U6=P@8EU?R>8>(F4BNF&6V>9'FF)T@"`G'B2DY9V;38W7D:#2DB8
M<*F/FD:68LF-47F"'ZF:L"ECO.=KSA<ZI\>10OE_C6E=Z$:-KQF6=VF/*JF!
M'/5\YS@\?/-^.&F700F6C,F9>NF99"6<B3F5R,E*CO$<G5B<3+F9H8F/P]F:
M#WF=V/F(*=F<$`F>B(F:_K.YF/$)DWH9GI!%GTQGB'$EG4YYGNZ9="]YG\%H
MGP'JDK:HG_+YGH5)F^69E_`9F^,0C@[J9]&YEW79F0DZC!)*G$4XGNJ)F0VJ
M;R:(H1TJH.29H0HZG0=*H/R8GQ0ZF;N)HO59HKZIH0_JHC&ZHA$JE4?)DCCJ
MG\<YGS5JH^+UH<ZYE"IJ92**@SJ*H/])HSYJH1PJI/@)G:SYHS_YG(.YH2UH
MG`MJEE#:GQIYH]S95M7YI4FYGG4X;S,ZI<%9I;^YGRD*IFH:IPI9I!AZF@UX
MI53*I)EIG8%)164ZH@#:IEAZFTZH/]X)D$CZHJY)HC_ZF:XH:A8IIHJZ@SI)
M_J0T":-AVJ1`RIYWZE8'F&UM9*EV.J84PZ*/6J=T:JH>JE/\QRC^QWRM"J>=
M:JC4.:A/RJFT9I+U>*F22JN96J$Z9W'.9:9`N:MEUZN>94VKB8Q<VIZK.DV5
MB8`6MJ7!.J?,=7Z0T'VSFI9=^8'"&J)YVG(2=4FY^IV@2JS;2AG+YZ=+:JW5
M^(`0R';QFJQ.RJ:+FJ4!*7J,%X;OVDYRVJ*>JJ^E:9/H>ID,JJ4@>J_KZG/^
MRJX$BZ8(*Z-'BJ\GF@^4:J^J.JP=BZG9ZK`/"V_]*K%\NK$*6Z7SND"?<4?'
M*IL@&[+)9ZX@:+&.ZC7+RI4X"UW(NHDQY;([FII8_ABQ%TM(BS=_-KLWV'@6
MZG&!TEJPK-JCG/JS)+BOO!FQ+.N3SAJU1*=J6T9O$J2R20>H$YNP^>JT`YNC
M)_>OGD&S-2N>`D,.1EI#._NRVNBF0>NQ)6N8>%N5DB).,GNT;SMC5>>U.K=-
M85MSS;BICSJUYLFQ.<MA^@2X;KNUW+&P40JO="N58RNW=PNU>?NFA4ILP_>W
ML.JMH6DX*!NP*J6Y5&NK_-FAC<NPCRNZ:HNS:PJCO*"[:TBN$`.Z04JTJ1JT
MLHNQM)L]X7:[N"N6NZNZ-MJ[Z_:Y3_N[A^FEWEB[Q61QN_2Q*5I=UPI[Y"J$
M'(JX\'JKCLNWX80G&CNA_@R9,^A9OKIYLX<KKL$;O]5J9,@@<A2+K0V+E+B1
M(-3:N>[;OD-*P-S&*F>[O_0K'O9;M/C;,\1KO3"+GRQ;OZ&+9OC[OI?[BT/U
MNI]:P07GP.Z0I_E+OD`;P'%)IB:JM1>,36W0J<\7('.'N-VKO],;O99;PJZ;
MML;KO7NKA!?B!F<+PT;YH#-,P#VLMTV*PZN+K#S<ITALH("8E5G;L<RHI/QF
MQ%"LP$E\PY=;O80JP4_\Q=)[8C!,Q54,G!Z9Q<VKPA7+QHP)P6#,OUT:?I#H
M>$9KMBN;@M$+K5[LQWD\QLX4Q[KJQ,"*N;.K34<FLH#,6<]K>%+*QUNL$,^P
M_L09',%S;,@YK,-QQ!TD^[E67,:T!ZZC/+1OW,=52[E'C,A_UCFWY\9Z#`YQ
M)XTUO,6,S,6O#+R8K*=,;)UUJ;NFBZ"@K,;I>;*V;,M:$:E=VJ=A:\=[F;R>
M*LR^3,RT?,N2;++IBLI1_,>K3+XY<\5H?+..+,O?J,G;C,3(W,OGF\H(G,":
