389 lines
17 KiB
Plaintext
389 lines
17 KiB
Plaintext
|
||
> Anyone out there remember the Cheese Box. It's a device that will allow
|
||
> you to dial in on one phone line and connect with, and dial out on another.
|
||
> I remember a schematic for one many years ago in Tap or Yipl. (Cheese Box
|
||
> were commonly used by bookies)
|
||
|
||
Here are two schematics I have for diverters... enjoy.
|
||
|
||
*-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-*
|
||
! !
|
||
! The Dark Side Research Group !
|
||
! !
|
||
! Proudly Presents: !
|
||
! The DARK BOX: Multi-Purpose Network Manipulation Unit !
|
||
! !
|
||
! By: Cablecast 0perator !
|
||
! !
|
||
! (]<)0PYWR0NGDE 1987, 1990 DSR/ATR All Rights Fucked !
|
||
! !
|
||
*-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-+-=-*
|
||
|
||
|
||
|
||
-=> Introduction <=-
|
||
|
||
The Dark Box is the newest device to enter the "colored box" market
|
||
and is guaranteed to rerevoloutionize the art of telecommunications
|
||
fraud. The device's inventor, Cablecast 0perator, became quite bored
|
||
with the old forms of phreaking, having to worry about codes dying,
|
||
or being traced. The unit you are about to build was spawned by the
|
||
need for a more versitle, safe and interesting way to phreak. You
|
||
don't need any special tones or attack dialers, just your good old
|
||
every-day DTMF pushbutton phone.
|
||
|
||
The box's basic design allows you to call anywhere on earth (or
|
||
elsewhere for all we care) without fear of being billed or traced.
|
||
But it's uses do not stop there! When hooked up properly, it can be
|
||
used to emulate multi-line bridges, loop lines and direct in-dials.
|
||
|
||
It's really quite simple. The device is plugged into two phone
|
||
lines, other than your own, or one end into a phone line and the
|
||
other into another box. When there is an incoming call, the device
|
||
senses this and picks up the phone. Your call is then transferred to
|
||
the other line or onto the loop. When you hang up, the device senses
|
||
this, too, and it hangs up also, waiting for the next caller.
|
||
|
||
To illustrate this, whip out your good old analog multimeter and
|
||
hook it up to your phone line. See that nice, juicy voltage on
|
||
there? Now call it on your other line. The voltage will jump and the
|
||
polarity will go all to hell. This version of the Dark Box uses
|
||
an alternating current detector to tell if the phone is ringing
|
||
because sensing voltage is unreliable and not entirely universal. Now
|
||
pick up your second line. There is a momentary blackout on it and
|
||
then the voltage becomes constant. Now hang up the phone you called
|
||
in on. There will be another blackout on your other line ans then
|
||
the voltage will pop back up again. On the box, hangup is detected
|
||
by the line current passing through an optoisolator that is holding
|
||
the relay open. When it is cut off for the split second the blackout
|
||
occurs, the relay is cut off and the phone hangs up.
|
||
|
||
NOTE: With the rapid expansion of digital ESS's, the little phone
|
||
company quirks that are essential for the device's operation might
|
||
not be available in your area. Check your line with the meter as
|
||
directed to be sure!
|
||
|
||
-=> Trip To Radio Snack <=-
|
||
|
||
On your next trip out to your friendly neighborhood Radio Shack, get
|
||
yourself these:
|
||
|
||
1:1 Audio Isolation Transformer
|
||
555 IC Timer
|
||
Optoisolator (Transistor Output)
|
||
(2) NPN Transistors (2N3904 or 6 Will Do Nicely)
|
||
(2) 100k 1/4w Resistors
|
||
(2) Normal Diodes
|
||
1k 1/4w Resistor
|
||
10mF Electrolytic Capacitor
|
||
Disc Capacitor (.01mF)
|
||
DPST Relay
|
||
9v Battery or Likewise AC Adapter and Timer
|
||
|
||
It'll run you about five or six bucks, unless of course you get a
|
||
five finger discount...It can be mounted on a small IC perfboard, or
|
||
whatever you like depending on how small you want it.
|
||
|
||
If you can't display the schematic that goes along with this, we'll
|
||
do it like connect the dots, it'll be fun!!
