379 lines
16 KiB
Plaintext
379 lines
16 KiB
Plaintext
|
||
Wireless Phones, Part 1
|
||
by Mr. Icom
|
||
Updated: 4/17/87
|
||
Introduction:
|
||
=============
|
||
|
||
While there have been many files dealing with mobile phones, all that I've seen
|
||
have had inaccurate or incomplete information. This file will inform the
|
||
phreak about the various telephone systems currently in use: "Cordless"
|
||
Phones, IMTS, Marine, Cellular, and Satellite trunks; hopefully giving the
|
||
reader an insight on how they work, and perhaps how to control them. In Part
|
||
I, I will discuss "cordless" phones.
|
||
|
||
|
||
Cordless Phones
|
||
===============
|
||
|
||
Cordless phones need no explanation, as most phreaks have one or two. However,
|
||
there seems to be an unexplainable lack of accuracy as to the frequencies used
|
||
on them. Cordless phones use two frequencies simultanisly for full-duplex
|
||
communications. Currently, there are 3 frequency pair ranges used by cordless
|
||
phones. The first is a 1.7 Mhz./49 Mhz. split. These are used by the first
|
||
cordless phones. Where the base transponder transmits in the 1.7 Mhz. range,
|
||
and the handset transmits in the 49 Mhz. range. The 1.7 Mhz. carrier uses
|
||
the AC power lines in the house as an antenna(This is known as "Carrier
|
||
Current" transmission). Because of this fact, the range was limited, and the
|
||
connections generally sucked because of interference from the 60 Hz. power
|
||
line frequency. While no more of these units are being made. They still can
|
||
be had at tag sales/flea markets, and rip-off department stores like Caldors,
|
||
Ames, and Jamesway. The frequencies (in Mhz.)are outlined below:
|
||
|
||
Base Handset
|
||
===== =======
|
||
1.705 49.830
|
||
1.735 49.845
|
||
1.765 49.860
|
||
1.795 49.875
|
||
1.825 49.890
|
||
|
||
It is also interesting to note that the above 1.7 Mhz. frequencies are also
|
||
used by those "Wireless Intercoms" sold by Radio Shack.
|
||
|
||
The second pair of frequencies is 46 Mhz./49 Mhz. All cordless phones today
|
||
use these frequencies. The elimination of the bothersome 1.7 Mhz. side clears
|
||
up interference, and also allows for a longer range. Another thing which the
|
||
FCC did when allocation the 46/49 splits was include more channels to lessen
|
||
interference from other phones. The frequencies are:
|
||
|
||
Base Handset
|
||
====== =======
|
||
46.610 49.670
|
||
46.630 49.845
|
||
46.670 49.860
|
||
46.710 49.770
|
||
46.730 49.875
|
||
46.770 49.830
|
||
46.830 49.890
|
||
46.870 49.930
|
||
46.930 49.990
|
||
46.970 49.970
|
||
|
||
It is interesting to note that the the 46 and 49 Mhz. range is also allocated
|
||
for U.S. Government use, specificaly the military. This discrepency stems
|
||
from two reasons. First, the FCC doesn't handle governmental allocations, an
|
||
organization called IRAC(Intergovernmental Radio Advisory Commitie) does them.
|
||
Second, the FCC feels that the range of cordless phones is so limited that it
|
||
won't cause interference.
|
||
|
||
The third pair of frequencies used is 49 Mhz./70 Mhz. These were used by
|
||
cordless phones designed for export to foregin countries. While they are
|
||
illegal, that doen't stop people from using them.
|
||
|
||
"Crusing for dial tones"
|
||
========================
|
||
|
||
Back in the early days of cordless phones, the lack of security features on
|
||
them made it easy for someone to take his handset, and drive/walk around the
|
||
neighborhood, finding out how many dial-tones he could bring up. Nowadays, the
|
||
addition of various things in order to prevent this make it very difficult.
|
||
There are three major security features used in cordless phones. The first one
|
||
disconnects the base transponder from the airwaves if the phone is put in its
|
||
charger slot. While there is no way to circumvent this, keeping the phone in
|
||
its charger slot appears to many people as a limitation of its mobility. Thus,
|
||
many prople keep them lying around OUT of the charger slot, right by their
|
||
side, so they don't have to run for the phone when it rings. Thus, their
|
||
desire for convienence destroys the security. The second feature is a digital
|
||
code which the handset sends to the transponder when it is brought off hook.
|
||
The transponder checks the code, and if it matches, a dial tone is presented.