MY<T#S,LOA\&1G,YM;,S^B<YG6K:Y;,,>W&L%&<1\/,1[XR&;9UG4/,GEO+5R
M7,AN.+ZUG('SK,HFNL&4UL%P9VF^.M'W[+3YW,3JK,W]S,\6!L^F?$(&_)>M
MNZ3=0<\-2\E(NZ>!3,:ZO'</+=*R5=+F''LT"!PJ_AW/*BC&U5S,UPNPUVRJ
M-GW3C$3#.IV#IVE(@;I:#)4-@D;-:$O4\X7428U>S,O48>G4`'?11$22?6NP
M]$S5"GW)#7U>6:W5^<+5,CV87^V[$!W.88:*^,6TATS3;TO((+V]D(RG;&P1
M"9T>`Z1,LR:(KWO6\;S)81RX5KJXE<S1DTTN;5V3`/R]Z#35RBRP:>W75EVK
M@CM1A#MJAIL;4,U//;M&>3W4^[S#Z_O:L`W9,!VWE-W5>LC.G.=RG3?.>[K8
MELS0GVW!\ZO77%O6[/6U./V,SVRMO<W.O^V^YGO"_GRCQ>UJ]879:;S`8/N1
MSJW8G&W=?3W=?SV7X=V6_MFM<:**VPD1,*/=VD:]UZ=[U;(=V@M]V\\V?576
M:9L=U`6*S:Y:U!]=U6U]-77,'.X]X'P]W\H;V[]*W.]MVX:\QO=-X-'=WX_M
MV.L,V--*RH,US6@MW/X]TVJMT?6=R>1=C!`NXO$=X"M^RHP*WAH:CP\,F>@-
MW'#MN0O.@`!.WP^>S2O<<,:6A=H5>;RJL?RMKFE:O"$>TK/]K"UGXS=>E*F-
M>M"'3@Q\W;X=XPG>Y!E>XCY^<\"<C0IN>@4]3E-.Y,B9W-]]X4KNV>,-VF">
M>T.NW3E>YFQ"46,MY<JMXL+;X#O^YX#NY+M,VEB9Y79>YT1\;YE6;K3BW1;.
M_N*='=QP/MP;3GI9)SR1N;B45)J+WK6VO8`;3;:1[N!14\<'7>KSU$]7Z9<(
MV0VZ9FO'?6Q2A.0_SN0:[N4M;L)OANF$$B@*J+;;72,VAB5OG>8T4>L\WN<H
M3NJ$#N/UU^L-@FS`3JS"#F:4Z2:I2]#-E.R!SMC2G>L,/N@G3G33[G*)O>SP
M>V-&>6>JIZ7@Z\AT;=\Z_N3D/N+EG8N5MWM?-N:0CFYJ>7"+HY64"ID:9]9;
M#N)(T^$+/P>H(=]9?DV_GFKSCF=!Z+?_KGD,BM)`'=.PJ^P?7A:EBO&6E"I.
M`],67-'VC,M^3N_D'/(/C]&IH^DG?XD;I\70+>K#_F`7(F_:'P]8,WGS"/_M
MN<#6U-OF!SOJ_A[6L"S.7.[QWHX:4>X-/,_LKQH4A,T;3Q_AZ0[?]2085!_G
MF;M?/O;!58WS6OR'YI+J&%["M=W/T9SN9V_2&/5OL_K-5VZU+0%"_2,@6M_Q
MD@[U`[KS=@_O=Q[%;D^_<&_V0K_G]E?W-3VM06Z%'*S`BI_P6^_T;DY<7W^Z
ME*S(/)BZ+UWVE__WYCV514_I(L'S<7BH78>JLB'M/?["(Q_WC&_PQS`9(K_J
M@'H[%M_J&3_N0#_W+>WWINZ`N>^MH:/\N7EJJ7?W#VGS4WZN1_\1J(_O_=;N
M=&AU%I5P\?[?1'SHV37]_DFN^LB/WYS;_9K'_1PG]1J]\:+4[2UO6^:_OI8T
M),N__MK?_EK+T\ED^@00'U,W@5\!.2&3SX5[9JX?#,61'+T23=65;5WLC;GH
M-"Y*V_0,W_E=%A1":K9-J'-,%8=$5A*'9-J,G&03FS5IN5VO=_J%(3JYLCGJ
M.Y>A5O&;5(R"KF$ZO/&$*BM\=^X/$&_PQ8[P$)'+D+"&[<Q(Z0@($G(Q<5#.
