textfiles/phreak/BOXES/red8.box

Phat Red Boxing
by: Bungalow Bill
thanks: dave ferret, kops
hello: epidemic, the l0pht, the teriyaki kids

Ok, now I'm sure everyone around has at least heard of the mighty red box 
and all the cool stuff it can do. But I've yet to see an up-to-date file 
that explains completely how to build a red box, how to use it, and why 
it works. When Resist0r asked me to write a file on red boxes, I saw my 
chance. I will show you how to build your basic red box, some cool 
modifications you can make, and tell you how to use it and why it works. 
The standard disclaimer applies. Don't do this stuff or you'll get 
arrested.

What it Does
<><><><><><><>
A red box allows you to make free long distance calls from pay phones. If 
you know what you're doing, you can get local calls to, but it takes a 
little more work. A red box is really handy when you're out of town and 
you want to call someone for a few minutes. Longer calls can be 
irritating because you are continually interupted by a recording asking 
for more money.

How to Make One
<><><><><><><><><>
Lots of people ask me this, and lots more ask other people this, so 
here's the easiest method to make a red box. It costs you some cash, but 
you'll get it back. If you don't, it's not worth building. If you have no 
electronics experience, don't try this. You'll break the dialer and have 
thrown away about $30. Get a friend to do it for you.

Go to rat shack and buy one of their 33 Memory Pocket Tone Dialers. Don't 
get the cheaper ones with no memory because you need the memory to make 
quarters and save time, plus it looks cooler. If they don't have one in 
the store tell them to order you one or you'll castrate them. It should 
cost you about $25 (the dialer, not the castration). Then call Mouser 
electronics and tell them you want a 6.5536MHz frequency crystal. The 
Mouser part number is 520-HCA655-12. They cost $1.30 each. The number for 
Mouser is 1-800-346-6873.

When you have your dialer and your crystal, get your pretty small 
screwdriver, and your soldering iron. Unscrew the six screws on the back 
of the dialer. Make sure you get all six, you have to open the battery 
case to get the bottom two. Keep the screws in pairs and remember which 
screws go in which pairs of holes, because there are three different size 
screws that they use. You have to use your pretty small screwdriver to 
pry apart the sides of the box. The speaker is wired to the board on the 
left side (when the back is facing you), so pry and lift on the right, 
being careful not to break the wires.

Once you have the dialer open, look next to the little black blob of 
silicon in the middle of the board. There should be a tiny silver 
cylinder there. If it's not there, it is sometimes placed on the top left 
of the board. In either case, it is glued to the board. Use your pretty 
small screwdriver, an exacto knife, or a shark's tooth (minus the shark) 
to cut between the crystal and the board, so that the crystal is free 
from the glue. Then use your soldering iron and desolder the crystal from 
the board. If the crystal doesn't say 3.xxxxx on the side somewhere, put 
it back and look for something else that's silver and cylindrical.

If you got that part right, the rest is easy. Take the new crystal you 
bought and solder it in where the old one was. Make sure it fits 
comfortably. If the case won't close, remove the crystal, solder two 
wires to the contacts, run them out the middle left vent on the back of 
the dialer, and solder the crystal onto the wires, and then tape it to 
the back of the dialer.

Using the Box
<><><><><><><>
Turn on your dialer. Store three *s in the P3 location, two *s in the P2 
location and one * in the P1 location. Now push P3. Sure sounds like the 
tone for a quarter, doesn't it? Go to your nearest pay phone, and dial a 
long distance number. You should hear a recording that says, "Please 
deposit $2.75 for the first three minutes," or whatever the price of the 
call is. Press the rubber part of your dialer against the mouthpiece and 
play your tones. If you get an operator, say, "Hey, my iguana came home 
late last night. How much do I owe ya?" Then laugh, and hang up. 
Otherwise, you should hear, "Please hold, connecting your call." You will 
be put through and you can talk for three minutes, at which time the 
recording will come back and ask for more money. You can put in more, or 
hang up. It's nice to remind the person you're calling that you'll be 
interupted, because they get suddenly put on hold, and it can be 
confusing.

Why it Works
<><><><><><><>
Pay phones are connected by a special wire to the central office, and are 
designated as being pay phones. When you put in money to make a local 
call, the signals go through this special wire and that's how they know 
you put in money. But for a long distance call, it is left up to the long 
distance carrier to determine whether there is money in the phone or not. 
AT&T uses a system called ACTS, which (I think) stands for Automated Coin 
Toll System. ACTS listens for the tones, which are generated 
automatically by the phone. When it hears them, it just figures, "Oh, 
money! Ok, connect the call!" What you are doing with your red box is 
playing those tones for the computer, which doesn't know the difference 
between your money and your tones.

Cooler Boxes
<><><><><><><>
Now, this red box design is really basic, but it's no fun, because you 
can't use it as a tone dialer anymore. There is a way that you can 
though. When you buy your tone dialer at rat shack, also buy a six prong 
DPDT mini toggle switch. When you open up the box, remove the old 
crystal. Solder two wires to the contacts. Run them out the middle left 
vent on the back of the dialer. Put the dialer back together. Solder the 
two wires to the middle two prongs of the switch. Solder the new crystal 
to one of the other pairs, and the old crystal to the pair that's left. 
Now turn on the dialer. Flip the switch to the old crystal. Wow, DTMF! 
Switch it to the new crystal. Wow, a red box! You can even store numbers 
in the other 30 memory locations and dial them with the dialer, so you 
get more bang for your buck! Some people glue or epoxy the 
switch-and-crystal unit to the back of their dialer, but I just used 
electrical tape (red, of course).

The only problem with this design is that it is quite obvious to anyone 
who looks at it that the dialer has been modified. Here's a way to keep 
all the electronics inside the box, and still have a combo box.

When you call Mouser to buy your crystals, also buy two mercury tilt 
switches. The glass type are the cheapest, at 66<36> each. The part number 
is 107-1003. Don't buy the DPDT switch from rat shack.

Before you open the dialer, make the following circuit. Solder a wire to 
one lead of the first mercury switch. Then solder one lead of one of the 
crystals to the other lead of the mercury switch. Then solder another 
wire to the other lead of the crystal. Do the same for the other crystal 
and switch. Now solder each pair of wires to the contacts on the board. 
Make sure that the mercury switch connected to the old crystal points 
towards the top of the dialer, while the mercury switch with the new 
crystal points towards the bottom. Also make sure that none of the wires 
or crystals are contacting any of the other components on the board, 
because this could cause a short circuit when you turn on the dialer, and 
might fry the electronics.

When you put the dialer back together, turn it on. If you did this right, 
you should get DTMF tones when you hold the box one way, and red box 
tones when you hold it the other. This way, if a cop or somebody searches 
you, they have much less of a chance of discovering that this is a toll 
fraud device, because it doesn't look modified.

That's all there is for that file. Hope it helps you out. If you have 
questions visit my web page, http://www.tiac.net/users/julianne. Phreak 
in peace...