|
||
This code is either preset at the factory, or user set by manipulating a couple
|
||
of DIP switches. While the changing of the code on preset units would reqiure
|
||
you to go inside the machine, and clip/add a few diodes. With the user set
|
||
ones, all one would have to do is try every code till you get a dial-tone.
|
||
Most sets have 4-8 switches for the security code. This comes out from 8 to
|
||
255 different combinations. The security code is transmitted via a digital
|
||
tone, similiar to that used by IMTS signaling.(More on that in a future
|
||
volume.) To hear what I'm talking about, get your handset and a scanner. Tune
|
||
your scanner to your handset frequency, and bring your handset off hook. As
|
||
you bring it off hook, you should hear a bleeping tone. That is the security
|
||
code being transmitted. Now, if you had a slightly modified 6 meter ham
|
||
transmitter, and lived fairly close to your neighbor with a cordless phone.
|
||
You could possibly record his security code, and play it back through your
|
||
transmitter, thus sucessfully impersonating his handset. While I don't know of
|
||
any compatibilities between cordless phone security codes at this point, if I
|
||
hear of any, they will be posted in a revision of this article.
|
||
|
||
The third security feature was designed, and marketed just recently, this
|
||
security feature is complete digitizing of the phones audio using Pulse Code
|
||
Modulation, very similiar to what's used on digital trunks.
|
||
|
||
|
||
Increasing Your Range
|
||
=====================
|
||
|
||
Once cordless phones came out, someone got the bright idea of extending its
|
||
range. Most people think that some kind of amplifer can be built which would
|
||
give you more power, and extended range. It isn't that simple. Since a
|
||
cordless phone is a full-duplex radio link, an isolator is needed to keep the
|
||
two transmitters seperate. Unless you had a degree in Radio Enginerring, your
|
||
attempts at making this would most likely ruin the unit, and any sucessful
|
||
attempts would make your cordless phone about 10 times its current size.
|
||
However, there is another way to extend your range, and that is by assing an
|
||
external antenna on your roof. This will only work with 46/49 Mhz. units, as
|
||
this antenna will only bost the 49 Mhz. side on 1.7/49 Mhz. units. On those
|
||
phones, the 49 Mhz. side is usually ok, and you'll still have to put up with
|
||
the interference on 1.7 Mhz. In any event, you'll need 5 lengths of stiff
|
||
wire(coathangers) 47 inches long, an SO-239 coaxial cable connector, and enough
|
||
good quality(RG-8) coaxial cable to get from your phone to your roof. The
|
||
cable should have a PL-259 connector on one end, and alligator clips on the
|
||
other. Take the wire, and attach it to the SO-239 as shown:
|
||
|
||
|
||
|
|
||
Wire attached->|
|
||
to center hole |
|
||
|
|
||
^
|
||
Wire attached/===\
|
||
to outer / * \
|
||
holes----> / $ \
|
||
(ground) / | \
|
||
|
|
||
|
|
||
Coaxial |
|
||
Cable --> |
|
||
|
|
||
Down to
|
||
Base
|
||
Unit
|
||
|
||
^
|
||
=== SO-239 Connector
|
||
*
|
||
|
||
|
||
$ PL-259 Connector
|
||
|
||
|
||
At the base Unit, attach the center conducter to the whip antenna, and attach
|
||
the other connector to the chassis(ground). For those lacking in antenna
|
||
building skills, there are also commercially availible units availible for
|
||
about $50.
|
||
|
||
IMTS
|
||
====
|
||
|
||
IMTS, or Improved Mobile Telephone Service is an automated telephone system which used to be the standard of mobile phones until cellular came along. IMTS uses the following frequencies (in Mhz.):
|
||
|
||
Channel Base Freq. Mobile Freq.
|
||
------- ---------- ------------
|
||
ZO 35.26 43.26
|
||
ZF 35.30 43.30
|
||
ZH 35.34 43.34
|
||
ZM 35.38 43.38
|
||
ZA 35.42 43.32
|
||
ZY 35.46 43.46
|
||
ZR 35.50 43.50
|
||
ZB 35.54 43.54
|
||
ZW 35.62 43.62
|
||
ZL 35.66 43.66
|
||
1 152.03 158.49
|
||
3 152.06 158.52
|
||
5 152.09 158.55
|
||
7 152.12 158.58
|
||
9 152.15 158.61
|
||
11 152.18 158.64
|
||
13 152.21 158.67
|
||
JL 152.51 157.77
|
||
YL 152.54 157.80
|
||
JP 152.57 157.83
|
||
YP 152.60 157.86
|
||
YJ 152.63 157.89
|
||
YK 152.66 157.92
|
||
JS 152.69 157.95
|
||
YS 152.72 157.98
|
||
YR 152.75 158.01
|
||
JK 152.78 158.04
|
||
JR 152.81 158.07
|
||
|
||
There are also frequencies allocated in the UHF Range. The base
|
||
frequencies are posted below. The mobiles operate 5 Mhz. above the base
|
||
frequency. Thus, the mobile frequency for channel 21 is 458.025.