MCXA'8\4RZQ.C,513L+3T,G4A5+75]>ZU,W86C[6/2L562+=AU(KOJG=OE9<6
MS!@Y>76V6-D9]FDF%[&YBK+28UBX3?A9M=H['`M\7-R\!?4CTI-:+]CZQM'"
M_IKFO-T>'Y,YGW^K1([=(7#O*%%(DXD;&7+]4"QD^-!)+(<0C:7KM6R:0#UF
M%-8YX6?/J(D4U9$T&6.DC)0G7<WI-B\CHXT<L042=/'F-9:@=O9LN*^AR%\6
M?38)N:C:RC@S:4KZ05#:')=%55*U>DOBDCRX/EY%EO1>KH]JG#K0]*,C5*]:
MU[;%]:I85VD1W,(-*-.3G4<XMT;25O<G8*]*733+!DUP(K`:$Z\EW#AKY,"6
MB$)6=%>?9:N/-7\#.AEQ9SB+\8KNR=ETV)89D:;.S+:T:Y.H9=?Z_.\M,9][
M10TE!G*J3C*8;=>>;1PB;=BX9<VMG"\AFD#1_Z(!_GZ6^&CD))5O[]*=>>#F
MDTYG,^]TNOGT-BMA7%[<.T/P\<<]%Q-W;%G>)_6CU9VSA['28H*TU^B#[L!^
MY@LM0;Z".<4_-X`Y+Z>YQ#.P07,6S'"75C;<Z2".SB*OB@G_P"XF##GTYL,5
M4?+,19OB,2N_LGZID#P4W],NQG!:[#&:5'[DSA?K!CS/HXO6(#"[-X8$\I^C
MI)R2RBJMO!++++7<DLLNO?S2OMI<(LN"_N)1,B2Z4H0/RC;;?-+-J?3K[26_
ML-FO0#;=W--%.*$,;L[<3+F1'@C=NU!//A4]T$\@TZ2GJ;^H4XL]09=B;-%,
MXVO444D-(6@_Z>C<:D<G_C4]5<PP46TK3QY7?=4R3F&5#%%79[W5+5EQA;'4
M^W;]=3!@-6O55&&-!?'8QHCU-=EFDW,6L&6_T!7::L.S]BIIC\&66Q:[S;9)
M9K\=EQ9JR1U"V^_.77<U=EE*]S)WY<5TWF?7M+7>?-75]R%XM3"77V<!#KC,
M+4NBE^"$7U2XKB>1"BY>OU1E>+N!*?Y7-1JBV]?,B__T.)DK17!8%`JGC1`]
MD/M4&5R$%2(5C`CY8KE!BVFNRF7AZE$C+0E'K*[2F[VSF>:CKDT4TM]F[&\H
M.1_M2.B:HSXMX_0.F@1K_R"6^>6I&?7ZW:H+?21`&LV.5&?KG`;[:[:Y$[O"
M_IO,-'O)M)].VVW9B,[[TMBZ)E1NLO?RX;\)]^9;2,3[A3OPE`-_'/*^)%:\
M8LH59/QNB<L.,&B9[[9\6-`1S+EG=:2">`S-0Q5=L,-9/Q3IU_5U7?;A2*]]
M7MIQ;TY%@2:6U_!Z,M0==Y*_^;THU'TD-3\.B:_=>"&1I]I2V.VRL$BI=W\F
M^L1%$Q"KBBP47OOME>G^DN?C'9_W]B/[5'WOS0^9\=X3:X3WITS>):[J;1]^
M?N>K7^Q:IQY9:(TKZ$(>)R(2)>4=S![Q8QWZ%..:!U&A*[19H/_8AX3_Q6%Z
MZ0L@_6YGO\XPT"S#T6#_VH>_PN`FA>>0H.@H.$!E_A$J@XI@X7A<B(Y+,5`<
M,P1=#4MXP[_5H8,O#$KI/B@6?XQ'0R/\B@V+]3V0P&1U/A1@K[@G1?$5$5_?