|
||
|
||
+ O P Q
|
||
_________ ________ ___|_____|_____|_____|___
|
||
A -|o |- H I -|o |- N | C |
|
||
B -| 555 |- G J -| OptoIs |- M | O DPDT/DPST |
|
||
C -| ICTimer |- F K -|________|- L | I Relay |
|
||
D -|_________|- E |___L_____________________|
|
||
| | | |
|
||
- R S T
|
||
|
||
This is the wiring diagram for X1, the 1:1 Audio Transformer:
|
||
|
||
RED --(white)--------O||O--------------(red)-- YEL
|
||
O||O
|
||
GRN --(black)--------O||O-----------(yellow)-- BLK
|
||
|
||
They don't have to be paired exactly like that, just remember that
|
||
white goes with black, and red goes with yellow.
|
||
|
||
Text coding of the schematic is very simple. If you have ever
|
||
assembled one of those 1,000,000,000,000-in-1 electronics kits from
|
||
Shack, you can do this... I will guide you with TO and THRU. There
|
||
is a difference:
|
||
|
||
A ----*---- B A ----- R1 ----- B
|
||
|
|
||
R1
|
||
|
||
"A TO R1 TO B" "A THRU R1 TO B"
|
||
Parallel Circuit Series Circuit
|
||
|
||
These are the abbreviations for the components:
|
||
|
||
RED, GRN, YEL, BLK = Phone line red and green respectively
|
||
Dx(Anode/Cathode) = The Diodes Where x={1,2}
|
||
Qx(Emitter/Base/Collector) = Transistors x={1,2}
|
||
C1(+/-) = Electrolytic Capacitor (observe polarity!)
|
||
C2 = Disc Capacitor
|
||
R1 = 1k Resistor
|
||
Rx = 100k Resistor x={2,3}
|
||
|
||
Ya dig it, mon? If this is too complex for you, try and view the
|
||
schematic through Generic Software's CADD, or try to draw your
|
||
own out from the directions below. Sometimes it helps to do this
|
||
in visual terms!
|
||
|
||
Ok, let's go to it...
|
||
|
||
<-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=->
|
||
1: GRN thru R3 to Q1(Emitter) to GND
|
||
2: RED thru D1(Anaode) to Q1(Base)
|
||
3: Q1(Collector) to B
|
||
4: +V thru R1 to B
|
||
5: +V to M to D to H to Q2(Collector)
|
||
6: H thru R2 to G to F thru C1(+) to GND
|
||
7: E thru C2 to A to GND
|
||
8: C thru D2(Anode) to Q2(Base) to L
|
||
9: Q2(Emitter) thru COIL to GND
|
||
10: RED to I
|
||
11: J thru X1 to T
|
||
12: GRN to R
|
||
13: BLK thru X1 to Q
|
||
14: YEL to O
|
||
<-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=->
|
||
|
||
There. That wasn't too hard now, was it? Now let's test it. A word
|
||
to the wise: Do not substitute batteries or other power supplies in
|
||
place of the telephone line. If you do, then you risk blowing the
|
||
transformer and the optoisolator.
|
||
|
||
-=> Testing The Puppy <=-
|
||
|
||
Now that you have it built, double check and make sure everything is
|
||
OK before you apply power to it. If everything you have is right,
|
||
there might be some wierd, uncaught error in the file, or you have
|
||
bad parts. Contact us or try again.
|
||
|
||
A voltmeter and a logic probe can come in handy here...
|
||
|
||
Connect the battery, but not the phone line yet. Your relay should
|
||
not throw. If it does, check the 555 and the transistor triggering
|
||
it.
|
||
|
||
If that's ok, short out the emitter and collector on Q1 momentarily.
|
||
The relay should throw for about two or three seconds then shut off.
|
||
If not, check that trigger circuit again.
|
||
|
||
Now plug in RED and GRN. If your relay trips, you might have the RED
|
||
and GRN reversed, or Q1 is not wired properly.
|
||
|
||
If you're ok, call it on your other line. It should ring once and
|
||
then pick up. If it's busy, perhaps D1 is not right. If it doesn't
|
||
answer the phone, check Q1 to make sure all contacts are right.
|
||
|
||
Ok, FINAL TEST! Connect YEL and BLK and call the line that RED and
|
||
GRN are on. It should pick up and you should hear a steady dial tone
|
||
and be able to dial DTMF on it, etc etc etc. There are several
|
||
problems that could arise here. 1) No dial tone means it's either
|
||
not hooked up right, or the transformer is bad. 2) If you only get
|
||
it for about three seconds before it hangs up on you, you are not
|
||
getting complete isolation from the other line. Check the
|
||
transformer. 3) If the dial tone you hear is "bobbled" then you have
|
||
a major voltage spillover, isolate the second line from the rest of
|
||
the circuit.