|
||
|
||
21 454.025
|
||
22 454.05
|
||
23 454.075
|
||
24 454.10
|
||
25 454.125
|
||
26 454.15
|
||
27 454.175
|
||
28 454.20
|
||
29 454.225
|
||
30 454.25
|
||
31 454.275
|
||
32 454.30
|
||
33 454.325
|
||
34 454.35
|
||
QC 454.375
|
||
QJ 454.40
|
||
QD 454.425
|
||
QA 454.45
|
||
QE 454.475
|
||
QP 454.50
|
||
QK 454.525
|
||
QB 454.55
|
||
QO 454.575
|
||
QR 454.60
|
||
QY 454.625
|
||
QF 454.675
|
||
|
||
Of all these frequencies, the VHF-high band ones are the most popular. If
|
||
you live within 25-50 miles of anything resembling a a moderatly sized town,
|
||
you will have at least 1 VHF-high band channel availible. VHF-low band
|
||
channels are used primarilly in rural areas, and those with mountainous
|
||
terrain. UHF channels are being used in cities where the VHF channels are
|
||
getting crowded. If you live in a major city, expect to have most, if not all
|
||
these channels availible to you.
|
||
|
||
IMTS Signaling:
|
||
|
||
IMTS signaling is accomplised by in-band signaling tones from 1,300 hz. to
|
||
2,200 hz. Two Single frequency tones are alternated, much like ASCII modem
|
||
tones, to produce the digits for the ID number, and destination number. The
|
||
tones are as follows.
|
||
|
||
Base tones:
|
||
Idle - 2,000 hz. - used to indicate an availible channel.
|
||
Sieze - 1,800 hz. - sent as an acknowledgement by the base that a channel has
|
||
been taken.
|
||
Mobile Tones:
|
||
Guard - 2,150 hz. - used when the mobile goes off-hook to sieze a channel, as
|
||
the "space" tone when sending the ID and destination number, and to acknowledge
|
||
an incomming call.
|
||
Connect - 1,633 hz. - used to "pick-up" and incomming call, and as the "mark"
|
||
tone in sending the ID and destination number.
|
||
Disconnect - 1,336 hz. - used to disconnect.
|
||
|
||
To originate a call, the mobile sends 350 ms(milliseconds) of guard tone
|
||
followed by 50 ms of connect tone. The base then sends stops sending the idle
|
||
tone, stays quiet for 250ms, and sends 250ms of sieze tone. The mobile sends
|
||
190ms of guard tone, and sends the ID number at 20 pulses per second. The ID
|
||
number consists of the subscribers A/C and phone number. The pulses consist of
|
||
25 ms of connect tone, follwed by either 25ms of silence or guard tone,
|
||
depending if the digit is odd or even. The interdigit interval is either 190ms
|
||
of silence or guard tone, depending on weither or not the last digit was odd or
|
||
even. Once the ID is sent, dialing is accomplished by sending alternating
|
||
connect and guard tones at 10 pulses per second. A pulse is 60ms of connect
|
||
tone, followed by 40ms of guard tone. To disconnect, send 750ms of disconnect
|
||
tone.
|
||
|
||
Getting an IMTS phone:
|
||
|
||
There are many ways to get an IMTS phone. They can be bought from electronic
|
||
surplus dealers, however these may need some work, and you'll have to figure
|
||
out how to reprogram the thing. I've also seen the ID circutry torn out of
|
||
them when sold as surplus in order to keep people from doing what you're about
|
||
to do. Your best bet is to go to a hamfest/electronic fleamarket, and pick up
|
||
a business band mobile radio. These are surplus units capabile of transmitting
|
||
in the 150-174 Mhz. range. While these units are often modified by hams for
|
||
the 2 meter(144-148 Mhz.), or 3/4 meter (440-450 Mhz.) band. They can be
|
||
modified back for the business band. All that most of these units require to
|
||
be brought into the IMTS band is the proper crystal, and the retuning of a
|
||
capaciter or two. This, along with a cheap VHF-high band reciever makes a full
|
||
duplex radio setup. (Be sure to use headphones with the reciever to avoid
|
||
feedback!) Now you need to duplicate the tones. There are two ways to do this.