MVIN_ONA%6A'0A-:R60C=MSPSGG$T8)(CI;AE,3:VT5MOO)X>1:BQ.5KI/T&*
MX!\)64A#'A*1B53DE_A8QFUMXX%C:.0D8]1##J[OD>BBY"979$D\[FM:/.'D
M*-LVOA\MB#-").4J(Y;``_H-DQUBY2Q-@T)7GK**FJ3E+F-U2U>>+(:^V88?
M?X/!.ZJ)E\F$#B-?V<Q%4NE.(CF=X):D2&5>,X(!L64S@7E`3ZUG;'2))#;)
MN1MM^O*3L:1)."%%HDN6_A.>5%G,-H$8QFFBK6M7C.<^6:5$4\+R.HZ#!]GX
M6="6"5)0N(0:)-FSM!X8%*+FU.(_,70=Z9BH9ZJ,Z$:M1Y'F_:U$V7N91CE:
MTG?R`WP@!82==$-2DW+4I>YQFLE29J.8OA2B-V7>%#Q%S37@%*@RI!X'\30F
M@@85J5U$EKB2VM1R#3633I6JAZ`*RJE>M8]A8RI6N9K&RVVUJV$-Y5+'RA\Z
MKM,9,PTAA`"5Q2RB527'-.O^2M8TG<+1H\_<6%[W"E>4R!5PT11IR1#"&Z!%
MLV"%L!$ZBLK&<18LH("[VN0$JZF[^C-61ELH_U(RS9[J!2J:59M1^^K7)2S6
M_AV&<^ST0DM-R0YN;H\MWPD!*Q^FQ2P(I-7?9I46/)U<K4YL52QOQ0);V98I
M+\:U3T*`6Q,^7=8=M)6F2D'JUDI9-['"%,Y;1;5=@VCNM74=V:A,R\3>(DFU
MPZ0N=ID+JI2VEZ[=?5-JCIL\B_[VH_`=;<<*(MS`HI6[QNT&:>T*6OW^5VV(
MA608X#M9!^N/OR)R*'KW]^"G(+B^0[.@%0E$.`!#N&/<^*Q_VV,Z^%'V1@3>
M+UL/[%<15^>P*:9P@2O[XG?8N''-7>=W+XRW#",'N@B%3%M[W-RR.==(D8*P
M>/%6S$V`MST^%2R+<9RTIDT9A\+E\8Y]<^0D>_G&_C.2<(5MNF4?U[:7].6P
MDXV\M&L(N,2;>S)QF9S=(U53&YYU\IL]K+'-RKF\6S;S@$P[63Y/3M"H;?/9
MSAQDKT9KS7[>,>$TJ^(5-SFPCWV@6FV<9]^^!+^,EG2HL<QF&H4:SRBNM&_/
M-&DR@SB^F';>AJ5+3%<KN<JO]?2)Z6QG7]]YP?$ELG9C_&&:?B[+8![QJW-]
MZ#[K^,$8_K%Q''VO^]W7V%X>-:GW[&M`;;O;O_[SIQ>J7%3<\]!26#*N7:SM
MK;&ZFKK6M8X1W*-J<[%AJLOT@]:A,WK'&M3>17&=E0;9<?]L8V=%MY*;6.Y%
M-YK;;U&Q:R/N6;J>M9.T_AZ6E'@;YETS=-6\OC.<YQSL&AD6V0I6+V1[C&LZ
M0ILLFTOUI>$*\U?OV\+<G;6:I0LTBP/;;C)'+<%%*U]Q^[ROQ4YPP9_<<@LS
M.411CGF-5&[IJ%<\O5.^-R;TVG6O?UWIP`R5I:]L8O0&I;#8+OF1_'CNMVX:
M[GWN[=I-A^KI(IG@:Z<W8:<M5@;96U5]EPC&_1ZUK<<1A"XE?.&%=OA;Z9SQ
M-W-\Y"F?S<I?7EF"ER7F.9^K)**Q\Z&7:%9%7_K-\,KTJ2<KZ57?^GY]J$NN
ME[V&)C][VUOU]KG?N9,`J7O?M^NDOQ?^D#4_?.._JNC'5_[RF=]\YS\?^M&7
8%?[TJ5]]ZU\?^]G7_O:YWWWOOZ$````[
`
end

==============================END UUENCODED GIF===============================

EOF