|
||
|
||
If everything checks out, you have just built a DARK BOX!! Now let's
|
||
have fun with it...
|
||
|
||
-=> Applications And Operations <=-
|
||
|
||
You already have the basic unit constructed. This is sort of a
|
||
Pseudo-Extender or Pseudo-Diverter. Place it on any two phone lines
|
||
(other than your own) and be sure you know the number for the RED-
|
||
GRN pair. Now when you call the line that's hooked up to RED and
|
||
GRN, you get the dial tone from the YEL/BLK pair, and it's just like
|
||
you were at that person's house using THEIR phone! But you're not,
|
||
you could be in Tahiti if you want! This is, basically, how you
|
||
avoid billing of calls.
|
||
|
||
If you want to use this box from long distance without having to pay
|
||
for it yourself, you could wire a black box resistor onto the
|
||
RED/GRN pair. It's not your phone line, what do you care?
|
||
|
||
For loop lines and cheese boxes, wire two Dark Boxes back to back on
|
||
any two phone lines.
|
||
|
||
For a multiple line bridge, you need as many boxes as you want dial-
|
||
ins. Loop all the YEL's and BLK's together respectively and plug the
|
||
RED/GRN's into a hunt group (You know, call 555-0000 and if
|
||
it's busy, you'll be transferred to 555-0001, etc etc), this way,
|
||
hackers can drop in and out at will. Didn't Cap'n Crunch do
|
||
something like this?
|
||
|
||
If you want to make credit card calls instead of dialing direct,
|
||
attach the box to two payphones that are next to each other.
|
||
That way, you don't have to freeze your ass off to avoid having
|
||
your phone number put on the guy's card bill. Make sure the
|
||
payphones will accept incoming calls!
|
||
|
||
Patch YEL/BLK into an audio amplifier and into the paging system
|
||
at someplace like K-Mart. Imagine the riot you can start by
|
||
paging "INS! Stay where you are!" The xfrmer should push out
|
||
a line level audio, so interfacing to most sound applications
|
||
should be a snap.
|
||
|
||
A word about Caller ID. CI has been introduced scince the invention
|
||
of the box. The box can bypass CI to an extent, being that if the box
|
||
calls someone who caller ID's you, they'll get the second phone line
|
||
of the box, and not you. However, if the indialing line for the box
|
||
has CI and you call directly into it and someone happens to be there
|
||
to get it, you could be in serious trouble. A soloution to this would
|
||
be to use the box on a payphone that will accept incoming calls.
|
||
Scince noone gives a fuck who calls a pay phone, chances are it won't
|
||
CI'd. You could also place the box in an area that doesn't have CI,
|
||
whereas in order for CI to work, both the caller and the callee must
|
||
be in service areas.
|
||
|
||
|
||
Don't be limited by only these suggestions! Be creative and let us
|
||
know how you use it! Make a DID for your school's PABX, or get your
|
||
VICModem to autoanswer! There HUNDREDS of uses for this
|
||
revoloutionary device waiting to be discovered!
|
||
|
||
-=> One Final Word <=-
|
||
|
||
The staff of Dark Side Research would like to thank our friend,
|
||
Rebecca, who has encouraged us to press on in the Box's development
|
||
even during times when it seemed hopeless.
|
||
|
||
Enjoy you new toy....
|
||
|
||
Cablecast 0perator
|
||
---
|
||
Cheshire Catalyst Research Productions present...
|
||
|
||
Diverter 1992. An alternative to the DARK BOX.
|
||
|
||
Design: Mavicon M.D., The Ear, Cheshire Catalyst and 2 that shall remain
|
||
nameless.
|
||
|
||
Plans: Mavicon M.D.
|
||
|
||
|
||
|
||
Diverter Plans
|
||
|
||
Parts List:
|
||
Everything can be obtained at your local Radio-Shack. As much as
|
||
i hate that store, they are convenient...
|
||
|
||
RLY1 DPDT relay
|
||
T1 1:1 audio transformer
|
||
D1 1N914 or similar diode
|
||
D2 large LED
|
||
LMP1 neon lamp
|
||
R1 10 k
|
||
R2 photocell
|
||
R3 22 k
|
||
R4 47 k
|
||
Q1 2N2222, 2N3904, 2N4401, most any other NPN switching
|
||
transistor
|
||
1 nine volt battery. The negative terminal goes to ground on the
|
||
schematic. Positive terminal to +9 volts.