|
||
The easiest, and most versatle is to use a computer, and generate the tones,
|
||
but since few computers with tone generating capabilities are portable, an
|
||
alternate method must be found. By wiring up an ordinary phone dial to a dual
|
||
tone audio oscillator, one can duplicate a mobile phone dialer. Plans for this
|
||
unit can be found in 2600 magazine.(See end of file.) With your "IMTS Box.",
|
||
you can either tape an ID number off the air, or generate one with your
|
||
computer. To use your homebrew IMTS phone, find a channel that has an idle
|
||
tone on it, send your connect and ID tone sequence, dial your number, and
|
||
you're connected.
|
||
|
||
|
||
Marine Band
|
||
===========
|
||
|
||
The marine telephone band is for ships at sea to communicate with landbased
|
||
telephones. A marine band telephone call is put through by finding an unused
|
||
frequency, calling the marine operator, and giving her your callsign and phone
|
||
number to call. The frequencies are as follows (in Mhz.).
|
||
|
||
Channel Ship Freq. Shore Freq.
|
||
------- ---------- -----------
|
||
24 157.20 161.8
|
||
84 157.225 161.825
|
||
25 157.25 161.85
|
||
85 157.275 161.875
|
||
26 157.30 161.90
|
||
86 157.325 161.925
|
||
27 157.35 161.95
|
||
87 157.375 161.975
|
||
28 157.40 162.00
|
||
|
||
Marine Band Radiotelephones:
|
||
|
||
While you could take your business band radio, and put in marine band crystals,
|
||
Marine Radiotelephones are easily availible, and somewhat inexpensive
|
||
($100-$300 for a decent radio with VFO, memories and 25 watts). Some places
|
||
may ask you for a marine license, which is no problem. Just write to the FCC,
|
||
and they will send you an application, there are no requirements. Before using
|
||
your radio, listen on the telephone channels for a contact by another ship, and
|
||
copy down the callsign used. Wait a while, and then feel free to use the
|
||
callsign to place a call. DO NOT USE YOUR OWN CALLSIGN IF YOU GOT ONE! If you
|
||
do, expect to pay for a buck a minute minimmum call. Marine telephone is one
|
||
of the easiest ways for "wireless" communications, however, it still presents
|
||
the same dangers as IMTS phreaking.
|
||
|
||
|
||
Ham Radio Autopatch and the Simpatch
|
||
====================================
|
||
|
||
Autopatch is a function put on many ham repeaters allowing the use of a
|
||
phone-line over the air. While one could phreak using an Autopatch, I advise
|
||
you not to, as there is usually a control operator monitoring the machine.
|
||
(Some do it 24 hours a day.), and any attempts at hacking an access code will
|
||
probally be noted. Being a Ham, I'm not going into the subject of Autopatch
|
||
any further than this, as there are better ways to phreak, and Ham's are
|
||
helpful people(Some are even phreaks!) whom you can get assistance on technical
|
||
matters. In short, don't fuck with Autopatches! However, along the lines of
|
||
an autopatch is something called a Simpatch, which is a simpler version of an
|
||
autopatch designed for use with a ham transciver. This device makes a
|
||
wonderful extended-range cordless phone when hooked up into a can. It's major
|
||
drawback is that it's expensive, but anyone with a little electronics backround
|
||
can probally build one. A simpatch can also be used with CB's, or just about
|
||
any other radio. A good idea for an extended range cordless phone would be a
|
||
simpatch, and two CB walkie talkies. One CB would be connected to the Simpatch
|
||
connected to the can and accessed via the second walkie talkie. The entire
|
||
setup could be hidden in a tree and using a wire antenna (dipole of 1/4 wave
|
||
vertical) for a range of 5-20 miles.
|
||
|
||
|
||
Conclusion
|
||
==========
|
||
|
||
Acknowledgements:
|
||
|
||
1) Mobile Phones-Theory and Construction. by The Reasearcher. 2600, April 1986
|
||
Availible from: 2600 Magazine
|
||
P.O. Box 752
|
||
Middle Island, NY 11953
|
||
Write for latest rates on subscriptions and back issues.
|
||
2) Understanding Telephone Electronics. Availible at Radio Shack
|
||
3) American Radio Relay League
|
||
225 Main St.
|
||
Newington, CT 06111
|
||
(has free information on ham radio)
|
||
|
||
Thanks go to The Datamaster, Peter Pulse, Bellcon, and The Surge for their
|
||
assistance.
|
||
|
||
-Mr. Icom
|
||
March 29, 1987, Updated April 17, 1987
|
||
|
||
End of File.
|
||
|
||
|