|
||
|
||
Assembly:
|
||
|
||
The best way to assemble the design is to grab one of those small
|
||
copper lined perfboards from Radio-Shack. They are nice to work
|
||
on, and can easily be trimmed down to a minimum size once
|
||
everything is soldered in. The process is the same as any other.
|
||
Solder all the parts in per the schematic. The photocell must be
|
||
in a position so that the light from the neon lamp(LMP1) and the
|
||
LED(D2) both shine on it. All the polarity must be observed.
|
||
Whichever direction you put the led in, you must remember (color
|
||
code your wires, green is positive, red is negative, yellow is
|
||
positive, black is negative) the negative side of the line must
|
||
go to its negative side. The same goes for the transformer. the
|
||
positive side of each line has to be connected to the correct
|
||
pair on the transformer. On the Radio-Shack transformers, put
|
||
positive of both lines on the Red and Black pairs, The negative
|
||
on Yellow and White. Our prototypes have reached less that 1" x
|
||
1" in size.
|
||
|
||
NOTE: The entire thing MUST be wrapped in black tape. IT must be light tight
|
||
or you will have a relay that turns on with the sunrise.
|
||
|
||
Theory of Operation:
|
||
|
||
The diverter works on some basic electronic principals. Step by
|
||
step. The phone rings. The neon lamp is activated by the high
|
||
voltage(88 p-p) ac and flashes. This light shines on the
|
||
photocell, decreasing its resistance. When this happens, the
|
||
positive voltage flowing through the photocell and the 10k
|
||
resistor exceed the breakdown voltage of the base of the
|
||
transistor and switches that transistor on. Once the transistor
|
||
is on, current flows freely from emitter to collector, energizing
|
||
the relay. The relay's two sets of switches connect both lines
|
||
to the 1:1 audio transformer, effectively taking both lines off
|
||
the hook and coupling any audio signals from either line to the
|
||
other one. Once this happens, current is now flowing through the
|
||
transformer,relay,led loop. This current lights the led and that
|
||
light shines on the photocell. This is what keeps the device
|
||
latched. The light from the led keeps the photocell resistance
|
||
low enough to keep the transistor on. Now, you make you call and
|
||
get on with your business. You hang up. Now, the local CO keeps
|
||
current flowing through the indial line for about 5 seconds, at
|
||
which point it drops down for a second or so and then goes back
|
||
up. This is the signal the device uses to determine when you've
|
||
hung up. When the current drops down, there is no light, and the
|
||
photocell resistance raises enough to turn the transistor off and
|
||
delatch the entire system.
|
||
|
||
Applications:
|
||
|
||
The applications are relatively obvious. Hook it up to two
|
||
unused lines and make free calls. Hook it up to two payphones,
|
||
and red box calls. The only thing to watch out for is ringing.
|
||
If you hook it up to a residential line for the indial a small
|
||
(maybe 1/8) of a ring occurs when you call, tipping off people
|
||
inside the house.
|
||
|
||
|
||
|-------------------------------------
|
||
| | o +9V
|
||
| L1+ T1 | |
|
||
| o-------wwwww----------| | |
|
||
| | | |
|
||
| L1- | | |
|
||
| o-------------| | | o--------|
|
||
| | | | | |
|
||
| | | | | |
|
||
| | | | | |
|
||
| L2- | |---l----------l---------l--| _____
|
||
o-------\ LMP1 | | | \| | | w | /^\ D1
|
||
R4 47k * | | | | |\ | w | /---\
|
||
--\/\/--/ | | | | | | | w | |
|
||
| | |-l----------l-----------l--| |
|
||
| | | RY1 | | |
|
||
o L2+ |------| | | |
|
||
| | o---------
|
||
| | |
|
||
| | ----|
|
||
| D2 | /
|
||
| |\ | T1 | /
|
||
|----------| >|-----wwwwww---------- /
|
||
|/ | 000
|
||
|--------- 000 Q1
|
||
| 000
|
||
oooo | \
|
||
o o 10k | \
|
||
o-------o-/\/\/o------------/\/\/---| \
|
||
+9V o o R2 \ R1 |
|
||
oooo / 22k -----
|
||
\ R3 ---
|
||
| -
|
||
|
|
||
-----
|
||
---
|
||
-
|
||
|
||
|